# changelog

author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.56.1
   - gadget/install: do not assume dm device has same block size as
     disk
   - gadget: check also mbr type when testing for implicit data
     partition
   - interfaces: update network-control interface with permissions
     required by resolvectl
   - interfaces/builtin: remove the name=org.freedesktop.DBus
     restriction in cups-control AppArmor rules
   - many: print valid/invalid status on snap validate --monitor ...
   - o/snapstate: fix validation sets restoring and snap revert on
     failed refresh
   - interfaces/opengl: update allowed PCI accesses for RPi
   - interfaces/shared-memory: Update AppArmor permissions for
     mmap+linkpaths


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.56.2
   - o/snapstate: exclude services from refresh app awareness hard
     running check
   - cmd/snap: support custom apparmor features dir with snap
     prepare-image


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.57
   - tests: Fix calls to systemctl is-system-running
   - osutil/disks: handle GPT for 4k disk and too small tables
   - packaging: import change from the 2.54.3-1.1 upload
   - many: revert "features: disable refresh-app-awarness by default
     again"
   - tests: improve robustness of preparation for regression/lp-1803542
   - tests: get the ubuntu-image binary built with test keys
   - tests: remove commented code from lxd test
   - interfaces/builtin: add more permissions for steam-support
   - tests: skip interfaces-network-control on i386
   - tests: tweak the "tests/nested/manual/connections" test
   - interfaces: posix-mq: allow specifying message queue paths as an
     array
   - bootloader/assets: add ttyS0,115200n8 to grub.cfg
   - i/b/desktop,unity7: remove name= specification on D-Bus signals
   - tests: ensure that microk8s does not produce DENIED messages
   - many: support non-default provenance snap-revisions in
     DeriveSideInfo
   - tests: fix `core20-new-snapd-does-not-break-old-initrd` test
   - many: device and provenance revision authority cross checks
   - tests: fix nested save-data test on 22.04
   - sandbox/cgroup: ignore container slices when tracking snaps
   - tests: improve 'ignore-running' spread test
   - tests: add `debug:` section to `tests/nested/manual/connections`
   - tests: remove leaking `pc-kernel.snap` in `repack_kernel_snap`
   - many: preparations for revision authority cross checks including
     device scope
   - daemon,overlord/servicestate: followup changes from PR #11960 to
     snap logs
   - cmd/snap: fix visual representation of 'AxB%' cpu quota modifier.
   - many: expose and support provenance from snap.yaml metadata
   - overlord,snap: add support for per-snap storage on ubuntu-save
   - nested: fix core-early-config nested test
   - tests: revert lxd change to support nested lxd launch
   - tests: add invariant check for leftover cgroup scopes
   - daemon,systemd: introduce support for namespaces in 'snap logs'
   - cmd/snap: do not track apps that wish to stay outside of the life-
     cycle system
   - asserts: allow classic + snaps models and add distribution to
     model
   - cmd/snap: add snap debug connections/connection commands
   - data: start snapd after time-set.target
   - tests: remove ubuntu 21.10 from spread tests due to end of life
   - tests: Update the whitebox word to avoid inclusive naming issues
   - many: mount gadget in run folder
   - interfaces/hardware-observe: clean up reading access to sysfs
   - tests: use overlayfs for interfaces-opengl-nvidia test
   - tests: update fake-netplan-apply test for 22.04
   - tests: add executions for ubuntu 22.04
   - tests: enable centos-9
   - tests: make more robust the files check in preseed-core20 test
   - bootloader/assets: add fallback entry to grub.cfg
   - interfaces/apparmor: add permissions for per-snap directory on
     ubuntu-save partition
   - devicestate: add more path to `fixupWritableDefaultDirs()`
   - boot,secboot: reset DA lockout counter after successful boot
   - many: Revert "overlord,snap: add support for per-snap storage on
     ubuntu-save"
   - overlord,snap: add support for per-snap storage on ubuntu-save
   - tests: exclude centos-7 from kernel-module-load test
   - dirs: remove unused SnapAppArmorAdditionalDir
   - boot,device: extract SealedKey helpers from boot to device
   - boot,gadget: add new `device.TpmLockoutAuthUnder()` and use it
   - interfaces/display-control: allow changing brightness value
   - asserts: add more context to key expiry error
   - many: introduce IsUndo flag in LinkContext
   - i/apparmor: allow calling which.debianutils
   - tests: new profile id for apparmor in test preseed-core20
   - tests: detect 403 in apt-hooks and skip test in this case
   - overlord/servicestate: restart the relevant journald service when
     a journal quota group is modified
   - client,cmd/snap: add journal quota frontend (5/n)
   - gadget/device: introduce package which provides helpers for
     locations of things
   - features: disable refresh-app-awarness by default again
   - many: install bash completion files in writable directory
   - image: fix handling of var/lib/extrausers when preseeding
     uc20
   - tests: force version 2.48.3 on xenial ESM
   - tests: fix snap-network-erros on uc16
   - cmd/snap-confine: be compatible with a snap rootfs built as a
     tmpfs
   - o/snapstate: allow install of unasserted gadget/kernel on
     dangerous models
   - interfaces: dynamic loading of kernel modules
   - many: add optional primary key provenance to snap-revision, allow
     delegating via snap-declaration revision-authority
   - tests: fix boringcripto errors in centos7
   - tests: fix snap-validate-enforce in opensuse-tumbleweed
   - test: print User-Agent on failed checks
   - interfaces: add memory stats to system_observe
   - interfaces/pwm: Remove implicitOnCore/implicitOnClassic
   - spread: add openSUSE Leap 15.4
   - tests: disable core20-to-core22 nested test
   - tests: fix nested/manual/connections test
   - tests: add spread test for migrate-home command
   - overlord/servicestate: refresh security profiles when services are
     affected by quotas
   - interfaces/apparmor: add missing apparmor rules for journal
     namespaces
   - tests: add nested test variant that adds 4k sector size
   - cmd/snap: fix test failing due to timezone differences
   - build-aux/snap: build against the snappy-dev/image PPA
   - daemon: implement api handler for refresh with enforced validation
     sets
   - preseed: suggest to install "qemu-user-static"
   - many: add migrate-home debug command
   - o/snapstate: support passing validation sets to storehelpers via
     RevisionOptions
   - cmd/snapd-apparmor: fix unit tests on distros which do not support
     reexec
   - o/devicestate: post factory reset ensure, spread test update
   - tests/core/basic20: Enable on uc22
   - packaging/arch: install snapd-apparmor
   - o/snapstate: support migrating snap home as change
   - tests: enable snapd.apparmor service in all the opensuse systems
   - snapd-apparmor: add more integration-ish tests
   - asserts: store required revisions for missing snaps in
     CheckInstalledSnaps
   - overlord/ifacestate: fix path for journal redirect
   - o/devicestate: factory reset with encryption
   - cmd/snapd-apparmor: reimplement snapd-apparmor in Go
   - squashfs: improve error reporting when `unsquashfs` fails
   - o/assertstate: support multiple extra validation sets in
     EnforcedValidationSets
   - tests: enable mount-order-regression test for arm devices
   - tests: fix interfaces network control
   - interfaces: update AppArmor template to allow read the memory …
   - cmd/snap-update-ns: add /run/systemd to unrestricted paths
   - wrappers: fix LogNamespace being written to the wrong file
   - boot: release the new PCR handles when sealing for factory reset
   - tests: add support fof uc22 in test uboot-unpacked-assets
   - boot: post factory reset cleanup
   - tests: add support for uc22 in listing test
   - spread.yaml: add ubuntu-22.04-06 to qemu-nested
   - gadget: check also mbr type when testing for implicit data
     partition
   - interfaces/system-packages-doc: allow read-only access to
     /usr/share/cups/doc-root/ and /usr/share/gimp/2.0/help/
   - tests/nested/manual/core20-early-config: revert changes that
     disable netplan checks
   - o/ifacestate: warn if the snapd.apparmor service is disabled
   - tests: add spread execution for fedora 36
   - overlord/hookstate/ctlcmd: fix timestamp coming out of sync in
     unit tests
   - gadget/install: do not assume dm device has same block size as
     disk
   - interfaces: update network-control interface with permissions
     required by resolvectl
   - secboot: stage and transition encryption keys
   - secboot, boot: support and use alternative PCR handles during
     factory reset
   - overlord/ifacestate: add journal bind-mount snap layout when snap
     is in a journal quota group (4/n)
   - secboot/keymgr, cmd/snap-fde-keymgr: two step encryption key
     change
   - cmd/snap: cleanup and make the code a bit easier to read/maintain
     for quota options
   - overlord/hookstate/ctlcmd: add 'snapctl model' command (3/3)
   - cmd/snap-repair: fix snap-repair tests silently failing
   - spread: drop openSUSE Leap 15.2
   - interfaces/builtin: remove the name=org.freedesktop.DBus
     restriction in cups-control AppArmor rules
   - wrappers: write journald config files for quota groups with
     journal quotas (3/n)
   - o/assertstate: auto aliases for apps that exist
   - o/state: use more detailed NoStateError in state
   - tests/main/interfaces-browser-support: verify jupyter notebooks
     access
   - o/snapstate: exclude services from refresh app awareness hard
     running check
   - tests/main/nfs-support: be robust against umount failures
   - tests: update centos images and add new centos 9 image
   - many: print valid/invalid status on snap validate --monitor
   - secboot, boot: TPM provisioning mode enum, introduce
     reprovisioning
   - tests: allow to re-execute aborted tests
   - cmd/snapd-apparmor: add explicit WSL detection to
     is_container_with_internal_policy
   - tests: avoid launching lxd inside lxd on cloud images
   - interfaces: extra htop apparmor rules
   - gadget/install: encrypted system factory reset support
   - secboot: helpers for dealing with PCR handles and TPM resources
   - systemd: improve error handling for systemd-sysctl command
   - boot, secboot: separate the TPM provisioning and key sealing
   - o/snapstate: fix validation sets restoring and snap revert on
     failed refresh
   - interfaces/builtin/system-observe: extend access for htop
   - cmd/snap: support custom apparmor features dir with snap prepare-
     image
   - interfaces/mount-observe: Allow read access to /run/mount/utab
   - cmd/snap: add help strings for set-quota options
   - interfaces/builtin: add README file
   - cmd/snap-confine: mount support cleanups
   - overlord: execute snapshot cleanup in task
   - i/b/accounts_service: fix path of introspectable objects
   - interfaces/opengl: update allowed PCI accesses for RPi
   - configcore: add core.system.ctrl-alt-del-action config option
   - many: structured startup timings
   - spread: switch back to building ubuntu-image from source
   - many: optional recovery keys
   - tests/lib/nested: fix unbound variable
   - run-checks: fail on equality checks w/ ErrNoState
   - snap-bootstrap: Mount as private
   - tests: Test for gadget connections
   - tests: set `br54.dhcp4=false` in the netplan-cfg test
   - tests: core20 preseed/nested spread test
   - systemd: remove the systemctl stop timeout handling
   - interfaces/shared-memory: Update AppArmor permissions for
     mmap+link
   - many: replace ErrNoState equality checks w/ errors.Is()
   - cmd/snap: exit w/ non-zero code on missing snap
   - systemd: fix snapd systemd-unit stop progress notifications
   - .github: Trigger daily riscv64 snapd edge builds
   - interfaces/serial-port: add ttyGS to serial port allow list
   - interfaces/modem-manager: Don't generate DBus plug policy
   - tests: add spread test to test upgrade from release snapd to
     current
   - wrappers: refactor EnsureSnapServices
   - testutil: add ErrorIs test checker
   - tests: import spread shellcheck changes
   - cmd/snap-fde-keymgr: best effort idempotency of add-recovery-key
   - interfaces/udev: refactor handling of udevadm triggers for input
   - secboot: support for changing encryption keys via keymgr


author: Alberto Mardegan <alberto.mardegan@canonical.com>
changelog:
  - New upstream release 2.57.1
   - cmd/snap-update-ns: handle mountpoint removal failures with EBUSY
   - cmd/snap-update-ns: print current mount entries
   - cmd/snap-update-ns: check the unused mounts with a cleaned path
   - snap-confine: disable -Werror=array-bounds in __overflow tests to
     fix build error on Ubuntu 22.10
   - systemd: add `WantedBy=default.target` to snap mount units
     (LP: #1983528)


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.57.2
   - store/tooling,tests: support UBUNTU_STORE_URL override env var
   - packaging/*/tests/integrationtests: reload ssh.service, not
     sshd.service
   - tests: check snap download with snapcraft v7+ export-login auth
     data
   - store/tooling: support using snapcraft v7+ base64-encoded auth
     data
   - many: progress bars should use the overridable stdouts
   - many: refactor store code to be able to use simpler form of auth
     creds
   - snap,store: drop support/consideration for anonymous download urls
   - data: include snapd/mounts in preseeded blob
   - many: Set SNAPD_APPARMOR_REEXEC=1
   - overlord: track security profiles for non-active snaps


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.57.3
   - wrappers: journal namespaces did not honor journal.persistent
   - snap/quota,wrappers: allow using 0 values for the journal rate to
     override the system default values
   - multiple: clear up naming convention for cpu-set quota
   - i/b/mount-control: allow custom filesystem types
   - i/b/system-observe: allow reading processes security label
   - sandbox/cgroup: don't check V1 cgroup if V2 is active
   - asserts,boot,secboot: switch to a secboot version measuring
     classic


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.57.4
   - release, snapd-apparmor: fixed outdated WSL detection
   - overlord/ifacestate: fix conflict detection of auto-connection
   - overlord: run install-device hook during factory reset
   - image/preseed/preseed_linux: add missing new line
   - boot: add factory-reset cases for boot-flags.
   - interfaces: added read/write access to /proc/self/coredump_filter
     for process-control
   - interfaces: add read access to /proc/cgroups and
     /proc/sys/vm/swappiness to system-observe
   - fde: run fde-reveal-key with `DefaultDependencies=no`
   - snapdenv: added wsl to userAgent
   - tests: fix restore section for persistent-journal-namespace
   - i/b/mount-control: add optional `/` to umount rules
   - cmd/snap-bootstrap: changes to be able to boot classic rootfs
   - cmd/snap-bootstrap: add CVM mode


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.57.5
   - image: clean snapd mount after preseeding
   - wrappers,snap/quota: clear LogsDirectory= in the service unit
     for journal namespaces
   - cmd/snap,daemon: allow zero values from client to daemon for
     journal rate-limit
   - interfaces: steam-support allow pivot /run/media and /etc/nvidia
     mount
   - o/ifacestate: introduce DebugAutoConnectCheck hook
   - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
   - autopkgtests: fix running autopkgtest on kinetic
   - interfaces: add microceph interface
   - interfaces: steam-support allow additional mounts
   - many: add stub services
   - interfaces: add kconfig paths to system-observe
   - i/b/system_observe: honour root dir when checking for
     /boot/config-*
   - interfaces: grant access to speech-dispatcher socket
   - interfaces: rework logic of unclashMountEntries


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.57.6
    - SECURITY UPDATE: Local privilege escalation
      - snap-confine: Fix race condition in snap-confine when preparing a
        private tmp mount namespace for a snap
      - CVE-2022-3328


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.58
   - many: Use /tmp/snap-private-tmp for per-snap private tmps
   - data: Add systemd-tmpfiles configuration to create private tmp dir
   - cmd/snap: test allowed and forbidden refresh hold values
   - cmd/snap: be more consistent in --hold help and err messages
   - cmd/snap: error on refresh holds that are negative or too short
   - o/homedirs: make sure we do not write to /var on build time
   - image: make sure file customizations happen also when we have
     defaultscause
   - tests/fde-on-classic: set ubuntu-seed label in seed partitions
   - gadget: system-seed-null should also have fs label ubuntu-seed
   - many: gadget.HasRole, ubuntu-seed can come also from system-seed-
     null
   - o/devicestate: fix paths for retrieving recovery key on classic
   - cmd/snap-confine: do not discard const qualifier
   - interfaces: allow python3.10+ in the default template
   - o/restart: fix PendingForSystemRestart
   - interfaces: allow wayland slot snaps to access shm files created
     by Firefox
   - o/assertstate: add Sequence() to val set tracking
   - o/assertstate: set val set 'Current' to pinned sequence
   - tests: tweak the libvirt interface test to work on 22.10
   - tests: use system-seed-null role on classic with modes tests
   - boot: add directory for data on install
   - o/devicestate: change some names from esp to seed/seed-null
   - gadget: add system-seed-null role
   - o/devicestate: really add error to new error message
   - restart,snapstate: implement reboot-required notifications on
     classic
   - many: avoid automatic system restarts on classic through new
     overlord/restart logic
   - release: Fix WSL detection in LXD
   - o/state: introduce WaitStatus
   - interfaces: Fix desktop interface rules for document portal
   - client: remove classic check for `snap recovery --show-
     keys`
   - many: create snapd.mounts targets to schedule mount units
   - image: enable sysfs overlay for UC preseeding
   - i/b/network-control: add permissions for using AF_XDP
   - i/apparmor: move mocking of home and overlay conditions to osutil
   - tests/main/degraded: ignore man-db update failures in CentOS
   - cmd/snap: fix panic when running snap w/ flag but w/o subcommand
   - tests: save snaps generated during image preaparation
   - tests: skip building snapd based on new env var
   - client: remove misleading comments in ValidateApplyOptions
   - boot/seal: add debug traces for bootchains
   - bootloader/assets: fix grub.cfg when there are no labels
   - cmd/snap: improve refresh hold's output
   - packaging: enable BPF in RHEL9
   - packaging: do not traverse filesystems in postrm script
   - tests: get microk8s from another branch
   - bootloader: do not specify Core version in grub entry
   - many: refresh --hold follow-up
   - many: support refresh hold/unhold to API and CLI
   - many: expand fully handling links mapping in all components, in
     the API and in snap info
   - snap/system_usernames,tests: Azure IoT Edge system usernames
   - interface: Allow access to
     org.freedesktop.DBus.ListActivatableNames via system-observe
     interface
   - o/devicestate,daemon: use the expiration date from the assertion
     in user-state and REST api (user-removal 4/n)
   - gadget: add unit tests for new install functions for FDE on
     classic
   - cmd/snap-seccomp: fix typo in AF_XDP value
   - tests/connected-after-reboot-revert: run also on UC16
   - kvm: allow read of AMD-SEV parameters
   - data: tweak apt integration config var
   - o/c/configcore: add faillock configuration
   - tests: use dbus-daemon instead of dbus-launch
   - packaging: remove unclean debian-sid patch
   - asserts: add keyword 'user-presence' keyword in system-user
     assertion (auto-removal 3/n)
   - interfaces: steam-support allow pivot /run/media and /etc/nvidia
     mount
   - aspects: initial code
   - overlord: process auto-import assertion at first boot
   - release, snapd-apparmor, syscheck: distinguish WSL1 and WSL2
   - tests: fix lxd-mount-units in ubuntu kinetic
   - tests: new variable used to configure the kernel command line in
     nested tests
   - go.mod: update to newer secboot/uc22 branch
   - autopkgtests: fix running autopkgtest on kinetic
   - tests: remove squashfs leftovers in fakeinstaller
   - tests: create partition table in fakeinstaller
   - o/ifacestate: introduce DebugAutoConnectCheck hook
   - tests: use test-snapd-swtpm instead of swtpm-mvo snap in nested
     helper
   - interfaces/polkit: do not require polkit directory if no file is
     needed
   - o/snapstate: be consistent not creating per-snap save dirs for
     classic models
   - inhibit: use hintFile()
   - tests: use `snap prepare-image` in fde-on-classic mk-image.sh
   - interfaces: add microceph interface
   - seccomp: allow opening XDP sockets
   - interfaces: allow access to icon subdirectories
   - tests: add minimal-smoke test for UC22 and increase minimal RAM
   - overlord: introduce hold levels in the snapstate.Hold* API
   - o/devicestate: support mounting ubuntu-save also on classic with
     modes
   - interfaces: steam-support allow additional mounts
   - fakeinstaller: format SystemDetails result with %+v
   - cmd/libsnap-confine-private: do not panic on chmod failure
   - tests: ensure that fakeinstaller put the seed into the right place
   - many: add stub services for prompting
   - tests: add libfwupd and libfwupdplugin5 to openSUSE dependencies
   - o/snapstate: fix snaps-hold pruning/reset in the presence of
     system holding
   - many: add support for setting up encryption from installer
   - many: support classic snaps in the context of classic and extended
     models
   - cmd/snap,daemon: allow zero values from client to daemon for
     journal rate limit
   - boot,o/devicestate: extend HasFDESetupHook to consider unrelated
     kernels
   - cmd/snap: validation set refresh-enforce CLI support + spread test
   - many: fix filenames written in modeenv for base/gadget plus drive-
     by TODO
   - seed: fix seed test to use a pseudo-random byte sequence
   - cmd/snap-confine: remove setuid calls from cgroup init code
   - boot,o/devicestate: introduce and use MakeRunnableStandaloneSystem
   - devicestate,boot,tests: make `fakeinstaller` test work
   - store: send Snap-Device-Location header with cloud information
   - overlord: fix unit tests after merging master in
   - o/auth: move HasUserExpired into UserState and name it HasExpired,
     and add unit tests for this
   - o/auth: rename NewUserData to NewUserParams
   - many: implementation of finish install step handlers
   - overlord: auto-resolve validation set enforcement constraints
   - i/backends,o/ifacestate: cleanup backends.All
   - cmd/snap-confine: move bind-mount setup into separate function
   - tests/main/mount-ns: update namespace for 18.04
   - o/state: Hold pseudo-error for explicit holding, concept of
     pending changes in prune logic
   - many: support extended classic models that omit kernel/gadget
   - data/selinux: allow snapd to detect WSL
   - overlord: add code to remove users that has an expiration date set
   - wrappers,snap/quota: clear LogsDirectory= in the service unit for
     journal namespaces
   - daemon: move user add, remove operations to overlord device state
   - gadget: implement write content from gadget information
   - {device,snap}state: fix ineffectual assignments
   - daemon: support validation set refresh+enforce in API
   - many: rename AddAffected* to RegisterAffected*, add
     Change|State.Has, fix a comment
   - many: reset store session when setting proxy.store
   - overlord/ifacestate: fix conflict detection of auto-connection
   - interfaces: added read/write access to /proc/self/coredump_filter
     for process-control
   - interfaces: add read access to /proc/cgroups and
     /proc/sys/vm/swappiness to system-observe
   - fde: run fde-reveal-key with `DefaultDependencies=no`
   - many: don't concatenate non-constant format strings
   - o/devicestate: fix non-compiling test
   - release, snapd-apparmor: fixed outdated WSL detection
   - many: add todos discussed in the review in
     tests/nested/manual/fde-on-classic, snapstate cleanups
   - overlord: run install-device hook during factory reset
   - i/b/mount-control: add optional `/` to umount rules
   - gadget/install: split Run in several functions
   - o/devicestate: refactor some methods as preparation for install
     steps implementation
   - tests: fix how snaps are cached in uc22
   - tests/main/cgroup-tracking-failure: fix rare failure in Xenial and
     Bionic
   - many: make {Install,Initramfs}{{,Host},Writable}Dir a  function
   - tests/nested/manual/core20: fix manual test after changes to
     'tests.nested exec'
   - tests: move the unit tests system to 22.04 in github actions
     workflow
   - tests: fix nested errors uc20
   - boot: rewrite switch in SnapTypeParticipatesInBoot()
   - gadget: refactor to allow usage from the installer
   - overlord/devicestate: support for mounting ubuntu-save before the
     install-device hook
   - many: allow to install/update kernels/gadgets on classic with
     modes
   - tests: fix issues related to dbus session and localtime in uc18
   - many: support home dirs located deeper under /home
   - many: refactor tests to use explicit strings instead of
     boot.Install{Initramfs,Host}{Writable,FDEData}Dir
   - boot: add factory-reset cases for boot-flags
   - tests: disable quota tests on arm devices using ubuntu core
   - tests: fix unbound SPREAD_PATH variable on nested debug session
   - overlord: start turning restart into a full state manager
   - boot: apply boot logic also for classic with modes boot snaps
   - tests: fix snap-env test on debug section when no var files were
     created
   - overlord,daemon: allow returning errors when requesting a restart
   - interfaces: login-session-control: add further D-Bus interfaces
   - snapdenv: added wsl to userAgent
   - o/snapstate: support running multiple ops transactionally
   - store: use typed valset keys in store package
   - daemon: add `ensureStateSoon()` when calling systems POST api
   - gadget: add rules for validating classic with modes gadget.yaml
     files
   - wrappers: journal namespaces did not honor journal.persistent
   - many: stub devicestate.Install{Finish,SetupStorageEncryption}()
   - sandbox/cgroup: don't check V1 cgroup if V2 is active
   - seed: add support to load auto import assertion
   - tests: fix preseed tests for arm systems
   - include/lk: update LK recovery environment definition to include
     device lock state used by bootloader
   - daemon: return `storage-encryption` in /systems/<label> reply
   - tests: start using remote tools from snapd-testing-tools project
     in nested tests
   - tests: fix non mountable filesystem error in interfaces-udisks2
   - client: clarify what InstallStep{SetupStorageEncryption,Finish} do
   - client: prepare InstallSystemOptions for real use
   - usersession: Remove duplicated struct
   - o/snapstate: support specific revisions in UpdateMany/InstallMany
   - i/b/system_packages_doc: restore access to Libreoffice
     documentation
   - snap/quota,wrappers: allow using 0 values for the journal rate
     limit
   - tests: add kinetic images to the gce bucket for preseed test
   - multiple: clear up naming convention for thread quota
   - daemon: implement stub `"action": "install"`
   - tests/main/snap-quota-{install/journal}: fix unstable spread tests
   - tests: remove code for old systems not supported anymore
   - tests: third part of the nested helper cleanup
   - image: clean snapd mount after preseeding
   - tests: use the new ubuntu kinetic image
   - i/b/system_observe: honour root dir when checking for
     /boot/config-*
   - tests: restore microk8s test on 16.04
   - tests: run spread tests on arm64 instances in google cloud
   - tests: skip interfaces-udisks2 in fedora
   - asserts,boot,secboot: switch to a secboot version measuring
     classic
   - client: add API for GET /systems/<label>
   - overlord: frontend for --quota-group support (2/2)
   - daemon: add GET support for `/systems/<seed-label>`
   - i/b/system-observe: allow reading processes security label
   - many: support '--purge' when removing multiple snaps
   - snap-confine: remove obsolete code
   - interfaces: rework logic of unclashMountEntries
   - data/systemd/Makefile: add comment warning about "snapd." prefix
   - interfaces: grant access to speech-dispatcher socket (bug 1787245)
   - overlord/servicestate: disallow removal of quota group with any
     limits set
   - data: include snapd/mounts in preseeded blob
   - many: Set SNAPD_APPARMOR_REEXEC=1
   - store/tooling,tests: support UBUNTU_STORE_URL override env var
   - multiple: clear up naming convention for cpu-set quota
   - tests: improve and standardize debug section on tests
   - device: add new DeviceManager.encryptionSupportInfo()
   - tests: check snap download with snapcraft v7+ export-login auth
     data
   - cmd/snap-bootstrap: changes to be able to boot classic rootfs
   - tests: fix debug section for test uc20-create-partitions
   - overlord: --quota-group support (1/2)
   - asserts,cmd/snap-repair: drop not pursued
     AuthorityDelegation/signatory-id
   - snap-bootstrap: add CVM mode* snap-bootstrap: add classic runmode
   - interfaces: make polkit implicit on core if /usr/libexec/polkitd
     exists
   - multiple: move arguments for auth.NewUser into a struct (auto-
     removal 1/n)
   - overlord: track security profiles for non-active snaps
   - tests: remove NESTED_IMAGE_ID from nested manual tests
   - tests: add extra space to ubuntu bionic
   - store/tooling: support using snapcraft v7+ base64-encoded auth
     data
   - overlord: allow seeding in the case of classic with modes system
   - packaging/*/tests/integrationtests: reload ssh.service, not
     sshd.service
   - tests: rework snap-logs-journal test and add missing cleanup
   - tests: add spread test for journal quotas
   - tests: run spread tests in ubuntu kinetic
   - o/snapstate: extend support for holding refreshes
   - devicestate: return an error in checkEncryption() if KernelInfo
     fails
   - tests: fix sbuild test on debian sid
   - o/devicestate: do not run tests in this folder twice
   - sandbox/apparmor: remove duplicate hook into testing package
   - many: refactor store code to be able to use simpler form of auth
     creds
   - snap,store: drop support/consideration for anonymous download urls
   - data/selinux: allow snaps to read certificates
   - many: add Is{Core,Classic}Boot() to DeviceContext
   - o/assertstate: don't refresh enforced validation sets during check
   - go.mod: replace maze.io/x/crypto with local repo
   - many: fix unnecessary use of fmt.Sprintf
   - bootloader,systemd: fix `don't use Yoda conditions (ST1017)`
   - HACKING.md: extend guidelines with common review comments
   - many: progress bars should use the overridable stdouts
   - tests: remove ubuntu 21.10 from sru validation
   - tests: import remote tools
   - daemon,usersession: switch from HeaderMap to Header in tests
   - asserts: add some missing `c.Check()` in the asserts test
   - strutil: fix VersionCompare() to allow multiple `-` in the version
   - testutil: remove unneeded `fmt.Sprintf`
   - boot: remove some unneeded `fmt.Sprintf()` calls
   - tests: implement prepare_gadget and prepare_base and unify all the
     version
   - o/snapstate: refactor managed refresh schedule logic
   - o/assertstate, snapasserts: implementation of
     assertstate.TryEnforceValidationSets function
   - interfaces: add kconfig paths to system-observe
   - dbusutil: move debian patch into dbustest
   - many: change name and input of CheckProvenance to clarify usage
   - tests: Fix a missing parameter in command to wait for device
   - tests: Work-around non-functional --wait on systemctl
   - tests: unify the way the snapd/core and kernel are repacked in
     nested helper
   - tests: skip interfaces-ufisks2 on centos-9
   - i/b/mount-control: allow custom filesystem types
   - interfaces,metautil: make error handling in getPaths() more
     targeted
   - cmd/snap-update-ns: handle mountpoint removal failures with EBUSY
   - tests: fix pc-kernel repacking
   - systemd: add `WantedBy=default.target` to snap mount units
   - tests: disable microk8s test on 16.04


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.58.1
   - secboot: detect lockout mode in CheckTPMKeySealingSupported
   - cmd/snap-update-ns: prevent keeping unneeded mountpoints
   - o/snapstate: do not infinitely retry when an update fails during
     seeding
   - interfaces/modem-manager: add permissions for NETLINK_ROUTE
   - systemd/emulation.go: use `systemctl --root` to enable/disable
   - snap: provide more error context in `NotSnapError`
   - interfaces: add read access to /run for cryptsetup
   - boot: avoid reboot loop if there is a bad try kernel
   - devicestate: retry serial acquire on time based certificate
     errors
   - o/devicestate: run systemctl daemon-reload after install-device
     hook
   - cmd/snap,daemon: add 'held' to notes in 'snap list'
   - o/snapshotstate: check snapshots are self-contained on import
   - cmd/snap: show user+gating hold info in 'snap info'
   - daemon: expose user and gating holds at /v2/snaps/{name}


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.58.3
   - interfaces/screen-inhibit-control: Add support for xfce-power-
     manager
   - interfaces/network-manager: do not show ptrace read
     denials
   - interfaces: relax rules for mount-control `what` for functionfs
   - cmd/snap-bootstrap: add support for snapd_system_disk
   - interfaces/modem-manager: add net_admin capability
   - interfaces/network-manager: add permission for OpenVPN
   - httputil: fix checking x509 certification error on go 1.20
   - i/b/fwupd: allow reading host os-release
   - boot: on classic+modes `MarkBootSuccessfull` does not need a base
   - boot: do not include `base=` in modeenv for classic+modes installs
   - tests: add spread test that validates revert on boot for core does
     not happen on classic+modes
   - snapstate: only take boot participants into account in
     UpdateBootRevisions
   - snapstate: refactor UpdateBootRevisions() to make it easier to
     check for boot.SnapTypeParticipatesInBoot()


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.60
   - Support for dynamic snapshot data exclusions
   - Apparmor userspace is vendored inside the snapd snap
   - Added a default-configure hook that exposes gadget default
     configuration options to snaps during first install before
     services are started
   - Allow install from initrd to speed up the initial installation
     for systems that do not have a install-device hook
   - New `snap sign --chain` flag that appends the account and
     account-key assertions
   - Support validation-sets in the model assertion
   - Support new "min-size" field in gadget.yaml
   - New interface: "userns"


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.60.1
   - install: fallback to lazy unmount() in writeFilesystemContent
   - data: include "modprobe.d" and "modules-load.d" in preseeded blob
   - gadget: fix install test on armhf
   - interfaces: fix typo in network_manager_observe
   - sandbox/apparmor: don't let vendored apparmor conflict with system
   - gadget/update: set parts in laid out data from the ones matched
   - many: move SnapConfineAppArmorDir from dirs to sandbox/apparmor
   - many: stop using `-O no-expr-simplify` in apparmor_parser
   - go.mod: update secboot to latest uc22 branch


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.60.2
   - i/builtin: allow directories in private /dev/shm
   - i/builtin: add read access to /proc/task/schedstat in system-
     observe
   - snap-bootstrap: print version information at startup
   - go.mod: update gopkg.in/yaml.v3 to v3.0.1 to fix CVE-2022-28948
   - snap, store: filter out invalid snap edited links from store info
     and persisted state
   - o/configcore: write netplan defaults to 00-snapd-config on seeding
   - snapcraft.yaml: pull in apparmor_parser optimization patches from
     https://gitlab.com/apparmor/apparmor/-/merge_requests/711
   - snap-confine: fix missing \0 after readlink
   - cmd/snap: hide append-integrity-data
   - interfaces/opengl: add support for ARM Mali


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.60.3
   - i/b/shared-memory: handle "private" plug attribute in shared-
     memory interface correctly
   - i/apparmor: support for home.d tunables from /etc/


author: Michael Vogt <michael.vogt@ubuntu.com>
changelog:
  - New upstream release 2.60.4
   - i/b/qualcomm_ipc_router.go: switch to plug/slot and add socket
     permission
   - interfaces/builtin: fix custom-device udev KERNEL values
   - overlord: allow the firmware-updater snap to install user daemons
   - interfaces: allow loopback as a block-device


author: Philip Meulengracht <philip.meulengracht@canonical.com>
changelog:
  - New upstream release 2.61
   - Fix control of activated services in 'snap start' and 'snap stop'
   - Correctly reflect activated services in 'snap services'
   - Disabled services are no longer enabled again when snap is
     refreshed
   - interfaces/builtin: added support for Token2 U2F keys
   - interfaces/u2f-devices: add Swissbit iShield Key
   - interfaces/builtin: update gpio apparmor to match pattern that
     contains multiple subdirectories under /sys/devices/platform
   - interfaces: add a polkit-agent interface
   - interfaces: add pcscd interface
   - Kernel command-line can now be edited in the gadget.yaml
   - Only track validation-sets in run-mode, fixes validation-set
     issues on first boot.
   - Added support for using store.access to disable access to snap
     store
   - Support for fat16 partition in gadget
   - Pre-seed authority delegation is now possible
   - Support new system-user name  daemon
   - Several bug fixes and improvements around remodelling
   - Offline remodelling support


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.61.1
   - Stop requiring default provider snaps on image building and first
     boot if alternative providers are included and available
   - Fix auth.json access for login as non-root group ID
   - Fix incorrect remodelling conflict when changing track to older
     snapd version
   - Improved check-rerefresh message
   - Fix UC16/18 kernel/gadget update failure due volume mismatch with
     installed disk
   - Stop auto-import of assertions during install modes
   - Desktop interface exposes GetIdletime
   - Polkit interface support for new polkit versions
   - Fix not applying snapd snap changes in tracked channel when remodelling


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.61.2
   - Fix to enable plug/slot sanitization for prepare-image
   - Fix panic when device-service.access=offline
   - Support offline remodeling
   - Allow offline update only remodels without serial
   - Fail early when remodeling to old model revision
   - Fix to enable plug/slot sanitization for validate-seed
   - Allow removal of core snap on classic systems
   - Fix network-control interface denial for file lock on /run/netns
   - Add well-known core24 snap-id
   - Fix remodel snap installation order
   - Prevent remodeling from UC18+ to UC16
   - Fix cups auto-connect on classic with cups snap installed
   - u2f-devices interface support for GoTrust Idem Key with USB-C
   - Fix to restore services after unlink failure
   - Add libcudnn.so to Nvidia libraries
   - Fix skipping base snap download due to false snapd downgrade
     conflict


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.62
   - Aspects based configuration schema support (experimental)
   - Refresh app awareness support for UI (experimental)
   - Support for user daemons by introducing new control switches
     --user/--system/--users for service start/stop/restart
     (experimental)
   - Add AppArmor prompting experimental flag (feature currently
     unsupported)
   - Installation of local snap components of type test
   - Packaging of components with snap pack
   - Expose experimental features supported/enabled in snapd REST API
     endpoint /v2/system-info
   - Support creating and removing recovery systems for use by factory
     reset
   - Enable API route for creating and removing recovery systems using
     /v2/systems with action create and /v2/systems/{label} with action
     remove
   - Lift requirements for fde-setup hook for single boot install
   - Enable single reboot gadget update for UC20+
   - Allow core to be removed on classic systems
   - Support for remodeling on hybrid systems
   - Install desktop files on Ubuntu Core and update after snapd
     upgrade
   - Upgrade sandbox features to account for cgroup v2 device filtering
   - Support snaps to manage their own cgroups
   - Add support for AppArmor 4.0 unconfined profile mode
   - Add AppArmor based read access to /etc/default/keyboard
   - Upgrade to squashfuse 0.5.0
   - Support useradd utility to enable removing Perl dependency for
     UC24+
   - Support for recovery-chooser to use console-conf snap
   - Add support for --uid/--gid using strace-static
   - Add support for notices (from pebble) and expose via the snapd
     REST API endpoints /v2/notices and /v2/notice
   - Add polkit authentication for snapd REST API endpoints
     /v2/snaps/{snap}/conf and /v2/apps
   - Add refresh-inhibit field to snapd REST API endpoint /v2/snaps
   - Add refresh-inhibited select query to REST API endpoint /v2/snaps
   - Take into account validation sets during remodeling
   - Improve offline remodeling to use installed revisions of snaps to
     fulfill the remodel revision requirement
   - Add rpi configuration option sdtv_mode
   - When snapd snap is not installed, pin policy ABI to 4.0 or 3.0 if
     present on host
   - Fix gadget zero-sized disk mapping caused by not ignoring zero
     sized storage traits
   - Fix gadget install case where size of existing partition was not
     correctly taken into account
   - Fix trying to unmount early kernel mount if it does not exist
   - Fix restarting mount units on snapd start
   - Fix call to udev in preseed mode
   - Fix to ensure always setting up the device cgroup for base bare
     and core24+
   - Fix not copying data from newly set homedirs on revision change
   - Fix leaving behind empty snap home directories after snap is
     removed (resulting in broken symlink)
   - Fix to avoid using libzstd from host by adding to snapd snap
   - Fix autorefresh to correctly handle forever refresh hold
   - Fix username regex allowed for system-user assertion to not allow
     '+'
   - Fix incorrect application icon for notification after autorefresh
     completion
   - Fix to restart mount units when changed
   - Fix to support AppArmor running under incus
   - Fix case of snap-update-ns dropping synthetic mounts due to
     failure to match  desired mount dependencies
   - Fix parsing of base snap version to enable pre-seeding of Ubuntu
     Core Desktop
   - Fix packaging and tests for various distributions
   - Add remoteproc interface to allow developers to interact with
     Remote Processor Framework which enables snaps to load firmware to
     ARM Cortex microcontrollers
   - Add kernel-control interface to enable controlling the kernel
     firmware search path
   - Add nfs-mount interface to allow mounting of NFS shares
   - Add ros-opt-data interface to allow snaps to access the host
     /opt/ros/ paths
   - Add snap-refresh-observe interface that provides refresh-app-
     awareness clients access to relevant snapd API endpoints
   - steam-support interface: generalize Pressure Vessel root paths and
     allow access to driver information, features and container
     versions
   - steam-support interface: make implicit on Ubuntu Core Desktop
   - desktop interface: improved support for Ubuntu Core Desktop and
     limit autoconnection to implicit slots
   - cups-control interface: make autoconnect depend on presence of
     cupsd on host to ensure it works on classic systems
   - opengl interface: allow read access to /usr/share/nvidia
   - personal-files interface: extend to support automatic creation of
     missing parent directories in write paths
   - network-control interface: allow creating /run/resolveconf
   - network-setup-control and network-setup-observe interfaces: allow
     busctl bind as required for systemd 254+
   - libvirt interface: allow r/w access to /run/libvirt/libvirt-sock-
     ro and read access to /var/lib/libvirt/dnsmasq/**
   - fwupd interface: allow access to IMPI devices (including locking
     of device nodes), sysfs attributes needed by amdgpu and the COD
     capsule update directory
   - uio interface: allow configuring UIO drivers from userspace
     libraries
   - serial-port interface: add support for NXP Layerscape SoC
   - lxd-support interface: add attribute enable-unconfined-mode to
     require LXD to opt-in to run unconfined
   - block-devices interface: add support for ZFS volumes
   - system-packages-doc interface: add support for reading jquery and
     sphinx documentation
   - system-packages-doc interface: workaround to prevent autoconnect
     failure for snaps using base bare
   - microceph-support interface: allow more types of block devices to
     be added as an OSD
   - mount-observe interface: allow read access to
     /proc/{pid}/task/{tid}/mounts and proc/{pid}/task/{tid}/mountinfo
   - polkit interface: changed to not be implicit on core because
     installing policy files is not possible
   - upower-observe interface: allow stats refresh
   - gpg-public-keys interface: allow creating lock file for certain
     gpg operations
   - shutdown interface: allow access to SetRebootParameter method
   - media-control interface: allow device file locking
   - u2f-devices interface: support for Trustkey G310H, JaCarta U2F,
     Kensington VeriMark Guard, RSA DS100, Google Titan v2


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.63
   - Support for snap services to show the current status of user
     services (experimental)
   - Refresh app awareness: record snap-run-inhibit notice when
     starting app from snap that is busy with refresh (experimental)
   - Refresh app awareness: use warnings as fallback for desktop
     notifications (experimental)
   - Aspect based configuration: make request fields in the aspect-
     bundle's rules optional (experimental)
   - Aspect based configuration: make map keys conform to the same
     format as path sub-keys (experimental)
   - Aspect based configuration: make unset and set behaviour similar
     to configuration options (experimental)
   - Aspect based configuration: limit nesting level for setting value
     (experimental)
   - Components: use symlinks to point active snap component revisions
   - Components: add model assertion support for components
   - Components: fix to ensure local component installation always gets
     a new revision number
   - Add basic support for a CIFS remote filesystem-based home
     directory
   - Add support for AppArmor profile kill mode to avoid snap-confine
     error
   - Allow more than one interface to grant access to the same API
     endpoint or notice type
   - Allow all snapd service's control group processes to send systemd
     notifications to prevent warnings flooding the log
   - Enable not preseeded single boot install
   - Update secboot to handle new sbatlevel
   - Fix to not use cgroup for non-strict confined snaps (devmode,
     classic)
   - Fix two race conditions relating to freedesktop notifications
   - Fix missing tunables in snap-update-ns AppArmor template
   - Fix rejection of snapd snap udev command line by older host snap-
     device-helper
   - Rework seccomp allow/deny list
   - Clean up files removed by gadgets
   - Remove non-viable boot chains to avoid secboot failure
   - posix_mq interface: add support for missing time64 mqueue syscalls
     mq_timedreceive_time64 and mq_timedsend_time64
   - password-manager-service interface: allow kwalletd version 6
   - kubernetes-support interface: allow SOCK_SEQPACKET sockets
   - system-observe interface: allow listing systemd units and their
     properties
   - opengl interface: enable use of nvidia container toolkit CDI
     config generation


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.64
   - Support building snapd using base Core22 (Snapcraft 8.x)
   - FIPS: support building FIPS complaint snapd variant that switches
     to FIPS mode when the system boots with FIPS enabled
   - AppArmor: update to AppArmor 4.0.1
   - AppArmor: support AppArmor snippet priorities
   - AppArmor prompting: add checks for prompting support, include
     prompting status in system key, and restart snapd if prompting
     flag changes
   - AppArmor prompting: include prompt prefix in AppArmor rules if
     prompting is supported and enabled
   - AppArmor prompting: add common types, constraints, and mappings
     from AppArmor permissions to abstract permissions
   - AppArmor prompting: add path pattern parsing and matching
   - Registry views (experimental): rename from aspects to registries
   - Registry views (experimental): support reading registry views
     using snapctl
   - Registry views (experimental): restrict view paths from using a
     number as first character and view names to storage path style
     patterns
   - Snap components: support installing snaps and components from
     files at the same time (no REST API/CLI)
   - Snap components: support downloading components related assertions
     from the store
   - Snap components: support installing components from the store (no
     REST API/CLI)
   - Snap components: support removing components (REST API, no CLI)
   - Snap components: started support for component hooks
   - Snap components: support kernel modules as components
   - Refresh app awareness (experimental): add data field for
     /v2/changes REST API to allow associating each task with affected
     snaps
   - Refresh app awareness (experimental): use the app name from
     .desktop file in notifications
   - Refresh app awareness (experimental): give snap-refresh-observe
     interface access to /v2/snaps/{name} endpoint
   - Allow re-exec when SNAP_REEXEC is set for unlisted distros to
     simplify testing
   - Generate GNU build ID for Go binaries
   - Add missing etelpmoc.sh for shell completion
   - Do not attempt to run snapd on classic when re-exec is disabled
   - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse
   - Add snap debug api command to enable running raw queries
   - Enable snap-confine snap mount directory detection
   - Replace global seccomp filter with deny rules in standard seccomp
     template
   - Remove support for Ubuntu Core Launcher (superseded by snap-
     confine)
   - Support creating pending serial bound users after serial assertion
     becomes available
   - Support disabling cloud-init using kernel command-line
   - In hybrid systems, apps can refresh without waiting for restarts
     required by essential snaps
   - Ship snap-debug-info.sh script used for system diagnostics
   - Improve error messages when attempting to run non-existent snap
   - Switch to -u UID:GID for strace-static
   - Support enabling snapd logging with snap set system
     debug.snapd.{log,log-level}
   - Fix restarting activated services instead of their activator units
     (i.e. sockets, timers)
   - Fix potential unexpected auto-refresh of snap on managed schedule
   - Fix potential segfault by guarding against kernel command-line
     changes on classic system
   - Fix proxy entries in /etc/environment with missing newline that
     caused later manual entries to not be usable
   - Fix offline remodelling by ignoring prerequisites that will
     otherwise be downloaded from store
   - Fix devmode seccomp deny regression that caused spamming the log
     instead of actual denies
   - Fix snap lock leak during refresh
   - Fix not re-pinning validation sets that were already pinned when
     enforcing new validation sets
   - Fix handling of unexpected snapd runtime failure
   - Fix /v2/notices REST API skipping notices with duplicate
     timestamps
   - Fix comparing systemd versions that may contain pre-release
     suffixes
   - Fix udev potentially starting before snap-device-helper is made
     available
   - Fix race in snap seed metadata loading
   - Fix treating cloud-init exit status 2 as error
   - Fix to prevent sending refresh complete notification if snap snap-
     refresh-observe interface is connected
   - Fix to queue snapctl service commands if run from the default-
     configure hook to ensure they get up-to-date config values
   - Fix stop service failure when the service is not actually running
     anymore
   - Add registry interface that provides snaps access to a particular
     registry view
   - steam-support interface: relaxed AppArmor and seccomp restrictions
     to improve user experience
   - home interface: autoconnect home on Ubuntu Core Desktop
   - serial-port interface: support RPMsg tty
   - display-control interface: allow changing LVDS backlight power and
     brightness
   - power-control interface: support for battery charging thesholds,
     type/status and AC type/status
   - cpu-control interface: allow CPU C-state control
   - raw-usb interface: support RPi5 and Thinkpad x13s
   - custom-device interface: allow device file locking
   - lxd-support interface: allow LXD to self-manage its own cgroup
   - network-manager interface: support MPTCP sockets
   - network-control interface: allow plug/slot access to gnutls config
     and systemd resolved cache flushing via D-Bus


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.65
   - Support building snapd using base Core22 (Snapcraft 8.x)
   - FIPS: support building FIPS complaint snapd variant that switches
     to FIPS mode when the system boots with FIPS enabled
   - AppArmor: update to latest 4.0.2 release
   - AppArmor: enable using ABI 4.0 from host parser
   - AppArmor: fix parser lookup
   - AppArmor: support AppArmor snippet priorities
   - AppArmor: allow reading cgroup memory.max file
   - AppArmor: allow using snap-exec coming from the snapd snap when
     starting a confined process with jailmode
   - AppArmor prompting (experimental): add checks for prompting
     support, include prompting status in system key, and restart snapd
     if prompting flag changes
   - AppArmor prompting (experimental): include prompt prefix in
     AppArmor rules if prompting is supported and enabled
   - AppArmor prompting (experimental): add common types, constraints,
     and mappings from AppArmor permissions to abstract permissions
   - AppArmor prompting (experimental): add path pattern parsing and
     matching
   - AppArmor prompting (experimental): add path pattern precedence
     based on specificity
   - AppArmor prompting (experimental): add packages to manage
     outstanding request prompts and rules
   - AppArmor prompting (experimental): add prompting API and notice
     types, which require snap-interfaces-requests-control interface
   - AppArmor prompting (experimental): feature flag can only be
     enabled if prompting is supported, handler service connected, and
     the service can be started
   - Registry views (experimental): rename from aspects to registries
   - Registry views (experimental): support reading registry views and
     setting/unsetting registry data using snapctl
   - Registry views (experimental): fetch and refresh registry
     assertions as needed
   - Registry views (experimental): restrict view paths from using a
     number as first character and view names to storage path style
     patterns
   - Snap components: support installing snaps and components from
     files at the same time (no REST API/CLI)
   - Snap components: support downloading components related assertions
     from the store
   - Snap components: support installing components from the store
   - Snap components: support removing components individually and
     during snap removal
   - Snap components: support kernel modules as components
   - Snap components: support for component install, pre-refresh and
     post-refresh hooks
   - Snap components: initial support for building systems that contain
     components
   - Refresh app awareness (experimental): add data field for
     /v2/changes REST API to allow associating each task with affected
     snaps
   - Refresh app awareness (experimental): use the app name from
     .desktop file in notifications
   - Refresh app awareness (experimental): give snap-refresh-observe
     interface access to /v2/snaps/{name} endpoint
   - Improve snap-confine compatibility with nvidia drivers
   - Allow re-exec when SNAP_REEXEC is set for unlisted distros to
     simplify testing
   - Allow mixing revision and channel on snap install
   - Generate GNU build ID for Go binaries
   - Add missing etelpmoc.sh for shell completion
   - Do not attempt to run snapd on classic when re-exec is disabled
   - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse
   - Add snap debug API command to enable running raw queries
   - Enable snap-confine snap mount directory detection
   - Replace global seccomp filter with deny rules in standard seccomp
     template
   - Remove support for Ubuntu Core Launcher (superseded by snap-
     confine)
   - Support creating pending serial bound users after serial assertion
     becomes available
   - Support disabling cloud-init using kernel command-line
   - In hybrid systems, apps can refresh without waiting for restarts
     required by essential snaps
   - Ship snap-debug-info.sh script used for system diagnostics
   - Improve error messages when attempting to run non-existent snap
   - Switch to -u UID:GID for strace-static
   - Support enabling snapd logging with snap set system
     debug.snapd.{log,log-level}
   - Add options system.coredump.enable and system.coredump.maxuse to
     support using systemd-coredump on Ubuntu Core
   - Provide documentation URL for 'snap interface '
   - Fix restarting activated services instead of their activator units
     (i.e. sockets, timers)
   - Fix potential unexpected auto-refresh of snap on managed schedule
   - Fix potential segfault by guarding against kernel command-line
     changes on classic system
   - Fix proxy entries in /etc/environment with missing newline that
     caused later manual entries to not be usable
   - Fix offline remodelling by ignoring prerequisites that will
     otherwise be downloaded from store
   - Fix devmode seccomp deny regression that caused spamming the log
     instead of actual denies
   - Fix snap lock leak during refresh
   - Fix not re-pinning validation sets that were already pinned when
     enforcing new validation sets
   - Fix handling of unexpected snapd runtime failure
   - Fix /v2/notices REST API skipping notices with duplicate
     timestamps
   - Fix comparing systemd versions that may contain pre-release
     suffixes
   - Fix udev potentially starting before snap-device-helper is made
     available
   - Fix race in snap seed metadata loading
   - Fix treating cloud-init exit status 2 as error
   - Fix to prevent sending refresh complete notification if snap snap-
     refresh-observe interface is connected
   - Fix to queue snapctl service commands if run from the default-
     configure hook to ensure they get up-to-date config values
   - Fix stop service failure when the service is not actually running
     anymore
   - Fix parsing /proc/PID/mounts with spaces
   - Add registry interface that provides snaps access to a particular
     registry view
   - Add snap-interfaces-requests-control interface to enable prompting
     client snaps
   - steam-support interface: remove all AppArmor and seccomp
     restrictions to improve user experience
   - opengl interface: improve compatibility with nvidia drivers
   - home interface: autoconnect home on Ubuntu Core Desktop
   - serial-port interface: support RPMsg tty
   - display-control interface: allow changing LVDS backlight power and
     brightness
   - power-control interface: support for battery charging thesholds,
     type/status and AC type/status
   - cpu-control interface: allow CPU C-state control
   - raw-usb interface: support RPi5 and Thinkpad x13s
   - custom-device interface: allow device file locking
   - lxd-support interface: allow LXD to self-manage its own cgroup
   - network-manager interface: support MPTCP sockets
   - network-control interface: allow plug/slot access to gnutls config
     and systemd resolved cache flushing via D-Bus
   - network-control interface: allow wpa_supplicant dbus api
   - gpio-control interface: support gpiochip* devices
   - polkit interface: fix "rw" mount option check
   - u2f-devices interface: enable additional security keys
   - desktop interface: enable kde theming support


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.65.1
   - Support building snapd using base Core22 (Snapcraft 8.x)
   - FIPS: support building FIPS complaint snapd variant that switches
     to FIPS mode when the system boots with FIPS enabled
   - AppArmor: update to latest 4.0.2 release
   - AppArmor: enable using ABI 4.0 from host parser
   - AppArmor: fix parser lookup
   - AppArmor: support AppArmor snippet priorities
   - AppArmor: allow reading cgroup memory.max file
   - AppArmor: allow using snap-exec coming from the snapd snap when
     starting a confined process with jailmode
   - AppArmor prompting (experimental): add checks for prompting
     support, include prompting status in system key, and restart snapd
     if prompting flag changes
   - AppArmor prompting (experimental): include prompt prefix in
     AppArmor rules if prompting is supported and enabled
   - AppArmor prompting (experimental): add common types, constraints,
     and mappings from AppArmor permissions to abstract permissions
   - AppArmor prompting (experimental): add path pattern parsing and
     matching
   - AppArmor prompting (experimental): add path pattern precedence
     based on specificity
   - AppArmor prompting (experimental): add packages to manage
     outstanding request prompts and rules
   - AppArmor prompting (experimental): add prompting API and notice
     types, which require snap-interfaces-requests-control interface
   - AppArmor prompting (experimental): feature flag can only be
     enabled if prompting is supported, handler service connected, and
     the service can be started
   - Registry views (experimental): rename from aspects to registries
   - Registry views (experimental): support reading registry views and
     setting/unsetting registry data using snapctl
   - Registry views (experimental): fetch and refresh registry
     assertions as needed
   - Registry views (experimental): restrict view paths from using a
     number as first character and view names to storage path style
     patterns
   - Snap components: support installing snaps and components from
     files at the same time (no REST API/CLI)
   - Snap components: support downloading components related assertions
     from the store
   - Snap components: support installing components from the store
   - Snap components: support removing components individually and
     during snap removal
   - Snap components: support kernel modules as components
   - Snap components: support for component install, pre-refresh and
     post-refresh hooks
   - Snap components: initial support for building systems that contain
     components
   - Refresh app awareness (experimental): add data field for
     /v2/changes REST API to allow associating each task with affected
     snaps
   - Refresh app awareness (experimental): use the app name from
     .desktop file in notifications
   - Refresh app awareness (experimental): give snap-refresh-observe
     interface access to /v2/snaps/{name} endpoint
   - Improve snap-confine compatibility with nvidia drivers
   - Allow re-exec when SNAP_REEXEC is set for unlisted distros to
     simplify testing
   - Allow mixing revision and channel on snap install
   - Generate GNU build ID for Go binaries
   - Add missing etelpmoc.sh for shell completion
   - Do not attempt to run snapd on classic when re-exec is disabled
   - Packaging/build maintenance for Debian sid, Fedora, Arch, openSuse
   - Add snap debug API command to enable running raw queries
   - Enable snap-confine snap mount directory detection
   - Replace global seccomp filter with deny rules in standard seccomp
     template
   - Remove support for Ubuntu Core Launcher (superseded by snap-
     confine)
   - Support creating pending serial bound users after serial assertion
     becomes available
   - Support disabling cloud-init using kernel command-line
   - In hybrid systems, apps can refresh without waiting for restarts
     required by essential snaps
   - Ship snap-debug-info.sh script used for system diagnostics
   - Improve error messages when attempting to run non-existent snap
   - Switch to -u UID:GID for strace-static
   - Support enabling snapd logging with snap set system
     debug.snapd.{log,log-level}
   - Add options system.coredump.enable and system.coredump.maxuse to
     support using systemd-coredump on Ubuntu Core
   - Provide documentation URL for 'snap interface '
   - Fix snapd riscv64 build
   - Fix restarting activated services instead of their activator units
     (i.e. sockets, timers)
   - Fix potential unexpected auto-refresh of snap on managed schedule
   - Fix potential segfault by guarding against kernel command-line
     changes on classic system
   - Fix proxy entries in /etc/environment with missing newline that
     caused later manual entries to not be usable
   - Fix offline remodelling by ignoring prerequisites that will
     otherwise be downloaded from store
   - Fix devmode seccomp deny regression that caused spamming the log
     instead of actual denies
   - Fix snap lock leak during refresh
   - Fix not re-pinning validation sets that were already pinned when
     enforcing new validation sets
   - Fix handling of unexpected snapd runtime failure
   - Fix /v2/notices REST API skipping notices with duplicate
     timestamps
   - Fix comparing systemd versions that may contain pre-release
     suffixes
   - Fix udev potentially starting before snap-device-helper is made
     available
   - Fix race in snap seed metadata loading
   - Fix treating cloud-init exit status 2 as error
   - Fix to prevent sending refresh complete notification if snap snap-
     refresh-observe interface is connected
   - Fix to queue snapctl service commands if run from the default-
     configure hook to ensure they get up-to-date config values
   - Fix stop service failure when the service is not actually running
     anymore
   - Fix parsing /proc/PID/mounts with spaces
   - Add registry interface that provides snaps access to a particular
     registry view
   - Add snap-interfaces-requests-control interface to enable prompting
     client snaps
   - steam-support interface: remove all AppArmor and seccomp
     restrictions to improve user experience
   - opengl interface: improve compatibility with nvidia drivers
   - home interface: autoconnect home on Ubuntu Core Desktop
   - serial-port interface: support RPMsg tty
   - display-control interface: allow changing LVDS backlight power and
     brightness
   - power-control interface: support for battery charging thesholds,
     type/status and AC type/status
   - cpu-control interface: allow CPU C-state control
   - raw-usb interface: support RPi5 and Thinkpad x13s
   - custom-device interface: allow device file locking
   - lxd-support interface: allow LXD to self-manage its own cgroup
   - network-manager interface: support MPTCP sockets
   - network-control interface: allow plug/slot access to gnutls config
     and systemd resolved cache flushing via D-Bus
   - network-control interface: allow wpa_supplicant dbus api
   - gpio-control interface: support gpiochip* devices
   - polkit interface: fix "rw" mount option check
   - u2f-devices interface: enable additional security keys
   - desktop interface: enable kde theming support


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.65.2
   - Bump squashfuse from version 0.5.0 to 0.5.2 (used in snapd deb
     only)


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.66
   - AppArmor prompting (experimental): expand kernel support checks
   - AppArmor prompting (experimental): consolidate error messages and
     add error kinds
   - AppArmor prompting (experimental): grant /v2/snaps/{name} via
     snap-interfaces-requests-control
   - AppArmor prompting (experimental): add checks for duplicate
     pattern variants
   - Registry views (experimental): add handlers that commit (and
     cleanup) registry transactions
   - Registry views (experimental): add a snapctl fail command for
     rejecting registry transactions
   - Registry views (experimental): allow custodian snaps to implement
     registry hooks that modify and save registry data
   - Registry views (experimental): run view-changed hooks only for
     snaps plugging views affected by modified paths
   - Registry views (experimental): make registry transactions
     serialisable
   - Snap components: handle refreshing components to revisions that
     have been on the system before
   - Snap components: enable creating Ubuntu Core images that contain
     components
   - Snap components: handle refreshing components independently of
     snaps
   - Snap components: handle removing components when refreshing a snap
     that no longer defines them
   - Snap components: extend snapd Ubuntu Core installation API to
     allow for picking optional snaps and components to install
   - Snap components: extend kernel.yaml with "dynamic-modules",
     allowing kernel to define a location for kmods from component
     hooks
   - Snap components: renamed component type "test" to "standard"
   - Desktop IDs: support installing desktop files with custom names
     based on desktop-file-ids desktop interface plug attr
   - Auto-install snapd on classic systems as prerequisite for any non-
     essential snap install
   - Support loading AppArmor profiles on WSL2 with non-default kernel
     and securityfs mounted
   - Debian/Fedora packaging updates
   - Add snap debug command for investigating execution aspects of the
     snap toolchain
   - Improve snap pack error for easier parsing
   - Add support for user services when refreshing snaps
   - Add snap remove --terminate flag for terminating running snap
     processes
   - Support building FIPS complaint snapd deb and snap
   - Fix to not use nss when looking up for users/groups from snapd
     snap
   - Fix ordering in which layout changes are saved
   - Patch snapd snap dynamic linker to ignore LD_LIBRARY_PATH and
     related variables
   - Fix libexec dir for openSUSE Slowroll
   - Fix handling of the shared snap directory for parallel installs
   - Allow writing to /run/systemd/journal/dev-log by default
   - Avoid state lock during snap removal to avoid delaying other snapd
     operations
   - Add nomad-support interface to enable running Hashicorp Nomad
   - Add intel-qat interface
   - u2f-devices interface: add u2f trustkey t120 product id and fx
     series fido u2f devices
   - desktop interface: improve integration with xdg-desktop-portal
   - desktop interface: add desktop-file-ids plug attr to desktop
     interface
   - unity7 interface: support desktop-file-ids in desktop files rule
     generation
   - desktop-legacy interface: support desktop-file-ids in desktop
     files rule generation
   - desktop-legacy interface: grant access to gcin socket location
   - login-session-observe interface: allow introspection
   - custom-device interface: allow to explicitly identify matching
     device in udev tagging block
   - system-packages-doc interface: allow reading /usr/share/javascript
   - modem-manager interface: add new format of WWAN ports
   - pcscd interface: allow pcscd to read opensc.conf
   - cpu-control interface: add IRQ affinity control to cpu_control
   - opengl interface: add support for cuda workloads on Tegra iGPU in
     opengl interface


author: Ernest Lotter <ernest.lotter@canonical.com>
changelog:
  - New upstream release 2.66.1
   - AppArmor prompting (experimental): Fix kernel prompting support
     check
   - Allow kernel snaps to have content slots
   - Fix ignoring snaps in try mode when amending


author: Neal Gompa <ngompa13@gmail.com> - 1.47-1
changelog:
  - Update to 1.47
  - New API: snapd_channel_get_released_at
  - New API: SNAPD_ERROR_DNS_FAILURE
  - Fix tests breaking due to undefined order of results
  - Remove generated MOC file from tarball


author: Neal Gompa <ngompa13@gmail.com> - 1.48-1
changelog:
  - Update to 1.48
  - Many new APIs added
  - Allow searching via common-id
  - Add a description markdown parser
  - Replace SnapdConnection with SnapdPlugRef and SnapdSlotRef
  - Support updated connections API (/v2/connections)
  - Support updated /v2/interfaces&select= API
  - Support snap configuration API
  - Add Qt interface attribute API
  - Make snapd_client_set_socket_path revert to the default when NULL passed.
  - Fix C99 mode not being enabled on older versions of GCC


author: Neal Gompa <ngompa13@gmail.com> - 1.49-1
changelog:
  - Update to 1.49
  - New APIs for getting connections and deprecating older variants
  - Fix memory leaks
  - Use C99 variable style


author: Neal Gompa <ngompa13@gmail.com> - 1.54-1
changelog:
  - Update to 1.54
  - Add API to get snap website
  - Add purge option to remove
  - Switch build system to Meson
  - Fix Qt build with optimisation disabled
  - Fix tests breaking on json-glib < 1.2.4
  - Use C99 style variable definitions


author: Neal Gompa <ngompa13@gmail.com> - 1.55-1
changelog:
  - Update to 1.55
  - Add new APIs for download and logout actions
  - Add support for snap store logout
  - Fix QSnapdAuthData () constructor not copying discharge strings correctly
  - Remove obsolete screenshot parsing code
  - Make all snapd 404 errors return SNAPD_ERROR_NOT_FOUND


author: Neal Gompa <ngompa13@gmail.com> - 1.57-1
changelog:
  - Update to 1.57
  - Add snapd_interface_make_label
  - Add support for new snap types: "core", "base" and "snapd"
  - Change way GTK documentation is generated to avoid a Meson bug
  - Fix leak in markdown parser
  - Fix leak in logout code
  - Make build reproducible by fixing comment in generated file


author: Neal Gompa <ngompa13@gmail.com> - 1.58-1
changelog:
  - Update to 1.58
  - Fix GIR annotations on snapd_client_get_snap_conf
  - Put more information into error messages for unknown errors


author: Neal Gompa <ngompa@fedoraproject.org> - 2.4.14-1
changelog:
  - Rebase to 2.4.14
  - Modernize packaging to current packaging guidelines
  - Drop unsupported devel content
  - Run test suite


author: Michel Alexandre Salim <salimma@fedoraproject.org> - 2.5.1-1
changelog:
  - Update to 2.5.1
  - Convert to SPDX license identifier
  - Add compat subpackage for snoopy-disable and snoopy-enable


author: David Woodhouse <dwmw2@infradead.org> - 2.6.1-3
changelog:
  - Resolves: rhbz#1831086 softhsm use-after-free on process exit
    Fix crash introduced by initial patch


author: Dominik Mierzejewski <rpm@greysector.net> - 1.0.5-1
changelog:
  - update to 1.0.5 (#1933413)
  - drop obsolete patch
  - drop redundant explicit Requires: on pyudev
  - python3-gobject is optional (for GUI only), move to Recommends:
  - fix unknown battery status regression


author: Dominik Mierzejewski <rpm@greysector.net> - 1.0.6-1
changelog:
  - update to 1.0.6 (#1953333)
  - improve handling of unavailable devices on startup or resume (#1921575, #1912132, #1942301, #1946104)
  - add a conditional weak dependency on appindicator extension for gnome-shell


author: Dominik Mierzejewski <rpm@greysector.net> - 1.1.0-1
changelog:
  - update to 1.1.0 (#2026986)
  - fix exceptions when adding devices (#2008448, #2015360)
  - fix exception when applying settings fails (#2020706, #2022320)


author: Jiri Kucera <jkucera@redhat.com> - 14.4.2.0-20
changelog:
  - added patch that fixes WAV to HCOM conversion abortion on 64 bit big endian
    machines
    + resolves #1558887


author: Jiri Kucera <jkucera@redhat.com> - 14.4.2.0-21
changelog:
  - fix hunks in patches
  - prevents division by zero in src/ao.c
    + fixes/prevents "sox killed by SIGFPE (signal 8)" kind of bugs that appear
      randomly, depending on reporter's HW/environment/OS components
    + related bugs: #1309426, #1226675, #1540762, #1492910


author: Jiri Kucera <jkucera@redhat.com> - 14.4.2.0-22
changelog:
  - added patch that fixes:
    + "divide by zero in startread function in wav.c" (CVE-2017-11332)
    + "invalid memory read in read_samples function in hcom.c" (CVE-2017-11358)
    + "divide by zero in wavwritehdr function in wav.c" (CVE-2017-11359)
    resolves #1480674, #1480675, #1480676, and #1480678


author: Paul Howarth <paul@city-fan.org> - 0.4.0-11
changelog:
  - Replace /bin/* dependencies with coreutils etc. (#1512898)
  - Drop explicit paths for commands to aid spec readability
  - Drop EL-5 support
    - Drop legacy Group: and BuildRoot: tags
    - Drop explicit buildroot cleaning in %install section
    - Drop explicit %clean section
    - Noarch sub-packages are always available now


author: Paul Howarth <paul@city-fan.org> - 0.4.0-12
changelog:
  - Account for systemd-units being merged into systemd at Fedora 17
  - Drop support for SysV-to-systemd migration from Fedora 18, RHEL 7
  - Use forward-looking conditionals
  - One build requirement per line


author: Volker Fröhlich <volker27@gmx.at> - 1.9.2-1
changelog:
  - New upstream release
  - Use github as source
  - Use license macro and remove the now-gone README
  - Remove merged patch


author: Lukáš Tyrychtr <lukastyrychtr@gmail.com> 2.5-9
changelog:
  - Add an obsoletes directive for the old speech-tools-libs as they're
    no longer part of the Festival package.


author: Leigh Scott <leigh123linux@gmail.com> - 2.1.1-1
changelog:
  - Update to 2.1.1 release
  - Remove pointless check, builders don't have internet access
  - Use python3 macros
  - Fix Source URL
  - Remove gz extension from man file
  - Don't bother compressing man file as rpmbuild does it
  - Remove unnecessary Requires
  - Spec file clean up


author: Bojan Smojver <bojan@rexursive.com> - 1.4-28
changelog:
  - Helper protocol patch (bug #1443273, bug #1418267)
  - Fix logrotate configuration (bug #1394601)
  - Fix typo in transparent-proxying.service


author: Christopher Engelhard <ce@lcts.de> 2.4.0-9
changelog:
  - add bundled provides for fnv and simclist
  - add systemd dependency
  - fix changelog formatting
  - patch & use upstream service file
  - revert 05037d7b - disallow building on rhel < 6
  - make package own /usr/libexec/sshguard


author: Christopher Engelhard <ce@lcts.de> 2.4.0-10
changelog:
  - add missing dependencies
  - move examples to (docdir)/examples subfolder
  - prefix directories with %dir in %files
  - use complete & commented config files
  - add white/blacklisting


author: Christopher Engelhard <ce@lcts.de> 2.4.0-12
changelog:
  - include patch to fully whitelist localhost in IPv6/v4 (PR #56)
  - add explicit Requires: ipset to firewalld backend


author: Christopher Engelhard <ce@lcts.de> 2.4.1-5
changelog:
  - Fix backend path in example spec file
  - Remove SysV init related things
  - Require a backend
  - Fix wrong check for EPEL8


author: Kevin Fenzi <kevin@scrye.com> - 1.0.4-1
changelog:
  - Update to 1.0.4. Fixes bug #1856063
  - Apply upstream commit to fix python2 compat on remote side. Fixes bug #1851622


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0-0.5
changelog:
  - Update to c0c9826 (fix RHBZ#2002436)
  - Removed and obsoleted stb_perlin-devel due to possible patents
  - Updated stb_truetype to 1.26
  - Bug fixes in stb_image (no new version number)


author: Benjamin A. Beasley <code@musicinmybrain.net>
changelog:
  - Update to 8b5f1f3
  - The stb_perlin-devel subpackage has been restored, as upstream believes
    all relevant patents are now expired.


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0-0.20.20220908git8b5f1f3
changelog:
  - Patch in a candidate fix for ossfuzz issue 24232
  - Improves handling of certain invalid PNGs by stb_image


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0-0.21.20230129git6199bf7
changelog:
  - Update to 6199bf7 (stb_image 2.28)
  - Security-related patches for stb_image have been merged upstream, and
    there are other bugfixes.


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0-0.27.20231009gitc4bbb6e
changelog:
  - Update to 0^20231009gitc4bbb6e
  - A new stb_image_resize2 library is introduced
  - Upstream has deprecated stb_image_resize, but we still package it


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0-0.40.20240208gitb7cf124
changelog:
  - Update to 0^20240208gitb7cf124
  - stb_image-devel is updated to 2.29
  - stb_image_resize2-devel is updated to 2.05


author: Kalev Lember <klember@redhat.com> - 0.19.3-1
changelog:
  - 0.19.3
  - Don't replace upstream screenshots in appdata
  - Use desktop-file-validate rather than desktop-file-install
  - Validate appdata


author: Ondrej Mosnacek <omosnace@redhat.com> - 14.1-1
changelog:
  - Adapt spec file for NNUE support
  - Use upstream buildsystem
  - Bump to version 14.1
  - Resolves: rhbz#1875192
  - Resolves: rhbz#1988004


author: Mikhail Zabaluev <mikhail.zabaluev@gmail.com> - 5.8.1-1
changelog:
  - Update to 5.8.1 (#1711920)
  - No more separate strongswan-swanctl.service to start out of order (#1775548)
  - Added strongswan-starter.service


author: Paul Wouters <pwouters@redhat.com> - 5.9.0-1
changelog:
  - Resolves: rhbz#1861747 strongswan-5.9.0 is available
  - Remove --enable-fips-mode=2, which defaults strongswan to FIPS only.
    (use fips_mode = 2 in plugins {} openssl {} in strongswan.conf to enable FIPS)


author: Davide Cavalca <dcavalca@fedoraproject.org> - 5.9.0-4
changelog:
  - Build with with capabilities support
  - Resolves: rhbz#1911572 StrongSwan not configured with libcap support


author: Paul Wouters <paul.wouters@aiven.io> - 5.9.3-1
changelog:
  - Resolves: rhbz#1979574 strongswan-5.9.3 is available
  - Make strongswan main dir world readable so apps can find strongswan.conf


author: Artem Egorenkov <aegorenk@redhat.com> - 0.3.1-0.2.20200318git7939e965
changelog:
  - Snapshot information field added
  - systemd-rpm-macros added to build requirements
  - systemd-devel and systemd removed from build requirements
  - Obsoletes version for getns-stubby fixed


author: Petr Menšík <pemensik@redhat.com> - 0.4.2-2
changelog:
  - Private users do not work with dynamic users
  - Provide path to unbound-anchor key, but keep it commented out


author: Francisco Javier Tsao Santín <tsao@gpul.org> - 4.0.0.dev0-1
changelog:
  - Upgraded to 4.0.0.dev0 in order to remove python2 dependencies.
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Francisco Javier Tsao Santín <tsao@gpul.org> - 4.2.0-1
changelog:
  - Packaging cleanups to align with current Fedora Packaging Guidelines by Neal Gompa <ngompa13@gmail.com>
  - Upgraded to 4.2.0 version. Removed meld3 dependency by Francisco Javier Tsao Santín <tsao@gpul.org>


author: Ryan Lerch <rlerch@redhat.com> - 0.4-1
changelog:
  - Fix message body format when sending a Fedora message
  - Fix standard commands like .listmeetings and .recent


author: Steve Grubb <sgrubb@redhat.com> 5.0.0-2
changelog:
  - New feature release (which also fixes a security issue)
  - Enable ebpf on x86_64 only
  - Disable building on ppc64le due to rust problems


author: Jason Taylor <jtfas90@gmail.com> 5.0.3-1
changelog:
  - Upstream security/bugfix release
  - Updated reference, classification, threshold config file installs


author: Ron Olson <tachoknight@gmail.com> 5.2-0.9.20200311git33150e3
changelog:
  - Updated to swift-5.2-DEVELOPMENT-SNAPSHOT-2020-03-11-a and switched to
    using patched version of cmake to get around issues building 5.2 with
    3.17


author: Ron Olson <tachoknight@gmail.com> 5.2.1-1
changelog:
  - Reorganized the package to place everything in a single location,
    changed the versioning scheme, and removed a number of obsolete patches


author: Xavier Bachelot <xavier@bachelot.org> 6.2.62-1
changelog:
  - Update to 6.2.62
    - Fixes CVE-2020-26880 (RHBZ#1886232 - RHBZ#1886233)
  - Unbundle jquery-ui
  - Unbundle jquery on EL8


author: Xavier Bachelot <xavier@bachelot.org> 6.2.68-1
changelog:
  - Update to 6.2.68
  - Dont unbundle jquery-ui on EL9
  - Use Archive::Zip::SimpleZip instead of Archive::Zip where available


author: Xavier Bachelot <xavier@bachelot.org> 6.2.70-2
changelog:
  - Fix sympasoap socket ownership for httpd (RHBZ#2152381)
  - Fix both wwwsympa and sympasoap socket ownership for nginx


author: Xavier Bachelot <xavier@bachelot.org> 6.2.72-4
changelog:
  - Tidy up BuildRequires/Requires
  - BR: tzdata, which is not pulled from dependencies on F39+ (RHBZ#2261742)


author: Xavier Bachelot <xavier@bachelot.org> 6.2.72-5
changelog:
  - Drop EL7 support
  - Fix filter ordering
  - Fix httpd config needed after httpd fix for CVE-2024-38477 (RHBZ#2307179)


author: Ding-Yi Chen <dchen@redhat.com> - 2.0.0-1
changelog:
  - Update to 2.0.0
  - Fixes Bug 1476515 - AppStream metadata for Synergy package are missing
  - The real executable is now "synergy-core",
    "synergy" is now a symlink to synergy-core
  - cmake3 is now BuildRequired
  - syntool is removed by upstream


author: Ding-Yi Chen <dchen@redhat.com> - 2.0.0-2
changelog:
  - Restore Program /usr/bin/synergy
  - Fixes Bug 1542286 synergy-2.0.0 should not have been pushed anywhere except rawhide
  - Fixes Bug 1541640 - synergy.desktop file useless


author: Ding-Yi Chen <dchen@redhat.com> - 1:1.10.2-1
changelog:
  - Revert to v1 as Synergy 2 is back to beta
    https://symless.com/blog/synergy-2-back-beta
  - Following files/programs are gone
    * /usr/bin/synergy-core
    * /usr/share/pixmaps/synergy.ico
  - Following files/programs are back
    * /usr/bin/synergy
    * /usr/bin/syntool


author: Ding-Yi Chen <dchen@redhat.com> - 1:1.14.3.5-1
changelog:
  - Upstream update to v1.14.3.5-stable
  - Add BuildRequires: libnotify-devel, libxkbfile-devel, pugixml-devel


author: Peter Czanik <peter@czanik.hu> - 3.23.1-2
changelog:
  - fix MaxMindDB (GeoIP) packaging (make it a sub-package again)
  - fix file conflicit between rsyslog and syslog-ng: /etc/logrotate.d/syslog
    see: https://bugzilla.redhat.com/show_bug.cgi?id=1802165
    It became a weak dependency which conflicts with rsyslog


author: Roman Tsisyk <rtsisyk@fedoraproject.org> - 2.2.2.62-1
changelog:
  - New minor release.
  - Disable python2-based tests.
  - Drop ARM support - upstream doesn't support it.


author: Roman Tsisyk <rtsisyk@fedoraproject.org> - 2.4.2.68-1
changelog:
  - New minor release.
  - Use `cmake_build` && `cmake_install` instead of `make` && `make install`.
  - Update description from the official web-site.


author: Roman Tsisyk <rtsisyk@fedoraproject.org> - 2.4.2.68-2
changelog:
  - Use 755 for /var/lib/tarantool and /var/log/tarntool.
  - Fix /run directory.
  - Fix systemd invocations.
  - Disable bundled curl.
  - Disable bundled zstd.
  - Fix rpmlint warnings.
  - Speed up build.


author: Dmitrij S. Kryzhevich <krege@land.ru> - 1.17-1
changelog:
  - Update to 1.17.
  - Drop upstream patch as it was... hm... included in upstream.
  - Fix download URL.
  - Drop commented code.
  - Drop defattr tag.


author: Robert Scheck <robert@fedoraproject.org> - 1.7.21-6
changelog:
  - Disabled strip via objcopy to achieve proper -debuginfo package
  - Added patch to fix compiler warnings about implicit fall-through
  - Added patch to fix "ee key too small" error messages during tests
  - Added patch for OpenSSL 3.0 support (#2088363)


author: Jakub Jelen <jjelen@redhat.com> - 7.6-88
changelog:
  - Remove the devel subpackage (#1495181)
  - Adjust build process for recent changes (nsl separated from glibc-headers)


author: Bojan Smojver <bojan@rexursive com> - 4.4.2-1
changelog:
  - bump up to 4.4.2
  - CVE-2022-27939, CVE-2022-27940, CVE-2022-27941, CVE-2022-27942,
  - CVE-2022-28487, CVE-2022-37047, CVE-2022-37048, CVE-2022-37049


author: Bojan Smojver <bojan@rexursive com> - 4.4.3-2
changelog:
  - CVE-2023-27783 CVE-2023-27784 CVE-2023-27785 CVE-2023-27786
    CVE-2023-27787 CVE-2023-27788 CVE-2023-27789


author: Dominic Hopf <dmaphy@fedoraproject.org> - 1.92-2
changelog:
  - Improve requirement listings
  - Fix requirement for python3-psutil on EPEL8
  - Add missing requirement for gtk-update-icon-cache


author: Ding-Yi Chen <dchen@redhat.com> - 1.10.0-1
changelog:
  - Upstream update to 1.10.0
  - Fixes RHBZ #1917603 - terminology-1.10.0 is available
  - Remove BuildRequired elementary-devel because it is merged into efl-devel


author: Sandro Mani <manisandro@gmail.com> - 4.0.0-2
changelog:
  - Make all langpack / script subpackages require tesseract for tessdata dir ownership
  - Fix tesseract-osd requires
  - Fix typo cirilic -> cyrillic


author: Sandro Mani <manisandro@gmail.com> - 4.0.0-5
changelog:
  - Improve subpackage descriptions
  - Make script subpackages own the script directory
  - Bump release to -5


author: Christian Krause <chkr@fedoraproject.org> - 3.0.2-1
changelog:
  - Updated to 3.0.2 (BZ #1750167)
  - Updated installed documentation files
  - Added provided man page (adjusted to Fedora's script name "testssl")


author: Pavel Raiskup <praiskup@redhat.com> - 0-0.3.20180821git5339fb6
changelog:
  - fix versioning and other problems spotted by Robert-André Mauchin
    and Lukáš Tyrychtr (rhbz#1619528)


author: 'Ben Rosser' <rosser.bjr@gmail.com> 20150202git-2
changelog:
  - Added license tag, added an extra file to doc.
  - Changed tfdocgen man page to use a wildcard encoding.


author: Robert Scheck <robert@fedoraproject.org> - 3.8-1
changelog:
  - Upgrade to 3.8 (#1902857)
  - Spec file modernization including support for RHEL/CentOS 7
  - Remove perl(Socket6) dependency (thanks to Michal Josef Špaček)


author: Carl George <carl@george.computer> - 2.2.0-3.2020704git5a1c8d8
changelog:
  - Update to latest upstream commit
  - Add patch to use correct shell completion locations
  - Run test suite
  - Add provides for ag and bundled uthash


author: Carl George <carl@george.computer> - 2.2.0^2020704.5a1c8d8-1
changelog:
  - Switch to caret versioning
  - Build against system uthash
  - Add patch for zsh completion of new flags


author: Athmane Madjoudj <athmane@fedoraproject.org> 2.25b-35
changelog:
  - Add patch to fix RHBZ #887451 / CVE-2012-5640
  - Fix fedora logo issue (RHBZ #1114423).
  - Enable PIE flags (RHBZ #955129)
  - Use systemd for post-rotate script (RHBZ #1218259)


author: Fabian Affolter <mail@fabian-affolter.ch> - 1.0.35-1
changelog:
  - Fix for CVE-2018-16737, CVE-2018-16738 and CVE-2018-16758 
  - Update to new upstream version 1.0.35


author: Petr Šabata <contyk@redhat.com> - 5.0-0.100.b8
changelog:
  - Include current Debian and Gentoo patches
  - Add ATCP, GMCP and OPT102 support
  - This is a big change, bumping the release quite a bit to reflect that


author: Carl George <carlwgeorge@fedoraproject.org> - 1.11.1-1
changelog:
  - Update to version 1.11.1 rhbz#2220885
  - Switch to SPDX license identifier and mark license file appropriately
  - Use upstream default config file with minimal changes
  - Log to journal instead of files
  - Run daemon in foreground to remove the need for pidfile tracking


author: Dominik Mierzejewski <dominik@greysector.net> - 2.6.2-28
changelog:
  - apply Debian patch to fix CVE-2021-42260 (rhbz#2253716, rhbz#2253718)
  - apply Debian patch to fix CVE-2023-34194 and its duplicate, CVE-2023-40462
    (rhbz#2254376, rhbz#2254381)
  - fix incorrect text element encoding (upstream isssue #51)
  - compile and run tests


author: Peter Hanecak <hany@hany.sk> - 3.0.4-2
changelog:
  - droppped tipc-trace since it requires Python 2
    (see https://bugzilla.redhat.com/show_bug.cgi?id=1817029)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 0.6.9-1
changelog:
  - Simplified version and release update logic (skuznets@redhat.com)
  - Added `--use-release` flag for `tito tag` (skuznets@redhat.com)
  - Use `def` instead of a lambda for function assignment (skuznets@redhat.com)
  - Fix typos in man pages (lsedlar@redhat.com)
  - explain how automatic tagging was done (msuchy@redhat.com)
  - Rename CargoTagger as CargoBump (msehnout@redhat.com)
  - Fix errors in documentation (lsedlar@redhat.com)
  - fix few pep8 errors (sehnoutka.martin@gmail.com)
  - Read tito.props and look for pkg managers section.
    (sehnoutka.martin@gmail.com)
  - Implement cargo tagger using regular expressions (without toml library)
    (sehnoutka.martin@gmail.com)
  - Add entry point for Cargo tagger and tagger class.
    (sehnoutka.martin@gmail.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 0.6.10-1
changelog:
  - Do not undo tags when git state is dirty (skuznets@redhat.com)
  - Parse options in `tito init` (skuznets@redhat.com)
  - Only use `rpmbuild --noclean` if it is supported (skuznets@redhat.com)
  - Explicitly define indicies in formatting statements (skuznets@redhat.com)
  - Achieve quiet output from `rpmbuild` without passing `--quiet`
    (skuznets@redhat.com)
  - Update the MANIFEST.in (skuznets@redhat.com)
  - Correctly pass verbosity options through the builder CLI
    (skuznets@redhat.com)
  - Use correct print-formatting directive in debugging (skuznets@redhat.com)
  - Use `.format()` string formatting correctly in Builder (skuznets@redhat.com)
  - Refactor `rpmbuild` invocation for readability (skuznets@redhat.com)
  - Added `--quiet` and `--verbose` to `tito build` (skuznets@redhat.com)
  - Add a Travis CI manifest (skuznets@redhat.com)
  - Only flush output stream if flushing is supported (skuznets@redhat.com)
  - Added support for choosing platforms for tests (skuznets@redhat.com)
  - Refactored version->tag mapping logic in Tagger (skuznets@redhat.com)
  - Improved debugging for RPM build step (skuznets@redhat.com)
  - Print command debugging information only once (skuznets@redhat.com)
  - Flush output buffers (skuznets@redhat.com)
  - Document `tito tag --use-release` in the manpage (skuznets@redhat.com)
  - Added an option to not escalate privileges on `tito build --install`
    (skuznets@redhat.com)
  - Factor out the version->tag mapping in the Builder (skuznets@redhat.com)
  - Collapse tagger class selection logic (skuznets@redhat.com)
  - Rename `globalconfig` section to `buildconfig` in README
    (skuznets@redhat.com)
  - fixes #29 - remove --list-tags and --only-tags (jmrodri@gmail.com)
  - 253 - print cmd info when --debug is supplied (jmrodri@gmail.com)
  - Work around `dnf` issues and install builddep for Rawhide
    (skuznets@redhat.com)


author: Devan Goodwin <dgoodwin@rm-rf.ca> 0.6.11-1
changelog:
  - Fixing remote_git_name (adammhaile@gmail.com)
  - Fix links in README.md file (mzalewsk@redhat.com)
  - Encourage usage of git push --follow-tags (mzalewsk@redhat.com)
  - Print mock output when building with MockBuilder (yuxzhu@redhat.com)
  - Fix a race condition when /tmp/tito doesn't exist (vfreex@gmail.com)
  - Don't append 'None' to Release line with no '%{?dist}' part
    (patrice.fournier@ifax.com)
  - python3's map() returns a map object, but we expect sources to be a list
    (evgeni@golov.de)
  - Submitting was missing a t. (jmrodri@gmail.com)
  - update links (robberphex@gmail.com)
  - use LC_ALL=C.UTF-8 rather than plain C (msuchy@redhat.com)
  - make ReleaseTagger honour --use-version (egolov@redhat.com)
  - also verify that ReleaseTagger supports --use-release (egolov@redhat.com)
  - add test for ReleaseTagger together with --use-version (egolov@redhat.com)
  - Format package list more cleanly (skuznets@redhat.com)
  - Custom tag support in tito release (vrutkovs@redhat.com)
  - VersionTagger should support custom tag format (vrutkovs@redhat.com)
  - Remove createrepo_c BR from spec (ngompa13@gmail.com)
  - Use createrepo_c for creating rpm-md repos (ngompa13@gmail.com)
  - Fixup Fedora Dockerfiles to work correctly (ngompa13@gmail.com)
  - Remove useless EL5 stuff (ngompa13@gmail.com)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.12-1
changelog:
  - Remove obsolete Group tag (ignatenkobrain@fedoraproject.org)
  - Update URL and Source locations (awilliam@redhat.com)
  - Fix cheetah binary dependency (awilliam@redhat.com)
  - Correct and make less confusing the conditional Python macros (awilliam@redhat.com)
  - python-devel → python2-devel (ignatenkobrain@fedoraproject.org)
  - %{python_sitelib} → %{python2_sitelib} (ignatenkobrain@fedoraproject.org)
  - Remove %clean section (ignatenkobrain@fedoraproject.org)
  - Use python3 on EPEL8 (frostyx@email.cz)
  - Do not require obsoleted fedora-cert (msuchy@redhat.com)
  - Fix tito build --test --rpm -i Traceback on Fedora 31 (sisi.chlupova@gmail.com)
  - Enable GnuPG signed tags (bcl@redhat.com)
  - Fix #335 handle source tarballs with UTF8 characters in the name (awood@redhat.com)
  - Remove deprecated BuildRoot macros from spec (awood@redhat.com)
  - Releaser: Ensure rpmlintrc files are copied when releasing (ngompa13@gmail.com)
  - Releaser: Ensure SUSE-style changes file is copied when releasing (ngompa13@gmail.com)
  - Tagger: Add SUSETagger to support SUSE-style detached changelogs (ngompa13@gmail.com)
  - Add support for building with Git LFS. (ntillman@barracuda.com)
  - use built-in shutil.copy2 instead of cp command (mtinberg@wisc.edu)
  - Avoid double builds with mock (tdockendorf@osc.edu)
  - Fix rsync failures in dockerized tests, update for F27. (dgoodwin@redhat.com)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.13-1
changelog:
  - Add _copy_extra_sources() method to BuilderBase class.
    (daniel@versatushpc.com.br)
  - Rename HACKING to HACKING.md so it renders on GitHub (tadej.j@nez.si)
  - Modernize developer installation (tadej.j@nez.si)
  - make get_project_name more resilient (evgeni@golov.de)
  - Use pycodestyle pacakge when pep8 is not available (frostyx@email.cz)
  - Move to python-blessed (ekulik@redhat.com)
  - Fix the Source0 URL and prep phase (frostyx@email.cz)
  - run_command_print should behave similar to run_command (yuxzhu@redhat.com)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.14-1
changelog:
  - Fix #367 - copy_extra_sources for alternative builders (frostyx@email.cz)
  - Fix #243 - Add a list of projects using tito (frostyx@email.cz)
  - Fix #364 - Make yes or no input less aggressive (frostyx@email.cz)
  - Fix #358 - Move bugzilla code to a separate file (frostyx@email.cz)
  - Fix #158 - Separate .tito directory creation from tito.props file creation (frostyx@email.cz)
  - Fix #338 - Use os.makedirs instead of running mkdir -p command (frostyx@email.cz)
  - Fix #331 - Do not specify file digest algorithms (frostyx@email.cz)
  - #305 - Add a possibility to have full datetime entries in changelog (frostyx@email.cz)
  - #252 - Use template to generate file with __version__ (frostyx@email.cz)
  - #187 - Implement --version parameter (frostyx@email.cz)
  - mention the #tito irc channel in the readme (frostyx@email.cz)
  - Describe how to release tito (frostyx@email.cz)
  - Move tito under rpm-software-management namespace (frostyx@email.cz)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.15-1
changelog:
  - FedoraGitReleaser: upload extra sources to lookaside cache
    (praiskup@redhat.com)
  - When extra source file exist, then do not copy it
    (jhnidek@redhat.com)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.16-1
changelog:
  - Fix manpage generation on Fedora Rawhide (F34)
  - Ignore spectool warnings
  - Skip nonexisting extra sources
  - Fix copy_extra_sources for remote URLs
  - Use --no-rebuild-srpm for scratch builds in KojiReleaser


author: Jakub Kadlcik <frostyx@email.cz> 0.6.17-1
changelog:
  - Update releasers.conf (frostyx@email.cz)
  - Make build --verbose autocompletable (nmoumoul@redhat.com)
  - Add support for centpkg (wpoteat@redhat.com)
  - Remove extraneous extra newline (areese@users.noreply.github.com)
  - Add some documentation for tito.builder.SubmoduleAwareBuilder
    (areese999@apple.com)
  - Update based on feedback: 1. Remove PushDir, tito.common.chdir has the same
    functionality so use that instead. 2. Remove useless override of constructor,
    it's just extra noise. (areese999@apple.com)
  - 150 Add support for repos that use submodules. Allow though submodules are a
    contentious topic, this adds a submodule_aware_builder (areese999@apple.com)
  - doc: fix typo tito.props (subpop@users.noreply.github.com)
  - Update fedora releaser in .tito/releasers.conf (frostyx@email.cz)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.18-1
changelog:
  - Document fetch_sources option in tito.props (frostyx@email.cz)
  - Rename fetch-sources to fetch_sources in the tito.props config
    (frostyx@email.cz)
  - Adding option to fetch sources (sisi.chlupova@gmail.com)
  - Change the master branch in releasers.conf to rawhide (frostyx@email.cz)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.20-1
changelog:
  - Sync repo (in addition to tag) during mead build (nmoumoul@redhat.com)
  - Add 'Building RHEL packages with Tito' as external doc (frostyx@email.cz)
  - Consider the current project git config when releasing to DistGit
    (frostyx@email.cz)
  - Print the problematic binary files (frostyx@email.cz)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.21-1
changelog:
  - Properly catch TitoException (frostyx@email.cz)
  - Add documentation for the MockBuilder (frostyx@email.cz)
  - Allow to define mock chroot in tito.props (frostyx@email.cz)
  - Fix recursion error in MockBuilder (frostyx@email.cz)
  - DistGitReleasers: don't nuke external sources with fetch_sources (praiskup@redhat.com)
  - Add installation instructions from PyPI (frostyx@email.cz)
  - Add long_description to setup.py (frostyx@email.cz)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.22-1
changelog:
  - Fix python2 urlretrieve import (frostyx@email.cz)
  - Fixed submodule archives concatenation (jerzy.drozdz@jdsieci.pl)
  - Fixed issue #414 (jerzy.drozdz@jdsieci.pl)
  - Fixed issue #413 (jerzy.drozdz@jdsieci.pl)
  - Revert 45d431ad149cb33e2462a990c4c4f29e6bb2bb7e (nmoumoul@redhat.com)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.23-1
changelog:
  - Replace `submodule--helper list` with `git config --get-regexp`
  - do not overwrite packit.yaml and its variants (msuchy@redhat.com)
  - packit: fixing the Fedora build failures (praiskup@redhat.com)
  - Don't upload patches to the lookaside cache (frostyx@email.cz)
  - use spdx license (msuchy@redhat.com)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.24-1
changelog:
  - Will now copy both source files and patch files declared in the spec
  - Fix UpstreamBuilder deprecation warning (#461) (frostyx@email.cz)
  - Fix the setup.py license according to tito.spec (#433) (frostyx@email.cz)


author: Jakub Kadlcik <frostyx@email.cz>
changelog:
  - Use rpm.ds instead of deprecated hdr.dsFromHeader (frostyx@email.cz)
  - Support branch aliases in releasers (frostyx@email.cz)
  - Document how to automate bodhi updates (msuchy@redhat.com)
  - Use raw strings for regex patterns (frostyx@email.cz)
  - Allow tito build without .tito directory (frostyx@email.cz)
  - Unify README and index.md (msuchy@redhat.com)
  - Fix PEP8 issues found by runtests.py (frostyx@email.cz)
  - Replace egrep with grep -E (frostyx@email.cz)
  - Don't use --cacheonly on DNF5 (frostyx@email.cz)


author: Jakub Kadlcik <frostyx@email.cz> 0.6.26-1
changelog:
  - Fix issue with missing version numbers in the changelog (frostyx@email.cz)
  - Tito wrapper for easier development (praiskup@redhat.com)


author: Jakub Kadlčík <frostyx@email.cz>
changelog:
  - Defer submodule detection to git
  - Many improvements to tests and they now run during package build
  - New config option `buildconfig.test_version_suffix`


author: TI_Eugene <ti.eugene@gmail.com> - 0.9.3-2
changelog:
  - License fixes.
  - *.so.* names fix
  - make_build fix
  - -doc fixes
  - check fixes
  - ldconfig call fix
  - compiler flags fixes


author: TI_Eugene <ti.eugene@gmail.com> - 0.9.3-3
changelog:
  - Disabled only those tests that lock excessive numbers of pages (and will
    therefore fail on a system with default resource limits)
  - Disabled LTO, since it causes test failures on all file-based database tests
  - Added COPYING file in files section for -doc subpackage
  - Installing doc/ and api-doc/ subdirectories in -doc subpackage
  - Added example/ to -doc
  - Changed man pages wildcard from ..._*.1.* to ..._*.1*
  - Removed -lib/-libs mess
  - Excluded i686 arch


author: TI_Eugene <ti.eugene@gmail.com> - 0.9.3-4
changelog:
  - 'Required: pkgconfig' removed from -devel
  - spec spaces/tabs resolved
  - Added CONTRIBUTING.md to -libs
  - examples/ moved from -doc to -devel
  - `excludearch i686` proven


author: TI_Eugene <ti.eugene@gmail.com> - 0.9.15-1
changelog:
  - Version bump
  - Added gcc10 as required for el8
  - x32 enabled (#1920195)
  - 'make check' temporary disabled


author: TI_Eugene <ti.eugene@gmail.com> - 1.0.13-1
changelog:
  - Version bump
  - 'make check-light' implemented (https://github.com/estraier/tkrzw/issues/23)
  - ppc64le temporary disabled


author: Sonia Xu <sonix@amazon.com> - 1:9.0.59-1
changelog:
  - Update to 9.0.59
  - Resolves: rhbz#2047419 - CVE-2022-23181 tomcat: local privilege escalation vulnerability


author: Coty Sutherland <csutherl@redhat.com> - 1:9.0.65-2
changelog:
  - Cleaning up some unused deps and system properties
  - Conditionally remove some classes that are not provided by the bnd
    version shipped in el8


author: Peng Wu <pwu@redhat.com> - 0.6.0-37
changelog:
  - Update BuildRequires to mariadb-connector-c-devel
  - Add tomoe-0.6.0-fixes-set-parse-error.patch to fix compile


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.9-1
changelog:
  - update to latest upstream release https://forum.torproject.org/t/security-release-0-4-8-9/10155
  - security fixes for bz#2248562 & bz#2248563
  - add --enable-gpl build options to enable PoW as DDoS protection bz#2247828


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.10-1
changelog:
  - update to latest upstream release https://forum.torproject.org/t/security-release-0-4-8-10/10536
  - security fixes for bz#2253846 & bz#2211726 & bz#2253847


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.11-1
changelog:
  - update to latest upstream release https://forum.torproject.org/t/stable-release-0-4-8-11/12265
  - bz#2211726


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.12-1
changelog:
  - update to latest upstream release https://forum.torproject.org/t/stable-release-0-4-8-12/13060
  - Security fixes: bz#2248564, bz#2281499, bz#2281500, bz#2281502, bz#2281503
  - switch to sysusers based user provisioning approach - fixes bz#2252618
  - Add legacy openssl build dependency from F41 on - fixes FTBS / bz#2301334
  - since we can now drop EL7 support we can also cleanup systemd handling


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.12-2
changelog:
  - Re-add systemd-devel as build dependency so the daemon knows how to notify systemd that it was started - fixes bz#2302910


author: Marcel Härry <mh+fedora@scrit.ch> - 0.4.8.13-1
changelog:
  - update to latest upstream release https://forum.torproject.org/t/new-tor-stable-release-0-4-8-13/15397 (bz#2211726)
  - reviewed and adjusted SPDX license format


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.10-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.10.
  - Changed a dependency from ncurses-devel to pkgconfig(ncurses), now that
    the Autoconf macro uses pkg-config.
  - Added a dependency on gcc, as per the Fedora Packaging Guidelines for C
    programs.
  - Added a dependency on desktop-file-utils for the desktop file.
  - Install the desktop file and icons now shipped with Star Traders.
  - Install the COPYING file to /usr/share/licenses/trader.
  - Use generic make_build and make_install macros.


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.15-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.15.
  - Added a dependency on make, as per current packaging guidelines.


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.16-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.16.
  - Added an AppStream-conforming metadata file.


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.18-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.18.
  - Added verification of upstream signature.


author: John Zaitseff <J.Zaitseff@zap.org.au> - 7.19-1
changelog:
  - Updated the RPM package for a new release of Star Traders: version 7.19.
  - Update rules for AppStream metainfo and desktop files.


author: Jered Floyd <jered@redhat.com> 9.1.2-1
changelog:
  - Initial revision
  - Adapt to modern rpm conventions
  - Add draft SELinux policy
  - Don't run as root, just claim CAP_NET_BIND_SERVICE for
    privileged ports
  - Merge and cleanup of upstream .spec file along with Copr version
    maintained by Hiroaki Nakamura <hnakamur@gmail.com>, based on
    long-ophaned package.  ChangeLog included below for reference.


author: Jered Floyd <jered@redhat.com> 9.1.2-5
changelog:
  - Changes based on spec review; change "RedHat" capitalization,
    and add link to upstream file layout discussion


author: Jered Floyd <jered@redhat.com> 9.1.2-8
changelog:
  - Cherry-pick OpenSSL 3 compatibility required for RHEL 9
  - Switch to OpenSSL 3 on f36+
  - Include automake in BuildRequires


author: Jered Floyd <jered@redhat.com> 9.1.3-1
changelog:
  - Update to 9.1.3, resolves CVE-2022-25763, CVE-2022-31779, CVE-2021-37150,
    CVE-2022-28129, CVE-2022-31780
  - Resolve glibc 2.36 (f37) header incompatibility that caused FTBFS RHBZ#2112282


author: Jered Floyd <jered@redhat.com> 9.2.4-2
changelog:
  - Enable build with deprecated OpenSSL Engine
    https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 4.11-13
changelog:
  - Add BuildRequires on gcc-c++
  - Remove Group tags
  - Don't clear the buildroot in the install section
  - Switch to %ldconfig_scriptlets


author: Kevin Kofler <Kevin@tigcc.ticalc.org> 0.35-5
changelog:
  - Change URL to https
  - Get the tarball directly from upstream rather than from Ubuntu
  - Remove redundant "-n %{name}-%{version}" from %setup
  - Use %py3_build and %py3_install macros
  - Add Python 3.6 to check-requirements


author: Kevin Kofler <Kevin@tigcc.ticalc.org> 0.35-6
changelog:
  - Change permissions of the *.rules files from 0640 to 0644
  - Change permissions of the before.init and after.init hooks from 0640 to 0755
  - Don't prepend /usr/bin/env to sys.executable, which is always an absolute path


author: Jaroslav Škarvada <jskarvad@redhat.com> - 3.14.0.0-1.20190401gitac96d055
changelog:
  - New version, switched to git snapshot
  - Conditionalized wireshark support
  - Disabled wireshark support, it's currently broken (upstream ticket #268)
  - Disabled tests, it's currently broken (upstream ticket #267)
  - Dropped boost169 patch (not needed)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 3.14.0.0-2.201904023gitc52f3f41
changelog:
  - New git snapshot
  - Added python2-numpy build requirement
  - Re-enabled tests for upstream to easily reproduce the problem


author: Jeremy Newton <alexjnewt AT hotmail DOT com> 1.0-2.20190403git1139876
changelog:
  - Update to newer git, fixes install issues and all patches upstreamed
  - Add missing static provides for devel


author: Robert Scheck <robert@fedoraproject.org> 3.2.4-3
changelog:
  - Added proxyscan 1.1 module for scanning open proxy servers (DNSBL,
    HTTP-CONNECT and -POST, Socks 4 and 5, Wingate and Cisco routers)


author: Robert Scheck <robert@fedoraproject.org> 5.0.7-2
changelog:
  - Remove build-time path from rpath (#1891370 #c1)
  - Apply Fedora system-wide crypto policy (#1891370 #c1)
  - License breakdown in spec file (#1891370 #c1)


author: Chris Adams <linux@cmadams.net> - 1.2.8-0.8.20171022svn14722
changelog:
  - update to new upstream snapshot
  - fix SSL to build against newer OpenSSL (works with older too)
  - update default config to have Fedora SSL path
  - update systemd service file to restart on failure
  - sync Fedora and EPEL SRPMS, drop EPEL 5


author: Chris Adams <linux@cmadams.net> - 1.2.8-0.13.20171022svn14722
changelog:
  - clean up spec file and remove conditionals - spec file is for F28+
  - remove tcp-wrappers (obsolete, use iptables to control access)
  - add gcc BR for future Fedora
  - switch to private user, fix default config parse (BZ 1543142)
  - switch to foreground for systemd unit


author: Dominik 'Rathann' Mierzejewski <rpm@greysector.net> - 2.3.6-1
changelog:
  - update to 2.3.6
  - new upstream location
  - use cmake and run tests
  - switch main package to archful per
    https://docs.fedoraproject.org/en-US/packaging-guidelines/#_do_not_use_noarch


author: Jonathan Wright <jonathan@almalinux.org> - 7.2.5-8
changelog:
  - Enable tests by default
    selectively disable tests that fail in mock for redis
    disable redis-sentinel tests, they always fail in mock


author: Pavel Raiskup <praiskup@redhat.com> - 5-1
changelog:
  - support for fast "ruff" analyser
  - --linter-tag option added
  - subproject detection by .vcs-diff-lint.yml


author: Pavel Raiskup <praiskup@redhat.com> 6-1
changelog:
  - bugfix: correctly honor file renames
  - bugfix: fix subproject detection for git worktree
  - ruff: do full project scans (since Ruff is fast enough)
  - check the new (changed) code in a side-directory


author: Pavel Raiskup <praiskup@redhat.com> 6.2-1
changelog:
  - drop unnecessary newline in the output
  - ruff: don't prefix the error locations with absolute path
  - ruff: don't optimize out the full Ruff run
  - print the git sha1 being analyzed
  - bugfix: correct matching filenames with endswith()


author: Pavel Raiskup <praiskup@redhat.com> 6.3-1
changelog:
  - don't require all the linters, just recommend them
  - use requested linters only if they are available
  - nicer info/debug output


author: Scott Tsai scottt.tw@gmail.com - 3.922-5
changelog:
  - Remove duplicate copies of 'examples' in /usr/share/doc
  - https://bugzilla.redhat.com/show_bug.cgi?id=1592057#c3


author: Martin Gansser <martinkg@fedoraproject.org> - 1.1-3.20170830gitafc8ea9
changelog:
  - change license tag to GPLv2
  - fix warning _FORTIFY_SOURCE requires compiling with optimization (-O)


author: Daniel Berteaud <daniel@firewall-services.com> 0.2.19-1
changelog:
  - Add an exclusive lock to be sure we correctly count the number of running
    backups This also ensure only one LVM snapshot is created at a time, which is
    a good thing to prevent overloading the system (daniel@firewall-services.com)


author: Daniel Berteaud <daniel@firewall-services.com> 0.2.22-1
changelog:
  - Support pigz compression (daniel@firewall-services.com)
  - Don't try to detect backing LVM volume is snapshot is disabled
    (daniel@firewall-services.com)


author: Daniel Berteaud <daniel@firewall-services.com> 0.2.23-1
changelog:
  - Remove redundant debug statement (daniel@firewall-services.com)
  - Fix $glock scope (daniel@firewall-services.com)
  - Fix tito releasers (daniel@firewall-services.com)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.19.rc1
changelog:
  - Update to version 2.1.0-rc1
  - Drop patches accepted upstream:
    voms-nid-defined.patch, voms-gssapi-header.patch and voms-wsdl2h.patch
  - Use systemd unit file from source distribution


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 2.1.0-0.27.rc3
changelog:
  - Update to version 2.1.0-rc3
  - Drop patches accepted upstream
  - Add new patches (the PRs have been accepted upstream)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 3.3.0-8
changelog:
  - Only remove the maven-javadoc-plugin configuration on EPEL 8
  - Add source version to javadoc configuration (backported from git)


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 3.3.2-1
changelog:
  - Update to version 3.3.2 - matches canl-java 2.6.x
  - Drop patches voms-api-java-javadoc-source.patch and -no-local.patch


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 3.3.2-1
changelog:
  - Update to version 3.3.2
  - Drop patches voms-clients-java-use-a-more-sensible-timeout.patch and
    voms-clients-java-change-default-proxy-cert-key-length-to-2048-bits.patch


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 3.1.7-5
changelog:
  - Build using mariadb-connector-c for Fedora 28+
  - EPEL 5 End-Of-Life specfile clean-up
    - Remove Group and BuildRoot tags
    - Don't clear the buildroot in the install section
    - Remove the clean section


author: James Hennessy <jphxxxx@gmail.com>
changelog:
  - Fixed issue where vpnc-script is using resolvconf on systems where "resolve" isn't enabled in /etc/nsswitch.


author: Robert Scheck <robert@fedoraproject.org> - 0.5.3-63.git20230121
changelog:
  - Added upstream patch to fix out-of-bounds access due to multiple backspaces
    to address incomplete fix for CVE-2022-38223 (#2222775, #2222780, #2255207)


author: Luiz Carvalho <lui@redhat.com> - 1.1.4-1
changelog:
  - New ``/config`` API endpoint to expose the application configuration
  - Retry sending STOMP message after a delay
  - Revert allow overriding krb_principal option for waiverdb-cli


author: Valerij Maljulin <vmaljuli@redhat.com> - 1.1.7-1
changelog:
  - Support for multiple LDAP queries was added
  - Calling ``start`` for the ``stomp.py`` connection was removed as it was deprecated
  - ``scenario`` field was added to the database


author: Lukas Holecek <hluk@email.cz> - 1.3.0-1
changelog:
  - A simpler permission configuration can be now used. New option
    ``PERMISSIONS`` uses glob expressions instead of a regular expression to
    verify the user is allowed to waive a test case. The configuration can be
    listed with :http:get:`/api/v1.0/permissions`. Additional GET parameter
    ``testcase`` can be used to filter the list by matching test case.
    ``PERMISSION_MAPPING`` is deprecated but still works if the new option is not
    defined.
  - Fixes possible disconnecting issue with older stomp.py library
    (https://github.com/jasonrbriggs/stomp.py/issues/323).


author: Lukas Holecek <hluk@email.cz> - 1.4.0-1
changelog:
  - On an authentication error, waiverdb-cli will now print the actual error
    message instead of a JSONDecodeError exception.
  - Documentation has been updated and moved to: https://waiverdb.readthedocs.io


author: Benjamin A. Beasley <code@musicinmybrain.net> - 6.0.4-12
changelog:
  - Explicitly set most Makefile variables
  - Moves the documentation into the standard location
  - Enables rebuilding localized man pages etc.


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.2.2-17
changelog:
  - Change URLs from HTTP to HTTPS
  - Add source file signature verification
  - Use %make_build and %make_install macros
  - Reformatting and minor changes for personal style preference
  - Fix man page glob
  - Use less broad globs
  - Add ABOUT-NLS, BACKLOG, and THANKS as %doc files
  - Rebuild configure script at build time
  - Add a %check section and run the tests
  - Add ncurses-devel BR for termcap/curses support
  - Add missing BR on gcc
  - Rebuild man pages in RPM build
  - Properly install license file (COPYING)


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.2.2-18
changelog:
  - Improve summary and description text
  - Build HTML and PDF versions of the documentation
  - Add Latex2e to License field


author: Mikel Olasagasti Uranga <mikel@olasagasti.info> - 0.0.2
changelog:
  - Update to 0.0.2
  - Install webp-pixbuf.thumbnailer
  - Remove extra license text file, now bundled in the release


author: Wolfgang Stöggl <c72578@yahoo.de> - 0.8.2-1
changelog:
  - New upstream version
  - Drop patches (fixed upstream):
    websocketpp-0.8.1-boost_1.70.patch
    websocketpp-0.8.1-fix_CMakeLists.txt_version_number.patch


author: Joe Walker <grumpey0@gmail.com> - 2.7.1-1
changelog:
  - Update to Version 2.7.1
    (https://weechat.org/files/releasenotes/ReleaseNotes-2.7.1.html)
    (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8955)


author: Michel Alexandre Salim <salimma@fedoraproject.org> 3.4-7
changelog:
  - Fix test compilation
  - build tests with -fPIC
  - install test dependency on locale data
  - disable failing tests


author: Michal Ambroz <rebus at, seznam.cz> - 0.5.5-2
changelog:
  - removed alias bundle - needs to be solved by
  - added conditional for the (network) tests
  - license is GPLv2+
  - empty the plugin/IpToCountry.csv with problematic 
  - move addons and plugin-development to doc folder


author: Sudip Shil <sshil@redhat.com> - 1.0.1-1
changelog:
  - -h option for help
  - --all, --sort, --help long options are available
  - warning will be given if no input after `whichfont -a`


author: Sudip Shil <sshil@redhat.com> - 1.0.7-1
changelog:
  - feature added: fontname option, sans-serif would be default
  - feature added: add option to print utf8 hex sequence


author: Sudip Shil <sshil@redhat.com> - 1.0.8-1
changelog:
  - Handling non-printable charcaters
  - Print nicer names for all non-printable characters
  - code rendering


author: dave@bevhost.com 20080615-13.2
changelog:
  - Added parameterized systemd unit file for client
  - Added more complete usage example to RELEASENOTES


author: dave@bevhost.com 20080615-23.1
changelog:
  - Update upstream from 13 to 23 including
  - bugfix close file descriptions on exec
  - bugfix warning suppression for YYDEBUG
  - better logging for Option 20
  - added more examples in documentation
  - enhancement now able to randomize interface IP


author: Hans de Goede <hdegoede@redhat.com> - 0.4.2-1
changelog:
  - New upstream release 0.4.2 (rhbz#1433550)
  - Fixes CVE-2017-11661 CVE-2017-11662 CVE-2017-11663 CVE-2017-11664 (#1479315)


author: Joe Doss <joe@solidadmin.com> - 1.0.20191226-1
changelog:
  - Update to 1.0.20191226
  - Split wireguard-tools back into it's own spec file
  - Add in patch to fix dns-hatchet path


author: Leigh Scott <leigh123linux@gmail.com> - 1.0.20200319-2
changelog:
  - Add missing config directory
  - Remove default buildroot BuildRequires
  - Simplify doc install
  - Remove commented lines
  - Use correct macro for bash-completion


author: Joe Doss <joe@solidadmin.com> - 1.0.20200510-1
changelog:
  - Update to 1.0.20200510
  - ipc: add support for openbsd kernel implementation
  - ipc: cleanup openbsd support
  - wg-quick: add support for openbsd kernel implementation
  - wg-quick: cleanup openbsd support
  - wg-quick: support dns search domains
  - Makefile: simplify silent cleaning
  - ipc: remove extra space
  - git: add gitattributes so tarball doesn't have gitignore files
  - terminal: specialize color_mode to stdout only
  - wg-quick: android: support application whitelist
  - systemd: add wg-quick.target


author: Joe Doss <joe@solidadmin.com> - 1.0.20200513-1
changelog:
  - Update to 1.0.20200513
  - Makefile: remember to install all systemd units
  - ipc: openbsd: switch to array ioctl interface


author: Joe Doss <joe@solidadmin.com> - 1.0.20200820-1
changelog:
  - Update to 1.0.20200820
  - ipc: split into separate files per-platform
  - wincompat: fold random into genkey
  - systemd: add reload target to systemd unit
  - man: wg-quick: use syncconf instead of addconf for strip example
  - pubkey: isblank is a subset of isspace
  - ctype: use non-locale-specific ctype.h
  - wg-quick: wait on process substitutions


author: Joe Doss <joe@solidadmin.com> - 1.0.20200827-1
changelog:
  - Update to 1.0.20200827
  - wg-quick: android: use iproute2 to bring up interface instead of ndc
  - wg-quick: Revert wait on process substitutions


author: Joe Doss <joe@solidadmin.com> - 1.0.20210223-1
changelog:
  - wg-quick: android: do not free iterated pointer
  - wg-quick: openbsd: no use for userspace support
  - embeddable-wg-library: sync latest from netlink.h
  - wincompat: recent mingw has inet_ntop/inet_pton
  - wincompat: add resource and manifest and enable lto
  - wincompat: do not elevate by default
  - completion: add help and syncconf completions
  - sticky-sockets: do not use SO_REUSEADDR
  - man: LOG_LEVEL variables changed name
  - ipc: do not use fscanf with trailing \n
  - ipc: read trailing responses after set operation


author: Joe Doss <joe@solidadmin.com> - 1.0.20210315-1
changelog:
  - Makefile: fix version indicator
  - wireguard-tools: const correctness
  - wireguard-tools: drag in headers for prototypes
  - ipc: uniformly ignore preshared keys that are zero
  - wg-quick: freebsd: add kernel support
  - ipc: freebsd: add initial FreeBSD support
  - wg-quick: freebsd: avoid writing private keys to /tmp


author: Joe Doss <joe@solidadmin.com> - 1.0.20210424-1
changelog:
  - wg-quick: freebsd: check for socket using -S, not -f
  - wg-quick: freebsd: do not assume point-to-point interface flag
  - wg-quick: freebsd: use ifconfig for determining if interface is up
  - wg-quick: kill route monitor when loop terminates


author: Joe Doss <joe@solidadmin.com> - 1.0.20210914-1
changelog:
  - contrib/launchd: fix xml syntax error
  - wg-quick: darwin: account for "link#XX" gateways
  - ipc: add wireguard-nt support
  - ipc: cache windows lookups to avoid O(n^2) with nested lookups
  - ipc: remove windows elevation
  - ipc: windows: don't display disabled adapters
  - ipc: windows: use devpkey instead of nci for name
  - wg-quick: android: adjust for android 12
  - wg-quick: openbsd: set DNS with resolvd(8)


author: John W. Linville <linville@redhat.com> - 1:29-20
changelog:
  - Remove essentially unused pre_release tagging in spec file
  - Fixup Makefile patch to include LDFLAGS in all linking commands


author: Benjamin A. Beasley <code@musicinmybrain.net> - 0.20091126-27
changelog:
  - Clarify URL/Source situation, and do not claim to have a working source
    archive URL
  - General tidying of spec file; use modern macros and install HTML format
    description as documentation
  - Add hand-written man pages


author: Yaakov Selkowitz <yselkowi@redhat.com> - 1.10.50-1
changelog:
  - Update to 1.10.50
  - Enable GNOME Flashback applet
  - Support GNOME Shell 42 (#2132504) and 43 (#2132507)


author: Sérgio Basto <sergio@serjux.com> - 0.9.16-1
changelog:
  - Update to 0.9.16
  - Java viewers moved to
    https://github.com/LibVNC/libvncserver/tree/master/webclients/java-applet
  - classes and jars have been removed from upstream sources.
  - Remove support to EL5
  - Encoding and permissions of files seems that are correct, no need to fix.
  - rpmlint doesn't find any hardcoded rpath


author: Petr Pisar <ppisar@redhat.com> - 0.9.16-2
changelog:
  - Modernize a spec file
  - License corrected from GPLv2 to GPLv2+
  - Enforce system crypto policy
  - Normalize ChangeLog encoding
  - Fix building with GCC 10 properly
  - Fix a NULL pointer dereference in a cursor handler (upstream bug #123)


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.12.0-1
changelog:
  - New upstream version 1.12.0
  - Source code signature verification
  - New CMake build system
  - Enable new optional ICU dependency
  - Build API documentation with Doxygen


author: Benjamin A. Beasley <code@musicinmybrain.net> - 1.12.0-2
changelog:
  - Make spec file compatible with EPEL8: force CMake out-of-source build, add
    ldconfig_scriptlets macro, and add explicit dependency on graphviz (dot) for
    API docs


author: Benjamin A. Beasley <code@musicinmybrain.net> 1.12.0-5
changelog:
  - Commit KEYS (gpg keychain for source verification) to SCM rather than
    keeping it in the lookaside cache


author: Mosaab Alzoubi <moceap[AT]hotmail[DOT]com> - 1.6.1-1
changelog:
  - Update to 1.6.1
  - Change upstream
  - Exclude CVE-2010-0055 patch, includes in upstream
  - Exclude norpath patch, using sed
  - Pass FTBFS state #1676224
  - General clean of the spec
  - Use Fedora guide lines in Source URL


author: Mosaab Alzoubi <moceap[AT]hotmail[DOT]com> - 1.8.0.417.1-1
changelog:
  - Use Apple upstream instead of non-fresh Github one
  - New upstream in 1.8 dev branch with 417.1 subversion
  - Close CVE-2018-17093
  - Close CVE-2018-17094
  - Close CVE-2017-11124
  - Close CVE-2017-11125
  - Close CVE-2010-3798
  - Use license macro
  - Add OpenSSL To Configuration


author: Peter Hutterer <peter.hutterer@redhat.com> 1.1.0-4
changelog:
  - Reduce the BuildRequires to the set actually needed
  - update the rest of the spec a bit, drop RHEL5 conditional


author: Davide Cavalca <dcavalca@fedoraproject.org> - 1.1.8-2
changelog:
  - Unretire package
  - Update URL
  - Install README as doc
  - Use the appropriate macro to install the license
  - Relax globbing for man pages
  - Convert specfile from tabs to spaces


author: Robin Lee <cheeselee@fedoraproject.org> - 7.12.0-1
changelog:
  - Update to 7.12.0
  - Remove upstreamed patches
  - Don't require removed subpackage
  - use %{_localstatedir} instead of %{_var}


author: Robin Lee <cheeselee@fedoraproject.org> - 7.12.0-2
changelog:
  - Re-enable the service if it was enabled in sysv mode
  - Follow upstream to enable net.ipv4.conf.all.arp_notify


author: Robin Lee <cheeselee@fedoraproject.org> - 7.16.0-1
changelog:
  - Rename to xe-guest-utilities-latest to not conflict with the xe-guest-utilities package
    provided in Citrix Hypervisor
  - Release 7.16.0
  - Separate %{buildnum} and %{release}


author: Robin Lee <cheeselee@fedoraproject.org> - 7.21.0-1
changelog:
  - Update to 7.21.0, supports CentOS 8.3
  - Apply to patch to support CentOS Stream 8
  - Update Citrix Hypervisor to the latest one


author: Jerry James <loganjerry@gmail.com> - 21.5.34-29.20171230hg92757c2b8239
changelog:
  - Update to latest mercurial snapshot for miscellaneous bug fixes
  - Remove obsolete scriptlets
  - Drop upstreamed -endian, -gcpro, and -format-overflow patches
  - Install a scalable icon


author: Jerry James <loganjerry@gmail.com> - 21.5.34-33.20190323hgc0ed7ef9a5a1
changelog:
  - Update to latest mercurial snapshot for miscellaneous bug fixes
  - Switch from NSS to OpenSSL
  - Build with openldap support
  - Compress the Lisp source files


author: Tim Landscheidt <tim@tim-landscheidt.de> - 21.5.34-33.20190323hgc0ed7ef9a5a1
changelog:
  - Obsolete -el subpackage
  - Remove needless use of %defattr
  - Simplify generation of file list
  - Enable test suite


author: Jerry James <loganjerry@gmail.com> - 20190315-1
changelog:
  - Update all packages
  - Include mew again, since xemacs-mew no longer exists
  - Add -python3 patch and build with python3 instead of python2
  - Add -eval-when and -deps patches to fix FTBFS


author: Mukundan Ragavan <nonamedotc@fedoraproject.org> - 4.13.8-1
changelog:
  - Update to 4.13.8
  - Enable gobject introspection
  - Following upstream, disable perl bindings and obsolete xfconf-perl sub-pkg


author: Hans de Goede <hdegoede@redhat.com> - 3.2.6a-6
changelog:
  - Fix font issues (rhbz#1523624) :
   - Adjust xfig-3.2.5-urwfonts.patch for new font names in urw-base35-fonts
   - Except for the symbols font, use the old un-scalable Adobe PCF Symbol font
     for now as StandardSymbolsPS.otf from urw-base35-fonts is currently broken
   - Add a patch to deal with some fonts being scalable, while Symbol is not
   - Note the dingbats font is also broken in urw-base35-fonts, but there is no
     replacement for it, so that font is still broken, see rhbz#1534206
  - ghostscript-core no longer exists, instead require ghostscript (rhbz#1536581)
  - Remove obsolete icon-cache and desktop-database scriptlets
  - Add a patch from Debian fixing some issues with arrows


author: Hans de Goede <hdegoede@redhat.com> - 3.2.6a-7
changelog:
  - Fix font issues take 2 (rhbz#1523624) :
   - It turns out the new urw fonts are completely unusuable as X11 core fonts,
     stop using them for now (see bug rhbz#1551219)
   - Add a patch to use the fallback fonts for non-scalable fonts too, so that
     we at least show something somewhat reasonable for Bookman, New Century
     Schoolbook and Palatino
   - This means that display of Zapf Chancery and Zapf Dingbats currently
     falls back to the "fixed" font, which is completely wrong for Dingbats


author: Hans de Goede <hdegoede@redhat.com> - 3.2.7a-1
changelog:
  - New upstream release 3.2.7a
  - Add Requires: transfig to make sure esp export works (rhbz#1642033)
  - Switch back to URW fonts so that Bookman, New Century Schoolbook and
    Palatino work again. This uses the old version of the URW fonts which are
    now packaged as urw-base35-fonts-legacy (rhbz#1523624, rhbz#1551219)
  - Trim the changelog


author: Paul Wouters <pwouters@redhat.com> - 1.3.14-1
changelog:
  - Resolves: rhbz#1322190 Updated to 1.3.14
  - Resolves: rhbz#1722121 Use proper /run directory
  - Resolves: rhbz#1399648 Review Request: xl2tpd


author: Paul Wouters <pwouters@redhat.com> - 1.3.15-1
changelog:
  - Resolves: rhbz#1761700 xl2tpd-1.3.15 is available
  - Resolves: rhbz#1875262 Unsupported options 'crtscts' and 'lock' in /etc/ppp/options.xl2tpd
  - Resolves: rhbz#1869420 xl2tpd.service:8: PIDFile= references a path below legacy directory /var/run/


author: Bojan Smojver <bojan@rexursive.com> - 0.9.19-5
changelog:
  - Insert glamoregl module into xorg.conf for glamor package
  - Add missed Xorg server dependencies into glamor package


author: Luya Tshimbalanga <luya@fedoraproject.org> - 1.0.17-1
changelog:
  - Update to 1.0.17 (#1798239)
  - Drop unneeded texlive dependencies
  - Fix build with translations parameter


author: Tom Callaway <spot@fedoraproject.org> - 1:4.04-5
changelog:
  - pull in all the headers
  - apply null fix for default var in GlobalParams()
  - make a libxpdfcore for texlive-base to use


author: Antonio Trande <sagitter@fedoraproject.org> - 4.0.2-2
changelog:
  - Built on EPEL8
  - Drop (obsolete) python-websockify dependency
  - Add MPLv2.0 LICENSE file for HTML5 version


author: Sérgio Basto <sergio@serjux.com> - 4.4.3-2
changelog:
  - Add unitdir, we may have unitdir but by default disabled, preset just enable service by default which understandably was not approved.
    to check presets run `systemctl status xpra | grep preset`
  - Un-split xpra-udev and other improvements
  - Add support to procps, avif, qrencode, libdrm and libwebp


author: Sérgio Basto <sergio@serjux.com> - 4.4.3-3
changelog:
  - Fix epel builds, seems upstream sort out py3cairo hack on el8
  - el8 now also have xorg-x11-drv-dummy


author: Sérgio M. Basto <sergio@serjux.com> - 4.4.3-6
changelog:
  - Add unitdir, we may have unitdir but by default disabled, preset just
    enable service by default which understandably was not approved.


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 5.0.1-1
changelog:
  - Update to version 5.0.1
  - Don't use versioned plugin names in configuration
  - Backport plugin version change from git master


author: Bojan Smojver <bojan@rexurive.com> - 1:0.9.14-2
changelog:
  - Bump up to 0.9.14
  - Add a set of patches to deal with new GCC warnings/errors
  - Do not emit warning on failed architecture detection
  - Exclude s390x arch for now


author: Bojan Smojver <bojan@rexurive.com> - 1:0.9.21-1
changelog:
  - Bump up to 0.9.21
  - CVE-2022-23468 CVE-2022-23477 CVE-2022-23478 CVE-2022-23479 CVE-2022-23480
  - CVE-2022-23481 CVE-2022-23483 CVE-2022-23482 CVE-2022-23484 CVE-2022-23493


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1:5.45-1
changelog:
  - Update to 5.45
  - asm6502.c/immediate: readd free() call accidentally removed during gcc warnings fix
  - beats/draw_beats: avoid integer overflow by multiplication


author: Mamoru TASAKA <mtasaka@fedoraproject.org> - 1:5.45-3
changelog:
  - Fix up gcc -Wstringop or -Wformat-overflow warnings
  - Make xscreensaver logo or ok button appear on lock screen


author: Davide Cavalca <dcavalca@fedoraproject.org> - 1.0.2-1
changelog:
  - Unretire package
  - Switch source to GitHub and update to 1.0.2
  - Use cmake instead of scons
  - Install systemd user service
  - Misc specfile updates


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.7.4-1
changelog:
  - Update to version 0.7.4
  - Enable runtime detection of sse2/avx2/avx512 on intel architectures
  - Fix compiler warning for 32 bit architectures


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.8.0-1
changelog:
  - Update to version 0.8.0
  - Drop patches xxhash-compiler-warning-32-bit.patch (accepted upstream)
    and xxhash-pkgconfig.patch (issue fixed upstream)
  - Fix empty version in .pc file


author: Mattias Ellert <mattias.ellert@physics.uu.se> - 0.8.1-1
changelog:
  - Update to version 0.8.1
  - Drop patch xxhash-pkgconfig-version.patch (accepted upstream)
  - Fix compilation on RHEL 7 ppc64le (gcc 4.8)
  - The x86 dispatch code now enables sse2 and avx2 separately, it can now use
    sse2 on EPEL 7 without trying to use avx2 which is not supported by gcc 4.8
  - Add documentation package - doxygen mark-up was added


author: Oliver Haessler <oliver@redhat.com> - 0.38.2-3
changelog:
  - increment number, as bodhi has issues with the previous version,
  so fixing it by updating the minor version


author: Adrien Vergé <adrienverge@gmail.com> - 1.31.0-1
changelog:
  - Update to latest upstream version
  - Temporarily restore setup.py/setup.cfg since setuptools ≥ 61 is not available


author: Michal Ambroz <rebus at, seznam.cz> - 3.9.0-1
changelog:
  - bump to 3.9.0 release (#1680203)
  - switch from python-sphinx to python3-sphinx for generating the documentation for fc31+
  - should fix also #1660398 (CVE-2018-19974 CVE-2018-19975 CVE-2018-19976),
    but by design it might be always dangerous to run yara signatures compiled by 3rd party,
    so it is advised to re-compile yara rules instead
  - BUGFIX: Denial of service when using "dex" module. Found by the Cisco Talos team. (upstream #1023, CVE-2019-5020)
  - BUGFIX: Buffer overflow in "dotnet" module.
  - BUGFIX: Regexp regression when using nested quantifiers {x,y} for certain values of x and y. (#1018)


author: Michal Ambroz <rebus at, seznam.cz> - 3.10.0-1
changelog:
  - bump to 3.10.0 release (#1680204)
  - Harden virtual machine against malicious code.
  - BUGFIX: Regression bug in hex strings containing wildcards (upstream #1025).
  - BUGFIX: Buffer overrun in “elf” module.
  - BUGFIX: Buffer overrun in “dotnet” module.


author: Michal Ambroz <rebus at, seznam.cz> - 3.11.0-1
changelog:
  - bump to 3.11.0 release (#1760678)
  - BUGFIX: Some regexp character classes not matching correctly when used with “nocase” modifier (upstream #1117)
  - BUGFIX: Reduce the number of ERROR_TOO_MANY_RE_FIBERS errors for certain hex pattern containing large jumps (upstream #1107)
  - BUGFIX: Buffer overrun in “dotnet” module (upstream #1108)
  - BUGFIX: Memory leak while attaching to a process fails (upstream #1070)


author: zsvetlik@redhat.com - 1.22.10-1
changelog:
  - Update to 1.22.10
  - Resolves: RHBZ#1816262, RHBZ#1851876
  - Long resolved CVEs, just not mentioned in changelog


author: Neal Gompa <ngompa@fedoraproject.org> - 1.22.10-4
changelog:
  - Work around broken brp-mangle-shebangs behavior (see RHBZ#1998924)
  - Fix broken macro variable for legacy "nodejs-yarn" binary name (RHBZ#1904279)


author: zsvetlik@redhat.com - 1.22.17-1
changelog:
  - Update to latest upstream release
  - use --force in yarnpkg-tarball.sh to workaround dependency conflincts


author: Maxwell G <gotmax@e.email> - 2021.12.17-1
changelog:
  - Update to 2021.12.17. Fixes rhbz#2033616.
  - Properly own shell completions directories
  - Remove obsolete epel6 code.


author: Severin Gehwolf <sgehwolf@redhat.com> - 2.4.8-4
changelog:
  - Add explicit requirement on javapackages-tools since yuicompressor
    script uses java-functions. See RHBZ#1600426.


author: Orion Poplawski <orion@cora.nwra.com> - 6.0.13-1
changelog:
  - Update to 6.0.13
  - Add policy to allow zabbix scripts to run chronyc as chronyc_t (bz#2160180)
  - Add policy to allow zabbix agent to run rpm read-only
  - Fix up alternatives scripts to allow better upgrades from other zabbix packages


author: Orion Poplawski <orion@nwra.com> - 6.0.29-1
changelog:
  - Update to 6.0.29
  - Hopefully really get the zabbix_run_sudo SELinux boolean working for
    zabbix-agent and allow it to run lvm when enabled


author: Orion Poplawski <orion@nwra.com> - 6.0.33-1
changelog:
  - Update to 6.0.33 ((CVE-2024-22114, CVE-2024-22122, CVE-2024-22123,
    CVE-2024-36460, CVE-2024-36461)


author: Jonathan Dieter <jdieter@gmail.com> - 1.1.2-2
changelog:
  - Fix multipart range handling to work with quotes, fixes #1706627
  - Fix file creation permissions so they respect umask
  - Actually push new sources


author: Jonathan Dieter <jdieter@gmail.com> - 1.1.1-2
changelog:
  - Fix compilation on GCC 4.4.7 so it builds on EL6
  - Add missing sources
  - Also, zchunk will now automatically do all your taxes


author: Jonathan Dieter <jdieter@gmail.com> - 1.2.0-1
changelog:
  - Add `--uncompressed` option to zck, allowing for embedding of uncompressed
    digests in the header
  - Various small bug fixes


author: Jonathan Dieter <jdieter@gmail.com> - 1.2.1-1
changelog:
  - Fixed bug that limited size of file that could be compressed using zchunk to 2GB
  - Fixed memory leak


author: Jonathan Dieter <jdieter@gmail.com> - 1.3.0-1
changelog:
  - Add option to generate a zchunk header from an uncompressed file without
    actually creating a zchunk file


author: Jonathan Dieter <jdieter@gmail.com> - 1.3.1-1
changelog:
  - Fix a few low severity security bugs including
    - An off-by-one overflow when reading compressed integers from a
      malicious zchunk file
    - Error handling being skipped when the number of bytes read doesn't
      match what's expected
    - Not freeing memory when attempting to reallocate to size 0


author: Jonathan Dieter <jdieter@gmail.com> - 1.4.0-1
changelog:
  - Add native OpenSSL 3 compatibility
  - Add new function for getting zchunk context from chunk
  - Fix bug when assembling from multiple sources


author: Denis Arnaud <denis.arnaud_fedora@m4x.org> - 4.3.4-1
changelog:
  - Upstream upgrade
  - Fixes #1921879, #1921972, #1921973, #1921975, #1921976, #1921979, #1921981,
  - #1921983, #1921983, #1921985, #1921987, #1921989, #1921992, #1921994


author: Ben Woodard <woodard@redhat.com> - 4.3.4-3
changelog:
  - disable building with libunwind to fix C++ exceptions when a C applicaion loads
    a module written in C++ #2175966


author: Jason L Tibbitts III <tibbs@math.uh.edu> - 0-0.9gitfe0f368
changelog:
  - Require specific version of znc, to avoid unexpected breakage when znc
    updates.  (Broken deps are better than a broken server.)


author: Justin W. Flory <jflory7@fedoraproject.org> - 1.0.3-1
changelog:
  - Fix reused integers from being optimized out.
  - Props to Jan Drögehoff (FAS: sentry) for sending this fix upstream to avoid carrying a Fedora-specific patch.
  - Remove grues.


