<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="1181">
<package pkgid="a03ca3b4e86089e3c13af797b31827501dec10977cb996cdfab3fc9589a17a111f71befa5a00810f96d2637a7576cc0b0b05d85124f4666e8cc9797b0149f328" name="AusweisApp" arch="s390x">
  <version epoch="0" ver="2.5.5" rel="46.1"/>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1705147200">- New upstream release
  + Version 2.0.2
  - Avoid showing hints to the PIN reset service.
- Pass original source tree name to %setup macro
- Use original source tree name in %install section</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1705665600">- New upstream release
  + Version 2.0.3
  - Fixed crash on macOS 11.
  - Fixed missing German translation.
  - Fixed display of release notes.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1709208000">- New upstream release
  + Version 2.1.0
  - Visual adjustments and optimization of the graphical user interface.
  - Improved detection of system language on macOS.
  - Removed the five minutes time limit for password
    entry when the ID card is placed on the reader.
  - Fixed display of changed device names when using "Smartphone as card reader".
  - Add an option to disable animations.
  - Fixed the behavior of "Smartphone as card reader"
    with activated password entry when using a PUK.
  - Fixed of the connection test with a password-protected
    proxy in the diagnostics on desktop systems.
  - Drop support for macOS 11 Big Sur.
  - Fixed processing of certificates with CAv3 extension.
  - Unified documentation for installation and integration.
  - Update of OpenSSL to version 3.1.5.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1712836800">- New upstream release
  + Version 2.1.1
  - Visual adjustments and optimization of the graphical user interface.
  - Fixed rarely occurring problems in connection with the browser used.
  - Textual adjustments.
  - Fixed READER messages in the SDK when using unknown cards or when
    the connection to the card is unstable.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1720180800">- New upstream release
  + Version 2.2.0
  - Visual adjustments and optimization of the graphical user interface.
  - Display of the old and new device name when using "Smartphone as card
    reader" if the name of a device has changed.
  - An information page has been added at the end of an authentication before
    forwarding to the service provider.
  - Increased the time allowed to respond to card commands on Android to support
    badges that have switched to a safe slow mode after too many incorrect CAN entries.
  - Improved accessibility options.
  - Support for Android 8 has been discontinued.
  - The "Smartphone as card reader" function now requires at least version 2.1.0.
  - Support for ChromeOS has been added.
  - Support for key lengths smaller than 3000 bits has been discontinued.
  - Changelog added to the documentation for the SDK.
  - Functional extension of the SDK (see changelog).
  - Update of Qt to version 6.7.2.
  - Update of OpenSSL to version 3.3.1.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1720785600">- Cherry-pick upstream patch to fix QML error with Qt 6.6
  + 0001-fix-qml-error-with-qt6.6.patch</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1721390400">- Add missing libQt6Svg6 runtime dependency to Requires</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1726056000">- New upstream release
  + Version 2.2.1
  - Visual adjustments and optimization of the graphical user interface.
  - Optimization of accessibility and keyboard usability.
  - Prevention of the display of external content in
    the graphical user interface.
  - Support for smartphones with Android 15 where
    optimized memory management has been activated.
  - Support for 16 KB page sizes on Android.
  - Stabilization of the iOS SDK during fast restarts.
  - Correction of the behavior when using Qt 6.6.3.
  - Avoidance of a log file within the container in the container SDK.
  - Update of the Android NDK to r27b (27.1.12297006).
  - Update of the Android SDK Platform to Android 15 (API level 35).
  - Update of OpenSSL to version 3.3.2.
- Drop patches for issues fixed upstream
  + 0001-fix-qml-error-with-qt6.6.patch</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1729684800">- New upstream release
  + Version 2.2.2
  - Visual adjustments and optimization of the graphical user interface.
  - Optimization of accessibility and keyboard operability.
  - Addition of the Android ABIs armeabi-v7a and x86_64 in addition to
    arm64-v8a in the SDK.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1730462400">- Add patch from Fedora to enforce use of legacy OpenSSL API
  + 0001-use-legacy-openssl-api.patch (bsc#1231686)</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1741262400">- New upstream release
  + Version 2.3.0
  - Introduction of onboarding.
  - Visual adjustments and optimization of the graphical user interface.
  - macOS Monterey 12 is no longer supported.
  - iOS 14 and 15 are no longer supported.
  - The integrated simulator now performs the terminal authentication
    completely instead of accepting every input.
  - Update from Android NDK to r27c (27.2.12479018).
  - Update of Qt to version 6.8.1.
  - Update of OpenSSL to version 3.4.1.
- Refresh 0001-use-legacy-openssl-api.patch</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1742299200">- New upstream release
  + Version 2.3.1
  - Fixed compatibility of AusweisApp with Windows Server 2016.
  - Visual adjustments and optimization of the graphical user interface.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1750939200">- New upstream release
  + Version 2.3.2
  - Improvements with regards to accessibility.
  - Visual adjustments and optimization of the graphical interface.
  - Temporarily removing an ID card on an Android smartphone as a card
    reader before typing in the password no longer results in an error.
  - On Windows, smartphones that can only be reached via IPv6 are now
    also recognized as card readers.
  - Added support for smartphones as card readers on Windows Server.
  - Relative URL redirects during authentication are now correctly
    taken into account.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1761825600">- New upstream release
  + Version 2.4.0
  - Accessibility support has been completed.
  - Visual adjustments and optimization of the graphical interface.
  - Connecting to a smartphone as card reader is now faster.
  - Update of Qt to version 6.9.2.
  - Update of OpenSSL to version 3.5.4.
  - Update of Android NDK to r28c (28.2.13676358).
  - Fixed a crash when using the SDK on Android on x86_64.
- Add qt6-declarative-devel to BuildRequires
- Add qt6-qmlcore-private-devel to BuildRequires
- Cherry-pick updated 0001-use-legacy-openssl-api.patch from Fedora</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1769688000">- New upstream release
  + Version 2.4.1
  - Visual adjustments and optimizations to the graphical user interface.
  - Enabled privacy protection against screenshots on mobile devices
    when entering passwords or displaying personal details.
  - Fixed unstable behavior when using smartphones as card readers.
  - Updated OpenSSL to version 3.5.5.
  - The container SDK now only contains necessary libraries instead
    of the complete package manager of the distribution.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1775649600">- New upstream release
  + Version 2.5.0
  - Visual adjustments and optimizations to the graphical user interface.
  - macOS Ventura 13 is no longer supported.
  - iOS 16 is no longer supported.
  - The http_parser library has been replaced by llhttp.
  - A compiler with C++20 support is required.
  - Update of Qt to version 6.10.2.
  - Update of OpenSSL to version 3.6.1.
  - Update of the Android NDK to r29 (29.0.14206865).
  - Update of the Android SDK Platform to Android 16 (API level 36).
  - Smartphones paired as card readers with an installed AusweisApp
    are now available as readers on Android via the SDK.
  - Access for web browsers to the partially integrated SDK is disabled
    by default and can be enabled if needed.
- Add pkgconfig(libllhttp) to BuildRequires
- Build with -DUSE_LEGACY_OPENSSL_API=ON to enable legacy OpenSSL API
- Drop 0001-use-legacy-openssl-api.patch, fixed upstream
- Drop build support for openSUSE Leap 15</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1775995200">- New upstream release
  + Version 2.5.1
  - Fix an error regarding the minimum supported macOS version.
  - Update of OpenSSL to version 3.6.2.
  - Fix version number on Android  mistakenly including the
    architecture.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1782216000">- New upstream release
  + Version 2.5.3
  - Update of OpenSSL to version 3.6.3.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1784203200">- New upstream release
  + Version 2.5.4
  - Visual adjustments and optimizations to the graphical user interface.
  - Fixed a potential crash when using accessibility features.
  - Optimized individual accessibility features.
  - Compatibility with OpenSSL 4.0.0 has been established
    using -DUSE_LEGACY_OPENSSL_API=ON.
  - Fixed a potential deadlock in the WebSocket SDK.
  - Added new features to the SDK (see changelog).</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1787054400">- New upstream release
  + Version 2.5.5
  - Visual adjustments and optimizations to the graphical user interface.
  - Optimization of individual accessibility features.
  - Adjustment of the app icon on macOS and iOS.
  - Prevent a potential memory leak in OpenSSL.
  - Prevent the potential injection of malicious code into an
    error page generated by the application in the web browser.</changelog>
</package>
<package pkgid="ab7805562a4eccf149170f9b3196529e99c3efd3b02e2c5bdb305d411cef1eef2f457c0f301ee5191c0083641214a0a847ef69c7ff60f5dd17b6a4000695e7af" name="AusweisApp" arch="src">
  <version epoch="0" ver="2.5.5" rel="46.1"/>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1705147200">- New upstream release
  + Version 2.0.2
  - Avoid showing hints to the PIN reset service.
- Pass original source tree name to %setup macro
- Use original source tree name in %install section</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1705665600">- New upstream release
  + Version 2.0.3
  - Fixed crash on macOS 11.
  - Fixed missing German translation.
  - Fixed display of release notes.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1709208000">- New upstream release
  + Version 2.1.0
  - Visual adjustments and optimization of the graphical user interface.
  - Improved detection of system language on macOS.
  - Removed the five minutes time limit for password
    entry when the ID card is placed on the reader.
  - Fixed display of changed device names when using "Smartphone as card reader".
  - Add an option to disable animations.
  - Fixed the behavior of "Smartphone as card reader"
    with activated password entry when using a PUK.
  - Fixed of the connection test with a password-protected
    proxy in the diagnostics on desktop systems.
  - Drop support for macOS 11 Big Sur.
  - Fixed processing of certificates with CAv3 extension.
  - Unified documentation for installation and integration.
  - Update of OpenSSL to version 3.1.5.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1712836800">- New upstream release
  + Version 2.1.1
  - Visual adjustments and optimization of the graphical user interface.
  - Fixed rarely occurring problems in connection with the browser used.
  - Textual adjustments.
  - Fixed READER messages in the SDK when using unknown cards or when
    the connection to the card is unstable.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1720180800">- New upstream release
  + Version 2.2.0
  - Visual adjustments and optimization of the graphical user interface.
  - Display of the old and new device name when using "Smartphone as card
    reader" if the name of a device has changed.
  - An information page has been added at the end of an authentication before
    forwarding to the service provider.
  - Increased the time allowed to respond to card commands on Android to support
    badges that have switched to a safe slow mode after too many incorrect CAN entries.
  - Improved accessibility options.
  - Support for Android 8 has been discontinued.
  - The "Smartphone as card reader" function now requires at least version 2.1.0.
  - Support for ChromeOS has been added.
  - Support for key lengths smaller than 3000 bits has been discontinued.
  - Changelog added to the documentation for the SDK.
  - Functional extension of the SDK (see changelog).
  - Update of Qt to version 6.7.2.
  - Update of OpenSSL to version 3.3.1.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1720785600">- Cherry-pick upstream patch to fix QML error with Qt 6.6
  + 0001-fix-qml-error-with-qt6.6.patch</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1721390400">- Add missing libQt6Svg6 runtime dependency to Requires</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1726056000">- New upstream release
  + Version 2.2.1
  - Visual adjustments and optimization of the graphical user interface.
  - Optimization of accessibility and keyboard usability.
  - Prevention of the display of external content in
    the graphical user interface.
  - Support for smartphones with Android 15 where
    optimized memory management has been activated.
  - Support for 16 KB page sizes on Android.
  - Stabilization of the iOS SDK during fast restarts.
  - Correction of the behavior when using Qt 6.6.3.
  - Avoidance of a log file within the container in the container SDK.
  - Update of the Android NDK to r27b (27.1.12297006).
  - Update of the Android SDK Platform to Android 15 (API level 35).
  - Update of OpenSSL to version 3.3.2.
- Drop patches for issues fixed upstream
  + 0001-fix-qml-error-with-qt6.6.patch</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1729684800">- New upstream release
  + Version 2.2.2
  - Visual adjustments and optimization of the graphical user interface.
  - Optimization of accessibility and keyboard operability.
  - Addition of the Android ABIs armeabi-v7a and x86_64 in addition to
    arm64-v8a in the SDK.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1730462400">- Add patch from Fedora to enforce use of legacy OpenSSL API
  + 0001-use-legacy-openssl-api.patch (bsc#1231686)</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1741262400">- New upstream release
  + Version 2.3.0
  - Introduction of onboarding.
  - Visual adjustments and optimization of the graphical user interface.
  - macOS Monterey 12 is no longer supported.
  - iOS 14 and 15 are no longer supported.
  - The integrated simulator now performs the terminal authentication
    completely instead of accepting every input.
  - Update from Android NDK to r27c (27.2.12479018).
  - Update of Qt to version 6.8.1.
  - Update of OpenSSL to version 3.4.1.
- Refresh 0001-use-legacy-openssl-api.patch</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1742299200">- New upstream release
  + Version 2.3.1
  - Fixed compatibility of AusweisApp with Windows Server 2016.
  - Visual adjustments and optimization of the graphical user interface.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1750939200">- New upstream release
  + Version 2.3.2
  - Improvements with regards to accessibility.
  - Visual adjustments and optimization of the graphical interface.
  - Temporarily removing an ID card on an Android smartphone as a card
    reader before typing in the password no longer results in an error.
  - On Windows, smartphones that can only be reached via IPv6 are now
    also recognized as card readers.
  - Added support for smartphones as card readers on Windows Server.
  - Relative URL redirects during authentication are now correctly
    taken into account.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1761825600">- New upstream release
  + Version 2.4.0
  - Accessibility support has been completed.
  - Visual adjustments and optimization of the graphical interface.
  - Connecting to a smartphone as card reader is now faster.
  - Update of Qt to version 6.9.2.
  - Update of OpenSSL to version 3.5.4.
  - Update of Android NDK to r28c (28.2.13676358).
  - Fixed a crash when using the SDK on Android on x86_64.
- Add qt6-declarative-devel to BuildRequires
- Add qt6-qmlcore-private-devel to BuildRequires
- Cherry-pick updated 0001-use-legacy-openssl-api.patch from Fedora</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1769688000">- New upstream release
  + Version 2.4.1
  - Visual adjustments and optimizations to the graphical user interface.
  - Enabled privacy protection against screenshots on mobile devices
    when entering passwords or displaying personal details.
  - Fixed unstable behavior when using smartphones as card readers.
  - Updated OpenSSL to version 3.5.5.
  - The container SDK now only contains necessary libraries instead
    of the complete package manager of the distribution.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1775649600">- New upstream release
  + Version 2.5.0
  - Visual adjustments and optimizations to the graphical user interface.
  - macOS Ventura 13 is no longer supported.
  - iOS 16 is no longer supported.
  - The http_parser library has been replaced by llhttp.
  - A compiler with C++20 support is required.
  - Update of Qt to version 6.10.2.
  - Update of OpenSSL to version 3.6.1.
  - Update of the Android NDK to r29 (29.0.14206865).
  - Update of the Android SDK Platform to Android 16 (API level 36).
  - Smartphones paired as card readers with an installed AusweisApp
    are now available as readers on Android via the SDK.
  - Access for web browsers to the partially integrated SDK is disabled
    by default and can be enabled if needed.
- Add pkgconfig(libllhttp) to BuildRequires
- Build with -DUSE_LEGACY_OPENSSL_API=ON to enable legacy OpenSSL API
- Drop 0001-use-legacy-openssl-api.patch, fixed upstream
- Drop build support for openSUSE Leap 15</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1775995200">- New upstream release
  + Version 2.5.1
  - Fix an error regarding the minimum supported macOS version.
  - Update of OpenSSL to version 3.6.2.
  - Fix version number on Android  mistakenly including the
    architecture.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1782216000">- New upstream release
  + Version 2.5.3
  - Update of OpenSSL to version 3.6.3.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1784203200">- New upstream release
  + Version 2.5.4
  - Visual adjustments and optimizations to the graphical user interface.
  - Fixed a potential crash when using accessibility features.
  - Optimized individual accessibility features.
  - Compatibility with OpenSSL 4.0.0 has been established
    using -DUSE_LEGACY_OPENSSL_API=ON.
  - Fixed a potential deadlock in the WebSocket SDK.
  - Added new features to the SDK (see changelog).</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1787054400">- New upstream release
  + Version 2.5.5
  - Visual adjustments and optimizations to the graphical user interface.
  - Optimization of individual accessibility features.
  - Adjustment of the app icon on macOS and iOS.
  - Prevent a potential memory leak in OpenSSL.
  - Prevent the potential injection of malicious code into an
    error page generated by the application in the web browser.</changelog>
</package>
<package pkgid="028a77b502804477d83d402da887bd9e7577893b9f544b11185abd06780d670bd3499bc63508de09477618b924de14e033135cd5fd5ef5b482f0b0a6a3d30480" name="AusweisApp-debuginfo" arch="s390x">
  <version epoch="0" ver="2.5.5" rel="46.1"/>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1705147200">- New upstream release
  + Version 2.0.2
  - Avoid showing hints to the PIN reset service.
- Pass original source tree name to %setup macro
- Use original source tree name in %install section</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1705665600">- New upstream release
  + Version 2.0.3
  - Fixed crash on macOS 11.
  - Fixed missing German translation.
  - Fixed display of release notes.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1709208000">- New upstream release
  + Version 2.1.0
  - Visual adjustments and optimization of the graphical user interface.
  - Improved detection of system language on macOS.
  - Removed the five minutes time limit for password
    entry when the ID card is placed on the reader.
  - Fixed display of changed device names when using "Smartphone as card reader".
  - Add an option to disable animations.
  - Fixed the behavior of "Smartphone as card reader"
    with activated password entry when using a PUK.
  - Fixed of the connection test with a password-protected
    proxy in the diagnostics on desktop systems.
  - Drop support for macOS 11 Big Sur.
  - Fixed processing of certificates with CAv3 extension.
  - Unified documentation for installation and integration.
  - Update of OpenSSL to version 3.1.5.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1712836800">- New upstream release
  + Version 2.1.1
  - Visual adjustments and optimization of the graphical user interface.
  - Fixed rarely occurring problems in connection with the browser used.
  - Textual adjustments.
  - Fixed READER messages in the SDK when using unknown cards or when
    the connection to the card is unstable.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1720180800">- New upstream release
  + Version 2.2.0
  - Visual adjustments and optimization of the graphical user interface.
  - Display of the old and new device name when using "Smartphone as card
    reader" if the name of a device has changed.
  - An information page has been added at the end of an authentication before
    forwarding to the service provider.
  - Increased the time allowed to respond to card commands on Android to support
    badges that have switched to a safe slow mode after too many incorrect CAN entries.
  - Improved accessibility options.
  - Support for Android 8 has been discontinued.
  - The "Smartphone as card reader" function now requires at least version 2.1.0.
  - Support for ChromeOS has been added.
  - Support for key lengths smaller than 3000 bits has been discontinued.
  - Changelog added to the documentation for the SDK.
  - Functional extension of the SDK (see changelog).
  - Update of Qt to version 6.7.2.
  - Update of OpenSSL to version 3.3.1.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1720785600">- Cherry-pick upstream patch to fix QML error with Qt 6.6
  + 0001-fix-qml-error-with-qt6.6.patch</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1721390400">- Add missing libQt6Svg6 runtime dependency to Requires</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1726056000">- New upstream release
  + Version 2.2.1
  - Visual adjustments and optimization of the graphical user interface.
  - Optimization of accessibility and keyboard usability.
  - Prevention of the display of external content in
    the graphical user interface.
  - Support for smartphones with Android 15 where
    optimized memory management has been activated.
  - Support for 16 KB page sizes on Android.
  - Stabilization of the iOS SDK during fast restarts.
  - Correction of the behavior when using Qt 6.6.3.
  - Avoidance of a log file within the container in the container SDK.
  - Update of the Android NDK to r27b (27.1.12297006).
  - Update of the Android SDK Platform to Android 15 (API level 35).
  - Update of OpenSSL to version 3.3.2.
- Drop patches for issues fixed upstream
  + 0001-fix-qml-error-with-qt6.6.patch</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1729684800">- New upstream release
  + Version 2.2.2
  - Visual adjustments and optimization of the graphical user interface.
  - Optimization of accessibility and keyboard operability.
  - Addition of the Android ABIs armeabi-v7a and x86_64 in addition to
    arm64-v8a in the SDK.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1730462400">- Add patch from Fedora to enforce use of legacy OpenSSL API
  + 0001-use-legacy-openssl-api.patch (bsc#1231686)</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1741262400">- New upstream release
  + Version 2.3.0
  - Introduction of onboarding.
  - Visual adjustments and optimization of the graphical user interface.
  - macOS Monterey 12 is no longer supported.
  - iOS 14 and 15 are no longer supported.
  - The integrated simulator now performs the terminal authentication
    completely instead of accepting every input.
  - Update from Android NDK to r27c (27.2.12479018).
  - Update of Qt to version 6.8.1.
  - Update of OpenSSL to version 3.4.1.
- Refresh 0001-use-legacy-openssl-api.patch</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1742299200">- New upstream release
  + Version 2.3.1
  - Fixed compatibility of AusweisApp with Windows Server 2016.
  - Visual adjustments and optimization of the graphical user interface.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1750939200">- New upstream release
  + Version 2.3.2
  - Improvements with regards to accessibility.
  - Visual adjustments and optimization of the graphical interface.
  - Temporarily removing an ID card on an Android smartphone as a card
    reader before typing in the password no longer results in an error.
  - On Windows, smartphones that can only be reached via IPv6 are now
    also recognized as card readers.
  - Added support for smartphones as card readers on Windows Server.
  - Relative URL redirects during authentication are now correctly
    taken into account.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1761825600">- New upstream release
  + Version 2.4.0
  - Accessibility support has been completed.
  - Visual adjustments and optimization of the graphical interface.
  - Connecting to a smartphone as card reader is now faster.
  - Update of Qt to version 6.9.2.
  - Update of OpenSSL to version 3.5.4.
  - Update of Android NDK to r28c (28.2.13676358).
  - Fixed a crash when using the SDK on Android on x86_64.
- Add qt6-declarative-devel to BuildRequires
- Add qt6-qmlcore-private-devel to BuildRequires
- Cherry-pick updated 0001-use-legacy-openssl-api.patch from Fedora</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1769688000">- New upstream release
  + Version 2.4.1
  - Visual adjustments and optimizations to the graphical user interface.
  - Enabled privacy protection against screenshots on mobile devices
    when entering passwords or displaying personal details.
  - Fixed unstable behavior when using smartphones as card readers.
  - Updated OpenSSL to version 3.5.5.
  - The container SDK now only contains necessary libraries instead
    of the complete package manager of the distribution.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1775649600">- New upstream release
  + Version 2.5.0
  - Visual adjustments and optimizations to the graphical user interface.
  - macOS Ventura 13 is no longer supported.
  - iOS 16 is no longer supported.
  - The http_parser library has been replaced by llhttp.
  - A compiler with C++20 support is required.
  - Update of Qt to version 6.10.2.
  - Update of OpenSSL to version 3.6.1.
  - Update of the Android NDK to r29 (29.0.14206865).
  - Update of the Android SDK Platform to Android 16 (API level 36).
  - Smartphones paired as card readers with an installed AusweisApp
    are now available as readers on Android via the SDK.
  - Access for web browsers to the partially integrated SDK is disabled
    by default and can be enabled if needed.
- Add pkgconfig(libllhttp) to BuildRequires
- Build with -DUSE_LEGACY_OPENSSL_API=ON to enable legacy OpenSSL API
- Drop 0001-use-legacy-openssl-api.patch, fixed upstream
- Drop build support for openSUSE Leap 15</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1775995200">- New upstream release
  + Version 2.5.1
  - Fix an error regarding the minimum supported macOS version.
  - Update of OpenSSL to version 3.6.2.
  - Fix version number on Android  mistakenly including the
    architecture.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1782216000">- New upstream release
  + Version 2.5.3
  - Update of OpenSSL to version 3.6.3.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1784203200">- New upstream release
  + Version 2.5.4
  - Visual adjustments and optimizations to the graphical user interface.
  - Fixed a potential crash when using accessibility features.
  - Optimized individual accessibility features.
  - Compatibility with OpenSSL 4.0.0 has been established
    using -DUSE_LEGACY_OPENSSL_API=ON.
  - Fixed a potential deadlock in the WebSocket SDK.
  - Added new features to the SDK (see changelog).</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1787054400">- New upstream release
  + Version 2.5.5
  - Visual adjustments and optimizations to the graphical user interface.
  - Optimization of individual accessibility features.
  - Adjustment of the app icon on macOS and iOS.
  - Prevent a potential memory leak in OpenSSL.
  - Prevent the potential injection of malicious code into an
    error page generated by the application in the web browser.</changelog>
</package>
<package pkgid="222dcdfe968f76d095cd2c5b7a45cb30de977f410198130009fe83b77a19c17a76ea0f58c93db38eee4535c359c27ce686c43b40b5c6b1d8aa16a7b0a866140c" name="AusweisApp-debugsource" arch="s390x">
  <version epoch="0" ver="2.5.5" rel="46.1"/>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1705147200">- New upstream release
  + Version 2.0.2
  - Avoid showing hints to the PIN reset service.
- Pass original source tree name to %setup macro
- Use original source tree name in %install section</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1705665600">- New upstream release
  + Version 2.0.3
  - Fixed crash on macOS 11.
  - Fixed missing German translation.
  - Fixed display of release notes.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1709208000">- New upstream release
  + Version 2.1.0
  - Visual adjustments and optimization of the graphical user interface.
  - Improved detection of system language on macOS.
  - Removed the five minutes time limit for password
    entry when the ID card is placed on the reader.
  - Fixed display of changed device names when using "Smartphone as card reader".
  - Add an option to disable animations.
  - Fixed the behavior of "Smartphone as card reader"
    with activated password entry when using a PUK.
  - Fixed of the connection test with a password-protected
    proxy in the diagnostics on desktop systems.
  - Drop support for macOS 11 Big Sur.
  - Fixed processing of certificates with CAv3 extension.
  - Unified documentation for installation and integration.
  - Update of OpenSSL to version 3.1.5.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1712836800">- New upstream release
  + Version 2.1.1
  - Visual adjustments and optimization of the graphical user interface.
  - Fixed rarely occurring problems in connection with the browser used.
  - Textual adjustments.
  - Fixed READER messages in the SDK when using unknown cards or when
    the connection to the card is unstable.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1720180800">- New upstream release
  + Version 2.2.0
  - Visual adjustments and optimization of the graphical user interface.
  - Display of the old and new device name when using "Smartphone as card
    reader" if the name of a device has changed.
  - An information page has been added at the end of an authentication before
    forwarding to the service provider.
  - Increased the time allowed to respond to card commands on Android to support
    badges that have switched to a safe slow mode after too many incorrect CAN entries.
  - Improved accessibility options.
  - Support for Android 8 has been discontinued.
  - The "Smartphone as card reader" function now requires at least version 2.1.0.
  - Support for ChromeOS has been added.
  - Support for key lengths smaller than 3000 bits has been discontinued.
  - Changelog added to the documentation for the SDK.
  - Functional extension of the SDK (see changelog).
  - Update of Qt to version 6.7.2.
  - Update of OpenSSL to version 3.3.1.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1720785600">- Cherry-pick upstream patch to fix QML error with Qt 6.6
  + 0001-fix-qml-error-with-qt6.6.patch</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1721390400">- Add missing libQt6Svg6 runtime dependency to Requires</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1726056000">- New upstream release
  + Version 2.2.1
  - Visual adjustments and optimization of the graphical user interface.
  - Optimization of accessibility and keyboard usability.
  - Prevention of the display of external content in
    the graphical user interface.
  - Support for smartphones with Android 15 where
    optimized memory management has been activated.
  - Support for 16 KB page sizes on Android.
  - Stabilization of the iOS SDK during fast restarts.
  - Correction of the behavior when using Qt 6.6.3.
  - Avoidance of a log file within the container in the container SDK.
  - Update of the Android NDK to r27b (27.1.12297006).
  - Update of the Android SDK Platform to Android 15 (API level 35).
  - Update of OpenSSL to version 3.3.2.
- Drop patches for issues fixed upstream
  + 0001-fix-qml-error-with-qt6.6.patch</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1729684800">- New upstream release
  + Version 2.2.2
  - Visual adjustments and optimization of the graphical user interface.
  - Optimization of accessibility and keyboard operability.
  - Addition of the Android ABIs armeabi-v7a and x86_64 in addition to
    arm64-v8a in the SDK.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1730462400">- Add patch from Fedora to enforce use of legacy OpenSSL API
  + 0001-use-legacy-openssl-api.patch (bsc#1231686)</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1741262400">- New upstream release
  + Version 2.3.0
  - Introduction of onboarding.
  - Visual adjustments and optimization of the graphical user interface.
  - macOS Monterey 12 is no longer supported.
  - iOS 14 and 15 are no longer supported.
  - The integrated simulator now performs the terminal authentication
    completely instead of accepting every input.
  - Update from Android NDK to r27c (27.2.12479018).
  - Update of Qt to version 6.8.1.
  - Update of OpenSSL to version 3.4.1.
- Refresh 0001-use-legacy-openssl-api.patch</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1742299200">- New upstream release
  + Version 2.3.1
  - Fixed compatibility of AusweisApp with Windows Server 2016.
  - Visual adjustments and optimization of the graphical user interface.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1750939200">- New upstream release
  + Version 2.3.2
  - Improvements with regards to accessibility.
  - Visual adjustments and optimization of the graphical interface.
  - Temporarily removing an ID card on an Android smartphone as a card
    reader before typing in the password no longer results in an error.
  - On Windows, smartphones that can only be reached via IPv6 are now
    also recognized as card readers.
  - Added support for smartphones as card readers on Windows Server.
  - Relative URL redirects during authentication are now correctly
    taken into account.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1761825600">- New upstream release
  + Version 2.4.0
  - Accessibility support has been completed.
  - Visual adjustments and optimization of the graphical interface.
  - Connecting to a smartphone as card reader is now faster.
  - Update of Qt to version 6.9.2.
  - Update of OpenSSL to version 3.5.4.
  - Update of Android NDK to r28c (28.2.13676358).
  - Fixed a crash when using the SDK on Android on x86_64.
- Add qt6-declarative-devel to BuildRequires
- Add qt6-qmlcore-private-devel to BuildRequires
- Cherry-pick updated 0001-use-legacy-openssl-api.patch from Fedora</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1769688000">- New upstream release
  + Version 2.4.1
  - Visual adjustments and optimizations to the graphical user interface.
  - Enabled privacy protection against screenshots on mobile devices
    when entering passwords or displaying personal details.
  - Fixed unstable behavior when using smartphones as card readers.
  - Updated OpenSSL to version 3.5.5.
  - The container SDK now only contains necessary libraries instead
    of the complete package manager of the distribution.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1775649600">- New upstream release
  + Version 2.5.0
  - Visual adjustments and optimizations to the graphical user interface.
  - macOS Ventura 13 is no longer supported.
  - iOS 16 is no longer supported.
  - The http_parser library has been replaced by llhttp.
  - A compiler with C++20 support is required.
  - Update of Qt to version 6.10.2.
  - Update of OpenSSL to version 3.6.1.
  - Update of the Android NDK to r29 (29.0.14206865).
  - Update of the Android SDK Platform to Android 16 (API level 36).
  - Smartphones paired as card readers with an installed AusweisApp
    are now available as readers on Android via the SDK.
  - Access for web browsers to the partially integrated SDK is disabled
    by default and can be enabled if needed.
- Add pkgconfig(libllhttp) to BuildRequires
- Build with -DUSE_LEGACY_OPENSSL_API=ON to enable legacy OpenSSL API
- Drop 0001-use-legacy-openssl-api.patch, fixed upstream
- Drop build support for openSUSE Leap 15</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1775995200">- New upstream release
  + Version 2.5.1
  - Fix an error regarding the minimum supported macOS version.
  - Update of OpenSSL to version 3.6.2.
  - Fix version number on Android  mistakenly including the
    architecture.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1782216000">- New upstream release
  + Version 2.5.3
  - Update of OpenSSL to version 3.6.3.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1784203200">- New upstream release
  + Version 2.5.4
  - Visual adjustments and optimizations to the graphical user interface.
  - Fixed a potential crash when using accessibility features.
  - Optimized individual accessibility features.
  - Compatibility with OpenSSL 4.0.0 has been established
    using -DUSE_LEGACY_OPENSSL_API=ON.
  - Fixed a potential deadlock in the WebSocket SDK.
  - Added new features to the SDK (see changelog).</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1787054400">- New upstream release
  + Version 2.5.5
  - Visual adjustments and optimizations to the graphical user interface.
  - Optimization of individual accessibility features.
  - Adjustment of the app icon on macOS and iOS.
  - Prevent a potential memory leak in OpenSSL.
  - Prevent the potential injection of malicious code into an
    error page generated by the application in the web browser.</changelog>
</package>
<package pkgid="7069fd103302728009ea918f735b3d17f95fddae681ea9c7bdf3ebd656f2ef55140a1343092d35bf524e66026936aef3fc06dbbfae93ed51e6ef193f7d0a76f5" name="QtPass" arch="s390x">
  <version epoch="0" ver="1.7.0" rel="14.6"/>
  <changelog author="ecsos@opensuse.org" date="1570017600">- Update to 1.3.1
  - Renaming password #463 #469
  - Edit main title field #446
  - Add missing finishedShow() signal connection in PasswordDialog
    constructor (fixes the "Edit password" function) #473
  - Build dependency fixes #467 #479
  - Additional lines (notes) shown again #474
  - Running but no GUI #451
  - Correct font color with Dark themes #340 #476
  - Add missing overrides #478
  - Sorted profiles dropdown as in #404 #472
  - Fix missing app ID and icon on Wayland. #468</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1570276800">- Remove superfluous entry for password-store from Recommends as
  it's already stated in Requires
- Add hicolor-icon-theme to BuildRequires</changelog>
  <changelog author="ecsos@opensuse.org" date="1570363200">- Rename all to package_naming_guidelines.</changelog>
  <changelog author="ecsos@opensuse.org" date="1570622400">- Update to 1.3.2
  - Don't call QtPass::setup() from QtPass class constructor #482
    fixes first run issues #485, #481, #466, #423 and #308
  - Password window padding #484
  - Buttons width on RHEL 8 #483
  - Start minimized works again #471</changelog>
  <changelog author="ecsos@opensuse.org" date="1586692800">- Add qtpass.appdata.xml.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1695124800">- Update to 1.4.0
  * What's Changed
  - Don't use a deprecated method in #491
  - Issue #402: 'deselect()' on clearing filter in #490
  - Don't base pass-otp availability decision on hardcoded /usr/lib in #499
  - Use new stable version of install-qt-action.  in #502
  - Enable out-of-source build in #503
  - Enable ubuntu, windows and macOS based builds for CI in #508
  - Spelling: Git pull, Git push in #516
  - Fix blurry icons when fractional scaling is enabled in #526
  - Update minimum Qt version in #527
  - #514 Show password with a monospace font in #528
  - Clear search on profile change in #529
  - Move MainWindow to the screen the cursor is on in #547
  - Fix issues with renaming passwords and moving folders in #532
  - Explicitly only remove ".gpg" when renaming files in #558
  - Keep suffices when moving (to) a directory while imitiating pass in #559
  - Fix keys created/expires dates in the users dialog window (fix: 571) in #572
  - Fix installation instructions in README.md in #565
  - Delete context menu after exec in #578
  - Add more options for the password displaying in #587
  - Fix accidental deletion of entire passwordstore in #604
  - Install QT in codeql workflow in #608
  - Super Linter added and fixing findings in #610
  - Removed travis (no longer free) and lgtm (migrated to Github) in #612
  - fix the unintended "running" of the entropy window in the keygen dial… in #640
  - Restore licensing info for QProgressIndicator in #642
  - Add pass store signing key feature in #634
  - Fix taborder and add buddies in keygen dialog in #643
  - Clazy cleanup and other minor fixes in #641
  - fix bug =&gt; clipboard was not cleared when using primary selection in #615
  - super-linter ENV variables in shared location for local and automated in #616
  - clang-format -i src/.cpp src/.h in #645
  - Version bump and cleanup in #646
  * Wording and localisation
  - Spelling: Git, GPG, PWGen, etc. in #492
  - Spelling: Keylist missing, Could not fetch, GPG in #493
  - Spelling: Search for users, , in #495
  - Translations update from Weblate in #530
  - Translations update from Weblate in #531
  - Translations update from Weblate in #535
  - Translations update from Weblate in #541
  - Translations update from Weblate in #548
  - Translations update from Weblate in #552
  - Translations update from Weblate in #553
  - Translations update from Weblate in #554
  - Translations update from Weblate in #560
  - Translations update from Weblate in #562
  - Translations update from Weblate in #563
  - Correct a typo in pass.cpp in #570
  - Translations update from Weblate in #573
  - Translations update from Hosted Weblate in #576
  - Translations updated in #605
  - Translation cleanup in #606
  - Translations update from Hosted Weblate in #607
  - New Transifex integration yml in #609
  - Translations update from Hosted Weblate in #611
  - Translations update from Hosted Weblate in #613
  - Translations update from Hosted Weblate in #614
  - Translations update from Hosted Weblate in #617
  - Translations update from Hosted Weblate in #618
  - Document "Using profiles" in #619
  - markdownlint --fix &amp;&amp; textlint --fix in #621
  - Translations update from Hosted Weblate in #622
  - Translations update from Hosted Weblate in #626
  - Translations update from Hosted Weblate in #627
  - Translations update from Hosted Weblate in #628
  - Translations update from Hosted Weblate in #629
  - Translations update from Hosted Weblate in #632
  - Translations update from Hosted Weblate in #633
  - Translations update from Hosted Weblate in #636
  - Translations update from Hosted Weblate in #644
  - Translations update from Hosted Weblate in #647
  - Translations update from Hosted Weblate in #648
  - Added Serbian and Estonian to project file in #649
  - Translations update from Hosted Weblate in #650
  - Natural language fixes in #654
  - Initial Korean from Weblate in #655</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt; - 1.5.0" date="1774094400">- Update to 1.5.0
  * Highlights
  - Modernized C++/Qt build pipeline with clang-tidy and wider
    lint/test hardening.
  - Windows release pipeline reliability improvements for AppVeyor
    and Inno Setup packaging.
  - 1.5.0 release metadata and packaging preparation across the
    desktop app, installer, and CI configuration.
  * Fixes &amp; Improvements
  - Fixed profile handling issues in Qt6 compatibility scenarios
    and improved profile selection behavior #681, #695.
  - Preserved existing application behavior when launching qtpass
    without parameters #704.
  - Removed a regression where gpg_id comments could be altered #658.
  - Added missing include path fixes and small reliability
    hardening in core code paths #690, #716.
  * Release, CI and Maintenance
  - Added/updated PublicCode and CI workflows, including release-time
    validation and action upgrades #701, #709, #710, #711, #712.
  - Completed the AppVeyor/Inno Setup modernization and packaging
    updates #722.
  - Updated readme status badges and branch links to current
    workflow targets #724.
  * Localization
  - Synchronised a large set of translation updates through
    Weblate and translation automation.
- Add QtPass-desktop_version.patch to fix invalid-desktopfile.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt; - 1.5.1" date="1774180800">- Update to 1.5.1
  * Fixes
  - Crash on Wayland when screenAt() returns null (#706, #663)
  - CLI arguments being parsed as password search (#652)
  - OTP error handling with better messages (#677)
  - Window icon not showing on dialog boxes (#671)
  - Slovak translation GPG keygen script (#667)
  - Suppress qApp deprecation warnings on Qt6
- Rebase QtPass-desktop_version.patch</changelog>
  <changelog author="ecsos@opensuse.org" date="1776168000">- Update to version 1.6.0:
  * chore: bump version to 1.6.0 and update CHANGELOG
  * test: address review findings for util tests (#985)
  * test: fix executor and util review findings (#984)
  * test: strengthen test assertions per review (#983)
  * test: add executor edge case tests (#982)
  * test: add filecontent edge case tests (#981)
  * test: add more coverage tests (#980)
  * Localization update
  * test: add gpgkeystate coverage tests (#979)
  * test: add UserInfo created/expiry coverage (#978)
- Drop QtPass-desktop_version.patch because it's no longer needed.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1776859200">- Update to version 1.7.0:
  * fix: exclude ui_*.h generated files from Doxygen (#1132)
  * Release v1.7.0 (#1093)
  * tests: use modern QSignalSpy syntax in UI tests (#1131)
  * Fix: QProgressIndicator memory leak and dark mode support (#1129)
  * fix: correct QProgressIndicator license and copyright (#1128)
  * chore: Cleanup
  * fix: add PASS_INSERT to queue before transactionStart/End sequence (#1127)
  * fix: rename transactionStartEnd and differentiate transactionAdd test (#1124)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1123)
  * fix: add assertion to transactionAdd test and remove empty cleanupTestCase (#1122)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1120)
  * fix: translation spelling corrections (#1119)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1118)
  * Translations update from Hosted Weblate (#1116)
  * Fix: formal/informal address in Dutch translations (#1117)
  * Fix: formal/informal address in Dutch translations (#1115)
  * Translations update from Hosted Weblate (#1114)
  * Hernummering localization
  * feat: add integration tests for edge cases (#1112)
  * Translations update from Hosted Weblate (#1113)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1110)
  * fix: rename CHI_SQUARE_CRITICAL_VALUE_DF9 to CHI_SQUARE_PERMISSIVE_THRESHOLD_DF9 (#1111)
  * fix: add named constants and better test messages in tst_util.cpp (#1109)
  * fix: address additional CodeRabbit findings in tst_util.cpp (#1108)
  * docs: More contributing updates (#1107)
  * fix: apply CodeRabbit auto-fixes to CONTRIBUTING.md (#1105)
  * fix: improve test naming and constants in tst_util.cpp (#1106)
  * docs: add commit signing requirement to CONTRIBUTING.md (#1104)
  * fix: address CoPilot test findings in tst_util.cpp (#1103)
  * fix: address CoPilot test findings in tst_util.cpp (#1102)
  * fix: use QString() for proper comparison in test assertions (#1101)
  * fix: address additional Coverity scan issues (#1100)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1099)
  * fix: address Coverity scan issues
  * fix: distclean for clean localizations (#1094)
  * Apply suggested fix to CLAUDE.md from Copilot Autofix (#1095)
  * docs: improve CLAUDE.md and fix skill inaccuracies (#1091)
  * Translations update from Hosted Weblate (#1090)
  * Omnummeren localizatie
  * docs: update skill files with Doxygen enforcement and Qt 5.15 compat patterns (#1088)
  * docs: Added CLAUDE.md (#1089)
  * docs: standardise Doxygen style across headers and main.cpp (#1087)
  * Omnummeren localizatie
  * refactor: rename single-letter parameters in setLength and setPasswordCharTemplate (#1086)
  * fix: guard against out-of-bounds index in password character set selection (#1084)
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * fix: use std::as_const on m_fields range-for to prevent implicit detachment
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to src/passworddialog.cpp from Copilot Autofix
  * Apply suggested fix to src/passworddialog.cpp from Copilot Autofix
  * Apply suggested fix to src/passworddialog.cpp from Copilot Autofix
  * docs: remove stale @todo comments
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Translated using Weblate (Czech)
  * Translated using Weblate (German (Luxembourg))
  * Translated using Weblate (Albanian)
  * Translated using Weblate (Albanian)
  * Translated using Weblate (Arabic (Morocco))
  * Translated using Weblate (Afrikaans)
  * Translated using Weblate (Czech)
  * Translated using Weblate (German (Luxembourg))
  * Translated using Weblate (Spanish (Ecuador))
  * Translated using Weblate (Luxembourgish)
  * Translated using Weblate (Czech)
  * Translated using Weblate (Spanish (Argentina))
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Portuguese (Brazil))
  * Translated using Weblate (English (United Kingdom))
  * fix: apply CodeRabbit auto-fixes
  * style: clang-format
  * Apply suggested fix to src/storemodel.cpp from Copilot Autofix
  * Apply suggested fix to src/src.pro from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Friesyske taal tafoege, Fryslân Boppe!
  * Translated using Weblate (Turkish)
  * Translated using Weblate (Frisian (fy_NL))
  * Translated using Weblate (Frisian (fy_NL))
  * Translated using Weblate (Polish)
  * Added translation using Weblate (Frisian (fy_NL))
  * Translated using Weblate (Dutch (Belgium))
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Ukrainian)
  * Translated using Weblate (German)
  * style: clang-format
  * fix: apply CodeRabbit auto-fixes
  * refactor: evaluate key.endsWith('=') once in setEnvVar, use Q_ASSERT_X
  * fix: move length == 0 guard to top of generatePassword
  * refactor: extract fallbackCharset helper, use trailing return type style
  * fix: add missing QDebug include for qWarning() in setEnvVar
  * fix: address AI findings in pass.cpp and storemodel.cpp
  * All the updates
  * fix: move isGrepHeaderLine into anonymous namespace, drop redundant isEmpty check
  * fix: rename max_mod_bound to rejectionThreshold (camelCase convention)
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/storemodel.cpp from Copilot Autofix
  * Apply suggested fix to src/storemodel.cpp from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Translated using Weblate (Turkish)
  * fix: validate ItemKind on deserialization, exhaustive switch in executeDropAction
  * fix: update storemodel.cpp to use ItemKind enum and const QString&amp; param
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to src/storemodel.h from Copilot Autofix
  * Apply suggested fix to src/storemodel.h from Copilot Autofix
  * fix: restore key expired fallback, revert findGpgconfInGpgDir arg, add &lt;algorithm&gt;
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/storemodel.h from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Translated using Weblate (Swedish)
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Luxembourgish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Serbian (Cyrillic script))
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Chinese (Simplified Han script))
  * Translated using Weblate (Arabic (Morocco))
  * Add more integration tests and fix CI GPG/Git issues
  * Translated using Weblate (Arabic (Morocco))
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Hungarian)
  * Fix gpgconf discovery, restore signing key, and clear insertErrorSpy
  * Fix platform-specific pinentry and RealPass error diagnostics
  * chore: ignore integration test binary
  * CI: Use correct pass-otp package names per OS (pass-extension-otp on Linux, pass-otp on macOS)
  * CI: Fix pass-otp package name for macOS
  * CI: Install pass-otp on Linux and macOS
  * CI: Install pass on Linux and macOS
  * Fix integration tests: clear passSigningKey, use gpgInsertErrorMsg for RealPass
  * Fix integration test code quality findings and CI dependencies
  * fix: CI GPG trust, full-write verification, and Insert error diagnostics
  * fix: fail fast with diagnostics if gpg-agent setup fails in initTestCase
  * fix: pre-start gpg-agent and configure loopback pinentry for CI
  * feat: add integration tests for ImitatePass and RealPass backends
  * Regenerate localization files with qmake6
  * Additional fixes for refactored methods
  * Refine complex method fixes
  * Refactor complex methods to reduce cyclomatic complexity
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Sinhala)
  * Fix code quality findings
  * Use beginFilterChange/endFilterChange for Qt 6.10+
  * Translated using Weblate (Portuguese (Brazil))
  * Clean up localization files after qmake6 regeneration
  * fix: add missing Turkish translations and correct German typos
  * Add QVERIFY checks for file operations in settings tests
  * fix: avoid deprecated invalidateFilter on Qt 6.5+
  * fix: add null/empty/stream-status guards in drag-and-drop decode
  * fix: suppress invalidateFilter deprecation warning instead of version guards
  * fix: correct version guard for beginFilterChange to Qt 6.9
  * fix: use only beginFilterChange() — endFilterChange() does not exist
  * fix: match showThis declaration to definition, fix missed rename in setter
  * Translated using Weblate (German)
  * Translated using Weblate (German)
  * Translated using Weblate (Welsh)
  * fix: pass QModelIndex by const ref, reorder MIME check, fix typo
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Translations update from Hosted Weblate (#1044)
  * fix: use beginFilterChange/endFilterChange on Qt 6.9+
  * Translations update from Hosted Weblate (#1043)
  * chore: Update locale files with new words  (#1041)
  * feat: implement pass grep content search (#109) (#1037)
  * feat: add Spanish regional variants (#1040)
  * Translations update from Hosted Weblate (#1039)
  * fix: avoid deprecated invalidateFilter on Qt 6.5+ (#1038)
  * fix: improve profile creation experience (#1036)
  * fix: show user-friendly error when GPG key is expired or invalid (#1035)
  * fix: clear stale selection and update proxy filter on profile change (#1033)
  * Renumbered localez
  * Translations update from Hosted Weblate (#1031)
  * fix: set PASSWORD_STORE_* env vars and grey out pass-managed controls (#1032)
  * CodeRabbit Generated Unit Tests: Add unit tests for PR changes (#1030)
  * Translations update from Hosted Weblate (#1029)
  * fix: resolve clangd performance and correctness findings (#1028)
  * fix: clarify conflicted file paths in merge instructions (#1027)
  * fix: avoid wildcard in merge conflict resolution (#1024)
  * Potential fixes for 2 code quality findings (#1023)
  * chore: update localization skill (#1022)
  * chore: add Claude Code skills adapted from .opencode/skills (#1021)
  * fix: ta_IN translation corrections (#1020)
  * Translations update from Hosted Weblate (#1018)
  * fix: ro_RO localization corrections (#1019)
  * chore: More localization updates with Qwen (#1016)
  * fix: grammar corrections in localization files (#1017)
  * Translations update from Hosted Weblate (#1015)
  * Helpful qwen2.5
  * pt_BR
  * style: Updated code formatting and indentation for consistency in project configuration files (#1013)
  * Fixed Sinhala, Sri Lanka file name
  * Merge pull request #1012 from IJHack/localization-updates-with-qwen
  * Tamil
  * Moved Tamil
  * naming and Chinese
  * Translated using Weblate (Estonian)
  * Translated using Weblate (Estonian)
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Spanish)
  * Translated using Weblate (Luxembourgish)
  * Translated using Weblate (Chinese (Simplified Han script))
  * Translated using Weblate (Dutch (Belgium))
  * Translated using Weblate (Galician)
  * Translated using Weblate (Danish)
  * Translated using Weblate (Slovenian)
  * Translated using Weblate (Polish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Afrikaans)
  * Translated using Weblate (Welsh)
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Albanian)
  * Translated using Weblate (Ukrainian)
  * Translated using Weblate (German)
  * Translated using Weblate (English (United Kingdom))
  * Translated using Weblate (Croatian)
  * test: improve randomness and distribution tests
  * New translations
  * feat: add re-encrypt context menu for directories (#1009)
  * Update .github/workflows/docs.yml
  * fix: add error handling for Doxyfile version update in docs workflow
  * fix: use raw VERSION in sed replacement
  * fix: improve version escaping and validation in release-mac.sh
  * Update scripts/release-mac.sh
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * fix: improve shell script error handling and safety
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Apply suggested fix to scripts/generate-doxygen-pdf.sh from Copilot Autofix
  * Twijfelachtige fix
  * refactor: remove unnecessary charset variables in generateRandomPassword tests
  * fix: use correct doxygen download URL
  * shfmt and recover backup in the end
  * Minder enter
  * Update scripts/generate-doxygen-pdf.sh
  * chmod +x and newline
  * fix: apply CodeRabbit auto-fixes
  * refactor: rename ambiguous variable names in util tests
  * Update scripts/generate-doxygen-pdf.sh
  * Apply suggested fix to scripts/generate-doxygen-pdf.sh from Copilot Autofix
  * Update .github/workflows/docs.yml
  * chore: install Doxygen 1.16.1 from official release in CI
  * Locale fix
  * Locale and version update
  * fix: use USE_PDFLATEX in PDF script and derive output dir from PDF_FILE
  * fix: use portable sed with temp file for cross-platform compatibility
  * fix: handle latex output directories in PDF script
  * fix: use portable sed syntax for macOS/BSD compatibility
  * fix: set doxygen version directly in Doxyfile
  * fix: use scoped rollback for gpg executable in configIsValid test
  * test: add charset validation and configIsValid edge cases
  * perf: use static regex instances in isValidKeyId and findBinaryInPath
  * fix: properly strip angle brackets before 0x prefix
  * refactor: simplify isValidKeyId complexity using regex
  * fix: update util.h comment and tests per review findings
  * fix: update util.h comment and tests per review findings
  * fix: validate .gpg-id key IDs - accept emails and special formats
  * chore: verify macdeployqt and appdmg are available before using
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Update scripts/release-mac.sh
  * docs: remove Doxyfile from grep example
  * docs: update skill to exclude Doxyfile from manual updates
  * docs: fix release workflow order per review
  * fix: export QTPASS_VERSION in release-mac.sh before doxygen
  * fix: update MATHJAX_RELPATH to jsdelivr and make skill evergreen
  * fix: export QTPASS_VERSION for Doxygen
  * docs: fix release workflow per CodeAnt review
  * Microsocopic cleanup in spec file
  * docs: make releasing skill evergreen
  * docs: update releasing skill with learned patterns
  * chore: update version in Doxyfile to 1.6.0
  * fix: resolve lint issues in CHANGELOG</changelog>
</package>
<package pkgid="ffb9bdc7aaa5e6b77ce5ae7928398a3737fabef0526d75190e22c4104f357c0f5dfb635c8046f9c9218904b729ab901df90579d323cfcf9ace8c101f0dc5b042" name="QtPass" arch="src">
  <version epoch="0" ver="1.7.0" rel="14.6"/>
  <changelog author="aavindraa@gmail.com" date="1510228800">- update to 1.2.0
  * Many UX improvements
  * Improved process management
  * Extraction of library and main function
  * Added sftp, ftps, webdav and webdavs as supported links
  * PRNG issues on Windows fixed
- cleanup spec file with spec-cleaner</changelog>
  <changelog author="herbert@graeber-clan.de" date="1510747200">- Fix HighDPI</changelog>
  <changelog author="avindra@opensuse.org" date="1515067200">- update to 1.2.1
  * All passwords that have been generated with QtPass prior to
    1.2.1 should be regenerated and changed.
  * Version 1.2.0 leaks passwords
  * When importing settings from 1.1.5 or older, clipboard
    settings revert to No Clipboard
  * Add Catalan translation</changelog>
  <changelog author="herbert@graeber-clan.de" date="1519819200">- Convert to license to SPDX-3.0
- Use %license</changelog>
  <changelog author="ecsos@opensuse.org" date="1525867200">- update to 1.2.2
  - Clipboard clearing timer is not reset when new passwords are
    copied to the clipboard #309
  - Removal of files outside of password-store #300 #363
  - Lots of fixes and refactoring. #364 #376 #378 #381 #382 #384
    [#386]
  - Fix &amp; make clearClipboard more robust #359
  - Multiple question marks while trying to delete password #385
  - No button icons and text in "menu bar" #383
  - Entire program is huge on High DPI screen on Linux #369
  - Parallel make issue in qtpass-1.2.1: ld: cannot find -lqtpass
    [#350]
  - No password entry prompt #343
  - Can't install on OS X Sierra #337
  - No icon on MacOS #333
  - Font and spacing used for URL links on right in main window
    absurdly large #329
  - QtPass don't display all lines with templates #273 #358
  - Update CONTRIBUTING.md #354 and add two entries in FAQ about
    the language #353
  - Fix nested template argument list compile error #346
  - Honor PREFIX during tests install #345</changelog>
  <changelog author="herbert@graeber-clan.de" date="1525867201">- Remove the qtpass-highdpi.patch, merged upstream</changelog>
  <changelog author="ecsos@opensuse.org" date="1528200000">- update to 1.2.3
  - Add support for OTP code generation on Linux as requested in
    [#327] #394 (Noettore)
  - Revert scroll bar changes #393 (destanyol)
  - Fix High Dpi Support. Works now under Windows and KDE/Plasma.
    [#392] (hgraeber)
  - Duplicate prefix in installation of tests directory in v1.2.2.
    [#389]
  - Compilation error on FreeBSD member access into incomplete type
    [#388]
- remove patch qtpass-highdpi.patch because now in upstream</changelog>
  <changelog author="herbert@graeber-clan.de" date="1531137600">- Make RCC calls reproducible</changelog>
  <changelog author="Herbert Graeber &lt;herbert@graeber-clan.de&gt;" date="1539432000">- For reprodicibilty QT_HASH_SEED has to be set to 0</changelog>
  <changelog author="ecsos@opensuse.org" date="1566648000">- Update to 1.3.0
  Some of the many changes, please resort to the CHANGELOG for
  a more complete listing.
  - Add otp (two factor authentication) support #327
  - Use key fingerprint as ID instead of “long” ID. #452
  - Typo: dialouge to dialogue. #444
  - Scripts and logic specific to Windows Store releases #439
  - For config check, check that the selected binary is available.
    [#438]
  - Fix character encoding issues for non-UTF-8 locales. #435
  - Fixes and improvments for config dialog #432
  - Support for using WSL binaries on Windows #431
  - Bugfixes and Windows compatibility improvements #430
  - Semi-automatic code cleanup #425
  - Update to prevent the installer requesting admin #424
  - Display passwords as QR codes #421
  - Tested working on Mac Os HS with pinentry-mac #419
  - Bugfixes #413
  - pwgen: fix inverted "Generate ... less secure passwords"
    checkbox #409
  - Continuing refactoring #407
  - #390 make box cheched when opening a folder users panel #403
  - Windows sigsev issues #326
  - Access to the / (root) directory form within the application
    window on MacOS #302
  - Context menu on transparent fields is transparent too . . #227
  - Various issues with Info.plist file on macOS #457
  - Problem with GNUpg not found on MacOS #362
  - Unable to see main application window (applicationn runs
    minimized to tray only) #286</changelog>
  <changelog author="ecsos@opensuse.org" date="1570017600">- Update to 1.3.1
  - Renaming password #463 #469
  - Edit main title field #446
  - Add missing finishedShow() signal connection in PasswordDialog
    constructor (fixes the "Edit password" function) #473
  - Build dependency fixes #467 #479
  - Additional lines (notes) shown again #474
  - Running but no GUI #451
  - Correct font color with Dark themes #340 #476
  - Add missing overrides #478
  - Sorted profiles dropdown as in #404 #472
  - Fix missing app ID and icon on Wayland. #468</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1570276800">- Remove superfluous entry for password-store from Recommends as
  it's already stated in Requires
- Add hicolor-icon-theme to BuildRequires</changelog>
  <changelog author="ecsos@opensuse.org" date="1570363200">- Rename all to package_naming_guidelines.</changelog>
  <changelog author="ecsos@opensuse.org" date="1570622400">- Update to 1.3.2
  - Don't call QtPass::setup() from QtPass class constructor #482
    fixes first run issues #485, #481, #466, #423 and #308
  - Password window padding #484
  - Buttons width on RHEL 8 #483
  - Start minimized works again #471</changelog>
  <changelog author="ecsos@opensuse.org" date="1586692800">- Add qtpass.appdata.xml.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1695124800">- Update to 1.4.0
  * What's Changed
  - Don't use a deprecated method in #491
  - Issue #402: 'deselect()' on clearing filter in #490
  - Don't base pass-otp availability decision on hardcoded /usr/lib in #499
  - Use new stable version of install-qt-action.  in #502
  - Enable out-of-source build in #503
  - Enable ubuntu, windows and macOS based builds for CI in #508
  - Spelling: Git pull, Git push in #516
  - Fix blurry icons when fractional scaling is enabled in #526
  - Update minimum Qt version in #527
  - #514 Show password with a monospace font in #528
  - Clear search on profile change in #529
  - Move MainWindow to the screen the cursor is on in #547
  - Fix issues with renaming passwords and moving folders in #532
  - Explicitly only remove ".gpg" when renaming files in #558
  - Keep suffices when moving (to) a directory while imitiating pass in #559
  - Fix keys created/expires dates in the users dialog window (fix: 571) in #572
  - Fix installation instructions in README.md in #565
  - Delete context menu after exec in #578
  - Add more options for the password displaying in #587
  - Fix accidental deletion of entire passwordstore in #604
  - Install QT in codeql workflow in #608
  - Super Linter added and fixing findings in #610
  - Removed travis (no longer free) and lgtm (migrated to Github) in #612
  - fix the unintended "running" of the entropy window in the keygen dial… in #640
  - Restore licensing info for QProgressIndicator in #642
  - Add pass store signing key feature in #634
  - Fix taborder and add buddies in keygen dialog in #643
  - Clazy cleanup and other minor fixes in #641
  - fix bug =&gt; clipboard was not cleared when using primary selection in #615
  - super-linter ENV variables in shared location for local and automated in #616
  - clang-format -i src/.cpp src/.h in #645
  - Version bump and cleanup in #646
  * Wording and localisation
  - Spelling: Git, GPG, PWGen, etc. in #492
  - Spelling: Keylist missing, Could not fetch, GPG in #493
  - Spelling: Search for users, , in #495
  - Translations update from Weblate in #530
  - Translations update from Weblate in #531
  - Translations update from Weblate in #535
  - Translations update from Weblate in #541
  - Translations update from Weblate in #548
  - Translations update from Weblate in #552
  - Translations update from Weblate in #553
  - Translations update from Weblate in #554
  - Translations update from Weblate in #560
  - Translations update from Weblate in #562
  - Translations update from Weblate in #563
  - Correct a typo in pass.cpp in #570
  - Translations update from Weblate in #573
  - Translations update from Hosted Weblate in #576
  - Translations updated in #605
  - Translation cleanup in #606
  - Translations update from Hosted Weblate in #607
  - New Transifex integration yml in #609
  - Translations update from Hosted Weblate in #611
  - Translations update from Hosted Weblate in #613
  - Translations update from Hosted Weblate in #614
  - Translations update from Hosted Weblate in #617
  - Translations update from Hosted Weblate in #618
  - Document "Using profiles" in #619
  - markdownlint --fix &amp;&amp; textlint --fix in #621
  - Translations update from Hosted Weblate in #622
  - Translations update from Hosted Weblate in #626
  - Translations update from Hosted Weblate in #627
  - Translations update from Hosted Weblate in #628
  - Translations update from Hosted Weblate in #629
  - Translations update from Hosted Weblate in #632
  - Translations update from Hosted Weblate in #633
  - Translations update from Hosted Weblate in #636
  - Translations update from Hosted Weblate in #644
  - Translations update from Hosted Weblate in #647
  - Translations update from Hosted Weblate in #648
  - Added Serbian and Estonian to project file in #649
  - Translations update from Hosted Weblate in #650
  - Natural language fixes in #654
  - Initial Korean from Weblate in #655</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt; - 1.5.0" date="1774094400">- Update to 1.5.0
  * Highlights
  - Modernized C++/Qt build pipeline with clang-tidy and wider
    lint/test hardening.
  - Windows release pipeline reliability improvements for AppVeyor
    and Inno Setup packaging.
  - 1.5.0 release metadata and packaging preparation across the
    desktop app, installer, and CI configuration.
  * Fixes &amp; Improvements
  - Fixed profile handling issues in Qt6 compatibility scenarios
    and improved profile selection behavior #681, #695.
  - Preserved existing application behavior when launching qtpass
    without parameters #704.
  - Removed a regression where gpg_id comments could be altered #658.
  - Added missing include path fixes and small reliability
    hardening in core code paths #690, #716.
  * Release, CI and Maintenance
  - Added/updated PublicCode and CI workflows, including release-time
    validation and action upgrades #701, #709, #710, #711, #712.
  - Completed the AppVeyor/Inno Setup modernization and packaging
    updates #722.
  - Updated readme status badges and branch links to current
    workflow targets #724.
  * Localization
  - Synchronised a large set of translation updates through
    Weblate and translation automation.
- Add QtPass-desktop_version.patch to fix invalid-desktopfile.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt; - 1.5.1" date="1774180800">- Update to 1.5.1
  * Fixes
  - Crash on Wayland when screenAt() returns null (#706, #663)
  - CLI arguments being parsed as password search (#652)
  - OTP error handling with better messages (#677)
  - Window icon not showing on dialog boxes (#671)
  - Slovak translation GPG keygen script (#667)
  - Suppress qApp deprecation warnings on Qt6
- Rebase QtPass-desktop_version.patch</changelog>
  <changelog author="ecsos@opensuse.org" date="1776168000">- Update to version 1.6.0:
  * chore: bump version to 1.6.0 and update CHANGELOG
  * test: address review findings for util tests (#985)
  * test: fix executor and util review findings (#984)
  * test: strengthen test assertions per review (#983)
  * test: add executor edge case tests (#982)
  * test: add filecontent edge case tests (#981)
  * test: add more coverage tests (#980)
  * Localization update
  * test: add gpgkeystate coverage tests (#979)
  * test: add UserInfo created/expiry coverage (#978)
- Drop QtPass-desktop_version.patch because it's no longer needed.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1776859200">- Update to version 1.7.0:
  * fix: exclude ui_*.h generated files from Doxygen (#1132)
  * Release v1.7.0 (#1093)
  * tests: use modern QSignalSpy syntax in UI tests (#1131)
  * Fix: QProgressIndicator memory leak and dark mode support (#1129)
  * fix: correct QProgressIndicator license and copyright (#1128)
  * chore: Cleanup
  * fix: add PASS_INSERT to queue before transactionStart/End sequence (#1127)
  * fix: rename transactionStartEnd and differentiate transactionAdd test (#1124)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1123)
  * fix: add assertion to transactionAdd test and remove empty cleanupTestCase (#1122)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1120)
  * fix: translation spelling corrections (#1119)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1118)
  * Translations update from Hosted Weblate (#1116)
  * Fix: formal/informal address in Dutch translations (#1117)
  * Fix: formal/informal address in Dutch translations (#1115)
  * Translations update from Hosted Weblate (#1114)
  * Hernummering localization
  * feat: add integration tests for edge cases (#1112)
  * Translations update from Hosted Weblate (#1113)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1110)
  * fix: rename CHI_SQUARE_CRITICAL_VALUE_DF9 to CHI_SQUARE_PERMISSIVE_THRESHOLD_DF9 (#1111)
  * fix: add named constants and better test messages in tst_util.cpp (#1109)
  * fix: address additional CodeRabbit findings in tst_util.cpp (#1108)
  * docs: More contributing updates (#1107)
  * fix: apply CodeRabbit auto-fixes to CONTRIBUTING.md (#1105)
  * fix: improve test naming and constants in tst_util.cpp (#1106)
  * docs: add commit signing requirement to CONTRIBUTING.md (#1104)
  * fix: address CoPilot test findings in tst_util.cpp (#1103)
  * fix: address CoPilot test findings in tst_util.cpp (#1102)
  * fix: use QString() for proper comparison in test assertions (#1101)
  * fix: address additional Coverity scan issues (#1100)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1099)
  * fix: address Coverity scan issues
  * fix: distclean for clean localizations (#1094)
  * Apply suggested fix to CLAUDE.md from Copilot Autofix (#1095)
  * docs: improve CLAUDE.md and fix skill inaccuracies (#1091)
  * Translations update from Hosted Weblate (#1090)
  * Omnummeren localizatie
  * docs: update skill files with Doxygen enforcement and Qt 5.15 compat patterns (#1088)
  * docs: Added CLAUDE.md (#1089)
  * docs: standardise Doxygen style across headers and main.cpp (#1087)
  * Omnummeren localizatie
  * refactor: rename single-letter parameters in setLength and setPasswordCharTemplate (#1086)
  * fix: guard against out-of-bounds index in password character set selection (#1084)
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * fix: use std::as_const on m_fields range-for to prevent implicit detachment
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to src/passworddialog.cpp from Copilot Autofix
  * Apply suggested fix to src/passworddialog.cpp from Copilot Autofix
  * Apply suggested fix to src/passworddialog.cpp from Copilot Autofix
  * docs: remove stale @todo comments
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Translated using Weblate (Czech)
  * Translated using Weblate (German (Luxembourg))
  * Translated using Weblate (Albanian)
  * Translated using Weblate (Albanian)
  * Translated using Weblate (Arabic (Morocco))
  * Translated using Weblate (Afrikaans)
  * Translated using Weblate (Czech)
  * Translated using Weblate (German (Luxembourg))
  * Translated using Weblate (Spanish (Ecuador))
  * Translated using Weblate (Luxembourgish)
  * Translated using Weblate (Czech)
  * Translated using Weblate (Spanish (Argentina))
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Portuguese (Brazil))
  * Translated using Weblate (English (United Kingdom))
  * fix: apply CodeRabbit auto-fixes
  * style: clang-format
  * Apply suggested fix to src/storemodel.cpp from Copilot Autofix
  * Apply suggested fix to src/src.pro from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Friesyske taal tafoege, Fryslân Boppe!
  * Translated using Weblate (Turkish)
  * Translated using Weblate (Frisian (fy_NL))
  * Translated using Weblate (Frisian (fy_NL))
  * Translated using Weblate (Polish)
  * Added translation using Weblate (Frisian (fy_NL))
  * Translated using Weblate (Dutch (Belgium))
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Ukrainian)
  * Translated using Weblate (German)
  * style: clang-format
  * fix: apply CodeRabbit auto-fixes
  * refactor: evaluate key.endsWith('=') once in setEnvVar, use Q_ASSERT_X
  * fix: move length == 0 guard to top of generatePassword
  * refactor: extract fallbackCharset helper, use trailing return type style
  * fix: add missing QDebug include for qWarning() in setEnvVar
  * fix: address AI findings in pass.cpp and storemodel.cpp
  * All the updates
  * fix: move isGrepHeaderLine into anonymous namespace, drop redundant isEmpty check
  * fix: rename max_mod_bound to rejectionThreshold (camelCase convention)
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/storemodel.cpp from Copilot Autofix
  * Apply suggested fix to src/storemodel.cpp from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Translated using Weblate (Turkish)
  * fix: validate ItemKind on deserialization, exhaustive switch in executeDropAction
  * fix: update storemodel.cpp to use ItemKind enum and const QString&amp; param
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to src/storemodel.h from Copilot Autofix
  * Apply suggested fix to src/storemodel.h from Copilot Autofix
  * fix: restore key expired fallback, revert findGpgconfInGpgDir arg, add &lt;algorithm&gt;
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/storemodel.h from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Translated using Weblate (Swedish)
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Luxembourgish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Serbian (Cyrillic script))
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Chinese (Simplified Han script))
  * Translated using Weblate (Arabic (Morocco))
  * Add more integration tests and fix CI GPG/Git issues
  * Translated using Weblate (Arabic (Morocco))
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Hungarian)
  * Fix gpgconf discovery, restore signing key, and clear insertErrorSpy
  * Fix platform-specific pinentry and RealPass error diagnostics
  * chore: ignore integration test binary
  * CI: Use correct pass-otp package names per OS (pass-extension-otp on Linux, pass-otp on macOS)
  * CI: Fix pass-otp package name for macOS
  * CI: Install pass-otp on Linux and macOS
  * CI: Install pass on Linux and macOS
  * Fix integration tests: clear passSigningKey, use gpgInsertErrorMsg for RealPass
  * Fix integration test code quality findings and CI dependencies
  * fix: CI GPG trust, full-write verification, and Insert error diagnostics
  * fix: fail fast with diagnostics if gpg-agent setup fails in initTestCase
  * fix: pre-start gpg-agent and configure loopback pinentry for CI
  * feat: add integration tests for ImitatePass and RealPass backends
  * Regenerate localization files with qmake6
  * Additional fixes for refactored methods
  * Refine complex method fixes
  * Refactor complex methods to reduce cyclomatic complexity
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Sinhala)
  * Fix code quality findings
  * Use beginFilterChange/endFilterChange for Qt 6.10+
  * Translated using Weblate (Portuguese (Brazil))
  * Clean up localization files after qmake6 regeneration
  * fix: add missing Turkish translations and correct German typos
  * Add QVERIFY checks for file operations in settings tests
  * fix: avoid deprecated invalidateFilter on Qt 6.5+
  * fix: add null/empty/stream-status guards in drag-and-drop decode
  * fix: suppress invalidateFilter deprecation warning instead of version guards
  * fix: correct version guard for beginFilterChange to Qt 6.9
  * fix: use only beginFilterChange() — endFilterChange() does not exist
  * fix: match showThis declaration to definition, fix missed rename in setter
  * Translated using Weblate (German)
  * Translated using Weblate (German)
  * Translated using Weblate (Welsh)
  * fix: pass QModelIndex by const ref, reorder MIME check, fix typo
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Translations update from Hosted Weblate (#1044)
  * fix: use beginFilterChange/endFilterChange on Qt 6.9+
  * Translations update from Hosted Weblate (#1043)
  * chore: Update locale files with new words  (#1041)
  * feat: implement pass grep content search (#109) (#1037)
  * feat: add Spanish regional variants (#1040)
  * Translations update from Hosted Weblate (#1039)
  * fix: avoid deprecated invalidateFilter on Qt 6.5+ (#1038)
  * fix: improve profile creation experience (#1036)
  * fix: show user-friendly error when GPG key is expired or invalid (#1035)
  * fix: clear stale selection and update proxy filter on profile change (#1033)
  * Renumbered localez
  * Translations update from Hosted Weblate (#1031)
  * fix: set PASSWORD_STORE_* env vars and grey out pass-managed controls (#1032)
  * CodeRabbit Generated Unit Tests: Add unit tests for PR changes (#1030)
  * Translations update from Hosted Weblate (#1029)
  * fix: resolve clangd performance and correctness findings (#1028)
  * fix: clarify conflicted file paths in merge instructions (#1027)
  * fix: avoid wildcard in merge conflict resolution (#1024)
  * Potential fixes for 2 code quality findings (#1023)
  * chore: update localization skill (#1022)
  * chore: add Claude Code skills adapted from .opencode/skills (#1021)
  * fix: ta_IN translation corrections (#1020)
  * Translations update from Hosted Weblate (#1018)
  * fix: ro_RO localization corrections (#1019)
  * chore: More localization updates with Qwen (#1016)
  * fix: grammar corrections in localization files (#1017)
  * Translations update from Hosted Weblate (#1015)
  * Helpful qwen2.5
  * pt_BR
  * style: Updated code formatting and indentation for consistency in project configuration files (#1013)
  * Fixed Sinhala, Sri Lanka file name
  * Merge pull request #1012 from IJHack/localization-updates-with-qwen
  * Tamil
  * Moved Tamil
  * naming and Chinese
  * Translated using Weblate (Estonian)
  * Translated using Weblate (Estonian)
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Spanish)
  * Translated using Weblate (Luxembourgish)
  * Translated using Weblate (Chinese (Simplified Han script))
  * Translated using Weblate (Dutch (Belgium))
  * Translated using Weblate (Galician)
  * Translated using Weblate (Danish)
  * Translated using Weblate (Slovenian)
  * Translated using Weblate (Polish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Afrikaans)
  * Translated using Weblate (Welsh)
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Albanian)
  * Translated using Weblate (Ukrainian)
  * Translated using Weblate (German)
  * Translated using Weblate (English (United Kingdom))
  * Translated using Weblate (Croatian)
  * test: improve randomness and distribution tests
  * New translations
  * feat: add re-encrypt context menu for directories (#1009)
  * Update .github/workflows/docs.yml
  * fix: add error handling for Doxyfile version update in docs workflow
  * fix: use raw VERSION in sed replacement
  * fix: improve version escaping and validation in release-mac.sh
  * Update scripts/release-mac.sh
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * fix: improve shell script error handling and safety
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Apply suggested fix to scripts/generate-doxygen-pdf.sh from Copilot Autofix
  * Twijfelachtige fix
  * refactor: remove unnecessary charset variables in generateRandomPassword tests
  * fix: use correct doxygen download URL
  * shfmt and recover backup in the end
  * Minder enter
  * Update scripts/generate-doxygen-pdf.sh
  * chmod +x and newline
  * fix: apply CodeRabbit auto-fixes
  * refactor: rename ambiguous variable names in util tests
  * Update scripts/generate-doxygen-pdf.sh
  * Apply suggested fix to scripts/generate-doxygen-pdf.sh from Copilot Autofix
  * Update .github/workflows/docs.yml
  * chore: install Doxygen 1.16.1 from official release in CI
  * Locale fix
  * Locale and version update
  * fix: use USE_PDFLATEX in PDF script and derive output dir from PDF_FILE
  * fix: use portable sed with temp file for cross-platform compatibility
  * fix: handle latex output directories in PDF script
  * fix: use portable sed syntax for macOS/BSD compatibility
  * fix: set doxygen version directly in Doxyfile
  * fix: use scoped rollback for gpg executable in configIsValid test
  * test: add charset validation and configIsValid edge cases
  * perf: use static regex instances in isValidKeyId and findBinaryInPath
  * fix: properly strip angle brackets before 0x prefix
  * refactor: simplify isValidKeyId complexity using regex
  * fix: update util.h comment and tests per review findings
  * fix: update util.h comment and tests per review findings
  * fix: validate .gpg-id key IDs - accept emails and special formats
  * chore: verify macdeployqt and appdmg are available before using
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Update scripts/release-mac.sh
  * docs: remove Doxyfile from grep example
  * docs: update skill to exclude Doxyfile from manual updates
  * docs: fix release workflow order per review
  * fix: export QTPASS_VERSION in release-mac.sh before doxygen
  * fix: update MATHJAX_RELPATH to jsdelivr and make skill evergreen
  * fix: export QTPASS_VERSION for Doxygen
  * docs: fix release workflow per CodeAnt review
  * Microsocopic cleanup in spec file
  * docs: make releasing skill evergreen
  * docs: update releasing skill with learned patterns
  * chore: update version in Doxyfile to 1.6.0
  * fix: resolve lint issues in CHANGELOG</changelog>
</package>
<package pkgid="717c184544db9053a51a96f4885ff4e4c0d713443668685a5468592a56d0e8ca299a83969ef1b63657c61de63367699f4f6c423633bbf4e84718134881145a20" name="QtPass-debuginfo" arch="s390x">
  <version epoch="0" ver="1.7.0" rel="14.6"/>
  <changelog author="ecsos@opensuse.org" date="1570017600">- Update to 1.3.1
  - Renaming password #463 #469
  - Edit main title field #446
  - Add missing finishedShow() signal connection in PasswordDialog
    constructor (fixes the "Edit password" function) #473
  - Build dependency fixes #467 #479
  - Additional lines (notes) shown again #474
  - Running but no GUI #451
  - Correct font color with Dark themes #340 #476
  - Add missing overrides #478
  - Sorted profiles dropdown as in #404 #472
  - Fix missing app ID and icon on Wayland. #468</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1570276800">- Remove superfluous entry for password-store from Recommends as
  it's already stated in Requires
- Add hicolor-icon-theme to BuildRequires</changelog>
  <changelog author="ecsos@opensuse.org" date="1570363200">- Rename all to package_naming_guidelines.</changelog>
  <changelog author="ecsos@opensuse.org" date="1570622400">- Update to 1.3.2
  - Don't call QtPass::setup() from QtPass class constructor #482
    fixes first run issues #485, #481, #466, #423 and #308
  - Password window padding #484
  - Buttons width on RHEL 8 #483
  - Start minimized works again #471</changelog>
  <changelog author="ecsos@opensuse.org" date="1586692800">- Add qtpass.appdata.xml.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1695124800">- Update to 1.4.0
  * What's Changed
  - Don't use a deprecated method in #491
  - Issue #402: 'deselect()' on clearing filter in #490
  - Don't base pass-otp availability decision on hardcoded /usr/lib in #499
  - Use new stable version of install-qt-action.  in #502
  - Enable out-of-source build in #503
  - Enable ubuntu, windows and macOS based builds for CI in #508
  - Spelling: Git pull, Git push in #516
  - Fix blurry icons when fractional scaling is enabled in #526
  - Update minimum Qt version in #527
  - #514 Show password with a monospace font in #528
  - Clear search on profile change in #529
  - Move MainWindow to the screen the cursor is on in #547
  - Fix issues with renaming passwords and moving folders in #532
  - Explicitly only remove ".gpg" when renaming files in #558
  - Keep suffices when moving (to) a directory while imitiating pass in #559
  - Fix keys created/expires dates in the users dialog window (fix: 571) in #572
  - Fix installation instructions in README.md in #565
  - Delete context menu after exec in #578
  - Add more options for the password displaying in #587
  - Fix accidental deletion of entire passwordstore in #604
  - Install QT in codeql workflow in #608
  - Super Linter added and fixing findings in #610
  - Removed travis (no longer free) and lgtm (migrated to Github) in #612
  - fix the unintended "running" of the entropy window in the keygen dial… in #640
  - Restore licensing info for QProgressIndicator in #642
  - Add pass store signing key feature in #634
  - Fix taborder and add buddies in keygen dialog in #643
  - Clazy cleanup and other minor fixes in #641
  - fix bug =&gt; clipboard was not cleared when using primary selection in #615
  - super-linter ENV variables in shared location for local and automated in #616
  - clang-format -i src/.cpp src/.h in #645
  - Version bump and cleanup in #646
  * Wording and localisation
  - Spelling: Git, GPG, PWGen, etc. in #492
  - Spelling: Keylist missing, Could not fetch, GPG in #493
  - Spelling: Search for users, , in #495
  - Translations update from Weblate in #530
  - Translations update from Weblate in #531
  - Translations update from Weblate in #535
  - Translations update from Weblate in #541
  - Translations update from Weblate in #548
  - Translations update from Weblate in #552
  - Translations update from Weblate in #553
  - Translations update from Weblate in #554
  - Translations update from Weblate in #560
  - Translations update from Weblate in #562
  - Translations update from Weblate in #563
  - Correct a typo in pass.cpp in #570
  - Translations update from Weblate in #573
  - Translations update from Hosted Weblate in #576
  - Translations updated in #605
  - Translation cleanup in #606
  - Translations update from Hosted Weblate in #607
  - New Transifex integration yml in #609
  - Translations update from Hosted Weblate in #611
  - Translations update from Hosted Weblate in #613
  - Translations update from Hosted Weblate in #614
  - Translations update from Hosted Weblate in #617
  - Translations update from Hosted Weblate in #618
  - Document "Using profiles" in #619
  - markdownlint --fix &amp;&amp; textlint --fix in #621
  - Translations update from Hosted Weblate in #622
  - Translations update from Hosted Weblate in #626
  - Translations update from Hosted Weblate in #627
  - Translations update from Hosted Weblate in #628
  - Translations update from Hosted Weblate in #629
  - Translations update from Hosted Weblate in #632
  - Translations update from Hosted Weblate in #633
  - Translations update from Hosted Weblate in #636
  - Translations update from Hosted Weblate in #644
  - Translations update from Hosted Weblate in #647
  - Translations update from Hosted Weblate in #648
  - Added Serbian and Estonian to project file in #649
  - Translations update from Hosted Weblate in #650
  - Natural language fixes in #654
  - Initial Korean from Weblate in #655</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt; - 1.5.0" date="1774094400">- Update to 1.5.0
  * Highlights
  - Modernized C++/Qt build pipeline with clang-tidy and wider
    lint/test hardening.
  - Windows release pipeline reliability improvements for AppVeyor
    and Inno Setup packaging.
  - 1.5.0 release metadata and packaging preparation across the
    desktop app, installer, and CI configuration.
  * Fixes &amp; Improvements
  - Fixed profile handling issues in Qt6 compatibility scenarios
    and improved profile selection behavior #681, #695.
  - Preserved existing application behavior when launching qtpass
    without parameters #704.
  - Removed a regression where gpg_id comments could be altered #658.
  - Added missing include path fixes and small reliability
    hardening in core code paths #690, #716.
  * Release, CI and Maintenance
  - Added/updated PublicCode and CI workflows, including release-time
    validation and action upgrades #701, #709, #710, #711, #712.
  - Completed the AppVeyor/Inno Setup modernization and packaging
    updates #722.
  - Updated readme status badges and branch links to current
    workflow targets #724.
  * Localization
  - Synchronised a large set of translation updates through
    Weblate and translation automation.
- Add QtPass-desktop_version.patch to fix invalid-desktopfile.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt; - 1.5.1" date="1774180800">- Update to 1.5.1
  * Fixes
  - Crash on Wayland when screenAt() returns null (#706, #663)
  - CLI arguments being parsed as password search (#652)
  - OTP error handling with better messages (#677)
  - Window icon not showing on dialog boxes (#671)
  - Slovak translation GPG keygen script (#667)
  - Suppress qApp deprecation warnings on Qt6
- Rebase QtPass-desktop_version.patch</changelog>
  <changelog author="ecsos@opensuse.org" date="1776168000">- Update to version 1.6.0:
  * chore: bump version to 1.6.0 and update CHANGELOG
  * test: address review findings for util tests (#985)
  * test: fix executor and util review findings (#984)
  * test: strengthen test assertions per review (#983)
  * test: add executor edge case tests (#982)
  * test: add filecontent edge case tests (#981)
  * test: add more coverage tests (#980)
  * Localization update
  * test: add gpgkeystate coverage tests (#979)
  * test: add UserInfo created/expiry coverage (#978)
- Drop QtPass-desktop_version.patch because it's no longer needed.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1776859200">- Update to version 1.7.0:
  * fix: exclude ui_*.h generated files from Doxygen (#1132)
  * Release v1.7.0 (#1093)
  * tests: use modern QSignalSpy syntax in UI tests (#1131)
  * Fix: QProgressIndicator memory leak and dark mode support (#1129)
  * fix: correct QProgressIndicator license and copyright (#1128)
  * chore: Cleanup
  * fix: add PASS_INSERT to queue before transactionStart/End sequence (#1127)
  * fix: rename transactionStartEnd and differentiate transactionAdd test (#1124)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1123)
  * fix: add assertion to transactionAdd test and remove empty cleanupTestCase (#1122)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1120)
  * fix: translation spelling corrections (#1119)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1118)
  * Translations update from Hosted Weblate (#1116)
  * Fix: formal/informal address in Dutch translations (#1117)
  * Fix: formal/informal address in Dutch translations (#1115)
  * Translations update from Hosted Weblate (#1114)
  * Hernummering localization
  * feat: add integration tests for edge cases (#1112)
  * Translations update from Hosted Weblate (#1113)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1110)
  * fix: rename CHI_SQUARE_CRITICAL_VALUE_DF9 to CHI_SQUARE_PERMISSIVE_THRESHOLD_DF9 (#1111)
  * fix: add named constants and better test messages in tst_util.cpp (#1109)
  * fix: address additional CodeRabbit findings in tst_util.cpp (#1108)
  * docs: More contributing updates (#1107)
  * fix: apply CodeRabbit auto-fixes to CONTRIBUTING.md (#1105)
  * fix: improve test naming and constants in tst_util.cpp (#1106)
  * docs: add commit signing requirement to CONTRIBUTING.md (#1104)
  * fix: address CoPilot test findings in tst_util.cpp (#1103)
  * fix: address CoPilot test findings in tst_util.cpp (#1102)
  * fix: use QString() for proper comparison in test assertions (#1101)
  * fix: address additional Coverity scan issues (#1100)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1099)
  * fix: address Coverity scan issues
  * fix: distclean for clean localizations (#1094)
  * Apply suggested fix to CLAUDE.md from Copilot Autofix (#1095)
  * docs: improve CLAUDE.md and fix skill inaccuracies (#1091)
  * Translations update from Hosted Weblate (#1090)
  * Omnummeren localizatie
  * docs: update skill files with Doxygen enforcement and Qt 5.15 compat patterns (#1088)
  * docs: Added CLAUDE.md (#1089)
  * docs: standardise Doxygen style across headers and main.cpp (#1087)
  * Omnummeren localizatie
  * refactor: rename single-letter parameters in setLength and setPasswordCharTemplate (#1086)
  * fix: guard against out-of-bounds index in password character set selection (#1084)
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * fix: use std::as_const on m_fields range-for to prevent implicit detachment
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to src/passworddialog.cpp from Copilot Autofix
  * Apply suggested fix to src/passworddialog.cpp from Copilot Autofix
  * Apply suggested fix to src/passworddialog.cpp from Copilot Autofix
  * docs: remove stale @todo comments
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Translated using Weblate (Czech)
  * Translated using Weblate (German (Luxembourg))
  * Translated using Weblate (Albanian)
  * Translated using Weblate (Albanian)
  * Translated using Weblate (Arabic (Morocco))
  * Translated using Weblate (Afrikaans)
  * Translated using Weblate (Czech)
  * Translated using Weblate (German (Luxembourg))
  * Translated using Weblate (Spanish (Ecuador))
  * Translated using Weblate (Luxembourgish)
  * Translated using Weblate (Czech)
  * Translated using Weblate (Spanish (Argentina))
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Portuguese (Brazil))
  * Translated using Weblate (English (United Kingdom))
  * fix: apply CodeRabbit auto-fixes
  * style: clang-format
  * Apply suggested fix to src/storemodel.cpp from Copilot Autofix
  * Apply suggested fix to src/src.pro from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Friesyske taal tafoege, Fryslân Boppe!
  * Translated using Weblate (Turkish)
  * Translated using Weblate (Frisian (fy_NL))
  * Translated using Weblate (Frisian (fy_NL))
  * Translated using Weblate (Polish)
  * Added translation using Weblate (Frisian (fy_NL))
  * Translated using Weblate (Dutch (Belgium))
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Ukrainian)
  * Translated using Weblate (German)
  * style: clang-format
  * fix: apply CodeRabbit auto-fixes
  * refactor: evaluate key.endsWith('=') once in setEnvVar, use Q_ASSERT_X
  * fix: move length == 0 guard to top of generatePassword
  * refactor: extract fallbackCharset helper, use trailing return type style
  * fix: add missing QDebug include for qWarning() in setEnvVar
  * fix: address AI findings in pass.cpp and storemodel.cpp
  * All the updates
  * fix: move isGrepHeaderLine into anonymous namespace, drop redundant isEmpty check
  * fix: rename max_mod_bound to rejectionThreshold (camelCase convention)
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/storemodel.cpp from Copilot Autofix
  * Apply suggested fix to src/storemodel.cpp from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Translated using Weblate (Turkish)
  * fix: validate ItemKind on deserialization, exhaustive switch in executeDropAction
  * fix: update storemodel.cpp to use ItemKind enum and const QString&amp; param
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to src/storemodel.h from Copilot Autofix
  * Apply suggested fix to src/storemodel.h from Copilot Autofix
  * fix: restore key expired fallback, revert findGpgconfInGpgDir arg, add &lt;algorithm&gt;
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/storemodel.h from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Translated using Weblate (Swedish)
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Luxembourgish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Serbian (Cyrillic script))
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Chinese (Simplified Han script))
  * Translated using Weblate (Arabic (Morocco))
  * Add more integration tests and fix CI GPG/Git issues
  * Translated using Weblate (Arabic (Morocco))
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Hungarian)
  * Fix gpgconf discovery, restore signing key, and clear insertErrorSpy
  * Fix platform-specific pinentry and RealPass error diagnostics
  * chore: ignore integration test binary
  * CI: Use correct pass-otp package names per OS (pass-extension-otp on Linux, pass-otp on macOS)
  * CI: Fix pass-otp package name for macOS
  * CI: Install pass-otp on Linux and macOS
  * CI: Install pass on Linux and macOS
  * Fix integration tests: clear passSigningKey, use gpgInsertErrorMsg for RealPass
  * Fix integration test code quality findings and CI dependencies
  * fix: CI GPG trust, full-write verification, and Insert error diagnostics
  * fix: fail fast with diagnostics if gpg-agent setup fails in initTestCase
  * fix: pre-start gpg-agent and configure loopback pinentry for CI
  * feat: add integration tests for ImitatePass and RealPass backends
  * Regenerate localization files with qmake6
  * Additional fixes for refactored methods
  * Refine complex method fixes
  * Refactor complex methods to reduce cyclomatic complexity
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Sinhala)
  * Fix code quality findings
  * Use beginFilterChange/endFilterChange for Qt 6.10+
  * Translated using Weblate (Portuguese (Brazil))
  * Clean up localization files after qmake6 regeneration
  * fix: add missing Turkish translations and correct German typos
  * Add QVERIFY checks for file operations in settings tests
  * fix: avoid deprecated invalidateFilter on Qt 6.5+
  * fix: add null/empty/stream-status guards in drag-and-drop decode
  * fix: suppress invalidateFilter deprecation warning instead of version guards
  * fix: correct version guard for beginFilterChange to Qt 6.9
  * fix: use only beginFilterChange() — endFilterChange() does not exist
  * fix: match showThis declaration to definition, fix missed rename in setter
  * Translated using Weblate (German)
  * Translated using Weblate (German)
  * Translated using Weblate (Welsh)
  * fix: pass QModelIndex by const ref, reorder MIME check, fix typo
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Translations update from Hosted Weblate (#1044)
  * fix: use beginFilterChange/endFilterChange on Qt 6.9+
  * Translations update from Hosted Weblate (#1043)
  * chore: Update locale files with new words  (#1041)
  * feat: implement pass grep content search (#109) (#1037)
  * feat: add Spanish regional variants (#1040)
  * Translations update from Hosted Weblate (#1039)
  * fix: avoid deprecated invalidateFilter on Qt 6.5+ (#1038)
  * fix: improve profile creation experience (#1036)
  * fix: show user-friendly error when GPG key is expired or invalid (#1035)
  * fix: clear stale selection and update proxy filter on profile change (#1033)
  * Renumbered localez
  * Translations update from Hosted Weblate (#1031)
  * fix: set PASSWORD_STORE_* env vars and grey out pass-managed controls (#1032)
  * CodeRabbit Generated Unit Tests: Add unit tests for PR changes (#1030)
  * Translations update from Hosted Weblate (#1029)
  * fix: resolve clangd performance and correctness findings (#1028)
  * fix: clarify conflicted file paths in merge instructions (#1027)
  * fix: avoid wildcard in merge conflict resolution (#1024)
  * Potential fixes for 2 code quality findings (#1023)
  * chore: update localization skill (#1022)
  * chore: add Claude Code skills adapted from .opencode/skills (#1021)
  * fix: ta_IN translation corrections (#1020)
  * Translations update from Hosted Weblate (#1018)
  * fix: ro_RO localization corrections (#1019)
  * chore: More localization updates with Qwen (#1016)
  * fix: grammar corrections in localization files (#1017)
  * Translations update from Hosted Weblate (#1015)
  * Helpful qwen2.5
  * pt_BR
  * style: Updated code formatting and indentation for consistency in project configuration files (#1013)
  * Fixed Sinhala, Sri Lanka file name
  * Merge pull request #1012 from IJHack/localization-updates-with-qwen
  * Tamil
  * Moved Tamil
  * naming and Chinese
  * Translated using Weblate (Estonian)
  * Translated using Weblate (Estonian)
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Spanish)
  * Translated using Weblate (Luxembourgish)
  * Translated using Weblate (Chinese (Simplified Han script))
  * Translated using Weblate (Dutch (Belgium))
  * Translated using Weblate (Galician)
  * Translated using Weblate (Danish)
  * Translated using Weblate (Slovenian)
  * Translated using Weblate (Polish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Afrikaans)
  * Translated using Weblate (Welsh)
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Albanian)
  * Translated using Weblate (Ukrainian)
  * Translated using Weblate (German)
  * Translated using Weblate (English (United Kingdom))
  * Translated using Weblate (Croatian)
  * test: improve randomness and distribution tests
  * New translations
  * feat: add re-encrypt context menu for directories (#1009)
  * Update .github/workflows/docs.yml
  * fix: add error handling for Doxyfile version update in docs workflow
  * fix: use raw VERSION in sed replacement
  * fix: improve version escaping and validation in release-mac.sh
  * Update scripts/release-mac.sh
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * fix: improve shell script error handling and safety
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Apply suggested fix to scripts/generate-doxygen-pdf.sh from Copilot Autofix
  * Twijfelachtige fix
  * refactor: remove unnecessary charset variables in generateRandomPassword tests
  * fix: use correct doxygen download URL
  * shfmt and recover backup in the end
  * Minder enter
  * Update scripts/generate-doxygen-pdf.sh
  * chmod +x and newline
  * fix: apply CodeRabbit auto-fixes
  * refactor: rename ambiguous variable names in util tests
  * Update scripts/generate-doxygen-pdf.sh
  * Apply suggested fix to scripts/generate-doxygen-pdf.sh from Copilot Autofix
  * Update .github/workflows/docs.yml
  * chore: install Doxygen 1.16.1 from official release in CI
  * Locale fix
  * Locale and version update
  * fix: use USE_PDFLATEX in PDF script and derive output dir from PDF_FILE
  * fix: use portable sed with temp file for cross-platform compatibility
  * fix: handle latex output directories in PDF script
  * fix: use portable sed syntax for macOS/BSD compatibility
  * fix: set doxygen version directly in Doxyfile
  * fix: use scoped rollback for gpg executable in configIsValid test
  * test: add charset validation and configIsValid edge cases
  * perf: use static regex instances in isValidKeyId and findBinaryInPath
  * fix: properly strip angle brackets before 0x prefix
  * refactor: simplify isValidKeyId complexity using regex
  * fix: update util.h comment and tests per review findings
  * fix: update util.h comment and tests per review findings
  * fix: validate .gpg-id key IDs - accept emails and special formats
  * chore: verify macdeployqt and appdmg are available before using
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Update scripts/release-mac.sh
  * docs: remove Doxyfile from grep example
  * docs: update skill to exclude Doxyfile from manual updates
  * docs: fix release workflow order per review
  * fix: export QTPASS_VERSION in release-mac.sh before doxygen
  * fix: update MATHJAX_RELPATH to jsdelivr and make skill evergreen
  * fix: export QTPASS_VERSION for Doxygen
  * docs: fix release workflow per CodeAnt review
  * Microsocopic cleanup in spec file
  * docs: make releasing skill evergreen
  * docs: update releasing skill with learned patterns
  * chore: update version in Doxyfile to 1.6.0
  * fix: resolve lint issues in CHANGELOG</changelog>
</package>
<package pkgid="f011e545071d2ddd93ec24600bbf1b0775be5a6bff70f2a6a85ec6f1a4290d41da2c5a3990519382879ade3f3f43d72290f28dd3123ee8c32c9f27e75bfddedd" name="QtPass-debugsource" arch="s390x">
  <version epoch="0" ver="1.7.0" rel="14.6"/>
  <changelog author="ecsos@opensuse.org" date="1570017600">- Update to 1.3.1
  - Renaming password #463 #469
  - Edit main title field #446
  - Add missing finishedShow() signal connection in PasswordDialog
    constructor (fixes the "Edit password" function) #473
  - Build dependency fixes #467 #479
  - Additional lines (notes) shown again #474
  - Running but no GUI #451
  - Correct font color with Dark themes #340 #476
  - Add missing overrides #478
  - Sorted profiles dropdown as in #404 #472
  - Fix missing app ID and icon on Wayland. #468</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1570276800">- Remove superfluous entry for password-store from Recommends as
  it's already stated in Requires
- Add hicolor-icon-theme to BuildRequires</changelog>
  <changelog author="ecsos@opensuse.org" date="1570363200">- Rename all to package_naming_guidelines.</changelog>
  <changelog author="ecsos@opensuse.org" date="1570622400">- Update to 1.3.2
  - Don't call QtPass::setup() from QtPass class constructor #482
    fixes first run issues #485, #481, #466, #423 and #308
  - Password window padding #484
  - Buttons width on RHEL 8 #483
  - Start minimized works again #471</changelog>
  <changelog author="ecsos@opensuse.org" date="1586692800">- Add qtpass.appdata.xml.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1695124800">- Update to 1.4.0
  * What's Changed
  - Don't use a deprecated method in #491
  - Issue #402: 'deselect()' on clearing filter in #490
  - Don't base pass-otp availability decision on hardcoded /usr/lib in #499
  - Use new stable version of install-qt-action.  in #502
  - Enable out-of-source build in #503
  - Enable ubuntu, windows and macOS based builds for CI in #508
  - Spelling: Git pull, Git push in #516
  - Fix blurry icons when fractional scaling is enabled in #526
  - Update minimum Qt version in #527
  - #514 Show password with a monospace font in #528
  - Clear search on profile change in #529
  - Move MainWindow to the screen the cursor is on in #547
  - Fix issues with renaming passwords and moving folders in #532
  - Explicitly only remove ".gpg" when renaming files in #558
  - Keep suffices when moving (to) a directory while imitiating pass in #559
  - Fix keys created/expires dates in the users dialog window (fix: 571) in #572
  - Fix installation instructions in README.md in #565
  - Delete context menu after exec in #578
  - Add more options for the password displaying in #587
  - Fix accidental deletion of entire passwordstore in #604
  - Install QT in codeql workflow in #608
  - Super Linter added and fixing findings in #610
  - Removed travis (no longer free) and lgtm (migrated to Github) in #612
  - fix the unintended "running" of the entropy window in the keygen dial… in #640
  - Restore licensing info for QProgressIndicator in #642
  - Add pass store signing key feature in #634
  - Fix taborder and add buddies in keygen dialog in #643
  - Clazy cleanup and other minor fixes in #641
  - fix bug =&gt; clipboard was not cleared when using primary selection in #615
  - super-linter ENV variables in shared location for local and automated in #616
  - clang-format -i src/.cpp src/.h in #645
  - Version bump and cleanup in #646
  * Wording and localisation
  - Spelling: Git, GPG, PWGen, etc. in #492
  - Spelling: Keylist missing, Could not fetch, GPG in #493
  - Spelling: Search for users, , in #495
  - Translations update from Weblate in #530
  - Translations update from Weblate in #531
  - Translations update from Weblate in #535
  - Translations update from Weblate in #541
  - Translations update from Weblate in #548
  - Translations update from Weblate in #552
  - Translations update from Weblate in #553
  - Translations update from Weblate in #554
  - Translations update from Weblate in #560
  - Translations update from Weblate in #562
  - Translations update from Weblate in #563
  - Correct a typo in pass.cpp in #570
  - Translations update from Weblate in #573
  - Translations update from Hosted Weblate in #576
  - Translations updated in #605
  - Translation cleanup in #606
  - Translations update from Hosted Weblate in #607
  - New Transifex integration yml in #609
  - Translations update from Hosted Weblate in #611
  - Translations update from Hosted Weblate in #613
  - Translations update from Hosted Weblate in #614
  - Translations update from Hosted Weblate in #617
  - Translations update from Hosted Weblate in #618
  - Document "Using profiles" in #619
  - markdownlint --fix &amp;&amp; textlint --fix in #621
  - Translations update from Hosted Weblate in #622
  - Translations update from Hosted Weblate in #626
  - Translations update from Hosted Weblate in #627
  - Translations update from Hosted Weblate in #628
  - Translations update from Hosted Weblate in #629
  - Translations update from Hosted Weblate in #632
  - Translations update from Hosted Weblate in #633
  - Translations update from Hosted Weblate in #636
  - Translations update from Hosted Weblate in #644
  - Translations update from Hosted Weblate in #647
  - Translations update from Hosted Weblate in #648
  - Added Serbian and Estonian to project file in #649
  - Translations update from Hosted Weblate in #650
  - Natural language fixes in #654
  - Initial Korean from Weblate in #655</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt; - 1.5.0" date="1774094400">- Update to 1.5.0
  * Highlights
  - Modernized C++/Qt build pipeline with clang-tidy and wider
    lint/test hardening.
  - Windows release pipeline reliability improvements for AppVeyor
    and Inno Setup packaging.
  - 1.5.0 release metadata and packaging preparation across the
    desktop app, installer, and CI configuration.
  * Fixes &amp; Improvements
  - Fixed profile handling issues in Qt6 compatibility scenarios
    and improved profile selection behavior #681, #695.
  - Preserved existing application behavior when launching qtpass
    without parameters #704.
  - Removed a regression where gpg_id comments could be altered #658.
  - Added missing include path fixes and small reliability
    hardening in core code paths #690, #716.
  * Release, CI and Maintenance
  - Added/updated PublicCode and CI workflows, including release-time
    validation and action upgrades #701, #709, #710, #711, #712.
  - Completed the AppVeyor/Inno Setup modernization and packaging
    updates #722.
  - Updated readme status badges and branch links to current
    workflow targets #724.
  * Localization
  - Synchronised a large set of translation updates through
    Weblate and translation automation.
- Add QtPass-desktop_version.patch to fix invalid-desktopfile.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt; - 1.5.1" date="1774180800">- Update to 1.5.1
  * Fixes
  - Crash on Wayland when screenAt() returns null (#706, #663)
  - CLI arguments being parsed as password search (#652)
  - OTP error handling with better messages (#677)
  - Window icon not showing on dialog boxes (#671)
  - Slovak translation GPG keygen script (#667)
  - Suppress qApp deprecation warnings on Qt6
- Rebase QtPass-desktop_version.patch</changelog>
  <changelog author="ecsos@opensuse.org" date="1776168000">- Update to version 1.6.0:
  * chore: bump version to 1.6.0 and update CHANGELOG
  * test: address review findings for util tests (#985)
  * test: fix executor and util review findings (#984)
  * test: strengthen test assertions per review (#983)
  * test: add executor edge case tests (#982)
  * test: add filecontent edge case tests (#981)
  * test: add more coverage tests (#980)
  * Localization update
  * test: add gpgkeystate coverage tests (#979)
  * test: add UserInfo created/expiry coverage (#978)
- Drop QtPass-desktop_version.patch because it's no longer needed.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1776859200">- Update to version 1.7.0:
  * fix: exclude ui_*.h generated files from Doxygen (#1132)
  * Release v1.7.0 (#1093)
  * tests: use modern QSignalSpy syntax in UI tests (#1131)
  * Fix: QProgressIndicator memory leak and dark mode support (#1129)
  * fix: correct QProgressIndicator license and copyright (#1128)
  * chore: Cleanup
  * fix: add PASS_INSERT to queue before transactionStart/End sequence (#1127)
  * fix: rename transactionStartEnd and differentiate transactionAdd test (#1124)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1123)
  * fix: add assertion to transactionAdd test and remove empty cleanupTestCase (#1122)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1120)
  * fix: translation spelling corrections (#1119)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1118)
  * Translations update from Hosted Weblate (#1116)
  * Fix: formal/informal address in Dutch translations (#1117)
  * Fix: formal/informal address in Dutch translations (#1115)
  * Translations update from Hosted Weblate (#1114)
  * Hernummering localization
  * feat: add integration tests for edge cases (#1112)
  * Translations update from Hosted Weblate (#1113)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1110)
  * fix: rename CHI_SQUARE_CRITICAL_VALUE_DF9 to CHI_SQUARE_PERMISSIVE_THRESHOLD_DF9 (#1111)
  * fix: add named constants and better test messages in tst_util.cpp (#1109)
  * fix: address additional CodeRabbit findings in tst_util.cpp (#1108)
  * docs: More contributing updates (#1107)
  * fix: apply CodeRabbit auto-fixes to CONTRIBUTING.md (#1105)
  * fix: improve test naming and constants in tst_util.cpp (#1106)
  * docs: add commit signing requirement to CONTRIBUTING.md (#1104)
  * fix: address CoPilot test findings in tst_util.cpp (#1103)
  * fix: address CoPilot test findings in tst_util.cpp (#1102)
  * fix: use QString() for proper comparison in test assertions (#1101)
  * fix: address additional Coverity scan issues (#1100)
  * Apply suggested fix to CONTRIBUTING.md from Copilot Autofix (#1099)
  * fix: address Coverity scan issues
  * fix: distclean for clean localizations (#1094)
  * Apply suggested fix to CLAUDE.md from Copilot Autofix (#1095)
  * docs: improve CLAUDE.md and fix skill inaccuracies (#1091)
  * Translations update from Hosted Weblate (#1090)
  * Omnummeren localizatie
  * docs: update skill files with Doxygen enforcement and Qt 5.15 compat patterns (#1088)
  * docs: Added CLAUDE.md (#1089)
  * docs: standardise Doxygen style across headers and main.cpp (#1087)
  * Omnummeren localizatie
  * refactor: rename single-letter parameters in setLength and setPasswordCharTemplate (#1086)
  * fix: guard against out-of-bounds index in password character set selection (#1084)
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * fix: use std::as_const on m_fields range-for to prevent implicit detachment
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to src/passworddialog.cpp from Copilot Autofix
  * Apply suggested fix to src/passworddialog.cpp from Copilot Autofix
  * Apply suggested fix to src/passworddialog.cpp from Copilot Autofix
  * docs: remove stale @todo comments
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Translated using Weblate (Czech)
  * Translated using Weblate (German (Luxembourg))
  * Translated using Weblate (Albanian)
  * Translated using Weblate (Albanian)
  * Translated using Weblate (Arabic (Morocco))
  * Translated using Weblate (Afrikaans)
  * Translated using Weblate (Czech)
  * Translated using Weblate (German (Luxembourg))
  * Translated using Weblate (Spanish (Ecuador))
  * Translated using Weblate (Luxembourgish)
  * Translated using Weblate (Czech)
  * Translated using Weblate (Spanish (Argentina))
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Portuguese (Brazil))
  * Translated using Weblate (English (United Kingdom))
  * fix: apply CodeRabbit auto-fixes
  * style: clang-format
  * Apply suggested fix to src/storemodel.cpp from Copilot Autofix
  * Apply suggested fix to src/src.pro from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_uk_UA.ts from Copilot Autofix
  * Friesyske taal tafoege, Fryslân Boppe!
  * Translated using Weblate (Turkish)
  * Translated using Weblate (Frisian (fy_NL))
  * Translated using Weblate (Frisian (fy_NL))
  * Translated using Weblate (Polish)
  * Added translation using Weblate (Frisian (fy_NL))
  * Translated using Weblate (Dutch (Belgium))
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Ukrainian)
  * Translated using Weblate (German)
  * style: clang-format
  * fix: apply CodeRabbit auto-fixes
  * refactor: evaluate key.endsWith('=') once in setEnvVar, use Q_ASSERT_X
  * fix: move length == 0 guard to top of generatePassword
  * refactor: extract fallbackCharset helper, use trailing return type style
  * fix: add missing QDebug include for qWarning() in setEnvVar
  * fix: address AI findings in pass.cpp and storemodel.cpp
  * All the updates
  * fix: move isGrepHeaderLine into anonymous namespace, drop redundant isEmpty check
  * fix: rename max_mod_bound to rejectionThreshold (camelCase convention)
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/storemodel.cpp from Copilot Autofix
  * Apply suggested fix to src/storemodel.cpp from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Translated using Weblate (Turkish)
  * fix: validate ItemKind on deserialization, exhaustive switch in executeDropAction
  * fix: update storemodel.cpp to use ItemKind enum and const QString&amp; param
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_sv_SE.ts from Copilot Autofix
  * Apply suggested fix to src/storemodel.h from Copilot Autofix
  * Apply suggested fix to src/storemodel.h from Copilot Autofix
  * fix: restore key expired fallback, revert findGpgconfInGpgDir arg, add &lt;algorithm&gt;
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Apply suggested fix to src/storemodel.h from Copilot Autofix
  * Apply suggested fix to src/pass.cpp from Copilot Autofix
  * Translated using Weblate (Swedish)
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Luxembourgish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Serbian (Cyrillic script))
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Chinese (Simplified Han script))
  * Translated using Weblate (Arabic (Morocco))
  * Add more integration tests and fix CI GPG/Git issues
  * Translated using Weblate (Arabic (Morocco))
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Hungarian)
  * Fix gpgconf discovery, restore signing key, and clear insertErrorSpy
  * Fix platform-specific pinentry and RealPass error diagnostics
  * chore: ignore integration test binary
  * CI: Use correct pass-otp package names per OS (pass-extension-otp on Linux, pass-otp on macOS)
  * CI: Fix pass-otp package name for macOS
  * CI: Install pass-otp on Linux and macOS
  * CI: Install pass on Linux and macOS
  * Fix integration tests: clear passSigningKey, use gpgInsertErrorMsg for RealPass
  * Fix integration test code quality findings and CI dependencies
  * fix: CI GPG trust, full-write verification, and Insert error diagnostics
  * fix: fail fast with diagnostics if gpg-agent setup fails in initTestCase
  * fix: pre-start gpg-agent and configure loopback pinentry for CI
  * feat: add integration tests for ImitatePass and RealPass backends
  * Regenerate localization files with qmake6
  * Additional fixes for refactored methods
  * Refine complex method fixes
  * Refactor complex methods to reduce cyclomatic complexity
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Sinhala)
  * Fix code quality findings
  * Use beginFilterChange/endFilterChange for Qt 6.10+
  * Translated using Weblate (Portuguese (Brazil))
  * Clean up localization files after qmake6 regeneration
  * fix: add missing Turkish translations and correct German typos
  * Add QVERIFY checks for file operations in settings tests
  * fix: avoid deprecated invalidateFilter on Qt 6.5+
  * fix: add null/empty/stream-status guards in drag-and-drop decode
  * fix: suppress invalidateFilter deprecation warning instead of version guards
  * fix: correct version guard for beginFilterChange to Qt 6.9
  * fix: use only beginFilterChange() — endFilterChange() does not exist
  * fix: match showThis declaration to definition, fix missed rename in setter
  * Translated using Weblate (German)
  * Translated using Weblate (German)
  * Translated using Weblate (Welsh)
  * fix: pass QModelIndex by const ref, reorder MIME check, fix typo
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Apply suggested fix to localization/localization_tr_TR.ts from Copilot Autofix
  * Translations update from Hosted Weblate (#1044)
  * fix: use beginFilterChange/endFilterChange on Qt 6.9+
  * Translations update from Hosted Weblate (#1043)
  * chore: Update locale files with new words  (#1041)
  * feat: implement pass grep content search (#109) (#1037)
  * feat: add Spanish regional variants (#1040)
  * Translations update from Hosted Weblate (#1039)
  * fix: avoid deprecated invalidateFilter on Qt 6.5+ (#1038)
  * fix: improve profile creation experience (#1036)
  * fix: show user-friendly error when GPG key is expired or invalid (#1035)
  * fix: clear stale selection and update proxy filter on profile change (#1033)
  * Renumbered localez
  * Translations update from Hosted Weblate (#1031)
  * fix: set PASSWORD_STORE_* env vars and grey out pass-managed controls (#1032)
  * CodeRabbit Generated Unit Tests: Add unit tests for PR changes (#1030)
  * Translations update from Hosted Weblate (#1029)
  * fix: resolve clangd performance and correctness findings (#1028)
  * fix: clarify conflicted file paths in merge instructions (#1027)
  * fix: avoid wildcard in merge conflict resolution (#1024)
  * Potential fixes for 2 code quality findings (#1023)
  * chore: update localization skill (#1022)
  * chore: add Claude Code skills adapted from .opencode/skills (#1021)
  * fix: ta_IN translation corrections (#1020)
  * Translations update from Hosted Weblate (#1018)
  * fix: ro_RO localization corrections (#1019)
  * chore: More localization updates with Qwen (#1016)
  * fix: grammar corrections in localization files (#1017)
  * Translations update from Hosted Weblate (#1015)
  * Helpful qwen2.5
  * pt_BR
  * style: Updated code formatting and indentation for consistency in project configuration files (#1013)
  * Fixed Sinhala, Sri Lanka file name
  * Merge pull request #1012 from IJHack/localization-updates-with-qwen
  * Tamil
  * Moved Tamil
  * naming and Chinese
  * Translated using Weblate (Estonian)
  * Translated using Weblate (Estonian)
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Spanish)
  * Translated using Weblate (Luxembourgish)
  * Translated using Weblate (Chinese (Simplified Han script))
  * Translated using Weblate (Dutch (Belgium))
  * Translated using Weblate (Galician)
  * Translated using Weblate (Danish)
  * Translated using Weblate (Slovenian)
  * Translated using Weblate (Polish)
  * Translated using Weblate (Swedish)
  * Translated using Weblate (Afrikaans)
  * Translated using Weblate (Welsh)
  * Translated using Weblate (Hungarian)
  * Translated using Weblate (Albanian)
  * Translated using Weblate (Ukrainian)
  * Translated using Weblate (German)
  * Translated using Weblate (English (United Kingdom))
  * Translated using Weblate (Croatian)
  * test: improve randomness and distribution tests
  * New translations
  * feat: add re-encrypt context menu for directories (#1009)
  * Update .github/workflows/docs.yml
  * fix: add error handling for Doxyfile version update in docs workflow
  * fix: use raw VERSION in sed replacement
  * fix: improve version escaping and validation in release-mac.sh
  * Update scripts/release-mac.sh
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * fix: improve shell script error handling and safety
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Apply suggested fix to scripts/generate-doxygen-pdf.sh from Copilot Autofix
  * Twijfelachtige fix
  * refactor: remove unnecessary charset variables in generateRandomPassword tests
  * fix: use correct doxygen download URL
  * shfmt and recover backup in the end
  * Minder enter
  * Update scripts/generate-doxygen-pdf.sh
  * chmod +x and newline
  * fix: apply CodeRabbit auto-fixes
  * refactor: rename ambiguous variable names in util tests
  * Update scripts/generate-doxygen-pdf.sh
  * Apply suggested fix to scripts/generate-doxygen-pdf.sh from Copilot Autofix
  * Update .github/workflows/docs.yml
  * chore: install Doxygen 1.16.1 from official release in CI
  * Locale fix
  * Locale and version update
  * fix: use USE_PDFLATEX in PDF script and derive output dir from PDF_FILE
  * fix: use portable sed with temp file for cross-platform compatibility
  * fix: handle latex output directories in PDF script
  * fix: use portable sed syntax for macOS/BSD compatibility
  * fix: set doxygen version directly in Doxyfile
  * fix: use scoped rollback for gpg executable in configIsValid test
  * test: add charset validation and configIsValid edge cases
  * perf: use static regex instances in isValidKeyId and findBinaryInPath
  * fix: properly strip angle brackets before 0x prefix
  * refactor: simplify isValidKeyId complexity using regex
  * fix: update util.h comment and tests per review findings
  * fix: update util.h comment and tests per review findings
  * fix: validate .gpg-id key IDs - accept emails and special formats
  * chore: verify macdeployqt and appdmg are available before using
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Apply suggested fix to scripts/release-mac.sh from Copilot Autofix
  * Update scripts/release-mac.sh
  * docs: remove Doxyfile from grep example
  * docs: update skill to exclude Doxyfile from manual updates
  * docs: fix release workflow order per review
  * fix: export QTPASS_VERSION in release-mac.sh before doxygen
  * fix: update MATHJAX_RELPATH to jsdelivr and make skill evergreen
  * fix: export QTPASS_VERSION for Doxygen
  * docs: fix release workflow per CodeAnt review
  * Microsocopic cleanup in spec file
  * docs: make releasing skill evergreen
  * docs: update releasing skill with learned patterns
  * chore: update version in Doxyfile to 1.6.0
  * fix: resolve lint issues in CHANGELOG</changelog>
</package>
<package pkgid="9f40ab91c5ea5948652957ed588aec37bba4b315a4e4ba0c4b8b6ac658067f8a94fcb62f02e75085a00aa166fe5bfbb3c93510c40fe803ff9dad7ffc9d4200b3" name="SecLists" arch="noarch">
  <version epoch="0" ver="2026.1" rel="11.3"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1624449600">- First import</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1624536000">- Removed Payloads/Zip-Bombs/*.gz and Payloads/Zip-Bombs/*.zip causing rpmlint
  to hang</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670241600">- update to 2022.4:
  * includes multiple updates from the community</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670328000">- fix last change</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670414400">- skip zipbombs as they break the testing and legal checks</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1740312000">- Update to 2025.1
  * This release includes multiple updates from the community.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1758196800">- Update to version 2025.2
  * Two new tools for creating and manipulating wordlists have
    been added to the main readme:
  * CeWL
  * WL
  * Two 10 Million+ wordlists have been added for subdomain
    fuzzing/discovery.
  * Discovery/DNS/FUZZSUBS_CYFARE_1.txt
  * Discovery/DNS/FUZZSUBS_CYFARE_2.txt
  * All words wordlists have been moved into the directory
    Miscellaneous/Words/.
  * And many other miscellaneous fixes and improvements.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1758283200">- Update to version 2025.3
  Important changes
  * Deprecated DirBuster wordlists
    The dirbuster wordlists were made in 2007, and are now
    considered obsolete. Instead, these wordlists are recommended
    for testing modern web environments:
    + Discovery/Web-Content/combined_words.txt
    + Discovery/Web-Content/combined_directories.txt
    The dirbuster wordlists will remain contained in SecLists, but
    they now have the DirBuster-2007 prefix to highlight their age.
  * Dangerous SQLi payloads
    The SQL Injection wordlists contained in Fuzzing/Databases/SQLi
    are not safe to use on production environments. Many of those
    wordlists contain potentially destructive queries which may
    permanently delete data on any databases they're used on. A
    warning has been added to the README.md for that directory.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1774785600">- Update to version 2026.1
  New wordlists
  * Created 2025 most used passwords wordlist.
  * Added AI ethical and safety boundary testing wordlists.
  * Updated top1million subdomains lists with cloudflare data.
  * Add wordlists for: Kubernetes, Docker, Elasticsearch, Grafana,
    GitLab, Prometheus.
  * Added OpenWRT discovery wordlist.
  * Added RSTP camera wordlist.
  * Added SOfensive LFI wordlist and removed redundant
    GracefulSecurity wordlist.
  * Added wordlist for Bluedit CMS.
  * Added locale-codes wordlist and language-codes wordlist.
  * Add common.txt in brazilian portuguese.
  * Add more hispanic names.
  * Added list of Brazilian names.
  * Added polish password wordlist.
  * Added Polish wordlist to Passwords/Common-Credentials/
    Language-Specific.
  Updates to existing wordlists
  * Added more API fuzzing endpoints.
  * Added more entries to "SAP-NetWeaver.txt".
  * Added more payloads to graphql wordlist.
  * Added more payloads to login_bypass.txt.
  * Added more payloads to Swagger.txt.
  * Updated list of Spring endpoints..
  * Updated list of years in 'quickhits.txt'.
- Set BuildArch to "noarch"</changelog>
</package>
<package pkgid="a6a319ca6cdf46c2470707de9b4e5228c9f9343cd2e8079093430581469d49bb4d9c0d4d73675cc5f85dd0bd09dafe73598a8367f5ea5668195c3566a1b80be5" name="SecLists" arch="src">
  <version epoch="0" ver="2026.1" rel="11.3"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1624449600">- First import</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1624536000">- Removed Payloads/Zip-Bombs/*.gz and Payloads/Zip-Bombs/*.zip causing rpmlint
  to hang</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670241600">- update to 2022.4:
  * includes multiple updates from the community</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670328000">- fix last change</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670414400">- skip zipbombs as they break the testing and legal checks</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1740312000">- Update to 2025.1
  * This release includes multiple updates from the community.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1758196800">- Update to version 2025.2
  * Two new tools for creating and manipulating wordlists have
    been added to the main readme:
  * CeWL
  * WL
  * Two 10 Million+ wordlists have been added for subdomain
    fuzzing/discovery.
  * Discovery/DNS/FUZZSUBS_CYFARE_1.txt
  * Discovery/DNS/FUZZSUBS_CYFARE_2.txt
  * All words wordlists have been moved into the directory
    Miscellaneous/Words/.
  * And many other miscellaneous fixes and improvements.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1758283200">- Update to version 2025.3
  Important changes
  * Deprecated DirBuster wordlists
    The dirbuster wordlists were made in 2007, and are now
    considered obsolete. Instead, these wordlists are recommended
    for testing modern web environments:
    + Discovery/Web-Content/combined_words.txt
    + Discovery/Web-Content/combined_directories.txt
    The dirbuster wordlists will remain contained in SecLists, but
    they now have the DirBuster-2007 prefix to highlight their age.
  * Dangerous SQLi payloads
    The SQL Injection wordlists contained in Fuzzing/Databases/SQLi
    are not safe to use on production environments. Many of those
    wordlists contain potentially destructive queries which may
    permanently delete data on any databases they're used on. A
    warning has been added to the README.md for that directory.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1774785600">- Update to version 2026.1
  New wordlists
  * Created 2025 most used passwords wordlist.
  * Added AI ethical and safety boundary testing wordlists.
  * Updated top1million subdomains lists with cloudflare data.
  * Add wordlists for: Kubernetes, Docker, Elasticsearch, Grafana,
    GitLab, Prometheus.
  * Added OpenWRT discovery wordlist.
  * Added RSTP camera wordlist.
  * Added SOfensive LFI wordlist and removed redundant
    GracefulSecurity wordlist.
  * Added wordlist for Bluedit CMS.
  * Added locale-codes wordlist and language-codes wordlist.
  * Add common.txt in brazilian portuguese.
  * Add more hispanic names.
  * Added list of Brazilian names.
  * Added polish password wordlist.
  * Added Polish wordlist to Passwords/Common-Credentials/
    Language-Specific.
  Updates to existing wordlists
  * Added more API fuzzing endpoints.
  * Added more entries to "SAP-NetWeaver.txt".
  * Added more payloads to graphql wordlist.
  * Added more payloads to login_bypass.txt.
  * Added more payloads to Swagger.txt.
  * Updated list of Spring endpoints..
  * Updated list of years in 'quickhits.txt'.
- Set BuildArch to "noarch"</changelog>
</package>
<package pkgid="929f73df057659b67121f71d788c2924de6214e862ac71ac36209d2dc68fda48fbc4f932af684d55f90ccfcc144748fddb106974f4119390816d1cb942cd7496" name="XSStrike" arch="noarch">
  <version epoch="0" ver="3.1.5" rel="6.14"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1625054400">- First import from upstream. XSStrike is a tool designed to discover XSS in
  web applications.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1625140800">- Create a link to xsstrike.py into /usr/bin (with removal support in
  uninstallation)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1715774400">- Use %autosetup macro: allows us to eliminate usage of deprecated
  %patchN syntax.</changelog>
</package>
<package pkgid="e125028b8861f5b4cfd7320b1488565d4e74ef57d955290463a9efca8690eaf769040625ec071fb94b3de75c26c5264a55aee4b4f5bd462ef35b1aa3a8657a74" name="XSStrike" arch="src">
  <version epoch="0" ver="3.1.5" rel="6.14"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1625054400">- First import from upstream. XSStrike is a tool designed to discover XSS in
  web applications.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1625140800">- Create a link to xsstrike.py into /usr/bin (with removal support in
  uninstallation)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1715774400">- Use %autosetup macro: allows us to eliminate usage of deprecated
  %patchN syntax.</changelog>
</package>
<package pkgid="b10af75a4e2d6e23312eb1428093252b4ddb1c3497ac4e33870e576ec6be6b01d264e372cc92375c5fb877feda33ffc0a78a1a7936168eec381b5250f78e6797" name="addrwatch" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="13.51"/>
  <changelog author="aloisio@gmx.com" date="1478606400">- Initial package (version 1.0)</changelog>
  <changelog author="aloisio@gmx.com" date="1478865600">- Added addrwatch-rpmlintrc as source</changelog>
  <changelog author="jengelh@inai.de" date="1486036800">- Compact description a bit</changelog>
  <changelog author="aloisio@gmx.com" date="1495022400">- Update to version 1.0.1
- Dropped addrwatch-1.0-no_return_in_nonvoid.patch (merged
  upstream)
- Fixed source URL</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564660800">- Added fix-db-reconnect-issue.patch: Addresses an compilation
  issue: https://github.com/fln/addrwatch/issues/11
- Enabled MySQL support
- Applied spec-cleaner
- Removed no longer needed rpmlintrc file</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564660801">- Split off addrwatch_mysql into subpackage (addrwatch-mysql).</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564660802">- Removed subpackage due to unneeded complexity.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564747200">- Using %autosetup macro.</changelog>
  <changelog author="Richard Brown &lt;rbrown@suse.com&gt;" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="Luigi Baldoni &lt;aloisio@gmx.com&gt;" date="1582545600">- Update to version 1.0.2
  * Add leading / to default shared-memory name
  * Add clang-tidy support, clean most of the linter warnings
  * Remove sys_siglist usage in favor of strsignal (#12)
  * Add clang-format format support, re-style code base
  * addrwatch: Add limits header for PATH_MAX
  * Mark db_reconnect as static inline, fixes GH-11
  * Add experimental meson build support
  * Add mysql migration script, update README.md
- Drop fix-db-reconnect-issue.patch (merged upstream)</changelog>
</package>
<package pkgid="60f748c0ce89def1bd55d38d7ab0bcfe7ef904f3db97d670a6721e60341c99ffe149a93814e641b0eeb1605ff1ae009f21051f17d2d1a5ea99f235b5e4a6450b" name="addrwatch" arch="src">
  <version epoch="0" ver="1.0.2" rel="13.51"/>
  <changelog author="aloisio@gmx.com" date="1478606400">- Initial package (version 1.0)</changelog>
  <changelog author="aloisio@gmx.com" date="1478865600">- Added addrwatch-rpmlintrc as source</changelog>
  <changelog author="jengelh@inai.de" date="1486036800">- Compact description a bit</changelog>
  <changelog author="aloisio@gmx.com" date="1495022400">- Update to version 1.0.1
- Dropped addrwatch-1.0-no_return_in_nonvoid.patch (merged
  upstream)
- Fixed source URL</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564660800">- Added fix-db-reconnect-issue.patch: Addresses an compilation
  issue: https://github.com/fln/addrwatch/issues/11
- Enabled MySQL support
- Applied spec-cleaner
- Removed no longer needed rpmlintrc file</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564660801">- Split off addrwatch_mysql into subpackage (addrwatch-mysql).</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564660802">- Removed subpackage due to unneeded complexity.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564747200">- Using %autosetup macro.</changelog>
  <changelog author="Richard Brown &lt;rbrown@suse.com&gt;" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="Luigi Baldoni &lt;aloisio@gmx.com&gt;" date="1582545600">- Update to version 1.0.2
  * Add leading / to default shared-memory name
  * Add clang-tidy support, clean most of the linter warnings
  * Remove sys_siglist usage in favor of strsignal (#12)
  * Add clang-format format support, re-style code base
  * addrwatch: Add limits header for PATH_MAX
  * Mark db_reconnect as static inline, fixes GH-11
  * Add experimental meson build support
  * Add mysql migration script, update README.md
- Drop fix-db-reconnect-issue.patch (merged upstream)</changelog>
</package>
<package pkgid="62ec9ed28f8a50d8136a2c328bd5487fa9d4cb54cf6bc59a9ee9718f531251f939573d995faff2354d20b75bf07b0c2bff272ee1769f0dac9be5d4b2b521e97f" name="addrwatch-debuginfo" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="13.51"/>
  <changelog author="aloisio@gmx.com" date="1478606400">- Initial package (version 1.0)</changelog>
  <changelog author="aloisio@gmx.com" date="1478865600">- Added addrwatch-rpmlintrc as source</changelog>
  <changelog author="jengelh@inai.de" date="1486036800">- Compact description a bit</changelog>
  <changelog author="aloisio@gmx.com" date="1495022400">- Update to version 1.0.1
- Dropped addrwatch-1.0-no_return_in_nonvoid.patch (merged
  upstream)
- Fixed source URL</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564660800">- Added fix-db-reconnect-issue.patch: Addresses an compilation
  issue: https://github.com/fln/addrwatch/issues/11
- Enabled MySQL support
- Applied spec-cleaner
- Removed no longer needed rpmlintrc file</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564660801">- Split off addrwatch_mysql into subpackage (addrwatch-mysql).</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564660802">- Removed subpackage due to unneeded complexity.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564747200">- Using %autosetup macro.</changelog>
  <changelog author="Richard Brown &lt;rbrown@suse.com&gt;" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="Luigi Baldoni &lt;aloisio@gmx.com&gt;" date="1582545600">- Update to version 1.0.2
  * Add leading / to default shared-memory name
  * Add clang-tidy support, clean most of the linter warnings
  * Remove sys_siglist usage in favor of strsignal (#12)
  * Add clang-format format support, re-style code base
  * addrwatch: Add limits header for PATH_MAX
  * Mark db_reconnect as static inline, fixes GH-11
  * Add experimental meson build support
  * Add mysql migration script, update README.md
- Drop fix-db-reconnect-issue.patch (merged upstream)</changelog>
</package>
<package pkgid="41fd8ff55808c005a23ef35d8d3fd8df43662f7945cffb00f655fd004b37e07a1c1abe594cf9d494ca363e70554e1289366bad3b87718d2d77f8fad697efdda6" name="addrwatch-debugsource" arch="s390x">
  <version epoch="0" ver="1.0.2" rel="13.51"/>
  <changelog author="aloisio@gmx.com" date="1478606400">- Initial package (version 1.0)</changelog>
  <changelog author="aloisio@gmx.com" date="1478865600">- Added addrwatch-rpmlintrc as source</changelog>
  <changelog author="jengelh@inai.de" date="1486036800">- Compact description a bit</changelog>
  <changelog author="aloisio@gmx.com" date="1495022400">- Update to version 1.0.1
- Dropped addrwatch-1.0-no_return_in_nonvoid.patch (merged
  upstream)
- Fixed source URL</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564660800">- Added fix-db-reconnect-issue.patch: Addresses an compilation
  issue: https://github.com/fln/addrwatch/issues/11
- Enabled MySQL support
- Applied spec-cleaner
- Removed no longer needed rpmlintrc file</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564660801">- Split off addrwatch_mysql into subpackage (addrwatch-mysql).</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564660802">- Removed subpackage due to unneeded complexity.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1564747200">- Using %autosetup macro.</changelog>
  <changelog author="Richard Brown &lt;rbrown@suse.com&gt;" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="Luigi Baldoni &lt;aloisio@gmx.com&gt;" date="1582545600">- Update to version 1.0.2
  * Add leading / to default shared-memory name
  * Add clang-tidy support, clean most of the linter warnings
  * Remove sys_siglist usage in favor of strsignal (#12)
  * Add clang-format format support, re-style code base
  * addrwatch: Add limits header for PATH_MAX
  * Mark db_reconnect as static inline, fixes GH-11
  * Add experimental meson build support
  * Add mysql migration script, update README.md
- Drop fix-db-reconnect-issue.patch (merged upstream)</changelog>
</package>
<package pkgid="279c17e002649da3fe7c3124ee09305028ba4e7458c56c313877b46281bb690409e2a4fda6d1ed3d5fadcf4df21b492bff646fe0268a29b99cdf8c3920a23403" name="aide" arch="s390x">
  <version epoch="0" ver="0.19.2" rel="92.6"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1677153600">- Update to 0.18
- Rename aide-0.17.3-as-needed.patch to and rebase aide-0.18-as-needed.patch
- Added autoconf and autoconf-archive as building dependencies due to an error
  when reconfiguring the source
- Rebase aide-xattr-in-libc.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1679054400">- update to 0.18.1:
  * Fix handling of empty growing files
  * Fix segfault when using --dry-init
  * Update README
- switch to pcre2</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1685966400">- Update to 0.18.3:
  * Handle readlink() errors
- Update to 0.18.2:
  * Add warning if rules contain not compiled-in attributes
  * Add missing lock for tree operations during file system scan</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1685966401">- switched service macros from %systemd_* to %service_*
  according to documentation at https://en.opensuse.org/openSUSE:Systemd_packaging_guidelines#Registering_unit_files_in_install_scripts</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688126400">- Update to 0.18.4:
  * Fix handling of extended attributes on symlinks
  * Add missing ')' to log message
  * Fix static linking of the aide binary
  * Don't require database_out for --dry-init
  * Remove strerror() calls from thread log messages</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 0.18.5:
  * Fix child directory processing on equal match</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1691064000">- Update to 0.18.6:
  * Fix double free() during report generation
  * Improve handling of ACL errors</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1723377600">-  Update to 0.18.8:
  * Fix concurrent reading of extended attributes (xattrs)
  * Raise warning if both input databases are the same
-  Update to 0.18.7:
  * Add missing library CFLAGS
  * Fix typo in aide.conf manual page
  * Fix 64-bit time_t on 32-bit architectures
  * Fix debug logging for returned attributes
  * Fix condition for error message of failing to open gzipped files
- rebased aide-0.18-as-needed.patch</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1746705600">- Update to 0.19.0:
  * Fix build with additional libraries on non-Linux systems
  * Update NEWS file and aide.conf.5 man page
  * Move log message to limit log level
- Rebased aide-0.18-as-needed.patch, aide-systemd.patch,
  aide-xattr-in-libc.patch
- Moved signature to Source100, use pkgconf in BuildRequirements
  when available</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1755604800">- Update to 0.19.2 (2025-08-13):
  * Security bug fixes
  - CVE-2025-54389: Escape control characters in report and log
    output (bsc#1247884)
  - CVE-2025-54409: Fix null pointer dereference after reading
    incorrectly encoded xattr attributes from database (bsc#1247885)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1768996800">- generate the /var/lib/aide directory via tmpfiles (jsc#PED-14791)</changelog>
</package>
<package pkgid="0a23d70f699780c58a6807907c405af11ca9f0aa570cf3167cbd732006c04ae06ca87ca7bc3180e4f688f13f98e872849187c71c819dc9a583c928e09572f5b1" name="aide" arch="src">
  <version epoch="0" ver="0.19.2" rel="92.6"/>
  <changelog author="Matthias Eliasson &lt;elimat@opensuse.org&gt;" date="1552824000">- Update to 0.16.1
  * Move to GitHub
  * Update documentation
  * Bug fixes
- Upstream have moved to GitHub update URL and Source URLs accordingly
- Refresh patch: aide-xattr-in-libc.patch
- aide-0.16.1-as-needed.patch: replaces aide-0.16-as-needed.patch
- Some cleanup of spec with spec-cleaner</changelog>
  <changelog author="&lt;abergmann@suse.com&gt;" date="1562846400">- Remove not available gcrypt algorithm 7 DB_HAVAL (bsc#1098360).
  Add aide-define_hash_use_gcrypt.patch</changelog>
  <changelog author="Matthias Eliasson &lt;elimat@opensuse.org&gt;" date="1596110400">- Update to 0.16.2
  Bug fixes:
  * Fix handling of directory-restricted negative rules
  * Don't lock '/dev/null' when used as output database
  * Fix parsing of rules containing '?' quantifier
  * Fix extended attributes support (xattrs)
  * Fix processing of go files
  Please note:
  * The addition of the "trusted.*", "user.*" and the "security.*"
  namespaces to the xattrs attribute might lead to a vast amount of
  reported changed entries during your next AIDE run. You can use the
  `report_ignore_changed_attrs` option (see aide.conf(5)) to ignore
  changes of the xattrs attribute; but be aware that this will exclude
  the expected but also the unexpected (potentially malicious) changes.
- Run spec-cleaner</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1614168000">- Update to 0.17.3:
  * BACKWARDS INCOMPATIBLE CHANGES
  - '--verbose' command line option and 'verbose' config option are no
    longer supported, use 'log_level' and 'report_level' options instead
  - '--report' command line option is no longer supported, use
    'report_url' config option instead
  - 'ignore_list' config option is no longer supported, use
    'report_ignore_changed_attrs' instead
  - 'report_attributes' config option is no longer supported, use
    'report_force_attrs' instead
  - (restricted) regular rules must start with literal '/', i.e. the rule
    cannot begin with a macro variable
  - config lines must end with new line
  - '@' and ' ' in the configuration are now escaped with '\', that means
    to match a '\' you have to use four backslashes '\\\\' in your rules
  - 'gzip_dbout=false' fails now with config error when no zlib support
    is compiled in
  - remove '--with-initial-errors' configure option
  - remove PostgreSQL database backend support
  - remove Sun ACL support
  - remove config and database signing support
  * Enhancements:
  - add new '--log-level' command line option and 'log_level' config option
  - introduce named log levels
  - add new 'report' log level to help to debug rule matching
  - add new 'config' log level to help to debug config and rule parsing
  - aad new '--dry-init' command
  - add new '--path-check' command
  - add directory support for @@include
  - add new @@x_include config macro
  - add new @@x_include_setenv config macro
  - add new default compound group 'H' (all compiled-in hashsums)
  - add support for per-report_url options
  - add new 'report_level' config option
  - add new 'report_append' config option
  - add exit code 21 for file lock errors
  - add default config values, available hashsums and compound groups
    to '--version' output
  - add Linux capabilities support
  - show changed attributes in 'different attributes' message
  - enable 'gost' and 'whirlpool' checksums when using gcrypt
  - add 'stribog256' and 'stribog512' gcrypt algorithms
  - add config file names to log output
  * Miscellaneous behaviour changes:
  - 'report_summarize_changes': hashsum changes are now indicated with 'H'
  - print '--help' and '--verion' output to stdout
  - log messages and errors are always written to stderr
  - initialise report URLs after configuration parsing
  - allow empty values for macro variables
  - SIGUSR1 now toggles debug log level
  - fail on errors in regular expressions during config parsing
  - fail on invalid URLs during config check
  - Fail on double slash in rule path
  - cache log lines when 'log_level' is not yet set
  * Deprecations:
  - 'database' config option is now deprecated, use 'database_in' instead
  - 'summarize_changes' config option is now deprecated, use
    'report_summarize_changes' instead
  - 'grouped' config option is now deprecated, use 'report_grouped'
    instead
  - non-alphanumeric group names are deprecated
  * Notable bug fixes:
  - fix line numbers in log messages
  - remove warning when input database is '/dev/null'
  - correctly handle UTF-8 in path names and rules
  - fix compilation with curl and gcrypt
  - warn on unsupported hash algorithms
  - improve large-file support
  * Remove obsolete aide-attributes.sh script
  * Remove outdated manual.html
  * Update documentation
- Rename aide-0.16.1-as-needed.patch to and rebase aide-0.17.3-as-needed.patch
- Rebase aide-xattr-in-libc.patch
- Remove aide-define_hash_use_gcrypt.patch (no longer needed)
- Remove aide-dynamic.patch (no longer needed)</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1614168001">- Update default config file to match v0.17</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1617364800">- added missing pcre-devel buildrequires.</changelog>
  <changelog author="Stefan Schubert &lt;schubi@suse.de&gt;" date="1636027200">- Added aide.service and aide.timer in order to run
  aide periodically in the background via systemd timer.
- aide-systemd.patch: hook in new manpages</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1648555200">- Update to 0.17.4:
  * fix CVE-2021-45417: precalculate buffer size in base64 functions (bsc#1194735)</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1677153600">- Update to 0.18
- Rename aide-0.17.3-as-needed.patch to and rebase aide-0.18-as-needed.patch
- Added autoconf and autoconf-archive as building dependencies due to an error
  when reconfiguring the source
- Rebase aide-xattr-in-libc.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1679054400">- update to 0.18.1:
  * Fix handling of empty growing files
  * Fix segfault when using --dry-init
  * Update README
- switch to pcre2</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1685966400">- Update to 0.18.3:
  * Handle readlink() errors
- Update to 0.18.2:
  * Add warning if rules contain not compiled-in attributes
  * Add missing lock for tree operations during file system scan</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1685966401">- switched service macros from %systemd_* to %service_*
  according to documentation at https://en.opensuse.org/openSUSE:Systemd_packaging_guidelines#Registering_unit_files_in_install_scripts</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688126400">- Update to 0.18.4:
  * Fix handling of extended attributes on symlinks
  * Add missing ')' to log message
  * Fix static linking of the aide binary
  * Don't require database_out for --dry-init
  * Remove strerror() calls from thread log messages</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 0.18.5:
  * Fix child directory processing on equal match</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1691064000">- Update to 0.18.6:
  * Fix double free() during report generation
  * Improve handling of ACL errors</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1723377600">-  Update to 0.18.8:
  * Fix concurrent reading of extended attributes (xattrs)
  * Raise warning if both input databases are the same
-  Update to 0.18.7:
  * Add missing library CFLAGS
  * Fix typo in aide.conf manual page
  * Fix 64-bit time_t on 32-bit architectures
  * Fix debug logging for returned attributes
  * Fix condition for error message of failing to open gzipped files
- rebased aide-0.18-as-needed.patch</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1746705600">- Update to 0.19.0:
  * Fix build with additional libraries on non-Linux systems
  * Update NEWS file and aide.conf.5 man page
  * Move log message to limit log level
- Rebased aide-0.18-as-needed.patch, aide-systemd.patch,
  aide-xattr-in-libc.patch
- Moved signature to Source100, use pkgconf in BuildRequirements
  when available</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1755604800">- Update to 0.19.2 (2025-08-13):
  * Security bug fixes
  - CVE-2025-54389: Escape control characters in report and log
    output (bsc#1247884)
  - CVE-2025-54409: Fix null pointer dereference after reading
    incorrectly encoded xattr attributes from database (bsc#1247885)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1768996800">- generate the /var/lib/aide directory via tmpfiles (jsc#PED-14791)</changelog>
</package>
<package pkgid="9eb793cfd787cbad1cc1d957179ee89a8dcaa0f33654cb411aee2a8438db93a366a3b41cb0156af098f8838f7c0640d9f1ac2fb027b19768de9789e79c099bc7" name="aide-debuginfo" arch="s390x">
  <version epoch="0" ver="0.19.2" rel="92.6"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1677153600">- Update to 0.18
- Rename aide-0.17.3-as-needed.patch to and rebase aide-0.18-as-needed.patch
- Added autoconf and autoconf-archive as building dependencies due to an error
  when reconfiguring the source
- Rebase aide-xattr-in-libc.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1679054400">- update to 0.18.1:
  * Fix handling of empty growing files
  * Fix segfault when using --dry-init
  * Update README
- switch to pcre2</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1685966400">- Update to 0.18.3:
  * Handle readlink() errors
- Update to 0.18.2:
  * Add warning if rules contain not compiled-in attributes
  * Add missing lock for tree operations during file system scan</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1685966401">- switched service macros from %systemd_* to %service_*
  according to documentation at https://en.opensuse.org/openSUSE:Systemd_packaging_guidelines#Registering_unit_files_in_install_scripts</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688126400">- Update to 0.18.4:
  * Fix handling of extended attributes on symlinks
  * Add missing ')' to log message
  * Fix static linking of the aide binary
  * Don't require database_out for --dry-init
  * Remove strerror() calls from thread log messages</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 0.18.5:
  * Fix child directory processing on equal match</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1691064000">- Update to 0.18.6:
  * Fix double free() during report generation
  * Improve handling of ACL errors</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1723377600">-  Update to 0.18.8:
  * Fix concurrent reading of extended attributes (xattrs)
  * Raise warning if both input databases are the same
-  Update to 0.18.7:
  * Add missing library CFLAGS
  * Fix typo in aide.conf manual page
  * Fix 64-bit time_t on 32-bit architectures
  * Fix debug logging for returned attributes
  * Fix condition for error message of failing to open gzipped files
- rebased aide-0.18-as-needed.patch</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1746705600">- Update to 0.19.0:
  * Fix build with additional libraries on non-Linux systems
  * Update NEWS file and aide.conf.5 man page
  * Move log message to limit log level
- Rebased aide-0.18-as-needed.patch, aide-systemd.patch,
  aide-xattr-in-libc.patch
- Moved signature to Source100, use pkgconf in BuildRequirements
  when available</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1755604800">- Update to 0.19.2 (2025-08-13):
  * Security bug fixes
  - CVE-2025-54389: Escape control characters in report and log
    output (bsc#1247884)
  - CVE-2025-54409: Fix null pointer dereference after reading
    incorrectly encoded xattr attributes from database (bsc#1247885)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1768996800">- generate the /var/lib/aide directory via tmpfiles (jsc#PED-14791)</changelog>
</package>
<package pkgid="f322c09b48cfc45cd505864a06a70d3c4974d3abfde55afa85b2aa1125d0310b41033f6baf35b303628eba71494cb32b569e086a65383ef1dc394866ead2a5ac" name="aide-debugsource" arch="s390x">
  <version epoch="0" ver="0.19.2" rel="92.6"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1677153600">- Update to 0.18
- Rename aide-0.17.3-as-needed.patch to and rebase aide-0.18-as-needed.patch
- Added autoconf and autoconf-archive as building dependencies due to an error
  when reconfiguring the source
- Rebase aide-xattr-in-libc.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1679054400">- update to 0.18.1:
  * Fix handling of empty growing files
  * Fix segfault when using --dry-init
  * Update README
- switch to pcre2</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1685966400">- Update to 0.18.3:
  * Handle readlink() errors
- Update to 0.18.2:
  * Add warning if rules contain not compiled-in attributes
  * Add missing lock for tree operations during file system scan</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1685966401">- switched service macros from %systemd_* to %service_*
  according to documentation at https://en.opensuse.org/openSUSE:Systemd_packaging_guidelines#Registering_unit_files_in_install_scripts</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688126400">- Update to 0.18.4:
  * Fix handling of extended attributes on symlinks
  * Add missing ')' to log message
  * Fix static linking of the aide binary
  * Don't require database_out for --dry-init
  * Remove strerror() calls from thread log messages</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 0.18.5:
  * Fix child directory processing on equal match</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1691064000">- Update to 0.18.6:
  * Fix double free() during report generation
  * Improve handling of ACL errors</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1723377600">-  Update to 0.18.8:
  * Fix concurrent reading of extended attributes (xattrs)
  * Raise warning if both input databases are the same
-  Update to 0.18.7:
  * Add missing library CFLAGS
  * Fix typo in aide.conf manual page
  * Fix 64-bit time_t on 32-bit architectures
  * Fix debug logging for returned attributes
  * Fix condition for error message of failing to open gzipped files
- rebased aide-0.18-as-needed.patch</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1746705600">- Update to 0.19.0:
  * Fix build with additional libraries on non-Linux systems
  * Update NEWS file and aide.conf.5 man page
  * Move log message to limit log level
- Rebased aide-0.18-as-needed.patch, aide-systemd.patch,
  aide-xattr-in-libc.patch
- Moved signature to Source100, use pkgconf in BuildRequirements
  when available</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1755604800">- Update to 0.19.2 (2025-08-13):
  * Security bug fixes
  - CVE-2025-54389: Escape control characters in report and log
    output (bsc#1247884)
  - CVE-2025-54409: Fix null pointer dereference after reading
    incorrectly encoded xattr attributes from database (bsc#1247885)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1768996800">- generate the /var/lib/aide directory via tmpfiles (jsc#PED-14791)</changelog>
</package>
<package pkgid="35d468032696cb8843a3742e2162be9b81d1209152993aed0402cafa75cb13912b99867725267cb2f11886cdba82c380bf68d6bf3e625c114ed7040d8ce604ae" name="aide-test" arch="noarch">
  <version epoch="0" ver="0.19.2" rel="92.6"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1677153600">- Update to 0.18
- Rename aide-0.17.3-as-needed.patch to and rebase aide-0.18-as-needed.patch
- Added autoconf and autoconf-archive as building dependencies due to an error
  when reconfiguring the source
- Rebase aide-xattr-in-libc.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1679054400">- update to 0.18.1:
  * Fix handling of empty growing files
  * Fix segfault when using --dry-init
  * Update README
- switch to pcre2</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1685966400">- Update to 0.18.3:
  * Handle readlink() errors
- Update to 0.18.2:
  * Add warning if rules contain not compiled-in attributes
  * Add missing lock for tree operations during file system scan</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1685966401">- switched service macros from %systemd_* to %service_*
  according to documentation at https://en.opensuse.org/openSUSE:Systemd_packaging_guidelines#Registering_unit_files_in_install_scripts</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688126400">- Update to 0.18.4:
  * Fix handling of extended attributes on symlinks
  * Add missing ')' to log message
  * Fix static linking of the aide binary
  * Don't require database_out for --dry-init
  * Remove strerror() calls from thread log messages</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 0.18.5:
  * Fix child directory processing on equal match</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1691064000">- Update to 0.18.6:
  * Fix double free() during report generation
  * Improve handling of ACL errors</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1723377600">-  Update to 0.18.8:
  * Fix concurrent reading of extended attributes (xattrs)
  * Raise warning if both input databases are the same
-  Update to 0.18.7:
  * Add missing library CFLAGS
  * Fix typo in aide.conf manual page
  * Fix 64-bit time_t on 32-bit architectures
  * Fix debug logging for returned attributes
  * Fix condition for error message of failing to open gzipped files
- rebased aide-0.18-as-needed.patch</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1746705600">- Update to 0.19.0:
  * Fix build with additional libraries on non-Linux systems
  * Update NEWS file and aide.conf.5 man page
  * Move log message to limit log level
- Rebased aide-0.18-as-needed.patch, aide-systemd.patch,
  aide-xattr-in-libc.patch
- Moved signature to Source100, use pkgconf in BuildRequirements
  when available</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1755604800">- Update to 0.19.2 (2025-08-13):
  * Security bug fixes
  - CVE-2025-54389: Escape control characters in report and log
    output (bsc#1247884)
  - CVE-2025-54409: Fix null pointer dereference after reading
    incorrectly encoded xattr attributes from database (bsc#1247885)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1768996800">- generate the /var/lib/aide directory via tmpfiles (jsc#PED-14791)</changelog>
</package>
<package pkgid="9b41312fd191798fe6e5f2310c805e3af31a37ded8bf8e4760de2cb9e23673e03cd8e8a77361a8a0b91a459032b9fe242c6b8bda1032202f86d98fb273a236df" name="aircrack-ng" arch="s390x">
  <version epoch="0" ver="1.7" rel="22.16"/>
  <changelog author="atoptsoglou@suse.com" date="1547812800">- Fix conflict issue with graphviz: python files are now installed
  under air_graphviz, add conflict.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1585915200">- build with pcre for regex filtering of SSID
- with with hwloc to improve performance
- fix experimental feature conditional build
- fix SQLite conditional build</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1589025600">- Run spec-cleaner
- Force python3 for all tools written in python
- Use proper docdir
- Update patch:
  * conflict.patch
- Introduce devel subpackage
- Run testsuite
- Update to version 1.6:
  * Aircrack-ng: Fixed ARM processors display with -u
  * Aircrack-ng: Fixed AVX-512F support
  * Aircrack-ng: Fixed cracking speed calculation
  * Aircrack-ng: Fixed cracking WEP beyond 10k IVS
  * Aircrack-ng: Fixed creating new session and added test case
  * Aircrack-ng: Fixed encryption display in some cases when
    prompting for network to crack
  * Aircrack-ng: Fixed exiting Aircrack-ng in some cases
  * Aircrack-ng: Fixed logical and physical processor count
    detection
  * Aircrack-ng: Fixed PMKID length check
  * Aircrack-ng: Various fixes and improvements to WPA cracking
    engine and its performance
  * Airdecap-ng: Decrypt both directions when WDS is in use
  * Airdecap-ng: Fixed decrypting WPA PCAP when BSSID changes
  * Airgraph-ng: Added support for WPA3
  * Airgraph-ng: Switch to argparse
  * Airmon-ng: Added detection for wicd, Intel Wireless Daemon
    (iwd), net_applet
  * Airmon-ng: Handle case when avahi keeps getting restarted
  * Airmon-ng: Indicates when interface doesn't exist
  * Airodump-ng: Added autocolorization interactive key
  * Airodump-ng: Added option to read PCAP in realtime (-T)
  * Airodump-ng: Added PMKID detection
  * Airodump-ng: Added support for GMAC
  * Airodump-ng: Added support for WPA3 and OWE (Enhanced Open)
  * Airodump-ng: Basic UTF-8 support
  * Airodump-ng: Checked management frames are complete before
    processing IE to avoid switch from WEP to WPA
  * Airodump-ng: Display signal when reading from PCAP
  * Airodump-ng: Fixed netxml output with hidden SSID
  * Airodump-ng: Improved rates calculation for 802.11n/ac
  * Airtun-ng: Fixed using -p with -e
  * Autoconf: Fixed order of ssl and crypto libraries
  * dcrack: Fixed client reporting benchmark
  * dcrack: Now handles chunked encoding when communicating
    (default in Python3)
  * Freeradius-WPE: Updated patch for v3.0.20
  * General: Added python3 support to scripts
  * General: Added security policy to report security issues
  * General: Reorganizing filesystem layout (See PR 2032), and
    switch to automake 1.14+
  * General: Convert to non-recursive make (part of PR 2032)
  * General: Deduplicating functions and code cleanups
  * General: Fixed packaging on cygwin due to openssl library
    name change
  * General: Removed coveralls.io
  * General: Updated dependencies in README.md/INSTALLING
  * General: Use upstream radiotap libary, as a sub-tree
  * HostAPd-WPE: Updated for v2.9
  * Manpages: Fixes and improvements
  * Tests: Added Integration tests for aireplay-ng, airodump-ng,
    aircrack-ng, airbase-ng, and others
  * Tests: Added tests for airdecap-ng, aircrack-ng</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1593950400">- fix build with gcc10 (gh#2138)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1652270400">- Update to version 1.7
  Airdecap-ng
  * Endianness fixes.
  * Output PCAP as little endian.
  Airodump-ng
  * Fixed blank encryption field when APs have TKIP (and/or CCMP)
    with WPA2.
  * Updated encryption filter (-t/--encrypt) for WPA3 and OWE.
  * Fixed out-of-order timestamp captures.
  * Ignore NULL PMKID.
  * Fixed dropping management frames with zeroed timestamp.
  * Fixed sorting where sometimes it started with a different field
  * Allow setting colors only in AP selection mode.
  * Fix crash on 4K Linux console.
  * Fixed issue where existing clients not linked to an AP become
    hidden when hitting 'o'.
  * Allow use of WiFi 6E 6GHz frequencies.
  * Look for oui.txt in /usr/share/hwdata.
  Airgraph-ng
  * Fixed graphviz package conflict.
  * Fixed downloading OUI with python3.
  * Ensure support/ directory is created when installing.
  Aircrack-ng
  * Fix handshake replay counter logic.
  * Handle timeout when parsing EAPOL.
  * Fixed WEP display.
  * Fixed spurious EXIT messages.
  * Improved handshake selection by fixing EAPOL timing and
    clearing state.
  * Ignore NULL PMKID.
  * Added Apple M1 detection.
  Aireplay-ng
  * In test mode, detect tampering of sequence number b
    firmware/driver.
  * Fixed incorrectly rewritten loops affecting fragmentation
    attack, and in some cases, SKA fake auth.
  * Fixed a bunch of instances where packets had their
    duration updated instead of the sequence number.
  Airmon-ng
  * Fix avahi killing.
  * rewrite service stopping entirely.
  * Codestyle fixes and code cleanup.
  * Added a few Raspberry Pi hardware revisions.
  * Fixes for 8812au driver.
  * Fix iwlwifi firmware formatting.
  * Remove broken KVM detection.
  * Show regdomain in verbose mode.
  * Document frequency usage.
  * Add a sleep to help predictable names due to udev sometimes
    renaming interface.
  * Added warning for broken radiotap headers in kernel 5.15
    to 5.15.4
  * shellcheck fixes.
  * support systemctl as some systems don't support 'service'
    anymore.
  * Fixes for pciutils 3.8, backward compatible.
  Airbase-ng
  * use enum for frame type/subtype.
  * remove a few IE in association responses.
  Besside-ng
  * Support and detect all channels in 5GHz in Auto-Channel mode.
  OSdep
  * Search additional IE for channel information
  Airgraph-ng
  * switch airodump-join to Python 3
  General
  * Fix compilation with LibreSSL 3.5.
  * Add Linux uclibc support.
  * Shell script fixes thanks to shellcheck.
  * Fixes for GCC 10 and 11.
  * Fixed cross-compilation.
  * Code refactoring, deduplication, cleanup, and misc code
    improvements.
  * Coverity Scan fixes, which includes memory leaks, race
    conditions, division by 0, and other issues.
- Remove patch:
  * conflict.patch (not longer needed)</changelog>
  <changelog author="Holger B. A. Rauch &lt;holger.rauch@posteo.de&gt;" date="1672142400">- "Fixed" patch
  (originally coming from "https://github.com/aircrack-ng/aircrack-ng/pull/2335")
  * s390x-enablement-cpustats.patch
- Excluded .keepthisfolder file from being taken into account for RPM packaging</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742385600">- build with pcre2, adding partial upstream patches
  aircrack-ng-1.7-pcre2-1-2385.patch
  aircrack-ng-1.7-pcre2-1-2391.patch
  aircrack-ng-1.7-pcre2-1-2397.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1747396800">- Fix changelog format: the line immediately after the dashed line
  is supposed to be the header with date/author info.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1753099200">- fix wrong-script-interpreter badness</changelog>
</package>
<package pkgid="262a0c15f936135ea96067d51d9f31e1db5a70e48ea0bbc245568655c500f209b537a3cb5b875e46c04e9f45a4551cf2eed4ea72f6b85f604db59274c83ae61c" name="aircrack-ng" arch="src">
  <version epoch="0" ver="1.7" rel="22.16"/>
  <changelog author="pascal.bleser@opensuse.org" date="1251979200">- update to rc4</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1252411200">- update to 1.0</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1256299200">- forced rebuild to avoid uploading the binary packages</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1272196800">- update to 1.1</changelog>
  <changelog author="i@margueirte.su" date="1377950400">- update version 1.2-beta1
  * see http://www.aircrack-ng.org/doku.php?id=changelog for details
- enable:
  * gcrypt: Use libgcrypt crypto library instead of the default OpenSSL
    And also use internal fast sha1 implementation
  * libnl: Add support for netlink (nl80211)
  * ext_scripts: airoscript-ng, versuck-ng, airgraph-ng and airdrop-ng</changelog>
  <changelog author="chris@computersalat.de" date="1389528000">- update to 1.2-beta2
  * Airbase-ng: Fixed order of IE when creating soft Access Point.
  * Airbase-ng: Fixed Caffe Latte Attack not working for all clients.
  * Aircrack-ng: Improved PTW speed thanks to Ramiro Polla.
  * Airmon-zc: Fixed improper use of the interface.
  * Airdecap-ng: Fixed decoding captures with WMM enabled.
  * Various: Fixed memory leaks in Aircrack-ng, Aireplay-ng, OSdep.
  * Added support for static analysis using Coverity Scan.
  * Fixed compilation due to PIC unfriendly assembly on Gentoo hardened.
  * Fixed running tests using 'make check'.
  * Fixed building aircrack-ng with recent version of gcc and also on cygwin.
  * Various other small fixes.</changelog>
  <changelog author="p.seiler@linuxmail.org" date="1415880000">- update to 1.2-rc1
  * Airodump-ng should be able to parse the canonical oui file.
  * Airodump-ng: Fixed GPS stack overflow.
  * Airodump-ng: Fixed stopping cleanly with Ctrl-C.
  * Airmon-zc: better handling for when modules are not available (incomplete)
  * Airmon-zc: users can now start the monitor interface again to change channels
  * Airmon-zc: update to use ip instead of ifconfig if available.
  * Airmon-zc: better handling of devices without pci bus
  * Aireplay-ng: Fixed tcp_test stack overflow.
  * OSdep: Fixed libnl detection. Also avoid detection on non Linux systems.
  * OSdep: Fixed segmentation fault that happens with a malicious server.
  * Besside-ng: Add regular expression matching for the SSID.
  * Buddy-ng: Fixed segmentation fault.
  * Makefile: Fixed 'commands commence before first target' error when building Aircrack-ng.
  * Fixed segfault when changing the optimization when compiling with gcc thanks to Ramiro Polla.
  * Removed airdriver-ng (outdated and not meant for today's kernels)
  * Added gitignore file.
  * Fixed build issues on other compilers by using stdint.h types.
  * Updating installation file and added pkg-config as a requirement.
  * Various small fixes and improvements.</changelog>
  <changelog author="i@margueirte.su" date="1466769600">-Update version 1.2-rc4
  * Airodump-ng: Increase console window size.
  * Aircrack-ng: Added time remaining and percentage done when doing
    WPA cracking with a dictionary (file).
  * Aircrack-ng: Make benchmark last 15 seconds for a more accurate
    value.
  * Airmon-ng: Display chipset for some Broadcom SDIO.
  * Airbase-ng: Fixed broadcasting 'default'.
  * General: Fixed a bunch of compilation warnings with gcc and clang.
  * General: Fixed compilation on ARM and MIPS.
  * General: Memory cleanups, fixed memory leaks and fix other issues
    reported by Valgrind.
  Sat Jun  6 2015 mailaender@opensuse.org
- update to 1.2-rc2
  * Airtun-ng: Adds WPA CCMP and TKIP decryption and CCMP encryption
  * Compilation: Added support for DUMA.
  * Makefile: Renamed 'unstable' to 'experimental'.
  * Airodump-ng: Fixed XML sanitizing.
  * Airmon-ng: Airmon-zc is now stable enough to replace airmon-ng.
  * Manpages: Removed airdriver-ng manpage and references to it (forgot to do it before the previous release).
  * Manpages: Updated 'see also' references in all manpages.
  * PCRE: Added it in various places and docs.
  * WZCook: Fixed processing values stored in register.
  * Updated a few headers files (if_llc, ieee80211, ethernet and if_arp).
  * Compilation: de-hardcode -lpcap to allow specifying pcap libraries.
  * Makefile: Fixed installing/uninstalling Airdrop-ng documentation files.
  * Makefile: Fixed uninstalling ext_scripts.
  * Airodump-ng: Added new paths (and removed one) for OUI files and simplified logic to find the OUI file.
  * Aircrack-ng: Fixed ignoring -p when specified after -S.
  * Airmon-ng: fixes for openwrt busybox ps/grep issues which do not seem present in other versions of busybox
  * Airmon-ng: fix vm detection.
  * Airserv-ng: Fixed channel setting (and assert call).
  * Airodump-ng: Fixes to NetXML (unassociated clients missing and various other small bugs) and update the code to match current NetXML output.
  * Airodump-ng: Removed requirement for 2 packets before AP is written to output (text) files.
  * Airodump-ng: Fixed formatting of ESSID and display of WPA/WPA2 (as well as a bunch of other small fixes) in CSV file.
  * Airodump-ng: Fixed GPSd.
  * Airodump-ng: Allow to specify write interval for CSV, kismet CSV and NetXML files.
  * Airserv-ng: Fixed wrong station data displayed in Airodump-ng.
  * General: Fixed 64 bit promotion issues.
  * General: Fixed a bunch of uninitialized values and non-zeroed structures (upon allocating them).
  * General: Added Stack protection.
  * Various other small fixes and improvements</changelog>
  <changelog author="aloisio@gmx.com" date="1539172800">- Update to version 1.4
  * Aircrack-ng: Added PMKID cracking
  * Aircrack-ng: Serious speed up and memory usage decrease when
    loading large files (multiple Gb) using AVL trees
  * Aircrack-ng: Added hwloc (Hardware Locality) to improve
    performance
  * Aircrack-ng: Support cracking PCAP with Protected Management
    Frames (802.11w)
  * Aircrack-ng: Merged check_thread() and read_thread()
  * Aircrack-ng: Allow static linking with chosen SIMD
  * Aircrack-ng: Display AVX512F when present
  * Airodump-ng: Added clients GPS coordinates in NetXML file
  * Airdecap-ng: Improve decrypting/parsing speed
  * Airmon-ng: Updated/fixed using with nexmon
  * Airmon-ng: Better check for lspci requirement on systems
    that don't have PCI/PCIe devices
  * Airmon-ng: Added support for rtl8812au/8814au/rtl88xxau
    driver
  * Build: Fixed building with a few different architectures
  * Build: Switch to new CI/CD tool, PyDeployer
  * Build: Improved building on Windows (and building/testing
    with AppVeyor)
  * Build: Improved and tweaked CI systems (buildbots, Travis,
    AppVeyor)
  * Build: Support for statically linking libraries/binaries
  * Build: Automatic development packages build for multiple
    Linux distro and upload to PackageCloud.io
  * Tests: Added new tests for Aircrack-ng
  * Tests: Added new capture files
  * Freeradius-WPE: Fixed opening log file twice
  * General: Fixed loading PCAP on system with a different
    endianness
  * General: Fixed memory leaks and issues reported by static
    analysis tools
  * General: Fixed "error while loading shared libraries"
  * General: Various other small improvements in the tools,
    build system, tests and documentation
  * General: Update FSF address
  * General: Code formatting
- Update to version 1.3
  * Aircrack-ng: Allow using Hashcat HCCAPX files as input files.
  * Aircrack-ng: Fixed floating point exception due to division
    by 0 when displaying stats.
  * Aircrack-ng: Updated manpage regarding hex wordlist usage.
  * Aircrack-ng: Added save/restore session when cracking using
    wordlists (-N and -R).
  * Aircrack-ng: Moved crypto to its own library,
    aircrack-crypto/ (aka crypto engine).
  * Aircrack-ng: Now back to a single binary thanks to
    crypto-engine.
  * Aircrack-ng: Performance improvements of the crypto engine
    across various CPU architectures.
  * Aircrack-ng: Added support for AVX512 in the crypto-engine
    (and build).
  * Aircrack-ng: Improved building crypto-engine across CPU
    architectures and compilers (gcc, clang and ICC).
  * Aircrack-ng: Allow to list available SIMD optimizations.
  * Aircrack-ng: Improved benchmark tool for unusual CPU/cores
    count.
  * Airodump-ng: Fixed running in the background.
  * Airodump-ng: Don't show WPA handshake capture notice for
    out-of-scope ESSIDs.
  * Airodump-ng: Add --background 0/1 to force disable/enable
    background settings and override autodetection of background.
  * Airodump-ng: Added support for GCMP, GCMP-256 and CCMP-256.
  * Airolib-ng: Fixed importing data when interrupting process
    using Ctrl-C.
  * dcrack: Check if dictionary and capture file exists before
    uploading them.
  * dcrack: Clean up dictionary before uploading it to the
    server.
  * dcrack: Gracefully stop and display errors instead of
    printing stacktrace whenever possible.
  * dcrack: Move temporary user files to /tmp and cleanup when
    done.
  * dcrack: Fixed displaying status when no clients are
    connected to the server.
  * dcrack: Validate uploaded PCAP and display success/failure.
  * dcrack: Improved removing BSSID.
  * WPAClean: Fixed crash with invalid prism2 header PCAP and
    added tests.
  * WPAClean: Don't create output file if no handshake are
    present or if input file is bad.
  * WPAClean: Fixed memory leak.
  * Airmon-ng: Fixed display of interface name if name is too
    long.
  * OSdep: Fixed memory leak and null pointer dereference.
  * OSdep: Fixed byteorder macros and other tools crashing.
  * OSdep: Added support to build as a shared library.
  * FreeRADIUS-WPE: Updated instructions for v3.0.17.
  * HostAPd-wpe: Added Response-Identity logging and displaying
    NETNTLM hash in hashcat format.
  * Airgraph-ng: Renamed dump-join to airodump-join.
  * General: Added coveralls.io badge.
  * General: Added --without-opt to disable stack protector when
    using GCC &gt;= 4.9
  * General: Various improvements and fixes, some from Coverity
    Scan and Valgrind.
  * General: Fixed typos reported by codespell.
  * General: Extracted console functions and moved to
    aircrack-util/.
  * General: Renamed osdep/ to aircrack-osdep/.
  * General: Fixed and added functions prototypes and commented
    out unused functions.
  * General: Reformat source code using clang-format and added
    .clang-format file for IDE.
  * General: Improvements to AppVeyor and TravisCI builds
  * Building: Added NEON intrinsic support.
  * Building: Support paths containing spaces, during autoreconf.
  * Building: Fix compilation without getauxval in the
    trampoline binary.
  * Building: Fixed compiler warnings on Windows, FreeBSD.
  * Building: Fixes and documentation for OSX.
  * Building: Added support for tcmalloc and jemalloc.
  * Building: Added instruction to build Windows binaries with
    Airpcap.
  * Unit test: Using CMocka for some tests
  * Documentation: Updated explanations regarding building some
    experimental tools.</changelog>
  <changelog author="atoptsoglou@suse.com" date="1544529600">- Update to version 1.5.2:
  * Airodump-ng: Fixed AP selection slip in interactive mode
  * Airodump-ng: Revamped GPS logging functionality and added new logging format (logcsv)
  * Aircrack-ng: Only load the maximum supported and available crypto engine
  * Aircrack-ng: Reworked wordlist producer/consumer queue
  * Airserv-ng: Fixed communication between platforms with different size int
  * Airmon-ng: Improved detection of Raspberry Pis
  * General: Signed and unsigned comparison fixes
  * General: Code cleanups
  * General: Added more tests
  * General: Compilation improvements/fixes in autotools
  * General: Big endian fixes
  * General: Fixed spelling errors
  * Made the changelog look better
  * Adjustments to spec file</changelog>
  <changelog author="atoptsoglou@suse.com" date="1547812800">- Fix conflict issue with graphviz: python files are now installed
  under air_graphviz, add conflict.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1585915200">- build with pcre for regex filtering of SSID
- with with hwloc to improve performance
- fix experimental feature conditional build
- fix SQLite conditional build</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1589025600">- Run spec-cleaner
- Force python3 for all tools written in python
- Use proper docdir
- Update patch:
  * conflict.patch
- Introduce devel subpackage
- Run testsuite
- Update to version 1.6:
  * Aircrack-ng: Fixed ARM processors display with -u
  * Aircrack-ng: Fixed AVX-512F support
  * Aircrack-ng: Fixed cracking speed calculation
  * Aircrack-ng: Fixed cracking WEP beyond 10k IVS
  * Aircrack-ng: Fixed creating new session and added test case
  * Aircrack-ng: Fixed encryption display in some cases when
    prompting for network to crack
  * Aircrack-ng: Fixed exiting Aircrack-ng in some cases
  * Aircrack-ng: Fixed logical and physical processor count
    detection
  * Aircrack-ng: Fixed PMKID length check
  * Aircrack-ng: Various fixes and improvements to WPA cracking
    engine and its performance
  * Airdecap-ng: Decrypt both directions when WDS is in use
  * Airdecap-ng: Fixed decrypting WPA PCAP when BSSID changes
  * Airgraph-ng: Added support for WPA3
  * Airgraph-ng: Switch to argparse
  * Airmon-ng: Added detection for wicd, Intel Wireless Daemon
    (iwd), net_applet
  * Airmon-ng: Handle case when avahi keeps getting restarted
  * Airmon-ng: Indicates when interface doesn't exist
  * Airodump-ng: Added autocolorization interactive key
  * Airodump-ng: Added option to read PCAP in realtime (-T)
  * Airodump-ng: Added PMKID detection
  * Airodump-ng: Added support for GMAC
  * Airodump-ng: Added support for WPA3 and OWE (Enhanced Open)
  * Airodump-ng: Basic UTF-8 support
  * Airodump-ng: Checked management frames are complete before
    processing IE to avoid switch from WEP to WPA
  * Airodump-ng: Display signal when reading from PCAP
  * Airodump-ng: Fixed netxml output with hidden SSID
  * Airodump-ng: Improved rates calculation for 802.11n/ac
  * Airtun-ng: Fixed using -p with -e
  * Autoconf: Fixed order of ssl and crypto libraries
  * dcrack: Fixed client reporting benchmark
  * dcrack: Now handles chunked encoding when communicating
    (default in Python3)
  * Freeradius-WPE: Updated patch for v3.0.20
  * General: Added python3 support to scripts
  * General: Added security policy to report security issues
  * General: Reorganizing filesystem layout (See PR 2032), and
    switch to automake 1.14+
  * General: Convert to non-recursive make (part of PR 2032)
  * General: Deduplicating functions and code cleanups
  * General: Fixed packaging on cygwin due to openssl library
    name change
  * General: Removed coveralls.io
  * General: Updated dependencies in README.md/INSTALLING
  * General: Use upstream radiotap libary, as a sub-tree
  * HostAPd-WPE: Updated for v2.9
  * Manpages: Fixes and improvements
  * Tests: Added Integration tests for aireplay-ng, airodump-ng,
    aircrack-ng, airbase-ng, and others
  * Tests: Added tests for airdecap-ng, aircrack-ng</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1593950400">- fix build with gcc10 (gh#2138)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1652270400">- Update to version 1.7
  Airdecap-ng
  * Endianness fixes.
  * Output PCAP as little endian.
  Airodump-ng
  * Fixed blank encryption field when APs have TKIP (and/or CCMP)
    with WPA2.
  * Updated encryption filter (-t/--encrypt) for WPA3 and OWE.
  * Fixed out-of-order timestamp captures.
  * Ignore NULL PMKID.
  * Fixed dropping management frames with zeroed timestamp.
  * Fixed sorting where sometimes it started with a different field
  * Allow setting colors only in AP selection mode.
  * Fix crash on 4K Linux console.
  * Fixed issue where existing clients not linked to an AP become
    hidden when hitting 'o'.
  * Allow use of WiFi 6E 6GHz frequencies.
  * Look for oui.txt in /usr/share/hwdata.
  Airgraph-ng
  * Fixed graphviz package conflict.
  * Fixed downloading OUI with python3.
  * Ensure support/ directory is created when installing.
  Aircrack-ng
  * Fix handshake replay counter logic.
  * Handle timeout when parsing EAPOL.
  * Fixed WEP display.
  * Fixed spurious EXIT messages.
  * Improved handshake selection by fixing EAPOL timing and
    clearing state.
  * Ignore NULL PMKID.
  * Added Apple M1 detection.
  Aireplay-ng
  * In test mode, detect tampering of sequence number b
    firmware/driver.
  * Fixed incorrectly rewritten loops affecting fragmentation
    attack, and in some cases, SKA fake auth.
  * Fixed a bunch of instances where packets had their
    duration updated instead of the sequence number.
  Airmon-ng
  * Fix avahi killing.
  * rewrite service stopping entirely.
  * Codestyle fixes and code cleanup.
  * Added a few Raspberry Pi hardware revisions.
  * Fixes for 8812au driver.
  * Fix iwlwifi firmware formatting.
  * Remove broken KVM detection.
  * Show regdomain in verbose mode.
  * Document frequency usage.
  * Add a sleep to help predictable names due to udev sometimes
    renaming interface.
  * Added warning for broken radiotap headers in kernel 5.15
    to 5.15.4
  * shellcheck fixes.
  * support systemctl as some systems don't support 'service'
    anymore.
  * Fixes for pciutils 3.8, backward compatible.
  Airbase-ng
  * use enum for frame type/subtype.
  * remove a few IE in association responses.
  Besside-ng
  * Support and detect all channels in 5GHz in Auto-Channel mode.
  OSdep
  * Search additional IE for channel information
  Airgraph-ng
  * switch airodump-join to Python 3
  General
  * Fix compilation with LibreSSL 3.5.
  * Add Linux uclibc support.
  * Shell script fixes thanks to shellcheck.
  * Fixes for GCC 10 and 11.
  * Fixed cross-compilation.
  * Code refactoring, deduplication, cleanup, and misc code
    improvements.
  * Coverity Scan fixes, which includes memory leaks, race
    conditions, division by 0, and other issues.
- Remove patch:
  * conflict.patch (not longer needed)</changelog>
  <changelog author="Holger B. A. Rauch &lt;holger.rauch@posteo.de&gt;" date="1672142400">- "Fixed" patch
  (originally coming from "https://github.com/aircrack-ng/aircrack-ng/pull/2335")
  * s390x-enablement-cpustats.patch
- Excluded .keepthisfolder file from being taken into account for RPM packaging</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742385600">- build with pcre2, adding partial upstream patches
  aircrack-ng-1.7-pcre2-1-2385.patch
  aircrack-ng-1.7-pcre2-1-2391.patch
  aircrack-ng-1.7-pcre2-1-2397.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1747396800">- Fix changelog format: the line immediately after the dashed line
  is supposed to be the header with date/author info.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1753099200">- fix wrong-script-interpreter badness</changelog>
</package>
<package pkgid="05eb0aa39b4b748b3eec05485f0a8d695485a1c9d6dd435498bc36a95e12d59729b1080f0114d0d3b108be868d1d728fc7c3bf9e7d3cc96f49081d63db1ac3d7" name="aircrack-ng-debuginfo" arch="s390x">
  <version epoch="0" ver="1.7" rel="22.16"/>
  <changelog author="atoptsoglou@suse.com" date="1547812800">- Fix conflict issue with graphviz: python files are now installed
  under air_graphviz, add conflict.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1585915200">- build with pcre for regex filtering of SSID
- with with hwloc to improve performance
- fix experimental feature conditional build
- fix SQLite conditional build</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1589025600">- Run spec-cleaner
- Force python3 for all tools written in python
- Use proper docdir
- Update patch:
  * conflict.patch
- Introduce devel subpackage
- Run testsuite
- Update to version 1.6:
  * Aircrack-ng: Fixed ARM processors display with -u
  * Aircrack-ng: Fixed AVX-512F support
  * Aircrack-ng: Fixed cracking speed calculation
  * Aircrack-ng: Fixed cracking WEP beyond 10k IVS
  * Aircrack-ng: Fixed creating new session and added test case
  * Aircrack-ng: Fixed encryption display in some cases when
    prompting for network to crack
  * Aircrack-ng: Fixed exiting Aircrack-ng in some cases
  * Aircrack-ng: Fixed logical and physical processor count
    detection
  * Aircrack-ng: Fixed PMKID length check
  * Aircrack-ng: Various fixes and improvements to WPA cracking
    engine and its performance
  * Airdecap-ng: Decrypt both directions when WDS is in use
  * Airdecap-ng: Fixed decrypting WPA PCAP when BSSID changes
  * Airgraph-ng: Added support for WPA3
  * Airgraph-ng: Switch to argparse
  * Airmon-ng: Added detection for wicd, Intel Wireless Daemon
    (iwd), net_applet
  * Airmon-ng: Handle case when avahi keeps getting restarted
  * Airmon-ng: Indicates when interface doesn't exist
  * Airodump-ng: Added autocolorization interactive key
  * Airodump-ng: Added option to read PCAP in realtime (-T)
  * Airodump-ng: Added PMKID detection
  * Airodump-ng: Added support for GMAC
  * Airodump-ng: Added support for WPA3 and OWE (Enhanced Open)
  * Airodump-ng: Basic UTF-8 support
  * Airodump-ng: Checked management frames are complete before
    processing IE to avoid switch from WEP to WPA
  * Airodump-ng: Display signal when reading from PCAP
  * Airodump-ng: Fixed netxml output with hidden SSID
  * Airodump-ng: Improved rates calculation for 802.11n/ac
  * Airtun-ng: Fixed using -p with -e
  * Autoconf: Fixed order of ssl and crypto libraries
  * dcrack: Fixed client reporting benchmark
  * dcrack: Now handles chunked encoding when communicating
    (default in Python3)
  * Freeradius-WPE: Updated patch for v3.0.20
  * General: Added python3 support to scripts
  * General: Added security policy to report security issues
  * General: Reorganizing filesystem layout (See PR 2032), and
    switch to automake 1.14+
  * General: Convert to non-recursive make (part of PR 2032)
  * General: Deduplicating functions and code cleanups
  * General: Fixed packaging on cygwin due to openssl library
    name change
  * General: Removed coveralls.io
  * General: Updated dependencies in README.md/INSTALLING
  * General: Use upstream radiotap libary, as a sub-tree
  * HostAPd-WPE: Updated for v2.9
  * Manpages: Fixes and improvements
  * Tests: Added Integration tests for aireplay-ng, airodump-ng,
    aircrack-ng, airbase-ng, and others
  * Tests: Added tests for airdecap-ng, aircrack-ng</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1593950400">- fix build with gcc10 (gh#2138)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1652270400">- Update to version 1.7
  Airdecap-ng
  * Endianness fixes.
  * Output PCAP as little endian.
  Airodump-ng
  * Fixed blank encryption field when APs have TKIP (and/or CCMP)
    with WPA2.
  * Updated encryption filter (-t/--encrypt) for WPA3 and OWE.
  * Fixed out-of-order timestamp captures.
  * Ignore NULL PMKID.
  * Fixed dropping management frames with zeroed timestamp.
  * Fixed sorting where sometimes it started with a different field
  * Allow setting colors only in AP selection mode.
  * Fix crash on 4K Linux console.
  * Fixed issue where existing clients not linked to an AP become
    hidden when hitting 'o'.
  * Allow use of WiFi 6E 6GHz frequencies.
  * Look for oui.txt in /usr/share/hwdata.
  Airgraph-ng
  * Fixed graphviz package conflict.
  * Fixed downloading OUI with python3.
  * Ensure support/ directory is created when installing.
  Aircrack-ng
  * Fix handshake replay counter logic.
  * Handle timeout when parsing EAPOL.
  * Fixed WEP display.
  * Fixed spurious EXIT messages.
  * Improved handshake selection by fixing EAPOL timing and
    clearing state.
  * Ignore NULL PMKID.
  * Added Apple M1 detection.
  Aireplay-ng
  * In test mode, detect tampering of sequence number b
    firmware/driver.
  * Fixed incorrectly rewritten loops affecting fragmentation
    attack, and in some cases, SKA fake auth.
  * Fixed a bunch of instances where packets had their
    duration updated instead of the sequence number.
  Airmon-ng
  * Fix avahi killing.
  * rewrite service stopping entirely.
  * Codestyle fixes and code cleanup.
  * Added a few Raspberry Pi hardware revisions.
  * Fixes for 8812au driver.
  * Fix iwlwifi firmware formatting.
  * Remove broken KVM detection.
  * Show regdomain in verbose mode.
  * Document frequency usage.
  * Add a sleep to help predictable names due to udev sometimes
    renaming interface.
  * Added warning for broken radiotap headers in kernel 5.15
    to 5.15.4
  * shellcheck fixes.
  * support systemctl as some systems don't support 'service'
    anymore.
  * Fixes for pciutils 3.8, backward compatible.
  Airbase-ng
  * use enum for frame type/subtype.
  * remove a few IE in association responses.
  Besside-ng
  * Support and detect all channels in 5GHz in Auto-Channel mode.
  OSdep
  * Search additional IE for channel information
  Airgraph-ng
  * switch airodump-join to Python 3
  General
  * Fix compilation with LibreSSL 3.5.
  * Add Linux uclibc support.
  * Shell script fixes thanks to shellcheck.
  * Fixes for GCC 10 and 11.
  * Fixed cross-compilation.
  * Code refactoring, deduplication, cleanup, and misc code
    improvements.
  * Coverity Scan fixes, which includes memory leaks, race
    conditions, division by 0, and other issues.
- Remove patch:
  * conflict.patch (not longer needed)</changelog>
  <changelog author="Holger B. A. Rauch &lt;holger.rauch@posteo.de&gt;" date="1672142400">- "Fixed" patch
  (originally coming from "https://github.com/aircrack-ng/aircrack-ng/pull/2335")
  * s390x-enablement-cpustats.patch
- Excluded .keepthisfolder file from being taken into account for RPM packaging</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742385600">- build with pcre2, adding partial upstream patches
  aircrack-ng-1.7-pcre2-1-2385.patch
  aircrack-ng-1.7-pcre2-1-2391.patch
  aircrack-ng-1.7-pcre2-1-2397.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1747396800">- Fix changelog format: the line immediately after the dashed line
  is supposed to be the header with date/author info.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1753099200">- fix wrong-script-interpreter badness</changelog>
</package>
<package pkgid="3c2994bd0edebe3ee1e1074d61f8da12cd1824a87f2e072911859d3b256059c65bd41e0b00c5e19fbf5227e1c4d5a301fd2b36e5c3101ba87c5953f09ea769bf" name="aircrack-ng-debugsource" arch="s390x">
  <version epoch="0" ver="1.7" rel="22.16"/>
  <changelog author="atoptsoglou@suse.com" date="1547812800">- Fix conflict issue with graphviz: python files are now installed
  under air_graphviz, add conflict.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1585915200">- build with pcre for regex filtering of SSID
- with with hwloc to improve performance
- fix experimental feature conditional build
- fix SQLite conditional build</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1589025600">- Run spec-cleaner
- Force python3 for all tools written in python
- Use proper docdir
- Update patch:
  * conflict.patch
- Introduce devel subpackage
- Run testsuite
- Update to version 1.6:
  * Aircrack-ng: Fixed ARM processors display with -u
  * Aircrack-ng: Fixed AVX-512F support
  * Aircrack-ng: Fixed cracking speed calculation
  * Aircrack-ng: Fixed cracking WEP beyond 10k IVS
  * Aircrack-ng: Fixed creating new session and added test case
  * Aircrack-ng: Fixed encryption display in some cases when
    prompting for network to crack
  * Aircrack-ng: Fixed exiting Aircrack-ng in some cases
  * Aircrack-ng: Fixed logical and physical processor count
    detection
  * Aircrack-ng: Fixed PMKID length check
  * Aircrack-ng: Various fixes and improvements to WPA cracking
    engine and its performance
  * Airdecap-ng: Decrypt both directions when WDS is in use
  * Airdecap-ng: Fixed decrypting WPA PCAP when BSSID changes
  * Airgraph-ng: Added support for WPA3
  * Airgraph-ng: Switch to argparse
  * Airmon-ng: Added detection for wicd, Intel Wireless Daemon
    (iwd), net_applet
  * Airmon-ng: Handle case when avahi keeps getting restarted
  * Airmon-ng: Indicates when interface doesn't exist
  * Airodump-ng: Added autocolorization interactive key
  * Airodump-ng: Added option to read PCAP in realtime (-T)
  * Airodump-ng: Added PMKID detection
  * Airodump-ng: Added support for GMAC
  * Airodump-ng: Added support for WPA3 and OWE (Enhanced Open)
  * Airodump-ng: Basic UTF-8 support
  * Airodump-ng: Checked management frames are complete before
    processing IE to avoid switch from WEP to WPA
  * Airodump-ng: Display signal when reading from PCAP
  * Airodump-ng: Fixed netxml output with hidden SSID
  * Airodump-ng: Improved rates calculation for 802.11n/ac
  * Airtun-ng: Fixed using -p with -e
  * Autoconf: Fixed order of ssl and crypto libraries
  * dcrack: Fixed client reporting benchmark
  * dcrack: Now handles chunked encoding when communicating
    (default in Python3)
  * Freeradius-WPE: Updated patch for v3.0.20
  * General: Added python3 support to scripts
  * General: Added security policy to report security issues
  * General: Reorganizing filesystem layout (See PR 2032), and
    switch to automake 1.14+
  * General: Convert to non-recursive make (part of PR 2032)
  * General: Deduplicating functions and code cleanups
  * General: Fixed packaging on cygwin due to openssl library
    name change
  * General: Removed coveralls.io
  * General: Updated dependencies in README.md/INSTALLING
  * General: Use upstream radiotap libary, as a sub-tree
  * HostAPd-WPE: Updated for v2.9
  * Manpages: Fixes and improvements
  * Tests: Added Integration tests for aireplay-ng, airodump-ng,
    aircrack-ng, airbase-ng, and others
  * Tests: Added tests for airdecap-ng, aircrack-ng</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1593950400">- fix build with gcc10 (gh#2138)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1652270400">- Update to version 1.7
  Airdecap-ng
  * Endianness fixes.
  * Output PCAP as little endian.
  Airodump-ng
  * Fixed blank encryption field when APs have TKIP (and/or CCMP)
    with WPA2.
  * Updated encryption filter (-t/--encrypt) for WPA3 and OWE.
  * Fixed out-of-order timestamp captures.
  * Ignore NULL PMKID.
  * Fixed dropping management frames with zeroed timestamp.
  * Fixed sorting where sometimes it started with a different field
  * Allow setting colors only in AP selection mode.
  * Fix crash on 4K Linux console.
  * Fixed issue where existing clients not linked to an AP become
    hidden when hitting 'o'.
  * Allow use of WiFi 6E 6GHz frequencies.
  * Look for oui.txt in /usr/share/hwdata.
  Airgraph-ng
  * Fixed graphviz package conflict.
  * Fixed downloading OUI with python3.
  * Ensure support/ directory is created when installing.
  Aircrack-ng
  * Fix handshake replay counter logic.
  * Handle timeout when parsing EAPOL.
  * Fixed WEP display.
  * Fixed spurious EXIT messages.
  * Improved handshake selection by fixing EAPOL timing and
    clearing state.
  * Ignore NULL PMKID.
  * Added Apple M1 detection.
  Aireplay-ng
  * In test mode, detect tampering of sequence number b
    firmware/driver.
  * Fixed incorrectly rewritten loops affecting fragmentation
    attack, and in some cases, SKA fake auth.
  * Fixed a bunch of instances where packets had their
    duration updated instead of the sequence number.
  Airmon-ng
  * Fix avahi killing.
  * rewrite service stopping entirely.
  * Codestyle fixes and code cleanup.
  * Added a few Raspberry Pi hardware revisions.
  * Fixes for 8812au driver.
  * Fix iwlwifi firmware formatting.
  * Remove broken KVM detection.
  * Show regdomain in verbose mode.
  * Document frequency usage.
  * Add a sleep to help predictable names due to udev sometimes
    renaming interface.
  * Added warning for broken radiotap headers in kernel 5.15
    to 5.15.4
  * shellcheck fixes.
  * support systemctl as some systems don't support 'service'
    anymore.
  * Fixes for pciutils 3.8, backward compatible.
  Airbase-ng
  * use enum for frame type/subtype.
  * remove a few IE in association responses.
  Besside-ng
  * Support and detect all channels in 5GHz in Auto-Channel mode.
  OSdep
  * Search additional IE for channel information
  Airgraph-ng
  * switch airodump-join to Python 3
  General
  * Fix compilation with LibreSSL 3.5.
  * Add Linux uclibc support.
  * Shell script fixes thanks to shellcheck.
  * Fixes for GCC 10 and 11.
  * Fixed cross-compilation.
  * Code refactoring, deduplication, cleanup, and misc code
    improvements.
  * Coverity Scan fixes, which includes memory leaks, race
    conditions, division by 0, and other issues.
- Remove patch:
  * conflict.patch (not longer needed)</changelog>
  <changelog author="Holger B. A. Rauch &lt;holger.rauch@posteo.de&gt;" date="1672142400">- "Fixed" patch
  (originally coming from "https://github.com/aircrack-ng/aircrack-ng/pull/2335")
  * s390x-enablement-cpustats.patch
- Excluded .keepthisfolder file from being taken into account for RPM packaging</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742385600">- build with pcre2, adding partial upstream patches
  aircrack-ng-1.7-pcre2-1-2385.patch
  aircrack-ng-1.7-pcre2-1-2391.patch
  aircrack-ng-1.7-pcre2-1-2397.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1747396800">- Fix changelog format: the line immediately after the dashed line
  is supposed to be the header with date/author info.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1753099200">- fix wrong-script-interpreter badness</changelog>
</package>
<package pkgid="e399fb2b9eed70dfe85d608ab485e967634bb7df2c7df99578326152039ed78e191617ea9e0170cf538910c2a0077f0681dfa47224508781737883d43089e38d" name="aircrack-ng-devel" arch="noarch">
  <version epoch="0" ver="1.7" rel="22.16"/>
  <changelog author="atoptsoglou@suse.com" date="1547812800">- Fix conflict issue with graphviz: python files are now installed
  under air_graphviz, add conflict.patch</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1585915200">- build with pcre for regex filtering of SSID
- with with hwloc to improve performance
- fix experimental feature conditional build
- fix SQLite conditional build</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1589025600">- Run spec-cleaner
- Force python3 for all tools written in python
- Use proper docdir
- Update patch:
  * conflict.patch
- Introduce devel subpackage
- Run testsuite
- Update to version 1.6:
  * Aircrack-ng: Fixed ARM processors display with -u
  * Aircrack-ng: Fixed AVX-512F support
  * Aircrack-ng: Fixed cracking speed calculation
  * Aircrack-ng: Fixed cracking WEP beyond 10k IVS
  * Aircrack-ng: Fixed creating new session and added test case
  * Aircrack-ng: Fixed encryption display in some cases when
    prompting for network to crack
  * Aircrack-ng: Fixed exiting Aircrack-ng in some cases
  * Aircrack-ng: Fixed logical and physical processor count
    detection
  * Aircrack-ng: Fixed PMKID length check
  * Aircrack-ng: Various fixes and improvements to WPA cracking
    engine and its performance
  * Airdecap-ng: Decrypt both directions when WDS is in use
  * Airdecap-ng: Fixed decrypting WPA PCAP when BSSID changes
  * Airgraph-ng: Added support for WPA3
  * Airgraph-ng: Switch to argparse
  * Airmon-ng: Added detection for wicd, Intel Wireless Daemon
    (iwd), net_applet
  * Airmon-ng: Handle case when avahi keeps getting restarted
  * Airmon-ng: Indicates when interface doesn't exist
  * Airodump-ng: Added autocolorization interactive key
  * Airodump-ng: Added option to read PCAP in realtime (-T)
  * Airodump-ng: Added PMKID detection
  * Airodump-ng: Added support for GMAC
  * Airodump-ng: Added support for WPA3 and OWE (Enhanced Open)
  * Airodump-ng: Basic UTF-8 support
  * Airodump-ng: Checked management frames are complete before
    processing IE to avoid switch from WEP to WPA
  * Airodump-ng: Display signal when reading from PCAP
  * Airodump-ng: Fixed netxml output with hidden SSID
  * Airodump-ng: Improved rates calculation for 802.11n/ac
  * Airtun-ng: Fixed using -p with -e
  * Autoconf: Fixed order of ssl and crypto libraries
  * dcrack: Fixed client reporting benchmark
  * dcrack: Now handles chunked encoding when communicating
    (default in Python3)
  * Freeradius-WPE: Updated patch for v3.0.20
  * General: Added python3 support to scripts
  * General: Added security policy to report security issues
  * General: Reorganizing filesystem layout (See PR 2032), and
    switch to automake 1.14+
  * General: Convert to non-recursive make (part of PR 2032)
  * General: Deduplicating functions and code cleanups
  * General: Fixed packaging on cygwin due to openssl library
    name change
  * General: Removed coveralls.io
  * General: Updated dependencies in README.md/INSTALLING
  * General: Use upstream radiotap libary, as a sub-tree
  * HostAPd-WPE: Updated for v2.9
  * Manpages: Fixes and improvements
  * Tests: Added Integration tests for aireplay-ng, airodump-ng,
    aircrack-ng, airbase-ng, and others
  * Tests: Added tests for airdecap-ng, aircrack-ng</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1593950400">- fix build with gcc10 (gh#2138)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1652270400">- Update to version 1.7
  Airdecap-ng
  * Endianness fixes.
  * Output PCAP as little endian.
  Airodump-ng
  * Fixed blank encryption field when APs have TKIP (and/or CCMP)
    with WPA2.
  * Updated encryption filter (-t/--encrypt) for WPA3 and OWE.
  * Fixed out-of-order timestamp captures.
  * Ignore NULL PMKID.
  * Fixed dropping management frames with zeroed timestamp.
  * Fixed sorting where sometimes it started with a different field
  * Allow setting colors only in AP selection mode.
  * Fix crash on 4K Linux console.
  * Fixed issue where existing clients not linked to an AP become
    hidden when hitting 'o'.
  * Allow use of WiFi 6E 6GHz frequencies.
  * Look for oui.txt in /usr/share/hwdata.
  Airgraph-ng
  * Fixed graphviz package conflict.
  * Fixed downloading OUI with python3.
  * Ensure support/ directory is created when installing.
  Aircrack-ng
  * Fix handshake replay counter logic.
  * Handle timeout when parsing EAPOL.
  * Fixed WEP display.
  * Fixed spurious EXIT messages.
  * Improved handshake selection by fixing EAPOL timing and
    clearing state.
  * Ignore NULL PMKID.
  * Added Apple M1 detection.
  Aireplay-ng
  * In test mode, detect tampering of sequence number b
    firmware/driver.
  * Fixed incorrectly rewritten loops affecting fragmentation
    attack, and in some cases, SKA fake auth.
  * Fixed a bunch of instances where packets had their
    duration updated instead of the sequence number.
  Airmon-ng
  * Fix avahi killing.
  * rewrite service stopping entirely.
  * Codestyle fixes and code cleanup.
  * Added a few Raspberry Pi hardware revisions.
  * Fixes for 8812au driver.
  * Fix iwlwifi firmware formatting.
  * Remove broken KVM detection.
  * Show regdomain in verbose mode.
  * Document frequency usage.
  * Add a sleep to help predictable names due to udev sometimes
    renaming interface.
  * Added warning for broken radiotap headers in kernel 5.15
    to 5.15.4
  * shellcheck fixes.
  * support systemctl as some systems don't support 'service'
    anymore.
  * Fixes for pciutils 3.8, backward compatible.
  Airbase-ng
  * use enum for frame type/subtype.
  * remove a few IE in association responses.
  Besside-ng
  * Support and detect all channels in 5GHz in Auto-Channel mode.
  OSdep
  * Search additional IE for channel information
  Airgraph-ng
  * switch airodump-join to Python 3
  General
  * Fix compilation with LibreSSL 3.5.
  * Add Linux uclibc support.
  * Shell script fixes thanks to shellcheck.
  * Fixes for GCC 10 and 11.
  * Fixed cross-compilation.
  * Code refactoring, deduplication, cleanup, and misc code
    improvements.
  * Coverity Scan fixes, which includes memory leaks, race
    conditions, division by 0, and other issues.
- Remove patch:
  * conflict.patch (not longer needed)</changelog>
  <changelog author="Holger B. A. Rauch &lt;holger.rauch@posteo.de&gt;" date="1672142400">- "Fixed" patch
  (originally coming from "https://github.com/aircrack-ng/aircrack-ng/pull/2335")
  * s390x-enablement-cpustats.patch
- Excluded .keepthisfolder file from being taken into account for RPM packaging</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742385600">- build with pcre2, adding partial upstream patches
  aircrack-ng-1.7-pcre2-1-2385.patch
  aircrack-ng-1.7-pcre2-1-2391.patch
  aircrack-ng-1.7-pcre2-1-2397.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1747396800">- Fix changelog format: the line immediately after the dashed line
  is supposed to be the header with date/author info.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1753099200">- fix wrong-script-interpreter badness</changelog>
</package>
<package pkgid="8bf14944016ae4dd288c2c8ce4a541d405beabf841eee21b4a5674d90859b49dace52e9db4419e2387056bf4cc1d3ce75580fee2bc6b0b8b9648bbf67f1b8ed5" name="amap" arch="s390x">
  <version epoch="0" ver="5.4" rel="1.29"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1206014400">- Initial RPM</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376000">- Update to version 5.4:
  * This is a release to fix IPv6 UDP port scanning as no other tool
  * currently exists to do that.
  * Beside this, amap is outdated, and nmap should be prefered
  * Fix for IPv6 introduced in v5.3
  * Fixed UDP port scanning for IPv6
  * Disabled web update
  * added printing of [] brackets around IPv6 addresses (required)
  * Fixed a bug in amapcrap that the trigger would not display correctly
- spec file changes:
  * delete 'clean' section
  * fix license name
  * move 'changes' to the changes file
  * adding SUSE copyright (header) for spec file</changelog>
</package>
<package pkgid="4baa5cbb6390f13c8d840f31c5bf5b63872eebda88f69f8c5cf12214c6ac147508546c3c518f6c54098ccd13513e3ef58f75b2b07ed39d8bf41cae1b9891b355" name="amap" arch="src">
  <version epoch="0" ver="5.4" rel="1.29"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1206014400">- Initial RPM</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376000">- Update to version 5.4:
  * This is a release to fix IPv6 UDP port scanning as no other tool
  * currently exists to do that.
  * Beside this, amap is outdated, and nmap should be prefered
  * Fix for IPv6 introduced in v5.3
  * Fixed UDP port scanning for IPv6
  * Disabled web update
  * added printing of [] brackets around IPv6 addresses (required)
  * Fixed a bug in amapcrap that the trigger would not display correctly
- spec file changes:
  * delete 'clean' section
  * fix license name
  * move 'changes' to the changes file
  * adding SUSE copyright (header) for spec file</changelog>
</package>
<package pkgid="bbedd82c6259b7dc757f22477414a862dc40f71ccbb349ede435f7fed0b4ab9b737c856f357a32b07b1084790b785928bde86bbe3127cf27f62459a81288dacd" name="amap-debuginfo" arch="s390x">
  <version epoch="0" ver="5.4" rel="1.29"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1206014400">- Initial RPM</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376000">- Update to version 5.4:
  * This is a release to fix IPv6 UDP port scanning as no other tool
  * currently exists to do that.
  * Beside this, amap is outdated, and nmap should be prefered
  * Fix for IPv6 introduced in v5.3
  * Fixed UDP port scanning for IPv6
  * Disabled web update
  * added printing of [] brackets around IPv6 addresses (required)
  * Fixed a bug in amapcrap that the trigger would not display correctly
- spec file changes:
  * delete 'clean' section
  * fix license name
  * move 'changes' to the changes file
  * adding SUSE copyright (header) for spec file</changelog>
</package>
<package pkgid="94510052b5b1d780909fecf39ef570f499ab350140e55d4ff1f3c6df2656cc1f88a17adce971e2f9a62f8c75bf64598cf346ecd0de17ea8df3036b338a6e52bc" name="amap-debugsource" arch="s390x">
  <version epoch="0" ver="5.4" rel="1.29"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1206014400">- Initial RPM</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376000">- Update to version 5.4:
  * This is a release to fix IPv6 UDP port scanning as no other tool
  * currently exists to do that.
  * Beside this, amap is outdated, and nmap should be prefered
  * Fix for IPv6 introduced in v5.3
  * Fixed UDP port scanning for IPv6
  * Disabled web update
  * added printing of [] brackets around IPv6 addresses (required)
  * Fixed a bug in amapcrap that the trigger would not display correctly
- spec file changes:
  * delete 'clean' section
  * fix license name
  * move 'changes' to the changes file
  * adding SUSE copyright (header) for spec file</changelog>
</package>
<package pkgid="be5ed980066122d59b4c098dced57fafaf3c450266fb878ebd21d530133641503c9ff97fbcb4b03e3673eff3878e63e05aca1b07bcd72db3c6e1375917441401" name="amass" arch="s390x">
  <version epoch="0" ver="5.1.1" rel="2.8"/>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1747310400">- Initial packaging at version 4.2.0</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1776600000">- Update to version 5.1.1:
  * Require Go v1.26.
  * Updated asset-db to v0.24.4.
  * Introduced the first version of the engine REST API.
  * Enhanced the dispatcher with a durable backlog and a bounded
  in-memory work queue.
  * Improved dynamic scope expansion rules and location matching
  accuracy.
  * Optimized the HTTP probe transport and overall engine
  performance.
  * https://github.com/owasp-amass/amass/releases/tag/v5.1.1
- Update to version 5.0.1:
  * Fixed a bug related to the -tf flag in the assoc subcommand.
  * Updated dependencies.
  * https://github.com/owasp-amass/amass/releases/tag/v5.0.1
- Update to version 5.0.0:
  * Upgraded the development environment and runtime to Go v1.24.
  * Updated core framework dependencies.
  * Redesigned the architecture to allow the Amass tool to function
  as a launcher and client for a detached engine instance.
  * Implemented a new session entity queue backed by SQLite.
  * Introduced the Aviato plugin, supporting company enrichment,
  funding rounds, and employee data API endpoints.
  * Enhanced Organization asset discovery with brand name
  extraction, parent/child relationship support, and improved
  deduplication logic.
  * Added the `oam_assoc` tool to manage database caching and
  asset associations.
  * Improved DNS TXT record service discovery and updated the
  project to support structured logging.
  * Refactored the caching system and moved the triples
  implementation into the asset-db repository.
  * Optimized the FQDN data pipeline and reduced DNS query timeouts
  for better performance.
  * Removed deprecated subcommands (including `subs` and `emails`)
  and legacy asset types.
  * https://github.com/owasp-amass/amass/releases/tag/v5.0.0</changelog>
</package>
<package pkgid="af106ce6c5f5d30fc44117462fa384c516edc907dbd45725e8675041015613383fbaedcb4aa964a5008fbec0bc9b54e2c577726452f613cfa9924bf2d04ac8da" name="amass" arch="src">
  <version epoch="0" ver="5.1.1" rel="2.8"/>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1747310400">- Initial packaging at version 4.2.0</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1776600000">- Update to version 5.1.1:
  * Require Go v1.26.
  * Updated asset-db to v0.24.4.
  * Introduced the first version of the engine REST API.
  * Enhanced the dispatcher with a durable backlog and a bounded
  in-memory work queue.
  * Improved dynamic scope expansion rules and location matching
  accuracy.
  * Optimized the HTTP probe transport and overall engine
  performance.
  * https://github.com/owasp-amass/amass/releases/tag/v5.1.1
- Update to version 5.0.1:
  * Fixed a bug related to the -tf flag in the assoc subcommand.
  * Updated dependencies.
  * https://github.com/owasp-amass/amass/releases/tag/v5.0.1
- Update to version 5.0.0:
  * Upgraded the development environment and runtime to Go v1.24.
  * Updated core framework dependencies.
  * Redesigned the architecture to allow the Amass tool to function
  as a launcher and client for a detached engine instance.
  * Implemented a new session entity queue backed by SQLite.
  * Introduced the Aviato plugin, supporting company enrichment,
  funding rounds, and employee data API endpoints.
  * Enhanced Organization asset discovery with brand name
  extraction, parent/child relationship support, and improved
  deduplication logic.
  * Added the `oam_assoc` tool to manage database caching and
  asset associations.
  * Improved DNS TXT record service discovery and updated the
  project to support structured logging.
  * Refactored the caching system and moved the triples
  implementation into the asset-db repository.
  * Optimized the FQDN data pipeline and reduced DNS query timeouts
  for better performance.
  * Removed deprecated subcommands (including `subs` and `emails`)
  and legacy asset types.
  * https://github.com/owasp-amass/amass/releases/tag/v5.0.0</changelog>
</package>
<package pkgid="c81427649b9e8a7028dea4ad151ebdd81f1f3a68345b5c09cf0795905972caa50d42a578fa2ca99b916952266ea65ee1724622b287ada27577e23f68c57a813b" name="amass-debuginfo" arch="s390x">
  <version epoch="0" ver="5.1.1" rel="2.8"/>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1747310400">- Initial packaging at version 4.2.0</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1776600000">- Update to version 5.1.1:
  * Require Go v1.26.
  * Updated asset-db to v0.24.4.
  * Introduced the first version of the engine REST API.
  * Enhanced the dispatcher with a durable backlog and a bounded
  in-memory work queue.
  * Improved dynamic scope expansion rules and location matching
  accuracy.
  * Optimized the HTTP probe transport and overall engine
  performance.
  * https://github.com/owasp-amass/amass/releases/tag/v5.1.1
- Update to version 5.0.1:
  * Fixed a bug related to the -tf flag in the assoc subcommand.
  * Updated dependencies.
  * https://github.com/owasp-amass/amass/releases/tag/v5.0.1
- Update to version 5.0.0:
  * Upgraded the development environment and runtime to Go v1.24.
  * Updated core framework dependencies.
  * Redesigned the architecture to allow the Amass tool to function
  as a launcher and client for a detached engine instance.
  * Implemented a new session entity queue backed by SQLite.
  * Introduced the Aviato plugin, supporting company enrichment,
  funding rounds, and employee data API endpoints.
  * Enhanced Organization asset discovery with brand name
  extraction, parent/child relationship support, and improved
  deduplication logic.
  * Added the `oam_assoc` tool to manage database caching and
  asset associations.
  * Improved DNS TXT record service discovery and updated the
  project to support structured logging.
  * Refactored the caching system and moved the triples
  implementation into the asset-db repository.
  * Optimized the FQDN data pipeline and reduced DNS query timeouts
  for better performance.
  * Removed deprecated subcommands (including `subs` and `emails`)
  and legacy asset types.
  * https://github.com/owasp-amass/amass/releases/tag/v5.0.0</changelog>
</package>
<package pkgid="d80a9ec472d28650e42255ecb2635e562bd8d8a1f67957c86ab8b8ed9ec1999e6cd5587bac0a0c00ec7059f20e083b304a6b49e467e929d2df85629a322cf06b" name="amtu" arch="s390x">
  <version epoch="0" ver="1.0.8" rel="49.32"/>
  <changelog author="thomas@novell.com" date="1248350400">- upgraded to version 1.0.8
- added patch for missing fclose() in src/memsep.c (bnc#523353)</changelog>
  <changelog author="thomas@novell.com" date="1248436800">- fixed %files section in spec file by adding %doc</changelog>
  <changelog author="jengelh@medozas.de" date="1265284800">- add ExclusiveArch to specfile, as the package only has source
  files for certain architectures and fails on SPARC.</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="coolo@suse.com" date="1322827200">- add automake as buildrequire to avoid implicit dependency</changelog>
  <changelog author="aj@suse.de" date="1331035200">- Remove obsolete suse_update_config call
- No need to run bootstrap, the automake etc files are good enough
- Cleanup spec file</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1591876800">- Add -fcommon to allow package to build with GCC10</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1652961600">- Use https:// url (http:// redirects to it anyway).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1712318400">- Use full URL for source.</changelog>
</package>
<package pkgid="9f2f6cbaa2e3e79b554d08ce79ccf676dc49d92e5db92f59b55338ad918c94b7f6fe216973e64a636d189740950675a23d38e6428e4d6214e8635a39ee492f5e" name="amtu" arch="src">
  <version epoch="0" ver="1.0.8" rel="49.32"/>
  <changelog author="thomas@suse.de" date="1093003200">- created initial package for EAL4 evaluation of SLES9</changelog>
  <changelog author="thomas@suse.de" date="1093521600">- added patch to make memory separation testcase work on
  machines with kernel f_pos race fix. it is needed due to
  new permissions on /proc/self/maps.</changelog>
  <changelog author="thomas@suse.de" date="1094472000">- added laus, laus-devel to needforbuild</changelog>
  <changelog author="draht@suse.de" date="1172577600">- port from sles9 tree to sle10-sp for SP1, initial package in
  CODE10
- version upgrade to 1.0.4; featuring audit (LAF) support for
  compliance with CAPP</changelog>
  <changelog author="ro@suse.de" date="1172836800">- fix buildreq</changelog>
  <changelog author="thomas@novell.com" date="1248350400">- upgraded to version 1.0.8
- added patch for missing fclose() in src/memsep.c (bnc#523353)</changelog>
  <changelog author="thomas@novell.com" date="1248436800">- fixed %files section in spec file by adding %doc</changelog>
  <changelog author="jengelh@medozas.de" date="1265284800">- add ExclusiveArch to specfile, as the package only has source
  files for certain architectures and fails on SPARC.</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="coolo@suse.com" date="1322827200">- add automake as buildrequire to avoid implicit dependency</changelog>
  <changelog author="aj@suse.de" date="1331035200">- Remove obsolete suse_update_config call
- No need to run bootstrap, the automake etc files are good enough
- Cleanup spec file</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1591876800">- Add -fcommon to allow package to build with GCC10</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1652961600">- Use https:// url (http:// redirects to it anyway).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1712318400">- Use full URL for source.</changelog>
</package>
<package pkgid="0093d9bbcf6775644c60a5eeb681abeff039b275761b4720b33c32da4cf38597ea69f04248a41941a8f1d4bcca6d3087350d850934a9abc7f1a1b41d5504e6eb" name="apg" arch="s390x">
  <version epoch="0" ver="2.2.3" rel="8.22"/>
  <changelog author="pascal.bleser@opensuse.org" date="1276603200">- initial package (2.2.3)</changelog>
  <changelog author="mpluskal@suse.com" date="1443441600">- Use url for source
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="d5963e272226e81ccf91b5394713d8babd9b6c2c589cb64f108daf9ff591775d0438bf8e6e318ddb97bc754da2f61a9473c20d77ca7c4f6610688295f3f28221" name="apg" arch="src">
  <version epoch="0" ver="2.2.3" rel="8.22"/>
  <changelog author="pascal.bleser@opensuse.org" date="1276603200">- initial package (2.2.3)</changelog>
  <changelog author="mpluskal@suse.com" date="1443441600">- Use url for source
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="400227d95a7a8878de41611b9762b3380ac0ff040fb1ef7e4ac4d62b3445e351cc3ad1602b335df225cbf51901317c187c7b7ec36ce636b15089efb256c2887f" name="apg-debuginfo" arch="s390x">
  <version epoch="0" ver="2.2.3" rel="8.22"/>
  <changelog author="pascal.bleser@opensuse.org" date="1276603200">- initial package (2.2.3)</changelog>
  <changelog author="mpluskal@suse.com" date="1443441600">- Use url for source
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="88eb8b2f41324ed8cc5bc5aec237057bc1b9390ba3e25f2794ec60bd432610f7b4c52292cf9a703600a4afa5fb8c360032c8ce6852d9aad7dbec70965abf48d6" name="apg-debugsource" arch="s390x">
  <version epoch="0" ver="2.2.3" rel="8.22"/>
  <changelog author="pascal.bleser@opensuse.org" date="1276603200">- initial package (2.2.3)</changelog>
  <changelog author="mpluskal@suse.com" date="1443441600">- Use url for source
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="688154f36689ff197167e1ef19fc146a78fec9e58854378dfffaf3cc345b6b9b964ec067dba81d0fc987c6da4d6fbf6c4e1e636012794cdb643df3378250f928" name="argon2" arch="s390x">
  <version epoch="0" ver="20190702" rel="34.19"/>
  <changelog author="hpj@urpla.net" date="1485604800">- make sure to call cc with -pthread option (implies -lpthread)
- run test suite</changelog>
  <changelog author="adam@mizerski.pl" date="1487851200">- moved argon2-specs.pdf to doc subpackage
- added packaging of man page</changelog>
  <changelog author="meissner@suse.com" date="1492516800">- ship libargon2.pc (bsc#1034441)</changelog>
  <changelog author="lnussel@suse.de" date="1515499200">- Update to version 0.0+git20171227.670229c:
  * Added ABI version number
  * AVX2/AVX-512F optimizations of BLAMKA
  * Set Argon2 version number from the command line
  * New bindings
  * Minor bug and warning fixes (no security issue)
- use _service file</changelog>
  <changelog author="jengelh@inai.de" date="1515499201">- Update description.</changelog>
  <changelog author="lnussel@suse.de" date="1517313600">- add baselibs.conf as cryptsetup also has 32bit variants</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1589284800">- Update to version 0.0+git20190520.62358ba (boo#1170512):
  * Fix the Makefile to install libargon2.pc.
  * Wait for already running threads if a thread creation failed.
  * Added Argon2 Erlang binding.
  * Additional JVM bindings (Jargon2).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1650715200">- Fix version of package: 20190702 is the upstream version number
  of the package
- Replaced optflags.patch with adjust-makefile.patch, the
  patch will now also allow to set the file permissions of installed
  libraries. This fixes the rpmlint error: shared-library-not-executable</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651060800">- use a source url</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="f0156f93ec809891353228a9807757a8119bc2eeb3056f6ed68141087dd5494e00dc95e82a50334cd5c5a4c820b553a65eeeb06d5adc308be854b16eb5e889d8" name="argon2" arch="src">
  <version epoch="0" ver="20190702" rel="34.19"/>
  <changelog author="idonmez@suse.com" date="1482235200">- Initial release</changelog>
  <changelog author="hpj@urpla.net" date="1485604800">- make sure to call cc with -pthread option (implies -lpthread)
- run test suite</changelog>
  <changelog author="adam@mizerski.pl" date="1487851200">- moved argon2-specs.pdf to doc subpackage
- added packaging of man page</changelog>
  <changelog author="meissner@suse.com" date="1492516800">- ship libargon2.pc (bsc#1034441)</changelog>
  <changelog author="lnussel@suse.de" date="1515499200">- Update to version 0.0+git20171227.670229c:
  * Added ABI version number
  * AVX2/AVX-512F optimizations of BLAMKA
  * Set Argon2 version number from the command line
  * New bindings
  * Minor bug and warning fixes (no security issue)
- use _service file</changelog>
  <changelog author="jengelh@inai.de" date="1515499201">- Update description.</changelog>
  <changelog author="lnussel@suse.de" date="1517313600">- add baselibs.conf as cryptsetup also has 32bit variants</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1589284800">- Update to version 0.0+git20190520.62358ba (boo#1170512):
  * Fix the Makefile to install libargon2.pc.
  * Wait for already running threads if a thread creation failed.
  * Added Argon2 Erlang binding.
  * Additional JVM bindings (Jargon2).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1650715200">- Fix version of package: 20190702 is the upstream version number
  of the package
- Replaced optflags.patch with adjust-makefile.patch, the
  patch will now also allow to set the file permissions of installed
  libraries. This fixes the rpmlint error: shared-library-not-executable</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651060800">- use a source url</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="7bfaec5fa8a1bedae664f0b098e7bb56523279c20bec844d64a5d3e007e3f730a8c5921c8a1b40411dbf1c7e67283948a11427cfd18ce5b90ea503192947821b" name="argon2-debuginfo" arch="s390x">
  <version epoch="0" ver="20190702" rel="34.19"/>
  <changelog author="hpj@urpla.net" date="1485604800">- make sure to call cc with -pthread option (implies -lpthread)
- run test suite</changelog>
  <changelog author="adam@mizerski.pl" date="1487851200">- moved argon2-specs.pdf to doc subpackage
- added packaging of man page</changelog>
  <changelog author="meissner@suse.com" date="1492516800">- ship libargon2.pc (bsc#1034441)</changelog>
  <changelog author="lnussel@suse.de" date="1515499200">- Update to version 0.0+git20171227.670229c:
  * Added ABI version number
  * AVX2/AVX-512F optimizations of BLAMKA
  * Set Argon2 version number from the command line
  * New bindings
  * Minor bug and warning fixes (no security issue)
- use _service file</changelog>
  <changelog author="jengelh@inai.de" date="1515499201">- Update description.</changelog>
  <changelog author="lnussel@suse.de" date="1517313600">- add baselibs.conf as cryptsetup also has 32bit variants</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1589284800">- Update to version 0.0+git20190520.62358ba (boo#1170512):
  * Fix the Makefile to install libargon2.pc.
  * Wait for already running threads if a thread creation failed.
  * Added Argon2 Erlang binding.
  * Additional JVM bindings (Jargon2).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1650715200">- Fix version of package: 20190702 is the upstream version number
  of the package
- Replaced optflags.patch with adjust-makefile.patch, the
  patch will now also allow to set the file permissions of installed
  libraries. This fixes the rpmlint error: shared-library-not-executable</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651060800">- use a source url</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="fa03960f16b60c7d376e0aeff2d4381aa2fc19af3551d736613619b259264913400ecb4ba03600a3d18edbd7edd146241af7526d24e778c73137207967fe8f08" name="argon2-debugsource" arch="s390x">
  <version epoch="0" ver="20190702" rel="34.19"/>
  <changelog author="hpj@urpla.net" date="1485604800">- make sure to call cc with -pthread option (implies -lpthread)
- run test suite</changelog>
  <changelog author="adam@mizerski.pl" date="1487851200">- moved argon2-specs.pdf to doc subpackage
- added packaging of man page</changelog>
  <changelog author="meissner@suse.com" date="1492516800">- ship libargon2.pc (bsc#1034441)</changelog>
  <changelog author="lnussel@suse.de" date="1515499200">- Update to version 0.0+git20171227.670229c:
  * Added ABI version number
  * AVX2/AVX-512F optimizations of BLAMKA
  * Set Argon2 version number from the command line
  * New bindings
  * Minor bug and warning fixes (no security issue)
- use _service file</changelog>
  <changelog author="jengelh@inai.de" date="1515499201">- Update description.</changelog>
  <changelog author="lnussel@suse.de" date="1517313600">- add baselibs.conf as cryptsetup also has 32bit variants</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1589284800">- Update to version 0.0+git20190520.62358ba (boo#1170512):
  * Fix the Makefile to install libargon2.pc.
  * Wait for already running threads if a thread creation failed.
  * Added Argon2 Erlang binding.
  * Additional JVM bindings (Jargon2).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1650715200">- Fix version of package: 20190702 is the upstream version number
  of the package
- Replaced optflags.patch with adjust-makefile.patch, the
  patch will now also allow to set the file permissions of installed
  libraries. This fixes the rpmlint error: shared-library-not-executable</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651060800">- use a source url</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="e2f8cabd5c5261e8ad75604d181afab18e7cdaf64f9364ac9221e0b9d158832a58b48eaf480ca36d91feb5fc9ca265c03c93b627458febb05f343ef0c0683c9a" name="argon2-devel" arch="s390x">
  <version epoch="0" ver="20190702" rel="34.19"/>
  <changelog author="hpj@urpla.net" date="1485604800">- make sure to call cc with -pthread option (implies -lpthread)
- run test suite</changelog>
  <changelog author="adam@mizerski.pl" date="1487851200">- moved argon2-specs.pdf to doc subpackage
- added packaging of man page</changelog>
  <changelog author="meissner@suse.com" date="1492516800">- ship libargon2.pc (bsc#1034441)</changelog>
  <changelog author="lnussel@suse.de" date="1515499200">- Update to version 0.0+git20171227.670229c:
  * Added ABI version number
  * AVX2/AVX-512F optimizations of BLAMKA
  * Set Argon2 version number from the command line
  * New bindings
  * Minor bug and warning fixes (no security issue)
- use _service file</changelog>
  <changelog author="jengelh@inai.de" date="1515499201">- Update description.</changelog>
  <changelog author="lnussel@suse.de" date="1517313600">- add baselibs.conf as cryptsetup also has 32bit variants</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1589284800">- Update to version 0.0+git20190520.62358ba (boo#1170512):
  * Fix the Makefile to install libargon2.pc.
  * Wait for already running threads if a thread creation failed.
  * Added Argon2 Erlang binding.
  * Additional JVM bindings (Jargon2).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1650715200">- Fix version of package: 20190702 is the upstream version number
  of the package
- Replaced optflags.patch with adjust-makefile.patch, the
  patch will now also allow to set the file permissions of installed
  libraries. This fixes the rpmlint error: shared-library-not-executable</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651060800">- use a source url</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="7d9859c40eafb8c8173dd144e854a0a2b9d938ba0b8437a12510b4877b3beb3cb87a947bc3d020eb4f3537684b5de7ec5cb5b976646a03e9f3120876c47b2aa0" name="argon2-doc" arch="noarch">
  <version epoch="0" ver="20190702" rel="34.19"/>
  <changelog author="hpj@urpla.net" date="1485604800">- make sure to call cc with -pthread option (implies -lpthread)
- run test suite</changelog>
  <changelog author="adam@mizerski.pl" date="1487851200">- moved argon2-specs.pdf to doc subpackage
- added packaging of man page</changelog>
  <changelog author="meissner@suse.com" date="1492516800">- ship libargon2.pc (bsc#1034441)</changelog>
  <changelog author="lnussel@suse.de" date="1515499200">- Update to version 0.0+git20171227.670229c:
  * Added ABI version number
  * AVX2/AVX-512F optimizations of BLAMKA
  * Set Argon2 version number from the command line
  * New bindings
  * Minor bug and warning fixes (no security issue)
- use _service file</changelog>
  <changelog author="jengelh@inai.de" date="1515499201">- Update description.</changelog>
  <changelog author="lnussel@suse.de" date="1517313600">- add baselibs.conf as cryptsetup also has 32bit variants</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1589284800">- Update to version 0.0+git20190520.62358ba (boo#1170512):
  * Fix the Makefile to install libargon2.pc.
  * Wait for already running threads if a thread creation failed.
  * Added Argon2 Erlang binding.
  * Additional JVM bindings (Jargon2).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1650715200">- Fix version of package: 20190702 is the upstream version number
  of the package
- Replaced optflags.patch with adjust-makefile.patch, the
  patch will now also allow to set the file permissions of installed
  libraries. This fixes the rpmlint error: shared-library-not-executable</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651060800">- use a source url</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="5cb879fa3746e0c42cdcd4273d09a3b2204b85d242dbf317309a454fefcef77d94b8168cc0b57480008c771aded10cf391cdacfeefb03e8fb5da071d0df38bef" name="arp-scan" arch="s390x">
  <version epoch="0" ver="1.10.0" rel="28.3"/>
  <changelog author="mpluskal@suse.com" date="1431000000">- Update licensing information</changelog>
  <changelog author="mpluskal@suse.com" date="1455451200">- Update project and download url</changelog>
  <changelog author="meissner@suse.com" date="1462968000">- arp-scan-avoid-crash.patch: avoid crash when trying capture as
  user (bsc#978596)</changelog>
  <changelog author="mpluskal@suse.com" date="1526904000">- Cleanup spec file with spec-cleaner
- Adjust dependencies</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1551787200">- Update to version 1.9.5:
  * Updated IEEE OUI and IAB MAC/Vendor files.
  * Added new --plain (-x) option to surpress printing of header
    and footer text, and only display one output line for each
    responding host.
  * Use LWP::UserAgent instead of LWP::Simple in get-oui and
    get-iab to enable the raw content to be obtained, which avoids
    Unicode/UTF-8 issues.
  * Added arp-finherprint patterns for WIZnet W5100 and Cisco IOS
    15.0.
- Drop no longer needed arp-scan-avoid-crash.patch</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1572004800">- Update to version 1.9.6 (boo#1154552):
  * Use libpcap function pcap_set_immediate_mode() instead of ioctl
    calls to ensure packets are delivered immediately. This means
    that arp-scan now requires libpcap 1.5.0 or later and will
    not work with earlier libpcap versions</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1573732800">- Update to version 1.9.7:
  * Internal changes only</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dirk@matrix&gt;" date="1670241600">- update to 1.9.8:
  - Allow the use of Linux IP aliases such as eth0:0 for the interface name.
  - Permit regular MAC addresses e.g. 00:0c:29:b9:43:1b in mac-vendor.txt.
  - --limit=n option exits after n of hosts have responded, exit 1 for &lt;n
  - --resolve option to resolve responding IP addresses to hostnames
  - Potential buffer overrun in unmarshal_arp_pkt().
  - arp-scan aborts with EAGAIN on busy network or using high bandwidth
  - late ARP responses could sometimes be incorrectly flagged as duplicate
  - Updated IEEE URLs in download perl scripts.
  - Updated source for Mersenne RNG and replacement strlcat/strlcpy &amp; getopt.
  - Updated for compatability with autoconf 2.71
  - "make distcheck" works now
  - Number of responding hosts reported no longer counts duplicate packets.
  - Many typos corrected and edge cases fixed.
  - CI framework migrated from travis-ci to github actions.
  - Several new tests for "make check"</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1677672000">- update to 1.10.0
  * Support for POSIX.1e capabilities. Administrators can set
    cap_net_raw+p on the arp-scan binaries to allow non-root users
    to run arp scan if desired
  * MAC/Vendor file layout changed. /etc/arp-scan/mac-vendor.txt
    allows for local configuration
- build with upstream tarball</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1782129600">- Add arp-scan-EACCES-as-ENOENT.patch: treat EACCES like ENOENT when
  stat'ing the MAC/vendor mapping file (ieee-oui.txt / mac-vendor.txt)
  in the current directory, so arp-scan falls through to the system
  datadir instead of failing with "Permission denied"
  (boo#1210703, gh#royhills/arp-scan#120)
- Drop obsolete RPM group</changelog>
</package>
<package pkgid="d5d2a7fb852055838fee9e1d55430c2787cc5573deca73a85b917622d06c1edbf0eaaffba483b42acecac4dfa021e51beff9cf0529bf1a7e55d263fa152ad846" name="arp-scan" arch="src">
  <version epoch="0" ver="1.10.0" rel="28.3"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1237550400">- Initial RPM</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1299499200">- update to 1.8:
  * the IEEE OUI and IAB files were updated
  * support was added for trailer ARP replies
  * support for LLC/SNAP packets with the 802.1Q tag was added
  * full help output is no longer displayed for usage errors
  * the license was changed from GPL v2 to v3
  * a DoS warning was added to the manpage and help output
  * new arp fingerprints were added
  * gcc compiler security options were enabled
  * the Perl scripts were modified to work on systems where the perl executable
    is not in /usr/bin
  * various minor bugfixes and improvements were made</changelog>
  <changelog author="mpluskal@suse.com" date="1431000000">- Update to 1.9
- Cleanup spec file with spec-cleaner
- Update project url
- Use url for source</changelog>
  <changelog author="mpluskal@suse.com" date="1431000001">- Update licensing information</changelog>
  <changelog author="mpluskal@suse.com" date="1455451200">- Update project and download url</changelog>
  <changelog author="meissner@suse.com" date="1462968000">- arp-scan-avoid-crash.patch: avoid crash when trying capture as
  user (bsc#978596)</changelog>
  <changelog author="mpluskal@suse.com" date="1526904000">- Cleanup spec file with spec-cleaner
- Adjust dependencies</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1551787200">- Update to version 1.9.5:
  * Updated IEEE OUI and IAB MAC/Vendor files.
  * Added new --plain (-x) option to surpress printing of header
    and footer text, and only display one output line for each
    responding host.
  * Use LWP::UserAgent instead of LWP::Simple in get-oui and
    get-iab to enable the raw content to be obtained, which avoids
    Unicode/UTF-8 issues.
  * Added arp-finherprint patterns for WIZnet W5100 and Cisco IOS
    15.0.
- Drop no longer needed arp-scan-avoid-crash.patch</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1572004800">- Update to version 1.9.6 (boo#1154552):
  * Use libpcap function pcap_set_immediate_mode() instead of ioctl
    calls to ensure packets are delivered immediately. This means
    that arp-scan now requires libpcap 1.5.0 or later and will
    not work with earlier libpcap versions</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1573732800">- Update to version 1.9.7:
  * Internal changes only</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dirk@matrix&gt;" date="1670241600">- update to 1.9.8:
  - Allow the use of Linux IP aliases such as eth0:0 for the interface name.
  - Permit regular MAC addresses e.g. 00:0c:29:b9:43:1b in mac-vendor.txt.
  - --limit=n option exits after n of hosts have responded, exit 1 for &lt;n
  - --resolve option to resolve responding IP addresses to hostnames
  - Potential buffer overrun in unmarshal_arp_pkt().
  - arp-scan aborts with EAGAIN on busy network or using high bandwidth
  - late ARP responses could sometimes be incorrectly flagged as duplicate
  - Updated IEEE URLs in download perl scripts.
  - Updated source for Mersenne RNG and replacement strlcat/strlcpy &amp; getopt.
  - Updated for compatability with autoconf 2.71
  - "make distcheck" works now
  - Number of responding hosts reported no longer counts duplicate packets.
  - Many typos corrected and edge cases fixed.
  - CI framework migrated from travis-ci to github actions.
  - Several new tests for "make check"</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1677672000">- update to 1.10.0
  * Support for POSIX.1e capabilities. Administrators can set
    cap_net_raw+p on the arp-scan binaries to allow non-root users
    to run arp scan if desired
  * MAC/Vendor file layout changed. /etc/arp-scan/mac-vendor.txt
    allows for local configuration
- build with upstream tarball</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1782129600">- Add arp-scan-EACCES-as-ENOENT.patch: treat EACCES like ENOENT when
  stat'ing the MAC/vendor mapping file (ieee-oui.txt / mac-vendor.txt)
  in the current directory, so arp-scan falls through to the system
  datadir instead of failing with "Permission denied"
  (boo#1210703, gh#royhills/arp-scan#120)
- Drop obsolete RPM group</changelog>
</package>
<package pkgid="a71eaf0ce78d548e116ab7aada3b5755ef93af44eb9df727e87903aa1a17855a3a0fef6ee840e06902372332b876c8d8d8791d33554d362689e3bc1fb77dce12" name="arp-scan-debuginfo" arch="s390x">
  <version epoch="0" ver="1.10.0" rel="28.3"/>
  <changelog author="mpluskal@suse.com" date="1431000000">- Update licensing information</changelog>
  <changelog author="mpluskal@suse.com" date="1455451200">- Update project and download url</changelog>
  <changelog author="meissner@suse.com" date="1462968000">- arp-scan-avoid-crash.patch: avoid crash when trying capture as
  user (bsc#978596)</changelog>
  <changelog author="mpluskal@suse.com" date="1526904000">- Cleanup spec file with spec-cleaner
- Adjust dependencies</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1551787200">- Update to version 1.9.5:
  * Updated IEEE OUI and IAB MAC/Vendor files.
  * Added new --plain (-x) option to surpress printing of header
    and footer text, and only display one output line for each
    responding host.
  * Use LWP::UserAgent instead of LWP::Simple in get-oui and
    get-iab to enable the raw content to be obtained, which avoids
    Unicode/UTF-8 issues.
  * Added arp-finherprint patterns for WIZnet W5100 and Cisco IOS
    15.0.
- Drop no longer needed arp-scan-avoid-crash.patch</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1572004800">- Update to version 1.9.6 (boo#1154552):
  * Use libpcap function pcap_set_immediate_mode() instead of ioctl
    calls to ensure packets are delivered immediately. This means
    that arp-scan now requires libpcap 1.5.0 or later and will
    not work with earlier libpcap versions</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1573732800">- Update to version 1.9.7:
  * Internal changes only</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dirk@matrix&gt;" date="1670241600">- update to 1.9.8:
  - Allow the use of Linux IP aliases such as eth0:0 for the interface name.
  - Permit regular MAC addresses e.g. 00:0c:29:b9:43:1b in mac-vendor.txt.
  - --limit=n option exits after n of hosts have responded, exit 1 for &lt;n
  - --resolve option to resolve responding IP addresses to hostnames
  - Potential buffer overrun in unmarshal_arp_pkt().
  - arp-scan aborts with EAGAIN on busy network or using high bandwidth
  - late ARP responses could sometimes be incorrectly flagged as duplicate
  - Updated IEEE URLs in download perl scripts.
  - Updated source for Mersenne RNG and replacement strlcat/strlcpy &amp; getopt.
  - Updated for compatability with autoconf 2.71
  - "make distcheck" works now
  - Number of responding hosts reported no longer counts duplicate packets.
  - Many typos corrected and edge cases fixed.
  - CI framework migrated from travis-ci to github actions.
  - Several new tests for "make check"</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1677672000">- update to 1.10.0
  * Support for POSIX.1e capabilities. Administrators can set
    cap_net_raw+p on the arp-scan binaries to allow non-root users
    to run arp scan if desired
  * MAC/Vendor file layout changed. /etc/arp-scan/mac-vendor.txt
    allows for local configuration
- build with upstream tarball</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1782129600">- Add arp-scan-EACCES-as-ENOENT.patch: treat EACCES like ENOENT when
  stat'ing the MAC/vendor mapping file (ieee-oui.txt / mac-vendor.txt)
  in the current directory, so arp-scan falls through to the system
  datadir instead of failing with "Permission denied"
  (boo#1210703, gh#royhills/arp-scan#120)
- Drop obsolete RPM group</changelog>
</package>
<package pkgid="4e91694c9e732eb113fbc046079f3e375510f48e33fe60f602f55e66f7011776b39c785fb94d5428940456e7509b71e805c907456f11689710bdd9cbc01a37f7" name="arp-scan-debugsource" arch="s390x">
  <version epoch="0" ver="1.10.0" rel="28.3"/>
  <changelog author="mpluskal@suse.com" date="1431000000">- Update licensing information</changelog>
  <changelog author="mpluskal@suse.com" date="1455451200">- Update project and download url</changelog>
  <changelog author="meissner@suse.com" date="1462968000">- arp-scan-avoid-crash.patch: avoid crash when trying capture as
  user (bsc#978596)</changelog>
  <changelog author="mpluskal@suse.com" date="1526904000">- Cleanup spec file with spec-cleaner
- Adjust dependencies</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1551787200">- Update to version 1.9.5:
  * Updated IEEE OUI and IAB MAC/Vendor files.
  * Added new --plain (-x) option to surpress printing of header
    and footer text, and only display one output line for each
    responding host.
  * Use LWP::UserAgent instead of LWP::Simple in get-oui and
    get-iab to enable the raw content to be obtained, which avoids
    Unicode/UTF-8 issues.
  * Added arp-finherprint patterns for WIZnet W5100 and Cisco IOS
    15.0.
- Drop no longer needed arp-scan-avoid-crash.patch</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1572004800">- Update to version 1.9.6 (boo#1154552):
  * Use libpcap function pcap_set_immediate_mode() instead of ioctl
    calls to ensure packets are delivered immediately. This means
    that arp-scan now requires libpcap 1.5.0 or later and will
    not work with earlier libpcap versions</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1573732800">- Update to version 1.9.7:
  * Internal changes only</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dirk@matrix&gt;" date="1670241600">- update to 1.9.8:
  - Allow the use of Linux IP aliases such as eth0:0 for the interface name.
  - Permit regular MAC addresses e.g. 00:0c:29:b9:43:1b in mac-vendor.txt.
  - --limit=n option exits after n of hosts have responded, exit 1 for &lt;n
  - --resolve option to resolve responding IP addresses to hostnames
  - Potential buffer overrun in unmarshal_arp_pkt().
  - arp-scan aborts with EAGAIN on busy network or using high bandwidth
  - late ARP responses could sometimes be incorrectly flagged as duplicate
  - Updated IEEE URLs in download perl scripts.
  - Updated source for Mersenne RNG and replacement strlcat/strlcpy &amp; getopt.
  - Updated for compatability with autoconf 2.71
  - "make distcheck" works now
  - Number of responding hosts reported no longer counts duplicate packets.
  - Many typos corrected and edge cases fixed.
  - CI framework migrated from travis-ci to github actions.
  - Several new tests for "make check"</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1677672000">- update to 1.10.0
  * Support for POSIX.1e capabilities. Administrators can set
    cap_net_raw+p on the arp-scan binaries to allow non-root users
    to run arp scan if desired
  * MAC/Vendor file layout changed. /etc/arp-scan/mac-vendor.txt
    allows for local configuration
- build with upstream tarball</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1782129600">- Add arp-scan-EACCES-as-ENOENT.patch: treat EACCES like ENOENT when
  stat'ing the MAC/vendor mapping file (ieee-oui.txt / mac-vendor.txt)
  in the current directory, so arp-scan falls through to the system
  datadir instead of failing with "Permission denied"
  (boo#1210703, gh#royhills/arp-scan#120)
- Drop obsolete RPM group</changelog>
</package>
<package pkgid="31f5ce1b1a7b1b188d0028b1c2ba0e4579e1518358702306d0b535d1915b32aca3bbd159fd9c4f0758d868bc7c1d927133ff89a662d9961e19771e53b29a2430" name="arpwatch" arch="s390x">
  <version epoch="0" ver="3.9" rel="193.7"/>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647864000">- update to 3.2:
  - Change update-ethercodes to not clobber ethercodes.dat on failure.
  - Add a configure option to specify the path to sendmail
- use https, its 2022 after all</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1651060800">- Update to version 3.3:
  + Fix direction of memmove() in sanity_fddi().</changelog>
  <changelog author="olaf@aepfle.de" date="1670328000">- Enable loading of ethercodes.dat with arpwatch.ETHERCODES.patch
- Log useless 0-source only once for each MAC</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1697371200">- update to 3.4:
  * build system maintenance (upgrade to autoconf 2.71)
  * add arpwatch-3.4-include-time.patch to fix build broken by it</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1704542400">- update to 3.5:
  * Make SIGHUP checkpoint arp.dat
  * Fix bug that prevented checkpoint() from being called until
    after receiving a new arp/rarp packet</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1705924800">- update to 3.6:
  * Fix bug that prevented checkpoint() from being called until
    after receiving a new arp/rarp packet
  * Remove unconditional FreeBSD configure mandir hack</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1721908800">- arpwatch-gcc14.patch: fixed gcc14 issue</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1753963200">- Update to version 3.8:
  * update-ethercodes.sh: exit when curls fails.
- Update to version 3.7:
  * Complete switch to python massagevendor.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1761307200">- Update to version 3.9:
  * Use mktemp(1) to obtain a temporary file for update-ethercodes</changelog>
</package>
<package pkgid="1a36fc32dd2ef54ae4a307d8f3c66ecc4888506211307f5b4af1264e62e28aa25dfa7ba9633eb7d9c59e914b911691b12b7342f3eeac63bbdeed7c46dcb13ea4" name="arpwatch" arch="src">
  <version epoch="0" ver="3.9" rel="193.7"/>
  <changelog author="Stefan Seyfried &lt;seife+obs@b1-systems.com&gt;" date="1557230400">- add 0001-Ignore-802.1Q-frames.patch to fix log spam on networks
  with configured VLANs. (deb#625796)</changelog>
  <changelog author="Hans-Peter Jansen &lt;hpj@urpla.net&gt;" date="1602936000">- add report-iface.patch to see, where the offending change happened</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="olaf@aepfle.de" date="1611835201">- report MAC as HH:HH:HH:HH:HH:HH with arpwatch-MAC.patch
- remove unused ARPWATCH_INTERFACE= from sysconfig template
- schedule arpwatch.service after exim/postfix/sendmail
- remove arpwatch@.service from postinstall scriptlets to avoid warning
  in case no instance is configured
- move service_add_post to end of script because the macro exit
  the script early</changelog>
  <changelog author="olaf@aepfle.de" date="1612180800">- exit cleanly on SIGTERM with arpwatch-exit.patch
- refresh all patches for autosetup</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments. I tried hard to do this in a script
  but no matter if sed, awk or perl is used something always breaks</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1624968000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)
- Added service_* calls for the @.service file</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1628683200">- Added hardening to systemd service(s). Modified:
  * arpwatch.service
  * arpwatch@.service</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1630670400">- Update to version 3.1 (bsc#1185939)
  * Dropped
    + arpwatch-2.1a11-emailaddr.dif, this is now supported upstream.
    Incompatible change: Flags change from -e and -s to -w and -W
    + arpwatch-2.1a11-hname-overflow.dif: included upstream
    + arpwatch-2.1a11-tokenring.diff: Dropped token ring support
    + arpwatch-2.1a15-massagevendor.patch: new python version
    is available
    + arpwatch-MAC.patch: Fix is upstream
    + getnameinfo.patch
  * Refreshed
    + 0001-Ignore-802.1Q-frames.patch
    + arp2ethers.patch
  * Notable upstream changes:
    + Add python 2 compatibility to massagevendor (for pfsense &lt;= 2.4.4).
    + Add -Z (zero pad) and -C (compact) flags to arpwatch and arpsnmp to allow
    run time selection of zero padded or compact ethernet addresses in arp.dat.
    + arpsnmp errors now go to stderr instead of syslog.
    + Add arpwatch directory flag (-D)
    + Added the -x flag which is like -n but excludes cidrs</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1630670401">- Remove accidentially checked in manpage (arpwatch.8)</changelog>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647864000">- update to 3.2:
  - Change update-ethercodes to not clobber ethercodes.dat on failure.
  - Add a configure option to specify the path to sendmail
- use https, its 2022 after all</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1651060800">- Update to version 3.3:
  + Fix direction of memmove() in sanity_fddi().</changelog>
  <changelog author="olaf@aepfle.de" date="1670328000">- Enable loading of ethercodes.dat with arpwatch.ETHERCODES.patch
- Log useless 0-source only once for each MAC</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1697371200">- update to 3.4:
  * build system maintenance (upgrade to autoconf 2.71)
  * add arpwatch-3.4-include-time.patch to fix build broken by it</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1704542400">- update to 3.5:
  * Make SIGHUP checkpoint arp.dat
  * Fix bug that prevented checkpoint() from being called until
    after receiving a new arp/rarp packet</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1705924800">- update to 3.6:
  * Fix bug that prevented checkpoint() from being called until
    after receiving a new arp/rarp packet
  * Remove unconditional FreeBSD configure mandir hack</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1721908800">- arpwatch-gcc14.patch: fixed gcc14 issue</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1753963200">- Update to version 3.8:
  * update-ethercodes.sh: exit when curls fails.
- Update to version 3.7:
  * Complete switch to python massagevendor.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1761307200">- Update to version 3.9:
  * Use mktemp(1) to obtain a temporary file for update-ethercodes</changelog>
</package>
<package pkgid="07fdc185d8c3f9901b2e495ae48510085bf6da5b704c4795b0ac5ccf623d713aef55a1e0f9ba6f7449b73698c2c025efab36db564c389d8c1c7667ba4c467e8b" name="arpwatch-debuginfo" arch="s390x">
  <version epoch="0" ver="3.9" rel="193.7"/>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647864000">- update to 3.2:
  - Change update-ethercodes to not clobber ethercodes.dat on failure.
  - Add a configure option to specify the path to sendmail
- use https, its 2022 after all</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1651060800">- Update to version 3.3:
  + Fix direction of memmove() in sanity_fddi().</changelog>
  <changelog author="olaf@aepfle.de" date="1670328000">- Enable loading of ethercodes.dat with arpwatch.ETHERCODES.patch
- Log useless 0-source only once for each MAC</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1697371200">- update to 3.4:
  * build system maintenance (upgrade to autoconf 2.71)
  * add arpwatch-3.4-include-time.patch to fix build broken by it</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1704542400">- update to 3.5:
  * Make SIGHUP checkpoint arp.dat
  * Fix bug that prevented checkpoint() from being called until
    after receiving a new arp/rarp packet</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1705924800">- update to 3.6:
  * Fix bug that prevented checkpoint() from being called until
    after receiving a new arp/rarp packet
  * Remove unconditional FreeBSD configure mandir hack</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1721908800">- arpwatch-gcc14.patch: fixed gcc14 issue</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1753963200">- Update to version 3.8:
  * update-ethercodes.sh: exit when curls fails.
- Update to version 3.7:
  * Complete switch to python massagevendor.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1761307200">- Update to version 3.9:
  * Use mktemp(1) to obtain a temporary file for update-ethercodes</changelog>
</package>
<package pkgid="b41198a99ba5cae7eae144f51d4facb2d6cd4c4686d1f6e712814f4c76faf868ffad4c863d22a60c863176402b10e2a110a5393557d3d8e32583a60e6acaf97e" name="arpwatch-debugsource" arch="s390x">
  <version epoch="0" ver="3.9" rel="193.7"/>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647864000">- update to 3.2:
  - Change update-ethercodes to not clobber ethercodes.dat on failure.
  - Add a configure option to specify the path to sendmail
- use https, its 2022 after all</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1651060800">- Update to version 3.3:
  + Fix direction of memmove() in sanity_fddi().</changelog>
  <changelog author="olaf@aepfle.de" date="1670328000">- Enable loading of ethercodes.dat with arpwatch.ETHERCODES.patch
- Log useless 0-source only once for each MAC</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1697371200">- update to 3.4:
  * build system maintenance (upgrade to autoconf 2.71)
  * add arpwatch-3.4-include-time.patch to fix build broken by it</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1704542400">- update to 3.5:
  * Make SIGHUP checkpoint arp.dat
  * Fix bug that prevented checkpoint() from being called until
    after receiving a new arp/rarp packet</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1705924800">- update to 3.6:
  * Fix bug that prevented checkpoint() from being called until
    after receiving a new arp/rarp packet
  * Remove unconditional FreeBSD configure mandir hack</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1721908800">- arpwatch-gcc14.patch: fixed gcc14 issue</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1753963200">- Update to version 3.8:
  * update-ethercodes.sh: exit when curls fails.
- Update to version 3.7:
  * Complete switch to python massagevendor.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1761307200">- Update to version 3.9:
  * Use mktemp(1) to obtain a temporary file for update-ethercodes</changelog>
</package>
<package pkgid="77c8dcc79a48879364077016ba03670e83d9c6a740183e60d6c41160f3a964f26775342467fc90e29c50d7fb163ca64f86b603caa4bf969c0a7afeafa8acb7d0" name="arpwatch-ethercodes" arch="noarch">
  <version epoch="0" ver="20250404" rel="29.5"/>
  <changelog author="olaf@aepfle.de" date="1668168000">- sort existing oui.csv to show differences in future updates
- sort downloaded oui.csv
- move vim commands to a place where vim can find the commands</changelog>
  <changelog author="olaf@aepfle.de" date="1670846400">- Update to version 20221212</changelog>
  <changelog author="olaf@aepfle.de" date="1675944000">- Update to version 20230209</changelog>
  <changelog author="olaf@aepfle.de" date="1681992000">- Update to version 20230420
- Inject a QEMU/KVM entry</changelog>
  <changelog author="olaf@aepfle.de" date="1691496000">- Update to version 20230808</changelog>
  <changelog author="olaf@aepfle.de" date="1702382400">- Update to version 20231212</changelog>
  <changelog author="olaf@aepfle.de" date="1712232000">- Update to version 20240404</changelog>
  <changelog author="olaf@aepfle.de" date="1723118400">- Update to version 20240808</changelog>
  <changelog author="olaf@aepfle.de" date="1734004800">- Update to version 20241212</changelog>
  <changelog author="olaf@aepfle.de" date="1743768000">- Update to version 20250404</changelog>
</package>
<package pkgid="de6cb6796324ebe7b1a0f0ece0560435590873ba16941c0e1be88c0e39bfa3e3d6c2df961b170b93a1774c075701f3c5bba11ee55cfa180c966cef0dc16beb75" name="arpwatch-ethercodes" arch="src">
  <version epoch="0" ver="20250404" rel="29.5"/>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="autobuild@suse.de" date="1311422400">- automated update on 2011-07-23</changelog>
  <changelog author="autobuild@suse.de" date="1316520000">- automated update on 2011-09-20</changelog>
  <changelog author="autobuild@suse.de" date="1360497600">- automated update on 2013-02-10</changelog>
  <changelog author="coolo@suse.com" date="1404302400">- manual update on 2014-07-02</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- merge oui data base from 2015-06-19</changelog>
  <changelog author="mpluskal@suse.com" date="1459080000">- Update to 2016-03-28</changelog>
  <changelog author="Hans-Peter Jansen &lt;hpj@urpla.net&gt;" date="1537963200">- supply a new python3 script, that fetches (in local builds) and
  generates ethercodes.dat
- update to version 20180926_160344</changelog>
  <changelog author="Hans-Peter Jansen &lt;hpj@urpla.net&gt;" date="1603713600">- Update to version 20201026_100149</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1605009600">- Removed URL for source0 as this causes issues with our bots</changelog>
  <changelog author="olaf@aepfle.de" date="1668168000">- sort existing oui.csv to show differences in future updates
- sort downloaded oui.csv
- move vim commands to a place where vim can find the commands</changelog>
  <changelog author="olaf@aepfle.de" date="1670846400">- Update to version 20221212</changelog>
  <changelog author="olaf@aepfle.de" date="1675944000">- Update to version 20230209</changelog>
  <changelog author="olaf@aepfle.de" date="1681992000">- Update to version 20230420
- Inject a QEMU/KVM entry</changelog>
  <changelog author="olaf@aepfle.de" date="1691496000">- Update to version 20230808</changelog>
  <changelog author="olaf@aepfle.de" date="1702382400">- Update to version 20231212</changelog>
  <changelog author="olaf@aepfle.de" date="1712232000">- Update to version 20240404</changelog>
  <changelog author="olaf@aepfle.de" date="1723118400">- Update to version 20240808</changelog>
  <changelog author="olaf@aepfle.de" date="1734004800">- Update to version 20241212</changelog>
  <changelog author="olaf@aepfle.de" date="1743768000">- Update to version 20250404</changelog>
</package>
<package pkgid="523ab1760930d7023895c27243d78f43bad6b6296ddd429315b56c0cc384d25c0e71aebc485d66ff8b3757c54834c92c3232ef0a5c251ddea75e3a3b0403b838" name="arpwatch-ethercodes-build" arch="s390x">
  <version epoch="0" ver="3.9" rel="193.7"/>
  <changelog author="olaf@aepfle.de" date="1641816000">- remove instance units from post scripts, they can not be reloaded</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647864000">- update to 3.2:
  - Change update-ethercodes to not clobber ethercodes.dat on failure.
  - Add a configure option to specify the path to sendmail
- use https, its 2022 after all</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1651060800">- Update to version 3.3:
  + Fix direction of memmove() in sanity_fddi().</changelog>
  <changelog author="olaf@aepfle.de" date="1670328000">- Enable loading of ethercodes.dat with arpwatch.ETHERCODES.patch
- Log useless 0-source only once for each MAC</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1697371200">- update to 3.4:
  * build system maintenance (upgrade to autoconf 2.71)
  * add arpwatch-3.4-include-time.patch to fix build broken by it</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1704542400">- update to 3.5:
  * Make SIGHUP checkpoint arp.dat
  * Fix bug that prevented checkpoint() from being called until
    after receiving a new arp/rarp packet</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1705924800">- update to 3.6:
  * Fix bug that prevented checkpoint() from being called until
    after receiving a new arp/rarp packet
  * Remove unconditional FreeBSD configure mandir hack</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1721908800">- arpwatch-gcc14.patch: fixed gcc14 issue</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1753963200">- Update to version 3.8:
  * update-ethercodes.sh: exit when curls fails.
- Update to version 3.7:
  * Complete switch to python massagevendor.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1761307200">- Update to version 3.9:
  * Use mktemp(1) to obtain a temporary file for update-ethercodes</changelog>
</package>
<package pkgid="54b1ddbfe6b0e47113da85b745e7cdd1d8e1b801ad722e74ed0ff47cbd62be07210a1ed1c313276c832724ddd74b74b222d04a7fdc67472eff6a726e47b06493" name="audit" arch="src">
  <version epoch="0" ver="4.0.2" rel="186.5"/>
  <changelog author="antoine.belvire@opensuse.org" date="1529236800">- Update to version 2.8.3:
  * Correct msg function name in lru debug code.
  * Fix a segfault in auditd when dns resolution isn't available.
  * Make a reload legacy service for auditd.
  * In auparse python bindings, expose some new types that were
    missing.
  * In normalizer, pickup subject kind for user_login events.
  * Fix interpretation of unknown ioctcmds (rh#1540507).
  * Add ANOM_LOGIN_SERVICE, RESP_ORIGIN_BLOCK, &amp;
    RESP_ORIGIN_BLOCK_TIMED events.
  * In auparse_normalize for USER_LOGIN events, map acct for
    subj_kind.
  * Fix logging of IPv6 addresses in DAEMON_ACCEPT events
    (rh#1534748).
  * Do not rotate auditd logs when num_logs &lt; 2 (brozs).</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1529755200">- Update to version 2.8.4:
  * Generate checkpoint file even when not results are returned
    (Burn Alting).
  * Fix log file creation when file logging is disabled entirely
    (Vlad Glagolev).
  * Use SIGCONT to dump auditd internal state (rh#1504251).
  * Fix parsing of virtual timestamp fields in ausearch_expression
    (rh#1515903).
  * Fix parsing of uid &amp; success for ausearch.
  * Hide lru symbols in auparse.
  * Fix aureport summary time range reporting.
  * Allow unlimited retries on startup for remote logging.
  * Add queue_depth to remote logging stats and increase default
    queue_depth size.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1553169600">- Make use of some %make_install.</changelog>
  <changelog author="Tony Jones &lt;tonyj@suse.com&gt;" date="1578916800">- Update to version 2.8.5:
  * Fix segfault on shutdown
  * Fix hang on startup (#1587995)
  * Add sleep to script to dump state so file is ready when needed
  * Add auparse_normalizer support for SOFTWARE_UPDATE event
  * Mark netlabel events as simple events so that get processed quicker
  * When audispd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
  * Add 30-ospp-v42.rules to meet new Common Criteria requirements
  * Update lookup tables for the 4.18 kernel
  * In aureport, fix segfault in file report
  * Add auparse_normalizer support for labeled networking events
  * Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
  * Event aging is off by a second
  * In ausearch/auparse, correct event ordering to process oldest first
  * auparse_reset was not clearing everything it should
  * Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
  * In ausearch/report, lightly parse selinux portion of USER_AVC events
  * In ausearch/report, limit record size when malformed
  * In auditd, fix extract_type function for network originating events
  * In auditd, calculate right size and location for network originating events
  * Treat all network originating events as VER2 so dispatcher doesn't format it
  * In audisp-remote do an initial connection attempt (#1625156)
  * In auditd, allow expression of space left as a percentage (#1650670)
  * On PPC64LE systems, only allow 64 bit rules (#1462178)
  * Make some parts of auditd state report optional based on config
  * Fix ausearch when checkpointing a single file (Burn Alting)
  * Fix scripting in 31-privileged.rules wrt filecap (#1662516)
  * In ausearch, do not checkpt if stdin is input source
  * In libev, remove __cold__ attribute for functions to allow proper hardening
  * Add tests to configure.ac for openldap support
  * Make systemd support files use /run rather than /var/run (Christian Hesse)
  * Fix minor memory leak in auditd kerberos credentials code
  * Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
  * In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Remote zos building is now a configurable option.
  It should be disabled in audit (and left enabled in audit-secondary).</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1591012800">- Fix specfile to require libauparse0 and libaudit1 after splitting
  audit-libs (bsc#1172295)</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1606910400">- Enable Aarch64 processor support. (bsc#1179515 bsc#1179806)</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1623672000">- Adjust audit.spec and audit-secondary.spec to support new version
- Include fix for libev
  * add libev-werror.patch
- Update to version 3.0.2
- In audispd-statsd pluging, use struct sockaddr_storage (Ville Heikkinen)
- Optionally interpret auid in auditctl -l
- Update some syscall argument interpretations
- In auditd, do not allow spaces in the hostname name format
- Big documentation cleanup (MIZUTA Takeshi)
- Update syscall table to the 5.12 kernel
- Update the auparse normalizer for new event types
- Fix compiler warnings in ids subsystem
- Block a couple signals from flush &amp; reconfigure threads
- In auditd, don't wait on flush thread when exiting
- Output error message if the path of input files are too long ausearch/report
  Included fixes from 3.0.1
- Update syscall table to the 5.11 kernel
- Add new --eoe-timeout option to ausearch and aureport (Burn Alting)
- Only enable periodic timers when listening on the network
- Upgrade libev to 4.33
- Add auparse_new_buffer function to auparse library
- Use the select libev backend unless aggregating events
- Add sudoers to some base audit rules
- Update the auparse normalizer for some new syscalls and event types
  Included fixes from 3.0
- Generate checkpoint file even when no results are returned (Burn Alting)
- Fix log file creation when file logging is disabled entirely (Vlad Glagolev)
- Convert auparse_test to run with python3 (Tomáš Chvátal)
- Drop support for prelude
- Adjust backlog_wait_time in rules to the kernel default (#1482848)
- Remove ids key syntax checking of rules in auditctl
- Use SIGCONT to dump auditd internal state (#1504251)
- Fix parsing of virtual timestamp fields in ausearch_expression (#1515903)
- Fix parsing of uid &amp; success for ausearch
- Add support for not equal operator in audit by executable (Ondrej Mosnacek)
- Hide lru symbols in auparse
- Add systemd process protections
- Fix aureport summary time range reporting
- Allow unlimited retries on startup for remote logging
- Add queue_depth to remote logging stats and increase default queue_depth size
- Fix segfault on shutdown
- Merge auditd and audispd code
- Close on execute init_pipe fd (#1587995)
- Breakout audisp syslog plugin to be standalone program
- Create a common internal library to reduce code
- Move all audispd config files under /etc/audit/
- Move audispd.conf settings into auditd.conf
- Add queue depth statistics to internal state dump report
- Add network statistics to internal state dump report
- SIGUSR now also restarts queue processing if its suspended
- Update lookup tables for the 4.18 kernel
- Add auparse_normalizer support for SOFTWARE_UPDATE event
- Add 30-ospp-v42.rules to meet new Common Criteria requirements
- Deprecate enable_krb and replace with transport config opt for remote logging
- Mark netlabel events as simple events so that get processed quicker
- When auditd is reconfiguring, only SIGHUP plugins with valid pid (#1614833)
- In aureport, fix segfault in file report
- Add auparse_normalizer support for labeled networking events
- Fix memory leak in audisp-remote plugin when using krb5 transport. (#1622194)
- In ausearch/auparse, event aging is off by a second
- In ausearch/auparse, correct event ordering to process oldest first
- Migrate auparse python test to python3
- auparse_reset was not clearing everything it should
- Add support for AUDIT_MAC_CALIPSO_ADD, AUDIT_MAC_CALIPSO_DEL events
- In ausearch/report, lightly parse selinux portion of USER_AVC events
- Add bpf syscall command argument interpretation to auparse
- In ausearch/report, limit record size when malformed
- Port af_unix plugin to libev
- In auditd, fix extract_type function for network originating events
- In auditd, calculate right size and location for network originating events
- Make legacy script wait for auditd to terminate (#1643567)
- Treat all network originating events as VER2 so dispatcher doesn't format it
- If an event has a node name make it VER2 so dispatcher doesnt format it
- In audisp-remote do an initial connection attempt (#1625156)
- In auditd, allow expression of space left as a percentage (#1650670)
- On PPC64LE systems, only allow 64 bit rules (#1462178)
- Make some parts of auditd state report optional based on config
- Update to libev-4.25
- Fix ausearch when checkpointing a single file (Burn Alting)
- Fix scripting in 31-privileged.rules wrt filecap (#1662516)
- In ausearch, do not checkpt if stdin is input source
- In libev, remove __cold__ attribute for functions to allow proper hardening
- Add tests to configure.ac for openldap support
- Make systemd support files use /run rather than /var/run (Christian Hesse)
- Fix minor memory leak in auditd kerberos credentials code
- Allow exclude and user filter by executable name (Ondrej Mosnacek)
- Fix auditd regression where keep_logs is limited by rotate_logs 2 file test
- In ausearch/report fix --end to use midnight time instead of now (#1671338)
- Add substitue functions for strndupa &amp; rawmemchr
- Fix memleak in auparse caused by corrected event ordering
- Fix legacy reload script to reload audit rules when daemon is reloaded
- Support for unescaping in trusted messages (Dmitry Voronin)
- In auditd, use standard template for DEAMON events (Richard Guy Briggs)
- In aureport, fix segfault for malformed USER_CMD events
- Add exe field to audit_log_user_command in libaudit
- In auditctl support filter on socket address families (Richard Guy Briggs)
- Deprecate support for Alpha &amp; IA64 processors
- If space_left_action is rotate, allow it every time (#1718444)
- In auparse, drop standalone EOE events
- Add milliseconds column for ausearch extra time csv format
- Fix aureport first event reporting when no start given
- In audisp-remote, add new config item for startup connection errors
- Remove dependency on chkconfig
- Install rules to /usr/share/audit/sample-rules/
- Split up ospp rules to make SCAP scanning easier (#1746018)
- In audisp-syslog, support interpreting records (#1497279)
- Audit USER events now sends msg as name value pair
- Add support for AUDIT_BPF event
- Auditd should not process AUDIT_REPLACE events
- Update syscall tables to the 5.5 kernel
- Improve personality interpretation by using PERS_MASK
- Speedup ausearch/report parsing RAW logging format by caching uid/name lookup
- Change auparse python bindings to shared object (Issue #121)
- Add error messages for watch permissions
- If audit rules file doesn't exist log error message instead of info message
- Revise error message for unmatched options in auditctl
- In audisp-remote, fixup remote endpoint disappearin in ascii format
- Add backlog_wait_time_actual reporting / resetting to auditctl (Max Englander)
- In auditctl, add support for sending a signal to auditd
- Remove audit-fno-common.patch: fixed in upstream
- Remove audit-python3.patch: fixed in upstream</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1627646400">- Update to version 3.0.3:
  * Dont interpret audit netlink groups unless AUDIT_NLGRP_MAX is defined
  * Add support for AUDIT_RESP_ORIGIN_UNBLOCK_TIMED to ids
  * Change auparse_feed_has_data in auparse to include incomplete events
  * Auditd, stop linking against -lrt
  * Add ProtectHome and RestrictRealtime to auditd.service
  * In auditd, read up to 3 netlink packets in a row
  * In auditd, do not validate path to plugin unless active
  * In auparse, only emit config errors when AUPARSE_DEBUG env variable exists
- use https source urls</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1631793600">- Update to version 3.0.5:
  * In auditd, flush uid/gid caches when user/group added/deleted/modified
  * Fixed various issues when dealing with corrupted logs
  * In auditd, check if log_file is valid before closing handle
- Include fixed from 3.0.4:
  * Apply performance speedups to auparse library
  * Optimize rule loading in auditctl
  * Fix an auparse memory leak caused by glibc-2.33 by replacing realpath
  * Update syscall table to the 5.14 kernel
  * Fixed various issues when dealing with corrupted logs</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1636286400">- Update to version 3.0.6:
  * fixes a segfault on some SELINUX_ERR records
  * makes IPX packet interpretation dependent on the ipx header
    file existing
  * adds b32/b64 support to ausyscall
  * adds support for armv8l
  * fixes auditctl list of syscalls on PPC
  * auditd.service now restarts auditd under some conditions</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1649678400">- Modernize specfile constructs.</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.de&gt;" date="1671105600">- Enable build for ARM (32-bit)
- Update to version 3.0.9:
  * In auditd, release the async flush lock on stop
  * Don't allow auditd to log directly into /var/log when log_group is non-zero
  * Cleanup krb5 memory leaks on error paths
  * Update auditd.cron to use auditctl --signal
  * In auparse, if too many fields, realloc array bigger (Paul Wolneykien)
  * In auparse, special case kernel module name interpretation
  * If overflow_action is ignore, don't treat as an error
  (3.0.8)
  * Add gcc function attributes for access and allocation
  * Add some more man pages (MIZUTA Takeshi)
  * In auditd, change the reinitializing of the plugin queue
  * Fix path normalization in auparse (Sergio Correia)
  * In libaudit, handle ECONNREFUSED for network uid/gid lookups (Enzo Matsumiya)
  * In audisp-remote, fix hang with disk_low_action=suspend (Enzo Matsumiya)
  * Drop ProtectHome from auditd.service as it interferes with rules
  (3.0.7)
  * Add support for the OPENAT2 record type (Richard Guy Briggs)
  * In auditd, close the logging file descriptor when logging is suspended
  * Update the capabilities lookup table to match 5.16 kernel
  * Improve interpretation of renamat &amp; faccessat family of syscalls
  * Update syscall table for the 5.16 kernel
  * Reduce dependency from initscripts to initscripts-service
- Refresh patches (context adjusment):
  * audit-allow-manual-stop.patch
  * audit-ausearch-do-not-require-tclass.patch
  * audit-no-gss.patch
  * enable-stop-rules.patch
  * fix-hardened-service.patch
  * harden_auditd.service.patch
- Remove patches (fixed by version update):
  * libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
  * audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Giuliano Belinassi &lt;giuliano.belinassi@suse.com&gt;" date="1679313600">- Enable livepatching on main library on x86_64.</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Add new headers 'audit_logging.h' and 'audit-records.h' for
    audit-devel</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec: add requirement for 'awk' package (bsc#1231236)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="0b13d0bd907187278033901f4c186882c3291b3e62e7f00e55a71c5f09164d906441e59d67ba84d1e11261c2d27fb011b654d1e1183cfa4e5f4f08dc5b9a0ef6" name="audit" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.7"/>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1722859200">- Remove rcaudit symlink [jsc#PED-266]</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Move rules-related files into new subpackage `audit-rules':
  * Files moved:
  - /sbin/auditctl, /sbin/augenrules,
  /etc/audit/{audit.rules,rules.d/audit.rules,audit-stop.rules}
  - manpages for auditctl, augenrules, and audit.rules
  - /etc/audit is now owned by `audit-rules' as well
  * Add new file /usr/lib/systemd/system/audit-rules.service
  * Remove in-house create-augenrules-service.patch that generated
    augenrules.service systemd unit service
  * Remove ownership of /usr/share/audit
  * Create /usr/share/audit-rules directory on %install
  * Remove audit-userspace-517-compat.patch (fixed upstream)
  * Remove libev-werror.patch (fixed upstream)
  * Remove audit-allow-manual-stop.patch (fixed upstream)
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Remove autrace and auvirt references (upstream)
  * Replace README with README.md
- Drop `--enable-systemd' from %configure as SysV-style scripts
  aren't supported in upstream since
  113ae191758c ("Drop support for SysVinit")</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727352000">- Update audit-secondary.spec:
  * Add "Requires: audit-rules" for audit package
  * Remove preun/postun handling of audit-rules.service</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727784000">- Fix plugin termination when using systemd service units (bsc#1215377)
  * add auditd.service-fix-plugin-termination.patch</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727870400">- Readd audit-allow-manual-stop.patch (removed by mistake)</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec (bsc#1231236):
  * add requirement for 'awk' package
  * move some %post logic from audit to audit-rules</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1769428800">- Move all /var/spool, /var/log directories to systemd-tmpfiles</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="0753bc9838da2366474ebff00905323b6d9f128fd93a5d6c0909aedf4f51da7d983fa2cfeb18fcc5a4c222efad9f325e807d7eceb3eea74ebfd613a2155dbab9" name="audit-audispd-plugins" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.7"/>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1722859200">- Remove rcaudit symlink [jsc#PED-266]</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Move rules-related files into new subpackage `audit-rules':
  * Files moved:
  - /sbin/auditctl, /sbin/augenrules,
  /etc/audit/{audit.rules,rules.d/audit.rules,audit-stop.rules}
  - manpages for auditctl, augenrules, and audit.rules
  - /etc/audit is now owned by `audit-rules' as well
  * Add new file /usr/lib/systemd/system/audit-rules.service
  * Remove in-house create-augenrules-service.patch that generated
    augenrules.service systemd unit service
  * Remove ownership of /usr/share/audit
  * Create /usr/share/audit-rules directory on %install
  * Remove audit-userspace-517-compat.patch (fixed upstream)
  * Remove libev-werror.patch (fixed upstream)
  * Remove audit-allow-manual-stop.patch (fixed upstream)
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Remove autrace and auvirt references (upstream)
  * Replace README with README.md
- Drop `--enable-systemd' from %configure as SysV-style scripts
  aren't supported in upstream since
  113ae191758c ("Drop support for SysVinit")</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727352000">- Update audit-secondary.spec:
  * Add "Requires: audit-rules" for audit package
  * Remove preun/postun handling of audit-rules.service</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727784000">- Fix plugin termination when using systemd service units (bsc#1215377)
  * add auditd.service-fix-plugin-termination.patch</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727870400">- Readd audit-allow-manual-stop.patch (removed by mistake)</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec (bsc#1231236):
  * add requirement for 'awk' package
  * move some %post logic from audit to audit-rules</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1769428800">- Move all /var/spool, /var/log directories to systemd-tmpfiles</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="e45bedbcc33d7e7db812f52c01fd7aa700fcf76a49480126560ba01828caedd93d97394b3d152fae74a9b7c6f8ae4867a25cf3a0d554b33d2952204cce197f3f" name="audit-audispd-plugins-debuginfo" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.7"/>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1722859200">- Remove rcaudit symlink [jsc#PED-266]</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Move rules-related files into new subpackage `audit-rules':
  * Files moved:
  - /sbin/auditctl, /sbin/augenrules,
  /etc/audit/{audit.rules,rules.d/audit.rules,audit-stop.rules}
  - manpages for auditctl, augenrules, and audit.rules
  - /etc/audit is now owned by `audit-rules' as well
  * Add new file /usr/lib/systemd/system/audit-rules.service
  * Remove in-house create-augenrules-service.patch that generated
    augenrules.service systemd unit service
  * Remove ownership of /usr/share/audit
  * Create /usr/share/audit-rules directory on %install
  * Remove audit-userspace-517-compat.patch (fixed upstream)
  * Remove libev-werror.patch (fixed upstream)
  * Remove audit-allow-manual-stop.patch (fixed upstream)
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Remove autrace and auvirt references (upstream)
  * Replace README with README.md
- Drop `--enable-systemd' from %configure as SysV-style scripts
  aren't supported in upstream since
  113ae191758c ("Drop support for SysVinit")</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727352000">- Update audit-secondary.spec:
  * Add "Requires: audit-rules" for audit package
  * Remove preun/postun handling of audit-rules.service</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727784000">- Fix plugin termination when using systemd service units (bsc#1215377)
  * add auditd.service-fix-plugin-termination.patch</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727870400">- Readd audit-allow-manual-stop.patch (removed by mistake)</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec (bsc#1231236):
  * add requirement for 'awk' package
  * move some %post logic from audit to audit-rules</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1769428800">- Move all /var/spool, /var/log directories to systemd-tmpfiles</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="a1f869ba1a7d94e1fb9e92fb403895e261b7a7b2cba36393a801bfd5ded894c2b87ba5f788a49ee013ffff849f3689df0a9dee468d68b52ea4fed2f97786a7aa" name="audit-debuginfo" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.7"/>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1722859200">- Remove rcaudit symlink [jsc#PED-266]</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Move rules-related files into new subpackage `audit-rules':
  * Files moved:
  - /sbin/auditctl, /sbin/augenrules,
  /etc/audit/{audit.rules,rules.d/audit.rules,audit-stop.rules}
  - manpages for auditctl, augenrules, and audit.rules
  - /etc/audit is now owned by `audit-rules' as well
  * Add new file /usr/lib/systemd/system/audit-rules.service
  * Remove in-house create-augenrules-service.patch that generated
    augenrules.service systemd unit service
  * Remove ownership of /usr/share/audit
  * Create /usr/share/audit-rules directory on %install
  * Remove audit-userspace-517-compat.patch (fixed upstream)
  * Remove libev-werror.patch (fixed upstream)
  * Remove audit-allow-manual-stop.patch (fixed upstream)
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Remove autrace and auvirt references (upstream)
  * Replace README with README.md
- Drop `--enable-systemd' from %configure as SysV-style scripts
  aren't supported in upstream since
  113ae191758c ("Drop support for SysVinit")</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727352000">- Update audit-secondary.spec:
  * Add "Requires: audit-rules" for audit package
  * Remove preun/postun handling of audit-rules.service</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727784000">- Fix plugin termination when using systemd service units (bsc#1215377)
  * add auditd.service-fix-plugin-termination.patch</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727870400">- Readd audit-allow-manual-stop.patch (removed by mistake)</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec (bsc#1231236):
  * add requirement for 'awk' package
  * move some %post logic from audit to audit-rules</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1769428800">- Move all /var/spool, /var/log directories to systemd-tmpfiles</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="6458e01b074e21a061502f63ccfcee9a0eebffe5421ee95223e7a62785c6d616e9fda93dbd101f1724ae6234d7bd14afd74c93a56ec4615177e4e57b9498fa4b" name="audit-debugsource" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.5"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1649678400">- Modernize specfile constructs.</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.de&gt;" date="1671105600">- Enable build for ARM (32-bit)
- Update to version 3.0.9:
  * In auditd, release the async flush lock on stop
  * Don't allow auditd to log directly into /var/log when log_group is non-zero
  * Cleanup krb5 memory leaks on error paths
  * Update auditd.cron to use auditctl --signal
  * In auparse, if too many fields, realloc array bigger (Paul Wolneykien)
  * In auparse, special case kernel module name interpretation
  * If overflow_action is ignore, don't treat as an error
  (3.0.8)
  * Add gcc function attributes for access and allocation
  * Add some more man pages (MIZUTA Takeshi)
  * In auditd, change the reinitializing of the plugin queue
  * Fix path normalization in auparse (Sergio Correia)
  * In libaudit, handle ECONNREFUSED for network uid/gid lookups (Enzo Matsumiya)
  * In audisp-remote, fix hang with disk_low_action=suspend (Enzo Matsumiya)
  * Drop ProtectHome from auditd.service as it interferes with rules
  (3.0.7)
  * Add support for the OPENAT2 record type (Richard Guy Briggs)
  * In auditd, close the logging file descriptor when logging is suspended
  * Update the capabilities lookup table to match 5.16 kernel
  * Improve interpretation of renamat &amp; faccessat family of syscalls
  * Update syscall table for the 5.16 kernel
  * Reduce dependency from initscripts to initscripts-service
- Refresh patches (context adjusment):
  * audit-allow-manual-stop.patch
  * audit-ausearch-do-not-require-tclass.patch
  * audit-no-gss.patch
  * enable-stop-rules.patch
  * fix-hardened-service.patch
  * harden_auditd.service.patch
- Remove patches (fixed by version update):
  * libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
  * audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Giuliano Belinassi &lt;giuliano.belinassi@suse.com&gt;" date="1679313600">- Enable livepatching on main library on x86_64.</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Add new headers 'audit_logging.h' and 'audit-records.h' for
    audit-devel</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec: add requirement for 'awk' package (bsc#1231236)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="8fec72090416fe0a24d6ca8c473e343b5634cf1748d9dcae7f7e48a1a4516aa318265e81cf828ec426a6945d5525e8d9be5aaa8a053d55b09117bf9aa2557a4f" name="audit-devel" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.5"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1649678400">- Modernize specfile constructs.</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.de&gt;" date="1671105600">- Enable build for ARM (32-bit)
- Update to version 3.0.9:
  * In auditd, release the async flush lock on stop
  * Don't allow auditd to log directly into /var/log when log_group is non-zero
  * Cleanup krb5 memory leaks on error paths
  * Update auditd.cron to use auditctl --signal
  * In auparse, if too many fields, realloc array bigger (Paul Wolneykien)
  * In auparse, special case kernel module name interpretation
  * If overflow_action is ignore, don't treat as an error
  (3.0.8)
  * Add gcc function attributes for access and allocation
  * Add some more man pages (MIZUTA Takeshi)
  * In auditd, change the reinitializing of the plugin queue
  * Fix path normalization in auparse (Sergio Correia)
  * In libaudit, handle ECONNREFUSED for network uid/gid lookups (Enzo Matsumiya)
  * In audisp-remote, fix hang with disk_low_action=suspend (Enzo Matsumiya)
  * Drop ProtectHome from auditd.service as it interferes with rules
  (3.0.7)
  * Add support for the OPENAT2 record type (Richard Guy Briggs)
  * In auditd, close the logging file descriptor when logging is suspended
  * Update the capabilities lookup table to match 5.16 kernel
  * Improve interpretation of renamat &amp; faccessat family of syscalls
  * Update syscall table for the 5.16 kernel
  * Reduce dependency from initscripts to initscripts-service
- Refresh patches (context adjusment):
  * audit-allow-manual-stop.patch
  * audit-ausearch-do-not-require-tclass.patch
  * audit-no-gss.patch
  * enable-stop-rules.patch
  * fix-hardened-service.patch
  * harden_auditd.service.patch
- Remove patches (fixed by version update):
  * libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
  * audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Giuliano Belinassi &lt;giuliano.belinassi@suse.com&gt;" date="1679313600">- Enable livepatching on main library on x86_64.</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Add new headers 'audit_logging.h' and 'audit-records.h' for
    audit-devel</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec: add requirement for 'awk' package (bsc#1231236)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="c85e7d351e0df5ecc6520627f7fe0351eefb1da61b448c7dc7639d01fc39be35020490f2f66d9064108c76a2424e873eb31c8f6e28bf3bab50957148ad376ef0" name="audit-rules" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.7"/>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1722859200">- Remove rcaudit symlink [jsc#PED-266]</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Move rules-related files into new subpackage `audit-rules':
  * Files moved:
  - /sbin/auditctl, /sbin/augenrules,
  /etc/audit/{audit.rules,rules.d/audit.rules,audit-stop.rules}
  - manpages for auditctl, augenrules, and audit.rules
  - /etc/audit is now owned by `audit-rules' as well
  * Add new file /usr/lib/systemd/system/audit-rules.service
  * Remove in-house create-augenrules-service.patch that generated
    augenrules.service systemd unit service
  * Remove ownership of /usr/share/audit
  * Create /usr/share/audit-rules directory on %install
  * Remove audit-userspace-517-compat.patch (fixed upstream)
  * Remove libev-werror.patch (fixed upstream)
  * Remove audit-allow-manual-stop.patch (fixed upstream)
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Remove autrace and auvirt references (upstream)
  * Replace README with README.md
- Drop `--enable-systemd' from %configure as SysV-style scripts
  aren't supported in upstream since
  113ae191758c ("Drop support for SysVinit")</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727352000">- Update audit-secondary.spec:
  * Add "Requires: audit-rules" for audit package
  * Remove preun/postun handling of audit-rules.service</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727784000">- Fix plugin termination when using systemd service units (bsc#1215377)
  * add auditd.service-fix-plugin-termination.patch</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727870400">- Readd audit-allow-manual-stop.patch (removed by mistake)</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec (bsc#1231236):
  * add requirement for 'awk' package
  * move some %post logic from audit to audit-rules</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1769428800">- Move all /var/spool, /var/log directories to systemd-tmpfiles</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="3179679927fdd6b9b0f5c87fc56327c72543a2beb16c9a5d3d47937d24cdd1b16711902f5ec834a7af541cef3541c5dacc166116c94ce0764e7a5116b52bb20a" name="audit-rules-debuginfo" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.7"/>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1722859200">- Remove rcaudit symlink [jsc#PED-266]</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Move rules-related files into new subpackage `audit-rules':
  * Files moved:
  - /sbin/auditctl, /sbin/augenrules,
  /etc/audit/{audit.rules,rules.d/audit.rules,audit-stop.rules}
  - manpages for auditctl, augenrules, and audit.rules
  - /etc/audit is now owned by `audit-rules' as well
  * Add new file /usr/lib/systemd/system/audit-rules.service
  * Remove in-house create-augenrules-service.patch that generated
    augenrules.service systemd unit service
  * Remove ownership of /usr/share/audit
  * Create /usr/share/audit-rules directory on %install
  * Remove audit-userspace-517-compat.patch (fixed upstream)
  * Remove libev-werror.patch (fixed upstream)
  * Remove audit-allow-manual-stop.patch (fixed upstream)
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Remove autrace and auvirt references (upstream)
  * Replace README with README.md
- Drop `--enable-systemd' from %configure as SysV-style scripts
  aren't supported in upstream since
  113ae191758c ("Drop support for SysVinit")</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727352000">- Update audit-secondary.spec:
  * Add "Requires: audit-rules" for audit package
  * Remove preun/postun handling of audit-rules.service</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727784000">- Fix plugin termination when using systemd service units (bsc#1215377)
  * add auditd.service-fix-plugin-termination.patch</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727870400">- Readd audit-allow-manual-stop.patch (removed by mistake)</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec (bsc#1231236):
  * add requirement for 'awk' package
  * move some %post logic from audit to audit-rules</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1769428800">- Move all /var/spool, /var/log directories to systemd-tmpfiles</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="d7ff75172e3827937d52ae1df5cc0fda5a5914a5198529dc6262f84e17bcf7c210e740892394137035740cc57b877effcae74a22a179ee4be7dae4cd9207a701" name="audit-secondary" arch="src">
  <version epoch="0" ver="4.0.2" rel="186.7"/>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1636286400">- Update to version 3.0.6:
  * fixes a segfault on some SELINUX_ERR records
  * makes IPX packet interpretation dependent on the ipx header
    file existing
  * adds b32/b64 support to ausyscall
  * adds support for armv8l
  * fixes auditctl list of syscalls on PPC
  * auditd.service now restarts auditd under some conditions</changelog>
  <changelog author="Fabian Vogt &lt;fvogt@suse.com&gt;" date="1638187200">- Use %autosetup
- Don't include sample rules as %doc, they're already installed
  as normal files
- Fix create-augenrules-service.patch:
  * auditd.service needs to require augenrules.service,
    not the other way around
- Fix documentation for enable-stop-rules.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1648036800">- add audit-userspace-517-compat.patch</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1648209600">- Fix unhandled ECONNREFUSED with LDAP environments (bsc#1196645)
  * add libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
- Fix hang in audisp-remote with disk_low_action=suspend (bsc#1196517)
  * add audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="Stephan Kulow &lt;coolo@suse.com&gt;" date="1648296000">- Fix buildrequire for openldap2-devel - audit doesn't require the
  (outdated) C++ binding, but the C headers that happen to be pulled
  in by buildrequiring the C++ devel package</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1649678400">- Drop buildrequire on C++ compiler.
- Modernize specfile constructs.</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.de&gt;" date="1671105600">- Enable build for ARM (32-bit)
- Update to version 3.0.9:
  * In auditd, release the async flush lock on stop
  * Don't allow auditd to log directly into /var/log when log_group is non-zero
  * Cleanup krb5 memory leaks on error paths
  * Update auditd.cron to use auditctl --signal
  * In auparse, if too many fields, realloc array bigger (Paul Wolneykien)
  * In auparse, special case kernel module name interpretation
  * If overflow_action is ignore, don't treat as an error
  (3.0.8)
  * Add gcc function attributes for access and allocation
  * Add some more man pages (MIZUTA Takeshi)
  * In auditd, change the reinitializing of the plugin queue
  * Fix path normalization in auparse (Sergio Correia)
  * In libaudit, handle ECONNREFUSED for network uid/gid lookups (Enzo Matsumiya)
  * In audisp-remote, fix hang with disk_low_action=suspend (Enzo Matsumiya)
  * Drop ProtectHome from auditd.service as it interferes with rules
  (3.0.7)
  * Add support for the OPENAT2 record type (Richard Guy Briggs)
  * In auditd, close the logging file descriptor when logging is suspended
  * Update the capabilities lookup table to match 5.16 kernel
  * Improve interpretation of renamat &amp; faccessat family of syscalls
  * Update syscall table for the 5.16 kernel
  * Reduce dependency from initscripts to initscripts-service
- Refresh patches (context adjusment):
  * audit-allow-manual-stop.patch
  * audit-ausearch-do-not-require-tclass.patch
  * audit-no-gss.patch
  * enable-stop-rules.patch
  * fix-hardened-service.patch
  * harden_auditd.service.patch
- Remove patches (fixed by version update):
  * libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
  * audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1722859200">- Remove rcaudit symlink [jsc#PED-266]</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Move rules-related files into new subpackage `audit-rules':
  * Files moved:
  - /sbin/auditctl, /sbin/augenrules,
  /etc/audit/{audit.rules,rules.d/audit.rules,audit-stop.rules}
  - manpages for auditctl, augenrules, and audit.rules
  - /etc/audit is now owned by `audit-rules' as well
  * Add new file /usr/lib/systemd/system/audit-rules.service
  * Remove in-house create-augenrules-service.patch that generated
    augenrules.service systemd unit service
  * Remove ownership of /usr/share/audit
  * Create /usr/share/audit-rules directory on %install
  * Remove audit-userspace-517-compat.patch (fixed upstream)
  * Remove libev-werror.patch (fixed upstream)
  * Remove audit-allow-manual-stop.patch (fixed upstream)
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Remove autrace and auvirt references (upstream)
  * Replace README with README.md
- Drop `--enable-systemd' from %configure as SysV-style scripts
  aren't supported in upstream since
  113ae191758c ("Drop support for SysVinit")</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727352000">- Update audit-secondary.spec:
  * Add "Requires: audit-rules" for audit package
  * Remove preun/postun handling of audit-rules.service</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727784000">- Fix plugin termination when using systemd service units (bsc#1215377)
  * add auditd.service-fix-plugin-termination.patch</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727870400">- Readd audit-allow-manual-stop.patch (removed by mistake)</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec (bsc#1231236):
  * add requirement for 'awk' package
  * move some %post logic from audit to audit-rules</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1769428800">- Move all /var/spool, /var/log directories to systemd-tmpfiles</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="81daa5f3312357a7ae4d41ea8f7f15006592be8feae0bb0338308771c1e00aa0051cc8a4a244486911bbbad1a7615c14962398797c8b650499a212ed93c0e41b" name="audit-secondary-debugsource" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.7"/>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1722859200">- Remove rcaudit symlink [jsc#PED-266]</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Move rules-related files into new subpackage `audit-rules':
  * Files moved:
  - /sbin/auditctl, /sbin/augenrules,
  /etc/audit/{audit.rules,rules.d/audit.rules,audit-stop.rules}
  - manpages for auditctl, augenrules, and audit.rules
  - /etc/audit is now owned by `audit-rules' as well
  * Add new file /usr/lib/systemd/system/audit-rules.service
  * Remove in-house create-augenrules-service.patch that generated
    augenrules.service systemd unit service
  * Remove ownership of /usr/share/audit
  * Create /usr/share/audit-rules directory on %install
  * Remove audit-userspace-517-compat.patch (fixed upstream)
  * Remove libev-werror.patch (fixed upstream)
  * Remove audit-allow-manual-stop.patch (fixed upstream)
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Remove autrace and auvirt references (upstream)
  * Replace README with README.md
- Drop `--enable-systemd' from %configure as SysV-style scripts
  aren't supported in upstream since
  113ae191758c ("Drop support for SysVinit")</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727352000">- Update audit-secondary.spec:
  * Add "Requires: audit-rules" for audit package
  * Remove preun/postun handling of audit-rules.service</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727784000">- Fix plugin termination when using systemd service units (bsc#1215377)
  * add auditd.service-fix-plugin-termination.patch</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727870400">- Readd audit-allow-manual-stop.patch (removed by mistake)</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec (bsc#1231236):
  * add requirement for 'awk' package
  * move some %post logic from audit to audit-rules</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1769428800">- Move all /var/spool, /var/log directories to systemd-tmpfiles</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="874663d50154ad4c2b3472bbbcd753cbed843d9c410ed66dcf7369096658f2cfc5d5def0b92894fc821d9457376ebe74264aff09e207eaa9af0c8d4e9d584a95" name="augrok" arch="s390x">
  <version epoch="0" ver="2.2" rel="1.10"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1728561600">- audit.log search tool</changelog>
</package>
<package pkgid="5b033560e8f12052b224d79f5df8b380deb97e7b123db80ba5a1d1ab134a2111d67cb389c5b9e3d1c1e4d90e8813d889c245fb72d0eb49f1465c30e09526de1c" name="augrok" arch="src">
  <version epoch="0" ver="2.2" rel="1.10"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1728561600">- audit.log search tool</changelog>
</package>
<package pkgid="9eba959c0152f668836a8d21df19ca3dd0a0f9c80235e81e7978de4e4cb1d05a18d8ee49aab1b40006bfbcc6dddae71273cc9a60a6fb9ee991e2a9a6f3d3d85b" name="autossh" arch="s390x">
  <version epoch="0" ver="1.4g" rel="49.55"/>
  <changelog author="p.drouand@gmail.com" date="1405857600">- Add systemd support for openSUSE &gt; 12.2</changelog>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update to version 1.4d
  + call daemon() before opening any sockets. Problem discovered and
    diagnosed by Frank van der Aa when trying to start autossh at
    system init.
  + don't use malloc(n * size) idiom; use calloc()</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1429876800">- change autossh.service content to reflect it is a READONLY file.
- change the install line for autossh.service to:
  %__install -D -m 444 %{S:3} %{buildroot}%{_unitdir}/autossh@.service
  * This has 2 big changes.  First the permissions are 444, so READONLY.
  * Second, note the @ char in the target name.
    This makes it an instantiated service file
- add a sample my.conf override file
- add a README.SUSE.md file that:
  * explains how to use systemd instantiated service
  * how to use the override file
  * a full walkthru of how to setup a reverse tunnel</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1431518400">- Minor cleanups to service file and sample my.conf override file</changelog>
  <changelog author="multyrealm@gmail.com" date="1442318400">- Update to version 1.4e
  + By default, changing the poll time should change the first poll
    time to match. Only have different times if AUTOSSH_FIRST_POLL
    is explicitly set. Jerry Xie forwarded on change request from
    Ubuntu bug forums.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="sean@suspend.net" date="1539604800">- Update to version 1.4f
  + Change behavior when ssh exits on signal.
  + Fix order of arguments to kill().
  + Ignore SIGPIPE.
  + Should accept the default -1 with AUTOSSH_MAXSTART
  + memset() sigaction structure before use
- autossh-makefile-destdir.patch: dropped</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1552824000">- Remove pre-12.2 parts from build recipe
- Reduce hard dependency on systemd
- Replace old $RPM_* shell vars and %__-type macro indirections.</changelog>
  <changelog author="Greg Freemyer &lt;Greg.Freemyer@gmail.com&gt;" date="1553774400">- Update to version 1.4g
  + most notably addresses a bug that could see an alarm signal occur
    without a handler, causing autossh to exit inappropriately.</changelog>
  <changelog author="Beno&#xEE;t Monin &lt;benoit.monin@gmx.fr&gt;" date="1565352000">- add autoconf and automake as BuildRequires for autoreconf
- call autoreconf before configure otherwise setproctitle is
  mis-detected as present, causing a build failure</changelog>
</package>
<package pkgid="5ca318d13993377e83595a44f3e4fd3e1cddb46be645a46cea62db6056030ce09463dae95c47fe0e47cc5a87044b79de55a7036c7a9204debe28305a032bda05" name="autossh" arch="src">
  <version epoch="0" ver="1.4g" rel="49.55"/>
  <changelog author="meissner@suse.com" date="1333627200">- a ssh connection watch daemon</changelog>
  <changelog author="multyrealm@gmail.com" date="1333713600">- added SysV-style initscript and configuration file fillup template</changelog>
  <changelog author="multyrealm@gmail.com" date="1333713601">- added insserv_cleanup macro</changelog>
  <changelog author="cfarrell@suse.com" date="1334577600">- license update: BSD-3-Clause
  See fakepoll.h (BSD-4-Clause with UCB clarification). There is no GPL in
  this package</changelog>
  <changelog author="multyrealm@gmail.com" date="1334750400">- updated autossh configuration options</changelog>
  <changelog author="multyrealm@gmail.com" date="1363608000">- updated copyright year</changelog>
  <changelog author="multyrealm@gmail.com" date="1363694400">- support upto 10 autossh instances</changelog>
  <changelog author="multyrealm@gmail.com" date="1363953600">- change first autossh channel configuration key to
  the old one to make package update seemless</changelog>
  <changelog author="multyrealm@gmail.com" date="1364385600">- add functions to init script for controling autossh instances</changelog>
  <changelog author="multyrealm@gmail.com" date="1364385601">- support a custom count of instances</changelog>
  <changelog author="p.drouand@gmail.com" date="1405857600">- Add systemd support for openSUSE &gt; 12.2</changelog>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update to version 1.4d
  + call daemon() before opening any sockets. Problem discovered and
    diagnosed by Frank van der Aa when trying to start autossh at
    system init.
  + don't use malloc(n * size) idiom; use calloc()</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1429876800">- change autossh.service content to reflect it is a READONLY file.
- change the install line for autossh.service to:
  %__install -D -m 444 %{S:3} %{buildroot}%{_unitdir}/autossh@.service
  * This has 2 big changes.  First the permissions are 444, so READONLY.
  * Second, note the @ char in the target name.
    This makes it an instantiated service file
- add a sample my.conf override file
- add a README.SUSE.md file that:
  * explains how to use systemd instantiated service
  * how to use the override file
  * a full walkthru of how to setup a reverse tunnel</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1431518400">- Minor cleanups to service file and sample my.conf override file</changelog>
  <changelog author="multyrealm@gmail.com" date="1442318400">- Update to version 1.4e
  + By default, changing the poll time should change the first poll
    time to match. Only have different times if AUTOSSH_FIRST_POLL
    is explicitly set. Jerry Xie forwarded on change request from
    Ubuntu bug forums.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="sean@suspend.net" date="1539604800">- Update to version 1.4f
  + Change behavior when ssh exits on signal.
  + Fix order of arguments to kill().
  + Ignore SIGPIPE.
  + Should accept the default -1 with AUTOSSH_MAXSTART
  + memset() sigaction structure before use
- autossh-makefile-destdir.patch: dropped</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1552824000">- Remove pre-12.2 parts from build recipe
- Reduce hard dependency on systemd
- Replace old $RPM_* shell vars and %__-type macro indirections.</changelog>
  <changelog author="Greg Freemyer &lt;Greg.Freemyer@gmail.com&gt;" date="1553774400">- Update to version 1.4g
  + most notably addresses a bug that could see an alarm signal occur
    without a handler, causing autossh to exit inappropriately.</changelog>
  <changelog author="Beno&#xEE;t Monin &lt;benoit.monin@gmx.fr&gt;" date="1565352000">- add autoconf and automake as BuildRequires for autoreconf
- call autoreconf before configure otherwise setproctitle is
  mis-detected as present, causing a build failure</changelog>
</package>
<package pkgid="a01fab09819684615cb6085e0832b920998b2b63d7e7133be415a83743a85b26afd0b33e470166a6ded0dfc3218290224edbf7c50ecf80ee7b08df73c632d524" name="autossh-debuginfo" arch="s390x">
  <version epoch="0" ver="1.4g" rel="49.55"/>
  <changelog author="p.drouand@gmail.com" date="1405857600">- Add systemd support for openSUSE &gt; 12.2</changelog>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update to version 1.4d
  + call daemon() before opening any sockets. Problem discovered and
    diagnosed by Frank van der Aa when trying to start autossh at
    system init.
  + don't use malloc(n * size) idiom; use calloc()</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1429876800">- change autossh.service content to reflect it is a READONLY file.
- change the install line for autossh.service to:
  %__install -D -m 444 %{S:3} %{buildroot}%{_unitdir}/autossh@.service
  * This has 2 big changes.  First the permissions are 444, so READONLY.
  * Second, note the @ char in the target name.
    This makes it an instantiated service file
- add a sample my.conf override file
- add a README.SUSE.md file that:
  * explains how to use systemd instantiated service
  * how to use the override file
  * a full walkthru of how to setup a reverse tunnel</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1431518400">- Minor cleanups to service file and sample my.conf override file</changelog>
  <changelog author="multyrealm@gmail.com" date="1442318400">- Update to version 1.4e
  + By default, changing the poll time should change the first poll
    time to match. Only have different times if AUTOSSH_FIRST_POLL
    is explicitly set. Jerry Xie forwarded on change request from
    Ubuntu bug forums.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="sean@suspend.net" date="1539604800">- Update to version 1.4f
  + Change behavior when ssh exits on signal.
  + Fix order of arguments to kill().
  + Ignore SIGPIPE.
  + Should accept the default -1 with AUTOSSH_MAXSTART
  + memset() sigaction structure before use
- autossh-makefile-destdir.patch: dropped</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1552824000">- Remove pre-12.2 parts from build recipe
- Reduce hard dependency on systemd
- Replace old $RPM_* shell vars and %__-type macro indirections.</changelog>
  <changelog author="Greg Freemyer &lt;Greg.Freemyer@gmail.com&gt;" date="1553774400">- Update to version 1.4g
  + most notably addresses a bug that could see an alarm signal occur
    without a handler, causing autossh to exit inappropriately.</changelog>
  <changelog author="Beno&#xEE;t Monin &lt;benoit.monin@gmx.fr&gt;" date="1565352000">- add autoconf and automake as BuildRequires for autoreconf
- call autoreconf before configure otherwise setproctitle is
  mis-detected as present, causing a build failure</changelog>
</package>
<package pkgid="10651fa34544a0094094529f2e3202e9ddbcfb9c7b39abbd33fe000dd72e04fa1562ab4ecb84e9ce8504496db654b4e170faeb20409ea4e3516a6a4e3f2abf29" name="autossh-debugsource" arch="s390x">
  <version epoch="0" ver="1.4g" rel="49.55"/>
  <changelog author="p.drouand@gmail.com" date="1405857600">- Add systemd support for openSUSE &gt; 12.2</changelog>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update to version 1.4d
  + call daemon() before opening any sockets. Problem discovered and
    diagnosed by Frank van der Aa when trying to start autossh at
    system init.
  + don't use malloc(n * size) idiom; use calloc()</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1429876800">- change autossh.service content to reflect it is a READONLY file.
- change the install line for autossh.service to:
  %__install -D -m 444 %{S:3} %{buildroot}%{_unitdir}/autossh@.service
  * This has 2 big changes.  First the permissions are 444, so READONLY.
  * Second, note the @ char in the target name.
    This makes it an instantiated service file
- add a sample my.conf override file
- add a README.SUSE.md file that:
  * explains how to use systemd instantiated service
  * how to use the override file
  * a full walkthru of how to setup a reverse tunnel</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1431518400">- Minor cleanups to service file and sample my.conf override file</changelog>
  <changelog author="multyrealm@gmail.com" date="1442318400">- Update to version 1.4e
  + By default, changing the poll time should change the first poll
    time to match. Only have different times if AUTOSSH_FIRST_POLL
    is explicitly set. Jerry Xie forwarded on change request from
    Ubuntu bug forums.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="sean@suspend.net" date="1539604800">- Update to version 1.4f
  + Change behavior when ssh exits on signal.
  + Fix order of arguments to kill().
  + Ignore SIGPIPE.
  + Should accept the default -1 with AUTOSSH_MAXSTART
  + memset() sigaction structure before use
- autossh-makefile-destdir.patch: dropped</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1552824000">- Remove pre-12.2 parts from build recipe
- Reduce hard dependency on systemd
- Replace old $RPM_* shell vars and %__-type macro indirections.</changelog>
  <changelog author="Greg Freemyer &lt;Greg.Freemyer@gmail.com&gt;" date="1553774400">- Update to version 1.4g
  + most notably addresses a bug that could see an alarm signal occur
    without a handler, causing autossh to exit inappropriately.</changelog>
  <changelog author="Beno&#xEE;t Monin &lt;benoit.monin@gmx.fr&gt;" date="1565352000">- add autoconf and automake as BuildRequires for autoreconf
- call autoreconf before configure otherwise setproctitle is
  mis-detected as present, causing a build failure</changelog>
</package>
<package pkgid="f1c2dbe32f472f3119275b841479eeaa19014776bc7cfe2ddba81f0100a51dd836b6a649721e8ac68be43ebf1b6ebec017052ea78539e2994a347c4755a98b84" name="bearssl" arch="src">
  <version epoch="0" ver="0.6" rel="2.49"/>
  <changelog author="aloisio@gmx.com" date="1478174400">- Initial version 0.1</changelog>
  <changelog author="aloisio@gmx.com" date="1483617600">- Update to version 0.2
  * Support for ClientHello padding (RFC 7685).
  * Support for TLS_FALLBACK_SCSV (RFC 7507) (server-side;
    on the client, this is entirely under control of the
    caller).
  * New flag to prohibit renegotiations.
  * API for saving and restoring session parameters
    (controllable session resumption on the client side).
  * Client certificates: API to request a client certificate
    (on the server side), and to provide a client certificate
    (on the client side).
  * API for generic name extraction from X.509 certificates
    (from the subject DN and the SAN extension).
  * Improved T0 compilation (threaded code is about 10%
    shorter).
  * ChaCha20+Poly1305 support (RFC 7905).
  * Lots of fixes (including a couple of buffer overruns).</changelog>
  <changelog author="aloisio@gmx.com" date="1485777600">- Update to version 0.3
  * Support for ALPN extension (RFC 7301).
  * New big-integers support code (“i15”), that uses 15-bit
    words internally; this offers better performance and
    constant-time code on the ARM Cortex M series.
  * On the ARM Cortex M, a bit of inline assembly can be used
    to speed up multiplications and modular exponentations.
  * Many new elliptic curve implementations:
    + ec_prime_i15: supports P-256, P-384 and P-521 with the
    “i15” big integers.
    + ec_p256_m15: specialised implementation for P-256;
    similar to “i15” but faster. Internally, 13-bit words
    are used (for easier carry propagation).
    + ec_p256_m31: like ec_p256_m15, but using 30-bit words.
    + ec_c25519_i15 and ecc25519_i31 implement Curve25519 with
    the “i15” and “i31” big integers, respectively.
    + ec_c25519_m15 and ecc25519_m31 are specialised
    implementations of Curve25519 with 13-bit and 30-bit
    words, respectively; they are faster, but with a larger
    compiled code size.
    + ec_all_m15 and ec_all_m31 are aggregate wrappers that
    provide support for the three NIST curves and Curve25519,
    with the “m15/i15” or the “m31/i31” code, respectively.
  * New API for server-side private key handling: when using
    ECDHE, the pluggable module that computes the signature on
    the ServerKeyExchange message can now obtain the actual
    data, not just a hash thereof (this should help with EdDSA
    integration when that function is implemented).
  * Revamped Makefile structure:
    + Simplified configuration files (in the conf/ directory)
    to allow for selectable sets of parameters, including
    build directory.
    + Visual Studio + nmake.exe is now a supported target.
  * AES implementation with the AES-NI opcodes; works with
    GCC, Clang and Visual Studio, both in 32-bit and 64-bit
    modes.
  * GHASH implementation with pclmulqdq; works with GCC, Clang
    and Visual Studio, both in 32-bit and 64-bit modes.
  * Many fixes, including a buffer overrun.
- Refreshed bearssl-compile_flags.patch</changelog>
  <changelog author="aloisio@gmx.com" date="1492084800">- Update to version 0.4
  * New AES and GHASH implementations for POWER8 processors
    (provides AES/GCM at more than 2 gigabytes per second!).
  * Improved GHASH implementation with AES-NI opcodes
    (pclmulqdq).
  * New Poly1305 implementation with 64→128 multiplications,
    available on some 64-bit architectures.
  * New “i62” big-integer code with 64→128 multiplications,
    available on some 64-bit architectures (RSA is much faster).
  * Some mostly cosmetic patches to support very old systems
    (BearSSL now compiles and run on Debian 2.2 “potato” from
    2000, with GCC 2.95).</changelog>
  <changelog author="aloisio@gmx.com" date="1502884800">- Update to version 0.5
  * Added support for the BoarSSL / Twrch test framework.
  * Header files now include the ritual mantras that make them
    compatible with C++.
  * Better Makefile behaviour with Clang (FreeBSD compatibility).
  * Worked around a bug of GCC 4.8 and 4.9 in 32-bit x86 mode.
  * Incoming application data after initiating closure is now
    properly ignored.
  * Some instances of (critical) Certificate Policies extensions
    are now ignored (when it is safe to do so).
  * Fixed some behavioural bugs with regards to renegotiation
    (all were failing safe).
  * Added encoded OID for hash functions in the public API, to
    help with using RSA signatures in non-SSL contexts.
  * Fixed bug in AES/CBC decryption on x86 with AES-NI opcode
    (this was breaking decryption with AES/CBC cipher suites and
    TLS 1.0 only).
  * Added an explicit stack buffer initialisation (some provably
    harmless accesses to uninitialised data were performed,
    Valgrind was not happy).
  * Fixed bug in the search tree for the cache of SSL sessions
    (occasional lock-ups).
  * Fixed bug in modular reduction in the special field for
    P-256 (this was infrequently breaking ECDSA signatures).
  * Added support for exporting keying material (RFC 5705).
  * Added new general-purpose API for AEAD implementations (in
    non-SSL contexts) and an AES/GCM implementation that follows
    that API.
  * Added a function to forget saved session parameter in the
    LRU cache.
  * Added a new ChaCha20 implementation that uses SSE2 on x86
    architectures (both 32-bit and 64-bit).</changelog>
  <changelog author="aloisio@gmx.com" date="1534334400">- Update to version 0.6
  * Added general-purpose implementations of EAX and CCM modes
    (including shared precomputation support for EAX).
  * Added general-purpose RSA/OAEP implementation.
  * Added general-purpose HKDF implementation.
  * Added support for CCM and CCM_8 TLS cipher suites (RFC 6655
    and RFC 7251).
  * Added RSA and EC key generation.
  * Added private key encoding support (“raw” and PKCS#8
    formats, both in DER and PEM, for RSA and EC key pairs).
  * Made Base64 encoding/decoding constant-time (with regards to
    the encoded data bytes).
  * Added a generic API for random seed providers.
  * Added an extra DRBG based on AES/CTR + Hirose construction
    for reseeding.
  * Some cosmetic fixes to avoid warnings with picky compilers.
  * Makefile fix to achieve compatibility with OpenBSD.
  * Fixed a bug in bit length computation for big integers (this
    was breaking RSA signatures with some specific implementations
    and key lengths).
  * Made SSL/TLS client stricter in cipher suite selection (to
    align with server behaviour).
- Refreshed bearssl-compile_flags.patch</changelog>
  <changelog author="Luigi Baldoni &lt;aloisio@gmx.com&gt;" date="1642507200">- Fix Factory build</changelog>
</package>
<package pkgid="5d733a353c89ed6aaee65e5c37dff0c156404cf3dae61ec24132f16d7a97ed73b78984ebe700b03803538a49cee99b0409e4f2c466d2337e2ae9baa2a9c6f840" name="bearssl-debugsource" arch="s390x">
  <version epoch="0" ver="0.6" rel="2.49"/>
  <changelog author="aloisio@gmx.com" date="1478174400">- Initial version 0.1</changelog>
  <changelog author="aloisio@gmx.com" date="1483617600">- Update to version 0.2
  * Support for ClientHello padding (RFC 7685).
  * Support for TLS_FALLBACK_SCSV (RFC 7507) (server-side;
    on the client, this is entirely under control of the
    caller).
  * New flag to prohibit renegotiations.
  * API for saving and restoring session parameters
    (controllable session resumption on the client side).
  * Client certificates: API to request a client certificate
    (on the server side), and to provide a client certificate
    (on the client side).
  * API for generic name extraction from X.509 certificates
    (from the subject DN and the SAN extension).
  * Improved T0 compilation (threaded code is about 10%
    shorter).
  * ChaCha20+Poly1305 support (RFC 7905).
  * Lots of fixes (including a couple of buffer overruns).</changelog>
  <changelog author="aloisio@gmx.com" date="1485777600">- Update to version 0.3
  * Support for ALPN extension (RFC 7301).
  * New big-integers support code (“i15”), that uses 15-bit
    words internally; this offers better performance and
    constant-time code on the ARM Cortex M series.
  * On the ARM Cortex M, a bit of inline assembly can be used
    to speed up multiplications and modular exponentations.
  * Many new elliptic curve implementations:
    + ec_prime_i15: supports P-256, P-384 and P-521 with the
    “i15” big integers.
    + ec_p256_m15: specialised implementation for P-256;
    similar to “i15” but faster. Internally, 13-bit words
    are used (for easier carry propagation).
    + ec_p256_m31: like ec_p256_m15, but using 30-bit words.
    + ec_c25519_i15 and ecc25519_i31 implement Curve25519 with
    the “i15” and “i31” big integers, respectively.
    + ec_c25519_m15 and ecc25519_m31 are specialised
    implementations of Curve25519 with 13-bit and 30-bit
    words, respectively; they are faster, but with a larger
    compiled code size.
    + ec_all_m15 and ec_all_m31 are aggregate wrappers that
    provide support for the three NIST curves and Curve25519,
    with the “m15/i15” or the “m31/i31” code, respectively.
  * New API for server-side private key handling: when using
    ECDHE, the pluggable module that computes the signature on
    the ServerKeyExchange message can now obtain the actual
    data, not just a hash thereof (this should help with EdDSA
    integration when that function is implemented).
  * Revamped Makefile structure:
    + Simplified configuration files (in the conf/ directory)
    to allow for selectable sets of parameters, including
    build directory.
    + Visual Studio + nmake.exe is now a supported target.
  * AES implementation with the AES-NI opcodes; works with
    GCC, Clang and Visual Studio, both in 32-bit and 64-bit
    modes.
  * GHASH implementation with pclmulqdq; works with GCC, Clang
    and Visual Studio, both in 32-bit and 64-bit modes.
  * Many fixes, including a buffer overrun.
- Refreshed bearssl-compile_flags.patch</changelog>
  <changelog author="aloisio@gmx.com" date="1492084800">- Update to version 0.4
  * New AES and GHASH implementations for POWER8 processors
    (provides AES/GCM at more than 2 gigabytes per second!).
  * Improved GHASH implementation with AES-NI opcodes
    (pclmulqdq).
  * New Poly1305 implementation with 64→128 multiplications,
    available on some 64-bit architectures.
  * New “i62” big-integer code with 64→128 multiplications,
    available on some 64-bit architectures (RSA is much faster).
  * Some mostly cosmetic patches to support very old systems
    (BearSSL now compiles and run on Debian 2.2 “potato” from
    2000, with GCC 2.95).</changelog>
  <changelog author="aloisio@gmx.com" date="1502884800">- Update to version 0.5
  * Added support for the BoarSSL / Twrch test framework.
  * Header files now include the ritual mantras that make them
    compatible with C++.
  * Better Makefile behaviour with Clang (FreeBSD compatibility).
  * Worked around a bug of GCC 4.8 and 4.9 in 32-bit x86 mode.
  * Incoming application data after initiating closure is now
    properly ignored.
  * Some instances of (critical) Certificate Policies extensions
    are now ignored (when it is safe to do so).
  * Fixed some behavioural bugs with regards to renegotiation
    (all were failing safe).
  * Added encoded OID for hash functions in the public API, to
    help with using RSA signatures in non-SSL contexts.
  * Fixed bug in AES/CBC decryption on x86 with AES-NI opcode
    (this was breaking decryption with AES/CBC cipher suites and
    TLS 1.0 only).
  * Added an explicit stack buffer initialisation (some provably
    harmless accesses to uninitialised data were performed,
    Valgrind was not happy).
  * Fixed bug in the search tree for the cache of SSL sessions
    (occasional lock-ups).
  * Fixed bug in modular reduction in the special field for
    P-256 (this was infrequently breaking ECDSA signatures).
  * Added support for exporting keying material (RFC 5705).
  * Added new general-purpose API for AEAD implementations (in
    non-SSL contexts) and an AES/GCM implementation that follows
    that API.
  * Added a function to forget saved session parameter in the
    LRU cache.
  * Added a new ChaCha20 implementation that uses SSE2 on x86
    architectures (both 32-bit and 64-bit).</changelog>
  <changelog author="aloisio@gmx.com" date="1534334400">- Update to version 0.6
  * Added general-purpose implementations of EAX and CCM modes
    (including shared precomputation support for EAX).
  * Added general-purpose RSA/OAEP implementation.
  * Added general-purpose HKDF implementation.
  * Added support for CCM and CCM_8 TLS cipher suites (RFC 6655
    and RFC 7251).
  * Added RSA and EC key generation.
  * Added private key encoding support (“raw” and PKCS#8
    formats, both in DER and PEM, for RSA and EC key pairs).
  * Made Base64 encoding/decoding constant-time (with regards to
    the encoded data bytes).
  * Added a generic API for random seed providers.
  * Added an extra DRBG based on AES/CTR + Hirose construction
    for reseeding.
  * Some cosmetic fixes to avoid warnings with picky compilers.
  * Makefile fix to achieve compatibility with OpenBSD.
  * Fixed a bug in bit length computation for big integers (this
    was breaking RSA signatures with some specific implementations
    and key lengths).
  * Made SSL/TLS client stricter in cipher suite selection (to
    align with server behaviour).
- Refreshed bearssl-compile_flags.patch</changelog>
  <changelog author="Luigi Baldoni &lt;aloisio@gmx.com&gt;" date="1642507200">- Fix Factory build</changelog>
</package>
<package pkgid="f91d4a99843dc774784568fe0efcbeea4c1d4fc0d84ac85913b1c60134a9e413effaeaaec30aa82220c2efee04e237afa4d06aa290f6d9167a9c0961adef3193" name="bearssl-devel" arch="s390x">
  <version epoch="0" ver="0.6" rel="2.49"/>
  <changelog author="aloisio@gmx.com" date="1478174400">- Initial version 0.1</changelog>
  <changelog author="aloisio@gmx.com" date="1483617600">- Update to version 0.2
  * Support for ClientHello padding (RFC 7685).
  * Support for TLS_FALLBACK_SCSV (RFC 7507) (server-side;
    on the client, this is entirely under control of the
    caller).
  * New flag to prohibit renegotiations.
  * API for saving and restoring session parameters
    (controllable session resumption on the client side).
  * Client certificates: API to request a client certificate
    (on the server side), and to provide a client certificate
    (on the client side).
  * API for generic name extraction from X.509 certificates
    (from the subject DN and the SAN extension).
  * Improved T0 compilation (threaded code is about 10%
    shorter).
  * ChaCha20+Poly1305 support (RFC 7905).
  * Lots of fixes (including a couple of buffer overruns).</changelog>
  <changelog author="aloisio@gmx.com" date="1485777600">- Update to version 0.3
  * Support for ALPN extension (RFC 7301).
  * New big-integers support code (“i15”), that uses 15-bit
    words internally; this offers better performance and
    constant-time code on the ARM Cortex M series.
  * On the ARM Cortex M, a bit of inline assembly can be used
    to speed up multiplications and modular exponentations.
  * Many new elliptic curve implementations:
    + ec_prime_i15: supports P-256, P-384 and P-521 with the
    “i15” big integers.
    + ec_p256_m15: specialised implementation for P-256;
    similar to “i15” but faster. Internally, 13-bit words
    are used (for easier carry propagation).
    + ec_p256_m31: like ec_p256_m15, but using 30-bit words.
    + ec_c25519_i15 and ecc25519_i31 implement Curve25519 with
    the “i15” and “i31” big integers, respectively.
    + ec_c25519_m15 and ecc25519_m31 are specialised
    implementations of Curve25519 with 13-bit and 30-bit
    words, respectively; they are faster, but with a larger
    compiled code size.
    + ec_all_m15 and ec_all_m31 are aggregate wrappers that
    provide support for the three NIST curves and Curve25519,
    with the “m15/i15” or the “m31/i31” code, respectively.
  * New API for server-side private key handling: when using
    ECDHE, the pluggable module that computes the signature on
    the ServerKeyExchange message can now obtain the actual
    data, not just a hash thereof (this should help with EdDSA
    integration when that function is implemented).
  * Revamped Makefile structure:
    + Simplified configuration files (in the conf/ directory)
    to allow for selectable sets of parameters, including
    build directory.
    + Visual Studio + nmake.exe is now a supported target.
  * AES implementation with the AES-NI opcodes; works with
    GCC, Clang and Visual Studio, both in 32-bit and 64-bit
    modes.
  * GHASH implementation with pclmulqdq; works with GCC, Clang
    and Visual Studio, both in 32-bit and 64-bit modes.
  * Many fixes, including a buffer overrun.
- Refreshed bearssl-compile_flags.patch</changelog>
  <changelog author="aloisio@gmx.com" date="1492084800">- Update to version 0.4
  * New AES and GHASH implementations for POWER8 processors
    (provides AES/GCM at more than 2 gigabytes per second!).
  * Improved GHASH implementation with AES-NI opcodes
    (pclmulqdq).
  * New Poly1305 implementation with 64→128 multiplications,
    available on some 64-bit architectures.
  * New “i62” big-integer code with 64→128 multiplications,
    available on some 64-bit architectures (RSA is much faster).
  * Some mostly cosmetic patches to support very old systems
    (BearSSL now compiles and run on Debian 2.2 “potato” from
    2000, with GCC 2.95).</changelog>
  <changelog author="aloisio@gmx.com" date="1502884800">- Update to version 0.5
  * Added support for the BoarSSL / Twrch test framework.
  * Header files now include the ritual mantras that make them
    compatible with C++.
  * Better Makefile behaviour with Clang (FreeBSD compatibility).
  * Worked around a bug of GCC 4.8 and 4.9 in 32-bit x86 mode.
  * Incoming application data after initiating closure is now
    properly ignored.
  * Some instances of (critical) Certificate Policies extensions
    are now ignored (when it is safe to do so).
  * Fixed some behavioural bugs with regards to renegotiation
    (all were failing safe).
  * Added encoded OID for hash functions in the public API, to
    help with using RSA signatures in non-SSL contexts.
  * Fixed bug in AES/CBC decryption on x86 with AES-NI opcode
    (this was breaking decryption with AES/CBC cipher suites and
    TLS 1.0 only).
  * Added an explicit stack buffer initialisation (some provably
    harmless accesses to uninitialised data were performed,
    Valgrind was not happy).
  * Fixed bug in the search tree for the cache of SSL sessions
    (occasional lock-ups).
  * Fixed bug in modular reduction in the special field for
    P-256 (this was infrequently breaking ECDSA signatures).
  * Added support for exporting keying material (RFC 5705).
  * Added new general-purpose API for AEAD implementations (in
    non-SSL contexts) and an AES/GCM implementation that follows
    that API.
  * Added a function to forget saved session parameter in the
    LRU cache.
  * Added a new ChaCha20 implementation that uses SSE2 on x86
    architectures (both 32-bit and 64-bit).</changelog>
  <changelog author="aloisio@gmx.com" date="1534334400">- Update to version 0.6
  * Added general-purpose implementations of EAX and CCM modes
    (including shared precomputation support for EAX).
  * Added general-purpose RSA/OAEP implementation.
  * Added general-purpose HKDF implementation.
  * Added support for CCM and CCM_8 TLS cipher suites (RFC 6655
    and RFC 7251).
  * Added RSA and EC key generation.
  * Added private key encoding support (“raw” and PKCS#8
    formats, both in DER and PEM, for RSA and EC key pairs).
  * Made Base64 encoding/decoding constant-time (with regards to
    the encoded data bytes).
  * Added a generic API for random seed providers.
  * Added an extra DRBG based on AES/CTR + Hirose construction
    for reseeding.
  * Some cosmetic fixes to avoid warnings with picky compilers.
  * Makefile fix to achieve compatibility with OpenBSD.
  * Fixed a bug in bit length computation for big integers (this
    was breaking RSA signatures with some specific implementations
    and key lengths).
  * Made SSL/TLS client stricter in cipher suite selection (to
    align with server behaviour).
- Refreshed bearssl-compile_flags.patch</changelog>
  <changelog author="Luigi Baldoni &lt;aloisio@gmx.com&gt;" date="1642507200">- Fix Factory build</changelog>
</package>
<package pkgid="a4e3d4cc6cb8c6572410e4ec7bcd062f35946fcc1f972760f435e5ee45d50d7aeb02d41dfbea1aeb51ab86c8e94ede6dbc38679d65d1a3f321a1cd9931399ef1" name="bearssl-devel-debuginfo" arch="s390x">
  <version epoch="0" ver="0.6" rel="2.49"/>
  <changelog author="aloisio@gmx.com" date="1478174400">- Initial version 0.1</changelog>
  <changelog author="aloisio@gmx.com" date="1483617600">- Update to version 0.2
  * Support for ClientHello padding (RFC 7685).
  * Support for TLS_FALLBACK_SCSV (RFC 7507) (server-side;
    on the client, this is entirely under control of the
    caller).
  * New flag to prohibit renegotiations.
  * API for saving and restoring session parameters
    (controllable session resumption on the client side).
  * Client certificates: API to request a client certificate
    (on the server side), and to provide a client certificate
    (on the client side).
  * API for generic name extraction from X.509 certificates
    (from the subject DN and the SAN extension).
  * Improved T0 compilation (threaded code is about 10%
    shorter).
  * ChaCha20+Poly1305 support (RFC 7905).
  * Lots of fixes (including a couple of buffer overruns).</changelog>
  <changelog author="aloisio@gmx.com" date="1485777600">- Update to version 0.3
  * Support for ALPN extension (RFC 7301).
  * New big-integers support code (“i15”), that uses 15-bit
    words internally; this offers better performance and
    constant-time code on the ARM Cortex M series.
  * On the ARM Cortex M, a bit of inline assembly can be used
    to speed up multiplications and modular exponentations.
  * Many new elliptic curve implementations:
    + ec_prime_i15: supports P-256, P-384 and P-521 with the
    “i15” big integers.
    + ec_p256_m15: specialised implementation for P-256;
    similar to “i15” but faster. Internally, 13-bit words
    are used (for easier carry propagation).
    + ec_p256_m31: like ec_p256_m15, but using 30-bit words.
    + ec_c25519_i15 and ecc25519_i31 implement Curve25519 with
    the “i15” and “i31” big integers, respectively.
    + ec_c25519_m15 and ecc25519_m31 are specialised
    implementations of Curve25519 with 13-bit and 30-bit
    words, respectively; they are faster, but with a larger
    compiled code size.
    + ec_all_m15 and ec_all_m31 are aggregate wrappers that
    provide support for the three NIST curves and Curve25519,
    with the “m15/i15” or the “m31/i31” code, respectively.
  * New API for server-side private key handling: when using
    ECDHE, the pluggable module that computes the signature on
    the ServerKeyExchange message can now obtain the actual
    data, not just a hash thereof (this should help with EdDSA
    integration when that function is implemented).
  * Revamped Makefile structure:
    + Simplified configuration files (in the conf/ directory)
    to allow for selectable sets of parameters, including
    build directory.
    + Visual Studio + nmake.exe is now a supported target.
  * AES implementation with the AES-NI opcodes; works with
    GCC, Clang and Visual Studio, both in 32-bit and 64-bit
    modes.
  * GHASH implementation with pclmulqdq; works with GCC, Clang
    and Visual Studio, both in 32-bit and 64-bit modes.
  * Many fixes, including a buffer overrun.
- Refreshed bearssl-compile_flags.patch</changelog>
  <changelog author="aloisio@gmx.com" date="1492084800">- Update to version 0.4
  * New AES and GHASH implementations for POWER8 processors
    (provides AES/GCM at more than 2 gigabytes per second!).
  * Improved GHASH implementation with AES-NI opcodes
    (pclmulqdq).
  * New Poly1305 implementation with 64→128 multiplications,
    available on some 64-bit architectures.
  * New “i62” big-integer code with 64→128 multiplications,
    available on some 64-bit architectures (RSA is much faster).
  * Some mostly cosmetic patches to support very old systems
    (BearSSL now compiles and run on Debian 2.2 “potato” from
    2000, with GCC 2.95).</changelog>
  <changelog author="aloisio@gmx.com" date="1502884800">- Update to version 0.5
  * Added support for the BoarSSL / Twrch test framework.
  * Header files now include the ritual mantras that make them
    compatible with C++.
  * Better Makefile behaviour with Clang (FreeBSD compatibility).
  * Worked around a bug of GCC 4.8 and 4.9 in 32-bit x86 mode.
  * Incoming application data after initiating closure is now
    properly ignored.
  * Some instances of (critical) Certificate Policies extensions
    are now ignored (when it is safe to do so).
  * Fixed some behavioural bugs with regards to renegotiation
    (all were failing safe).
  * Added encoded OID for hash functions in the public API, to
    help with using RSA signatures in non-SSL contexts.
  * Fixed bug in AES/CBC decryption on x86 with AES-NI opcode
    (this was breaking decryption with AES/CBC cipher suites and
    TLS 1.0 only).
  * Added an explicit stack buffer initialisation (some provably
    harmless accesses to uninitialised data were performed,
    Valgrind was not happy).
  * Fixed bug in the search tree for the cache of SSL sessions
    (occasional lock-ups).
  * Fixed bug in modular reduction in the special field for
    P-256 (this was infrequently breaking ECDSA signatures).
  * Added support for exporting keying material (RFC 5705).
  * Added new general-purpose API for AEAD implementations (in
    non-SSL contexts) and an AES/GCM implementation that follows
    that API.
  * Added a function to forget saved session parameter in the
    LRU cache.
  * Added a new ChaCha20 implementation that uses SSE2 on x86
    architectures (both 32-bit and 64-bit).</changelog>
  <changelog author="aloisio@gmx.com" date="1534334400">- Update to version 0.6
  * Added general-purpose implementations of EAX and CCM modes
    (including shared precomputation support for EAX).
  * Added general-purpose RSA/OAEP implementation.
  * Added general-purpose HKDF implementation.
  * Added support for CCM and CCM_8 TLS cipher suites (RFC 6655
    and RFC 7251).
  * Added RSA and EC key generation.
  * Added private key encoding support (“raw” and PKCS#8
    formats, both in DER and PEM, for RSA and EC key pairs).
  * Made Base64 encoding/decoding constant-time (with regards to
    the encoded data bytes).
  * Added a generic API for random seed providers.
  * Added an extra DRBG based on AES/CTR + Hirose construction
    for reseeding.
  * Some cosmetic fixes to avoid warnings with picky compilers.
  * Makefile fix to achieve compatibility with OpenBSD.
  * Fixed a bug in bit length computation for big integers (this
    was breaking RSA signatures with some specific implementations
    and key lengths).
  * Made SSL/TLS client stricter in cipher suite selection (to
    align with server behaviour).
- Refreshed bearssl-compile_flags.patch</changelog>
  <changelog author="Luigi Baldoni &lt;aloisio@gmx.com&gt;" date="1642507200">- Fix Factory build</changelog>
</package>
<package pkgid="1b8cd43f29df031a4eaf5354d4c1f7582614ff0a383eea181e3c409492a918b067990fe740603622aa08a3ad1259c4d2a2f4992ed3358f3f037f6ba864d1f81e" name="bkcrack" arch="s390x">
  <version epoch="0" ver="1.8.1" rel="4.5"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1765108800">- initial version</changelog>
</package>
<package pkgid="86e3ed214916cc5a40b0c122414c78809848f8c0664181847b787ed9b0583a36422587b2b35b642b836b8a580ec30b6037bb1c91b6474fe6a257ca2789930e25" name="bkcrack" arch="src">
  <version epoch="0" ver="1.8.1" rel="4.5"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1765108800">- initial version</changelog>
</package>
<package pkgid="35680a59e2001a67f34b2ac28f9019399d8875361ea485bffe0f997683450ffdf189a1dd5253c7b624c4d5ab3e54a11c62b119e656ea1a30edd66b8fbedf8d9f" name="bkcrack-debuginfo" arch="s390x">
  <version epoch="0" ver="1.8.1" rel="4.5"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1765108800">- initial version</changelog>
</package>
<package pkgid="6549546a6719bc192eefd12953b4305ab171b113cd2cc1b9b294fa296cca389f998acac21995c374bbaf7a63e8833b5eec41d59b6847122c59a440fe8069774c" name="bkcrack-debugsource" arch="s390x">
  <version epoch="0" ver="1.8.1" rel="4.5"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1765108800">- initial version</changelog>
</package>
<package pkgid="3f2fa2a27131a994d6c77bc7515f4314e3d6d723ea2661212466c4b74487433a825c5c989d39619e315191c39c49a835bc49812d87bb7eb3b80c3a2aa06a4780" name="bomctl" arch="s390x">
  <version epoch="0" ver="0.4.3" rel="6.28"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1735387200">- new package bomctl: Format agnostic SBOM tooling</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1736424000">- Update to version 0.4.2:
  * New features
  - feat: Output Sboms without Modification (#210) (@ashearin)
  - feat: SBOM Aliases (#129) (@lmphil)
  - feat: SBOM linking (#223) (@jhoward-lm)
  - feat: add base document db annotation,
    WithSourceDocumentAnnotations and
    WithRevisedDocumentAnnotations functions (#211) (@ashearin)
  - feat: add latest document annotation (#230) (@ashearin)
  - feat: add link command stubs (#222) (@jhoward-lm)
  - feat: bomctl push subcommand OCI client functionality (#139)
    (@jhoward-lm)
  - feat: document annotations for source data, hash, format, and
    URL (#153) (@jhoward-lm)
  - feat: github client fetch support (#209) (@lallevato-lm)
  - feat: gitlab fetch (#229) (@lmphil)
  - feat: implement autocomplete (#238) (@lallevato-lm)
  * Bug fixes
  - fix: Fix typo in MAINTAINERS (#180) (@evankanderson)
  - fix: Print DocID for list cmd. Dynamic id/alias column width
    (#165) (@ashearin)
  - fix: add cyclonedx 1.6 support (#188) (@ashearin)
  - fix: update compare_docs function (#202) (@ashearin)
  * Documentation
  - docs: ADR-0006 sbom merge (#111) (@pkwiatkowski1)
  - docs: ADR-0007 sbom diff (#112) (@mfrystacky)
  - docs: ADR-0008 storage and retrieval without modification
    (#194) (@ashearin)
  - docs: ADR-0009 SBOM Linking (#164) (@lmphil)
  - docs: Roadmap Updates (#161) (@idunbarh)
  - docs: add ADR for auth types and encrypted secrets (#104)
    (@jhoward-lm)
  * Other changes
  - refactor: add Unpack function, rename to match package (#239)
    (@jhoward-lm)
  - refactor: add choiceValue type for static sets of flag
    options (#240) (@jhoward-lm)
  - refactor: add sliceutils helper package for dev convenience
    (#163) (@jhoward-lm)
  - refactor: break out Fetcher and Pusher from Client interface,
    add PrepareFetch method (#245) (@jhoward-lm)
  - refactor: internal option to force list output if desired
    (#241) (@jhoward-lm)
  - refactor: stage all externally referenced SBOMs before push
    (#155) (@jhoward-lm)
  - test: add cmd format/encoding unit tests, update e2e tests
    (#185) (@ashearin)
  - test: add unit tests for alias/tags DB functions (#174)
    (@lmphil)
  - test: client fetch unit tests (#205) (@jhoward-lm)
  - test: integration testing of functionality (#169) (@ashearin)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746187200">- Update to version 0.4.3:
  * New features
  - feat: add gitlab push to generic package registry (#266)
    (@lmphil)
  * Bug fixes
  - fix: Handle pushing new artifacts (#269) (@ashearin)
  * Dependencies
  - chore(deps): Bump the actions group across 1 directory with 9
    updates (#298)
  - chore(deps): Bump golang.org/x/crypto from 0.32.0 to 0.35.0
    (#299)
  - chore(deps): Bump github.com/spf13/cobra (#283)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#282)
  - chore(deps): Bump golang.org/x/term from 0.28.0 to 0.29.0
    (#285)
  - chore(deps): Bump the actions group across 1 directory with 7
    updates (#286)
  - chore(deps): Bump the gomod group across 1 directory with 3
    updates (#279)
  - chore(deps): Bump the actions group across 1 directory with 9
    updates (#280)
  - chore(deps): Bump the actions group with 2 updates (#270)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#271)
  - chore(deps): Bump the gomod group across 1 directory with 3
    updates (#268)
  - chore(deps): Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
    (#262)
  - chore(deps): Bump the actions group with 3 updates (#263)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#267)
  - chore(deps): Bump DavidAnson/markdownlint-cli2-action (#264)
  - chore(deps): Bump github.com/go-git/go-git/v5 from 5.12.0 to
    5.13.1 (#251)</changelog>
</package>
<package pkgid="a31c49a411cc3b61d3d17c85aa97dcb525ab1a872577511451876e4458de8f248a288d3cc437ed824808cf520547923bf34ec0a68b1f3cd3248f3efa02b7f6a1" name="bomctl" arch="src">
  <version epoch="0" ver="0.4.3" rel="6.28"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1735387200">- new package bomctl: Format agnostic SBOM tooling</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1736424000">- Update to version 0.4.2:
  * New features
  - feat: Output Sboms without Modification (#210) (@ashearin)
  - feat: SBOM Aliases (#129) (@lmphil)
  - feat: SBOM linking (#223) (@jhoward-lm)
  - feat: add base document db annotation,
    WithSourceDocumentAnnotations and
    WithRevisedDocumentAnnotations functions (#211) (@ashearin)
  - feat: add latest document annotation (#230) (@ashearin)
  - feat: add link command stubs (#222) (@jhoward-lm)
  - feat: bomctl push subcommand OCI client functionality (#139)
    (@jhoward-lm)
  - feat: document annotations for source data, hash, format, and
    URL (#153) (@jhoward-lm)
  - feat: github client fetch support (#209) (@lallevato-lm)
  - feat: gitlab fetch (#229) (@lmphil)
  - feat: implement autocomplete (#238) (@lallevato-lm)
  * Bug fixes
  - fix: Fix typo in MAINTAINERS (#180) (@evankanderson)
  - fix: Print DocID for list cmd. Dynamic id/alias column width
    (#165) (@ashearin)
  - fix: add cyclonedx 1.6 support (#188) (@ashearin)
  - fix: update compare_docs function (#202) (@ashearin)
  * Documentation
  - docs: ADR-0006 sbom merge (#111) (@pkwiatkowski1)
  - docs: ADR-0007 sbom diff (#112) (@mfrystacky)
  - docs: ADR-0008 storage and retrieval without modification
    (#194) (@ashearin)
  - docs: ADR-0009 SBOM Linking (#164) (@lmphil)
  - docs: Roadmap Updates (#161) (@idunbarh)
  - docs: add ADR for auth types and encrypted secrets (#104)
    (@jhoward-lm)
  * Other changes
  - refactor: add Unpack function, rename to match package (#239)
    (@jhoward-lm)
  - refactor: add choiceValue type for static sets of flag
    options (#240) (@jhoward-lm)
  - refactor: add sliceutils helper package for dev convenience
    (#163) (@jhoward-lm)
  - refactor: break out Fetcher and Pusher from Client interface,
    add PrepareFetch method (#245) (@jhoward-lm)
  - refactor: internal option to force list output if desired
    (#241) (@jhoward-lm)
  - refactor: stage all externally referenced SBOMs before push
    (#155) (@jhoward-lm)
  - test: add cmd format/encoding unit tests, update e2e tests
    (#185) (@ashearin)
  - test: add unit tests for alias/tags DB functions (#174)
    (@lmphil)
  - test: client fetch unit tests (#205) (@jhoward-lm)
  - test: integration testing of functionality (#169) (@ashearin)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746187200">- Update to version 0.4.3:
  * New features
  - feat: add gitlab push to generic package registry (#266)
    (@lmphil)
  * Bug fixes
  - fix: Handle pushing new artifacts (#269) (@ashearin)
  * Dependencies
  - chore(deps): Bump the actions group across 1 directory with 9
    updates (#298)
  - chore(deps): Bump golang.org/x/crypto from 0.32.0 to 0.35.0
    (#299)
  - chore(deps): Bump github.com/spf13/cobra (#283)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#282)
  - chore(deps): Bump golang.org/x/term from 0.28.0 to 0.29.0
    (#285)
  - chore(deps): Bump the actions group across 1 directory with 7
    updates (#286)
  - chore(deps): Bump the gomod group across 1 directory with 3
    updates (#279)
  - chore(deps): Bump the actions group across 1 directory with 9
    updates (#280)
  - chore(deps): Bump the actions group with 2 updates (#270)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#271)
  - chore(deps): Bump the gomod group across 1 directory with 3
    updates (#268)
  - chore(deps): Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
    (#262)
  - chore(deps): Bump the actions group with 3 updates (#263)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#267)
  - chore(deps): Bump DavidAnson/markdownlint-cli2-action (#264)
  - chore(deps): Bump github.com/go-git/go-git/v5 from 5.12.0 to
    5.13.1 (#251)</changelog>
</package>
<package pkgid="b7c88eb2a884298ec3417b7d3f1bab9b1f412680e479fb6fa7d43e254748bcb91edb164ae121d336ab4e6ae279055aad111d3b3ac758074bde6ca1fdaa943550" name="bomctl-bash-completion" arch="noarch">
  <version epoch="0" ver="0.4.3" rel="6.28"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1735387200">- new package bomctl: Format agnostic SBOM tooling</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1736424000">- Update to version 0.4.2:
  * New features
  - feat: Output Sboms without Modification (#210) (@ashearin)
  - feat: SBOM Aliases (#129) (@lmphil)
  - feat: SBOM linking (#223) (@jhoward-lm)
  - feat: add base document db annotation,
    WithSourceDocumentAnnotations and
    WithRevisedDocumentAnnotations functions (#211) (@ashearin)
  - feat: add latest document annotation (#230) (@ashearin)
  - feat: add link command stubs (#222) (@jhoward-lm)
  - feat: bomctl push subcommand OCI client functionality (#139)
    (@jhoward-lm)
  - feat: document annotations for source data, hash, format, and
    URL (#153) (@jhoward-lm)
  - feat: github client fetch support (#209) (@lallevato-lm)
  - feat: gitlab fetch (#229) (@lmphil)
  - feat: implement autocomplete (#238) (@lallevato-lm)
  * Bug fixes
  - fix: Fix typo in MAINTAINERS (#180) (@evankanderson)
  - fix: Print DocID for list cmd. Dynamic id/alias column width
    (#165) (@ashearin)
  - fix: add cyclonedx 1.6 support (#188) (@ashearin)
  - fix: update compare_docs function (#202) (@ashearin)
  * Documentation
  - docs: ADR-0006 sbom merge (#111) (@pkwiatkowski1)
  - docs: ADR-0007 sbom diff (#112) (@mfrystacky)
  - docs: ADR-0008 storage and retrieval without modification
    (#194) (@ashearin)
  - docs: ADR-0009 SBOM Linking (#164) (@lmphil)
  - docs: Roadmap Updates (#161) (@idunbarh)
  - docs: add ADR for auth types and encrypted secrets (#104)
    (@jhoward-lm)
  * Other changes
  - refactor: add Unpack function, rename to match package (#239)
    (@jhoward-lm)
  - refactor: add choiceValue type for static sets of flag
    options (#240) (@jhoward-lm)
  - refactor: add sliceutils helper package for dev convenience
    (#163) (@jhoward-lm)
  - refactor: break out Fetcher and Pusher from Client interface,
    add PrepareFetch method (#245) (@jhoward-lm)
  - refactor: internal option to force list output if desired
    (#241) (@jhoward-lm)
  - refactor: stage all externally referenced SBOMs before push
    (#155) (@jhoward-lm)
  - test: add cmd format/encoding unit tests, update e2e tests
    (#185) (@ashearin)
  - test: add unit tests for alias/tags DB functions (#174)
    (@lmphil)
  - test: client fetch unit tests (#205) (@jhoward-lm)
  - test: integration testing of functionality (#169) (@ashearin)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746187200">- Update to version 0.4.3:
  * New features
  - feat: add gitlab push to generic package registry (#266)
    (@lmphil)
  * Bug fixes
  - fix: Handle pushing new artifacts (#269) (@ashearin)
  * Dependencies
  - chore(deps): Bump the actions group across 1 directory with 9
    updates (#298)
  - chore(deps): Bump golang.org/x/crypto from 0.32.0 to 0.35.0
    (#299)
  - chore(deps): Bump github.com/spf13/cobra (#283)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#282)
  - chore(deps): Bump golang.org/x/term from 0.28.0 to 0.29.0
    (#285)
  - chore(deps): Bump the actions group across 1 directory with 7
    updates (#286)
  - chore(deps): Bump the gomod group across 1 directory with 3
    updates (#279)
  - chore(deps): Bump the actions group across 1 directory with 9
    updates (#280)
  - chore(deps): Bump the actions group with 2 updates (#270)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#271)
  - chore(deps): Bump the gomod group across 1 directory with 3
    updates (#268)
  - chore(deps): Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
    (#262)
  - chore(deps): Bump the actions group with 3 updates (#263)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#267)
  - chore(deps): Bump DavidAnson/markdownlint-cli2-action (#264)
  - chore(deps): Bump github.com/go-git/go-git/v5 from 5.12.0 to
    5.13.1 (#251)</changelog>
</package>
<package pkgid="f5795ebbda0364b2ae70149ad9a4f34400b1af3dde76ff1c2e1ea35576ed5e89aec43b68599828f36fc24a9ee45659e0638d863d087d85c57f03fdaeaeaff774" name="bomctl-debuginfo" arch="s390x">
  <version epoch="0" ver="0.4.3" rel="6.28"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1735387200">- new package bomctl: Format agnostic SBOM tooling</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1736424000">- Update to version 0.4.2:
  * New features
  - feat: Output Sboms without Modification (#210) (@ashearin)
  - feat: SBOM Aliases (#129) (@lmphil)
  - feat: SBOM linking (#223) (@jhoward-lm)
  - feat: add base document db annotation,
    WithSourceDocumentAnnotations and
    WithRevisedDocumentAnnotations functions (#211) (@ashearin)
  - feat: add latest document annotation (#230) (@ashearin)
  - feat: add link command stubs (#222) (@jhoward-lm)
  - feat: bomctl push subcommand OCI client functionality (#139)
    (@jhoward-lm)
  - feat: document annotations for source data, hash, format, and
    URL (#153) (@jhoward-lm)
  - feat: github client fetch support (#209) (@lallevato-lm)
  - feat: gitlab fetch (#229) (@lmphil)
  - feat: implement autocomplete (#238) (@lallevato-lm)
  * Bug fixes
  - fix: Fix typo in MAINTAINERS (#180) (@evankanderson)
  - fix: Print DocID for list cmd. Dynamic id/alias column width
    (#165) (@ashearin)
  - fix: add cyclonedx 1.6 support (#188) (@ashearin)
  - fix: update compare_docs function (#202) (@ashearin)
  * Documentation
  - docs: ADR-0006 sbom merge (#111) (@pkwiatkowski1)
  - docs: ADR-0007 sbom diff (#112) (@mfrystacky)
  - docs: ADR-0008 storage and retrieval without modification
    (#194) (@ashearin)
  - docs: ADR-0009 SBOM Linking (#164) (@lmphil)
  - docs: Roadmap Updates (#161) (@idunbarh)
  - docs: add ADR for auth types and encrypted secrets (#104)
    (@jhoward-lm)
  * Other changes
  - refactor: add Unpack function, rename to match package (#239)
    (@jhoward-lm)
  - refactor: add choiceValue type for static sets of flag
    options (#240) (@jhoward-lm)
  - refactor: add sliceutils helper package for dev convenience
    (#163) (@jhoward-lm)
  - refactor: break out Fetcher and Pusher from Client interface,
    add PrepareFetch method (#245) (@jhoward-lm)
  - refactor: internal option to force list output if desired
    (#241) (@jhoward-lm)
  - refactor: stage all externally referenced SBOMs before push
    (#155) (@jhoward-lm)
  - test: add cmd format/encoding unit tests, update e2e tests
    (#185) (@ashearin)
  - test: add unit tests for alias/tags DB functions (#174)
    (@lmphil)
  - test: client fetch unit tests (#205) (@jhoward-lm)
  - test: integration testing of functionality (#169) (@ashearin)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746187200">- Update to version 0.4.3:
  * New features
  - feat: add gitlab push to generic package registry (#266)
    (@lmphil)
  * Bug fixes
  - fix: Handle pushing new artifacts (#269) (@ashearin)
  * Dependencies
  - chore(deps): Bump the actions group across 1 directory with 9
    updates (#298)
  - chore(deps): Bump golang.org/x/crypto from 0.32.0 to 0.35.0
    (#299)
  - chore(deps): Bump github.com/spf13/cobra (#283)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#282)
  - chore(deps): Bump golang.org/x/term from 0.28.0 to 0.29.0
    (#285)
  - chore(deps): Bump the actions group across 1 directory with 7
    updates (#286)
  - chore(deps): Bump the gomod group across 1 directory with 3
    updates (#279)
  - chore(deps): Bump the actions group across 1 directory with 9
    updates (#280)
  - chore(deps): Bump the actions group with 2 updates (#270)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#271)
  - chore(deps): Bump the gomod group across 1 directory with 3
    updates (#268)
  - chore(deps): Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
    (#262)
  - chore(deps): Bump the actions group with 3 updates (#263)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#267)
  - chore(deps): Bump DavidAnson/markdownlint-cli2-action (#264)
  - chore(deps): Bump github.com/go-git/go-git/v5 from 5.12.0 to
    5.13.1 (#251)</changelog>
</package>
<package pkgid="c1334f27b317cec12432d49bb4e38adf0b9b40bf2cea4a6606852db59c582bfce282fccbe20bf1c680c95f091cf8758c40a0a7914f84085fef99d071ec1f6060" name="bomctl-fish-completion" arch="noarch">
  <version epoch="0" ver="0.4.3" rel="6.28"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1735387200">- new package bomctl: Format agnostic SBOM tooling</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1736424000">- Update to version 0.4.2:
  * New features
  - feat: Output Sboms without Modification (#210) (@ashearin)
  - feat: SBOM Aliases (#129) (@lmphil)
  - feat: SBOM linking (#223) (@jhoward-lm)
  - feat: add base document db annotation,
    WithSourceDocumentAnnotations and
    WithRevisedDocumentAnnotations functions (#211) (@ashearin)
  - feat: add latest document annotation (#230) (@ashearin)
  - feat: add link command stubs (#222) (@jhoward-lm)
  - feat: bomctl push subcommand OCI client functionality (#139)
    (@jhoward-lm)
  - feat: document annotations for source data, hash, format, and
    URL (#153) (@jhoward-lm)
  - feat: github client fetch support (#209) (@lallevato-lm)
  - feat: gitlab fetch (#229) (@lmphil)
  - feat: implement autocomplete (#238) (@lallevato-lm)
  * Bug fixes
  - fix: Fix typo in MAINTAINERS (#180) (@evankanderson)
  - fix: Print DocID for list cmd. Dynamic id/alias column width
    (#165) (@ashearin)
  - fix: add cyclonedx 1.6 support (#188) (@ashearin)
  - fix: update compare_docs function (#202) (@ashearin)
  * Documentation
  - docs: ADR-0006 sbom merge (#111) (@pkwiatkowski1)
  - docs: ADR-0007 sbom diff (#112) (@mfrystacky)
  - docs: ADR-0008 storage and retrieval without modification
    (#194) (@ashearin)
  - docs: ADR-0009 SBOM Linking (#164) (@lmphil)
  - docs: Roadmap Updates (#161) (@idunbarh)
  - docs: add ADR for auth types and encrypted secrets (#104)
    (@jhoward-lm)
  * Other changes
  - refactor: add Unpack function, rename to match package (#239)
    (@jhoward-lm)
  - refactor: add choiceValue type for static sets of flag
    options (#240) (@jhoward-lm)
  - refactor: add sliceutils helper package for dev convenience
    (#163) (@jhoward-lm)
  - refactor: break out Fetcher and Pusher from Client interface,
    add PrepareFetch method (#245) (@jhoward-lm)
  - refactor: internal option to force list output if desired
    (#241) (@jhoward-lm)
  - refactor: stage all externally referenced SBOMs before push
    (#155) (@jhoward-lm)
  - test: add cmd format/encoding unit tests, update e2e tests
    (#185) (@ashearin)
  - test: add unit tests for alias/tags DB functions (#174)
    (@lmphil)
  - test: client fetch unit tests (#205) (@jhoward-lm)
  - test: integration testing of functionality (#169) (@ashearin)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746187200">- Update to version 0.4.3:
  * New features
  - feat: add gitlab push to generic package registry (#266)
    (@lmphil)
  * Bug fixes
  - fix: Handle pushing new artifacts (#269) (@ashearin)
  * Dependencies
  - chore(deps): Bump the actions group across 1 directory with 9
    updates (#298)
  - chore(deps): Bump golang.org/x/crypto from 0.32.0 to 0.35.0
    (#299)
  - chore(deps): Bump github.com/spf13/cobra (#283)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#282)
  - chore(deps): Bump golang.org/x/term from 0.28.0 to 0.29.0
    (#285)
  - chore(deps): Bump the actions group across 1 directory with 7
    updates (#286)
  - chore(deps): Bump the gomod group across 1 directory with 3
    updates (#279)
  - chore(deps): Bump the actions group across 1 directory with 9
    updates (#280)
  - chore(deps): Bump the actions group with 2 updates (#270)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#271)
  - chore(deps): Bump the gomod group across 1 directory with 3
    updates (#268)
  - chore(deps): Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
    (#262)
  - chore(deps): Bump the actions group with 3 updates (#263)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#267)
  - chore(deps): Bump DavidAnson/markdownlint-cli2-action (#264)
  - chore(deps): Bump github.com/go-git/go-git/v5 from 5.12.0 to
    5.13.1 (#251)</changelog>
</package>
<package pkgid="f0f47f7405946c155e2efa616f442e477c1315dc58c766a64bf87097d9af1ae01dde1fda500ad5032ccd8544d16fcd0e9583abddbfc5df88feccfd871d62b612" name="bomctl-zsh-completion" arch="noarch">
  <version epoch="0" ver="0.4.3" rel="6.28"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1735387200">- new package bomctl: Format agnostic SBOM tooling</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1736424000">- Update to version 0.4.2:
  * New features
  - feat: Output Sboms without Modification (#210) (@ashearin)
  - feat: SBOM Aliases (#129) (@lmphil)
  - feat: SBOM linking (#223) (@jhoward-lm)
  - feat: add base document db annotation,
    WithSourceDocumentAnnotations and
    WithRevisedDocumentAnnotations functions (#211) (@ashearin)
  - feat: add latest document annotation (#230) (@ashearin)
  - feat: add link command stubs (#222) (@jhoward-lm)
  - feat: bomctl push subcommand OCI client functionality (#139)
    (@jhoward-lm)
  - feat: document annotations for source data, hash, format, and
    URL (#153) (@jhoward-lm)
  - feat: github client fetch support (#209) (@lallevato-lm)
  - feat: gitlab fetch (#229) (@lmphil)
  - feat: implement autocomplete (#238) (@lallevato-lm)
  * Bug fixes
  - fix: Fix typo in MAINTAINERS (#180) (@evankanderson)
  - fix: Print DocID for list cmd. Dynamic id/alias column width
    (#165) (@ashearin)
  - fix: add cyclonedx 1.6 support (#188) (@ashearin)
  - fix: update compare_docs function (#202) (@ashearin)
  * Documentation
  - docs: ADR-0006 sbom merge (#111) (@pkwiatkowski1)
  - docs: ADR-0007 sbom diff (#112) (@mfrystacky)
  - docs: ADR-0008 storage and retrieval without modification
    (#194) (@ashearin)
  - docs: ADR-0009 SBOM Linking (#164) (@lmphil)
  - docs: Roadmap Updates (#161) (@idunbarh)
  - docs: add ADR for auth types and encrypted secrets (#104)
    (@jhoward-lm)
  * Other changes
  - refactor: add Unpack function, rename to match package (#239)
    (@jhoward-lm)
  - refactor: add choiceValue type for static sets of flag
    options (#240) (@jhoward-lm)
  - refactor: add sliceutils helper package for dev convenience
    (#163) (@jhoward-lm)
  - refactor: break out Fetcher and Pusher from Client interface,
    add PrepareFetch method (#245) (@jhoward-lm)
  - refactor: internal option to force list output if desired
    (#241) (@jhoward-lm)
  - refactor: stage all externally referenced SBOMs before push
    (#155) (@jhoward-lm)
  - test: add cmd format/encoding unit tests, update e2e tests
    (#185) (@ashearin)
  - test: add unit tests for alias/tags DB functions (#174)
    (@lmphil)
  - test: client fetch unit tests (#205) (@jhoward-lm)
  - test: integration testing of functionality (#169) (@ashearin)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746187200">- Update to version 0.4.3:
  * New features
  - feat: add gitlab push to generic package registry (#266)
    (@lmphil)
  * Bug fixes
  - fix: Handle pushing new artifacts (#269) (@ashearin)
  * Dependencies
  - chore(deps): Bump the actions group across 1 directory with 9
    updates (#298)
  - chore(deps): Bump golang.org/x/crypto from 0.32.0 to 0.35.0
    (#299)
  - chore(deps): Bump github.com/spf13/cobra (#283)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#282)
  - chore(deps): Bump golang.org/x/term from 0.28.0 to 0.29.0
    (#285)
  - chore(deps): Bump the actions group across 1 directory with 7
    updates (#286)
  - chore(deps): Bump the gomod group across 1 directory with 3
    updates (#279)
  - chore(deps): Bump the actions group across 1 directory with 9
    updates (#280)
  - chore(deps): Bump the actions group with 2 updates (#270)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#271)
  - chore(deps): Bump the gomod group across 1 directory with 3
    updates (#268)
  - chore(deps): Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
    (#262)
  - chore(deps): Bump the actions group with 3 updates (#263)
  - chore(deps): Bump gitlab.com/gitlab-org/api/client-go (#267)
  - chore(deps): Bump DavidAnson/markdownlint-cli2-action (#264)
  - chore(deps): Bump github.com/go-git/go-git/v5 from 5.12.0 to
    5.13.1 (#251)</changelog>
</package>
<package pkgid="ea308f60f01d3eeaf7dcc6dc0c09d857a79a41f554ef2c207fb2289383d60482786af4a0ef70ed926b758bd54d507f0f596c1282edb70f9b8188a840adffbeb2" name="ccrypt" arch="s390x">
  <version epoch="0" ver="1.11" rel="12.49"/>
  <changelog author="mpluskal@suse.com" date="1449662400">- Update to 1.10
  * see ChangeLog for details
- Cleanup spec file with spec-cleaner
- Use shared gcrypt instead of bundled one
- Enable emacs support
- Initial changelog - previous packaging done by:
  * Pascal Bleser &lt;pascal.bleser@opensuse.org&gt;
  * Leo Eraly &lt;leo@unstable.be&gt;</changelog>
  <changelog author="mpluskal@suse.com" date="1461844800">- Install COPYING</changelog>
  <changelog author="mpluskal@suse.com" date="1512648000">- Split lang and emacs support subpackages
- Run provided tests</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1544788800">- Update to version 1.11:
  * In cat and unixcrypt modes, "-" can now be specified as a
    filename to mean standard input.
  * The emacs mode has been updated for compatibility with Emacs 26.
  * Estonian translations were added.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1642766400">- Workaround failing tests on Tumbleweed</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- switch to https source url</changelog>
</package>
<package pkgid="e99df66b2618f4b8603ca3964c8ac69f3a72278c0c9996a2dd1a34ef0974621f0cecfb5b9646e041c4e17f7ff9e548e6e52c233878e1a3ef8a6fbc5d268bbbf3" name="ccrypt" arch="src">
  <version epoch="0" ver="1.11" rel="12.49"/>
  <changelog author="mpluskal@suse.com" date="1449662400">- Update to 1.10
  * see ChangeLog for details
- Cleanup spec file with spec-cleaner
- Use shared gcrypt instead of bundled one
- Enable emacs support
- Initial changelog - previous packaging done by:
  * Pascal Bleser &lt;pascal.bleser@opensuse.org&gt;
  * Leo Eraly &lt;leo@unstable.be&gt;</changelog>
  <changelog author="mpluskal@suse.com" date="1461844800">- Install COPYING</changelog>
  <changelog author="mpluskal@suse.com" date="1512648000">- Split lang and emacs support subpackages
- Run provided tests</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1544788800">- Update to version 1.11:
  * In cat and unixcrypt modes, "-" can now be specified as a
    filename to mean standard input.
  * The emacs mode has been updated for compatibility with Emacs 26.
  * Estonian translations were added.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1642766400">- Workaround failing tests on Tumbleweed</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- switch to https source url</changelog>
</package>
<package pkgid="d252a1a17a501954aa1558db27f352d150d76fa680c8ef528370e90aa5cb0fe2180b568e13b414bc57b2fd846e6a8d42fd0de870acdffb04ce0c65061a4890ff" name="ccrypt-debuginfo" arch="s390x">
  <version epoch="0" ver="1.11" rel="12.49"/>
  <changelog author="mpluskal@suse.com" date="1449662400">- Update to 1.10
  * see ChangeLog for details
- Cleanup spec file with spec-cleaner
- Use shared gcrypt instead of bundled one
- Enable emacs support
- Initial changelog - previous packaging done by:
  * Pascal Bleser &lt;pascal.bleser@opensuse.org&gt;
  * Leo Eraly &lt;leo@unstable.be&gt;</changelog>
  <changelog author="mpluskal@suse.com" date="1461844800">- Install COPYING</changelog>
  <changelog author="mpluskal@suse.com" date="1512648000">- Split lang and emacs support subpackages
- Run provided tests</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1544788800">- Update to version 1.11:
  * In cat and unixcrypt modes, "-" can now be specified as a
    filename to mean standard input.
  * The emacs mode has been updated for compatibility with Emacs 26.
  * Estonian translations were added.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1642766400">- Workaround failing tests on Tumbleweed</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- switch to https source url</changelog>
</package>
<package pkgid="37f2505e44480cdb6afb6301ab1e26875299add8ee1da3abba23d2b701e0252f7f68274c9cd53ba644a351a8542b4d476f7904e16f5f4b55cf77b6cbfd4e948f" name="ccrypt-debugsource" arch="s390x">
  <version epoch="0" ver="1.11" rel="12.49"/>
  <changelog author="mpluskal@suse.com" date="1449662400">- Update to 1.10
  * see ChangeLog for details
- Cleanup spec file with spec-cleaner
- Use shared gcrypt instead of bundled one
- Enable emacs support
- Initial changelog - previous packaging done by:
  * Pascal Bleser &lt;pascal.bleser@opensuse.org&gt;
  * Leo Eraly &lt;leo@unstable.be&gt;</changelog>
  <changelog author="mpluskal@suse.com" date="1461844800">- Install COPYING</changelog>
  <changelog author="mpluskal@suse.com" date="1512648000">- Split lang and emacs support subpackages
- Run provided tests</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1544788800">- Update to version 1.11:
  * In cat and unixcrypt modes, "-" can now be specified as a
    filename to mean standard input.
  * The emacs mode has been updated for compatibility with Emacs 26.
  * Estonian translations were added.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1642766400">- Workaround failing tests on Tumbleweed</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- switch to https source url</changelog>
</package>
<package pkgid="6ec9907d480c758ad623cc82e71da3744fbe6a3b65c964ec7cecb97fb7f4d2eff19f5f3ebcb004ada5cf0969ee8bb9c47a61e2a3f96d0f3cd2e0e5e16df2626e" name="ccrypt-emacs" arch="s390x">
  <version epoch="0" ver="1.11" rel="12.49"/>
  <changelog author="mpluskal@suse.com" date="1449662400">- Update to 1.10
  * see ChangeLog for details
- Cleanup spec file with spec-cleaner
- Use shared gcrypt instead of bundled one
- Enable emacs support
- Initial changelog - previous packaging done by:
  * Pascal Bleser &lt;pascal.bleser@opensuse.org&gt;
  * Leo Eraly &lt;leo@unstable.be&gt;</changelog>
  <changelog author="mpluskal@suse.com" date="1461844800">- Install COPYING</changelog>
  <changelog author="mpluskal@suse.com" date="1512648000">- Split lang and emacs support subpackages
- Run provided tests</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1544788800">- Update to version 1.11:
  * In cat and unixcrypt modes, "-" can now be specified as a
    filename to mean standard input.
  * The emacs mode has been updated for compatibility with Emacs 26.
  * Estonian translations were added.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1642766400">- Workaround failing tests on Tumbleweed</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- switch to https source url</changelog>
</package>
<package pkgid="0eb979ed989fc092fb33a7685b50d1bf53e544c66cf977e85e2c2c69a2e5a870e8b11afe88812f647bebcd2a4b71670095efe345c2704a2190e98ccafd9ebd99" name="ccrypt-lang" arch="noarch">
  <version epoch="0" ver="1.11" rel="12.49"/>
  <changelog author="mpluskal@suse.com" date="1449662400">- Update to 1.10
  * see ChangeLog for details
- Cleanup spec file with spec-cleaner
- Use shared gcrypt instead of bundled one
- Enable emacs support
- Initial changelog - previous packaging done by:
  * Pascal Bleser &lt;pascal.bleser@opensuse.org&gt;
  * Leo Eraly &lt;leo@unstable.be&gt;</changelog>
  <changelog author="mpluskal@suse.com" date="1461844800">- Install COPYING</changelog>
  <changelog author="mpluskal@suse.com" date="1512648000">- Split lang and emacs support subpackages
- Run provided tests</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1544788800">- Update to version 1.11:
  * In cat and unixcrypt modes, "-" can now be specified as a
    filename to mean standard input.
  * The emacs mode has been updated for compatibility with Emacs 26.
  * Estonian translations were added.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1642766400">- Workaround failing tests on Tumbleweed</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- switch to https source url</changelog>
</package>
<package pkgid="fa4a4d9f0fb72453818988c1e476b8b445b533bcdd974fe946693b031439598dd8317e6970a86c0a960bbf77f00ee88191f2515def3a52eb0e1241255d62493a" name="cdk" arch="src">
  <version epoch="0" ver="5.0.20230201" rel="189.27"/>
  <changelog author="adrian@suse.de" date="1073736000">- add %defattr and %run_ldconfig</changelog>
  <changelog author="werner@suse.de" date="1101211200">- Add cdk to required packages for cdk-devel (bug #48405)
- Update to cdk 4.9.13</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="meissner@suse.de" date="1175169600">- added ncurses-devel</changelog>
  <changelog author="crrodriguez@suse.de" date="1236513600">- remove static libraries</changelog>
  <changelog author="coolo@novell.com" date="1251633600">- use %patch for Patch</changelog>
  <changelog author="coolo@novell.com" date="1266580800">- fix compilation with gcc 4.5</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile</changelog>
  <changelog author="coolo@suse.com" date="1317384000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="p.drouand@gmail.com" date="1419508800">- Update to version 5.0.20141106
  + Too many things to list; please read the changelog file
- Cleanup specfile
- Split out cdk library to a lib subpackage
- Update Url and source download Url
- Remove obsolete cdk-4.9.13.dif</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- fixed url, added .asc and keyring</changelog>
  <changelog author="p.drouand@gmail.com" date="1446379200">- Update to version 5.0.20150928
  * build ".deb" test-package with ncurses6, using versioned symbols.
  * modifications from ncurses/xterm to allow alternate to /bin/sh for
    configure-shell, while dropping support for non-POSIX shell such
    as Solaris.
  * updated/integrated changes for versioned symbols from ncurses6.
  * CF_DISABLE_LIBTOOL_VERSION when using -version-info (the native
    libtool mode), get the ABI_VERSION value from $VERSION (which comes
    from CF_VERSION_INFO)
  * CF_ADD_INCDIR fix an infinite loop when the include-directory to be
    added does not exist (bdo#786436)
  * CF_WITH_NCURSES_ETC add --with-screen option
  * CF_SUBDIR_PATH change this to a loop, adding /usr/pkg (NetBSD) and
    /opt/local (Mac OSX)
  * update config.guess, config.sub</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1550836800">- Update to version 5.0.20190220
  * 2019/02/20
    + updated rpm spec-file, for test-builds.
    + added pkgsrc files, for test-builds.
    + updated FreeBSD port-files, for test-builds.
    + add getCdkTitle, which uses new display encoding "&lt;#10&gt;" for newline
    in the example which demonstrates it, mentry_ex2 (prompted by
    discussion with Stéphane Goujet).
    + fix similar memory leaks in setCDKRadioItems and setCDKSelectionItems
    + fix memory leak in setCDKScrollItems (report by Stéphane Goujet).
    + make functionKey parameter to getchCDKObject optional
    (suggested by Stéphane Goujet).
    + modify test-packages to adjust includes in cdk.h when using test
    package for ncurses6 which would confuse test-package for cdk-perl.
    + change shlib-version in test-package to "abi", for better
    compatibility with the test-package for cdk-perl.
    + add manpage for cdk5-config
    + documentation improvements (report by Stéphane Goujet).
    + add check in drawCDKScrollCurrent() in case the list is not
    initialized (report by Stéphane Goujet).
    + modify writeCharAttrib to replace the color in the target cell rather
    than OR'ing it from the source-attribute (patch by Aarian P. Aleahmad)
    + add a null-pointer check in viewer.c's PatternNotFound() function
    (report by "c").
    + improve macros/markup in manpages.
    + updated configure macros, from lynx and ncurses development:
    CF_ADD_INCDIR, CF_CC_ENV_FLAGS, CF_CURSES_CPPFLAGS, CF_CURSES_LIBS,
    CF_FIND_LINKAGE, CF_GCC_WARNINGS, CF_GNU_SOURCE, CF_LD_RPATH_OPT,
    CF_NCURSES_CONFIG, CF_PDCURSES_X11, CF_POSIX_C_SOURCE, CF_PROG_EXT,
    CF_SHARED_OPTS, CF_TRY_XOPEN_SOURCE, CF_WITH_VERSIONED_SYMS,
    CF_XOPEN_CURSES, CF_XOPEN_SOURCE, CF_X_ATHENA_CPPFLAGS
    + update config.guess, config.sub
  * 2018/03/06
    + update versioned-symbol list for reRegisterCDKObject (prompted by
    Debian #892114, which adopted a different set of symbol versions
    such as "5.0.20161120", cf: 2014/11/06).
    + updated configure macros, from lynx development:  CF_CURSES_FUNCS,
    CF_CURSES_LIBS, CF_MAKEFLAGS, CF_NCURSES_CONFIG, CF_SHARED_OPTS
    + update config.guess, config.sub
  * 2017/12/09
    + updated ftp url in test-packages, etc.
    + updated configure macros CF_CC_ENV_FLAGS, CF_SHARED_OPTS
    + update config.guess, config.sub
  * 2017/09/18
    + updated configure macros:
    + CF_ADD_CFLAGS improve formatting of generated lists using
    CF_APPEND_TEXT
    + CF_CC_ENV_FLAGS - two changes
    a) revise the expression generating $cf_flags to actually work when
    there is more than one option.
    b) correct the parameter passed to CF_ADD_CFLAGS, which was the
    whole list rather than the current parameter.
    + CF_CURSES_LIBS reorganize to handle the case where initscr is a
    macro.
    + CF_NCURSES_CONFIG add check for term.h when using pkg-config
    + CF_NCURSES_VERSION use prototype for main
    + CF_SHARED_OPTS workaround for PGI compiler
    + CF_WITH_LIBTOOL use SIGQUIT(3) rather than SIGTRAP(5) in trap
    commands.  Fix a few places in configure/build scripts where
    DESTDIR and rpath were combined.
    + update config.guess, config.sub
  * 2016/12/10
    + improve formatting of manpages, using bullets
    + add -C and -R options to matrix_ex.c to exercise the col/row spacing
    features of matrix widget.
    + modify matrix widget to highlight the current cell for the cases
    when col/row spacing are greater than zero.
  * 2016/12/04
    + cleanup change for color pairs in 2016/11/20
    + modify initCDKScreen() to simplify initialization of curses by
    calling initscr() in this function after initializing the locale.
    That fixes a problem using PuTTY with CDK when built using ncurses
    (report by Marc Smith).
  * 2016/11/20
    + fix warnings from cppcheck 1.76.1
    + updated configure macros:
    + CF_CC_ENV_FLAGS don't limit the check to -I, -U and -D options,
    since the added options can include various compiler options before
    and after preprocessor options.
    + CF_GNU_SOURCE recent glibc (Debian 2.23-4 for example) has
    misordered ifdef/checks for new symbol _DEFAULT_SOURCE, producing
    warning messages when only _GNU_SOURCE is defined.  Add a followup
    check to define _DEFAULT_SOURCE.
    + CF_LD_RPATH_OPT change FreeBSD to use -Wl,-rpath rather than -rpath
    option.  According to FreeBSD #178732, either works since FreeBSD
    4.x; however scons does not accept anything except the -Wl,-rpath
    form.
    + CF_PROG_LINT add cpplint to programs to use; drop ad hoc tdlint and
    alint.
    + CF_WITH_NCURSES_ETC add check for ncurses pthreads
    + CF_XOPEN_SOURCE add "uclinux" to list of Linux's and use
    _GNU_SOURCE for cygwin headers, tested with cygwin 2.3, 2.5
    + CF__ADD_SHLIB_RULES improve scripting for ldconfig to avoid warning
    messages if no permissions
    + update config.guess, config.sub
    &gt; patches by Aarian P. Aleahmad:
    + modify encodeAttribute() to allow up to 256 color pairs.
    + corrected assignment in scroller_SetPosition(), to show highlighted
    member.
    + improve the way attributes are applied to Mentry widgets.
    + improve Entry widget by using newwin rather than subwin, as well
    as passing arguments to callback function.
  * 2016/11/19
    + add reRegisterCDKObject()
  * 2016/01/31
    + fix a few of the lintian errors in package/debian
    + fix some too-wide tables in manpages, which caused Debian lintian
    errors.
    + take lower-limit's formatted length into account in slider, etc.,
    (patch by Guido Meusch).
    + make similar repainting-fixes for radio.c and marquee.c
    + fix repainting of Scroll widget when it has no box-outline
    (patch by Manuel Schmitz).
    + add highlight and callbackData members to CDKBUTTON, as well as
    macros for setting/getting the highlight value.  Use the highlight to
    override the default A_REVERSE used in CDK button (patch by Aarian P.
    Aleahmad).
    + fix two bugs in template.c (patch by Aarian P. Aleahmad):
    + in cleanCDKTemplate, fill all of the info string with nulls
    + in setCDKTemplateValue, call cleanCDKTemplate whether or not
    the pointer for newValue passed by the caller was a null.
    + updated configure macros:
    + CF_LIB_PREFIX, CF_WITH_LIBTOOL, and CF_XOPEN_SOURCE, build-fixes
    for OS/2
    + CF_XOPEN_CURSES, improve check, making it define NCURSES_WIDECHAR
    if we happen to be building on a platform (such as OSX) where we do
    not define _XOPEN_SOURCE or _XOPEN_SOURCE_EXTENDED
    + CF_WITH_VERSIONED_SYMS, avoid ncurses build error on ppc64
    architecture the nm tool is reporting _is_missing in Data section
    for ppc64 (by comparison ppc64le is reporting it in Text section)
    + update config.guess, config.sub
  * 2015/09/28
    + build ".deb" test-package with ncurses6, using versioned symbols.
    + updated configure macros:
    + modifications from ncurses/xterm to allow alternate to /bin/sh for
    configure-shell, while dropping support for non-POSIX shell such
    as Solaris.
    + updated/integrated changes for versioned symbols from ncurses6.
    + CF_DISABLE_LIBTOOL_VERSION when using -version-info (the native
    libtool mode), get the ABI_VERSION value from $VERSION (which comes
    from CF_VERSION_INFO)
    + CF_ADD_INCDIR fix an infinite loop when the include-directory to be
    added does not exist (Debian #786436)
    + CF_WITH_NCURSES_ETC add --with-screen option
    + CF_SUBDIR_PATH change this to a loop, adding /usr/pkg (NetBSD) and
    /opt/local (Mac OSX)
    + update config.guess, config.sub
  * 2015/01/03
    + modify cdk-config.in to work with systems where libdir is /usr/lib64
    (patch by Peter Hyman).
    + corrected example for cdk_display.3 manpage (patch by Loïc
    work in non-POSIX locales (report by Mart Stöör).</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551182400">- Update to version 5.0.20190224
  + use HDR_ROOTNAME rather than PACKAGE in top-level makefile, to
    simplify building cdk and cdkw packages with non-conflicting paths.
  + add "check" rule to top-level makefile, for testing Arch Linux
    package.
  + modify test-package for RPMs to work with SUSE and Mageia.
- Enable wide version of libcdk(w)
- Enable ABI soname of the shared libraries
  + Somehow strange ABI 6.2.4 but RELEASE version is still 5.0</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551268800">- Remove debugging code from spec file</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551787200">- Update to version 5.0.20190303
  + deprecate installCDKLibrary rule by install.libs, which is used in
    the newer shared-library macros.
  + conditionally-comment action lines for the part of install-rules
    which conflict with the newer shared-library rules (report by Tom
    Brownridge).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620043200">- Update to version 5.0.20210324
  * Spelling fixes, per codespell
  * Updated build system</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1650974400">- Resolve rpmlint report "libcdk5.x86_64: E:
  shlib-policy-name-error SONAME: libcdk.so.6.2.4, expected
  package suffix: 6_2_4"</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1687521600">- Update to version 5.0.20230201
  + improve compiler-warnings in configure-checks.
  + change library dependencies in rpm spec-file.
  + update license in test-packages.
  + relicense as MIT-X11
  + reduce shellcheck warnings in support-scripts
  + updated configure script to work around regression in GNU grep 3.8
  + updated configure macros from xterm and ncurses development
  + update config.guess, config.sub
  + fix cppcheck style-warnings.
  + improve makefile header-dependencies by accounting for all generated
    headers (report/patch by Sergei Trofimovich).
  + updated configure macros from xterm and ncurses development:
    CF_ADD_INCDIR CF_APPEND_CFLAGS CF_DISABLE_ECHO CF_MAKEFLAGS
    CF_NCURSES_CONFIG CF_NCURSES_LIBS CF_PKG_CONFIG CF_REMOVE_CFLAGS
    CF_SHARED_OPTS CF_TRY_XOPEN_SOURCE CF_XOPEN_SOURCE
  + build-fix for HP-UX curses, which provides only part of the ACS_xxx
    definitions compatible with chtype's.
  + correct calls on SetViewSize in scroll.c, overlooked in 2005/04/24
    (report by Brad Hines).
  + updated configure macros from xterm and ncurses development:
    CF_C11_NORETURN CF_CHECK_LIBTOOL_VERSION CF_CONST_X_STRING
    CF_DISABLE_LEAKS CF_FUNC_LSTAT CF_GETOPT_HEADER CF_NCURSES_CONFIG
    CF_NO_LEAKS_OPTION CF_SHARED_OPTS CF_UTF8_LIB CF_XOPEN_CURSES
    CF_XOPEN_SOURCE
  + update config.guess, config.sub
  + updated configure script, for _Noreturn and exit_curses checks.
  + spelling fixes, per codespell.
  + updated configure script, for quoting/escaping fixes
  + update config.guess, config.sub
  + updated configure script, for compiler-warnings
  + update config.guess, config.sub
  + updated configure script, to work around ncurses 6.2 vs xcode's c99
    "-W" option.
  + update config.guess, config.sub
  + fix issues found with check-manpage
  + updated configure macros, from xterm and ncurses development:
    CF_ADD_LIBS CF_GCC_VERSION CF_GCC_WARNINGS CF_PROG_CC CF_PROG_LINT
    CF_X_TOOLKIT
  + update config.guess, config.sub</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1687521601">- Let libcdk6_3_4 conflict with older libcdk6_2_4</changelog>
</package>
<package pkgid="4aeafba34ec3ad8ff4893cf3d3c5ae5a3cd5619ca781798b5b51aa075d1ccea5d6070e4c8248a4cf83bebc81cecd550204c69160e07d9748d38eb3e7de19de95" name="cdk-debugsource" arch="s390x">
  <version epoch="0" ver="5.0.20230201" rel="189.27"/>
  <changelog author="meissner@suse.com" date="1419854400">- fixed url, added .asc and keyring</changelog>
  <changelog author="p.drouand@gmail.com" date="1446379200">- Update to version 5.0.20150928
  * build ".deb" test-package with ncurses6, using versioned symbols.
  * modifications from ncurses/xterm to allow alternate to /bin/sh for
    configure-shell, while dropping support for non-POSIX shell such
    as Solaris.
  * updated/integrated changes for versioned symbols from ncurses6.
  * CF_DISABLE_LIBTOOL_VERSION when using -version-info (the native
    libtool mode), get the ABI_VERSION value from $VERSION (which comes
    from CF_VERSION_INFO)
  * CF_ADD_INCDIR fix an infinite loop when the include-directory to be
    added does not exist (bdo#786436)
  * CF_WITH_NCURSES_ETC add --with-screen option
  * CF_SUBDIR_PATH change this to a loop, adding /usr/pkg (NetBSD) and
    /opt/local (Mac OSX)
  * update config.guess, config.sub</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1550836800">- Update to version 5.0.20190220
  * 2019/02/20
    + updated rpm spec-file, for test-builds.
    + added pkgsrc files, for test-builds.
    + updated FreeBSD port-files, for test-builds.
    + add getCdkTitle, which uses new display encoding "&lt;#10&gt;" for newline
    in the example which demonstrates it, mentry_ex2 (prompted by
    discussion with Stéphane Goujet).
    + fix similar memory leaks in setCDKRadioItems and setCDKSelectionItems
    + fix memory leak in setCDKScrollItems (report by Stéphane Goujet).
    + make functionKey parameter to getchCDKObject optional
    (suggested by Stéphane Goujet).
    + modify test-packages to adjust includes in cdk.h when using test
    package for ncurses6 which would confuse test-package for cdk-perl.
    + change shlib-version in test-package to "abi", for better
    compatibility with the test-package for cdk-perl.
    + add manpage for cdk5-config
    + documentation improvements (report by Stéphane Goujet).
    + add check in drawCDKScrollCurrent() in case the list is not
    initialized (report by Stéphane Goujet).
    + modify writeCharAttrib to replace the color in the target cell rather
    than OR'ing it from the source-attribute (patch by Aarian P. Aleahmad)
    + add a null-pointer check in viewer.c's PatternNotFound() function
    (report by "c").
    + improve macros/markup in manpages.
    + updated configure macros, from lynx and ncurses development:
    CF_ADD_INCDIR, CF_CC_ENV_FLAGS, CF_CURSES_CPPFLAGS, CF_CURSES_LIBS,
    CF_FIND_LINKAGE, CF_GCC_WARNINGS, CF_GNU_SOURCE, CF_LD_RPATH_OPT,
    CF_NCURSES_CONFIG, CF_PDCURSES_X11, CF_POSIX_C_SOURCE, CF_PROG_EXT,
    CF_SHARED_OPTS, CF_TRY_XOPEN_SOURCE, CF_WITH_VERSIONED_SYMS,
    CF_XOPEN_CURSES, CF_XOPEN_SOURCE, CF_X_ATHENA_CPPFLAGS
    + update config.guess, config.sub
  * 2018/03/06
    + update versioned-symbol list for reRegisterCDKObject (prompted by
    Debian #892114, which adopted a different set of symbol versions
    such as "5.0.20161120", cf: 2014/11/06).
    + updated configure macros, from lynx development:  CF_CURSES_FUNCS,
    CF_CURSES_LIBS, CF_MAKEFLAGS, CF_NCURSES_CONFIG, CF_SHARED_OPTS
    + update config.guess, config.sub
  * 2017/12/09
    + updated ftp url in test-packages, etc.
    + updated configure macros CF_CC_ENV_FLAGS, CF_SHARED_OPTS
    + update config.guess, config.sub
  * 2017/09/18
    + updated configure macros:
    + CF_ADD_CFLAGS improve formatting of generated lists using
    CF_APPEND_TEXT
    + CF_CC_ENV_FLAGS - two changes
    a) revise the expression generating $cf_flags to actually work when
    there is more than one option.
    b) correct the parameter passed to CF_ADD_CFLAGS, which was the
    whole list rather than the current parameter.
    + CF_CURSES_LIBS reorganize to handle the case where initscr is a
    macro.
    + CF_NCURSES_CONFIG add check for term.h when using pkg-config
    + CF_NCURSES_VERSION use prototype for main
    + CF_SHARED_OPTS workaround for PGI compiler
    + CF_WITH_LIBTOOL use SIGQUIT(3) rather than SIGTRAP(5) in trap
    commands.  Fix a few places in configure/build scripts where
    DESTDIR and rpath were combined.
    + update config.guess, config.sub
  * 2016/12/10
    + improve formatting of manpages, using bullets
    + add -C and -R options to matrix_ex.c to exercise the col/row spacing
    features of matrix widget.
    + modify matrix widget to highlight the current cell for the cases
    when col/row spacing are greater than zero.
  * 2016/12/04
    + cleanup change for color pairs in 2016/11/20
    + modify initCDKScreen() to simplify initialization of curses by
    calling initscr() in this function after initializing the locale.
    That fixes a problem using PuTTY with CDK when built using ncurses
    (report by Marc Smith).
  * 2016/11/20
    + fix warnings from cppcheck 1.76.1
    + updated configure macros:
    + CF_CC_ENV_FLAGS don't limit the check to -I, -U and -D options,
    since the added options can include various compiler options before
    and after preprocessor options.
    + CF_GNU_SOURCE recent glibc (Debian 2.23-4 for example) has
    misordered ifdef/checks for new symbol _DEFAULT_SOURCE, producing
    warning messages when only _GNU_SOURCE is defined.  Add a followup
    check to define _DEFAULT_SOURCE.
    + CF_LD_RPATH_OPT change FreeBSD to use -Wl,-rpath rather than -rpath
    option.  According to FreeBSD #178732, either works since FreeBSD
    4.x; however scons does not accept anything except the -Wl,-rpath
    form.
    + CF_PROG_LINT add cpplint to programs to use; drop ad hoc tdlint and
    alint.
    + CF_WITH_NCURSES_ETC add check for ncurses pthreads
    + CF_XOPEN_SOURCE add "uclinux" to list of Linux's and use
    _GNU_SOURCE for cygwin headers, tested with cygwin 2.3, 2.5
    + CF__ADD_SHLIB_RULES improve scripting for ldconfig to avoid warning
    messages if no permissions
    + update config.guess, config.sub
    &gt; patches by Aarian P. Aleahmad:
    + modify encodeAttribute() to allow up to 256 color pairs.
    + corrected assignment in scroller_SetPosition(), to show highlighted
    member.
    + improve the way attributes are applied to Mentry widgets.
    + improve Entry widget by using newwin rather than subwin, as well
    as passing arguments to callback function.
  * 2016/11/19
    + add reRegisterCDKObject()
  * 2016/01/31
    + fix a few of the lintian errors in package/debian
    + fix some too-wide tables in manpages, which caused Debian lintian
    errors.
    + take lower-limit's formatted length into account in slider, etc.,
    (patch by Guido Meusch).
    + make similar repainting-fixes for radio.c and marquee.c
    + fix repainting of Scroll widget when it has no box-outline
    (patch by Manuel Schmitz).
    + add highlight and callbackData members to CDKBUTTON, as well as
    macros for setting/getting the highlight value.  Use the highlight to
    override the default A_REVERSE used in CDK button (patch by Aarian P.
    Aleahmad).
    + fix two bugs in template.c (patch by Aarian P. Aleahmad):
    + in cleanCDKTemplate, fill all of the info string with nulls
    + in setCDKTemplateValue, call cleanCDKTemplate whether or not
    the pointer for newValue passed by the caller was a null.
    + updated configure macros:
    + CF_LIB_PREFIX, CF_WITH_LIBTOOL, and CF_XOPEN_SOURCE, build-fixes
    for OS/2
    + CF_XOPEN_CURSES, improve check, making it define NCURSES_WIDECHAR
    if we happen to be building on a platform (such as OSX) where we do
    not define _XOPEN_SOURCE or _XOPEN_SOURCE_EXTENDED
    + CF_WITH_VERSIONED_SYMS, avoid ncurses build error on ppc64
    architecture the nm tool is reporting _is_missing in Data section
    for ppc64 (by comparison ppc64le is reporting it in Text section)
    + update config.guess, config.sub
  * 2015/09/28
    + build ".deb" test-package with ncurses6, using versioned symbols.
    + updated configure macros:
    + modifications from ncurses/xterm to allow alternate to /bin/sh for
    configure-shell, while dropping support for non-POSIX shell such
    as Solaris.
    + updated/integrated changes for versioned symbols from ncurses6.
    + CF_DISABLE_LIBTOOL_VERSION when using -version-info (the native
    libtool mode), get the ABI_VERSION value from $VERSION (which comes
    from CF_VERSION_INFO)
    + CF_ADD_INCDIR fix an infinite loop when the include-directory to be
    added does not exist (Debian #786436)
    + CF_WITH_NCURSES_ETC add --with-screen option
    + CF_SUBDIR_PATH change this to a loop, adding /usr/pkg (NetBSD) and
    /opt/local (Mac OSX)
    + update config.guess, config.sub
  * 2015/01/03
    + modify cdk-config.in to work with systems where libdir is /usr/lib64
    (patch by Peter Hyman).
    + corrected example for cdk_display.3 manpage (patch by Loïc
    work in non-POSIX locales (report by Mart Stöör).</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551182400">- Update to version 5.0.20190224
  + use HDR_ROOTNAME rather than PACKAGE in top-level makefile, to
    simplify building cdk and cdkw packages with non-conflicting paths.
  + add "check" rule to top-level makefile, for testing Arch Linux
    package.
  + modify test-package for RPMs to work with SUSE and Mageia.
- Enable wide version of libcdk(w)
- Enable ABI soname of the shared libraries
  + Somehow strange ABI 6.2.4 but RELEASE version is still 5.0</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551268800">- Remove debugging code from spec file</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551787200">- Update to version 5.0.20190303
  + deprecate installCDKLibrary rule by install.libs, which is used in
    the newer shared-library macros.
  + conditionally-comment action lines for the part of install-rules
    which conflict with the newer shared-library rules (report by Tom
    Brownridge).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620043200">- Update to version 5.0.20210324
  * Spelling fixes, per codespell
  * Updated build system</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1650974400">- Resolve rpmlint report "libcdk5.x86_64: E:
  shlib-policy-name-error SONAME: libcdk.so.6.2.4, expected
  package suffix: 6_2_4"</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1687521600">- Update to version 5.0.20230201
  + improve compiler-warnings in configure-checks.
  + change library dependencies in rpm spec-file.
  + update license in test-packages.
  + relicense as MIT-X11
  + reduce shellcheck warnings in support-scripts
  + updated configure script to work around regression in GNU grep 3.8
  + updated configure macros from xterm and ncurses development
  + update config.guess, config.sub
  + fix cppcheck style-warnings.
  + improve makefile header-dependencies by accounting for all generated
    headers (report/patch by Sergei Trofimovich).
  + updated configure macros from xterm and ncurses development:
    CF_ADD_INCDIR CF_APPEND_CFLAGS CF_DISABLE_ECHO CF_MAKEFLAGS
    CF_NCURSES_CONFIG CF_NCURSES_LIBS CF_PKG_CONFIG CF_REMOVE_CFLAGS
    CF_SHARED_OPTS CF_TRY_XOPEN_SOURCE CF_XOPEN_SOURCE
  + build-fix for HP-UX curses, which provides only part of the ACS_xxx
    definitions compatible with chtype's.
  + correct calls on SetViewSize in scroll.c, overlooked in 2005/04/24
    (report by Brad Hines).
  + updated configure macros from xterm and ncurses development:
    CF_C11_NORETURN CF_CHECK_LIBTOOL_VERSION CF_CONST_X_STRING
    CF_DISABLE_LEAKS CF_FUNC_LSTAT CF_GETOPT_HEADER CF_NCURSES_CONFIG
    CF_NO_LEAKS_OPTION CF_SHARED_OPTS CF_UTF8_LIB CF_XOPEN_CURSES
    CF_XOPEN_SOURCE
  + update config.guess, config.sub
  + updated configure script, for _Noreturn and exit_curses checks.
  + spelling fixes, per codespell.
  + updated configure script, for quoting/escaping fixes
  + update config.guess, config.sub
  + updated configure script, for compiler-warnings
  + update config.guess, config.sub
  + updated configure script, to work around ncurses 6.2 vs xcode's c99
    "-W" option.
  + update config.guess, config.sub
  + fix issues found with check-manpage
  + updated configure macros, from xterm and ncurses development:
    CF_ADD_LIBS CF_GCC_VERSION CF_GCC_WARNINGS CF_PROG_CC CF_PROG_LINT
    CF_X_TOOLKIT
  + update config.guess, config.sub</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1687521601">- Let libcdk6_3_4 conflict with older libcdk6_2_4</changelog>
</package>
<package pkgid="d20003b707d67a60607b020819e8418b8e2e541da53af06eba4c2145d0a9ea971d6aaec336ae9d71887184cc9021ceb9212df1c344df0915170ac1d498e44631" name="cdk-devel" arch="s390x">
  <version epoch="0" ver="5.0.20230201" rel="189.27"/>
  <changelog author="meissner@suse.com" date="1419854400">- fixed url, added .asc and keyring</changelog>
  <changelog author="p.drouand@gmail.com" date="1446379200">- Update to version 5.0.20150928
  * build ".deb" test-package with ncurses6, using versioned symbols.
  * modifications from ncurses/xterm to allow alternate to /bin/sh for
    configure-shell, while dropping support for non-POSIX shell such
    as Solaris.
  * updated/integrated changes for versioned symbols from ncurses6.
  * CF_DISABLE_LIBTOOL_VERSION when using -version-info (the native
    libtool mode), get the ABI_VERSION value from $VERSION (which comes
    from CF_VERSION_INFO)
  * CF_ADD_INCDIR fix an infinite loop when the include-directory to be
    added does not exist (bdo#786436)
  * CF_WITH_NCURSES_ETC add --with-screen option
  * CF_SUBDIR_PATH change this to a loop, adding /usr/pkg (NetBSD) and
    /opt/local (Mac OSX)
  * update config.guess, config.sub</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1550836800">- Update to version 5.0.20190220
  * 2019/02/20
    + updated rpm spec-file, for test-builds.
    + added pkgsrc files, for test-builds.
    + updated FreeBSD port-files, for test-builds.
    + add getCdkTitle, which uses new display encoding "&lt;#10&gt;" for newline
    in the example which demonstrates it, mentry_ex2 (prompted by
    discussion with Stéphane Goujet).
    + fix similar memory leaks in setCDKRadioItems and setCDKSelectionItems
    + fix memory leak in setCDKScrollItems (report by Stéphane Goujet).
    + make functionKey parameter to getchCDKObject optional
    (suggested by Stéphane Goujet).
    + modify test-packages to adjust includes in cdk.h when using test
    package for ncurses6 which would confuse test-package for cdk-perl.
    + change shlib-version in test-package to "abi", for better
    compatibility with the test-package for cdk-perl.
    + add manpage for cdk5-config
    + documentation improvements (report by Stéphane Goujet).
    + add check in drawCDKScrollCurrent() in case the list is not
    initialized (report by Stéphane Goujet).
    + modify writeCharAttrib to replace the color in the target cell rather
    than OR'ing it from the source-attribute (patch by Aarian P. Aleahmad)
    + add a null-pointer check in viewer.c's PatternNotFound() function
    (report by "c").
    + improve macros/markup in manpages.
    + updated configure macros, from lynx and ncurses development:
    CF_ADD_INCDIR, CF_CC_ENV_FLAGS, CF_CURSES_CPPFLAGS, CF_CURSES_LIBS,
    CF_FIND_LINKAGE, CF_GCC_WARNINGS, CF_GNU_SOURCE, CF_LD_RPATH_OPT,
    CF_NCURSES_CONFIG, CF_PDCURSES_X11, CF_POSIX_C_SOURCE, CF_PROG_EXT,
    CF_SHARED_OPTS, CF_TRY_XOPEN_SOURCE, CF_WITH_VERSIONED_SYMS,
    CF_XOPEN_CURSES, CF_XOPEN_SOURCE, CF_X_ATHENA_CPPFLAGS
    + update config.guess, config.sub
  * 2018/03/06
    + update versioned-symbol list for reRegisterCDKObject (prompted by
    Debian #892114, which adopted a different set of symbol versions
    such as "5.0.20161120", cf: 2014/11/06).
    + updated configure macros, from lynx development:  CF_CURSES_FUNCS,
    CF_CURSES_LIBS, CF_MAKEFLAGS, CF_NCURSES_CONFIG, CF_SHARED_OPTS
    + update config.guess, config.sub
  * 2017/12/09
    + updated ftp url in test-packages, etc.
    + updated configure macros CF_CC_ENV_FLAGS, CF_SHARED_OPTS
    + update config.guess, config.sub
  * 2017/09/18
    + updated configure macros:
    + CF_ADD_CFLAGS improve formatting of generated lists using
    CF_APPEND_TEXT
    + CF_CC_ENV_FLAGS - two changes
    a) revise the expression generating $cf_flags to actually work when
    there is more than one option.
    b) correct the parameter passed to CF_ADD_CFLAGS, which was the
    whole list rather than the current parameter.
    + CF_CURSES_LIBS reorganize to handle the case where initscr is a
    macro.
    + CF_NCURSES_CONFIG add check for term.h when using pkg-config
    + CF_NCURSES_VERSION use prototype for main
    + CF_SHARED_OPTS workaround for PGI compiler
    + CF_WITH_LIBTOOL use SIGQUIT(3) rather than SIGTRAP(5) in trap
    commands.  Fix a few places in configure/build scripts where
    DESTDIR and rpath were combined.
    + update config.guess, config.sub
  * 2016/12/10
    + improve formatting of manpages, using bullets
    + add -C and -R options to matrix_ex.c to exercise the col/row spacing
    features of matrix widget.
    + modify matrix widget to highlight the current cell for the cases
    when col/row spacing are greater than zero.
  * 2016/12/04
    + cleanup change for color pairs in 2016/11/20
    + modify initCDKScreen() to simplify initialization of curses by
    calling initscr() in this function after initializing the locale.
    That fixes a problem using PuTTY with CDK when built using ncurses
    (report by Marc Smith).
  * 2016/11/20
    + fix warnings from cppcheck 1.76.1
    + updated configure macros:
    + CF_CC_ENV_FLAGS don't limit the check to -I, -U and -D options,
    since the added options can include various compiler options before
    and after preprocessor options.
    + CF_GNU_SOURCE recent glibc (Debian 2.23-4 for example) has
    misordered ifdef/checks for new symbol _DEFAULT_SOURCE, producing
    warning messages when only _GNU_SOURCE is defined.  Add a followup
    check to define _DEFAULT_SOURCE.
    + CF_LD_RPATH_OPT change FreeBSD to use -Wl,-rpath rather than -rpath
    option.  According to FreeBSD #178732, either works since FreeBSD
    4.x; however scons does not accept anything except the -Wl,-rpath
    form.
    + CF_PROG_LINT add cpplint to programs to use; drop ad hoc tdlint and
    alint.
    + CF_WITH_NCURSES_ETC add check for ncurses pthreads
    + CF_XOPEN_SOURCE add "uclinux" to list of Linux's and use
    _GNU_SOURCE for cygwin headers, tested with cygwin 2.3, 2.5
    + CF__ADD_SHLIB_RULES improve scripting for ldconfig to avoid warning
    messages if no permissions
    + update config.guess, config.sub
    &gt; patches by Aarian P. Aleahmad:
    + modify encodeAttribute() to allow up to 256 color pairs.
    + corrected assignment in scroller_SetPosition(), to show highlighted
    member.
    + improve the way attributes are applied to Mentry widgets.
    + improve Entry widget by using newwin rather than subwin, as well
    as passing arguments to callback function.
  * 2016/11/19
    + add reRegisterCDKObject()
  * 2016/01/31
    + fix a few of the lintian errors in package/debian
    + fix some too-wide tables in manpages, which caused Debian lintian
    errors.
    + take lower-limit's formatted length into account in slider, etc.,
    (patch by Guido Meusch).
    + make similar repainting-fixes for radio.c and marquee.c
    + fix repainting of Scroll widget when it has no box-outline
    (patch by Manuel Schmitz).
    + add highlight and callbackData members to CDKBUTTON, as well as
    macros for setting/getting the highlight value.  Use the highlight to
    override the default A_REVERSE used in CDK button (patch by Aarian P.
    Aleahmad).
    + fix two bugs in template.c (patch by Aarian P. Aleahmad):
    + in cleanCDKTemplate, fill all of the info string with nulls
    + in setCDKTemplateValue, call cleanCDKTemplate whether or not
    the pointer for newValue passed by the caller was a null.
    + updated configure macros:
    + CF_LIB_PREFIX, CF_WITH_LIBTOOL, and CF_XOPEN_SOURCE, build-fixes
    for OS/2
    + CF_XOPEN_CURSES, improve check, making it define NCURSES_WIDECHAR
    if we happen to be building on a platform (such as OSX) where we do
    not define _XOPEN_SOURCE or _XOPEN_SOURCE_EXTENDED
    + CF_WITH_VERSIONED_SYMS, avoid ncurses build error on ppc64
    architecture the nm tool is reporting _is_missing in Data section
    for ppc64 (by comparison ppc64le is reporting it in Text section)
    + update config.guess, config.sub
  * 2015/09/28
    + build ".deb" test-package with ncurses6, using versioned symbols.
    + updated configure macros:
    + modifications from ncurses/xterm to allow alternate to /bin/sh for
    configure-shell, while dropping support for non-POSIX shell such
    as Solaris.
    + updated/integrated changes for versioned symbols from ncurses6.
    + CF_DISABLE_LIBTOOL_VERSION when using -version-info (the native
    libtool mode), get the ABI_VERSION value from $VERSION (which comes
    from CF_VERSION_INFO)
    + CF_ADD_INCDIR fix an infinite loop when the include-directory to be
    added does not exist (Debian #786436)
    + CF_WITH_NCURSES_ETC add --with-screen option
    + CF_SUBDIR_PATH change this to a loop, adding /usr/pkg (NetBSD) and
    /opt/local (Mac OSX)
    + update config.guess, config.sub
  * 2015/01/03
    + modify cdk-config.in to work with systems where libdir is /usr/lib64
    (patch by Peter Hyman).
    + corrected example for cdk_display.3 manpage (patch by Loïc
    work in non-POSIX locales (report by Mart Stöör).</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551182400">- Update to version 5.0.20190224
  + use HDR_ROOTNAME rather than PACKAGE in top-level makefile, to
    simplify building cdk and cdkw packages with non-conflicting paths.
  + add "check" rule to top-level makefile, for testing Arch Linux
    package.
  + modify test-package for RPMs to work with SUSE and Mageia.
- Enable wide version of libcdk(w)
- Enable ABI soname of the shared libraries
  + Somehow strange ABI 6.2.4 but RELEASE version is still 5.0</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551268800">- Remove debugging code from spec file</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551787200">- Update to version 5.0.20190303
  + deprecate installCDKLibrary rule by install.libs, which is used in
    the newer shared-library macros.
  + conditionally-comment action lines for the part of install-rules
    which conflict with the newer shared-library rules (report by Tom
    Brownridge).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620043200">- Update to version 5.0.20210324
  * Spelling fixes, per codespell
  * Updated build system</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1650974400">- Resolve rpmlint report "libcdk5.x86_64: E:
  shlib-policy-name-error SONAME: libcdk.so.6.2.4, expected
  package suffix: 6_2_4"</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1687521600">- Update to version 5.0.20230201
  + improve compiler-warnings in configure-checks.
  + change library dependencies in rpm spec-file.
  + update license in test-packages.
  + relicense as MIT-X11
  + reduce shellcheck warnings in support-scripts
  + updated configure script to work around regression in GNU grep 3.8
  + updated configure macros from xterm and ncurses development
  + update config.guess, config.sub
  + fix cppcheck style-warnings.
  + improve makefile header-dependencies by accounting for all generated
    headers (report/patch by Sergei Trofimovich).
  + updated configure macros from xterm and ncurses development:
    CF_ADD_INCDIR CF_APPEND_CFLAGS CF_DISABLE_ECHO CF_MAKEFLAGS
    CF_NCURSES_CONFIG CF_NCURSES_LIBS CF_PKG_CONFIG CF_REMOVE_CFLAGS
    CF_SHARED_OPTS CF_TRY_XOPEN_SOURCE CF_XOPEN_SOURCE
  + build-fix for HP-UX curses, which provides only part of the ACS_xxx
    definitions compatible with chtype's.
  + correct calls on SetViewSize in scroll.c, overlooked in 2005/04/24
    (report by Brad Hines).
  + updated configure macros from xterm and ncurses development:
    CF_C11_NORETURN CF_CHECK_LIBTOOL_VERSION CF_CONST_X_STRING
    CF_DISABLE_LEAKS CF_FUNC_LSTAT CF_GETOPT_HEADER CF_NCURSES_CONFIG
    CF_NO_LEAKS_OPTION CF_SHARED_OPTS CF_UTF8_LIB CF_XOPEN_CURSES
    CF_XOPEN_SOURCE
  + update config.guess, config.sub
  + updated configure script, for _Noreturn and exit_curses checks.
  + spelling fixes, per codespell.
  + updated configure script, for quoting/escaping fixes
  + update config.guess, config.sub
  + updated configure script, for compiler-warnings
  + update config.guess, config.sub
  + updated configure script, to work around ncurses 6.2 vs xcode's c99
    "-W" option.
  + update config.guess, config.sub
  + fix issues found with check-manpage
  + updated configure macros, from xterm and ncurses development:
    CF_ADD_LIBS CF_GCC_VERSION CF_GCC_WARNINGS CF_PROG_CC CF_PROG_LINT
    CF_X_TOOLKIT
  + update config.guess, config.sub</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1687521601">- Let libcdk6_3_4 conflict with older libcdk6_2_4</changelog>
</package>
<package pkgid="d06ebdb76418931f775616fd5b6be5e5f36283a9752dd73bf894ed1c6b14a718e6040c58cc6e32f838bc829594de52e4cdc378d89589a99d58677b87adc714f7" name="certgen" arch="s390x">
  <version epoch="0" ver="1.4.0" rel="5.24"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1721131200">- new package certgen: a dead simple tool to generate self signed
  certificates (for MinIO TLS deployments)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721131201">- Update to version 1.3.0:
  * update go-releaser with latest changes
  * upgrade vulncheck min-go-version (#6)
  * Remove duplicated `Install` section (#5)
  * adding vulncheck github workflow action (#4)
  * add common-name support for client certs
  * update README.md binaries
  * fix generating certs, default to ecdsa-prime256v1
  * update certgen docs
  * add support for generating client certs
  * update goreleaser and format certgen.go</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1752580800">- Update to version 1.4.0:
  * update go.mod formatting
  * Overwrite ouName (#3)
  * update go1.24.5 (#8)</changelog>
</package>
<package pkgid="1db779f6d1d7c8dce8df90ed5dcb42c2cc9fd837450ca36b21f65aae4563ab98d6d22f409c06053ed95b951a80ba0bd57f98661165803cd55c13d6f3e4050e3a" name="certgen" arch="src">
  <version epoch="0" ver="1.4.0" rel="5.24"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1721131200">- new package certgen: a dead simple tool to generate self signed
  certificates (for MinIO TLS deployments)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721131201">- Update to version 1.3.0:
  * update go-releaser with latest changes
  * upgrade vulncheck min-go-version (#6)
  * Remove duplicated `Install` section (#5)
  * adding vulncheck github workflow action (#4)
  * add common-name support for client certs
  * update README.md binaries
  * fix generating certs, default to ecdsa-prime256v1
  * update certgen docs
  * add support for generating client certs
  * update goreleaser and format certgen.go</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1752580800">- Update to version 1.4.0:
  * update go.mod formatting
  * Overwrite ouName (#3)
  * update go1.24.5 (#8)</changelog>
</package>
<package pkgid="9d5a9f927c6838f97e6d82967091b605596af0aabbb75be88992872789e3ab06d7f9d11e844511a49ecae2d3a7e7eed17ef82ddfca34a4511c65be7e7e6b814b" name="certgen-debuginfo" arch="s390x">
  <version epoch="0" ver="1.4.0" rel="5.24"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1721131200">- new package certgen: a dead simple tool to generate self signed
  certificates (for MinIO TLS deployments)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721131201">- Update to version 1.3.0:
  * update go-releaser with latest changes
  * upgrade vulncheck min-go-version (#6)
  * Remove duplicated `Install` section (#5)
  * adding vulncheck github workflow action (#4)
  * add common-name support for client certs
  * update README.md binaries
  * fix generating certs, default to ecdsa-prime256v1
  * update certgen docs
  * add support for generating client certs
  * update goreleaser and format certgen.go</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1752580800">- Update to version 1.4.0:
  * update go.mod formatting
  * Overwrite ouName (#3)
  * update go1.24.5 (#8)</changelog>
</package>
<package pkgid="8ae9d57cd3d167b523ef981d6750ce37f04569a545885da74ef04c26f673f0ff47e78b629ff6f6bf8453961e6e06a4eb121e3fe4dcc9651c1002d20305933b56" name="certinfo" arch="s390x">
  <version epoch="0" ver="1.0.40+git20260221.5574ad1" rel="1.10"/>
  <changelog author="scott.bradnick@suse.com" date="1722600000">- Update to version 1.0.22+git20240802.1e4f1ae:
  * execute args in go routines</changelog>
  <changelog author="scott.bradnick@suse.com" date="1722600001">- Update to version 1.0.23+git20240802.4ca345b:
  * added sort by expiry flag</changelog>
  <changelog author="scott.bradnick@suse.com" date="1727956800">- Update to version 1.0.24+git20241003.3fa99e8:
  * add issuer and subject like flags
  * trigger pipeline
  * update dependencies
  * update deprecated field in go releaser</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734350400">- Update to version 1.0.25+git20241216.a1c8af6:
  * initial working version with extensions
  * add more extensions
  * update deprecated field in goreleaser
  * Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 in the go group (#40)
  * Bump github.com/icza/gox in the go group (#39)
  * WIP asn1 extensions
  * add oids for extensions
  * initial extensions</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734350401">- Update to version 1.0.26+git20241216.c2cda7b:
  * add more extensions</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734436800">- Update to version 1.0.27+git20241217.a2eaff6:
  * move github action permissions</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734436801">- Update to version 1.0.28+git20241217.5396db3:
  * print chains with insecure flag</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734523200">- Update to version 1.0.29+git20241218.bb2a9c4:
  * refactor and formatting
  * update README</changelog>
  <changelog author="scott.bradnick@suse.com" date="1735041600">- Update to version 1.0.30+git20241224.290f752:
  * update dependencies
  * add the rest of id kp oids</changelog>
  <changelog author="scott.bradnick@suse.com" date="1736424000">- Update to version 1.0.31+git20250109.c903eed:
  * fix tests
  * remove clipboard - pipeline failing and cannot be released
  * add server-name flag, useful for SNI testing
  * remove gox/timex dependency</changelog>
  <changelog author="scott.bradnick@suse.com" date="1740916800">- Update to version 1.0.32+git20250228.fab4bfe:
  * add dns names if present to expiry output
  * update deprected gorelaser flags
  * updte go version</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1743854400">- Update to version 1.0.33+git20250401.4a9a06f:
  * fix dns names with expiry flag</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1751630400">- Update to version 1.0.34+git20250704.39a6d1c:
  * update goreleaser</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1751803200">- Update to version 1.0.35+git20250705.671076b:
  * update brew not to show message</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1751803201">- Update to version 1.0.36+git20250706.fd6a656:
  * add public key algorithm to output</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1751889600">- Update to version 1.0.37+git20250707.e2340ba:
  * add option to print signature (#44)</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1753358400">- Updating copyright year and 'BuildRequires: go &gt;= ...' version</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1760097600">- Update to version 1.0.38+git20251010.ed66133:
  * Combine flags (#48)
  * update go version
  * Bump github.com/stretchr/testify from 1.11.0 to 1.11.1 in the go group (#47)
  * Bump github.com/stretchr/testify from 1.10.0 to 1.11.0 in the go group (#46)</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1762344000">- Adding 'Source100: README.md' as the README is suggested at src.opensuse.org
  setup, otherwise get the following message:
  * "Attention, "README.md" is not mentioned in spec files as source or patch."
- Update to version 1.0.39+git20251105.c09d0f8:
  * fix brew install on linux</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1771675200">- Update to version 1.0.40+git20260221.5574ad1:
  * format imports and add unit tests for host arg
  * Added functionality for protocal specification (#50)
  * udpate go version
  * add kubernetes example</changelog>
</package>
<package pkgid="9d90da22b00ec3143ef04e27a3a63029fd9529a9cf544f70d500b68f6f51fdf7d8ee2b2a495d50893c21bb65425bb73ccc1e2af65f55cce5d5cc217f494a33dd" name="certinfo" arch="src">
  <version epoch="0" ver="1.0.40+git20260221.5574ad1" rel="1.10"/>
  <changelog author="scott.bradnick@suse.com" date="1722600000">- Update to version 1.0.22+git20240802.1e4f1ae:
  * execute args in go routines</changelog>
  <changelog author="scott.bradnick@suse.com" date="1722600001">- Update to version 1.0.23+git20240802.4ca345b:
  * added sort by expiry flag</changelog>
  <changelog author="scott.bradnick@suse.com" date="1727956800">- Update to version 1.0.24+git20241003.3fa99e8:
  * add issuer and subject like flags
  * trigger pipeline
  * update dependencies
  * update deprecated field in go releaser</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734350400">- Update to version 1.0.25+git20241216.a1c8af6:
  * initial working version with extensions
  * add more extensions
  * update deprecated field in goreleaser
  * Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 in the go group (#40)
  * Bump github.com/icza/gox in the go group (#39)
  * WIP asn1 extensions
  * add oids for extensions
  * initial extensions</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734350401">- Update to version 1.0.26+git20241216.c2cda7b:
  * add more extensions</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734436800">- Update to version 1.0.27+git20241217.a2eaff6:
  * move github action permissions</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734436801">- Update to version 1.0.28+git20241217.5396db3:
  * print chains with insecure flag</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734523200">- Update to version 1.0.29+git20241218.bb2a9c4:
  * refactor and formatting
  * update README</changelog>
  <changelog author="scott.bradnick@suse.com" date="1735041600">- Update to version 1.0.30+git20241224.290f752:
  * update dependencies
  * add the rest of id kp oids</changelog>
  <changelog author="scott.bradnick@suse.com" date="1736424000">- Update to version 1.0.31+git20250109.c903eed:
  * fix tests
  * remove clipboard - pipeline failing and cannot be released
  * add server-name flag, useful for SNI testing
  * remove gox/timex dependency</changelog>
  <changelog author="scott.bradnick@suse.com" date="1740916800">- Update to version 1.0.32+git20250228.fab4bfe:
  * add dns names if present to expiry output
  * update deprected gorelaser flags
  * updte go version</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1743854400">- Update to version 1.0.33+git20250401.4a9a06f:
  * fix dns names with expiry flag</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1751630400">- Update to version 1.0.34+git20250704.39a6d1c:
  * update goreleaser</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1751803200">- Update to version 1.0.35+git20250705.671076b:
  * update brew not to show message</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1751803201">- Update to version 1.0.36+git20250706.fd6a656:
  * add public key algorithm to output</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1751889600">- Update to version 1.0.37+git20250707.e2340ba:
  * add option to print signature (#44)</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1753358400">- Updating copyright year and 'BuildRequires: go &gt;= ...' version</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1760097600">- Update to version 1.0.38+git20251010.ed66133:
  * Combine flags (#48)
  * update go version
  * Bump github.com/stretchr/testify from 1.11.0 to 1.11.1 in the go group (#47)
  * Bump github.com/stretchr/testify from 1.10.0 to 1.11.0 in the go group (#46)</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1762344000">- Adding 'Source100: README.md' as the README is suggested at src.opensuse.org
  setup, otherwise get the following message:
  * "Attention, "README.md" is not mentioned in spec files as source or patch."
- Update to version 1.0.39+git20251105.c09d0f8:
  * fix brew install on linux</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1771675200">- Update to version 1.0.40+git20260221.5574ad1:
  * format imports and add unit tests for host arg
  * Added functionality for protocal specification (#50)
  * udpate go version
  * add kubernetes example</changelog>
</package>
<package pkgid="94e8d55f2476c04e5caf9f9d62945d1d6bc7866915eaad0109e0b0d3c45e7ed534872790c6cd26a4c5d236b28a300f28c3e397bcd5e85c8bd843a81a611253d6" name="certinfo-debuginfo" arch="s390x">
  <version epoch="0" ver="1.0.40+git20260221.5574ad1" rel="1.10"/>
  <changelog author="scott.bradnick@suse.com" date="1722600000">- Update to version 1.0.22+git20240802.1e4f1ae:
  * execute args in go routines</changelog>
  <changelog author="scott.bradnick@suse.com" date="1722600001">- Update to version 1.0.23+git20240802.4ca345b:
  * added sort by expiry flag</changelog>
  <changelog author="scott.bradnick@suse.com" date="1727956800">- Update to version 1.0.24+git20241003.3fa99e8:
  * add issuer and subject like flags
  * trigger pipeline
  * update dependencies
  * update deprecated field in go releaser</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734350400">- Update to version 1.0.25+git20241216.a1c8af6:
  * initial working version with extensions
  * add more extensions
  * update deprecated field in goreleaser
  * Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 in the go group (#40)
  * Bump github.com/icza/gox in the go group (#39)
  * WIP asn1 extensions
  * add oids for extensions
  * initial extensions</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734350401">- Update to version 1.0.26+git20241216.c2cda7b:
  * add more extensions</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734436800">- Update to version 1.0.27+git20241217.a2eaff6:
  * move github action permissions</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734436801">- Update to version 1.0.28+git20241217.5396db3:
  * print chains with insecure flag</changelog>
  <changelog author="scott.bradnick@suse.com" date="1734523200">- Update to version 1.0.29+git20241218.bb2a9c4:
  * refactor and formatting
  * update README</changelog>
  <changelog author="scott.bradnick@suse.com" date="1735041600">- Update to version 1.0.30+git20241224.290f752:
  * update dependencies
  * add the rest of id kp oids</changelog>
  <changelog author="scott.bradnick@suse.com" date="1736424000">- Update to version 1.0.31+git20250109.c903eed:
  * fix tests
  * remove clipboard - pipeline failing and cannot be released
  * add server-name flag, useful for SNI testing
  * remove gox/timex dependency</changelog>
  <changelog author="scott.bradnick@suse.com" date="1740916800">- Update to version 1.0.32+git20250228.fab4bfe:
  * add dns names if present to expiry output
  * update deprected gorelaser flags
  * updte go version</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1743854400">- Update to version 1.0.33+git20250401.4a9a06f:
  * fix dns names with expiry flag</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1751630400">- Update to version 1.0.34+git20250704.39a6d1c:
  * update goreleaser</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1751803200">- Update to version 1.0.35+git20250705.671076b:
  * update brew not to show message</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1751803201">- Update to version 1.0.36+git20250706.fd6a656:
  * add public key algorithm to output</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1751889600">- Update to version 1.0.37+git20250707.e2340ba:
  * add option to print signature (#44)</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1753358400">- Updating copyright year and 'BuildRequires: go &gt;= ...' version</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1760097600">- Update to version 1.0.38+git20251010.ed66133:
  * Combine flags (#48)
  * update go version
  * Bump github.com/stretchr/testify from 1.11.0 to 1.11.1 in the go group (#47)
  * Bump github.com/stretchr/testify from 1.10.0 to 1.11.0 in the go group (#46)</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1762344000">- Adding 'Source100: README.md' as the README is suggested at src.opensuse.org
  setup, otherwise get the following message:
  * "Attention, "README.md" is not mentioned in spec files as source or patch."
- Update to version 1.0.39+git20251105.c09d0f8:
  * fix brew install on linux</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1771675200">- Update to version 1.0.40+git20260221.5574ad1:
  * format imports and add unit tests for host arg
  * Added functionality for protocal specification (#50)
  * udpate go version
  * add kubernetes example</changelog>
</package>
<package pkgid="5e0dd22c845c3cf585d68bbbfba8b3a8cdc46dcb54d9cca31e29d41c687513e3c6bea2a5c365fe02e3fccea7a36167996f5506fb5d4fae63bb42c97199ca5685" name="check-create-certificate" arch="noarch">
  <version epoch="0" ver="0.6" rel="2.3"/>
  <changelog author="jdsn@suse.de" date="1265284800">- initial checkin of version 0.1 into git repository</changelog>
  <changelog author="jdsn@suse.de" date="1265630400">- fix script name in header comment
- 0.2</changelog>
  <changelog author="jdsn@suse.de" date="1265803200">- adding license file and license header (bnc#578209)
- 0.3</changelog>
  <changelog author="jdsn@suse.de" date="1269950400">- fix hostname identification (bnc#592217)
- 0.4</changelog>
  <changelog author="jdsn@suse.de" date="1272542400">- be less verbose by default, add verbose mode (bnc#600829)
- use secure umask to prevent race conditions
- 0.5</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1364472000">- Adapted the License according to the spdx standard
- Cleaned the spec file up</changelog>
  <changelog author="jdsn@suse.de" date="1397044800">- updated to official GPL-2.0 text
- updated spec file</changelog>
  <changelog author="J. Daniel Schmidt &lt;jdsn@suse.de&gt;" date="1774267200">- change key default algorithm to ed25519 (needs openssl &gt;= 1.1.1)
- add support to define expiry in days
- version 0.6</changelog>
</package>
<package pkgid="dfa2b6242a6763df14757bb402da34f833b1903a349cd557d19a50d95a466057c394f3581c9970d69cbdb8d95f9395de53af05782edd9dc73167455bce909791" name="check-create-certificate" arch="src">
  <version epoch="0" ver="0.6" rel="2.3"/>
  <changelog author="jdsn@suse.de" date="1265284800">- initial checkin of version 0.1 into git repository</changelog>
  <changelog author="jdsn@suse.de" date="1265630400">- fix script name in header comment
- 0.2</changelog>
  <changelog author="jdsn@suse.de" date="1265803200">- adding license file and license header (bnc#578209)
- 0.3</changelog>
  <changelog author="jdsn@suse.de" date="1269950400">- fix hostname identification (bnc#592217)
- 0.4</changelog>
  <changelog author="jdsn@suse.de" date="1272542400">- be less verbose by default, add verbose mode (bnc#600829)
- use secure umask to prevent race conditions
- 0.5</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1364472000">- Adapted the License according to the spdx standard
- Cleaned the spec file up</changelog>
  <changelog author="jdsn@suse.de" date="1397044800">- updated to official GPL-2.0 text
- updated spec file</changelog>
  <changelog author="J. Daniel Schmidt &lt;jdsn@suse.de&gt;" date="1774267200">- change key default algorithm to ed25519 (needs openssl &gt;= 1.1.1)
- add support to define expiry in days
- version 0.6</changelog>
</package>
<package pkgid="99a47c1454c0e4e6587bb862b5323ad286a74978cb852664cdf3b200e104ea5f49c1bea213c07f25f91deba30740a6dd04005acb5f12ae9b449b74aa4ef7f125" name="chkrootkit" arch="s390x">
  <version epoch="0" ver="0.59" rel="1.9"/>
  <changelog author="aj@suse.de" date="1308571200">- Add BuildRequire: glibc-devel-static for openSUSE 12.1</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="meissner@suse.com" date="1409054400">- update to version 0.50
  - new rootkits check: Linux Rootkit 64bits
  - new backdoor check Operation Windigo
  - CVE-2014-0476 fix
  - minor bug fixes
- chkrootkit-0.49.patch refreshed to chkrootkit-0.50.patch</changelog>
  <changelog author="meissner@suse.com" date="1410350400">- chkrootkit-utmpchk.patch
  fixed a stack smashing in chkutmp binary. bnc#896057</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1556020800">- update to version 0.53
  - Mumblehard backdoor/botnet detection
  - Linux.Xor.DDoS Malware
  - Malicious TinyDNS detection
  - Backdoors.Linux.Mokes.a detection
  - Minor bug fixes
  - Linux.Proxy.10 detection
  - strings.c &amp; chkutmp.c bug fixes
  - Rocke Monero Miner detection
  - Added ss support
  - ifconfig.c bug fixes
  - Minor bug fixes
  - Updated chkrootkit-utmpchk.patch to version 0.53
  - Updated chkrootkit-0.50.patch to chkrootkit-0.53.patch</changelog>
  <changelog author="Carsten Ziepke &lt;kieltux@gmail.com&gt;" date="1615118400">- Update to version 0.54:
  - PWWLNX4 and 6 Rootkits detection
  - BTRFS bug fix
  - Fedora 33+ bug fix
  - Minor bug fixes
- Updated chkrootkit-utmpchk.patch to version 0.54
- Updated chkrootkit-0.53.patch to chkrootkit-0.54.patch
- Run spec-cleaner
- Set correct license</changelog>
  <changelog author="Carsten Ziepke &lt;kieltux@gmail.com&gt;" date="1676203200">- Update to version 0.57:
  * Bug fix release
- Changes in version 0.56:
  * Kovid rootkit
  * Syslogk rootkit
  * Minor bug fixes
- Changes in version 0.55:
  * Umbreon Linux Rootkit detection
  * Kinsing.A Backdoor
  * RotaJakito Backdoor
  * Minor bug fixes
- Rebase chkrootkit-utmpchk.patch
- Rebase chkrootkit-0.57.patch based on chkrootkit-0.54.patch,
  now using /usr/sbin instead /sbin, which fixes a long time error
- Run spec-cleaner</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1729080000">- Update to version 0.58b (Release Date: Jul 05 2023)
  * New option to avoid scannig network filesystems (-T)
  * Linux BPFDoor Malware detection
  * Bug fixes</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1752580800">- Add patch chkrootkit-signal_fix.patch to fix signal function</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1769256000">- updated to version 0.59
  - New checks: Process executed from memory
  - New commands: nologin
  - XZ Backdoor Bottkitty (UEFI Bootkit)
  - Bug fixes
- chkrootkit-0.58b.patch rebased into chkrootkit-0.59.patch
- chkrootkit-utmpchk.patch: fixed better hopefully, was buggy
- chkrootkit-signal_fix.patch: now fixed upstream</changelog>
</package>
<package pkgid="9ae7c5dcb771255803055699f035d30df6df406f12f9d98cb381c9a4bee68d4123d07da23ab457815ff9964f5bdbe413fc2e2aec8de92a5a6ce4ff89234aaf57" name="chkrootkit" arch="src">
  <version epoch="0" ver="0.59" rel="1.9"/>
  <changelog author="meissner@suse.de" date="1095076800">- Initial version 0.44.</changelog>
  <changelog author="meissner@suse.de" date="1120132800">- Upgraded to 0.45.
- Install all build binaries.
- Use more RPM_OPT_FLAGS, fixed some implicits.</changelog>
  <changelog author="meissner@suse.de" date="1125316800">- Actually install chkrootkit (#113616)
- No need for check_wtmpx (#113532)
- Fixed %doc permissions to be 644 (#113614)</changelog>
  <changelog author="meissner@suse.de" date="1137758400">- Upgraded to 0.46a.
- fixed %doc permissions.</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="schwab@suse.de" date="1148299200">- Don't strip binaries.</changelog>
  <changelog author="meissner@suse.de" date="1162900800">- upgraded to 0.47.
  - check for Enye LKM and Lupper.Worm
  - Fix for long lines in PS output
  - Add getpriority to identify LKMs
  - added various new rootkit signatures</changelog>
  <changelog author="coolo@novell.com" date="1257249600">- updated patches to apply with fuzz=0</changelog>
  <changelog author="freespacer@gmx.de" date="1285761600">- update to version 0.49
  - new tests: Mac OS X OSX.RSPlug.A Trojan Horse
  - more tests for suspicious sniffer logs
  - more tests for suspicious PHP files
  - more tests for shell history file anomalies
  - minor bug fixes
  - chkdirs.c: minor bug fixes
  - chkproc.c: minor bug fixes
  - chkutmp.c: bug fix by Michael Schwendt
- renew patch</changelog>
  <changelog author="aj@suse.de" date="1308571200">- Add BuildRequire: glibc-devel-static for openSUSE 12.1</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="meissner@suse.com" date="1409054400">- update to version 0.50
  - new rootkits check: Linux Rootkit 64bits
  - new backdoor check Operation Windigo
  - CVE-2014-0476 fix
  - minor bug fixes
- chkrootkit-0.49.patch refreshed to chkrootkit-0.50.patch</changelog>
  <changelog author="meissner@suse.com" date="1410350400">- chkrootkit-utmpchk.patch
  fixed a stack smashing in chkutmp binary. bnc#896057</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1556020800">- update to version 0.53
  - Mumblehard backdoor/botnet detection
  - Linux.Xor.DDoS Malware
  - Malicious TinyDNS detection
  - Backdoors.Linux.Mokes.a detection
  - Minor bug fixes
  - Linux.Proxy.10 detection
  - strings.c &amp; chkutmp.c bug fixes
  - Rocke Monero Miner detection
  - Added ss support
  - ifconfig.c bug fixes
  - Minor bug fixes
  - Updated chkrootkit-utmpchk.patch to version 0.53
  - Updated chkrootkit-0.50.patch to chkrootkit-0.53.patch</changelog>
  <changelog author="Carsten Ziepke &lt;kieltux@gmail.com&gt;" date="1615118400">- Update to version 0.54:
  - PWWLNX4 and 6 Rootkits detection
  - BTRFS bug fix
  - Fedora 33+ bug fix
  - Minor bug fixes
- Updated chkrootkit-utmpchk.patch to version 0.54
- Updated chkrootkit-0.53.patch to chkrootkit-0.54.patch
- Run spec-cleaner
- Set correct license</changelog>
  <changelog author="Carsten Ziepke &lt;kieltux@gmail.com&gt;" date="1676203200">- Update to version 0.57:
  * Bug fix release
- Changes in version 0.56:
  * Kovid rootkit
  * Syslogk rootkit
  * Minor bug fixes
- Changes in version 0.55:
  * Umbreon Linux Rootkit detection
  * Kinsing.A Backdoor
  * RotaJakito Backdoor
  * Minor bug fixes
- Rebase chkrootkit-utmpchk.patch
- Rebase chkrootkit-0.57.patch based on chkrootkit-0.54.patch,
  now using /usr/sbin instead /sbin, which fixes a long time error
- Run spec-cleaner</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1729080000">- Update to version 0.58b (Release Date: Jul 05 2023)
  * New option to avoid scannig network filesystems (-T)
  * Linux BPFDoor Malware detection
  * Bug fixes</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1752580800">- Add patch chkrootkit-signal_fix.patch to fix signal function</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1769256000">- updated to version 0.59
  - New checks: Process executed from memory
  - New commands: nologin
  - XZ Backdoor Bottkitty (UEFI Bootkit)
  - Bug fixes
- chkrootkit-0.58b.patch rebased into chkrootkit-0.59.patch
- chkrootkit-utmpchk.patch: fixed better hopefully, was buggy
- chkrootkit-signal_fix.patch: now fixed upstream</changelog>
</package>
<package pkgid="4f7eb8ec5e8d6fc2cd0e006b36a127452709de9a1b10a2ccc2f9abfe3ce4f16e2e240e96b48b507f730ab30ccc7654b2870f6f55209bb2aad6e9d75c8e460215" name="chkrootkit-debuginfo" arch="s390x">
  <version epoch="0" ver="0.59" rel="1.9"/>
  <changelog author="aj@suse.de" date="1308571200">- Add BuildRequire: glibc-devel-static for openSUSE 12.1</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="meissner@suse.com" date="1409054400">- update to version 0.50
  - new rootkits check: Linux Rootkit 64bits
  - new backdoor check Operation Windigo
  - CVE-2014-0476 fix
  - minor bug fixes
- chkrootkit-0.49.patch refreshed to chkrootkit-0.50.patch</changelog>
  <changelog author="meissner@suse.com" date="1410350400">- chkrootkit-utmpchk.patch
  fixed a stack smashing in chkutmp binary. bnc#896057</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1556020800">- update to version 0.53
  - Mumblehard backdoor/botnet detection
  - Linux.Xor.DDoS Malware
  - Malicious TinyDNS detection
  - Backdoors.Linux.Mokes.a detection
  - Minor bug fixes
  - Linux.Proxy.10 detection
  - strings.c &amp; chkutmp.c bug fixes
  - Rocke Monero Miner detection
  - Added ss support
  - ifconfig.c bug fixes
  - Minor bug fixes
  - Updated chkrootkit-utmpchk.patch to version 0.53
  - Updated chkrootkit-0.50.patch to chkrootkit-0.53.patch</changelog>
  <changelog author="Carsten Ziepke &lt;kieltux@gmail.com&gt;" date="1615118400">- Update to version 0.54:
  - PWWLNX4 and 6 Rootkits detection
  - BTRFS bug fix
  - Fedora 33+ bug fix
  - Minor bug fixes
- Updated chkrootkit-utmpchk.patch to version 0.54
- Updated chkrootkit-0.53.patch to chkrootkit-0.54.patch
- Run spec-cleaner
- Set correct license</changelog>
  <changelog author="Carsten Ziepke &lt;kieltux@gmail.com&gt;" date="1676203200">- Update to version 0.57:
  * Bug fix release
- Changes in version 0.56:
  * Kovid rootkit
  * Syslogk rootkit
  * Minor bug fixes
- Changes in version 0.55:
  * Umbreon Linux Rootkit detection
  * Kinsing.A Backdoor
  * RotaJakito Backdoor
  * Minor bug fixes
- Rebase chkrootkit-utmpchk.patch
- Rebase chkrootkit-0.57.patch based on chkrootkit-0.54.patch,
  now using /usr/sbin instead /sbin, which fixes a long time error
- Run spec-cleaner</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1729080000">- Update to version 0.58b (Release Date: Jul 05 2023)
  * New option to avoid scannig network filesystems (-T)
  * Linux BPFDoor Malware detection
  * Bug fixes</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1752580800">- Add patch chkrootkit-signal_fix.patch to fix signal function</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1769256000">- updated to version 0.59
  - New checks: Process executed from memory
  - New commands: nologin
  - XZ Backdoor Bottkitty (UEFI Bootkit)
  - Bug fixes
- chkrootkit-0.58b.patch rebased into chkrootkit-0.59.patch
- chkrootkit-utmpchk.patch: fixed better hopefully, was buggy
- chkrootkit-signal_fix.patch: now fixed upstream</changelog>
</package>
<package pkgid="e720ea87791b8e1d27ad8d564fceb3874c919afd67de2b3b6d2382c3032823cd460dcfdb7cefb53eef6be474eaa41d229d66138c1783f4aa1f5a977100b3ee1e" name="chkrootkit-debugsource" arch="s390x">
  <version epoch="0" ver="0.59" rel="1.9"/>
  <changelog author="aj@suse.de" date="1308571200">- Add BuildRequire: glibc-devel-static for openSUSE 12.1</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="meissner@suse.com" date="1409054400">- update to version 0.50
  - new rootkits check: Linux Rootkit 64bits
  - new backdoor check Operation Windigo
  - CVE-2014-0476 fix
  - minor bug fixes
- chkrootkit-0.49.patch refreshed to chkrootkit-0.50.patch</changelog>
  <changelog author="meissner@suse.com" date="1410350400">- chkrootkit-utmpchk.patch
  fixed a stack smashing in chkutmp binary. bnc#896057</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1556020800">- update to version 0.53
  - Mumblehard backdoor/botnet detection
  - Linux.Xor.DDoS Malware
  - Malicious TinyDNS detection
  - Backdoors.Linux.Mokes.a detection
  - Minor bug fixes
  - Linux.Proxy.10 detection
  - strings.c &amp; chkutmp.c bug fixes
  - Rocke Monero Miner detection
  - Added ss support
  - ifconfig.c bug fixes
  - Minor bug fixes
  - Updated chkrootkit-utmpchk.patch to version 0.53
  - Updated chkrootkit-0.50.patch to chkrootkit-0.53.patch</changelog>
  <changelog author="Carsten Ziepke &lt;kieltux@gmail.com&gt;" date="1615118400">- Update to version 0.54:
  - PWWLNX4 and 6 Rootkits detection
  - BTRFS bug fix
  - Fedora 33+ bug fix
  - Minor bug fixes
- Updated chkrootkit-utmpchk.patch to version 0.54
- Updated chkrootkit-0.53.patch to chkrootkit-0.54.patch
- Run spec-cleaner
- Set correct license</changelog>
  <changelog author="Carsten Ziepke &lt;kieltux@gmail.com&gt;" date="1676203200">- Update to version 0.57:
  * Bug fix release
- Changes in version 0.56:
  * Kovid rootkit
  * Syslogk rootkit
  * Minor bug fixes
- Changes in version 0.55:
  * Umbreon Linux Rootkit detection
  * Kinsing.A Backdoor
  * RotaJakito Backdoor
  * Minor bug fixes
- Rebase chkrootkit-utmpchk.patch
- Rebase chkrootkit-0.57.patch based on chkrootkit-0.54.patch,
  now using /usr/sbin instead /sbin, which fixes a long time error
- Run spec-cleaner</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1729080000">- Update to version 0.58b (Release Date: Jul 05 2023)
  * New option to avoid scannig network filesystems (-T)
  * Linux BPFDoor Malware detection
  * Bug fixes</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1752580800">- Add patch chkrootkit-signal_fix.patch to fix signal function</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1769256000">- updated to version 0.59
  - New checks: Process executed from memory
  - New commands: nologin
  - XZ Backdoor Bottkitty (UEFI Bootkit)
  - Bug fixes
- chkrootkit-0.58b.patch rebased into chkrootkit-0.59.patch
- chkrootkit-utmpchk.patch: fixed better hopefully, was buggy
- chkrootkit-signal_fix.patch: now fixed upstream</changelog>
</package>
<package pkgid="0ed6005626c26af63da6527d5379e65e2861115d0d9c7efffeb8c78e30c8291a416c68a1a216068486cb86be4b2b7ffb5e799e659350cfd1528d0f15bb47b393" name="chrootuid" arch="s390x">
  <version epoch="0" ver="1.3" rel="3.31"/>
  <changelog author="pascal.bleser@opensuse.org" date="1286798400">- initial package (1.3)</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1286798401">- add patch collection from Debian Sid</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1495022400">- adding SUSE copyright to spec, fix license name</changelog>
</package>
<package pkgid="05192ab0f9e6971658e56f78bad888ff17defac6e22205de9185478682f2ed47589c2c7e451730365029e4633ae545f0be047656a54497616e54a5c3b1a8d07d" name="chrootuid" arch="src">
  <version epoch="0" ver="1.3" rel="3.31"/>
  <changelog author="pascal.bleser@opensuse.org" date="1286798400">- initial package (1.3)</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1286798401">- add patch collection from Debian Sid</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1495022400">- adding SUSE copyright to spec, fix license name</changelog>
</package>
<package pkgid="d0aaac17c58c9b588ebf9799f3eea0482c7d997d79a947e21fba671f00bbeb774e4a8ae413da59f557888c495b5bb1b0e7ef45930f20f842afe45ae022f50949" name="chrootuid-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3" rel="3.31"/>
  <changelog author="pascal.bleser@opensuse.org" date="1286798400">- initial package (1.3)</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1286798401">- add patch collection from Debian Sid</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1495022400">- adding SUSE copyright to spec, fix license name</changelog>
</package>
<package pkgid="9e28573080a7d33e7cdd7064990f950cede28334dbbd49eb0853b70d6d7e7eb58d3d9686491a021e315079340346cff7b4fe04f36b9fa7cf6f0c3277246f2e87" name="chrootuid-debugsource" arch="s390x">
  <version epoch="0" ver="1.3" rel="3.31"/>
  <changelog author="pascal.bleser@opensuse.org" date="1286798400">- initial package (1.3)</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1286798401">- add patch collection from Debian Sid</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1495022400">- adding SUSE copyright to spec, fix license name</changelog>
</package>
<package pkgid="b77ebfd4dc03bffee8adc0b4634743bef5c5f427d0101cc51df2411fb3db7295523c61b7c2f702d6dde3e7fa85cb1e29d124118c3c502b512fe6f7c3bfa4a544" name="clair" arch="s390x">
  <version epoch="0" ver="4.9.0" rel="8.6"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717156800">- new package clair: Vulnerability Static Analysis for Containers,
  including the clairctl CLI</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717156801">- Update to version 4.7.4:
  * chore: 4.7.4 changelog bump
  * chore: Add merge step when creating release binaries
  * chore: update go version for release
  * chore: update claircore to v1.5.27
  * chore: update go version
  * Dockerfile: remove sh loop
  * cicd: add container version skew check
  * cicd: update testing workflow
  * cicd: don't upload workspace on failure
  * cicd: change version specifiers to be major-version only</changelog>
  <changelog author="andrea.manzini@suse.com" date="1733572800">- Update to version 4.8.0:
  * bump deps
  * stomp: guard against race in test
  * openshift: add backstop cron manifest
  * openshift: handle multiple Dockerfiles in build script
  * quaybackstop: add backstop GC command
  * introspection: lints
  * contrib: correct position of startupProbe spec
  * contrib/openshfit: only start buildkitd container if needed
  * contrib/openshift: login shenanigans
  * contrib/openshift: avoid patching when using upstream images
  * clair: add platform-specific signals
  * introspection: allow trace shutdown hook full timeout
  * clair: break cancellation chain for request contexts
  * clair: redo shutdown structure
  * docs: add building and Makefile usage sections
  * chore: run the go formatting over the repo
  * contrib: update `build_and_deploy.sh` script
  * openshift: have the pr_check script "dry run" a build
  * openshift: add "dry run" flag
  * auto: improve log messages
  * chore: fix some comments
  * chore: use the merge-multiple directive when downloading binaries
  * chore: Add merge step when creating release binaries
  * contrib: account for different container engine clients
  * contrib: update build script to use podman
  * httptransport: fix test flake
  * contrib: remove rms that were needed for previous fetcher
  * chore: update production manifest with new tmp dir
  * docs: add mention of disk space path and usage
  * initialize: use defaults for NewRemoteFetcher
  * httptransport: GET vuln report returns 404 when indexing in-progress
  * documentation: correct stale configuration options
  * httptransport: change api error handling to panic internally
  * httptransport: add metrics test
  * httputil: add test for non-OK statuses
  * httptransport: add unauthenticated "/robots.txt" endpoint
  * httptransport: add "robots.txt" endpoint
  * cmd: add exported source date
  * config: update minimum TLS version for server
  * docs: add OTLP configuration to prose documentation
  * chore: Add Go 1.22 support via moved godeltaprof dependancy bump
  * contrib: update dashboard regex
  * cmd: annotate fake key for gitleaks
  * chore: clean up sample config
  * openshift: make build_and_deploy script shellcheck-clean
  * config: Update comment to describe currently supported updaters
  * admin: add a check for compatible migration version
  * admin: add command to update go packages with norm_version
  * all: fix incorrect API paths
  * all: fix some typos
  * amqp: migrate to maintained package
  * chore: migrate go-jose to maintained version
  * config: add Sentry config
  * contrib: simplify openshift/pr_check.sh
  * config: add OTLP configuration types
  * httptransport: add client-close detection
  * httptransport: use compression middleware
  * httptransport: lints
  * httptransport: rework constructor
  * httptransport: update DiscoveryHandler to new style
  * httptransport: re-instrument handlers with new primitives
  * httptransport: exit goroutine in error helper
  * webhook: move+update debug server
  * httputil: add response recorder
  * compress: update compression middleware
  * admin: add pre v4.7.3 admin command to create index
  * contrib: add grafana dashboards for deletion metrics
  * Documentation: add more information on how to test and get started
  * config: fix typo</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765972800">- Update to version 4.9.0:
  * Claircore
  - enrichment: don't consider vulnerability.Description for
    enrichments
  - postgres: better GetEnrichments query
  - rpm: fix use of unique.Handle pinning fs.FS
  - vex: account for new VEX RPM module logic
  - cvss: switch to NVD 2.0 JSON feeds
  - chore: upgrade from pgx v4 to v5
  - vex: allow timeout to pull down VEX archive to be
    configurable
  - rpm: add function to determine if packages are installed from
    RPMs
  - sbom: add encoder to encode index reports as SPDX documents
  - rhel: deprecate updater in favor of VEX updater
  - suse: dynamic distribution discovery
  * All
  - 1aca06b8: fix formatted print calls
  * Amqp
  - 1a9f8769: add deprecation notice
  * Build(Deps)
  - e4feca46: bump golang.org/x/time from 0.7.0 to 0.8.0
  - f54011b5: bump golang.org/x/sync from 0.8.0 to 0.9.0
  - ee5524b8: bump go.opentelemetry.io/otel/sdk from 1.31.0 to
    1.32.0
  - 757b649c: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 20c0040f: bump github.com/go-stomp/stomp/v3 from 3.1.2 to
    3.1.3
  - 1607766c: bump github.com/prometheus/client_golang
  - 0a3a4611: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 12ea7bf9: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 146d4a67: bump github.com/urfave/cli/v2 from 2.27.3 to 2.27.5
  - 50003694: bump github.com/klauspost/compress from 1.17.10 to
    1.17.11
  - 6069bb24: bump
    go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  * Chore
  - f6a412cc: v4.9.0 changelog bump
  - cbfd97b6: fix typos in config.yaml.sample
  - 7c9c079b: update claircore to v1.5.48
  - 8e9a6d46: update claircore to v1.5.47
  - 804ef6a4: update claircore to v1.5.46
  - a50727a3: add DVO ignore annotations
  - 8d991938: update claircore to v1.5.45
  - ff2059cf: update claircore to v1.5.44
  - db51ed82: update claircore to v1.5.42
  - c2dc1766: update claircore to v1.5.41
  - 8aa9e1e2: update claircore to v1.5.40
  - eca299b7: update go references to go1.24
  - 1660b66b: upgrade from pgx v4 to v5
  - 68d03bae: remove reviews from dependabot config
  - 0c5292e7: upgrade config module to v1.4.2
  - e5d4c19c: update minimum go version to 1.23
  - e45fbf0e: update claircore to v1.5.35
  - 708bf2f5: update local-dev tracing configs to fix errors
  - 216ca2f1: update claircore to v1.5.34
  - dde57fc1: update openAPI spec to remove SourcePackage
  - e5149fd3: group some dependencies to avoid excessive PRs
  - 60ebea73: update claircore to v1.5.33
  * Chore(Deps)
  - f598d3ec: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - a952e3c6: bump the otel group with 11 updates
  - 878fbceb: bump github.com/google/go-containerregistry
  - 468e409c: bump actions/upload-artifact from 4 to 5
  - c87bc8f0: bump github.com/klauspost/compress from 1.18.1 to
    1.18.2
  - 2a5c11fd: bump actions/checkout from 5 to 6
  - b12439f4: bump golang.org/x/crypto from 0.44.0 to 0.45.0
  - e169a50a: bump google.golang.org/grpc from 1.76.0 to 1.77.0
  - 3e778f2c: bump golang.org/x/net in the golang-x group
  - 4563ccbd: bump github.com/go-stomp/stomp/v3 from 3.1.3 to
    3.1.5
  - 195cdb06: bump golang.org/x/sync in the golang-x group
  - b50044f4: bump actions/download-artifact from 5 to 6
  - 1b429595: bump github.com/klauspost/compress from 1.18.0 to
    1.18.1
  - e439e4df: bump the golang-x group with 2 updates
  - fe37c68b: bump google.golang.org/grpc from 1.75.1 to 1.76.0
  - ee6ea1c8: bump github.com/quay/claircore from 1.5.42 to
    1.5.43
  - afcfd7f0: bump google.golang.org/grpc from 1.75.0 to 1.75.1
  - 6a4937e4: bump the golang-x group across 1 directory with 3
    updates
  - 53cf68e9: bump github.com/jackc/pgx/v5 from 5.7.5 to 5.7.6
  - e9850949: bump github.com/prometheus/client_golang
  - 290969cd: bump actions/stale from 9 to 10
  - 5b5519b5: bump actions/github-script from 7 to 8
  - b78c76b1: bump actions/setup-go from 5 to 6
  - b1f4716b: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 93174450: bump github.com/grafana/pyroscope-go/godeltaprof
  - 0f1fde39: bump the otel group with 11 updates
  - 8dbb0f48: bump golang.org/x/net in the golang-x group
  - a35a1281: bump github.com/ulikunitz/xz from 0.5.11 to 0.5.14
  - 1fa9a753: bump actions/checkout from 4 to 5
  - f0b0949c: bump actions/download-artifact from 4 to 5
  - 890f4a1b: bump github.com/prometheus/client_golang
  - 80add42b: bump google.golang.org/grpc from 1.73.0 to 1.75.0
  - e4746794: bump github.com/jackc/pgx/v5 from 5.7.4 to 5.7.5
  - ba6fe31c: bump go.opentelemetry.io/otel/exporters/prometheus
  - 40b0402e: bump the golang-x group with 2 updates
  - f9635886: bump github.com/quay/zlog from 1.1.8 to 1.1.9
  - 4415106e: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - b7325ada: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 78b92595: bump the otel group with 11 updates
  - 62956271: bump github.com/urfave/cli/v2 from 2.27.6 to 2.27.7
  - 440eee8e: bump github.com/google/go-containerregistry
  - e75e2e2b: bump the golang-x group with 3 updates
  - cf20adbd: bump google.golang.org/grpc from 1.72.2 to 1.73.0
  - d9c211b4: bump github.com/quay/claircore from 1.5.37 to
    1.5.38
  - 6338de8b: bump github.com/ugorji/go/codec from 1.2.12 to
    1.2.14
  - 566271a1: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 3e3a2d33: bump github.com/google/go-containerregistry
  - 81b725ba: bump google.golang.org/grpc from 1.72.1 to 1.72.2
  - faad36e2: bump the otel group with 11 updates
  - 7979e036: bump google.golang.org/grpc from 1.72.0 to 1.72.1
  - 99ab2c1a: bump the golang-x group with 2 updates
  - a166f610: bump github.com/quay/claircore from 1.5.36 to
    1.5.37
  - d8e9dcf4: bump google.golang.org/grpc from 1.71.1 to 1.72.0
  - bfa8f11d: bump github.com/quay/claircore from 1.5.35 to
    1.5.36
  - f8a41628: bump github.com/prometheus/client_golang
  - 7ce22abe: bump google.golang.org/grpc from 1.71.0 to 1.71.1
  - c53cf2ba: bump the golang-x group with 2 updates
  - a5833a44: bump golang.org/x/net in the golang-x group
  - cc6fb14a: bump github.com/rs/zerolog from 1.33.0 to 1.34.0
  - 851e4a36: bump github.com/urfave/cli/v2 from 2.27.5 to 2.27.6
  - e9997624: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - a73e832b: bump github.com/prometheus/client_golang
  - 35110e9e: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 0a9866e3: bump the golang-x group with 3 updates
  - 1ce14606: bump the otel group with 11 updates
  - 919d5287: bump github.com/google/go-cmp in /config
  - 2673e4f4: bump github.com/rogpeppe/go-internal from 1.13.1 to
    1.14.1
  - cf7af98a: bump github.com/go-jose/go-jose/v3 from 3.0.3 to
    3.0.4
  - 6c9fae1e: bump github.com/google/go-cmp from 0.6.0 to 0.7.0
  - 707d8049: bump github.com/prometheus/client_golang
  - 136a618f: bump github.com/klauspost/compress from 1.17.11 to
    1.18.0
  - 3e7c6e74: bump the golang-x group with 3 updates
  - 73db520d: bump github.com/evanphx/json-patch/v5 from 5.9.10
    to 5.9.11
  - a3a60f10: bump google.golang.org/grpc from 1.69.4 to 1.70.0
  - cc29705c: bump github.com/evanphx/json-patch/v5 from 5.9.0 to
    5.9.10
  - d05b4049: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 8b99d320: bump the otel group with 11 updates
  - b2c66991: bump google.golang.org/grpc from 1.69.2 to 1.69.4
  - ef4a1f11: bump the golang-x group with 2 updates
  - 38b77499: bump golang.org/x/net in the golang-x group
  - 80c0381a: bump the otel group across 1 directory with 2
    updates
  - 3eff1ef1: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 5bf85313: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 9ebb61d9: bump golang.org/x/crypto from 0.30.0 to 0.31.0
  - 0881e079: bump the golang-x group with 2 updates
  - f556ef16: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - bf8737a1: bump golang.org/x/net in the golang-x group
  - f1d9aae4: bump
    go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  * Chore(Manifests)
  - 48b75fe4: add anti-affinity rules
  * Ci
  - a0a35fd7: Allow go test to access un-vendored dependencies
  * Cicd
  - ab791a2e: run multiarch tests without a full container
  - 935a61f3: vendor modules into nightly source
  * Clairctl
  - 4c93f8ea: Print a friendly error on panic
  - #2221### Config
  - 0db9beaf: add ability to disable enrichment
  - 7ab81b38: clean environment in example
  * Dev
  - 503215f5: rename dashboard.json file to clair.json
  - 65cd4244: add a grafana dashboard for postgres stats
  * Docker
  - 10485679: remove version line from docker-compose.yaml
  * Docker-Compose
  - 8c71b46e: update containers
  * Enrichments
  - 6527a9ec: disable enrichers if config option is set
  * Fix
  - 0a8c3864: typo in variable name
  * Go.Mod
  - 6db583f7: Update Go version to 1.24.9 for CVE-2025-47907
  * Health
  - b57b9fa6: using atomic.Uint32
  * Introspection
  - 797c2f45: implement OTLP support for metrics and traces
  * Misc
  - 5891f64b: remove API doc make target, CI check
  * Notifier
  - a9a68e18: increase default durations to be more reasonable
  * Openapi
  - 8c540b96: rebuild OpenAPI spec
  * Signer
  - 1c6d0496: initialize before checking for PSK
  - Fixes #2214 - #2221### Stomp
  - b2501ba3: ignore Unsubscribe error in test
  - 0b8e3507: add deprecation notice
  - 684be8d0: catch test-specific error
  * Types/V1
  - 50d0164b: add JSON API v1 types and schemas
  * Reverts
  - cicd: exclude darwin/arm64</changelog>
</package>
<package pkgid="46d6a556566d9a2a86bc510d6c01e9bae3a76ee97961dd7a9c4d52077f7cc694161b84d97ff710548ff5836134333f7353f4c7ac803366f77dcebbcfec5bf063" name="clair" arch="src">
  <version epoch="0" ver="4.9.0" rel="8.6"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717156800">- new package clair: Vulnerability Static Analysis for Containers,
  including the clairctl CLI</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717156801">- Update to version 4.7.4:
  * chore: 4.7.4 changelog bump
  * chore: Add merge step when creating release binaries
  * chore: update go version for release
  * chore: update claircore to v1.5.27
  * chore: update go version
  * Dockerfile: remove sh loop
  * cicd: add container version skew check
  * cicd: update testing workflow
  * cicd: don't upload workspace on failure
  * cicd: change version specifiers to be major-version only</changelog>
  <changelog author="andrea.manzini@suse.com" date="1733572800">- Update to version 4.8.0:
  * bump deps
  * stomp: guard against race in test
  * openshift: add backstop cron manifest
  * openshift: handle multiple Dockerfiles in build script
  * quaybackstop: add backstop GC command
  * introspection: lints
  * contrib: correct position of startupProbe spec
  * contrib/openshfit: only start buildkitd container if needed
  * contrib/openshift: login shenanigans
  * contrib/openshift: avoid patching when using upstream images
  * clair: add platform-specific signals
  * introspection: allow trace shutdown hook full timeout
  * clair: break cancellation chain for request contexts
  * clair: redo shutdown structure
  * docs: add building and Makefile usage sections
  * chore: run the go formatting over the repo
  * contrib: update `build_and_deploy.sh` script
  * openshift: have the pr_check script "dry run" a build
  * openshift: add "dry run" flag
  * auto: improve log messages
  * chore: fix some comments
  * chore: use the merge-multiple directive when downloading binaries
  * chore: Add merge step when creating release binaries
  * contrib: account for different container engine clients
  * contrib: update build script to use podman
  * httptransport: fix test flake
  * contrib: remove rms that were needed for previous fetcher
  * chore: update production manifest with new tmp dir
  * docs: add mention of disk space path and usage
  * initialize: use defaults for NewRemoteFetcher
  * httptransport: GET vuln report returns 404 when indexing in-progress
  * documentation: correct stale configuration options
  * httptransport: change api error handling to panic internally
  * httptransport: add metrics test
  * httputil: add test for non-OK statuses
  * httptransport: add unauthenticated "/robots.txt" endpoint
  * httptransport: add "robots.txt" endpoint
  * cmd: add exported source date
  * config: update minimum TLS version for server
  * docs: add OTLP configuration to prose documentation
  * chore: Add Go 1.22 support via moved godeltaprof dependancy bump
  * contrib: update dashboard regex
  * cmd: annotate fake key for gitleaks
  * chore: clean up sample config
  * openshift: make build_and_deploy script shellcheck-clean
  * config: Update comment to describe currently supported updaters
  * admin: add a check for compatible migration version
  * admin: add command to update go packages with norm_version
  * all: fix incorrect API paths
  * all: fix some typos
  * amqp: migrate to maintained package
  * chore: migrate go-jose to maintained version
  * config: add Sentry config
  * contrib: simplify openshift/pr_check.sh
  * config: add OTLP configuration types
  * httptransport: add client-close detection
  * httptransport: use compression middleware
  * httptransport: lints
  * httptransport: rework constructor
  * httptransport: update DiscoveryHandler to new style
  * httptransport: re-instrument handlers with new primitives
  * httptransport: exit goroutine in error helper
  * webhook: move+update debug server
  * httputil: add response recorder
  * compress: update compression middleware
  * admin: add pre v4.7.3 admin command to create index
  * contrib: add grafana dashboards for deletion metrics
  * Documentation: add more information on how to test and get started
  * config: fix typo</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765972800">- Update to version 4.9.0:
  * Claircore
  - enrichment: don't consider vulnerability.Description for
    enrichments
  - postgres: better GetEnrichments query
  - rpm: fix use of unique.Handle pinning fs.FS
  - vex: account for new VEX RPM module logic
  - cvss: switch to NVD 2.0 JSON feeds
  - chore: upgrade from pgx v4 to v5
  - vex: allow timeout to pull down VEX archive to be
    configurable
  - rpm: add function to determine if packages are installed from
    RPMs
  - sbom: add encoder to encode index reports as SPDX documents
  - rhel: deprecate updater in favor of VEX updater
  - suse: dynamic distribution discovery
  * All
  - 1aca06b8: fix formatted print calls
  * Amqp
  - 1a9f8769: add deprecation notice
  * Build(Deps)
  - e4feca46: bump golang.org/x/time from 0.7.0 to 0.8.0
  - f54011b5: bump golang.org/x/sync from 0.8.0 to 0.9.0
  - ee5524b8: bump go.opentelemetry.io/otel/sdk from 1.31.0 to
    1.32.0
  - 757b649c: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 20c0040f: bump github.com/go-stomp/stomp/v3 from 3.1.2 to
    3.1.3
  - 1607766c: bump github.com/prometheus/client_golang
  - 0a3a4611: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 12ea7bf9: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 146d4a67: bump github.com/urfave/cli/v2 from 2.27.3 to 2.27.5
  - 50003694: bump github.com/klauspost/compress from 1.17.10 to
    1.17.11
  - 6069bb24: bump
    go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  * Chore
  - f6a412cc: v4.9.0 changelog bump
  - cbfd97b6: fix typos in config.yaml.sample
  - 7c9c079b: update claircore to v1.5.48
  - 8e9a6d46: update claircore to v1.5.47
  - 804ef6a4: update claircore to v1.5.46
  - a50727a3: add DVO ignore annotations
  - 8d991938: update claircore to v1.5.45
  - ff2059cf: update claircore to v1.5.44
  - db51ed82: update claircore to v1.5.42
  - c2dc1766: update claircore to v1.5.41
  - 8aa9e1e2: update claircore to v1.5.40
  - eca299b7: update go references to go1.24
  - 1660b66b: upgrade from pgx v4 to v5
  - 68d03bae: remove reviews from dependabot config
  - 0c5292e7: upgrade config module to v1.4.2
  - e5d4c19c: update minimum go version to 1.23
  - e45fbf0e: update claircore to v1.5.35
  - 708bf2f5: update local-dev tracing configs to fix errors
  - 216ca2f1: update claircore to v1.5.34
  - dde57fc1: update openAPI spec to remove SourcePackage
  - e5149fd3: group some dependencies to avoid excessive PRs
  - 60ebea73: update claircore to v1.5.33
  * Chore(Deps)
  - f598d3ec: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - a952e3c6: bump the otel group with 11 updates
  - 878fbceb: bump github.com/google/go-containerregistry
  - 468e409c: bump actions/upload-artifact from 4 to 5
  - c87bc8f0: bump github.com/klauspost/compress from 1.18.1 to
    1.18.2
  - 2a5c11fd: bump actions/checkout from 5 to 6
  - b12439f4: bump golang.org/x/crypto from 0.44.0 to 0.45.0
  - e169a50a: bump google.golang.org/grpc from 1.76.0 to 1.77.0
  - 3e778f2c: bump golang.org/x/net in the golang-x group
  - 4563ccbd: bump github.com/go-stomp/stomp/v3 from 3.1.3 to
    3.1.5
  - 195cdb06: bump golang.org/x/sync in the golang-x group
  - b50044f4: bump actions/download-artifact from 5 to 6
  - 1b429595: bump github.com/klauspost/compress from 1.18.0 to
    1.18.1
  - e439e4df: bump the golang-x group with 2 updates
  - fe37c68b: bump google.golang.org/grpc from 1.75.1 to 1.76.0
  - ee6ea1c8: bump github.com/quay/claircore from 1.5.42 to
    1.5.43
  - afcfd7f0: bump google.golang.org/grpc from 1.75.0 to 1.75.1
  - 6a4937e4: bump the golang-x group across 1 directory with 3
    updates
  - 53cf68e9: bump github.com/jackc/pgx/v5 from 5.7.5 to 5.7.6
  - e9850949: bump github.com/prometheus/client_golang
  - 290969cd: bump actions/stale from 9 to 10
  - 5b5519b5: bump actions/github-script from 7 to 8
  - b78c76b1: bump actions/setup-go from 5 to 6
  - b1f4716b: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 93174450: bump github.com/grafana/pyroscope-go/godeltaprof
  - 0f1fde39: bump the otel group with 11 updates
  - 8dbb0f48: bump golang.org/x/net in the golang-x group
  - a35a1281: bump github.com/ulikunitz/xz from 0.5.11 to 0.5.14
  - 1fa9a753: bump actions/checkout from 4 to 5
  - f0b0949c: bump actions/download-artifact from 4 to 5
  - 890f4a1b: bump github.com/prometheus/client_golang
  - 80add42b: bump google.golang.org/grpc from 1.73.0 to 1.75.0
  - e4746794: bump github.com/jackc/pgx/v5 from 5.7.4 to 5.7.5
  - ba6fe31c: bump go.opentelemetry.io/otel/exporters/prometheus
  - 40b0402e: bump the golang-x group with 2 updates
  - f9635886: bump github.com/quay/zlog from 1.1.8 to 1.1.9
  - 4415106e: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - b7325ada: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 78b92595: bump the otel group with 11 updates
  - 62956271: bump github.com/urfave/cli/v2 from 2.27.6 to 2.27.7
  - 440eee8e: bump github.com/google/go-containerregistry
  - e75e2e2b: bump the golang-x group with 3 updates
  - cf20adbd: bump google.golang.org/grpc from 1.72.2 to 1.73.0
  - d9c211b4: bump github.com/quay/claircore from 1.5.37 to
    1.5.38
  - 6338de8b: bump github.com/ugorji/go/codec from 1.2.12 to
    1.2.14
  - 566271a1: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 3e3a2d33: bump github.com/google/go-containerregistry
  - 81b725ba: bump google.golang.org/grpc from 1.72.1 to 1.72.2
  - faad36e2: bump the otel group with 11 updates
  - 7979e036: bump google.golang.org/grpc from 1.72.0 to 1.72.1
  - 99ab2c1a: bump the golang-x group with 2 updates
  - a166f610: bump github.com/quay/claircore from 1.5.36 to
    1.5.37
  - d8e9dcf4: bump google.golang.org/grpc from 1.71.1 to 1.72.0
  - bfa8f11d: bump github.com/quay/claircore from 1.5.35 to
    1.5.36
  - f8a41628: bump github.com/prometheus/client_golang
  - 7ce22abe: bump google.golang.org/grpc from 1.71.0 to 1.71.1
  - c53cf2ba: bump the golang-x group with 2 updates
  - a5833a44: bump golang.org/x/net in the golang-x group
  - cc6fb14a: bump github.com/rs/zerolog from 1.33.0 to 1.34.0
  - 851e4a36: bump github.com/urfave/cli/v2 from 2.27.5 to 2.27.6
  - e9997624: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - a73e832b: bump github.com/prometheus/client_golang
  - 35110e9e: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 0a9866e3: bump the golang-x group with 3 updates
  - 1ce14606: bump the otel group with 11 updates
  - 919d5287: bump github.com/google/go-cmp in /config
  - 2673e4f4: bump github.com/rogpeppe/go-internal from 1.13.1 to
    1.14.1
  - cf7af98a: bump github.com/go-jose/go-jose/v3 from 3.0.3 to
    3.0.4
  - 6c9fae1e: bump github.com/google/go-cmp from 0.6.0 to 0.7.0
  - 707d8049: bump github.com/prometheus/client_golang
  - 136a618f: bump github.com/klauspost/compress from 1.17.11 to
    1.18.0
  - 3e7c6e74: bump the golang-x group with 3 updates
  - 73db520d: bump github.com/evanphx/json-patch/v5 from 5.9.10
    to 5.9.11
  - a3a60f10: bump google.golang.org/grpc from 1.69.4 to 1.70.0
  - cc29705c: bump github.com/evanphx/json-patch/v5 from 5.9.0 to
    5.9.10
  - d05b4049: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 8b99d320: bump the otel group with 11 updates
  - b2c66991: bump google.golang.org/grpc from 1.69.2 to 1.69.4
  - ef4a1f11: bump the golang-x group with 2 updates
  - 38b77499: bump golang.org/x/net in the golang-x group
  - 80c0381a: bump the otel group across 1 directory with 2
    updates
  - 3eff1ef1: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 5bf85313: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 9ebb61d9: bump golang.org/x/crypto from 0.30.0 to 0.31.0
  - 0881e079: bump the golang-x group with 2 updates
  - f556ef16: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - bf8737a1: bump golang.org/x/net in the golang-x group
  - f1d9aae4: bump
    go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  * Chore(Manifests)
  - 48b75fe4: add anti-affinity rules
  * Ci
  - a0a35fd7: Allow go test to access un-vendored dependencies
  * Cicd
  - ab791a2e: run multiarch tests without a full container
  - 935a61f3: vendor modules into nightly source
  * Clairctl
  - 4c93f8ea: Print a friendly error on panic
  - #2221### Config
  - 0db9beaf: add ability to disable enrichment
  - 7ab81b38: clean environment in example
  * Dev
  - 503215f5: rename dashboard.json file to clair.json
  - 65cd4244: add a grafana dashboard for postgres stats
  * Docker
  - 10485679: remove version line from docker-compose.yaml
  * Docker-Compose
  - 8c71b46e: update containers
  * Enrichments
  - 6527a9ec: disable enrichers if config option is set
  * Fix
  - 0a8c3864: typo in variable name
  * Go.Mod
  - 6db583f7: Update Go version to 1.24.9 for CVE-2025-47907
  * Health
  - b57b9fa6: using atomic.Uint32
  * Introspection
  - 797c2f45: implement OTLP support for metrics and traces
  * Misc
  - 5891f64b: remove API doc make target, CI check
  * Notifier
  - a9a68e18: increase default durations to be more reasonable
  * Openapi
  - 8c540b96: rebuild OpenAPI spec
  * Signer
  - 1c6d0496: initialize before checking for PSK
  - Fixes #2214 - #2221### Stomp
  - b2501ba3: ignore Unsubscribe error in test
  - 0b8e3507: add deprecation notice
  - 684be8d0: catch test-specific error
  * Types/V1
  - 50d0164b: add JSON API v1 types and schemas
  * Reverts
  - cicd: exclude darwin/arm64</changelog>
</package>
<package pkgid="8586bcf27522e4a6f3c10b42496f604f17654d06f909a1073cd9dde6cd87e93af25e30cec326260a96e9dd363c0801e35fb37c4fb351afac397c18f932702d59" name="clair-debuginfo" arch="s390x">
  <version epoch="0" ver="4.9.0" rel="8.6"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717156800">- new package clair: Vulnerability Static Analysis for Containers,
  including the clairctl CLI</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717156801">- Update to version 4.7.4:
  * chore: 4.7.4 changelog bump
  * chore: Add merge step when creating release binaries
  * chore: update go version for release
  * chore: update claircore to v1.5.27
  * chore: update go version
  * Dockerfile: remove sh loop
  * cicd: add container version skew check
  * cicd: update testing workflow
  * cicd: don't upload workspace on failure
  * cicd: change version specifiers to be major-version only</changelog>
  <changelog author="andrea.manzini@suse.com" date="1733572800">- Update to version 4.8.0:
  * bump deps
  * stomp: guard against race in test
  * openshift: add backstop cron manifest
  * openshift: handle multiple Dockerfiles in build script
  * quaybackstop: add backstop GC command
  * introspection: lints
  * contrib: correct position of startupProbe spec
  * contrib/openshfit: only start buildkitd container if needed
  * contrib/openshift: login shenanigans
  * contrib/openshift: avoid patching when using upstream images
  * clair: add platform-specific signals
  * introspection: allow trace shutdown hook full timeout
  * clair: break cancellation chain for request contexts
  * clair: redo shutdown structure
  * docs: add building and Makefile usage sections
  * chore: run the go formatting over the repo
  * contrib: update `build_and_deploy.sh` script
  * openshift: have the pr_check script "dry run" a build
  * openshift: add "dry run" flag
  * auto: improve log messages
  * chore: fix some comments
  * chore: use the merge-multiple directive when downloading binaries
  * chore: Add merge step when creating release binaries
  * contrib: account for different container engine clients
  * contrib: update build script to use podman
  * httptransport: fix test flake
  * contrib: remove rms that were needed for previous fetcher
  * chore: update production manifest with new tmp dir
  * docs: add mention of disk space path and usage
  * initialize: use defaults for NewRemoteFetcher
  * httptransport: GET vuln report returns 404 when indexing in-progress
  * documentation: correct stale configuration options
  * httptransport: change api error handling to panic internally
  * httptransport: add metrics test
  * httputil: add test for non-OK statuses
  * httptransport: add unauthenticated "/robots.txt" endpoint
  * httptransport: add "robots.txt" endpoint
  * cmd: add exported source date
  * config: update minimum TLS version for server
  * docs: add OTLP configuration to prose documentation
  * chore: Add Go 1.22 support via moved godeltaprof dependancy bump
  * contrib: update dashboard regex
  * cmd: annotate fake key for gitleaks
  * chore: clean up sample config
  * openshift: make build_and_deploy script shellcheck-clean
  * config: Update comment to describe currently supported updaters
  * admin: add a check for compatible migration version
  * admin: add command to update go packages with norm_version
  * all: fix incorrect API paths
  * all: fix some typos
  * amqp: migrate to maintained package
  * chore: migrate go-jose to maintained version
  * config: add Sentry config
  * contrib: simplify openshift/pr_check.sh
  * config: add OTLP configuration types
  * httptransport: add client-close detection
  * httptransport: use compression middleware
  * httptransport: lints
  * httptransport: rework constructor
  * httptransport: update DiscoveryHandler to new style
  * httptransport: re-instrument handlers with new primitives
  * httptransport: exit goroutine in error helper
  * webhook: move+update debug server
  * httputil: add response recorder
  * compress: update compression middleware
  * admin: add pre v4.7.3 admin command to create index
  * contrib: add grafana dashboards for deletion metrics
  * Documentation: add more information on how to test and get started
  * config: fix typo</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765972800">- Update to version 4.9.0:
  * Claircore
  - enrichment: don't consider vulnerability.Description for
    enrichments
  - postgres: better GetEnrichments query
  - rpm: fix use of unique.Handle pinning fs.FS
  - vex: account for new VEX RPM module logic
  - cvss: switch to NVD 2.0 JSON feeds
  - chore: upgrade from pgx v4 to v5
  - vex: allow timeout to pull down VEX archive to be
    configurable
  - rpm: add function to determine if packages are installed from
    RPMs
  - sbom: add encoder to encode index reports as SPDX documents
  - rhel: deprecate updater in favor of VEX updater
  - suse: dynamic distribution discovery
  * All
  - 1aca06b8: fix formatted print calls
  * Amqp
  - 1a9f8769: add deprecation notice
  * Build(Deps)
  - e4feca46: bump golang.org/x/time from 0.7.0 to 0.8.0
  - f54011b5: bump golang.org/x/sync from 0.8.0 to 0.9.0
  - ee5524b8: bump go.opentelemetry.io/otel/sdk from 1.31.0 to
    1.32.0
  - 757b649c: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 20c0040f: bump github.com/go-stomp/stomp/v3 from 3.1.2 to
    3.1.3
  - 1607766c: bump github.com/prometheus/client_golang
  - 0a3a4611: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 12ea7bf9: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 146d4a67: bump github.com/urfave/cli/v2 from 2.27.3 to 2.27.5
  - 50003694: bump github.com/klauspost/compress from 1.17.10 to
    1.17.11
  - 6069bb24: bump
    go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  * Chore
  - f6a412cc: v4.9.0 changelog bump
  - cbfd97b6: fix typos in config.yaml.sample
  - 7c9c079b: update claircore to v1.5.48
  - 8e9a6d46: update claircore to v1.5.47
  - 804ef6a4: update claircore to v1.5.46
  - a50727a3: add DVO ignore annotations
  - 8d991938: update claircore to v1.5.45
  - ff2059cf: update claircore to v1.5.44
  - db51ed82: update claircore to v1.5.42
  - c2dc1766: update claircore to v1.5.41
  - 8aa9e1e2: update claircore to v1.5.40
  - eca299b7: update go references to go1.24
  - 1660b66b: upgrade from pgx v4 to v5
  - 68d03bae: remove reviews from dependabot config
  - 0c5292e7: upgrade config module to v1.4.2
  - e5d4c19c: update minimum go version to 1.23
  - e45fbf0e: update claircore to v1.5.35
  - 708bf2f5: update local-dev tracing configs to fix errors
  - 216ca2f1: update claircore to v1.5.34
  - dde57fc1: update openAPI spec to remove SourcePackage
  - e5149fd3: group some dependencies to avoid excessive PRs
  - 60ebea73: update claircore to v1.5.33
  * Chore(Deps)
  - f598d3ec: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - a952e3c6: bump the otel group with 11 updates
  - 878fbceb: bump github.com/google/go-containerregistry
  - 468e409c: bump actions/upload-artifact from 4 to 5
  - c87bc8f0: bump github.com/klauspost/compress from 1.18.1 to
    1.18.2
  - 2a5c11fd: bump actions/checkout from 5 to 6
  - b12439f4: bump golang.org/x/crypto from 0.44.0 to 0.45.0
  - e169a50a: bump google.golang.org/grpc from 1.76.0 to 1.77.0
  - 3e778f2c: bump golang.org/x/net in the golang-x group
  - 4563ccbd: bump github.com/go-stomp/stomp/v3 from 3.1.3 to
    3.1.5
  - 195cdb06: bump golang.org/x/sync in the golang-x group
  - b50044f4: bump actions/download-artifact from 5 to 6
  - 1b429595: bump github.com/klauspost/compress from 1.18.0 to
    1.18.1
  - e439e4df: bump the golang-x group with 2 updates
  - fe37c68b: bump google.golang.org/grpc from 1.75.1 to 1.76.0
  - ee6ea1c8: bump github.com/quay/claircore from 1.5.42 to
    1.5.43
  - afcfd7f0: bump google.golang.org/grpc from 1.75.0 to 1.75.1
  - 6a4937e4: bump the golang-x group across 1 directory with 3
    updates
  - 53cf68e9: bump github.com/jackc/pgx/v5 from 5.7.5 to 5.7.6
  - e9850949: bump github.com/prometheus/client_golang
  - 290969cd: bump actions/stale from 9 to 10
  - 5b5519b5: bump actions/github-script from 7 to 8
  - b78c76b1: bump actions/setup-go from 5 to 6
  - b1f4716b: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 93174450: bump github.com/grafana/pyroscope-go/godeltaprof
  - 0f1fde39: bump the otel group with 11 updates
  - 8dbb0f48: bump golang.org/x/net in the golang-x group
  - a35a1281: bump github.com/ulikunitz/xz from 0.5.11 to 0.5.14
  - 1fa9a753: bump actions/checkout from 4 to 5
  - f0b0949c: bump actions/download-artifact from 4 to 5
  - 890f4a1b: bump github.com/prometheus/client_golang
  - 80add42b: bump google.golang.org/grpc from 1.73.0 to 1.75.0
  - e4746794: bump github.com/jackc/pgx/v5 from 5.7.4 to 5.7.5
  - ba6fe31c: bump go.opentelemetry.io/otel/exporters/prometheus
  - 40b0402e: bump the golang-x group with 2 updates
  - f9635886: bump github.com/quay/zlog from 1.1.8 to 1.1.9
  - 4415106e: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - b7325ada: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 78b92595: bump the otel group with 11 updates
  - 62956271: bump github.com/urfave/cli/v2 from 2.27.6 to 2.27.7
  - 440eee8e: bump github.com/google/go-containerregistry
  - e75e2e2b: bump the golang-x group with 3 updates
  - cf20adbd: bump google.golang.org/grpc from 1.72.2 to 1.73.0
  - d9c211b4: bump github.com/quay/claircore from 1.5.37 to
    1.5.38
  - 6338de8b: bump github.com/ugorji/go/codec from 1.2.12 to
    1.2.14
  - 566271a1: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 3e3a2d33: bump github.com/google/go-containerregistry
  - 81b725ba: bump google.golang.org/grpc from 1.72.1 to 1.72.2
  - faad36e2: bump the otel group with 11 updates
  - 7979e036: bump google.golang.org/grpc from 1.72.0 to 1.72.1
  - 99ab2c1a: bump the golang-x group with 2 updates
  - a166f610: bump github.com/quay/claircore from 1.5.36 to
    1.5.37
  - d8e9dcf4: bump google.golang.org/grpc from 1.71.1 to 1.72.0
  - bfa8f11d: bump github.com/quay/claircore from 1.5.35 to
    1.5.36
  - f8a41628: bump github.com/prometheus/client_golang
  - 7ce22abe: bump google.golang.org/grpc from 1.71.0 to 1.71.1
  - c53cf2ba: bump the golang-x group with 2 updates
  - a5833a44: bump golang.org/x/net in the golang-x group
  - cc6fb14a: bump github.com/rs/zerolog from 1.33.0 to 1.34.0
  - 851e4a36: bump github.com/urfave/cli/v2 from 2.27.5 to 2.27.6
  - e9997624: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - a73e832b: bump github.com/prometheus/client_golang
  - 35110e9e: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 0a9866e3: bump the golang-x group with 3 updates
  - 1ce14606: bump the otel group with 11 updates
  - 919d5287: bump github.com/google/go-cmp in /config
  - 2673e4f4: bump github.com/rogpeppe/go-internal from 1.13.1 to
    1.14.1
  - cf7af98a: bump github.com/go-jose/go-jose/v3 from 3.0.3 to
    3.0.4
  - 6c9fae1e: bump github.com/google/go-cmp from 0.6.0 to 0.7.0
  - 707d8049: bump github.com/prometheus/client_golang
  - 136a618f: bump github.com/klauspost/compress from 1.17.11 to
    1.18.0
  - 3e7c6e74: bump the golang-x group with 3 updates
  - 73db520d: bump github.com/evanphx/json-patch/v5 from 5.9.10
    to 5.9.11
  - a3a60f10: bump google.golang.org/grpc from 1.69.4 to 1.70.0
  - cc29705c: bump github.com/evanphx/json-patch/v5 from 5.9.0 to
    5.9.10
  - d05b4049: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 8b99d320: bump the otel group with 11 updates
  - b2c66991: bump google.golang.org/grpc from 1.69.2 to 1.69.4
  - ef4a1f11: bump the golang-x group with 2 updates
  - 38b77499: bump golang.org/x/net in the golang-x group
  - 80c0381a: bump the otel group across 1 directory with 2
    updates
  - 3eff1ef1: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 5bf85313: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 9ebb61d9: bump golang.org/x/crypto from 0.30.0 to 0.31.0
  - 0881e079: bump the golang-x group with 2 updates
  - f556ef16: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - bf8737a1: bump golang.org/x/net in the golang-x group
  - f1d9aae4: bump
    go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  * Chore(Manifests)
  - 48b75fe4: add anti-affinity rules
  * Ci
  - a0a35fd7: Allow go test to access un-vendored dependencies
  * Cicd
  - ab791a2e: run multiarch tests without a full container
  - 935a61f3: vendor modules into nightly source
  * Clairctl
  - 4c93f8ea: Print a friendly error on panic
  - #2221### Config
  - 0db9beaf: add ability to disable enrichment
  - 7ab81b38: clean environment in example
  * Dev
  - 503215f5: rename dashboard.json file to clair.json
  - 65cd4244: add a grafana dashboard for postgres stats
  * Docker
  - 10485679: remove version line from docker-compose.yaml
  * Docker-Compose
  - 8c71b46e: update containers
  * Enrichments
  - 6527a9ec: disable enrichers if config option is set
  * Fix
  - 0a8c3864: typo in variable name
  * Go.Mod
  - 6db583f7: Update Go version to 1.24.9 for CVE-2025-47907
  * Health
  - b57b9fa6: using atomic.Uint32
  * Introspection
  - 797c2f45: implement OTLP support for metrics and traces
  * Misc
  - 5891f64b: remove API doc make target, CI check
  * Notifier
  - a9a68e18: increase default durations to be more reasonable
  * Openapi
  - 8c540b96: rebuild OpenAPI spec
  * Signer
  - 1c6d0496: initialize before checking for PSK
  - Fixes #2214 - #2221### Stomp
  - b2501ba3: ignore Unsubscribe error in test
  - 0b8e3507: add deprecation notice
  - 684be8d0: catch test-specific error
  * Types/V1
  - 50d0164b: add JSON API v1 types and schemas
  * Reverts
  - cicd: exclude darwin/arm64</changelog>
</package>
<package pkgid="689aafc3747409bf0d014d0ef8a56323783a8ec2f658eb24fed2ed5bcf9e002fa5cc716601958dae0fd977d15e3d2e27474213e313371abd8c8ae79e0fccc3ca" name="clairctl" arch="s390x">
  <version epoch="0" ver="4.9.0" rel="8.6"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717156800">- new package clair: Vulnerability Static Analysis for Containers,
  including the clairctl CLI</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717156801">- Update to version 4.7.4:
  * chore: 4.7.4 changelog bump
  * chore: Add merge step when creating release binaries
  * chore: update go version for release
  * chore: update claircore to v1.5.27
  * chore: update go version
  * Dockerfile: remove sh loop
  * cicd: add container version skew check
  * cicd: update testing workflow
  * cicd: don't upload workspace on failure
  * cicd: change version specifiers to be major-version only</changelog>
  <changelog author="andrea.manzini@suse.com" date="1733572800">- Update to version 4.8.0:
  * bump deps
  * stomp: guard against race in test
  * openshift: add backstop cron manifest
  * openshift: handle multiple Dockerfiles in build script
  * quaybackstop: add backstop GC command
  * introspection: lints
  * contrib: correct position of startupProbe spec
  * contrib/openshfit: only start buildkitd container if needed
  * contrib/openshift: login shenanigans
  * contrib/openshift: avoid patching when using upstream images
  * clair: add platform-specific signals
  * introspection: allow trace shutdown hook full timeout
  * clair: break cancellation chain for request contexts
  * clair: redo shutdown structure
  * docs: add building and Makefile usage sections
  * chore: run the go formatting over the repo
  * contrib: update `build_and_deploy.sh` script
  * openshift: have the pr_check script "dry run" a build
  * openshift: add "dry run" flag
  * auto: improve log messages
  * chore: fix some comments
  * chore: use the merge-multiple directive when downloading binaries
  * chore: Add merge step when creating release binaries
  * contrib: account for different container engine clients
  * contrib: update build script to use podman
  * httptransport: fix test flake
  * contrib: remove rms that were needed for previous fetcher
  * chore: update production manifest with new tmp dir
  * docs: add mention of disk space path and usage
  * initialize: use defaults for NewRemoteFetcher
  * httptransport: GET vuln report returns 404 when indexing in-progress
  * documentation: correct stale configuration options
  * httptransport: change api error handling to panic internally
  * httptransport: add metrics test
  * httputil: add test for non-OK statuses
  * httptransport: add unauthenticated "/robots.txt" endpoint
  * httptransport: add "robots.txt" endpoint
  * cmd: add exported source date
  * config: update minimum TLS version for server
  * docs: add OTLP configuration to prose documentation
  * chore: Add Go 1.22 support via moved godeltaprof dependancy bump
  * contrib: update dashboard regex
  * cmd: annotate fake key for gitleaks
  * chore: clean up sample config
  * openshift: make build_and_deploy script shellcheck-clean
  * config: Update comment to describe currently supported updaters
  * admin: add a check for compatible migration version
  * admin: add command to update go packages with norm_version
  * all: fix incorrect API paths
  * all: fix some typos
  * amqp: migrate to maintained package
  * chore: migrate go-jose to maintained version
  * config: add Sentry config
  * contrib: simplify openshift/pr_check.sh
  * config: add OTLP configuration types
  * httptransport: add client-close detection
  * httptransport: use compression middleware
  * httptransport: lints
  * httptransport: rework constructor
  * httptransport: update DiscoveryHandler to new style
  * httptransport: re-instrument handlers with new primitives
  * httptransport: exit goroutine in error helper
  * webhook: move+update debug server
  * httputil: add response recorder
  * compress: update compression middleware
  * admin: add pre v4.7.3 admin command to create index
  * contrib: add grafana dashboards for deletion metrics
  * Documentation: add more information on how to test and get started
  * config: fix typo</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765972800">- Update to version 4.9.0:
  * Claircore
  - enrichment: don't consider vulnerability.Description for
    enrichments
  - postgres: better GetEnrichments query
  - rpm: fix use of unique.Handle pinning fs.FS
  - vex: account for new VEX RPM module logic
  - cvss: switch to NVD 2.0 JSON feeds
  - chore: upgrade from pgx v4 to v5
  - vex: allow timeout to pull down VEX archive to be
    configurable
  - rpm: add function to determine if packages are installed from
    RPMs
  - sbom: add encoder to encode index reports as SPDX documents
  - rhel: deprecate updater in favor of VEX updater
  - suse: dynamic distribution discovery
  * All
  - 1aca06b8: fix formatted print calls
  * Amqp
  - 1a9f8769: add deprecation notice
  * Build(Deps)
  - e4feca46: bump golang.org/x/time from 0.7.0 to 0.8.0
  - f54011b5: bump golang.org/x/sync from 0.8.0 to 0.9.0
  - ee5524b8: bump go.opentelemetry.io/otel/sdk from 1.31.0 to
    1.32.0
  - 757b649c: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 20c0040f: bump github.com/go-stomp/stomp/v3 from 3.1.2 to
    3.1.3
  - 1607766c: bump github.com/prometheus/client_golang
  - 0a3a4611: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 12ea7bf9: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 146d4a67: bump github.com/urfave/cli/v2 from 2.27.3 to 2.27.5
  - 50003694: bump github.com/klauspost/compress from 1.17.10 to
    1.17.11
  - 6069bb24: bump
    go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  * Chore
  - f6a412cc: v4.9.0 changelog bump
  - cbfd97b6: fix typos in config.yaml.sample
  - 7c9c079b: update claircore to v1.5.48
  - 8e9a6d46: update claircore to v1.5.47
  - 804ef6a4: update claircore to v1.5.46
  - a50727a3: add DVO ignore annotations
  - 8d991938: update claircore to v1.5.45
  - ff2059cf: update claircore to v1.5.44
  - db51ed82: update claircore to v1.5.42
  - c2dc1766: update claircore to v1.5.41
  - 8aa9e1e2: update claircore to v1.5.40
  - eca299b7: update go references to go1.24
  - 1660b66b: upgrade from pgx v4 to v5
  - 68d03bae: remove reviews from dependabot config
  - 0c5292e7: upgrade config module to v1.4.2
  - e5d4c19c: update minimum go version to 1.23
  - e45fbf0e: update claircore to v1.5.35
  - 708bf2f5: update local-dev tracing configs to fix errors
  - 216ca2f1: update claircore to v1.5.34
  - dde57fc1: update openAPI spec to remove SourcePackage
  - e5149fd3: group some dependencies to avoid excessive PRs
  - 60ebea73: update claircore to v1.5.33
  * Chore(Deps)
  - f598d3ec: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - a952e3c6: bump the otel group with 11 updates
  - 878fbceb: bump github.com/google/go-containerregistry
  - 468e409c: bump actions/upload-artifact from 4 to 5
  - c87bc8f0: bump github.com/klauspost/compress from 1.18.1 to
    1.18.2
  - 2a5c11fd: bump actions/checkout from 5 to 6
  - b12439f4: bump golang.org/x/crypto from 0.44.0 to 0.45.0
  - e169a50a: bump google.golang.org/grpc from 1.76.0 to 1.77.0
  - 3e778f2c: bump golang.org/x/net in the golang-x group
  - 4563ccbd: bump github.com/go-stomp/stomp/v3 from 3.1.3 to
    3.1.5
  - 195cdb06: bump golang.org/x/sync in the golang-x group
  - b50044f4: bump actions/download-artifact from 5 to 6
  - 1b429595: bump github.com/klauspost/compress from 1.18.0 to
    1.18.1
  - e439e4df: bump the golang-x group with 2 updates
  - fe37c68b: bump google.golang.org/grpc from 1.75.1 to 1.76.0
  - ee6ea1c8: bump github.com/quay/claircore from 1.5.42 to
    1.5.43
  - afcfd7f0: bump google.golang.org/grpc from 1.75.0 to 1.75.1
  - 6a4937e4: bump the golang-x group across 1 directory with 3
    updates
  - 53cf68e9: bump github.com/jackc/pgx/v5 from 5.7.5 to 5.7.6
  - e9850949: bump github.com/prometheus/client_golang
  - 290969cd: bump actions/stale from 9 to 10
  - 5b5519b5: bump actions/github-script from 7 to 8
  - b78c76b1: bump actions/setup-go from 5 to 6
  - b1f4716b: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 93174450: bump github.com/grafana/pyroscope-go/godeltaprof
  - 0f1fde39: bump the otel group with 11 updates
  - 8dbb0f48: bump golang.org/x/net in the golang-x group
  - a35a1281: bump github.com/ulikunitz/xz from 0.5.11 to 0.5.14
  - 1fa9a753: bump actions/checkout from 4 to 5
  - f0b0949c: bump actions/download-artifact from 4 to 5
  - 890f4a1b: bump github.com/prometheus/client_golang
  - 80add42b: bump google.golang.org/grpc from 1.73.0 to 1.75.0
  - e4746794: bump github.com/jackc/pgx/v5 from 5.7.4 to 5.7.5
  - ba6fe31c: bump go.opentelemetry.io/otel/exporters/prometheus
  - 40b0402e: bump the golang-x group with 2 updates
  - f9635886: bump github.com/quay/zlog from 1.1.8 to 1.1.9
  - 4415106e: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - b7325ada: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 78b92595: bump the otel group with 11 updates
  - 62956271: bump github.com/urfave/cli/v2 from 2.27.6 to 2.27.7
  - 440eee8e: bump github.com/google/go-containerregistry
  - e75e2e2b: bump the golang-x group with 3 updates
  - cf20adbd: bump google.golang.org/grpc from 1.72.2 to 1.73.0
  - d9c211b4: bump github.com/quay/claircore from 1.5.37 to
    1.5.38
  - 6338de8b: bump github.com/ugorji/go/codec from 1.2.12 to
    1.2.14
  - 566271a1: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 3e3a2d33: bump github.com/google/go-containerregistry
  - 81b725ba: bump google.golang.org/grpc from 1.72.1 to 1.72.2
  - faad36e2: bump the otel group with 11 updates
  - 7979e036: bump google.golang.org/grpc from 1.72.0 to 1.72.1
  - 99ab2c1a: bump the golang-x group with 2 updates
  - a166f610: bump github.com/quay/claircore from 1.5.36 to
    1.5.37
  - d8e9dcf4: bump google.golang.org/grpc from 1.71.1 to 1.72.0
  - bfa8f11d: bump github.com/quay/claircore from 1.5.35 to
    1.5.36
  - f8a41628: bump github.com/prometheus/client_golang
  - 7ce22abe: bump google.golang.org/grpc from 1.71.0 to 1.71.1
  - c53cf2ba: bump the golang-x group with 2 updates
  - a5833a44: bump golang.org/x/net in the golang-x group
  - cc6fb14a: bump github.com/rs/zerolog from 1.33.0 to 1.34.0
  - 851e4a36: bump github.com/urfave/cli/v2 from 2.27.5 to 2.27.6
  - e9997624: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - a73e832b: bump github.com/prometheus/client_golang
  - 35110e9e: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 0a9866e3: bump the golang-x group with 3 updates
  - 1ce14606: bump the otel group with 11 updates
  - 919d5287: bump github.com/google/go-cmp in /config
  - 2673e4f4: bump github.com/rogpeppe/go-internal from 1.13.1 to
    1.14.1
  - cf7af98a: bump github.com/go-jose/go-jose/v3 from 3.0.3 to
    3.0.4
  - 6c9fae1e: bump github.com/google/go-cmp from 0.6.0 to 0.7.0
  - 707d8049: bump github.com/prometheus/client_golang
  - 136a618f: bump github.com/klauspost/compress from 1.17.11 to
    1.18.0
  - 3e7c6e74: bump the golang-x group with 3 updates
  - 73db520d: bump github.com/evanphx/json-patch/v5 from 5.9.10
    to 5.9.11
  - a3a60f10: bump google.golang.org/grpc from 1.69.4 to 1.70.0
  - cc29705c: bump github.com/evanphx/json-patch/v5 from 5.9.0 to
    5.9.10
  - d05b4049: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 8b99d320: bump the otel group with 11 updates
  - b2c66991: bump google.golang.org/grpc from 1.69.2 to 1.69.4
  - ef4a1f11: bump the golang-x group with 2 updates
  - 38b77499: bump golang.org/x/net in the golang-x group
  - 80c0381a: bump the otel group across 1 directory with 2
    updates
  - 3eff1ef1: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 5bf85313: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 9ebb61d9: bump golang.org/x/crypto from 0.30.0 to 0.31.0
  - 0881e079: bump the golang-x group with 2 updates
  - f556ef16: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - bf8737a1: bump golang.org/x/net in the golang-x group
  - f1d9aae4: bump
    go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  * Chore(Manifests)
  - 48b75fe4: add anti-affinity rules
  * Ci
  - a0a35fd7: Allow go test to access un-vendored dependencies
  * Cicd
  - ab791a2e: run multiarch tests without a full container
  - 935a61f3: vendor modules into nightly source
  * Clairctl
  - 4c93f8ea: Print a friendly error on panic
  - #2221### Config
  - 0db9beaf: add ability to disable enrichment
  - 7ab81b38: clean environment in example
  * Dev
  - 503215f5: rename dashboard.json file to clair.json
  - 65cd4244: add a grafana dashboard for postgres stats
  * Docker
  - 10485679: remove version line from docker-compose.yaml
  * Docker-Compose
  - 8c71b46e: update containers
  * Enrichments
  - 6527a9ec: disable enrichers if config option is set
  * Fix
  - 0a8c3864: typo in variable name
  * Go.Mod
  - 6db583f7: Update Go version to 1.24.9 for CVE-2025-47907
  * Health
  - b57b9fa6: using atomic.Uint32
  * Introspection
  - 797c2f45: implement OTLP support for metrics and traces
  * Misc
  - 5891f64b: remove API doc make target, CI check
  * Notifier
  - a9a68e18: increase default durations to be more reasonable
  * Openapi
  - 8c540b96: rebuild OpenAPI spec
  * Signer
  - 1c6d0496: initialize before checking for PSK
  - Fixes #2214 - #2221### Stomp
  - b2501ba3: ignore Unsubscribe error in test
  - 0b8e3507: add deprecation notice
  - 684be8d0: catch test-specific error
  * Types/V1
  - 50d0164b: add JSON API v1 types and schemas
  * Reverts
  - cicd: exclude darwin/arm64</changelog>
</package>
<package pkgid="0634f642a68a51dd10d8415c635551c85b1d781e149d77fba9605421e94c4a5ab7db07efa275538fe030ed2fa5d388b5511505746609fc3ac2d700ca23ab3336" name="clairctl-debuginfo" arch="s390x">
  <version epoch="0" ver="4.9.0" rel="8.6"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717156800">- new package clair: Vulnerability Static Analysis for Containers,
  including the clairctl CLI</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717156801">- Update to version 4.7.4:
  * chore: 4.7.4 changelog bump
  * chore: Add merge step when creating release binaries
  * chore: update go version for release
  * chore: update claircore to v1.5.27
  * chore: update go version
  * Dockerfile: remove sh loop
  * cicd: add container version skew check
  * cicd: update testing workflow
  * cicd: don't upload workspace on failure
  * cicd: change version specifiers to be major-version only</changelog>
  <changelog author="andrea.manzini@suse.com" date="1733572800">- Update to version 4.8.0:
  * bump deps
  * stomp: guard against race in test
  * openshift: add backstop cron manifest
  * openshift: handle multiple Dockerfiles in build script
  * quaybackstop: add backstop GC command
  * introspection: lints
  * contrib: correct position of startupProbe spec
  * contrib/openshfit: only start buildkitd container if needed
  * contrib/openshift: login shenanigans
  * contrib/openshift: avoid patching when using upstream images
  * clair: add platform-specific signals
  * introspection: allow trace shutdown hook full timeout
  * clair: break cancellation chain for request contexts
  * clair: redo shutdown structure
  * docs: add building and Makefile usage sections
  * chore: run the go formatting over the repo
  * contrib: update `build_and_deploy.sh` script
  * openshift: have the pr_check script "dry run" a build
  * openshift: add "dry run" flag
  * auto: improve log messages
  * chore: fix some comments
  * chore: use the merge-multiple directive when downloading binaries
  * chore: Add merge step when creating release binaries
  * contrib: account for different container engine clients
  * contrib: update build script to use podman
  * httptransport: fix test flake
  * contrib: remove rms that were needed for previous fetcher
  * chore: update production manifest with new tmp dir
  * docs: add mention of disk space path and usage
  * initialize: use defaults for NewRemoteFetcher
  * httptransport: GET vuln report returns 404 when indexing in-progress
  * documentation: correct stale configuration options
  * httptransport: change api error handling to panic internally
  * httptransport: add metrics test
  * httputil: add test for non-OK statuses
  * httptransport: add unauthenticated "/robots.txt" endpoint
  * httptransport: add "robots.txt" endpoint
  * cmd: add exported source date
  * config: update minimum TLS version for server
  * docs: add OTLP configuration to prose documentation
  * chore: Add Go 1.22 support via moved godeltaprof dependancy bump
  * contrib: update dashboard regex
  * cmd: annotate fake key for gitleaks
  * chore: clean up sample config
  * openshift: make build_and_deploy script shellcheck-clean
  * config: Update comment to describe currently supported updaters
  * admin: add a check for compatible migration version
  * admin: add command to update go packages with norm_version
  * all: fix incorrect API paths
  * all: fix some typos
  * amqp: migrate to maintained package
  * chore: migrate go-jose to maintained version
  * config: add Sentry config
  * contrib: simplify openshift/pr_check.sh
  * config: add OTLP configuration types
  * httptransport: add client-close detection
  * httptransport: use compression middleware
  * httptransport: lints
  * httptransport: rework constructor
  * httptransport: update DiscoveryHandler to new style
  * httptransport: re-instrument handlers with new primitives
  * httptransport: exit goroutine in error helper
  * webhook: move+update debug server
  * httputil: add response recorder
  * compress: update compression middleware
  * admin: add pre v4.7.3 admin command to create index
  * contrib: add grafana dashboards for deletion metrics
  * Documentation: add more information on how to test and get started
  * config: fix typo</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765972800">- Update to version 4.9.0:
  * Claircore
  - enrichment: don't consider vulnerability.Description for
    enrichments
  - postgres: better GetEnrichments query
  - rpm: fix use of unique.Handle pinning fs.FS
  - vex: account for new VEX RPM module logic
  - cvss: switch to NVD 2.0 JSON feeds
  - chore: upgrade from pgx v4 to v5
  - vex: allow timeout to pull down VEX archive to be
    configurable
  - rpm: add function to determine if packages are installed from
    RPMs
  - sbom: add encoder to encode index reports as SPDX documents
  - rhel: deprecate updater in favor of VEX updater
  - suse: dynamic distribution discovery
  * All
  - 1aca06b8: fix formatted print calls
  * Amqp
  - 1a9f8769: add deprecation notice
  * Build(Deps)
  - e4feca46: bump golang.org/x/time from 0.7.0 to 0.8.0
  - f54011b5: bump golang.org/x/sync from 0.8.0 to 0.9.0
  - ee5524b8: bump go.opentelemetry.io/otel/sdk from 1.31.0 to
    1.32.0
  - 757b649c: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 20c0040f: bump github.com/go-stomp/stomp/v3 from 3.1.2 to
    3.1.3
  - 1607766c: bump github.com/prometheus/client_golang
  - 0a3a4611: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 12ea7bf9: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 146d4a67: bump github.com/urfave/cli/v2 from 2.27.3 to 2.27.5
  - 50003694: bump github.com/klauspost/compress from 1.17.10 to
    1.17.11
  - 6069bb24: bump
    go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  * Chore
  - f6a412cc: v4.9.0 changelog bump
  - cbfd97b6: fix typos in config.yaml.sample
  - 7c9c079b: update claircore to v1.5.48
  - 8e9a6d46: update claircore to v1.5.47
  - 804ef6a4: update claircore to v1.5.46
  - a50727a3: add DVO ignore annotations
  - 8d991938: update claircore to v1.5.45
  - ff2059cf: update claircore to v1.5.44
  - db51ed82: update claircore to v1.5.42
  - c2dc1766: update claircore to v1.5.41
  - 8aa9e1e2: update claircore to v1.5.40
  - eca299b7: update go references to go1.24
  - 1660b66b: upgrade from pgx v4 to v5
  - 68d03bae: remove reviews from dependabot config
  - 0c5292e7: upgrade config module to v1.4.2
  - e5d4c19c: update minimum go version to 1.23
  - e45fbf0e: update claircore to v1.5.35
  - 708bf2f5: update local-dev tracing configs to fix errors
  - 216ca2f1: update claircore to v1.5.34
  - dde57fc1: update openAPI spec to remove SourcePackage
  - e5149fd3: group some dependencies to avoid excessive PRs
  - 60ebea73: update claircore to v1.5.33
  * Chore(Deps)
  - f598d3ec: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - a952e3c6: bump the otel group with 11 updates
  - 878fbceb: bump github.com/google/go-containerregistry
  - 468e409c: bump actions/upload-artifact from 4 to 5
  - c87bc8f0: bump github.com/klauspost/compress from 1.18.1 to
    1.18.2
  - 2a5c11fd: bump actions/checkout from 5 to 6
  - b12439f4: bump golang.org/x/crypto from 0.44.0 to 0.45.0
  - e169a50a: bump google.golang.org/grpc from 1.76.0 to 1.77.0
  - 3e778f2c: bump golang.org/x/net in the golang-x group
  - 4563ccbd: bump github.com/go-stomp/stomp/v3 from 3.1.3 to
    3.1.5
  - 195cdb06: bump golang.org/x/sync in the golang-x group
  - b50044f4: bump actions/download-artifact from 5 to 6
  - 1b429595: bump github.com/klauspost/compress from 1.18.0 to
    1.18.1
  - e439e4df: bump the golang-x group with 2 updates
  - fe37c68b: bump google.golang.org/grpc from 1.75.1 to 1.76.0
  - ee6ea1c8: bump github.com/quay/claircore from 1.5.42 to
    1.5.43
  - afcfd7f0: bump google.golang.org/grpc from 1.75.0 to 1.75.1
  - 6a4937e4: bump the golang-x group across 1 directory with 3
    updates
  - 53cf68e9: bump github.com/jackc/pgx/v5 from 5.7.5 to 5.7.6
  - e9850949: bump github.com/prometheus/client_golang
  - 290969cd: bump actions/stale from 9 to 10
  - 5b5519b5: bump actions/github-script from 7 to 8
  - b78c76b1: bump actions/setup-go from 5 to 6
  - b1f4716b: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 93174450: bump github.com/grafana/pyroscope-go/godeltaprof
  - 0f1fde39: bump the otel group with 11 updates
  - 8dbb0f48: bump golang.org/x/net in the golang-x group
  - a35a1281: bump github.com/ulikunitz/xz from 0.5.11 to 0.5.14
  - 1fa9a753: bump actions/checkout from 4 to 5
  - f0b0949c: bump actions/download-artifact from 4 to 5
  - 890f4a1b: bump github.com/prometheus/client_golang
  - 80add42b: bump google.golang.org/grpc from 1.73.0 to 1.75.0
  - e4746794: bump github.com/jackc/pgx/v5 from 5.7.4 to 5.7.5
  - ba6fe31c: bump go.opentelemetry.io/otel/exporters/prometheus
  - 40b0402e: bump the golang-x group with 2 updates
  - f9635886: bump github.com/quay/zlog from 1.1.8 to 1.1.9
  - 4415106e: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - b7325ada: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 78b92595: bump the otel group with 11 updates
  - 62956271: bump github.com/urfave/cli/v2 from 2.27.6 to 2.27.7
  - 440eee8e: bump github.com/google/go-containerregistry
  - e75e2e2b: bump the golang-x group with 3 updates
  - cf20adbd: bump google.golang.org/grpc from 1.72.2 to 1.73.0
  - d9c211b4: bump github.com/quay/claircore from 1.5.37 to
    1.5.38
  - 6338de8b: bump github.com/ugorji/go/codec from 1.2.12 to
    1.2.14
  - 566271a1: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 3e3a2d33: bump github.com/google/go-containerregistry
  - 81b725ba: bump google.golang.org/grpc from 1.72.1 to 1.72.2
  - faad36e2: bump the otel group with 11 updates
  - 7979e036: bump google.golang.org/grpc from 1.72.0 to 1.72.1
  - 99ab2c1a: bump the golang-x group with 2 updates
  - a166f610: bump github.com/quay/claircore from 1.5.36 to
    1.5.37
  - d8e9dcf4: bump google.golang.org/grpc from 1.71.1 to 1.72.0
  - bfa8f11d: bump github.com/quay/claircore from 1.5.35 to
    1.5.36
  - f8a41628: bump github.com/prometheus/client_golang
  - 7ce22abe: bump google.golang.org/grpc from 1.71.0 to 1.71.1
  - c53cf2ba: bump the golang-x group with 2 updates
  - a5833a44: bump golang.org/x/net in the golang-x group
  - cc6fb14a: bump github.com/rs/zerolog from 1.33.0 to 1.34.0
  - 851e4a36: bump github.com/urfave/cli/v2 from 2.27.5 to 2.27.6
  - e9997624: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - a73e832b: bump github.com/prometheus/client_golang
  - 35110e9e: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 0a9866e3: bump the golang-x group with 3 updates
  - 1ce14606: bump the otel group with 11 updates
  - 919d5287: bump github.com/google/go-cmp in /config
  - 2673e4f4: bump github.com/rogpeppe/go-internal from 1.13.1 to
    1.14.1
  - cf7af98a: bump github.com/go-jose/go-jose/v3 from 3.0.3 to
    3.0.4
  - 6c9fae1e: bump github.com/google/go-cmp from 0.6.0 to 0.7.0
  - 707d8049: bump github.com/prometheus/client_golang
  - 136a618f: bump github.com/klauspost/compress from 1.17.11 to
    1.18.0
  - 3e7c6e74: bump the golang-x group with 3 updates
  - 73db520d: bump github.com/evanphx/json-patch/v5 from 5.9.10
    to 5.9.11
  - a3a60f10: bump google.golang.org/grpc from 1.69.4 to 1.70.0
  - cc29705c: bump github.com/evanphx/json-patch/v5 from 5.9.0 to
    5.9.10
  - d05b4049: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 8b99d320: bump the otel group with 11 updates
  - b2c66991: bump google.golang.org/grpc from 1.69.2 to 1.69.4
  - ef4a1f11: bump the golang-x group with 2 updates
  - 38b77499: bump golang.org/x/net in the golang-x group
  - 80c0381a: bump the otel group across 1 directory with 2
    updates
  - 3eff1ef1: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - 5bf85313: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  - 9ebb61d9: bump golang.org/x/crypto from 0.30.0 to 0.31.0
  - 0881e079: bump the golang-x group with 2 updates
  - f556ef16: bump
    go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
  - bf8737a1: bump golang.org/x/net in the golang-x group
  - f1d9aae4: bump
    go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  * Chore(Manifests)
  - 48b75fe4: add anti-affinity rules
  * Ci
  - a0a35fd7: Allow go test to access un-vendored dependencies
  * Cicd
  - ab791a2e: run multiarch tests without a full container
  - 935a61f3: vendor modules into nightly source
  * Clairctl
  - 4c93f8ea: Print a friendly error on panic
  - #2221### Config
  - 0db9beaf: add ability to disable enrichment
  - 7ab81b38: clean environment in example
  * Dev
  - 503215f5: rename dashboard.json file to clair.json
  - 65cd4244: add a grafana dashboard for postgres stats
  * Docker
  - 10485679: remove version line from docker-compose.yaml
  * Docker-Compose
  - 8c71b46e: update containers
  * Enrichments
  - 6527a9ec: disable enrichers if config option is set
  * Fix
  - 0a8c3864: typo in variable name
  * Go.Mod
  - 6db583f7: Update Go version to 1.24.9 for CVE-2025-47907
  * Health
  - b57b9fa6: using atomic.Uint32
  * Introspection
  - 797c2f45: implement OTLP support for metrics and traces
  * Misc
  - 5891f64b: remove API doc make target, CI check
  * Notifier
  - a9a68e18: increase default durations to be more reasonable
  * Openapi
  - 8c540b96: rebuild OpenAPI spec
  * Signer
  - 1c6d0496: initialize before checking for PSK
  - Fixes #2214 - #2221### Stomp
  - b2501ba3: ignore Unsubscribe error in test
  - 0b8e3507: add deprecation notice
  - 684be8d0: catch test-specific error
  * Types/V1
  - 50d0164b: add JSON API v1 types and schemas
  * Reverts
  - cicd: exclude darwin/arm64</changelog>
</package>
<package pkgid="063ac0593c0b78977f032460663e88e566f3fc628e03816ba5f075a1d6c60a5d4b7123f61db47931b526260fe6421d7cb127f5a814686815d39ff0287ed9e33c" name="clamav" arch="s390x">
  <version epoch="0" ver="1.5.4" rel="339.1"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1737633600">- Drop the version dependency on libcurl. Building against versions
  older than 7.45 does not fail anymore, but disables support for
  fdpassing in clamonacc. This only affects SLE-12 up to SP3.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1739188800">- bsc#1236949: Fix location of license files.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1742817600">- bsc#1239957: Build with PIE.
- Eliminate some UTF-8 NBSP characters from the changes file.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1748433600">- bsc#1243565: Add clamav-freshclam_test.patch to fix a race
  condition between the mockup servers started by different test
  cases in freshclam_test.py.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1750334400">- New version 1.4.3:
  ClamAV 1.4.3 is a patch release with the following fixes:
  * CVE-2025-20260, bsc#1245054: Fixed a possible buffer overflow
    write bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition or enable remote code
    execution. This issue only affects configurations where both:
  - The max file-size scan limit is set greater than or equal to 1024MB.
  - The max scan-size scan limit is set greater than or equal to 1025MB.
    The code flaw was present prior to version 1.0.0, but a change in
    version 1.0.0 that enables larger allocations based on untrusted data
    made it possible to trigger this bug.
    This issue affects all currently supported versions.
  * CVE-2025-20234, bsc#1245055: Fixed a possible buffer overflow
    read bug in the UDF file parser that may write to a temp file
    and thus disclose information, or it may crash and cause a
    denial-of-service (DoS) condition.
    This issue was introduced in version 1.2.0.
  * Fixed a possible use-after-free bug in the Xz decompression module in
    the bundled lzma-sdk library.
    This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a
    copy of the lzma-sdk with some performance changes specific to
    libclamav, plus select bug fixes like this one in lieu of a full
    upgrade to newer lzma-sdk.
    This issue affects all ClamAV versions at least as far back as 0.99.4.
  * Windows: Fixed a build install issue when a DLL dependency such as
    libcrypto has the exact same name as one provided by the Windows
    operating system.
- Renew clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1751284800">- bsc#1240363, clamav-disable-administrative-commands.patch: clamd:
  Add an option to toggle SHUTDOWN, RELOAD, STATS and VERSION.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1759924800">- New version 1.5.0:
  * Added checks to determine if an OLE2-based Microsoft Office
    document is encrypted.
  * Added the ability to record URIs found in HTML if the
    generate-JSON-metadata feature is enabled.
  * Added the ability to record URIs found in PDFs if the
    generate-JSON-metadata feature is enabled.
  * Added regex support for the clamd.conf OnAccessExcludePath
    config option.
  * Added CVD signing/verification with external .sign files.
  * Freshclam, ClamD, ClamScan, and Sigtool: Added an option to
    enable FIPS-like limits disabling MD5 and SHA1 from being used
    for verifying digital signatures or for being used to trust a
    file when checking for false positives (bsc#1221954).
  * ClamD: Added an option to disable select administrative
    commands including SHUTDOWN, RELOAD, STATS and VERSION.
  * libclamav: Added extended hashing functions with a "flags"
    parameter that allows the caller to choose if they want to
    bypass FIPS hash algorithm limits.
  * See the release announcement for the full list of changes:
    https://blog.clamav.net/2025/10/clamav-150-released.html
- Obsoleted patches:
  * clamav-freshclam_test.patch
  * clamav-disable-administrative-commands.patch
  * clamav-fips.patch
- Use macros for library versions
- Remove service symlinks: rcclamd, rcfreshclam, rcclamav-milter,
  and clamonacc.
- Use rust 1.86 for SLE-12 and SLE-15-SP2.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760443200">- Add json-c-json-c-0.18-20240915.tar.gz and link it statically
  into libclamav on SLE-12, because version 0.12 is too old.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760616000">- New version: 1.5.1:
  * Fixed a significant performance issue when scanning some PE
    files.
  * Fixed an issue recording file entries from a ZIP archive
    central directory which resulted in
    "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
    ClamScan --alert-exceeds-max command line option or ClamD
    AlertExceedsMax config file option.
  * Improved performance when scanning TNEF email attachments.
  * Fixed an issue with recording metadata for OOXML office
    documents.
  * Fixed an issue with signature matches for VBA in OLE2 office
    documents.
  * Loosened overly restrictive rules for embedded file
    identification and increased the limit for finding PE files
    embedded in other PE files.
  * Fixed an issue with extracting some RAR archives embedded in
    other files.
  * Fixed an issue with calculating fuzzy hashes affecting some
    images by updating the version for several Rust library
    dependencies.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1762257600">- Add clamav-workaround.patch to work around symbol removals in
  version 1.5.0 and 1.5.1.</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1763208000">- Build with older rust 1.87 for reproducible builds (boo#1249404)</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1763726400">- Provide a better fix for boo#1249404 by disabling debug mode.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1764331200">- Fix testsuite error on SLE-15-SP6 by falling back to rust1.86.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770724800">- jsc-PED-14819: Support transactional updates.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770984000">- bsc#1258072: Require main and library packages to be of the same
  version and release. Given that all the core functionality is
  in the libraries it makes little sense to update the main
  package alone.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1772712000">- New version 1.5.2:
  * bsc#1259207, CVE-2026-20031: Fixed an error handling bug in the
    HTML file parser that may crash the program and cause a
    denial-of-service (DoS) condition. This issue was introduced in
    version 1.1.0.
  * Fixed a possible infinite loop when scanning some JPEG files by
    upgrading affected ClamAV dependency, a Rust image library.
  * The CVD verification process will now ignore certificate files
    in the CVD certs directory when the user lacks read permissions.
  * Freshclam: Fix CLD verification bug with PrivateMirror option.
  * Upgraded the Rust bytes dependency to a newer version to
    resolve RUSTSEC-2026-0007 advisory.
  * Fixed a possible crash caused by invalid pointer alignment on
    some platforms.
  * Minimal required Rust version is now 1.87.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1773316800">- Disable build for 32 bit ix86 because of testsuite failures with
  rust &gt;= 1.87 that upstream is not planning to fix.
- Run the test suite on all SUSE releases.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1782907200">- update to 1.5.3
  ClamAV 1.5.3 is a patch release with the following fixes:
  * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
  * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
  * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
  * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
  * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
  * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
  * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
  * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
  * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
  * Metadata preclass scans now run before the final scan verdict.
  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1784894400">- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to
  fix path traversal vulnerability in OneNote parser.
- Add clamav-vendor-cve-2026-46671.tar.gz to provide the
  sanitise-file-name Rust crate required by the security fix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1786881600">- update to 1.5.4
  ClamAV 1.5.4 is a patch release with the following fixes:
  * CVE-2026-20337, bsc#1274597:
    Fixed ZIP catalogue capacity tracking that could write beyond a heap
    allocation while indexing local file headers.
  * CVE-2026-20345, bsc#1274600:
    Fixed an indexing error while converting GPT partition names that could
    read or write beyond a stack-allocated partition entry.
  * CVE-2026-20339, bsc#1274599:
    Fixed an integer overflow in the PESpin unpacker that could allocate an
    undersized buffer and then write beyond it while rebuilding a PE file.
  * CVE-2026-20338, bsc#1274598:
    Fixed ownership handling while merging ZIP catalogue records that could
    cause an invalid free while scanning a malformed archive.
  * CVE-2026-20346, bsc#1274601:
    Fixed an integer underflow in the PDF parser that could cause a crash while
    reading a malformed hex string.
  * CVE-2026-20347, bsc#1274602:
    Fixed undefined behavior and integer overflow in the Mach-O parser that
    could cause a crash while scanning a malformed Mach-O file.
  * CVE-2026-20348, bsc#1274603:
    Fixed XAR parser size handling that could request an excessive allocation
    or exceed scan limits while decompressing a malformed table of contents.
  * CVE-2025-8088:
    Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
    The fix rejects path separators in NTFS alternate data stream names to
    prevent extraction outside ClamAV's temporary scan directory on Windows.
  * Fixed thread-safety issues in the clamd STATS command that could disclose
    process memory or crash the daemon while scans and STATS requests run
    concurrently. Also fixed partial socket-write handling used for large STATS
    responses.
  * FreeBSD: Restored support for safe quarantine move and remove actions while
    preserving protection against source-path replacement races.
  * Fixed an OpenSSL library-context leak in legacy hashing helpers when a
    requested message digest cannot be fetched, such as when the default
    provider is unavailable in a FIPS-enabled environment.
  * Upgraded the Rust crossbeam-epoch dependency to resolve the
    RUSTSEC-2026-0204 advisory.</changelog>
</package>
<package pkgid="3809530b1dd1a72fd63424e804b916f45fac2635e7683b8ad01672fd693a0cb713fa5300cb3661cd2b68447295b12f73104de2ce92aa1cf677197db2a0f3d91b" name="clamav" arch="src">
  <version epoch="0" ver="1.5.4" rel="339.1"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1737633600">- Drop the version dependency on libcurl. Building against versions
  older than 7.45 does not fail anymore, but disables support for
  fdpassing in clamonacc. This only affects SLE-12 up to SP3.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1739188800">- bsc#1236949: Fix location of license files.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1742817600">- bsc#1239957: Build with PIE.
- Eliminate some UTF-8 NBSP characters from the changes file.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1748433600">- bsc#1243565: Add clamav-freshclam_test.patch to fix a race
  condition between the mockup servers started by different test
  cases in freshclam_test.py.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1750334400">- New version 1.4.3:
  ClamAV 1.4.3 is a patch release with the following fixes:
  * CVE-2025-20260, bsc#1245054: Fixed a possible buffer overflow
    write bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition or enable remote code
    execution. This issue only affects configurations where both:
  - The max file-size scan limit is set greater than or equal to 1024MB.
  - The max scan-size scan limit is set greater than or equal to 1025MB.
    The code flaw was present prior to version 1.0.0, but a change in
    version 1.0.0 that enables larger allocations based on untrusted data
    made it possible to trigger this bug.
    This issue affects all currently supported versions.
  * CVE-2025-20234, bsc#1245055: Fixed a possible buffer overflow
    read bug in the UDF file parser that may write to a temp file
    and thus disclose information, or it may crash and cause a
    denial-of-service (DoS) condition.
    This issue was introduced in version 1.2.0.
  * Fixed a possible use-after-free bug in the Xz decompression module in
    the bundled lzma-sdk library.
    This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a
    copy of the lzma-sdk with some performance changes specific to
    libclamav, plus select bug fixes like this one in lieu of a full
    upgrade to newer lzma-sdk.
    This issue affects all ClamAV versions at least as far back as 0.99.4.
  * Windows: Fixed a build install issue when a DLL dependency such as
    libcrypto has the exact same name as one provided by the Windows
    operating system.
- Renew clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1751284800">- bsc#1240363, clamav-disable-administrative-commands.patch: clamd:
  Add an option to toggle SHUTDOWN, RELOAD, STATS and VERSION.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1759924800">- New version 1.5.0:
  * Added checks to determine if an OLE2-based Microsoft Office
    document is encrypted.
  * Added the ability to record URIs found in HTML if the
    generate-JSON-metadata feature is enabled.
  * Added the ability to record URIs found in PDFs if the
    generate-JSON-metadata feature is enabled.
  * Added regex support for the clamd.conf OnAccessExcludePath
    config option.
  * Added CVD signing/verification with external .sign files.
  * Freshclam, ClamD, ClamScan, and Sigtool: Added an option to
    enable FIPS-like limits disabling MD5 and SHA1 from being used
    for verifying digital signatures or for being used to trust a
    file when checking for false positives (bsc#1221954).
  * ClamD: Added an option to disable select administrative
    commands including SHUTDOWN, RELOAD, STATS and VERSION.
  * libclamav: Added extended hashing functions with a "flags"
    parameter that allows the caller to choose if they want to
    bypass FIPS hash algorithm limits.
  * See the release announcement for the full list of changes:
    https://blog.clamav.net/2025/10/clamav-150-released.html
- Obsoleted patches:
  * clamav-freshclam_test.patch
  * clamav-disable-administrative-commands.patch
  * clamav-fips.patch
- Use macros for library versions
- Remove service symlinks: rcclamd, rcfreshclam, rcclamav-milter,
  and clamonacc.
- Use rust 1.86 for SLE-12 and SLE-15-SP2.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760443200">- Add json-c-json-c-0.18-20240915.tar.gz and link it statically
  into libclamav on SLE-12, because version 0.12 is too old.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760616000">- New version: 1.5.1:
  * Fixed a significant performance issue when scanning some PE
    files.
  * Fixed an issue recording file entries from a ZIP archive
    central directory which resulted in
    "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
    ClamScan --alert-exceeds-max command line option or ClamD
    AlertExceedsMax config file option.
  * Improved performance when scanning TNEF email attachments.
  * Fixed an issue with recording metadata for OOXML office
    documents.
  * Fixed an issue with signature matches for VBA in OLE2 office
    documents.
  * Loosened overly restrictive rules for embedded file
    identification and increased the limit for finding PE files
    embedded in other PE files.
  * Fixed an issue with extracting some RAR archives embedded in
    other files.
  * Fixed an issue with calculating fuzzy hashes affecting some
    images by updating the version for several Rust library
    dependencies.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1762257600">- Add clamav-workaround.patch to work around symbol removals in
  version 1.5.0 and 1.5.1.</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1763208000">- Build with older rust 1.87 for reproducible builds (boo#1249404)</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1763726400">- Provide a better fix for boo#1249404 by disabling debug mode.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1764331200">- Fix testsuite error on SLE-15-SP6 by falling back to rust1.86.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770724800">- jsc-PED-14819: Support transactional updates.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770984000">- bsc#1258072: Require main and library packages to be of the same
  version and release. Given that all the core functionality is
  in the libraries it makes little sense to update the main
  package alone.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1772712000">- New version 1.5.2:
  * bsc#1259207, CVE-2026-20031: Fixed an error handling bug in the
    HTML file parser that may crash the program and cause a
    denial-of-service (DoS) condition. This issue was introduced in
    version 1.1.0.
  * Fixed a possible infinite loop when scanning some JPEG files by
    upgrading affected ClamAV dependency, a Rust image library.
  * The CVD verification process will now ignore certificate files
    in the CVD certs directory when the user lacks read permissions.
  * Freshclam: Fix CLD verification bug with PrivateMirror option.
  * Upgraded the Rust bytes dependency to a newer version to
    resolve RUSTSEC-2026-0007 advisory.
  * Fixed a possible crash caused by invalid pointer alignment on
    some platforms.
  * Minimal required Rust version is now 1.87.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1773316800">- Disable build for 32 bit ix86 because of testsuite failures with
  rust &gt;= 1.87 that upstream is not planning to fix.
- Run the test suite on all SUSE releases.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1782907200">- update to 1.5.3
  ClamAV 1.5.3 is a patch release with the following fixes:
  * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
  * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
  * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
  * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
  * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
  * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
  * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
  * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
  * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
  * Metadata preclass scans now run before the final scan verdict.
  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1784894400">- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to
  fix path traversal vulnerability in OneNote parser.
- Add clamav-vendor-cve-2026-46671.tar.gz to provide the
  sanitise-file-name Rust crate required by the security fix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1786881600">- update to 1.5.4
  ClamAV 1.5.4 is a patch release with the following fixes:
  * CVE-2026-20337, bsc#1274597:
    Fixed ZIP catalogue capacity tracking that could write beyond a heap
    allocation while indexing local file headers.
  * CVE-2026-20345, bsc#1274600:
    Fixed an indexing error while converting GPT partition names that could
    read or write beyond a stack-allocated partition entry.
  * CVE-2026-20339, bsc#1274599:
    Fixed an integer overflow in the PESpin unpacker that could allocate an
    undersized buffer and then write beyond it while rebuilding a PE file.
  * CVE-2026-20338, bsc#1274598:
    Fixed ownership handling while merging ZIP catalogue records that could
    cause an invalid free while scanning a malformed archive.
  * CVE-2026-20346, bsc#1274601:
    Fixed an integer underflow in the PDF parser that could cause a crash while
    reading a malformed hex string.
  * CVE-2026-20347, bsc#1274602:
    Fixed undefined behavior and integer overflow in the Mach-O parser that
    could cause a crash while scanning a malformed Mach-O file.
  * CVE-2026-20348, bsc#1274603:
    Fixed XAR parser size handling that could request an excessive allocation
    or exceed scan limits while decompressing a malformed table of contents.
  * CVE-2025-8088:
    Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
    The fix rejects path separators in NTFS alternate data stream names to
    prevent extraction outside ClamAV's temporary scan directory on Windows.
  * Fixed thread-safety issues in the clamd STATS command that could disclose
    process memory or crash the daemon while scans and STATS requests run
    concurrently. Also fixed partial socket-write handling used for large STATS
    responses.
  * FreeBSD: Restored support for safe quarantine move and remove actions while
    preserving protection against source-path replacement races.
  * Fixed an OpenSSL library-context leak in legacy hashing helpers when a
    requested message digest cannot be fetched, such as when the default
    provider is unavailable in a FIPS-enabled environment.
  * Upgraded the Rust crossbeam-epoch dependency to resolve the
    RUSTSEC-2026-0204 advisory.</changelog>
</package>
<package pkgid="d23ee583965649dc828d0767af6391a14d209c3097a86f708eafae62cf83d82b953622c2347080c41569dda9a90366f92dd2fccd8049e1a3c998582c3e0b783d" name="clamav-debuginfo" arch="s390x">
  <version epoch="0" ver="1.5.4" rel="339.1"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1737633600">- Drop the version dependency on libcurl. Building against versions
  older than 7.45 does not fail anymore, but disables support for
  fdpassing in clamonacc. This only affects SLE-12 up to SP3.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1739188800">- bsc#1236949: Fix location of license files.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1742817600">- bsc#1239957: Build with PIE.
- Eliminate some UTF-8 NBSP characters from the changes file.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1748433600">- bsc#1243565: Add clamav-freshclam_test.patch to fix a race
  condition between the mockup servers started by different test
  cases in freshclam_test.py.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1750334400">- New version 1.4.3:
  ClamAV 1.4.3 is a patch release with the following fixes:
  * CVE-2025-20260, bsc#1245054: Fixed a possible buffer overflow
    write bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition or enable remote code
    execution. This issue only affects configurations where both:
  - The max file-size scan limit is set greater than or equal to 1024MB.
  - The max scan-size scan limit is set greater than or equal to 1025MB.
    The code flaw was present prior to version 1.0.0, but a change in
    version 1.0.0 that enables larger allocations based on untrusted data
    made it possible to trigger this bug.
    This issue affects all currently supported versions.
  * CVE-2025-20234, bsc#1245055: Fixed a possible buffer overflow
    read bug in the UDF file parser that may write to a temp file
    and thus disclose information, or it may crash and cause a
    denial-of-service (DoS) condition.
    This issue was introduced in version 1.2.0.
  * Fixed a possible use-after-free bug in the Xz decompression module in
    the bundled lzma-sdk library.
    This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a
    copy of the lzma-sdk with some performance changes specific to
    libclamav, plus select bug fixes like this one in lieu of a full
    upgrade to newer lzma-sdk.
    This issue affects all ClamAV versions at least as far back as 0.99.4.
  * Windows: Fixed a build install issue when a DLL dependency such as
    libcrypto has the exact same name as one provided by the Windows
    operating system.
- Renew clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1751284800">- bsc#1240363, clamav-disable-administrative-commands.patch: clamd:
  Add an option to toggle SHUTDOWN, RELOAD, STATS and VERSION.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1759924800">- New version 1.5.0:
  * Added checks to determine if an OLE2-based Microsoft Office
    document is encrypted.
  * Added the ability to record URIs found in HTML if the
    generate-JSON-metadata feature is enabled.
  * Added the ability to record URIs found in PDFs if the
    generate-JSON-metadata feature is enabled.
  * Added regex support for the clamd.conf OnAccessExcludePath
    config option.
  * Added CVD signing/verification with external .sign files.
  * Freshclam, ClamD, ClamScan, and Sigtool: Added an option to
    enable FIPS-like limits disabling MD5 and SHA1 from being used
    for verifying digital signatures or for being used to trust a
    file when checking for false positives (bsc#1221954).
  * ClamD: Added an option to disable select administrative
    commands including SHUTDOWN, RELOAD, STATS and VERSION.
  * libclamav: Added extended hashing functions with a "flags"
    parameter that allows the caller to choose if they want to
    bypass FIPS hash algorithm limits.
  * See the release announcement for the full list of changes:
    https://blog.clamav.net/2025/10/clamav-150-released.html
- Obsoleted patches:
  * clamav-freshclam_test.patch
  * clamav-disable-administrative-commands.patch
  * clamav-fips.patch
- Use macros for library versions
- Remove service symlinks: rcclamd, rcfreshclam, rcclamav-milter,
  and clamonacc.
- Use rust 1.86 for SLE-12 and SLE-15-SP2.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760443200">- Add json-c-json-c-0.18-20240915.tar.gz and link it statically
  into libclamav on SLE-12, because version 0.12 is too old.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760616000">- New version: 1.5.1:
  * Fixed a significant performance issue when scanning some PE
    files.
  * Fixed an issue recording file entries from a ZIP archive
    central directory which resulted in
    "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
    ClamScan --alert-exceeds-max command line option or ClamD
    AlertExceedsMax config file option.
  * Improved performance when scanning TNEF email attachments.
  * Fixed an issue with recording metadata for OOXML office
    documents.
  * Fixed an issue with signature matches for VBA in OLE2 office
    documents.
  * Loosened overly restrictive rules for embedded file
    identification and increased the limit for finding PE files
    embedded in other PE files.
  * Fixed an issue with extracting some RAR archives embedded in
    other files.
  * Fixed an issue with calculating fuzzy hashes affecting some
    images by updating the version for several Rust library
    dependencies.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1762257600">- Add clamav-workaround.patch to work around symbol removals in
  version 1.5.0 and 1.5.1.</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1763208000">- Build with older rust 1.87 for reproducible builds (boo#1249404)</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1763726400">- Provide a better fix for boo#1249404 by disabling debug mode.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1764331200">- Fix testsuite error on SLE-15-SP6 by falling back to rust1.86.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770724800">- jsc-PED-14819: Support transactional updates.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770984000">- bsc#1258072: Require main and library packages to be of the same
  version and release. Given that all the core functionality is
  in the libraries it makes little sense to update the main
  package alone.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1772712000">- New version 1.5.2:
  * bsc#1259207, CVE-2026-20031: Fixed an error handling bug in the
    HTML file parser that may crash the program and cause a
    denial-of-service (DoS) condition. This issue was introduced in
    version 1.1.0.
  * Fixed a possible infinite loop when scanning some JPEG files by
    upgrading affected ClamAV dependency, a Rust image library.
  * The CVD verification process will now ignore certificate files
    in the CVD certs directory when the user lacks read permissions.
  * Freshclam: Fix CLD verification bug with PrivateMirror option.
  * Upgraded the Rust bytes dependency to a newer version to
    resolve RUSTSEC-2026-0007 advisory.
  * Fixed a possible crash caused by invalid pointer alignment on
    some platforms.
  * Minimal required Rust version is now 1.87.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1773316800">- Disable build for 32 bit ix86 because of testsuite failures with
  rust &gt;= 1.87 that upstream is not planning to fix.
- Run the test suite on all SUSE releases.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1782907200">- update to 1.5.3
  ClamAV 1.5.3 is a patch release with the following fixes:
  * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
  * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
  * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
  * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
  * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
  * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
  * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
  * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
  * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
  * Metadata preclass scans now run before the final scan verdict.
  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1784894400">- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to
  fix path traversal vulnerability in OneNote parser.
- Add clamav-vendor-cve-2026-46671.tar.gz to provide the
  sanitise-file-name Rust crate required by the security fix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1786881600">- update to 1.5.4
  ClamAV 1.5.4 is a patch release with the following fixes:
  * CVE-2026-20337, bsc#1274597:
    Fixed ZIP catalogue capacity tracking that could write beyond a heap
    allocation while indexing local file headers.
  * CVE-2026-20345, bsc#1274600:
    Fixed an indexing error while converting GPT partition names that could
    read or write beyond a stack-allocated partition entry.
  * CVE-2026-20339, bsc#1274599:
    Fixed an integer overflow in the PESpin unpacker that could allocate an
    undersized buffer and then write beyond it while rebuilding a PE file.
  * CVE-2026-20338, bsc#1274598:
    Fixed ownership handling while merging ZIP catalogue records that could
    cause an invalid free while scanning a malformed archive.
  * CVE-2026-20346, bsc#1274601:
    Fixed an integer underflow in the PDF parser that could cause a crash while
    reading a malformed hex string.
  * CVE-2026-20347, bsc#1274602:
    Fixed undefined behavior and integer overflow in the Mach-O parser that
    could cause a crash while scanning a malformed Mach-O file.
  * CVE-2026-20348, bsc#1274603:
    Fixed XAR parser size handling that could request an excessive allocation
    or exceed scan limits while decompressing a malformed table of contents.
  * CVE-2025-8088:
    Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
    The fix rejects path separators in NTFS alternate data stream names to
    prevent extraction outside ClamAV's temporary scan directory on Windows.
  * Fixed thread-safety issues in the clamd STATS command that could disclose
    process memory or crash the daemon while scans and STATS requests run
    concurrently. Also fixed partial socket-write handling used for large STATS
    responses.
  * FreeBSD: Restored support for safe quarantine move and remove actions while
    preserving protection against source-path replacement races.
  * Fixed an OpenSSL library-context leak in legacy hashing helpers when a
    requested message digest cannot be fetched, such as when the default
    provider is unavailable in a FIPS-enabled environment.
  * Upgraded the Rust crossbeam-epoch dependency to resolve the
    RUSTSEC-2026-0204 advisory.</changelog>
</package>
<package pkgid="538defd423dcb2f0f462171f12028490c010be98ffcbdbc206bf4b647b53fd197b91e83124cf6fd7431cc54aa4e4ce40dc01a7d1e2ade6b75d2f6f4d2516eb19" name="clamav-debugsource" arch="s390x">
  <version epoch="0" ver="1.5.4" rel="339.1"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1737633600">- Drop the version dependency on libcurl. Building against versions
  older than 7.45 does not fail anymore, but disables support for
  fdpassing in clamonacc. This only affects SLE-12 up to SP3.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1739188800">- bsc#1236949: Fix location of license files.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1742817600">- bsc#1239957: Build with PIE.
- Eliminate some UTF-8 NBSP characters from the changes file.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1748433600">- bsc#1243565: Add clamav-freshclam_test.patch to fix a race
  condition between the mockup servers started by different test
  cases in freshclam_test.py.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1750334400">- New version 1.4.3:
  ClamAV 1.4.3 is a patch release with the following fixes:
  * CVE-2025-20260, bsc#1245054: Fixed a possible buffer overflow
    write bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition or enable remote code
    execution. This issue only affects configurations where both:
  - The max file-size scan limit is set greater than or equal to 1024MB.
  - The max scan-size scan limit is set greater than or equal to 1025MB.
    The code flaw was present prior to version 1.0.0, but a change in
    version 1.0.0 that enables larger allocations based on untrusted data
    made it possible to trigger this bug.
    This issue affects all currently supported versions.
  * CVE-2025-20234, bsc#1245055: Fixed a possible buffer overflow
    read bug in the UDF file parser that may write to a temp file
    and thus disclose information, or it may crash and cause a
    denial-of-service (DoS) condition.
    This issue was introduced in version 1.2.0.
  * Fixed a possible use-after-free bug in the Xz decompression module in
    the bundled lzma-sdk library.
    This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a
    copy of the lzma-sdk with some performance changes specific to
    libclamav, plus select bug fixes like this one in lieu of a full
    upgrade to newer lzma-sdk.
    This issue affects all ClamAV versions at least as far back as 0.99.4.
  * Windows: Fixed a build install issue when a DLL dependency such as
    libcrypto has the exact same name as one provided by the Windows
    operating system.
- Renew clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1751284800">- bsc#1240363, clamav-disable-administrative-commands.patch: clamd:
  Add an option to toggle SHUTDOWN, RELOAD, STATS and VERSION.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1759924800">- New version 1.5.0:
  * Added checks to determine if an OLE2-based Microsoft Office
    document is encrypted.
  * Added the ability to record URIs found in HTML if the
    generate-JSON-metadata feature is enabled.
  * Added the ability to record URIs found in PDFs if the
    generate-JSON-metadata feature is enabled.
  * Added regex support for the clamd.conf OnAccessExcludePath
    config option.
  * Added CVD signing/verification with external .sign files.
  * Freshclam, ClamD, ClamScan, and Sigtool: Added an option to
    enable FIPS-like limits disabling MD5 and SHA1 from being used
    for verifying digital signatures or for being used to trust a
    file when checking for false positives (bsc#1221954).
  * ClamD: Added an option to disable select administrative
    commands including SHUTDOWN, RELOAD, STATS and VERSION.
  * libclamav: Added extended hashing functions with a "flags"
    parameter that allows the caller to choose if they want to
    bypass FIPS hash algorithm limits.
  * See the release announcement for the full list of changes:
    https://blog.clamav.net/2025/10/clamav-150-released.html
- Obsoleted patches:
  * clamav-freshclam_test.patch
  * clamav-disable-administrative-commands.patch
  * clamav-fips.patch
- Use macros for library versions
- Remove service symlinks: rcclamd, rcfreshclam, rcclamav-milter,
  and clamonacc.
- Use rust 1.86 for SLE-12 and SLE-15-SP2.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760443200">- Add json-c-json-c-0.18-20240915.tar.gz and link it statically
  into libclamav on SLE-12, because version 0.12 is too old.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760616000">- New version: 1.5.1:
  * Fixed a significant performance issue when scanning some PE
    files.
  * Fixed an issue recording file entries from a ZIP archive
    central directory which resulted in
    "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
    ClamScan --alert-exceeds-max command line option or ClamD
    AlertExceedsMax config file option.
  * Improved performance when scanning TNEF email attachments.
  * Fixed an issue with recording metadata for OOXML office
    documents.
  * Fixed an issue with signature matches for VBA in OLE2 office
    documents.
  * Loosened overly restrictive rules for embedded file
    identification and increased the limit for finding PE files
    embedded in other PE files.
  * Fixed an issue with extracting some RAR archives embedded in
    other files.
  * Fixed an issue with calculating fuzzy hashes affecting some
    images by updating the version for several Rust library
    dependencies.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1762257600">- Add clamav-workaround.patch to work around symbol removals in
  version 1.5.0 and 1.5.1.</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1763208000">- Build with older rust 1.87 for reproducible builds (boo#1249404)</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1763726400">- Provide a better fix for boo#1249404 by disabling debug mode.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1764331200">- Fix testsuite error on SLE-15-SP6 by falling back to rust1.86.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770724800">- jsc-PED-14819: Support transactional updates.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770984000">- bsc#1258072: Require main and library packages to be of the same
  version and release. Given that all the core functionality is
  in the libraries it makes little sense to update the main
  package alone.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1772712000">- New version 1.5.2:
  * bsc#1259207, CVE-2026-20031: Fixed an error handling bug in the
    HTML file parser that may crash the program and cause a
    denial-of-service (DoS) condition. This issue was introduced in
    version 1.1.0.
  * Fixed a possible infinite loop when scanning some JPEG files by
    upgrading affected ClamAV dependency, a Rust image library.
  * The CVD verification process will now ignore certificate files
    in the CVD certs directory when the user lacks read permissions.
  * Freshclam: Fix CLD verification bug with PrivateMirror option.
  * Upgraded the Rust bytes dependency to a newer version to
    resolve RUSTSEC-2026-0007 advisory.
  * Fixed a possible crash caused by invalid pointer alignment on
    some platforms.
  * Minimal required Rust version is now 1.87.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1773316800">- Disable build for 32 bit ix86 because of testsuite failures with
  rust &gt;= 1.87 that upstream is not planning to fix.
- Run the test suite on all SUSE releases.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1782907200">- update to 1.5.3
  ClamAV 1.5.3 is a patch release with the following fixes:
  * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
  * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
  * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
  * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
  * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
  * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
  * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
  * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
  * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
  * Metadata preclass scans now run before the final scan verdict.
  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1784894400">- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to
  fix path traversal vulnerability in OneNote parser.
- Add clamav-vendor-cve-2026-46671.tar.gz to provide the
  sanitise-file-name Rust crate required by the security fix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1786881600">- update to 1.5.4
  ClamAV 1.5.4 is a patch release with the following fixes:
  * CVE-2026-20337, bsc#1274597:
    Fixed ZIP catalogue capacity tracking that could write beyond a heap
    allocation while indexing local file headers.
  * CVE-2026-20345, bsc#1274600:
    Fixed an indexing error while converting GPT partition names that could
    read or write beyond a stack-allocated partition entry.
  * CVE-2026-20339, bsc#1274599:
    Fixed an integer overflow in the PESpin unpacker that could allocate an
    undersized buffer and then write beyond it while rebuilding a PE file.
  * CVE-2026-20338, bsc#1274598:
    Fixed ownership handling while merging ZIP catalogue records that could
    cause an invalid free while scanning a malformed archive.
  * CVE-2026-20346, bsc#1274601:
    Fixed an integer underflow in the PDF parser that could cause a crash while
    reading a malformed hex string.
  * CVE-2026-20347, bsc#1274602:
    Fixed undefined behavior and integer overflow in the Mach-O parser that
    could cause a crash while scanning a malformed Mach-O file.
  * CVE-2026-20348, bsc#1274603:
    Fixed XAR parser size handling that could request an excessive allocation
    or exceed scan limits while decompressing a malformed table of contents.
  * CVE-2025-8088:
    Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
    The fix rejects path separators in NTFS alternate data stream names to
    prevent extraction outside ClamAV's temporary scan directory on Windows.
  * Fixed thread-safety issues in the clamd STATS command that could disclose
    process memory or crash the daemon while scans and STATS requests run
    concurrently. Also fixed partial socket-write handling used for large STATS
    responses.
  * FreeBSD: Restored support for safe quarantine move and remove actions while
    preserving protection against source-path replacement races.
  * Fixed an OpenSSL library-context leak in legacy hashing helpers when a
    requested message digest cannot be fetched, such as when the default
    provider is unavailable in a FIPS-enabled environment.
  * Upgraded the Rust crossbeam-epoch dependency to resolve the
    RUSTSEC-2026-0204 advisory.</changelog>
</package>
<package pkgid="10574789b36c8b28746759b82fd53a9d54cd417872e62fa9c4b49d44a3569d4948c56929dfe70b25d2c40ace9388c6dc25c0325a05c0041d263533aef63afa9c" name="clamav-devel" arch="s390x">
  <version epoch="0" ver="1.5.4" rel="339.1"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1737633600">- Drop the version dependency on libcurl. Building against versions
  older than 7.45 does not fail anymore, but disables support for
  fdpassing in clamonacc. This only affects SLE-12 up to SP3.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1739188800">- bsc#1236949: Fix location of license files.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1742817600">- bsc#1239957: Build with PIE.
- Eliminate some UTF-8 NBSP characters from the changes file.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1748433600">- bsc#1243565: Add clamav-freshclam_test.patch to fix a race
  condition between the mockup servers started by different test
  cases in freshclam_test.py.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1750334400">- New version 1.4.3:
  ClamAV 1.4.3 is a patch release with the following fixes:
  * CVE-2025-20260, bsc#1245054: Fixed a possible buffer overflow
    write bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition or enable remote code
    execution. This issue only affects configurations where both:
  - The max file-size scan limit is set greater than or equal to 1024MB.
  - The max scan-size scan limit is set greater than or equal to 1025MB.
    The code flaw was present prior to version 1.0.0, but a change in
    version 1.0.0 that enables larger allocations based on untrusted data
    made it possible to trigger this bug.
    This issue affects all currently supported versions.
  * CVE-2025-20234, bsc#1245055: Fixed a possible buffer overflow
    read bug in the UDF file parser that may write to a temp file
    and thus disclose information, or it may crash and cause a
    denial-of-service (DoS) condition.
    This issue was introduced in version 1.2.0.
  * Fixed a possible use-after-free bug in the Xz decompression module in
    the bundled lzma-sdk library.
    This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a
    copy of the lzma-sdk with some performance changes specific to
    libclamav, plus select bug fixes like this one in lieu of a full
    upgrade to newer lzma-sdk.
    This issue affects all ClamAV versions at least as far back as 0.99.4.
  * Windows: Fixed a build install issue when a DLL dependency such as
    libcrypto has the exact same name as one provided by the Windows
    operating system.
- Renew clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1751284800">- bsc#1240363, clamav-disable-administrative-commands.patch: clamd:
  Add an option to toggle SHUTDOWN, RELOAD, STATS and VERSION.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1759924800">- New version 1.5.0:
  * Added checks to determine if an OLE2-based Microsoft Office
    document is encrypted.
  * Added the ability to record URIs found in HTML if the
    generate-JSON-metadata feature is enabled.
  * Added the ability to record URIs found in PDFs if the
    generate-JSON-metadata feature is enabled.
  * Added regex support for the clamd.conf OnAccessExcludePath
    config option.
  * Added CVD signing/verification with external .sign files.
  * Freshclam, ClamD, ClamScan, and Sigtool: Added an option to
    enable FIPS-like limits disabling MD5 and SHA1 from being used
    for verifying digital signatures or for being used to trust a
    file when checking for false positives (bsc#1221954).
  * ClamD: Added an option to disable select administrative
    commands including SHUTDOWN, RELOAD, STATS and VERSION.
  * libclamav: Added extended hashing functions with a "flags"
    parameter that allows the caller to choose if they want to
    bypass FIPS hash algorithm limits.
  * See the release announcement for the full list of changes:
    https://blog.clamav.net/2025/10/clamav-150-released.html
- Obsoleted patches:
  * clamav-freshclam_test.patch
  * clamav-disable-administrative-commands.patch
  * clamav-fips.patch
- Use macros for library versions
- Remove service symlinks: rcclamd, rcfreshclam, rcclamav-milter,
  and clamonacc.
- Use rust 1.86 for SLE-12 and SLE-15-SP2.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760443200">- Add json-c-json-c-0.18-20240915.tar.gz and link it statically
  into libclamav on SLE-12, because version 0.12 is too old.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760616000">- New version: 1.5.1:
  * Fixed a significant performance issue when scanning some PE
    files.
  * Fixed an issue recording file entries from a ZIP archive
    central directory which resulted in
    "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
    ClamScan --alert-exceeds-max command line option or ClamD
    AlertExceedsMax config file option.
  * Improved performance when scanning TNEF email attachments.
  * Fixed an issue with recording metadata for OOXML office
    documents.
  * Fixed an issue with signature matches for VBA in OLE2 office
    documents.
  * Loosened overly restrictive rules for embedded file
    identification and increased the limit for finding PE files
    embedded in other PE files.
  * Fixed an issue with extracting some RAR archives embedded in
    other files.
  * Fixed an issue with calculating fuzzy hashes affecting some
    images by updating the version for several Rust library
    dependencies.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1762257600">- Add clamav-workaround.patch to work around symbol removals in
  version 1.5.0 and 1.5.1.</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1763208000">- Build with older rust 1.87 for reproducible builds (boo#1249404)</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1763726400">- Provide a better fix for boo#1249404 by disabling debug mode.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1764331200">- Fix testsuite error on SLE-15-SP6 by falling back to rust1.86.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770724800">- jsc-PED-14819: Support transactional updates.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770984000">- bsc#1258072: Require main and library packages to be of the same
  version and release. Given that all the core functionality is
  in the libraries it makes little sense to update the main
  package alone.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1772712000">- New version 1.5.2:
  * bsc#1259207, CVE-2026-20031: Fixed an error handling bug in the
    HTML file parser that may crash the program and cause a
    denial-of-service (DoS) condition. This issue was introduced in
    version 1.1.0.
  * Fixed a possible infinite loop when scanning some JPEG files by
    upgrading affected ClamAV dependency, a Rust image library.
  * The CVD verification process will now ignore certificate files
    in the CVD certs directory when the user lacks read permissions.
  * Freshclam: Fix CLD verification bug with PrivateMirror option.
  * Upgraded the Rust bytes dependency to a newer version to
    resolve RUSTSEC-2026-0007 advisory.
  * Fixed a possible crash caused by invalid pointer alignment on
    some platforms.
  * Minimal required Rust version is now 1.87.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1773316800">- Disable build for 32 bit ix86 because of testsuite failures with
  rust &gt;= 1.87 that upstream is not planning to fix.
- Run the test suite on all SUSE releases.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1782907200">- update to 1.5.3
  ClamAV 1.5.3 is a patch release with the following fixes:
  * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
  * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
  * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
  * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
  * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
  * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
  * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
  * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
  * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
  * Metadata preclass scans now run before the final scan verdict.
  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1784894400">- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to
  fix path traversal vulnerability in OneNote parser.
- Add clamav-vendor-cve-2026-46671.tar.gz to provide the
  sanitise-file-name Rust crate required by the security fix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1786881600">- update to 1.5.4
  ClamAV 1.5.4 is a patch release with the following fixes:
  * CVE-2026-20337, bsc#1274597:
    Fixed ZIP catalogue capacity tracking that could write beyond a heap
    allocation while indexing local file headers.
  * CVE-2026-20345, bsc#1274600:
    Fixed an indexing error while converting GPT partition names that could
    read or write beyond a stack-allocated partition entry.
  * CVE-2026-20339, bsc#1274599:
    Fixed an integer overflow in the PESpin unpacker that could allocate an
    undersized buffer and then write beyond it while rebuilding a PE file.
  * CVE-2026-20338, bsc#1274598:
    Fixed ownership handling while merging ZIP catalogue records that could
    cause an invalid free while scanning a malformed archive.
  * CVE-2026-20346, bsc#1274601:
    Fixed an integer underflow in the PDF parser that could cause a crash while
    reading a malformed hex string.
  * CVE-2026-20347, bsc#1274602:
    Fixed undefined behavior and integer overflow in the Mach-O parser that
    could cause a crash while scanning a malformed Mach-O file.
  * CVE-2026-20348, bsc#1274603:
    Fixed XAR parser size handling that could request an excessive allocation
    or exceed scan limits while decompressing a malformed table of contents.
  * CVE-2025-8088:
    Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
    The fix rejects path separators in NTFS alternate data stream names to
    prevent extraction outside ClamAV's temporary scan directory on Windows.
  * Fixed thread-safety issues in the clamd STATS command that could disclose
    process memory or crash the daemon while scans and STATS requests run
    concurrently. Also fixed partial socket-write handling used for large STATS
    responses.
  * FreeBSD: Restored support for safe quarantine move and remove actions while
    preserving protection against source-path replacement races.
  * Fixed an OpenSSL library-context leak in legacy hashing helpers when a
    requested message digest cannot be fetched, such as when the default
    provider is unavailable in a FIPS-enabled environment.
  * Upgraded the Rust crossbeam-epoch dependency to resolve the
    RUSTSEC-2026-0204 advisory.</changelog>
</package>
<package pkgid="84b5d2eb8ced87d9757d4d6b133007d1f3082dabdb496ee51f74314bce5fe086a8041a759938a51cb9c04857d7dddbe33fe7265ec65a891cfe68c24871904586" name="clamav-docs-html" arch="noarch">
  <version epoch="0" ver="1.5.4" rel="339.1"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1737633600">- Drop the version dependency on libcurl. Building against versions
  older than 7.45 does not fail anymore, but disables support for
  fdpassing in clamonacc. This only affects SLE-12 up to SP3.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1739188800">- bsc#1236949: Fix location of license files.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1742817600">- bsc#1239957: Build with PIE.
- Eliminate some UTF-8 NBSP characters from the changes file.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1748433600">- bsc#1243565: Add clamav-freshclam_test.patch to fix a race
  condition between the mockup servers started by different test
  cases in freshclam_test.py.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1750334400">- New version 1.4.3:
  ClamAV 1.4.3 is a patch release with the following fixes:
  * CVE-2025-20260, bsc#1245054: Fixed a possible buffer overflow
    write bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition or enable remote code
    execution. This issue only affects configurations where both:
  - The max file-size scan limit is set greater than or equal to 1024MB.
  - The max scan-size scan limit is set greater than or equal to 1025MB.
    The code flaw was present prior to version 1.0.0, but a change in
    version 1.0.0 that enables larger allocations based on untrusted data
    made it possible to trigger this bug.
    This issue affects all currently supported versions.
  * CVE-2025-20234, bsc#1245055: Fixed a possible buffer overflow
    read bug in the UDF file parser that may write to a temp file
    and thus disclose information, or it may crash and cause a
    denial-of-service (DoS) condition.
    This issue was introduced in version 1.2.0.
  * Fixed a possible use-after-free bug in the Xz decompression module in
    the bundled lzma-sdk library.
    This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a
    copy of the lzma-sdk with some performance changes specific to
    libclamav, plus select bug fixes like this one in lieu of a full
    upgrade to newer lzma-sdk.
    This issue affects all ClamAV versions at least as far back as 0.99.4.
  * Windows: Fixed a build install issue when a DLL dependency such as
    libcrypto has the exact same name as one provided by the Windows
    operating system.
- Renew clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1751284800">- bsc#1240363, clamav-disable-administrative-commands.patch: clamd:
  Add an option to toggle SHUTDOWN, RELOAD, STATS and VERSION.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1759924800">- New version 1.5.0:
  * Added checks to determine if an OLE2-based Microsoft Office
    document is encrypted.
  * Added the ability to record URIs found in HTML if the
    generate-JSON-metadata feature is enabled.
  * Added the ability to record URIs found in PDFs if the
    generate-JSON-metadata feature is enabled.
  * Added regex support for the clamd.conf OnAccessExcludePath
    config option.
  * Added CVD signing/verification with external .sign files.
  * Freshclam, ClamD, ClamScan, and Sigtool: Added an option to
    enable FIPS-like limits disabling MD5 and SHA1 from being used
    for verifying digital signatures or for being used to trust a
    file when checking for false positives (bsc#1221954).
  * ClamD: Added an option to disable select administrative
    commands including SHUTDOWN, RELOAD, STATS and VERSION.
  * libclamav: Added extended hashing functions with a "flags"
    parameter that allows the caller to choose if they want to
    bypass FIPS hash algorithm limits.
  * See the release announcement for the full list of changes:
    https://blog.clamav.net/2025/10/clamav-150-released.html
- Obsoleted patches:
  * clamav-freshclam_test.patch
  * clamav-disable-administrative-commands.patch
  * clamav-fips.patch
- Use macros for library versions
- Remove service symlinks: rcclamd, rcfreshclam, rcclamav-milter,
  and clamonacc.
- Use rust 1.86 for SLE-12 and SLE-15-SP2.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760443200">- Add json-c-json-c-0.18-20240915.tar.gz and link it statically
  into libclamav on SLE-12, because version 0.12 is too old.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760616000">- New version: 1.5.1:
  * Fixed a significant performance issue when scanning some PE
    files.
  * Fixed an issue recording file entries from a ZIP archive
    central directory which resulted in
    "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
    ClamScan --alert-exceeds-max command line option or ClamD
    AlertExceedsMax config file option.
  * Improved performance when scanning TNEF email attachments.
  * Fixed an issue with recording metadata for OOXML office
    documents.
  * Fixed an issue with signature matches for VBA in OLE2 office
    documents.
  * Loosened overly restrictive rules for embedded file
    identification and increased the limit for finding PE files
    embedded in other PE files.
  * Fixed an issue with extracting some RAR archives embedded in
    other files.
  * Fixed an issue with calculating fuzzy hashes affecting some
    images by updating the version for several Rust library
    dependencies.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1762257600">- Add clamav-workaround.patch to work around symbol removals in
  version 1.5.0 and 1.5.1.</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1763208000">- Build with older rust 1.87 for reproducible builds (boo#1249404)</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1763726400">- Provide a better fix for boo#1249404 by disabling debug mode.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1764331200">- Fix testsuite error on SLE-15-SP6 by falling back to rust1.86.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770724800">- jsc-PED-14819: Support transactional updates.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770984000">- bsc#1258072: Require main and library packages to be of the same
  version and release. Given that all the core functionality is
  in the libraries it makes little sense to update the main
  package alone.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1772712000">- New version 1.5.2:
  * bsc#1259207, CVE-2026-20031: Fixed an error handling bug in the
    HTML file parser that may crash the program and cause a
    denial-of-service (DoS) condition. This issue was introduced in
    version 1.1.0.
  * Fixed a possible infinite loop when scanning some JPEG files by
    upgrading affected ClamAV dependency, a Rust image library.
  * The CVD verification process will now ignore certificate files
    in the CVD certs directory when the user lacks read permissions.
  * Freshclam: Fix CLD verification bug with PrivateMirror option.
  * Upgraded the Rust bytes dependency to a newer version to
    resolve RUSTSEC-2026-0007 advisory.
  * Fixed a possible crash caused by invalid pointer alignment on
    some platforms.
  * Minimal required Rust version is now 1.87.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1773316800">- Disable build for 32 bit ix86 because of testsuite failures with
  rust &gt;= 1.87 that upstream is not planning to fix.
- Run the test suite on all SUSE releases.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1782907200">- update to 1.5.3
  ClamAV 1.5.3 is a patch release with the following fixes:
  * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
  * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
  * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
  * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
  * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
  * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
  * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
  * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
  * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
  * Metadata preclass scans now run before the final scan verdict.
  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1784894400">- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to
  fix path traversal vulnerability in OneNote parser.
- Add clamav-vendor-cve-2026-46671.tar.gz to provide the
  sanitise-file-name Rust crate required by the security fix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1786881600">- update to 1.5.4
  ClamAV 1.5.4 is a patch release with the following fixes:
  * CVE-2026-20337, bsc#1274597:
    Fixed ZIP catalogue capacity tracking that could write beyond a heap
    allocation while indexing local file headers.
  * CVE-2026-20345, bsc#1274600:
    Fixed an indexing error while converting GPT partition names that could
    read or write beyond a stack-allocated partition entry.
  * CVE-2026-20339, bsc#1274599:
    Fixed an integer overflow in the PESpin unpacker that could allocate an
    undersized buffer and then write beyond it while rebuilding a PE file.
  * CVE-2026-20338, bsc#1274598:
    Fixed ownership handling while merging ZIP catalogue records that could
    cause an invalid free while scanning a malformed archive.
  * CVE-2026-20346, bsc#1274601:
    Fixed an integer underflow in the PDF parser that could cause a crash while
    reading a malformed hex string.
  * CVE-2026-20347, bsc#1274602:
    Fixed undefined behavior and integer overflow in the Mach-O parser that
    could cause a crash while scanning a malformed Mach-O file.
  * CVE-2026-20348, bsc#1274603:
    Fixed XAR parser size handling that could request an excessive allocation
    or exceed scan limits while decompressing a malformed table of contents.
  * CVE-2025-8088:
    Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
    The fix rejects path separators in NTFS alternate data stream names to
    prevent extraction outside ClamAV's temporary scan directory on Windows.
  * Fixed thread-safety issues in the clamd STATS command that could disclose
    process memory or crash the daemon while scans and STATS requests run
    concurrently. Also fixed partial socket-write handling used for large STATS
    responses.
  * FreeBSD: Restored support for safe quarantine move and remove actions while
    preserving protection against source-path replacement races.
  * Fixed an OpenSSL library-context leak in legacy hashing helpers when a
    requested message digest cannot be fetched, such as when the default
    provider is unavailable in a FIPS-enabled environment.
  * Upgraded the Rust crossbeam-epoch dependency to resolve the
    RUSTSEC-2026-0204 advisory.</changelog>
</package>
<package pkgid="c9cf4725570ac6dce393b26a6356528e156c3c9daa3f0ad5f36ee58665cffc7a4a006f76b3d741c852057aff8a86b7284e179201238f457e5cc0c2483b9e9d49" name="clamav-milter" arch="s390x">
  <version epoch="0" ver="1.5.4" rel="339.1"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1737633600">- Drop the version dependency on libcurl. Building against versions
  older than 7.45 does not fail anymore, but disables support for
  fdpassing in clamonacc. This only affects SLE-12 up to SP3.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1739188800">- bsc#1236949: Fix location of license files.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1742817600">- bsc#1239957: Build with PIE.
- Eliminate some UTF-8 NBSP characters from the changes file.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1748433600">- bsc#1243565: Add clamav-freshclam_test.patch to fix a race
  condition between the mockup servers started by different test
  cases in freshclam_test.py.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1750334400">- New version 1.4.3:
  ClamAV 1.4.3 is a patch release with the following fixes:
  * CVE-2025-20260, bsc#1245054: Fixed a possible buffer overflow
    write bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition or enable remote code
    execution. This issue only affects configurations where both:
  - The max file-size scan limit is set greater than or equal to 1024MB.
  - The max scan-size scan limit is set greater than or equal to 1025MB.
    The code flaw was present prior to version 1.0.0, but a change in
    version 1.0.0 that enables larger allocations based on untrusted data
    made it possible to trigger this bug.
    This issue affects all currently supported versions.
  * CVE-2025-20234, bsc#1245055: Fixed a possible buffer overflow
    read bug in the UDF file parser that may write to a temp file
    and thus disclose information, or it may crash and cause a
    denial-of-service (DoS) condition.
    This issue was introduced in version 1.2.0.
  * Fixed a possible use-after-free bug in the Xz decompression module in
    the bundled lzma-sdk library.
    This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a
    copy of the lzma-sdk with some performance changes specific to
    libclamav, plus select bug fixes like this one in lieu of a full
    upgrade to newer lzma-sdk.
    This issue affects all ClamAV versions at least as far back as 0.99.4.
  * Windows: Fixed a build install issue when a DLL dependency such as
    libcrypto has the exact same name as one provided by the Windows
    operating system.
- Renew clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1751284800">- bsc#1240363, clamav-disable-administrative-commands.patch: clamd:
  Add an option to toggle SHUTDOWN, RELOAD, STATS and VERSION.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1759924800">- New version 1.5.0:
  * Added checks to determine if an OLE2-based Microsoft Office
    document is encrypted.
  * Added the ability to record URIs found in HTML if the
    generate-JSON-metadata feature is enabled.
  * Added the ability to record URIs found in PDFs if the
    generate-JSON-metadata feature is enabled.
  * Added regex support for the clamd.conf OnAccessExcludePath
    config option.
  * Added CVD signing/verification with external .sign files.
  * Freshclam, ClamD, ClamScan, and Sigtool: Added an option to
    enable FIPS-like limits disabling MD5 and SHA1 from being used
    for verifying digital signatures or for being used to trust a
    file when checking for false positives (bsc#1221954).
  * ClamD: Added an option to disable select administrative
    commands including SHUTDOWN, RELOAD, STATS and VERSION.
  * libclamav: Added extended hashing functions with a "flags"
    parameter that allows the caller to choose if they want to
    bypass FIPS hash algorithm limits.
  * See the release announcement for the full list of changes:
    https://blog.clamav.net/2025/10/clamav-150-released.html
- Obsoleted patches:
  * clamav-freshclam_test.patch
  * clamav-disable-administrative-commands.patch
  * clamav-fips.patch
- Use macros for library versions
- Remove service symlinks: rcclamd, rcfreshclam, rcclamav-milter,
  and clamonacc.
- Use rust 1.86 for SLE-12 and SLE-15-SP2.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760443200">- Add json-c-json-c-0.18-20240915.tar.gz and link it statically
  into libclamav on SLE-12, because version 0.12 is too old.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760616000">- New version: 1.5.1:
  * Fixed a significant performance issue when scanning some PE
    files.
  * Fixed an issue recording file entries from a ZIP archive
    central directory which resulted in
    "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
    ClamScan --alert-exceeds-max command line option or ClamD
    AlertExceedsMax config file option.
  * Improved performance when scanning TNEF email attachments.
  * Fixed an issue with recording metadata for OOXML office
    documents.
  * Fixed an issue with signature matches for VBA in OLE2 office
    documents.
  * Loosened overly restrictive rules for embedded file
    identification and increased the limit for finding PE files
    embedded in other PE files.
  * Fixed an issue with extracting some RAR archives embedded in
    other files.
  * Fixed an issue with calculating fuzzy hashes affecting some
    images by updating the version for several Rust library
    dependencies.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1762257600">- Add clamav-workaround.patch to work around symbol removals in
  version 1.5.0 and 1.5.1.</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1763208000">- Build with older rust 1.87 for reproducible builds (boo#1249404)</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1763726400">- Provide a better fix for boo#1249404 by disabling debug mode.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1764331200">- Fix testsuite error on SLE-15-SP6 by falling back to rust1.86.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770724800">- jsc-PED-14819: Support transactional updates.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770984000">- bsc#1258072: Require main and library packages to be of the same
  version and release. Given that all the core functionality is
  in the libraries it makes little sense to update the main
  package alone.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1772712000">- New version 1.5.2:
  * bsc#1259207, CVE-2026-20031: Fixed an error handling bug in the
    HTML file parser that may crash the program and cause a
    denial-of-service (DoS) condition. This issue was introduced in
    version 1.1.0.
  * Fixed a possible infinite loop when scanning some JPEG files by
    upgrading affected ClamAV dependency, a Rust image library.
  * The CVD verification process will now ignore certificate files
    in the CVD certs directory when the user lacks read permissions.
  * Freshclam: Fix CLD verification bug with PrivateMirror option.
  * Upgraded the Rust bytes dependency to a newer version to
    resolve RUSTSEC-2026-0007 advisory.
  * Fixed a possible crash caused by invalid pointer alignment on
    some platforms.
  * Minimal required Rust version is now 1.87.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1773316800">- Disable build for 32 bit ix86 because of testsuite failures with
  rust &gt;= 1.87 that upstream is not planning to fix.
- Run the test suite on all SUSE releases.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1782907200">- update to 1.5.3
  ClamAV 1.5.3 is a patch release with the following fixes:
  * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
  * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
  * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
  * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
  * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
  * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
  * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
  * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
  * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
  * Metadata preclass scans now run before the final scan verdict.
  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1784894400">- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to
  fix path traversal vulnerability in OneNote parser.
- Add clamav-vendor-cve-2026-46671.tar.gz to provide the
  sanitise-file-name Rust crate required by the security fix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1786881600">- update to 1.5.4
  ClamAV 1.5.4 is a patch release with the following fixes:
  * CVE-2026-20337, bsc#1274597:
    Fixed ZIP catalogue capacity tracking that could write beyond a heap
    allocation while indexing local file headers.
  * CVE-2026-20345, bsc#1274600:
    Fixed an indexing error while converting GPT partition names that could
    read or write beyond a stack-allocated partition entry.
  * CVE-2026-20339, bsc#1274599:
    Fixed an integer overflow in the PESpin unpacker that could allocate an
    undersized buffer and then write beyond it while rebuilding a PE file.
  * CVE-2026-20338, bsc#1274598:
    Fixed ownership handling while merging ZIP catalogue records that could
    cause an invalid free while scanning a malformed archive.
  * CVE-2026-20346, bsc#1274601:
    Fixed an integer underflow in the PDF parser that could cause a crash while
    reading a malformed hex string.
  * CVE-2026-20347, bsc#1274602:
    Fixed undefined behavior and integer overflow in the Mach-O parser that
    could cause a crash while scanning a malformed Mach-O file.
  * CVE-2026-20348, bsc#1274603:
    Fixed XAR parser size handling that could request an excessive allocation
    or exceed scan limits while decompressing a malformed table of contents.
  * CVE-2025-8088:
    Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
    The fix rejects path separators in NTFS alternate data stream names to
    prevent extraction outside ClamAV's temporary scan directory on Windows.
  * Fixed thread-safety issues in the clamd STATS command that could disclose
    process memory or crash the daemon while scans and STATS requests run
    concurrently. Also fixed partial socket-write handling used for large STATS
    responses.
  * FreeBSD: Restored support for safe quarantine move and remove actions while
    preserving protection against source-path replacement races.
  * Fixed an OpenSSL library-context leak in legacy hashing helpers when a
    requested message digest cannot be fetched, such as when the default
    provider is unavailable in a FIPS-enabled environment.
  * Upgraded the Rust crossbeam-epoch dependency to resolve the
    RUSTSEC-2026-0204 advisory.</changelog>
</package>
<package pkgid="ed02b884abef9125d8ff4632c616380af7e78bcb30c94ce4b3b85a5b123b82500c33b22e2e773b1c31680f7844f499b594aa99981b296cc77344ee18be8b5738" name="clamav-milter-debuginfo" arch="s390x">
  <version epoch="0" ver="1.5.4" rel="339.1"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1737633600">- Drop the version dependency on libcurl. Building against versions
  older than 7.45 does not fail anymore, but disables support for
  fdpassing in clamonacc. This only affects SLE-12 up to SP3.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1739188800">- bsc#1236949: Fix location of license files.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1742817600">- bsc#1239957: Build with PIE.
- Eliminate some UTF-8 NBSP characters from the changes file.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1748433600">- bsc#1243565: Add clamav-freshclam_test.patch to fix a race
  condition between the mockup servers started by different test
  cases in freshclam_test.py.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1750334400">- New version 1.4.3:
  ClamAV 1.4.3 is a patch release with the following fixes:
  * CVE-2025-20260, bsc#1245054: Fixed a possible buffer overflow
    write bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition or enable remote code
    execution. This issue only affects configurations where both:
  - The max file-size scan limit is set greater than or equal to 1024MB.
  - The max scan-size scan limit is set greater than or equal to 1025MB.
    The code flaw was present prior to version 1.0.0, but a change in
    version 1.0.0 that enables larger allocations based on untrusted data
    made it possible to trigger this bug.
    This issue affects all currently supported versions.
  * CVE-2025-20234, bsc#1245055: Fixed a possible buffer overflow
    read bug in the UDF file parser that may write to a temp file
    and thus disclose information, or it may crash and cause a
    denial-of-service (DoS) condition.
    This issue was introduced in version 1.2.0.
  * Fixed a possible use-after-free bug in the Xz decompression module in
    the bundled lzma-sdk library.
    This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a
    copy of the lzma-sdk with some performance changes specific to
    libclamav, plus select bug fixes like this one in lieu of a full
    upgrade to newer lzma-sdk.
    This issue affects all ClamAV versions at least as far back as 0.99.4.
  * Windows: Fixed a build install issue when a DLL dependency such as
    libcrypto has the exact same name as one provided by the Windows
    operating system.
- Renew clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1751284800">- bsc#1240363, clamav-disable-administrative-commands.patch: clamd:
  Add an option to toggle SHUTDOWN, RELOAD, STATS and VERSION.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1759924800">- New version 1.5.0:
  * Added checks to determine if an OLE2-based Microsoft Office
    document is encrypted.
  * Added the ability to record URIs found in HTML if the
    generate-JSON-metadata feature is enabled.
  * Added the ability to record URIs found in PDFs if the
    generate-JSON-metadata feature is enabled.
  * Added regex support for the clamd.conf OnAccessExcludePath
    config option.
  * Added CVD signing/verification with external .sign files.
  * Freshclam, ClamD, ClamScan, and Sigtool: Added an option to
    enable FIPS-like limits disabling MD5 and SHA1 from being used
    for verifying digital signatures or for being used to trust a
    file when checking for false positives (bsc#1221954).
  * ClamD: Added an option to disable select administrative
    commands including SHUTDOWN, RELOAD, STATS and VERSION.
  * libclamav: Added extended hashing functions with a "flags"
    parameter that allows the caller to choose if they want to
    bypass FIPS hash algorithm limits.
  * See the release announcement for the full list of changes:
    https://blog.clamav.net/2025/10/clamav-150-released.html
- Obsoleted patches:
  * clamav-freshclam_test.patch
  * clamav-disable-administrative-commands.patch
  * clamav-fips.patch
- Use macros for library versions
- Remove service symlinks: rcclamd, rcfreshclam, rcclamav-milter,
  and clamonacc.
- Use rust 1.86 for SLE-12 and SLE-15-SP2.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760443200">- Add json-c-json-c-0.18-20240915.tar.gz and link it statically
  into libclamav on SLE-12, because version 0.12 is too old.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760616000">- New version: 1.5.1:
  * Fixed a significant performance issue when scanning some PE
    files.
  * Fixed an issue recording file entries from a ZIP archive
    central directory which resulted in
    "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
    ClamScan --alert-exceeds-max command line option or ClamD
    AlertExceedsMax config file option.
  * Improved performance when scanning TNEF email attachments.
  * Fixed an issue with recording metadata for OOXML office
    documents.
  * Fixed an issue with signature matches for VBA in OLE2 office
    documents.
  * Loosened overly restrictive rules for embedded file
    identification and increased the limit for finding PE files
    embedded in other PE files.
  * Fixed an issue with extracting some RAR archives embedded in
    other files.
  * Fixed an issue with calculating fuzzy hashes affecting some
    images by updating the version for several Rust library
    dependencies.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1762257600">- Add clamav-workaround.patch to work around symbol removals in
  version 1.5.0 and 1.5.1.</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1763208000">- Build with older rust 1.87 for reproducible builds (boo#1249404)</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1763726400">- Provide a better fix for boo#1249404 by disabling debug mode.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1764331200">- Fix testsuite error on SLE-15-SP6 by falling back to rust1.86.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770724800">- jsc-PED-14819: Support transactional updates.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770984000">- bsc#1258072: Require main and library packages to be of the same
  version and release. Given that all the core functionality is
  in the libraries it makes little sense to update the main
  package alone.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1772712000">- New version 1.5.2:
  * bsc#1259207, CVE-2026-20031: Fixed an error handling bug in the
    HTML file parser that may crash the program and cause a
    denial-of-service (DoS) condition. This issue was introduced in
    version 1.1.0.
  * Fixed a possible infinite loop when scanning some JPEG files by
    upgrading affected ClamAV dependency, a Rust image library.
  * The CVD verification process will now ignore certificate files
    in the CVD certs directory when the user lacks read permissions.
  * Freshclam: Fix CLD verification bug with PrivateMirror option.
  * Upgraded the Rust bytes dependency to a newer version to
    resolve RUSTSEC-2026-0007 advisory.
  * Fixed a possible crash caused by invalid pointer alignment on
    some platforms.
  * Minimal required Rust version is now 1.87.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1773316800">- Disable build for 32 bit ix86 because of testsuite failures with
  rust &gt;= 1.87 that upstream is not planning to fix.
- Run the test suite on all SUSE releases.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1782907200">- update to 1.5.3
  ClamAV 1.5.3 is a patch release with the following fixes:
  * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
  * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
  * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
  * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
  * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
  * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
  * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
  * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
  * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
  * Metadata preclass scans now run before the final scan verdict.
  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1784894400">- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to
  fix path traversal vulnerability in OneNote parser.
- Add clamav-vendor-cve-2026-46671.tar.gz to provide the
  sanitise-file-name Rust crate required by the security fix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1786881600">- update to 1.5.4
  ClamAV 1.5.4 is a patch release with the following fixes:
  * CVE-2026-20337, bsc#1274597:
    Fixed ZIP catalogue capacity tracking that could write beyond a heap
    allocation while indexing local file headers.
  * CVE-2026-20345, bsc#1274600:
    Fixed an indexing error while converting GPT partition names that could
    read or write beyond a stack-allocated partition entry.
  * CVE-2026-20339, bsc#1274599:
    Fixed an integer overflow in the PESpin unpacker that could allocate an
    undersized buffer and then write beyond it while rebuilding a PE file.
  * CVE-2026-20338, bsc#1274598:
    Fixed ownership handling while merging ZIP catalogue records that could
    cause an invalid free while scanning a malformed archive.
  * CVE-2026-20346, bsc#1274601:
    Fixed an integer underflow in the PDF parser that could cause a crash while
    reading a malformed hex string.
  * CVE-2026-20347, bsc#1274602:
    Fixed undefined behavior and integer overflow in the Mach-O parser that
    could cause a crash while scanning a malformed Mach-O file.
  * CVE-2026-20348, bsc#1274603:
    Fixed XAR parser size handling that could request an excessive allocation
    or exceed scan limits while decompressing a malformed table of contents.
  * CVE-2025-8088:
    Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
    The fix rejects path separators in NTFS alternate data stream names to
    prevent extraction outside ClamAV's temporary scan directory on Windows.
  * Fixed thread-safety issues in the clamd STATS command that could disclose
    process memory or crash the daemon while scans and STATS requests run
    concurrently. Also fixed partial socket-write handling used for large STATS
    responses.
  * FreeBSD: Restored support for safe quarantine move and remove actions while
    preserving protection against source-path replacement races.
  * Fixed an OpenSSL library-context leak in legacy hashing helpers when a
    requested message digest cannot be fetched, such as when the default
    provider is unavailable in a FIPS-enabled environment.
  * Upgraded the Rust crossbeam-epoch dependency to resolve the
    RUSTSEC-2026-0204 advisory.</changelog>
</package>
<package pkgid="4d3d7a12d7c99405f3174d2012b511c09aeef937d6ac19216ee098bd9de482c318302bb8eea44f5bf00954bd23240847e38041010813ad787d9fc3ad14a0785e" name="clamav0" arch="s390x">
  <version epoch="0" ver="0.103.11" rel="5.5"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612612800">- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612872000">- Don't daemonize freshclam, but use a systemd timer instead to
  trigger updates
  + timer.freshclam
  % service.freshclam
  % clamav-conf.patch
- Remove obsolete patch (replaced by SOURCE_DATE_EPOCH)
  - clamav-disable-timestamps.patch
- Fix unit test
  + clamav-ck_assert_msg.patch
- Cleanup spec
  * use pkgconfig() to resolve BuildRequires where upstream uses it
  * rework creating vscan user (new system-user in Tumbleweed)
  * remove obsolete configure option --disable-zlib-vcheck</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1614254400">- Package clamav-milter in a subpackage
- Remove virus signatures upon uninstall
- Check for database existence before starting clamd
- Restart clamd when it exits</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1617796800">- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
- Update package signing key (from https://www.clamav.net/downloads)
  % clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1617969600">- Use a split-provides for clamav-milter instead of recommending it.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1635940800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1641988800">- Update to 0.103.5
  * CVE-2022-20698: Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https source urls</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1651752000">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1659700800">- Update to 0.103.7
  - Zip parser: tolerate 2-byte overlap in file entries
  - Fix bug with logical signature Intermediates feature
  - Update to UnRAR v6.1.7
  - Patch UnRAR: allow skipping files in solid archives
  - Patch UnRAR: limit dict winsize to 1GB</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1676462400">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.
- Package huge .html documentation in a separate subpackage.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1692187200">- Update to 0.103.9
  * CVE-2023-20197: Fixed a possible denial of service vulnerability in
    the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through
    1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8
    through 0.103.0. (boo#1214342)
  * Fixed compiler warnings that may turn into errors in Clang 16.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1692360000">- Renew clamav.keyring .</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1698235200">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1711368000">- Rename the package to clamav0 to make way for the 1.x package.</changelog>
</package>
<package pkgid="00b4ac687194ede682f4f55006bfaab88fc42d37c9a5136b1a5be6ade6b134e9fc17814acdf220b292dae6897afc0362a0417489908057a281223e715706c68c" name="clamav0" arch="src">
  <version epoch="0" ver="0.103.11" rel="5.5"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612612800">- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612872000">- Don't daemonize freshclam, but use a systemd timer instead to
  trigger updates
  + timer.freshclam
  % service.freshclam
  % clamav-conf.patch
- Remove obsolete patch (replaced by SOURCE_DATE_EPOCH)
  - clamav-disable-timestamps.patch
- Fix unit test
  + clamav-ck_assert_msg.patch
- Cleanup spec
  * use pkgconfig() to resolve BuildRequires where upstream uses it
  * rework creating vscan user (new system-user in Tumbleweed)
  * remove obsolete configure option --disable-zlib-vcheck</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1614254400">- Package clamav-milter in a subpackage
- Remove virus signatures upon uninstall
- Check for database existence before starting clamd
- Restart clamd when it exits</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1617796800">- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
- Update package signing key (from https://www.clamav.net/downloads)
  % clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1617969600">- Use a split-provides for clamav-milter instead of recommending it.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1635940800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1641988800">- Update to 0.103.5
  * CVE-2022-20698: Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https source urls</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1651752000">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1659700800">- Update to 0.103.7
  - Zip parser: tolerate 2-byte overlap in file entries
  - Fix bug with logical signature Intermediates feature
  - Update to UnRAR v6.1.7
  - Patch UnRAR: allow skipping files in solid archives
  - Patch UnRAR: limit dict winsize to 1GB</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1676462400">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.
- Package huge .html documentation in a separate subpackage.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1692187200">- Update to 0.103.9
  * CVE-2023-20197: Fixed a possible denial of service vulnerability in
    the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through
    1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8
    through 0.103.0. (boo#1214342)
  * Fixed compiler warnings that may turn into errors in Clang 16.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1692360000">- Renew clamav.keyring .</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1698235200">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1711368000">- Rename the package to clamav0 to make way for the 1.x package.</changelog>
</package>
<package pkgid="7929361e63ec8452b3402b3bb83eeb00ef034cdcb6eca6531a26b2413bc3ffd693dc0119139609699b11abe9bc2fc00cb88863f17005a446e56ede55961415a7" name="clamav0-debuginfo" arch="s390x">
  <version epoch="0" ver="0.103.11" rel="5.5"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612612800">- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612872000">- Don't daemonize freshclam, but use a systemd timer instead to
  trigger updates
  + timer.freshclam
  % service.freshclam
  % clamav-conf.patch
- Remove obsolete patch (replaced by SOURCE_DATE_EPOCH)
  - clamav-disable-timestamps.patch
- Fix unit test
  + clamav-ck_assert_msg.patch
- Cleanup spec
  * use pkgconfig() to resolve BuildRequires where upstream uses it
  * rework creating vscan user (new system-user in Tumbleweed)
  * remove obsolete configure option --disable-zlib-vcheck</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1614254400">- Package clamav-milter in a subpackage
- Remove virus signatures upon uninstall
- Check for database existence before starting clamd
- Restart clamd when it exits</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1617796800">- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
- Update package signing key (from https://www.clamav.net/downloads)
  % clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1617969600">- Use a split-provides for clamav-milter instead of recommending it.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1635940800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1641988800">- Update to 0.103.5
  * CVE-2022-20698: Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https source urls</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1651752000">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1659700800">- Update to 0.103.7
  - Zip parser: tolerate 2-byte overlap in file entries
  - Fix bug with logical signature Intermediates feature
  - Update to UnRAR v6.1.7
  - Patch UnRAR: allow skipping files in solid archives
  - Patch UnRAR: limit dict winsize to 1GB</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1676462400">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.
- Package huge .html documentation in a separate subpackage.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1692187200">- Update to 0.103.9
  * CVE-2023-20197: Fixed a possible denial of service vulnerability in
    the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through
    1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8
    through 0.103.0. (boo#1214342)
  * Fixed compiler warnings that may turn into errors in Clang 16.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1692360000">- Renew clamav.keyring .</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1698235200">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1711368000">- Rename the package to clamav0 to make way for the 1.x package.</changelog>
</package>
<package pkgid="fcc6c63af109118e42460499402413b4880951a7f7d459b8e420cfbf0c2d9881b4800f1feff8a40c6f0bc5ac3acd26075dda0908ba685d9bb994770386978119" name="clamav0-debugsource" arch="s390x">
  <version epoch="0" ver="0.103.11" rel="5.5"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612612800">- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612872000">- Don't daemonize freshclam, but use a systemd timer instead to
  trigger updates
  + timer.freshclam
  % service.freshclam
  % clamav-conf.patch
- Remove obsolete patch (replaced by SOURCE_DATE_EPOCH)
  - clamav-disable-timestamps.patch
- Fix unit test
  + clamav-ck_assert_msg.patch
- Cleanup spec
  * use pkgconfig() to resolve BuildRequires where upstream uses it
  * rework creating vscan user (new system-user in Tumbleweed)
  * remove obsolete configure option --disable-zlib-vcheck</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1614254400">- Package clamav-milter in a subpackage
- Remove virus signatures upon uninstall
- Check for database existence before starting clamd
- Restart clamd when it exits</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1617796800">- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
- Update package signing key (from https://www.clamav.net/downloads)
  % clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1617969600">- Use a split-provides for clamav-milter instead of recommending it.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1635940800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1641988800">- Update to 0.103.5
  * CVE-2022-20698: Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https source urls</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1651752000">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1659700800">- Update to 0.103.7
  - Zip parser: tolerate 2-byte overlap in file entries
  - Fix bug with logical signature Intermediates feature
  - Update to UnRAR v6.1.7
  - Patch UnRAR: allow skipping files in solid archives
  - Patch UnRAR: limit dict winsize to 1GB</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1676462400">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.
- Package huge .html documentation in a separate subpackage.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1692187200">- Update to 0.103.9
  * CVE-2023-20197: Fixed a possible denial of service vulnerability in
    the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through
    1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8
    through 0.103.0. (boo#1214342)
  * Fixed compiler warnings that may turn into errors in Clang 16.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1692360000">- Renew clamav.keyring .</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1698235200">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1711368000">- Rename the package to clamav0 to make way for the 1.x package.</changelog>
</package>
<package pkgid="562799335776ded4b337c71ed803209aa53040f40b29d0073cf960ae00d8ed92556394270245122cde01d7b887e99fd7b4f6d6d6de4762a937694ae62be26656" name="clamav0-devel" arch="s390x">
  <version epoch="0" ver="0.103.11" rel="5.5"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612612800">- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612872000">- Don't daemonize freshclam, but use a systemd timer instead to
  trigger updates
  + timer.freshclam
  % service.freshclam
  % clamav-conf.patch
- Remove obsolete patch (replaced by SOURCE_DATE_EPOCH)
  - clamav-disable-timestamps.patch
- Fix unit test
  + clamav-ck_assert_msg.patch
- Cleanup spec
  * use pkgconfig() to resolve BuildRequires where upstream uses it
  * rework creating vscan user (new system-user in Tumbleweed)
  * remove obsolete configure option --disable-zlib-vcheck</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1614254400">- Package clamav-milter in a subpackage
- Remove virus signatures upon uninstall
- Check for database existence before starting clamd
- Restart clamd when it exits</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1617796800">- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
- Update package signing key (from https://www.clamav.net/downloads)
  % clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1617969600">- Use a split-provides for clamav-milter instead of recommending it.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1635940800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1641988800">- Update to 0.103.5
  * CVE-2022-20698: Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https source urls</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1651752000">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1659700800">- Update to 0.103.7
  - Zip parser: tolerate 2-byte overlap in file entries
  - Fix bug with logical signature Intermediates feature
  - Update to UnRAR v6.1.7
  - Patch UnRAR: allow skipping files in solid archives
  - Patch UnRAR: limit dict winsize to 1GB</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1676462400">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.
- Package huge .html documentation in a separate subpackage.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1692187200">- Update to 0.103.9
  * CVE-2023-20197: Fixed a possible denial of service vulnerability in
    the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through
    1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8
    through 0.103.0. (boo#1214342)
  * Fixed compiler warnings that may turn into errors in Clang 16.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1692360000">- Renew clamav.keyring .</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1698235200">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1711368000">- Rename the package to clamav0 to make way for the 1.x package.</changelog>
</package>
<package pkgid="b92c56390820d97da0c30cee5c322de8afc2cd485d252d14d909bbcd734ec63bd9b2920c8ceb61e5507b936703cc0a18ed697d1c0a224a429f9bbe67f808efc5" name="clamav0-docs-html" arch="noarch">
  <version epoch="0" ver="0.103.11" rel="5.5"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612612800">- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612872000">- Don't daemonize freshclam, but use a systemd timer instead to
  trigger updates
  + timer.freshclam
  % service.freshclam
  % clamav-conf.patch
- Remove obsolete patch (replaced by SOURCE_DATE_EPOCH)
  - clamav-disable-timestamps.patch
- Fix unit test
  + clamav-ck_assert_msg.patch
- Cleanup spec
  * use pkgconfig() to resolve BuildRequires where upstream uses it
  * rework creating vscan user (new system-user in Tumbleweed)
  * remove obsolete configure option --disable-zlib-vcheck</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1614254400">- Package clamav-milter in a subpackage
- Remove virus signatures upon uninstall
- Check for database existence before starting clamd
- Restart clamd when it exits</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1617796800">- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
- Update package signing key (from https://www.clamav.net/downloads)
  % clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1617969600">- Use a split-provides for clamav-milter instead of recommending it.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1635940800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1641988800">- Update to 0.103.5
  * CVE-2022-20698: Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https source urls</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1651752000">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1659700800">- Update to 0.103.7
  - Zip parser: tolerate 2-byte overlap in file entries
  - Fix bug with logical signature Intermediates feature
  - Update to UnRAR v6.1.7
  - Patch UnRAR: allow skipping files in solid archives
  - Patch UnRAR: limit dict winsize to 1GB</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1676462400">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.
- Package huge .html documentation in a separate subpackage.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1692187200">- Update to 0.103.9
  * CVE-2023-20197: Fixed a possible denial of service vulnerability in
    the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through
    1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8
    through 0.103.0. (boo#1214342)
  * Fixed compiler warnings that may turn into errors in Clang 16.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1692360000">- Renew clamav.keyring .</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1698235200">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1711368000">- Rename the package to clamav0 to make way for the 1.x package.</changelog>
</package>
<package pkgid="d9a00d562453fa0d3b70ea215003233626287801b00d9e2d2491aa07228901b8834561d9d873ea2e30c300fb74874f9207ea9d47397e715d28d2f40b49f2ada2" name="clamav0-milter" arch="s390x">
  <version epoch="0" ver="0.103.11" rel="5.5"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612612800">- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612872000">- Don't daemonize freshclam, but use a systemd timer instead to
  trigger updates
  + timer.freshclam
  % service.freshclam
  % clamav-conf.patch
- Remove obsolete patch (replaced by SOURCE_DATE_EPOCH)
  - clamav-disable-timestamps.patch
- Fix unit test
  + clamav-ck_assert_msg.patch
- Cleanup spec
  * use pkgconfig() to resolve BuildRequires where upstream uses it
  * rework creating vscan user (new system-user in Tumbleweed)
  * remove obsolete configure option --disable-zlib-vcheck</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1614254400">- Package clamav-milter in a subpackage
- Remove virus signatures upon uninstall
- Check for database existence before starting clamd
- Restart clamd when it exits</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1617796800">- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
- Update package signing key (from https://www.clamav.net/downloads)
  % clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1617969600">- Use a split-provides for clamav-milter instead of recommending it.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1635940800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1641988800">- Update to 0.103.5
  * CVE-2022-20698: Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https source urls</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1651752000">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1659700800">- Update to 0.103.7
  - Zip parser: tolerate 2-byte overlap in file entries
  - Fix bug with logical signature Intermediates feature
  - Update to UnRAR v6.1.7
  - Patch UnRAR: allow skipping files in solid archives
  - Patch UnRAR: limit dict winsize to 1GB</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1676462400">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.
- Package huge .html documentation in a separate subpackage.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1692187200">- Update to 0.103.9
  * CVE-2023-20197: Fixed a possible denial of service vulnerability in
    the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through
    1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8
    through 0.103.0. (boo#1214342)
  * Fixed compiler warnings that may turn into errors in Clang 16.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1692360000">- Renew clamav.keyring .</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1698235200">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1711368000">- Rename the package to clamav0 to make way for the 1.x package.</changelog>
</package>
<package pkgid="ebd9916900d50b6101b3898580821e61b2a016ee6e9b4145925b6143882953e5e189582f2506587914781575fdbb3fabb3a336d520088eebc378313d263b3046" name="clamav0-milter-debuginfo" arch="s390x">
  <version epoch="0" ver="0.103.11" rel="5.5"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612612800">- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612872000">- Don't daemonize freshclam, but use a systemd timer instead to
  trigger updates
  + timer.freshclam
  % service.freshclam
  % clamav-conf.patch
- Remove obsolete patch (replaced by SOURCE_DATE_EPOCH)
  - clamav-disable-timestamps.patch
- Fix unit test
  + clamav-ck_assert_msg.patch
- Cleanup spec
  * use pkgconfig() to resolve BuildRequires where upstream uses it
  * rework creating vscan user (new system-user in Tumbleweed)
  * remove obsolete configure option --disable-zlib-vcheck</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1614254400">- Package clamav-milter in a subpackage
- Remove virus signatures upon uninstall
- Check for database existence before starting clamd
- Restart clamd when it exits</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1617796800">- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
- Update package signing key (from https://www.clamav.net/downloads)
  % clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1617969600">- Use a split-provides for clamav-milter instead of recommending it.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1635940800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1641988800">- Update to 0.103.5
  * CVE-2022-20698: Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https source urls</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1651752000">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1659700800">- Update to 0.103.7
  - Zip parser: tolerate 2-byte overlap in file entries
  - Fix bug with logical signature Intermediates feature
  - Update to UnRAR v6.1.7
  - Patch UnRAR: allow skipping files in solid archives
  - Patch UnRAR: limit dict winsize to 1GB</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1676462400">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.
- Package huge .html documentation in a separate subpackage.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1692187200">- Update to 0.103.9
  * CVE-2023-20197: Fixed a possible denial of service vulnerability in
    the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through
    1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8
    through 0.103.0. (boo#1214342)
  * Fixed compiler warnings that may turn into errors in Clang 16.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1692360000">- Renew clamav.keyring .</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1698235200">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1711368000">- Rename the package to clamav0 to make way for the 1.x package.</changelog>
</package>
<package pkgid="d97744b1de8e93dfc99e1b3a1fbd6a417822733947fb58f7b6d46658c03f1c1ec14d7e9aa665e3db2dcc8f8e2c48dec96b6e951a4fad518bc8361c1d1ce97b16" name="clamtk" arch="noarch">
  <version epoch="0" ver="6.18" rel="26.20"/>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1580731200">- Update to version 6.0.2
  * No changelog upstream
- Cleanup spec file</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1597579200">- update to 6.05:
  * Exclude Timeshift directory (Github #121)
  * Added Help button in Analysis to explain its purpose
    (Github #122)
  * Updated language files: English (en_UK), Galician (gl),
    Ukrainian (uk), French (fr), Afrikans (af), Hebrew (he),
    Chinese (zh_TW)
  * Add Encrypted.PDF as clean (Github #120). Also, remove alert-
    encrypted-* options
  * Add set LC_TIME (Gitlab commit a7b3a31c)
  * More README cleanup
  * Updated language files: Dutch (nl), Afrikans (af),
    Indonesian (id), English (en_UK)
  * Bug fix affecting manual updates
  * Update year (2019 -&gt; 2020)
  * Clean up man page
  * Heuristic scanning made an option rather than a default
  * Fix icon mismatch in the Scheduler
  * Fix icon glitch in Update
  * Updated language files: English (en_UK), Indonesian (id),
    Swedish (sv) (Launchpad #1688469)</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1601035200">- update to 6.06:
  * Fix for 'Show Hidden Files' checkbox automatically
  * Remove env from clamtk startup for correct
    dependency detection (rpmlint)
  * Minor language updates to desktop file
  * Updated language files: Japanese (ja), English (en_AU),
    Mon (mnw_MM), Finnish (fi), Malay (ms)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1613131200">- Update to version 6.07:
  + Update to look for additional information during update to know
    when finished.
  + Update dates to 2021.
- Add 0001-Do-not-inject-no-separator-into-window-decoration.patch:
  Do not add no-separator to window decoration (boo#1182151).</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1619524800">- Update to version 6.11:
  * Clamtk and Clamav do not update automatically
  * Add appdata.xml file
  * Remove code referencing old repo.
  * Bug: app doesn't scan files/folders on demand
  * Bug: Do not inject 'no-separator' into window decoration
  * Add --alert-broken-media option for versions &gt;= 103.1
  * Remove older repo (clamtk-gtk3), use clamtk only
- Remove 0001-Do-not-inject-no-separator-into-window-decoration.patch</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1628078400">- Update to version 6.13:
  * Fixes for appdata.xml
  * Partially work Github #129 (engine version, date of sigs, title)
  * Update translations in clamtk.desktop</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to version 6.14
  * Fix for context-menu scanning image issues</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1686657600">- Update to version 6.16
  * Fix for Virustotal privacy warning before upload or sending file hash only
  * Remove (hopefully) no longer needed lines; improve a few others (Scan.pm)
  * Updated language files: Dutch (nl)
  * Update README and site links for updated GPG key
- Update to version 6.15
  * Fix for Unable to delete previous analysis result
  * Updated language files: Indonesian (id), Swedish (sv), German (de), Chinese (zh_CN), Burmese (my)
  * Fix to German language string in clamtk.desktop
  * Update DISCLAIMER to use markdown (DISCLAIMER.md)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1720612800">- Update to 6.18:
  * Remove unnecessary line from #154 fix in App.pm
  * Change default clamtk user directory to .config/clamtk (Github #161)
  * Fix for scanned directories not showing in logs
  * Update App.pm to support $XDG_CONFIG_HOME environnement variable (Github #154)</changelog>
</package>
<package pkgid="5d9905fac1a208623e3e1529c4e9fb2b8de2e8b6408df8206765f4a1b40003d03cbdf346a39e7efa383b5c145c0db8eda27cc39e808741b2f4f237711074f365" name="clamtk" arch="src">
  <version epoch="0" ver="6.18" rel="26.20"/>
  <changelog author="ecsos@opensuse.org" date="1422100800">- update to 5.13
  * Fix for submitting new files in Analysis
  * Update for Virustotal API return results
  * Fix closing Results window exits program
  * Fix "extra" translation in Scan finish
  * Fix Results window doesn't show in some situations
  * Fix scan statistics not resetting after scan
- changes from 5.12
  * Fix for mouse focus issue in history window
    (Google Issue #29)
  * Add delete keybinding to history window
  * Fix error with analysis function where incorrect
    results were given
  * Add initial support for Trash. Thanks, Nikita!
  * Fix formatting issue when quarantining or deleting
    items in the Results panel</changelog>
  <changelog author="ecsos@opensuse.org" date="1428062400">- update to 5.15
  * Speed up file count/progressbar when directory
    chosen for scanning is root (/) by switching to
    progressbar's activity mode (no % complete)
  * Minor fix to keep window open after closing Results
    when main window is open
  * Fix window doesn't always show
  * Updated language files: Sinhalese (si), Croatian (hr),
    Dutch (nl)
- changes from 5.14
  * Add more meaningful progressbar back; requires
    File::Find (usually bundled, shouldn't add new requirements)
  * Fix language file text gets inserted into Update process
    for some ridiculous reason
  * Add more obvious notice for files that are too big to upload
    for Analysis (32MB limit through API)
  * Add more meaningful messages when trying to scan
    files/directories if user does not have permissions
  * Fix for when quit button requires more than one click
  * Minor font tweak to prevent words from being cut off
  * Updated language files: Finnish (fi), German (de),
    Ukrainian (uk), English (en_CA), English (en_AU),
    English (en_GB), Russian (ru), Galician (gl), Malay (ms),
    Romanian (ro), Chinese (zh_TW)</changelog>
  <changelog author="ecsos@opensuse.org" date="1431432000">- update to 5.18
  * Improvements with Results window
  * Minor tweak on PUA-identified files
  * Add github bug reporting page to help documentation
  * Updated language files: Indonesian (id), Uzbek (uz),
    Finnish (fi), Ukrainian (uk), Galician (gl), German (de),
    Hebrew (he), English (en_UK), Chinese (zh_TW), Korean (ko_KR),
    Dutch (nl)
- changes from 5.17
  * Fix crash with Results window
  * Remove freecode references from help files
- changes from 5.16
  * Properly destroy Results window
  * Fix incorrect version in legacy build
  * Fix progressbar count issue for when recursive is
    not selected
  * Improve hidden files scanning/counting
  * Update website page to github
  * Updated language files: French (fr), Polish (pl)</changelog>
  <changelog author="ecsos@opensuse.org" date="1437307200">- update to 5.19
  * Minor fix for History view and row selection (iter)
  * Minor tweak to improve display of objects scanned
  * Continue replacing Windows -&gt; boxes
  * Updated language files: Korean (ko_KR), Italian (it)</changelog>
  <changelog author="p.drouand@gmail.com" date="1453550400">- Update to version 5.20
  * Remove nautilus as dependency for clamtk (BZ #1260284)
  * Updated language files: Khmer (km), Thai (th), Lao (lo),
    French (fr)
- Perform a spec-cleaner
- Add %{perl_requires} macro
- Install perl libraries into %{perl_vendorlib}</changelog>
  <changelog author="ecsos@opensuse.org" date="1474545600">- update to 5.22
  * Directories not scanning if users home includes /sys or
    /dev (Github #61).
  * Fix all of Github #59 (max-scansize)
  * Fix to names of whitelisted directories with extra ";"
  * Update website in About dialog as github.io
  * Begin digitally signing rpms again, like debs
  * Updated language files: pt_BR, en_AU, sv
- changes from 5.21
  * Update man pages to include updated URLs for bug reporting
  * Explicitly add archive scanning (Github #59)
  * Removed most monospacing as requested
  * Improved text layout
  * Updated language files: (ja), Indonesian (id), Polish (pl),
    Esperanto (eo), Spanish (es), Danish (da), Malay (ms)</changelog>
  <changelog author="ecsos@opensuse.org" date="1483876800">- update to 5.24
  * Fix startup crash when icon theme lacks 'gtk-new' or other
    icon with Arch patch. Thanks to anthraxx. Closes BZ #1386370
  * Initial credits.md file showing contributors
  * Add comments line in About dialog to translation file
  * Removed built-in help documentation until updated
    and translated
  * Updated language files: Ukrainian (uk), Hebrew (he),
    English (en_UK), Galician (gl), Italian (it) Finnish (fi)
- changes from 5.23
  * Fix Github #67 (Directories not scanning under Linux Mint 18
    KDE [LiveUSB])</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1510228800">- update to 5.25
  * Remove forced white background (Github #51)
  * Update bitbucket path in various places
  * Use "other" for infobar button type (Github #51)
  * Updated language files: Chinese (zh_TW), Italian (it),
  English (en_AU), Dutch (nl), French (fr), Hungarian (hu),
    Swedish (sv)
- add source file validation</changelog>
  <changelog author="ecsos@opensuse.org" date="1549368000">- update to 5.26
  * UI change to single-click
  * Update year to 2018; 14th year :)
  * Updates to the man pages
  * Update Swedish (sv) language file for Launchpad #1688469
  * Begin move to https://gitlab.com/dave_m/clamtk</changelog>
  <changelog author="ecsos@opensuse.org" date="1557230400">- update to 5.27
  * Update options for new ClamAV (0.101.0)
  * Update language files: Swedish (sv), Japanese (ja)
  * Language files will begin to incorporate new "Language" field
  * Language files are now BSD because Launchpad.
    https://help.launchpad.net/Translations/LicensingFAQ
  * Update year to 2019; 15th year :)</changelog>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1580731200">- Update to version 6.0.2
  * No changelog upstream
- Cleanup spec file</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1597579200">- update to 6.05:
  * Exclude Timeshift directory (Github #121)
  * Added Help button in Analysis to explain its purpose
    (Github #122)
  * Updated language files: English (en_UK), Galician (gl),
    Ukrainian (uk), French (fr), Afrikans (af), Hebrew (he),
    Chinese (zh_TW)
  * Add Encrypted.PDF as clean (Github #120). Also, remove alert-
    encrypted-* options
  * Add set LC_TIME (Gitlab commit a7b3a31c)
  * More README cleanup
  * Updated language files: Dutch (nl), Afrikans (af),
    Indonesian (id), English (en_UK)
  * Bug fix affecting manual updates
  * Update year (2019 -&gt; 2020)
  * Clean up man page
  * Heuristic scanning made an option rather than a default
  * Fix icon mismatch in the Scheduler
  * Fix icon glitch in Update
  * Updated language files: English (en_UK), Indonesian (id),
    Swedish (sv) (Launchpad #1688469)</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1601035200">- update to 6.06:
  * Fix for 'Show Hidden Files' checkbox automatically
  * Remove env from clamtk startup for correct
    dependency detection (rpmlint)
  * Minor language updates to desktop file
  * Updated language files: Japanese (ja), English (en_AU),
    Mon (mnw_MM), Finnish (fi), Malay (ms)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1613131200">- Update to version 6.07:
  + Update to look for additional information during update to know
    when finished.
  + Update dates to 2021.
- Add 0001-Do-not-inject-no-separator-into-window-decoration.patch:
  Do not add no-separator to window decoration (boo#1182151).</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1619524800">- Update to version 6.11:
  * Clamtk and Clamav do not update automatically
  * Add appdata.xml file
  * Remove code referencing old repo.
  * Bug: app doesn't scan files/folders on demand
  * Bug: Do not inject 'no-separator' into window decoration
  * Add --alert-broken-media option for versions &gt;= 103.1
  * Remove older repo (clamtk-gtk3), use clamtk only
- Remove 0001-Do-not-inject-no-separator-into-window-decoration.patch</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1628078400">- Update to version 6.13:
  * Fixes for appdata.xml
  * Partially work Github #129 (engine version, date of sigs, title)
  * Update translations in clamtk.desktop</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to version 6.14
  * Fix for context-menu scanning image issues</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1686657600">- Update to version 6.16
  * Fix for Virustotal privacy warning before upload or sending file hash only
  * Remove (hopefully) no longer needed lines; improve a few others (Scan.pm)
  * Updated language files: Dutch (nl)
  * Update README and site links for updated GPG key
- Update to version 6.15
  * Fix for Unable to delete previous analysis result
  * Updated language files: Indonesian (id), Swedish (sv), German (de), Chinese (zh_CN), Burmese (my)
  * Fix to German language string in clamtk.desktop
  * Update DISCLAIMER to use markdown (DISCLAIMER.md)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1720612800">- Update to 6.18:
  * Remove unnecessary line from #154 fix in App.pm
  * Change default clamtk user directory to .config/clamtk (Github #161)
  * Fix for scanned directories not showing in logs
  * Update App.pm to support $XDG_CONFIG_HOME environnement variable (Github #154)</changelog>
</package>
<package pkgid="58f327949b5fc26cb96f049baf9253d1c96b8f2916b925ce47b1dc6c6784105b832774907a361cddb35e035c61e68dde8e2a8e285febac1c930eed3f63e73f36" name="clamtk-kde" arch="noarch">
  <version epoch="0" ver="0.20" rel="1.9"/>
  <changelog author="ecsos@opensuse.org" date="1423569600">- initial version 0.16</changelog>
  <changelog author="ecsos@opensuse.org" date="1423569601">- remove needless patch clamtk-add_searchpath.patch</changelog>
  <changelog author="ecsos@opensuse.org" date="1474545600">- update to 0.17
  * Update to KDE 5 (Github #62)
  * Update man pages with correct bug-reporting URL
  * Updated strings: Romanian (ro), English (en_AU),
    Italian (it), Korean (ko_KR)</changelog>
  <changelog author="ecsos@opensuse.org" date="1474545601">- add package for kf5</changelog>
  <changelog author="ecsos@opensuse.org" date="1508587200">- update to 0.18
  * Updated links, README.md
  * Updated strings: Afrikaans (af), Catalan (ca), Basque (eu),
    Khmer (km), Lithuanian (lt), Punjabi (pa)
  * Updated man pages (links, etc)
  * Change compression to xz</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1601553600">- Fix building Tumbleweed.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1720267200">- Update to 0.20
  * Update strings in desktop file
  * Update years -&gt; 2024
- Change to  new source url.</changelog>
</package>
<package pkgid="2aad9dab74dbee19ba39a3f4b15511751fbf2463f54c325880106f016c8b6e6aeb2f10f79706ff2b764fe8fbd88a968b3e08a79771a41efc85afa782468d56f6" name="clamtk-kde" arch="src">
  <version epoch="0" ver="0.20" rel="1.9"/>
  <changelog author="ecsos@opensuse.org" date="1423569600">- initial version 0.16</changelog>
  <changelog author="ecsos@opensuse.org" date="1423569601">- remove needless patch clamtk-add_searchpath.patch</changelog>
  <changelog author="ecsos@opensuse.org" date="1474545600">- update to 0.17
  * Update to KDE 5 (Github #62)
  * Update man pages with correct bug-reporting URL
  * Updated strings: Romanian (ro), English (en_AU),
    Italian (it), Korean (ko_KR)</changelog>
  <changelog author="ecsos@opensuse.org" date="1474545601">- add package for kf5</changelog>
  <changelog author="ecsos@opensuse.org" date="1508587200">- update to 0.18
  * Updated links, README.md
  * Updated strings: Afrikaans (af), Catalan (ca), Basque (eu),
    Khmer (km), Lithuanian (lt), Punjabi (pa)
  * Updated man pages (links, etc)
  * Change compression to xz</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1601553600">- Fix building Tumbleweed.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1720267200">- Update to 0.20
  * Update strings in desktop file
  * Update years -&gt; 2024
- Change to  new source url.</changelog>
</package>
<package pkgid="bd5c810b75d203aa6f26615daa4a6b09ae2cf9f8591d19e3099169b7ac16584646fd23b5f8e0c09a7575e7470275fe4bc32991709e25896075430beff8512cce" name="clamtk-kde-kf5" arch="noarch">
  <version epoch="0" ver="0.20" rel="1.9"/>
  <changelog author="ecsos@opensuse.org" date="1423569600">- initial version 0.16</changelog>
  <changelog author="ecsos@opensuse.org" date="1423569601">- remove needless patch clamtk-add_searchpath.patch</changelog>
  <changelog author="ecsos@opensuse.org" date="1474545600">- update to 0.17
  * Update to KDE 5 (Github #62)
  * Update man pages with correct bug-reporting URL
  * Updated strings: Romanian (ro), English (en_AU),
    Italian (it), Korean (ko_KR)</changelog>
  <changelog author="ecsos@opensuse.org" date="1474545601">- add package for kf5</changelog>
  <changelog author="ecsos@opensuse.org" date="1508587200">- update to 0.18
  * Updated links, README.md
  * Updated strings: Afrikaans (af), Catalan (ca), Basque (eu),
    Khmer (km), Lithuanian (lt), Punjabi (pa)
  * Updated man pages (links, etc)
  * Change compression to xz</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1601553600">- Fix building Tumbleweed.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1720267200">- Update to 0.20
  * Update strings in desktop file
  * Update years -&gt; 2024
- Change to  new source url.</changelog>
</package>
<package pkgid="8364743af4858195cfbc9c1f35649fc8155011c51669e69dc861bc32c94a9dd5cc78954868e53d39fbf03bf89b08c3767865f76151deb485f4f57a68e8fad163" name="clamtk-lang" arch="noarch">
  <version epoch="0" ver="6.18" rel="26.20"/>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1580731200">- Update to version 6.0.2
  * No changelog upstream
- Cleanup spec file</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1597579200">- update to 6.05:
  * Exclude Timeshift directory (Github #121)
  * Added Help button in Analysis to explain its purpose
    (Github #122)
  * Updated language files: English (en_UK), Galician (gl),
    Ukrainian (uk), French (fr), Afrikans (af), Hebrew (he),
    Chinese (zh_TW)
  * Add Encrypted.PDF as clean (Github #120). Also, remove alert-
    encrypted-* options
  * Add set LC_TIME (Gitlab commit a7b3a31c)
  * More README cleanup
  * Updated language files: Dutch (nl), Afrikans (af),
    Indonesian (id), English (en_UK)
  * Bug fix affecting manual updates
  * Update year (2019 -&gt; 2020)
  * Clean up man page
  * Heuristic scanning made an option rather than a default
  * Fix icon mismatch in the Scheduler
  * Fix icon glitch in Update
  * Updated language files: English (en_UK), Indonesian (id),
    Swedish (sv) (Launchpad #1688469)</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1601035200">- update to 6.06:
  * Fix for 'Show Hidden Files' checkbox automatically
  * Remove env from clamtk startup for correct
    dependency detection (rpmlint)
  * Minor language updates to desktop file
  * Updated language files: Japanese (ja), English (en_AU),
    Mon (mnw_MM), Finnish (fi), Malay (ms)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1613131200">- Update to version 6.07:
  + Update to look for additional information during update to know
    when finished.
  + Update dates to 2021.
- Add 0001-Do-not-inject-no-separator-into-window-decoration.patch:
  Do not add no-separator to window decoration (boo#1182151).</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1619524800">- Update to version 6.11:
  * Clamtk and Clamav do not update automatically
  * Add appdata.xml file
  * Remove code referencing old repo.
  * Bug: app doesn't scan files/folders on demand
  * Bug: Do not inject 'no-separator' into window decoration
  * Add --alert-broken-media option for versions &gt;= 103.1
  * Remove older repo (clamtk-gtk3), use clamtk only
- Remove 0001-Do-not-inject-no-separator-into-window-decoration.patch</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1628078400">- Update to version 6.13:
  * Fixes for appdata.xml
  * Partially work Github #129 (engine version, date of sigs, title)
  * Update translations in clamtk.desktop</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to version 6.14
  * Fix for context-menu scanning image issues</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1686657600">- Update to version 6.16
  * Fix for Virustotal privacy warning before upload or sending file hash only
  * Remove (hopefully) no longer needed lines; improve a few others (Scan.pm)
  * Updated language files: Dutch (nl)
  * Update README and site links for updated GPG key
- Update to version 6.15
  * Fix for Unable to delete previous analysis result
  * Updated language files: Indonesian (id), Swedish (sv), German (de), Chinese (zh_CN), Burmese (my)
  * Fix to German language string in clamtk.desktop
  * Update DISCLAIMER to use markdown (DISCLAIMER.md)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1720612800">- Update to 6.18:
  * Remove unnecessary line from #154 fix in App.pm
  * Change default clamtk user directory to .config/clamtk (Github #161)
  * Fix for scanned directories not showing in logs
  * Update App.pm to support $XDG_CONFIG_HOME environnement variable (Github #154)</changelog>
</package>
<package pkgid="b0db06f16f174a987e1049dbf85147d0e9671c4ab46d22c289a7a4d28cbd262c94de0fe58e207a212812c804e0e10882f17fd8997e27920c750e843928e25a48" name="clevis" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="9cb98ba9e88438aa60a532c67fb6c6fcf1a210f182edc742a93e8f7e749c1941de5ac89e5be4695564c2a27a1556d5a2e64f7833c91fdede37470bfcfc212ad8" name="clevis" arch="src">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="530257e37d7563017ebb568c4c3139988f498b910e42343a8e36a9afd0336369ceb901d86043e2dc14d17a31a3259ad5a7e70e43c0dd6978a253657f50e6420c" name="clevis-bash-completion" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="ed52f43b274c4b261faef65328ad1ab494fddf7acff5bde11b0c47de7b3d0e3264093696d2b8426a18eef5c68bdf0220673aba6be9b56f87d8c539e3eff7503f" name="clevis-debuginfo" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="1b891b8239c400e48928453f5e263800f9cb36bfd302d59d8f3fbc17c65702951737dfee87b67ec34fcd2f2f872c6b1e600fd298e566c3184af312be042bd826" name="clevis-debugsource" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="0f57aca18b9f2186b5bc54ab410302d47f16e18e9474bf3b81be514a259f63573e1a4a5c7eff41d56de0f644ac2a526a910f800afaa2d6be86a3e3d417af17af" name="clevis-dracut" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="cb5c1e983c8d594f11cd293a244a89f713aabc7ee59fa715782e7cdaa9b18459a1d22ba97e0a4f31da72d50b194248285ef0e743e98d94856333a9b60e17bd4b" name="clevis-luks" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="5098233ceef2bfd301fddd51c75eeec013ab1e351d65d5fa03c39b19525b549a75778787b578b1ed0ddc8328df0d234586d3b01ad4a819ffbb28e9dd876dff55" name="clevis-pin-pkcs11" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="2cfe2293d1eeae3653ea203334f2658e7ec87db0ab6d97e80d4840d1faebae4e57de8d3aa4787ca1a2a343e17cf6730f3797870493299887a75b95680b783718" name="clevis-pin-pkcs11-debuginfo" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="41286a3e08fa73e86b34ded91c2cbf1e233bb10187558f177c6fda89bdd941bf503b98cc25c1358f1c5208255f63e8abdba5d9621b23bfd24f9aaae8d29aad7a" name="clevis-pin-sss" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="f22b4768bb6d633181009a8e069282b723267f1c1065a09ba69730bb7730d5bbbca04faae0e29512e7f15396f878fd471f29fa50519882df944243d930349a64" name="clevis-pin-sss-debuginfo" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="ce183a21245806f0f9c67b65587905ab98c1ed02fc215cd13db7a134f5e20f0e34d908479fa5df612830bd5846078ce0dd561765068333f25dcdf6871d97c331" name="clevis-pin-tang" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="c7e8c64606b8b7b706fc29464d09b15a219d84d89d02daa9f248b4045dab1dbb956f1ffbbb2069b24de9f6eb01dc1c467ccefd49a6e6f7e8c706f8eda6715800" name="clevis-pin-tpm2" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="4a9843d79b73f326b20c99d240ec7f38232d76a249e714d99be69f619f254c2742fc28985b0d3c6fc7e4ee930706286ed8952f0712e346b048060b4e19a8cda4" name="clevis-systemd" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="bef918f954643b87f5868ff24be3c04a05d51bdab247a37819a4f0a70505d2dd95e6457690734ae7e31d5da869b4e76ccf4acd7024df7bf3459e2182ff4022fc" name="clevis-udisks2" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="889dbd178a4f1f6f8fceb647acc44399fb6279b626b7078c5ec5858347949b1cde9a719fd0c135a3ecac3f48b1cfd41b38e78b3bb070a2c23114904a99a27be7" name="clevis-udisks2-debuginfo" arch="s390x">
  <version epoch="0" ver="21" rel="8.11"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1673956800">- ship clevis v18, a unattended disk encryption unlocker, via either
  a server or TPM2. (jsc#PED-3009, jsc#PM-3627, jsc#PM-2793)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- updated to v19
  - Add external token id for existing passphrase (71869cb)
  - luks-edit: remove unnecessary 2&gt;/dev/null (6e48a1c)
  - Avoid invalid message for clevis command (3f879a3)
  - Notify error url on server connect fail (f5786d3)
  - Improve boot performance by removing key check (47b01ab)
  - systemd: account for unlocking failures in clevis-luks-askpass (92b09c9)
  - luks: enable debugging in clevis scripts when rd.debug is set (8c9e020)
  - luks: explicitly specify pbkdf iterations to cryptsetup (7159630)
  - tpm2: improve validation of PCRs in clevis-encrypt-tpm2 (4eb1980)
  - luks: define max entropy bits for pwmake (3bb852b)
  - luks: ignore empty &amp; comment lines in crypttab (0589c14)
  - Avoid luksmeta corruption on clevis bind (d8a25e3)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1684756800">- drop ncat requirement from clevis-systemd (boo#1211580)</changelog>
  <changelog author="Enrico Belleri &lt;kilgore.trout@idesmi.eu&gt;" date="1745064000">- Create packages:
  * clevis-pin_tpm2
  * clevis-pin_pkcs11
  * clevis-pin-sss
  * clevis-pin-tang
- Add 0002-find-pcscd.patch
- Update to version 21:
  * [EXPERIMENTAL] Add PKCS#11 pin basic functionality (5b07e40)
  * Ensure dnf builddep is installed in Fedora (#466) (2b34226)
  * udisks2: check for EINTR when reading in recover_key() (4c6d5d9)
  * udisks2: check if variables are NULL before calling unref (eea777f)
  * Fix README.md to include tang https configuration (#175) (#417) (4bddd5e)
  * Prevent Address in use error (601d0a9)
  * Fedora test build fix (3420001)
  * luks/udisks2: explicitly NULL-terminate buffer (251a888)
  * pins/sss: intialize variable before use (0938231)
  * Fix DNS resolution in initramfs (#367) (bebb037)
  * Upgrade checkout version (v3-&gt;v4) (#452) (ea7a8e1)
  * Fix killing of child process of clevisloop (c03dbf3)
  * Added language and misspell check for markdown files (#439) (fee1db3)
  * luks: decouple dracut from systemd unlocker (afe91eb)
  * luks: move dracut out of systemd directory (cfefdde)
  * Include manual compilation steps (#433) (ec16c7a)
  * Avoid execution of Github actions for Markdown (#427) (c9f2066)
  * Upgrade version for checkout Github action (#429) (4764b66)
  * Fix README.md to include "tang" pin (#424) (3add946)
  * Use jose, not pwmake, for password generation (#418) (4d23eda)
  * Use quay.io version of Fedora Rawhide container (#425) (bf9e1cd)
  * Add bash syntax highlighting to README.md (#414) (7c23279)
  * Fix README.md to include correct sss example (#409) (eb92459)
  * Fix Github actions by using latest ubuntu distro (#411) (c1a8aff)
  * documenting parameter to pass args to cryptsetup (96726a2)
  * initial test of passing args to 'crypsetup open' (0666b88)
  * passing args to 'crypsetup open'</changelog>
</package>
<package pkgid="906d2d0b535ed0527e3e84ef6b0842e9973eb61fcfcc5bbb57860fa1d97918b7a12c32e443f4fa493eae57826246c51ccf5f35927c1943983584be1f0ca1404d" name="corkscrew" arch="s390x">
  <version epoch="0" ver="2.0" rel="2.29"/>
  <changelog author="Pascal Bleser &lt;pascal.bleser@opensuse.org&gt;" date="1254830400">* new package, version 2.0</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1494936000">* fix compilation/installing problem
  * cleanup spec file</changelog>
</package>
<package pkgid="07f743541cbfe52611b76dce5182cc97d94cefa6e9e13d0ea955a8b082fc348d9d24368e719c19b16724d4f18d2bc4763368d8813cd1874c48d42607db508b1c" name="corkscrew" arch="src">
  <version epoch="0" ver="2.0" rel="2.29"/>
  <changelog author="Pascal Bleser &lt;pascal.bleser@opensuse.org&gt;" date="1254830400">* new package, version 2.0</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1494936000">* fix compilation/installing problem
  * cleanup spec file</changelog>
</package>
<package pkgid="8d6b4ca17e1a5bdc7da11d6e8e45a600a12d41c52d46f4c78bcd604ee92e93d9781f4286dd15f42b0bd0cf5c3c0ee53c44618842e54441474334f14cb58556f6" name="corkscrew-debuginfo" arch="s390x">
  <version epoch="0" ver="2.0" rel="2.29"/>
  <changelog author="Pascal Bleser &lt;pascal.bleser@opensuse.org&gt;" date="1254830400">* new package, version 2.0</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1494936000">* fix compilation/installing problem
  * cleanup spec file</changelog>
</package>
<package pkgid="222019e0cfe4acc00c20b4dca50217e887c390103a716cb82ca736187f7fd0a339bffb8fa82454d35cdc9f06b9a2d528c8edc9ee5efaa0325e7c645315d540ad" name="corkscrew-debugsource" arch="s390x">
  <version epoch="0" ver="2.0" rel="2.29"/>
  <changelog author="Pascal Bleser &lt;pascal.bleser@opensuse.org&gt;" date="1254830400">* new package, version 2.0</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1494936000">* fix compilation/installing problem
  * cleanup spec file</changelog>
</package>
<package pkgid="0c0bc563effe293d3041e6a98444ad0e3414dbe744c5a385d391942c66dd073a31804d54ae31056a65e0b9fa1a456fe4756564f455e6d375da7ffc0ad480e1e1" name="cosign" arch="s390x">
  <version epoch="0" ver="3.1.2" rel="76.2"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1699358400">- updated to 2.2.1 (jsc#SLE-23879)
  This release comes with a fix for
  CVE-2023-46737 / bsc#1216933 described in this [Github Security
  Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9).
  Enhancements:
  * feat: Support basic auth and bearer auth login to registry (#3310)
  * add support for ignoring certificates with pkcs11 (#3334)
  * Support ReplaceOp in Signatures (#3315)
  * feat: added ability to get image digest back via triangulate (#3255)
  * feat: add `--only` flag in `cosign copy` to copy sign, att &amp; sbom (#3247)
  * feat: add support attaching a Rekor bundle to a container (#3246)
  * feat: add support outputting rekor response on signing (#3248)
  * feat: improve dockerfile verify subcommand (#3264)
  * Add guard flag for experimental OCI 1.1 verify. (#3272)
  * Deprecate SBOM attachments (#3256)
  * feat: dedent line in cosign copy doc (#3244)
  * feat: add platform flag to cosign copy command (#3234)
  * Add SLSA 1.0 attestation support to cosign. Closes #2860 (#3219)
  * attest: pass OCI remote opts to att resolver. (#3225)
  Bug Fixes:
  * Merge pull request from GHSA-vfp6-jrw2-99g9
  * fix: allow cosign download sbom when image is absent (#3245)
  * ci: add a OCI registry test for referrers support (#3253)
  * Fix ReplaceSignatures (#3292)
  * Stop using deprecated in_toto.ProvenanceStatement (#3243)
  * Fixes #3236, disable SCT checking for a cosign verification when usin… (#3237)
  * fix: update error in `SignedEntity` to be more descriptive (#3233)
  * Fail timestamp verification if no root is provided (#3224)
  Documentation:
  * Add some docs about verifying in an air-gapped environment (#3321)
  * Update CONTRIBUTING.md (#3268)
  * docs: improves the Contribution guidelines (#3257)
  * Remove security policy (#3230)
  Others:
  * Set go to min 1.21 and update dependencies  (#3327)
  * Update contact for code of conduct (#3266)
  * Update .ko.yaml (#3240)</changelog>
  <changelog author="Marcos Bjoerkelund &lt;marcos.bjoerkelund@suse.com&gt;" date="1702382400">- updated to 2.2.2 (jsc#SLE-23879)
  v2.2.2 adds a new container with a shell,
  gcr.io/projectsigstore/cosign:vx.y.z-dev, in addition to the existing
  container gcr.io/projectsigstore/cosign:vx.y.z without a shell.
  For private deployments, we have also added an alias for
  - -insecure-skip-log, --private-infrastructure.
  Bug Fixes:
  * chore(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#3411) which fixes a bug with using Azure KMS
  * Don't require CT log keys if using a key/sk (#3415)
  * Fix copy without any flag set (#3409)
  * Update cosign generate cmd to not include newline (#3393)
  * Fix idempotency error with signing (#3371)
  Features:
  * Add --yes flag cosign import-key-pair to skip the overwrite confirmation. (#3383)
  * Use the timeout flag value in verify* commands. (#3391)
  * add --private-infrastructure flag (#3369)
  Container Updates:
  * Bump builder image to use go1.21.4 and add new cosign image tags with shell (#3373)
  Documentation:
  * Update SBOM_SPEC.md (#3358)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1706875200">- updated to 2.2.3 (jsc#SLE-23879)
  Bug Fixes:
  * Fix race condition on verification with multiple signatures attached to image (#3486)
  * fix(clean): Fix clean cmd for private registries (#3446)
  * Fixed BYO PKI verification (#3427)
  Features:
  * Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
  * Add support for OpenVEX predicate type (#3405)
  Documentation:
  * Resolves #3088: `version` sub-command expected behaviour documentation and testing (#3447)
  * add examples for cosign attach signature cmd (#3468)
  Misc:
  * Remove CertSubject function (#3467)
  * Use local rekor and fulcio instances in e2e tests (#3478)
- bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1713182400">- updated to 2.2.4 (jsc#SLE-23879)
  * Bug Fixes
  * Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  - CVE-2024-29902: Malicious attachments can cause system-wide denial of service (bsc#1222835)
  - CVE-2024-29903: Malicious artifects can cause machine-wide denial of service (bsc#1222837)
  * ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  * fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  * Honor creation timestamp for signatures again (#3549)
  * Features
  * Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)
  * Documentation
  * add oci bundle spec (#3622)
  * Correct help text of triangulate cmd (#3551)
  * Correct help text of verify-attestation policy argument (#3527)
  * feat: add OVHcloud MPR registry tested with cosign (#3639)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717156800">- add completion subpackages (bash, fish, zsh)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1721822400">- update to 2.3.0 (jsc#SLE-23879)
  * Features
  - Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface (#3693)
  - add registry options to cosign save (#3645)
  - Add debug providers command. (#3728)
  - Make config layers in ociremote mountable (#3741)
  - adds tsa cert chain check for env var or tuf targets. (#3600)
  - add --ca-roots and --ca-intermediates flags to 'cosign verify' (#3464)
  - add handling of keyless verification for all verify commands (#3761)
  * Bug Fixes
  - fix: close attestationFile (#3679)
  - Set bundleVerified to true after Rekor verification (Resolves #3740) (#3745)
  * Documentation
  - Document ImportKeyPair and LoadPrivateKey functions in pkg/cosign (#3776)</changelog>
  <changelog author="Sarah Kriesch &lt;sarah.kriesch@opensuse.org&gt;" date="1724155200">- Set CGO_ENABLED=1 for fixing s390x failed build</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1727870400">- update to 2.4.0 (jsc#SLE-23879)
  - Add new bundle support to verify-blob and verify-blob-attestation (#3796)
  - Adding protobuf bundle support to sign-blob and attest-blob (#3752)
  - Bump sigstore/sigstore to support email_verified as string or boolean (#3819)
  - Conformance testing for cosign (#3806)
  - move incremental builds per commit to GHCR instead of GCR (#3808)
  - Add support for recording creation timestamp for cosign attest (#3797)
  - Include SCT verification failure details in error message (#3799)</changelog>
  <changelog author="meissner@suse.com" date="1738756800">- Update to version 2.4.2:
  - Updated open-policy-agent to 1.1.0 library (#4036)
  - Note that only Rego v0 policies are supported at this time
  - Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
  - Add support for verifying root checksum in cosign initialize (#3953)
  - Detect if user supplied a valid protobuf bundle (#3931)
  - Add a log message if user doesn't provide --trusted-root (#3933)
  - Support mTLS towards container registry (#3922)
  - Add bundle create helper command (#3901)
  - Add trusted-root create helper command (#3876)
  Bug Fixes:
  - fix: set tls config while retaining other fields from default http transport (#4007)
  - policy fuzzer: ignore known panics (#3993)
  - Fix for multiple WithRemote options (#3982)
  - Add nightly conformance test workflow (#3979)
  - Fix copy --only for signatures + update/align docs (#3904)
- use "osc service mr" to update</changelog>
  <changelog author="meissner@suse.com" date="1740052800">- Update to version 2.4.3:
  * Enable fetching signatures without remote get. (#4047)
  * Bump sigstore/sigstore to support KMS plugins (#4073)
  * sort properly Go imports (#4071)
  * sync comment with parameter name in function signature (#4063)
  * fix go imports order to be alphabetical (#4062)
  * fix comment typo and imports order (#4061)
  * Feat/file flag completion improvements (#4028)
  * Udpate builder to use go1.23.6 (#4052)
  * Refactor verifyNewBundle into library function (#4013)
  * fix parsing error in --only for cosign copy (#4049)
  * Fix codeowners syntax, add dep-maintainers (#4046)</changelog>
  <changelog author="meissner@suse.com" date="1744545600">- Update to version 2.5.0:
  * Update sigstore-go to pick up bug fixes (#4150)
  * Update golangci-lint to v2, update golangci-lint-action (#4143)
  * Feat/non filename completions (#4115)
  * update builder to use go1.24.1 (#4116)
  * Add support for new bundle specification for attesting/verifying OCI image attestations (#3889)
  * Remove cert log line (#4113)
  * cmd/cosign/cli: fix typo in ignoreTLogMessage (#4111)
  * bump to latest scaffolding release for testing (#4099)
  * increase 2e2_test docker compose tiemout to 180s (#4091)
  * Fix replace with compliant image mediatype (#4077)
  * Add TSA certificate related flags and fields for cosign attest (#4079)
- Security issues fixed:
  - CVE-2024-6104: cosign: hashicorp/go-retryablehttp: url might write sensitive information to log file (bsc#1227031)
  - CVE-2024-51744: cosign: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232985)
  - CVE-2025-27144: cosign: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237682)
  - CVE-2025-22870: cosign: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238693)
  - CVE-2025-22868: cosign: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239204)
  - CVE-2025-22869: cosign: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239337)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1748433600">- switch to go1.24, enable fips build</changelog>
  <changelog author="meissner@suse.com" date="1752840000">- Update to version 2.5.3 (jsc#SLE-23879)
  - Add signing-config create command (#4280)
  - Allow multiple services to be specified for trusted-root create (#4285)
  - force when copying the latest image to overwrite (#4298)
  - Fix cert verification logic for trusted-root/SCTs (#4294)
  - Fix lint error for types package (#4295)
  - feat: Add OCI 1.1+ experimental support to tree (#4205)
  - Add validity period end for trusted-root create (#4271)
  - avoid double-loading trustedroot from file (#4264)
- Update to 2.5.2:
  - Do not load trusted root when CT env key is set
  - docs: improve doc for --no-upload option (#4206)
- Update to 2.5.1:
  * Features
  - Add Rekor v2 support for trusted-root create (#4242)
  - Add baseUrl and Uri to trusted-root create command
  - Upgrade to TUF v2 client with trusted root
  - Don't verify SCT for a private PKI cert (#4225)
  - Bump TSA library to relax EKU chain validation rules (#4219)
  * Bug Fixes
  - Bump sigstore-go to pick up log index=0 fix (#4162)
  - remove unused recursive flag on attest command (#4187)
  * Docs
  - Fix indentation in verify-blob cmd examples (#4160)
  * GO-2025-3660/ CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego (bsc#1246725)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1758196800">- Update to version 2.6.0:
  - Require exclusively a SigningConfig or service URLs when signing (#4403)
  - Add a terminal spinner while signing with sigstore-go (#4402)
  - Bump sigstore-go, support alternative hash algorithms with keys (#4386)
  - Add support for SigningConfig in sign/attest (#4371)
  - Support self-managed keys when signing with sigstore-go (#4368)
  - Remove SHA256 assumption in sign-blob/verify-blob (#4050)
  - introduce dockerfile to pin the go version to decouple go version from go.mod (#4369)
  - refactor: extract function to write referrer attestations (#4357)
  - Break import cycle with e2e build tag (#4370)
  - Update conformance test binary for signing config (#4367)
  - update builder image to use go1.25 (#4366)
  - Don't load content from TUF if trusted root path is specified (#4347)
  - Don't require timestamps when verifying with a key (#4337)
  - Fixes to cosign sign / verify for the new bundle format (#4346)
  - update builder to use go1.24.6 (#4334)
  - bump golangci-lint to v2.3.x (#4333)
  - Have cosign sign support bundle format (#4316)
  - Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
  - Verify subject with bundle only when checking claims (#4320)
  - Add to `attest-blob` the ability to supply a complete in-toto statement, and add to `verify-blob-attestation` the ability to verify with just a digest (#4306)</changelog>
  <changelog author="meissner@suse.com" date="1765368000">- Update to version 3.0.3:
  * 4554: Closes 4554 - Add warning when --output* is used (#4556)
  * chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542)
  * chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543)
  * chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546)
  * chore(deps): bump the actions group with 4 updates (#4544)
  * chore(deps): bump the gomod group across 1 directory with 5 updates (#4567)
  * chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568)
  * update builder to use go1.25.5 (#4566)
  * Protobuf bundle support for subcommand `clean` (#4539)
  * Add staging flag to initialize with staging TUF metadata
  * update slack invite link (#4560)
  * Updating sign-blob to also support signing with a certificate (#4547)
  * Bump sigstore library dependencies (#4532)
  * Protobuf bundle support for subcommands `save` and `load` (#4538)
  * Fix cert attachment for new bundle with signing config
  * Fix OCI verification with local cert - old bundle
  * chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519)
  * chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535)
  * chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536)
  * CVE-2025-58181: Fixed golang.org/x/crypto/ssh: invalidated number
    of mechanisms can cause unbounded memory consumption (bsc#1253913)
  * update go builder and cosign (#4529)
  * chore(deps): bump the gomod group across 1 directory with 7 updates (#4528)
  * chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520)
  * chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515)
  * chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518)
  * chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10.1 (#4521)
  * chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502)
  * chore(deps): bump the actions group across 1 directory with 2 updates (#4516)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111.0 (#4523)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4522)
  * Deprecate tlog-upload flag (#4458)
  * fix: Use signal context for `sign` cli package.
  * update offline verification directions (#4526)
  * Fix signing/verifying annotations for new bundle
  * Add support to download and attach for protobuf bundles (#4477)
  * Add --signing-algorithm flag (#3497)
  * Refactor signcommon bundle helpers
  * Add --bundle and fix --upload for new bundle
  * Pass insecure registry flags through to referrers
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109.1 (#4483)
  * Add protobuf bundle support for tree subcommand (#4491)
  * Remove stale embed import (#4492)
  * Support multiple container identities
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4484)
  * chore(deps): bump chainguard-dev/actions in the actions group (#4480)
  * chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4485)
  * chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#4486)
  * chore(deps): bump cuelang.org/go in the gomod group (#4479)
  * upgrade OSS-Fuzz build tooling (#4487)
  * Fix segfault when no attestations are found (#4472)
  * Use overridden repository for new bundle format (#4473)
  * update go to 1.25.3 (#4471)
  * Remove --out flag from `cosign initialize` (#4462)
  * chore(deps): bump the actions group with 2 updates (#4460)
  * Deprecate offline flag (#4457)
  * Deduplicate code in sign/attest* and verify* commands (#4449)
  * Cache signing config when calling initialize (#4456)
  * Update changelog for v3.0.2 (#4455)
  * chore(deps): bump google.golang.org/api from 0.250.0 to 0.251.0
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go
  * chore(deps): bump the actions group with 3 updates
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.107.2 to 3.108.0
  * choose different signature filename for KMS-signed release signatures (#4448)
  * chore(deps): bump github.com/go-jose/go-jose/v4 (#4451)
  * Update rekor-tiles version path
  * update CL for v3.0.1 release (#4447)
  * update goreleaser config for v3.0.0 release (#4446)
  * Create changelog for v3.0.0 (#4440)
  * Fetch service URLs from the TUF PGI signing config by default (#4428)
  * Create changelog for v2.6.1 (#4439)
  * chore(deps): bump google.golang.org/api from 0.249.0 to 0.250.0 (#4432)
  * chore(deps): bump the gomod group with 2 updates (#4429)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.8.0 to 1.9.0 (#4433)
  * chore(deps): bump the actions group with 3 updates (#4434)
  * chore(deps): bump github.com/go-openapi/swag from 0.24.1 to 0.25.1 (#4435)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4436)
  * chore(deps): bump github.com/go-openapi/runtime from 0.28.0 to 0.29.0 (#4437)
  * Bump module version to v3 for Cosign v3.0 (#4427)
  * Move sigstore-conformance back to tagged release (#4425)
  * Bump sigstore-go to v1.1.3 (#4423)
  * Partially populate the output of cosign verify when working with new bundles (#4416)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4419)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4418)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.105.0 to 3.107.0 (#4420)
  * chore(deps): bump chainguard-dev/actions in the actions group (#4421)
  * bump go builder to use 1.25.1 and cosign (#4417)
  * Bump sigstore-go for more precise user agents (#4413)
  * chore(deps): bump github.com/spf13/viper from 1.20.1 to 1.21.0 (#4408)
  * chore(deps): bump the actions group with 2 updates (#4407)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4410)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.104.0 to 3.105.0 (#4411)
  * Default to using the new protobuf format (#4318)</changelog>
  <changelog author="meissner@suse.com" date="1770811200">- Update to version 3.0.4:
  * CVE-2025-11065: Fixed github.com/go-viper/mapstructure/v2: sensitive
    Information leak in logs (bsc#1250620)
  * CVE-2026-22703: Fixed that cosign verification accepts any valid
    Rekor entry under certain conditions (bsc#1256496)
  * Fix bundle verify path for old bundle/trusted root (#4623)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616)
  * chore(deps): bump cuelang.org/go in the gomod group (#4615)
  * Optimize cosign tree performance by caching digest resolution (#4612)
  * Don't require a trusted root to verify offline with a key (#4613)
  * Support default services for trusted-root and signing-config creation (#4592)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602)
  * chore(deps): bump github.com/sigstore/sigstore-go (#4578)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601)
  * chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611)
  * chore(deps): bump k8s.io/client-go from 0.34.3 to 0.35.0 (#4604)
  * chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588)
  * chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586)
  * chore(deps): bump the gomod group with 5 updates (#4599)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600)
  * chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584)
  * chore(deps): bump the actions group with 3 updates (#4587)
  * chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589)
  * chore(deps): bump the gomod group with 9 updates (#4577)</changelog>
  <changelog author="meissner@suse.com" date="1771761600">- Update to version 3.0.5: (jsc#SLE-23879)
  * CVE-2026-24122: Fixed improper validation of certificates that
    outlive expired CA certificates (bsc#1258542)
  * CVE-2026-26958: Fixed filippo.io/edwards25519: failure to initialize
    receiver in MultiScalarMult can produce invalid results and lead to
    undefined behavior (bsc#1258612)
  * CVE-2026-24137: Fixed github.com/sigstore/sigstore/pkg/tuf: legacy
    TUF client allows for arbitrary file writes with target cache path
    traversal (bsc#1257139)
  * CVE-2026-22772: Fixed github.com/sigstore/fulcio: bypass MetaIssuer
    URL validation bypass can trigger SSRF to arbitrary internal services
    (bsc#1256562)
  * CVE-2026-23991: Fixed github.com/theupdateframework/go-tuf/v2: denial
    of service due to invalid TUF metadata JSON returned by TUF repository
    (bsc#1257080)
  * CVE-2026-23992: Fixed github.com/theupdateframework/go-tuf/v2:
    unauthorized modification to TUF metadata files due to a compromised
    or misconfigured TUF repository (bsc#1257085)
  * chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679)
  * chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670)
  * chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680)
  * chore(deps): bump the gomod group across 1 directory with 4 updates (#4702)
  * chore(deps): bump the actions group with 3 updates (#4703)
  * update golang builder to use go1.25.7 (#4687)
  * update golangci-lint to v2.8.x (#4688)
  * Fix typo in CLI help (#4701)
  * Support DSSE signing conformance test (#4685)
  * chore(deps): bump the actions group across 1 directory with 8 updates (#4689)
  * Deprecate rekor-entry-type flag (#4691)
  * Deprecate cosign triangulate (#4676)
  * Deprecate cosign copy (#4681)
  * Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668)
  * chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673)
  * Automatically require signed timestamp with Rekor v2 entries (#4666)
  * Fix syntax issue in conformance test, update nightly (#4664)
  * Add mTLS support for TSA client connections when signing with a signing config (#4620)
  * fix: avoid panic on malformed tlog entry body (#4652)
  * Verify validity of chain rather than just certificate (#4663)
  * Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
  * chore(deps): bump the gomod group across 1 directory with 3 updates (#4662)
  * Bump sigstore/sigstore to resolve GHSA (#4660)
  * Gracefully fail if bundle payload body is not a string (#4648)
  * fix: avoid panic on malformed replace payload (#4653)
  * chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659)
  * fix: avoid panic on malformed attestation payload (#4651)
  * fix: avoid panic on malformed tlog entries (#4649)
  * Update conformance to latest
  * docs(cosign): clarify RFC3161 revocation semantics (#4642)
  * Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
  * chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637)
  * Add origin key for ctfe trusted root
  * Add changelog updates for v3.0.4 and v2.6.2 (#4625)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778587200">- update to 3.0.6 (bsc#1261859, CVE-2026-39395):
  * Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801)
  * Handle whitespace-only certificate annotation (#4760)
  * fix(sign): closing SignerVerifier too early when signing with
    a security key (#4761)
  * Disallow --new-bundle-format and --rfc3161-timestamp (#4762)
  * support managed keys in conformance testing (#4728)
  * Add support for GCE metadata server env var (#4732)
  * fix: preserve per-layer annotations in
    WriteAttestationsReferrer (#4709)
  * Fix parsing of in-toto for string predicates
  * Mark batch of flags for deprecation (#4698)
  * disallow key and cert identity being used together
    during verification (#4636)
  * support key creation in GitLab group (#4704)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1783425600">- update to 3.1.1 (bsc#1267044,
  CVE-2026-25680,CVE-2026-42502,
  CVE-2026-27136,CVE-2026-25681,CVE-2026-42506,
  bsc#1266049, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829,
  CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833,
  CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595,
  CVE-2026-46597, CVE-2026-46598,
  bsc#1261811, CVE-2026-33815):
  * This release deprecates a number of flags related to
    verification material input for trust root material, as well
    as the bundle format, standardized across Sigstore SDKs,
    which is now the default output and input for signing and
    verifying respectively. You may continue to use the
    deprecated flags with Cosign v3.x releases. The deprecated
    flags will be removed in a future Cosign v4 release.
  * This release also updates the signing path for logging to
    Rekor v2. DSSE attestations will be logged as hashed entries,
    using the DSSE's pre-auth encoding (PAE). This should unblock
    developers who want to upload large signed DSSEs such as
    SBOMs.
  * Initialize PKCS11 slots Before Getting Token Info in
  * Sign exclusively via sigstore-go in
  * bundle create: Prevent IgnoreTlog when bundle contains SET in
  * Require bundle output or registry upload in
  * fix(load): pass NameOptions to name.ParseReference in
  * fix: honor --digestAlg when hashing a blob in verify-blob-
    attestation in https://github.com/sigstore/cosign/pull/4813
  * Deprecate Flags for v4: Certificates in
  * Deprecate flags signing config in
  * Deprecate flags bundle in
  * Fix typo in map of verify command fields unsupported for new
    bundle format in https://github.com/sigstore/cosign/pull/4853
  * Add bundle upgrade command in
  * Deprecate Flags for v4 in
  * fix: close file descriptor leaked in
    WriteSignedImageIndexImages loop in
  * fix: use Header.Set to prevent duplicate Authorization on
    retry in https://github.com/sigstore/cosign/pull/4870
  * feat(cli): add Rekor v2 flag to cosign signing-config create
  * Fix crash verifying timestamps when no timestamp was verified
  * Deprecate Flags for v4: OCI Referrers in
  * Use the configured Target Repository more consistently in
  * fix: check HTTP status code in LoadFileOrURL in
  * Fix unsafe type assertion in Rego policy evaluation by in
  * Fix Ed25519ph check to respect custom signing configs in
    sign-blob in https://github.com/sigstore/cosign/pull/4880
  * Enable initialize command output in conformance in
  * verify: return TUF errors for new bundle trusted roots in
  * Deprecate subcommands in
  * Remove docstring references to deprecated flags in
  * fix(verify): Attach detached certificates to static
    signatures via wrapped verifier in
  * fix(verify): copy CheckOpts inside VerifyNewBundle to fix
    data race in https://github.com/sigstore/cosign/pull/4917
  * Update sigstore-go to v1.2.0 in
  * **Full Changelog**:
    https://github.com/sigstore/cosign/compare/v3.0.6...v3.1.1</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1784289600">- updated to 3.1.2
  [#]# Deprecations
  * Deprecate --payload for sign and verify commands (#4991)
  [#]# Features
  * docs: add OVHcloud KMS in available external plugins (#4962)
  * Add insecure registry flag to ko publish in kind-verify-attestation workflow (#4970)
  * Deprecate --output-attestation (#4958)
  * Add bundle inspect command (#4842)
  [#]# Fixes
  * Guard against empty certificate PEM in mutate.Signature (#4998)
  * fix(download): Validate predicate type for new bundle format
  * Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
  * Fix Makefile: fall back to "unknown" version info when built outside a git repo (#5000)
  * fix(verify): skip identity validation for security keys (#5012)
  * fix: include artifactType in OCI 1.1 signature referrer manifest
  * Allow attestation download to handle both bundle types (#4996)
  * Fix panic in dockerfile verify on malformed FROM lines (#4979)
  * fix(release): restore signing-step auth and fail on image signing errors (#4978)
  * feat(signing-config): add --base-config flag to override services from base config (#4977)
  * fix: pass NewBundleFormat to KeyOpts in sign command (#4981)
  * fix: ignore build stage references in dockerfile verify (#4961)
  * fix: allow '=' in annotation values (#4957)
  [#]# Cleanup
  * Remove unused policy evaluation code (#4936)
  * Remove unused signing code (#4918)
  * Remove unused OCI code (#4935)
  * Remove unused ephemeral signer (#4938)
  [#]# Documentation
  * feat: improve verify flag shell completions (#4965)
  * docs: fix Short style and add Example fields to piv-tool subcommands (#4942)
  * docs: add Example fields to env and bundle create commands (#4941)
  * docs: fix Short style and add Example fields to pkcs11-tool subcommands</changelog>
</package>
<package pkgid="62477aab283ad16b8f913c147dae120c2e7a84d1320e3a5fb0a301e26f1f042d45bdf58c8f1c71e9223ae87bc935efa431359ad3f50a83a9db57520ac88de1f2" name="cosign" arch="src">
  <version epoch="0" ver="3.1.2" rel="76.2"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1699358400">- updated to 2.2.1 (jsc#SLE-23879)
  This release comes with a fix for
  CVE-2023-46737 / bsc#1216933 described in this [Github Security
  Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9).
  Enhancements:
  * feat: Support basic auth and bearer auth login to registry (#3310)
  * add support for ignoring certificates with pkcs11 (#3334)
  * Support ReplaceOp in Signatures (#3315)
  * feat: added ability to get image digest back via triangulate (#3255)
  * feat: add `--only` flag in `cosign copy` to copy sign, att &amp; sbom (#3247)
  * feat: add support attaching a Rekor bundle to a container (#3246)
  * feat: add support outputting rekor response on signing (#3248)
  * feat: improve dockerfile verify subcommand (#3264)
  * Add guard flag for experimental OCI 1.1 verify. (#3272)
  * Deprecate SBOM attachments (#3256)
  * feat: dedent line in cosign copy doc (#3244)
  * feat: add platform flag to cosign copy command (#3234)
  * Add SLSA 1.0 attestation support to cosign. Closes #2860 (#3219)
  * attest: pass OCI remote opts to att resolver. (#3225)
  Bug Fixes:
  * Merge pull request from GHSA-vfp6-jrw2-99g9
  * fix: allow cosign download sbom when image is absent (#3245)
  * ci: add a OCI registry test for referrers support (#3253)
  * Fix ReplaceSignatures (#3292)
  * Stop using deprecated in_toto.ProvenanceStatement (#3243)
  * Fixes #3236, disable SCT checking for a cosign verification when usin… (#3237)
  * fix: update error in `SignedEntity` to be more descriptive (#3233)
  * Fail timestamp verification if no root is provided (#3224)
  Documentation:
  * Add some docs about verifying in an air-gapped environment (#3321)
  * Update CONTRIBUTING.md (#3268)
  * docs: improves the Contribution guidelines (#3257)
  * Remove security policy (#3230)
  Others:
  * Set go to min 1.21 and update dependencies  (#3327)
  * Update contact for code of conduct (#3266)
  * Update .ko.yaml (#3240)</changelog>
  <changelog author="Marcos Bjoerkelund &lt;marcos.bjoerkelund@suse.com&gt;" date="1702382400">- updated to 2.2.2 (jsc#SLE-23879)
  v2.2.2 adds a new container with a shell,
  gcr.io/projectsigstore/cosign:vx.y.z-dev, in addition to the existing
  container gcr.io/projectsigstore/cosign:vx.y.z without a shell.
  For private deployments, we have also added an alias for
  - -insecure-skip-log, --private-infrastructure.
  Bug Fixes:
  * chore(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#3411) which fixes a bug with using Azure KMS
  * Don't require CT log keys if using a key/sk (#3415)
  * Fix copy without any flag set (#3409)
  * Update cosign generate cmd to not include newline (#3393)
  * Fix idempotency error with signing (#3371)
  Features:
  * Add --yes flag cosign import-key-pair to skip the overwrite confirmation. (#3383)
  * Use the timeout flag value in verify* commands. (#3391)
  * add --private-infrastructure flag (#3369)
  Container Updates:
  * Bump builder image to use go1.21.4 and add new cosign image tags with shell (#3373)
  Documentation:
  * Update SBOM_SPEC.md (#3358)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1706875200">- updated to 2.2.3 (jsc#SLE-23879)
  Bug Fixes:
  * Fix race condition on verification with multiple signatures attached to image (#3486)
  * fix(clean): Fix clean cmd for private registries (#3446)
  * Fixed BYO PKI verification (#3427)
  Features:
  * Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
  * Add support for OpenVEX predicate type (#3405)
  Documentation:
  * Resolves #3088: `version` sub-command expected behaviour documentation and testing (#3447)
  * add examples for cosign attach signature cmd (#3468)
  Misc:
  * Remove CertSubject function (#3467)
  * Use local rekor and fulcio instances in e2e tests (#3478)
- bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1713182400">- updated to 2.2.4 (jsc#SLE-23879)
  * Bug Fixes
  * Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  - CVE-2024-29902: Malicious attachments can cause system-wide denial of service (bsc#1222835)
  - CVE-2024-29903: Malicious artifects can cause machine-wide denial of service (bsc#1222837)
  * ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  * fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  * Honor creation timestamp for signatures again (#3549)
  * Features
  * Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)
  * Documentation
  * add oci bundle spec (#3622)
  * Correct help text of triangulate cmd (#3551)
  * Correct help text of verify-attestation policy argument (#3527)
  * feat: add OVHcloud MPR registry tested with cosign (#3639)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717156800">- add completion subpackages (bash, fish, zsh)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1721822400">- update to 2.3.0 (jsc#SLE-23879)
  * Features
  - Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface (#3693)
  - add registry options to cosign save (#3645)
  - Add debug providers command. (#3728)
  - Make config layers in ociremote mountable (#3741)
  - adds tsa cert chain check for env var or tuf targets. (#3600)
  - add --ca-roots and --ca-intermediates flags to 'cosign verify' (#3464)
  - add handling of keyless verification for all verify commands (#3761)
  * Bug Fixes
  - fix: close attestationFile (#3679)
  - Set bundleVerified to true after Rekor verification (Resolves #3740) (#3745)
  * Documentation
  - Document ImportKeyPair and LoadPrivateKey functions in pkg/cosign (#3776)</changelog>
  <changelog author="Sarah Kriesch &lt;sarah.kriesch@opensuse.org&gt;" date="1724155200">- Set CGO_ENABLED=1 for fixing s390x failed build</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1727870400">- update to 2.4.0 (jsc#SLE-23879)
  - Add new bundle support to verify-blob and verify-blob-attestation (#3796)
  - Adding protobuf bundle support to sign-blob and attest-blob (#3752)
  - Bump sigstore/sigstore to support email_verified as string or boolean (#3819)
  - Conformance testing for cosign (#3806)
  - move incremental builds per commit to GHCR instead of GCR (#3808)
  - Add support for recording creation timestamp for cosign attest (#3797)
  - Include SCT verification failure details in error message (#3799)</changelog>
  <changelog author="meissner@suse.com" date="1738756800">- Update to version 2.4.2:
  - Updated open-policy-agent to 1.1.0 library (#4036)
  - Note that only Rego v0 policies are supported at this time
  - Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
  - Add support for verifying root checksum in cosign initialize (#3953)
  - Detect if user supplied a valid protobuf bundle (#3931)
  - Add a log message if user doesn't provide --trusted-root (#3933)
  - Support mTLS towards container registry (#3922)
  - Add bundle create helper command (#3901)
  - Add trusted-root create helper command (#3876)
  Bug Fixes:
  - fix: set tls config while retaining other fields from default http transport (#4007)
  - policy fuzzer: ignore known panics (#3993)
  - Fix for multiple WithRemote options (#3982)
  - Add nightly conformance test workflow (#3979)
  - Fix copy --only for signatures + update/align docs (#3904)
- use "osc service mr" to update</changelog>
  <changelog author="meissner@suse.com" date="1740052800">- Update to version 2.4.3:
  * Enable fetching signatures without remote get. (#4047)
  * Bump sigstore/sigstore to support KMS plugins (#4073)
  * sort properly Go imports (#4071)
  * sync comment with parameter name in function signature (#4063)
  * fix go imports order to be alphabetical (#4062)
  * fix comment typo and imports order (#4061)
  * Feat/file flag completion improvements (#4028)
  * Udpate builder to use go1.23.6 (#4052)
  * Refactor verifyNewBundle into library function (#4013)
  * fix parsing error in --only for cosign copy (#4049)
  * Fix codeowners syntax, add dep-maintainers (#4046)</changelog>
  <changelog author="meissner@suse.com" date="1744545600">- Update to version 2.5.0:
  * Update sigstore-go to pick up bug fixes (#4150)
  * Update golangci-lint to v2, update golangci-lint-action (#4143)
  * Feat/non filename completions (#4115)
  * update builder to use go1.24.1 (#4116)
  * Add support for new bundle specification for attesting/verifying OCI image attestations (#3889)
  * Remove cert log line (#4113)
  * cmd/cosign/cli: fix typo in ignoreTLogMessage (#4111)
  * bump to latest scaffolding release for testing (#4099)
  * increase 2e2_test docker compose tiemout to 180s (#4091)
  * Fix replace with compliant image mediatype (#4077)
  * Add TSA certificate related flags and fields for cosign attest (#4079)
- Security issues fixed:
  - CVE-2024-6104: cosign: hashicorp/go-retryablehttp: url might write sensitive information to log file (bsc#1227031)
  - CVE-2024-51744: cosign: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232985)
  - CVE-2025-27144: cosign: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237682)
  - CVE-2025-22870: cosign: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238693)
  - CVE-2025-22868: cosign: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239204)
  - CVE-2025-22869: cosign: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239337)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1748433600">- switch to go1.24, enable fips build</changelog>
  <changelog author="meissner@suse.com" date="1752840000">- Update to version 2.5.3 (jsc#SLE-23879)
  - Add signing-config create command (#4280)
  - Allow multiple services to be specified for trusted-root create (#4285)
  - force when copying the latest image to overwrite (#4298)
  - Fix cert verification logic for trusted-root/SCTs (#4294)
  - Fix lint error for types package (#4295)
  - feat: Add OCI 1.1+ experimental support to tree (#4205)
  - Add validity period end for trusted-root create (#4271)
  - avoid double-loading trustedroot from file (#4264)
- Update to 2.5.2:
  - Do not load trusted root when CT env key is set
  - docs: improve doc for --no-upload option (#4206)
- Update to 2.5.1:
  * Features
  - Add Rekor v2 support for trusted-root create (#4242)
  - Add baseUrl and Uri to trusted-root create command
  - Upgrade to TUF v2 client with trusted root
  - Don't verify SCT for a private PKI cert (#4225)
  - Bump TSA library to relax EKU chain validation rules (#4219)
  * Bug Fixes
  - Bump sigstore-go to pick up log index=0 fix (#4162)
  - remove unused recursive flag on attest command (#4187)
  * Docs
  - Fix indentation in verify-blob cmd examples (#4160)
  * GO-2025-3660/ CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego (bsc#1246725)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1758196800">- Update to version 2.6.0:
  - Require exclusively a SigningConfig or service URLs when signing (#4403)
  - Add a terminal spinner while signing with sigstore-go (#4402)
  - Bump sigstore-go, support alternative hash algorithms with keys (#4386)
  - Add support for SigningConfig in sign/attest (#4371)
  - Support self-managed keys when signing with sigstore-go (#4368)
  - Remove SHA256 assumption in sign-blob/verify-blob (#4050)
  - introduce dockerfile to pin the go version to decouple go version from go.mod (#4369)
  - refactor: extract function to write referrer attestations (#4357)
  - Break import cycle with e2e build tag (#4370)
  - Update conformance test binary for signing config (#4367)
  - update builder image to use go1.25 (#4366)
  - Don't load content from TUF if trusted root path is specified (#4347)
  - Don't require timestamps when verifying with a key (#4337)
  - Fixes to cosign sign / verify for the new bundle format (#4346)
  - update builder to use go1.24.6 (#4334)
  - bump golangci-lint to v2.3.x (#4333)
  - Have cosign sign support bundle format (#4316)
  - Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
  - Verify subject with bundle only when checking claims (#4320)
  - Add to `attest-blob` the ability to supply a complete in-toto statement, and add to `verify-blob-attestation` the ability to verify with just a digest (#4306)</changelog>
  <changelog author="meissner@suse.com" date="1765368000">- Update to version 3.0.3:
  * 4554: Closes 4554 - Add warning when --output* is used (#4556)
  * chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542)
  * chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543)
  * chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546)
  * chore(deps): bump the actions group with 4 updates (#4544)
  * chore(deps): bump the gomod group across 1 directory with 5 updates (#4567)
  * chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568)
  * update builder to use go1.25.5 (#4566)
  * Protobuf bundle support for subcommand `clean` (#4539)
  * Add staging flag to initialize with staging TUF metadata
  * update slack invite link (#4560)
  * Updating sign-blob to also support signing with a certificate (#4547)
  * Bump sigstore library dependencies (#4532)
  * Protobuf bundle support for subcommands `save` and `load` (#4538)
  * Fix cert attachment for new bundle with signing config
  * Fix OCI verification with local cert - old bundle
  * chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519)
  * chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535)
  * chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536)
  * CVE-2025-58181: Fixed golang.org/x/crypto/ssh: invalidated number
    of mechanisms can cause unbounded memory consumption (bsc#1253913)
  * update go builder and cosign (#4529)
  * chore(deps): bump the gomod group across 1 directory with 7 updates (#4528)
  * chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520)
  * chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515)
  * chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518)
  * chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10.1 (#4521)
  * chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502)
  * chore(deps): bump the actions group across 1 directory with 2 updates (#4516)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111.0 (#4523)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4522)
  * Deprecate tlog-upload flag (#4458)
  * fix: Use signal context for `sign` cli package.
  * update offline verification directions (#4526)
  * Fix signing/verifying annotations for new bundle
  * Add support to download and attach for protobuf bundles (#4477)
  * Add --signing-algorithm flag (#3497)
  * Refactor signcommon bundle helpers
  * Add --bundle and fix --upload for new bundle
  * Pass insecure registry flags through to referrers
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109.1 (#4483)
  * Add protobuf bundle support for tree subcommand (#4491)
  * Remove stale embed import (#4492)
  * Support multiple container identities
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4484)
  * chore(deps): bump chainguard-dev/actions in the actions group (#4480)
  * chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4485)
  * chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#4486)
  * chore(deps): bump cuelang.org/go in the gomod group (#4479)
  * upgrade OSS-Fuzz build tooling (#4487)
  * Fix segfault when no attestations are found (#4472)
  * Use overridden repository for new bundle format (#4473)
  * update go to 1.25.3 (#4471)
  * Remove --out flag from `cosign initialize` (#4462)
  * chore(deps): bump the actions group with 2 updates (#4460)
  * Deprecate offline flag (#4457)
  * Deduplicate code in sign/attest* and verify* commands (#4449)
  * Cache signing config when calling initialize (#4456)
  * Update changelog for v3.0.2 (#4455)
  * chore(deps): bump google.golang.org/api from 0.250.0 to 0.251.0
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go
  * chore(deps): bump the actions group with 3 updates
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.107.2 to 3.108.0
  * choose different signature filename for KMS-signed release signatures (#4448)
  * chore(deps): bump github.com/go-jose/go-jose/v4 (#4451)
  * Update rekor-tiles version path
  * update CL for v3.0.1 release (#4447)
  * update goreleaser config for v3.0.0 release (#4446)
  * Create changelog for v3.0.0 (#4440)
  * Fetch service URLs from the TUF PGI signing config by default (#4428)
  * Create changelog for v2.6.1 (#4439)
  * chore(deps): bump google.golang.org/api from 0.249.0 to 0.250.0 (#4432)
  * chore(deps): bump the gomod group with 2 updates (#4429)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.8.0 to 1.9.0 (#4433)
  * chore(deps): bump the actions group with 3 updates (#4434)
  * chore(deps): bump github.com/go-openapi/swag from 0.24.1 to 0.25.1 (#4435)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4436)
  * chore(deps): bump github.com/go-openapi/runtime from 0.28.0 to 0.29.0 (#4437)
  * Bump module version to v3 for Cosign v3.0 (#4427)
  * Move sigstore-conformance back to tagged release (#4425)
  * Bump sigstore-go to v1.1.3 (#4423)
  * Partially populate the output of cosign verify when working with new bundles (#4416)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4419)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4418)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.105.0 to 3.107.0 (#4420)
  * chore(deps): bump chainguard-dev/actions in the actions group (#4421)
  * bump go builder to use 1.25.1 and cosign (#4417)
  * Bump sigstore-go for more precise user agents (#4413)
  * chore(deps): bump github.com/spf13/viper from 1.20.1 to 1.21.0 (#4408)
  * chore(deps): bump the actions group with 2 updates (#4407)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4410)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.104.0 to 3.105.0 (#4411)
  * Default to using the new protobuf format (#4318)</changelog>
  <changelog author="meissner@suse.com" date="1770811200">- Update to version 3.0.4:
  * CVE-2025-11065: Fixed github.com/go-viper/mapstructure/v2: sensitive
    Information leak in logs (bsc#1250620)
  * CVE-2026-22703: Fixed that cosign verification accepts any valid
    Rekor entry under certain conditions (bsc#1256496)
  * Fix bundle verify path for old bundle/trusted root (#4623)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616)
  * chore(deps): bump cuelang.org/go in the gomod group (#4615)
  * Optimize cosign tree performance by caching digest resolution (#4612)
  * Don't require a trusted root to verify offline with a key (#4613)
  * Support default services for trusted-root and signing-config creation (#4592)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602)
  * chore(deps): bump github.com/sigstore/sigstore-go (#4578)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601)
  * chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611)
  * chore(deps): bump k8s.io/client-go from 0.34.3 to 0.35.0 (#4604)
  * chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588)
  * chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586)
  * chore(deps): bump the gomod group with 5 updates (#4599)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600)
  * chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584)
  * chore(deps): bump the actions group with 3 updates (#4587)
  * chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589)
  * chore(deps): bump the gomod group with 9 updates (#4577)</changelog>
  <changelog author="meissner@suse.com" date="1771761600">- Update to version 3.0.5: (jsc#SLE-23879)
  * CVE-2026-24122: Fixed improper validation of certificates that
    outlive expired CA certificates (bsc#1258542)
  * CVE-2026-26958: Fixed filippo.io/edwards25519: failure to initialize
    receiver in MultiScalarMult can produce invalid results and lead to
    undefined behavior (bsc#1258612)
  * CVE-2026-24137: Fixed github.com/sigstore/sigstore/pkg/tuf: legacy
    TUF client allows for arbitrary file writes with target cache path
    traversal (bsc#1257139)
  * CVE-2026-22772: Fixed github.com/sigstore/fulcio: bypass MetaIssuer
    URL validation bypass can trigger SSRF to arbitrary internal services
    (bsc#1256562)
  * CVE-2026-23991: Fixed github.com/theupdateframework/go-tuf/v2: denial
    of service due to invalid TUF metadata JSON returned by TUF repository
    (bsc#1257080)
  * CVE-2026-23992: Fixed github.com/theupdateframework/go-tuf/v2:
    unauthorized modification to TUF metadata files due to a compromised
    or misconfigured TUF repository (bsc#1257085)
  * chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679)
  * chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670)
  * chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680)
  * chore(deps): bump the gomod group across 1 directory with 4 updates (#4702)
  * chore(deps): bump the actions group with 3 updates (#4703)
  * update golang builder to use go1.25.7 (#4687)
  * update golangci-lint to v2.8.x (#4688)
  * Fix typo in CLI help (#4701)
  * Support DSSE signing conformance test (#4685)
  * chore(deps): bump the actions group across 1 directory with 8 updates (#4689)
  * Deprecate rekor-entry-type flag (#4691)
  * Deprecate cosign triangulate (#4676)
  * Deprecate cosign copy (#4681)
  * Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668)
  * chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673)
  * Automatically require signed timestamp with Rekor v2 entries (#4666)
  * Fix syntax issue in conformance test, update nightly (#4664)
  * Add mTLS support for TSA client connections when signing with a signing config (#4620)
  * fix: avoid panic on malformed tlog entry body (#4652)
  * Verify validity of chain rather than just certificate (#4663)
  * Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
  * chore(deps): bump the gomod group across 1 directory with 3 updates (#4662)
  * Bump sigstore/sigstore to resolve GHSA (#4660)
  * Gracefully fail if bundle payload body is not a string (#4648)
  * fix: avoid panic on malformed replace payload (#4653)
  * chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659)
  * fix: avoid panic on malformed attestation payload (#4651)
  * fix: avoid panic on malformed tlog entries (#4649)
  * Update conformance to latest
  * docs(cosign): clarify RFC3161 revocation semantics (#4642)
  * Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
  * chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637)
  * Add origin key for ctfe trusted root
  * Add changelog updates for v3.0.4 and v2.6.2 (#4625)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778587200">- update to 3.0.6 (bsc#1261859, CVE-2026-39395):
  * Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801)
  * Handle whitespace-only certificate annotation (#4760)
  * fix(sign): closing SignerVerifier too early when signing with
    a security key (#4761)
  * Disallow --new-bundle-format and --rfc3161-timestamp (#4762)
  * support managed keys in conformance testing (#4728)
  * Add support for GCE metadata server env var (#4732)
  * fix: preserve per-layer annotations in
    WriteAttestationsReferrer (#4709)
  * Fix parsing of in-toto for string predicates
  * Mark batch of flags for deprecation (#4698)
  * disallow key and cert identity being used together
    during verification (#4636)
  * support key creation in GitLab group (#4704)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1783425600">- update to 3.1.1 (bsc#1267044,
  CVE-2026-25680,CVE-2026-42502,
  CVE-2026-27136,CVE-2026-25681,CVE-2026-42506,
  bsc#1266049, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829,
  CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833,
  CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595,
  CVE-2026-46597, CVE-2026-46598,
  bsc#1261811, CVE-2026-33815):
  * This release deprecates a number of flags related to
    verification material input for trust root material, as well
    as the bundle format, standardized across Sigstore SDKs,
    which is now the default output and input for signing and
    verifying respectively. You may continue to use the
    deprecated flags with Cosign v3.x releases. The deprecated
    flags will be removed in a future Cosign v4 release.
  * This release also updates the signing path for logging to
    Rekor v2. DSSE attestations will be logged as hashed entries,
    using the DSSE's pre-auth encoding (PAE). This should unblock
    developers who want to upload large signed DSSEs such as
    SBOMs.
  * Initialize PKCS11 slots Before Getting Token Info in
  * Sign exclusively via sigstore-go in
  * bundle create: Prevent IgnoreTlog when bundle contains SET in
  * Require bundle output or registry upload in
  * fix(load): pass NameOptions to name.ParseReference in
  * fix: honor --digestAlg when hashing a blob in verify-blob-
    attestation in https://github.com/sigstore/cosign/pull/4813
  * Deprecate Flags for v4: Certificates in
  * Deprecate flags signing config in
  * Deprecate flags bundle in
  * Fix typo in map of verify command fields unsupported for new
    bundle format in https://github.com/sigstore/cosign/pull/4853
  * Add bundle upgrade command in
  * Deprecate Flags for v4 in
  * fix: close file descriptor leaked in
    WriteSignedImageIndexImages loop in
  * fix: use Header.Set to prevent duplicate Authorization on
    retry in https://github.com/sigstore/cosign/pull/4870
  * feat(cli): add Rekor v2 flag to cosign signing-config create
  * Fix crash verifying timestamps when no timestamp was verified
  * Deprecate Flags for v4: OCI Referrers in
  * Use the configured Target Repository more consistently in
  * fix: check HTTP status code in LoadFileOrURL in
  * Fix unsafe type assertion in Rego policy evaluation by in
  * Fix Ed25519ph check to respect custom signing configs in
    sign-blob in https://github.com/sigstore/cosign/pull/4880
  * Enable initialize command output in conformance in
  * verify: return TUF errors for new bundle trusted roots in
  * Deprecate subcommands in
  * Remove docstring references to deprecated flags in
  * fix(verify): Attach detached certificates to static
    signatures via wrapped verifier in
  * fix(verify): copy CheckOpts inside VerifyNewBundle to fix
    data race in https://github.com/sigstore/cosign/pull/4917
  * Update sigstore-go to v1.2.0 in
  * **Full Changelog**:
    https://github.com/sigstore/cosign/compare/v3.0.6...v3.1.1</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1784289600">- updated to 3.1.2
  [#]# Deprecations
  * Deprecate --payload for sign and verify commands (#4991)
  [#]# Features
  * docs: add OVHcloud KMS in available external plugins (#4962)
  * Add insecure registry flag to ko publish in kind-verify-attestation workflow (#4970)
  * Deprecate --output-attestation (#4958)
  * Add bundle inspect command (#4842)
  [#]# Fixes
  * Guard against empty certificate PEM in mutate.Signature (#4998)
  * fix(download): Validate predicate type for new bundle format
  * Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
  * Fix Makefile: fall back to "unknown" version info when built outside a git repo (#5000)
  * fix(verify): skip identity validation for security keys (#5012)
  * fix: include artifactType in OCI 1.1 signature referrer manifest
  * Allow attestation download to handle both bundle types (#4996)
  * Fix panic in dockerfile verify on malformed FROM lines (#4979)
  * fix(release): restore signing-step auth and fail on image signing errors (#4978)
  * feat(signing-config): add --base-config flag to override services from base config (#4977)
  * fix: pass NewBundleFormat to KeyOpts in sign command (#4981)
  * fix: ignore build stage references in dockerfile verify (#4961)
  * fix: allow '=' in annotation values (#4957)
  [#]# Cleanup
  * Remove unused policy evaluation code (#4936)
  * Remove unused signing code (#4918)
  * Remove unused OCI code (#4935)
  * Remove unused ephemeral signer (#4938)
  [#]# Documentation
  * feat: improve verify flag shell completions (#4965)
  * docs: fix Short style and add Example fields to piv-tool subcommands (#4942)
  * docs: add Example fields to env and bundle create commands (#4941)
  * docs: fix Short style and add Example fields to pkcs11-tool subcommands</changelog>
</package>
<package pkgid="1cd75380b28286f974d81ced199643cf02fe4a19b29a8fc5f8901acec3ad4a2235d1f9de346cfab7b73df52a9e9fac953cfac59224fb3d577885e1298d4fe872" name="cosign-bash-completion" arch="noarch">
  <version epoch="0" ver="3.1.2" rel="76.2"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1699358400">- updated to 2.2.1 (jsc#SLE-23879)
  This release comes with a fix for
  CVE-2023-46737 / bsc#1216933 described in this [Github Security
  Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9).
  Enhancements:
  * feat: Support basic auth and bearer auth login to registry (#3310)
  * add support for ignoring certificates with pkcs11 (#3334)
  * Support ReplaceOp in Signatures (#3315)
  * feat: added ability to get image digest back via triangulate (#3255)
  * feat: add `--only` flag in `cosign copy` to copy sign, att &amp; sbom (#3247)
  * feat: add support attaching a Rekor bundle to a container (#3246)
  * feat: add support outputting rekor response on signing (#3248)
  * feat: improve dockerfile verify subcommand (#3264)
  * Add guard flag for experimental OCI 1.1 verify. (#3272)
  * Deprecate SBOM attachments (#3256)
  * feat: dedent line in cosign copy doc (#3244)
  * feat: add platform flag to cosign copy command (#3234)
  * Add SLSA 1.0 attestation support to cosign. Closes #2860 (#3219)
  * attest: pass OCI remote opts to att resolver. (#3225)
  Bug Fixes:
  * Merge pull request from GHSA-vfp6-jrw2-99g9
  * fix: allow cosign download sbom when image is absent (#3245)
  * ci: add a OCI registry test for referrers support (#3253)
  * Fix ReplaceSignatures (#3292)
  * Stop using deprecated in_toto.ProvenanceStatement (#3243)
  * Fixes #3236, disable SCT checking for a cosign verification when usin… (#3237)
  * fix: update error in `SignedEntity` to be more descriptive (#3233)
  * Fail timestamp verification if no root is provided (#3224)
  Documentation:
  * Add some docs about verifying in an air-gapped environment (#3321)
  * Update CONTRIBUTING.md (#3268)
  * docs: improves the Contribution guidelines (#3257)
  * Remove security policy (#3230)
  Others:
  * Set go to min 1.21 and update dependencies  (#3327)
  * Update contact for code of conduct (#3266)
  * Update .ko.yaml (#3240)</changelog>
  <changelog author="Marcos Bjoerkelund &lt;marcos.bjoerkelund@suse.com&gt;" date="1702382400">- updated to 2.2.2 (jsc#SLE-23879)
  v2.2.2 adds a new container with a shell,
  gcr.io/projectsigstore/cosign:vx.y.z-dev, in addition to the existing
  container gcr.io/projectsigstore/cosign:vx.y.z without a shell.
  For private deployments, we have also added an alias for
  - -insecure-skip-log, --private-infrastructure.
  Bug Fixes:
  * chore(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#3411) which fixes a bug with using Azure KMS
  * Don't require CT log keys if using a key/sk (#3415)
  * Fix copy without any flag set (#3409)
  * Update cosign generate cmd to not include newline (#3393)
  * Fix idempotency error with signing (#3371)
  Features:
  * Add --yes flag cosign import-key-pair to skip the overwrite confirmation. (#3383)
  * Use the timeout flag value in verify* commands. (#3391)
  * add --private-infrastructure flag (#3369)
  Container Updates:
  * Bump builder image to use go1.21.4 and add new cosign image tags with shell (#3373)
  Documentation:
  * Update SBOM_SPEC.md (#3358)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1706875200">- updated to 2.2.3 (jsc#SLE-23879)
  Bug Fixes:
  * Fix race condition on verification with multiple signatures attached to image (#3486)
  * fix(clean): Fix clean cmd for private registries (#3446)
  * Fixed BYO PKI verification (#3427)
  Features:
  * Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
  * Add support for OpenVEX predicate type (#3405)
  Documentation:
  * Resolves #3088: `version` sub-command expected behaviour documentation and testing (#3447)
  * add examples for cosign attach signature cmd (#3468)
  Misc:
  * Remove CertSubject function (#3467)
  * Use local rekor and fulcio instances in e2e tests (#3478)
- bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1713182400">- updated to 2.2.4 (jsc#SLE-23879)
  * Bug Fixes
  * Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  - CVE-2024-29902: Malicious attachments can cause system-wide denial of service (bsc#1222835)
  - CVE-2024-29903: Malicious artifects can cause machine-wide denial of service (bsc#1222837)
  * ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  * fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  * Honor creation timestamp for signatures again (#3549)
  * Features
  * Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)
  * Documentation
  * add oci bundle spec (#3622)
  * Correct help text of triangulate cmd (#3551)
  * Correct help text of verify-attestation policy argument (#3527)
  * feat: add OVHcloud MPR registry tested with cosign (#3639)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717156800">- add completion subpackages (bash, fish, zsh)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1721822400">- update to 2.3.0 (jsc#SLE-23879)
  * Features
  - Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface (#3693)
  - add registry options to cosign save (#3645)
  - Add debug providers command. (#3728)
  - Make config layers in ociremote mountable (#3741)
  - adds tsa cert chain check for env var or tuf targets. (#3600)
  - add --ca-roots and --ca-intermediates flags to 'cosign verify' (#3464)
  - add handling of keyless verification for all verify commands (#3761)
  * Bug Fixes
  - fix: close attestationFile (#3679)
  - Set bundleVerified to true after Rekor verification (Resolves #3740) (#3745)
  * Documentation
  - Document ImportKeyPair and LoadPrivateKey functions in pkg/cosign (#3776)</changelog>
  <changelog author="Sarah Kriesch &lt;sarah.kriesch@opensuse.org&gt;" date="1724155200">- Set CGO_ENABLED=1 for fixing s390x failed build</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1727870400">- update to 2.4.0 (jsc#SLE-23879)
  - Add new bundle support to verify-blob and verify-blob-attestation (#3796)
  - Adding protobuf bundle support to sign-blob and attest-blob (#3752)
  - Bump sigstore/sigstore to support email_verified as string or boolean (#3819)
  - Conformance testing for cosign (#3806)
  - move incremental builds per commit to GHCR instead of GCR (#3808)
  - Add support for recording creation timestamp for cosign attest (#3797)
  - Include SCT verification failure details in error message (#3799)</changelog>
  <changelog author="meissner@suse.com" date="1738756800">- Update to version 2.4.2:
  - Updated open-policy-agent to 1.1.0 library (#4036)
  - Note that only Rego v0 policies are supported at this time
  - Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
  - Add support for verifying root checksum in cosign initialize (#3953)
  - Detect if user supplied a valid protobuf bundle (#3931)
  - Add a log message if user doesn't provide --trusted-root (#3933)
  - Support mTLS towards container registry (#3922)
  - Add bundle create helper command (#3901)
  - Add trusted-root create helper command (#3876)
  Bug Fixes:
  - fix: set tls config while retaining other fields from default http transport (#4007)
  - policy fuzzer: ignore known panics (#3993)
  - Fix for multiple WithRemote options (#3982)
  - Add nightly conformance test workflow (#3979)
  - Fix copy --only for signatures + update/align docs (#3904)
- use "osc service mr" to update</changelog>
  <changelog author="meissner@suse.com" date="1740052800">- Update to version 2.4.3:
  * Enable fetching signatures without remote get. (#4047)
  * Bump sigstore/sigstore to support KMS plugins (#4073)
  * sort properly Go imports (#4071)
  * sync comment with parameter name in function signature (#4063)
  * fix go imports order to be alphabetical (#4062)
  * fix comment typo and imports order (#4061)
  * Feat/file flag completion improvements (#4028)
  * Udpate builder to use go1.23.6 (#4052)
  * Refactor verifyNewBundle into library function (#4013)
  * fix parsing error in --only for cosign copy (#4049)
  * Fix codeowners syntax, add dep-maintainers (#4046)</changelog>
  <changelog author="meissner@suse.com" date="1744545600">- Update to version 2.5.0:
  * Update sigstore-go to pick up bug fixes (#4150)
  * Update golangci-lint to v2, update golangci-lint-action (#4143)
  * Feat/non filename completions (#4115)
  * update builder to use go1.24.1 (#4116)
  * Add support for new bundle specification for attesting/verifying OCI image attestations (#3889)
  * Remove cert log line (#4113)
  * cmd/cosign/cli: fix typo in ignoreTLogMessage (#4111)
  * bump to latest scaffolding release for testing (#4099)
  * increase 2e2_test docker compose tiemout to 180s (#4091)
  * Fix replace with compliant image mediatype (#4077)
  * Add TSA certificate related flags and fields for cosign attest (#4079)
- Security issues fixed:
  - CVE-2024-6104: cosign: hashicorp/go-retryablehttp: url might write sensitive information to log file (bsc#1227031)
  - CVE-2024-51744: cosign: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232985)
  - CVE-2025-27144: cosign: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237682)
  - CVE-2025-22870: cosign: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238693)
  - CVE-2025-22868: cosign: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239204)
  - CVE-2025-22869: cosign: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239337)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1748433600">- switch to go1.24, enable fips build</changelog>
  <changelog author="meissner@suse.com" date="1752840000">- Update to version 2.5.3 (jsc#SLE-23879)
  - Add signing-config create command (#4280)
  - Allow multiple services to be specified for trusted-root create (#4285)
  - force when copying the latest image to overwrite (#4298)
  - Fix cert verification logic for trusted-root/SCTs (#4294)
  - Fix lint error for types package (#4295)
  - feat: Add OCI 1.1+ experimental support to tree (#4205)
  - Add validity period end for trusted-root create (#4271)
  - avoid double-loading trustedroot from file (#4264)
- Update to 2.5.2:
  - Do not load trusted root when CT env key is set
  - docs: improve doc for --no-upload option (#4206)
- Update to 2.5.1:
  * Features
  - Add Rekor v2 support for trusted-root create (#4242)
  - Add baseUrl and Uri to trusted-root create command
  - Upgrade to TUF v2 client with trusted root
  - Don't verify SCT for a private PKI cert (#4225)
  - Bump TSA library to relax EKU chain validation rules (#4219)
  * Bug Fixes
  - Bump sigstore-go to pick up log index=0 fix (#4162)
  - remove unused recursive flag on attest command (#4187)
  * Docs
  - Fix indentation in verify-blob cmd examples (#4160)
  * GO-2025-3660/ CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego (bsc#1246725)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1758196800">- Update to version 2.6.0:
  - Require exclusively a SigningConfig or service URLs when signing (#4403)
  - Add a terminal spinner while signing with sigstore-go (#4402)
  - Bump sigstore-go, support alternative hash algorithms with keys (#4386)
  - Add support for SigningConfig in sign/attest (#4371)
  - Support self-managed keys when signing with sigstore-go (#4368)
  - Remove SHA256 assumption in sign-blob/verify-blob (#4050)
  - introduce dockerfile to pin the go version to decouple go version from go.mod (#4369)
  - refactor: extract function to write referrer attestations (#4357)
  - Break import cycle with e2e build tag (#4370)
  - Update conformance test binary for signing config (#4367)
  - update builder image to use go1.25 (#4366)
  - Don't load content from TUF if trusted root path is specified (#4347)
  - Don't require timestamps when verifying with a key (#4337)
  - Fixes to cosign sign / verify for the new bundle format (#4346)
  - update builder to use go1.24.6 (#4334)
  - bump golangci-lint to v2.3.x (#4333)
  - Have cosign sign support bundle format (#4316)
  - Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
  - Verify subject with bundle only when checking claims (#4320)
  - Add to `attest-blob` the ability to supply a complete in-toto statement, and add to `verify-blob-attestation` the ability to verify with just a digest (#4306)</changelog>
  <changelog author="meissner@suse.com" date="1765368000">- Update to version 3.0.3:
  * 4554: Closes 4554 - Add warning when --output* is used (#4556)
  * chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542)
  * chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543)
  * chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546)
  * chore(deps): bump the actions group with 4 updates (#4544)
  * chore(deps): bump the gomod group across 1 directory with 5 updates (#4567)
  * chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568)
  * update builder to use go1.25.5 (#4566)
  * Protobuf bundle support for subcommand `clean` (#4539)
  * Add staging flag to initialize with staging TUF metadata
  * update slack invite link (#4560)
  * Updating sign-blob to also support signing with a certificate (#4547)
  * Bump sigstore library dependencies (#4532)
  * Protobuf bundle support for subcommands `save` and `load` (#4538)
  * Fix cert attachment for new bundle with signing config
  * Fix OCI verification with local cert - old bundle
  * chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519)
  * chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535)
  * chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536)
  * CVE-2025-58181: Fixed golang.org/x/crypto/ssh: invalidated number
    of mechanisms can cause unbounded memory consumption (bsc#1253913)
  * update go builder and cosign (#4529)
  * chore(deps): bump the gomod group across 1 directory with 7 updates (#4528)
  * chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520)
  * chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515)
  * chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518)
  * chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10.1 (#4521)
  * chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502)
  * chore(deps): bump the actions group across 1 directory with 2 updates (#4516)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111.0 (#4523)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4522)
  * Deprecate tlog-upload flag (#4458)
  * fix: Use signal context for `sign` cli package.
  * update offline verification directions (#4526)
  * Fix signing/verifying annotations for new bundle
  * Add support to download and attach for protobuf bundles (#4477)
  * Add --signing-algorithm flag (#3497)
  * Refactor signcommon bundle helpers
  * Add --bundle and fix --upload for new bundle
  * Pass insecure registry flags through to referrers
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109.1 (#4483)
  * Add protobuf bundle support for tree subcommand (#4491)
  * Remove stale embed import (#4492)
  * Support multiple container identities
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4484)
  * chore(deps): bump chainguard-dev/actions in the actions group (#4480)
  * chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4485)
  * chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#4486)
  * chore(deps): bump cuelang.org/go in the gomod group (#4479)
  * upgrade OSS-Fuzz build tooling (#4487)
  * Fix segfault when no attestations are found (#4472)
  * Use overridden repository for new bundle format (#4473)
  * update go to 1.25.3 (#4471)
  * Remove --out flag from `cosign initialize` (#4462)
  * chore(deps): bump the actions group with 2 updates (#4460)
  * Deprecate offline flag (#4457)
  * Deduplicate code in sign/attest* and verify* commands (#4449)
  * Cache signing config when calling initialize (#4456)
  * Update changelog for v3.0.2 (#4455)
  * chore(deps): bump google.golang.org/api from 0.250.0 to 0.251.0
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go
  * chore(deps): bump the actions group with 3 updates
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.107.2 to 3.108.0
  * choose different signature filename for KMS-signed release signatures (#4448)
  * chore(deps): bump github.com/go-jose/go-jose/v4 (#4451)
  * Update rekor-tiles version path
  * update CL for v3.0.1 release (#4447)
  * update goreleaser config for v3.0.0 release (#4446)
  * Create changelog for v3.0.0 (#4440)
  * Fetch service URLs from the TUF PGI signing config by default (#4428)
  * Create changelog for v2.6.1 (#4439)
  * chore(deps): bump google.golang.org/api from 0.249.0 to 0.250.0 (#4432)
  * chore(deps): bump the gomod group with 2 updates (#4429)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.8.0 to 1.9.0 (#4433)
  * chore(deps): bump the actions group with 3 updates (#4434)
  * chore(deps): bump github.com/go-openapi/swag from 0.24.1 to 0.25.1 (#4435)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4436)
  * chore(deps): bump github.com/go-openapi/runtime from 0.28.0 to 0.29.0 (#4437)
  * Bump module version to v3 for Cosign v3.0 (#4427)
  * Move sigstore-conformance back to tagged release (#4425)
  * Bump sigstore-go to v1.1.3 (#4423)
  * Partially populate the output of cosign verify when working with new bundles (#4416)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4419)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4418)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.105.0 to 3.107.0 (#4420)
  * chore(deps): bump chainguard-dev/actions in the actions group (#4421)
  * bump go builder to use 1.25.1 and cosign (#4417)
  * Bump sigstore-go for more precise user agents (#4413)
  * chore(deps): bump github.com/spf13/viper from 1.20.1 to 1.21.0 (#4408)
  * chore(deps): bump the actions group with 2 updates (#4407)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4410)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.104.0 to 3.105.0 (#4411)
  * Default to using the new protobuf format (#4318)</changelog>
  <changelog author="meissner@suse.com" date="1770811200">- Update to version 3.0.4:
  * CVE-2025-11065: Fixed github.com/go-viper/mapstructure/v2: sensitive
    Information leak in logs (bsc#1250620)
  * CVE-2026-22703: Fixed that cosign verification accepts any valid
    Rekor entry under certain conditions (bsc#1256496)
  * Fix bundle verify path for old bundle/trusted root (#4623)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616)
  * chore(deps): bump cuelang.org/go in the gomod group (#4615)
  * Optimize cosign tree performance by caching digest resolution (#4612)
  * Don't require a trusted root to verify offline with a key (#4613)
  * Support default services for trusted-root and signing-config creation (#4592)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602)
  * chore(deps): bump github.com/sigstore/sigstore-go (#4578)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601)
  * chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611)
  * chore(deps): bump k8s.io/client-go from 0.34.3 to 0.35.0 (#4604)
  * chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588)
  * chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586)
  * chore(deps): bump the gomod group with 5 updates (#4599)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600)
  * chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584)
  * chore(deps): bump the actions group with 3 updates (#4587)
  * chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589)
  * chore(deps): bump the gomod group with 9 updates (#4577)</changelog>
  <changelog author="meissner@suse.com" date="1771761600">- Update to version 3.0.5: (jsc#SLE-23879)
  * CVE-2026-24122: Fixed improper validation of certificates that
    outlive expired CA certificates (bsc#1258542)
  * CVE-2026-26958: Fixed filippo.io/edwards25519: failure to initialize
    receiver in MultiScalarMult can produce invalid results and lead to
    undefined behavior (bsc#1258612)
  * CVE-2026-24137: Fixed github.com/sigstore/sigstore/pkg/tuf: legacy
    TUF client allows for arbitrary file writes with target cache path
    traversal (bsc#1257139)
  * CVE-2026-22772: Fixed github.com/sigstore/fulcio: bypass MetaIssuer
    URL validation bypass can trigger SSRF to arbitrary internal services
    (bsc#1256562)
  * CVE-2026-23991: Fixed github.com/theupdateframework/go-tuf/v2: denial
    of service due to invalid TUF metadata JSON returned by TUF repository
    (bsc#1257080)
  * CVE-2026-23992: Fixed github.com/theupdateframework/go-tuf/v2:
    unauthorized modification to TUF metadata files due to a compromised
    or misconfigured TUF repository (bsc#1257085)
  * chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679)
  * chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670)
  * chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680)
  * chore(deps): bump the gomod group across 1 directory with 4 updates (#4702)
  * chore(deps): bump the actions group with 3 updates (#4703)
  * update golang builder to use go1.25.7 (#4687)
  * update golangci-lint to v2.8.x (#4688)
  * Fix typo in CLI help (#4701)
  * Support DSSE signing conformance test (#4685)
  * chore(deps): bump the actions group across 1 directory with 8 updates (#4689)
  * Deprecate rekor-entry-type flag (#4691)
  * Deprecate cosign triangulate (#4676)
  * Deprecate cosign copy (#4681)
  * Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668)
  * chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673)
  * Automatically require signed timestamp with Rekor v2 entries (#4666)
  * Fix syntax issue in conformance test, update nightly (#4664)
  * Add mTLS support for TSA client connections when signing with a signing config (#4620)
  * fix: avoid panic on malformed tlog entry body (#4652)
  * Verify validity of chain rather than just certificate (#4663)
  * Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
  * chore(deps): bump the gomod group across 1 directory with 3 updates (#4662)
  * Bump sigstore/sigstore to resolve GHSA (#4660)
  * Gracefully fail if bundle payload body is not a string (#4648)
  * fix: avoid panic on malformed replace payload (#4653)
  * chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659)
  * fix: avoid panic on malformed attestation payload (#4651)
  * fix: avoid panic on malformed tlog entries (#4649)
  * Update conformance to latest
  * docs(cosign): clarify RFC3161 revocation semantics (#4642)
  * Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
  * chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637)
  * Add origin key for ctfe trusted root
  * Add changelog updates for v3.0.4 and v2.6.2 (#4625)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778587200">- update to 3.0.6 (bsc#1261859, CVE-2026-39395):
  * Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801)
  * Handle whitespace-only certificate annotation (#4760)
  * fix(sign): closing SignerVerifier too early when signing with
    a security key (#4761)
  * Disallow --new-bundle-format and --rfc3161-timestamp (#4762)
  * support managed keys in conformance testing (#4728)
  * Add support for GCE metadata server env var (#4732)
  * fix: preserve per-layer annotations in
    WriteAttestationsReferrer (#4709)
  * Fix parsing of in-toto for string predicates
  * Mark batch of flags for deprecation (#4698)
  * disallow key and cert identity being used together
    during verification (#4636)
  * support key creation in GitLab group (#4704)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1783425600">- update to 3.1.1 (bsc#1267044,
  CVE-2026-25680,CVE-2026-42502,
  CVE-2026-27136,CVE-2026-25681,CVE-2026-42506,
  bsc#1266049, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829,
  CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833,
  CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595,
  CVE-2026-46597, CVE-2026-46598,
  bsc#1261811, CVE-2026-33815):
  * This release deprecates a number of flags related to
    verification material input for trust root material, as well
    as the bundle format, standardized across Sigstore SDKs,
    which is now the default output and input for signing and
    verifying respectively. You may continue to use the
    deprecated flags with Cosign v3.x releases. The deprecated
    flags will be removed in a future Cosign v4 release.
  * This release also updates the signing path for logging to
    Rekor v2. DSSE attestations will be logged as hashed entries,
    using the DSSE's pre-auth encoding (PAE). This should unblock
    developers who want to upload large signed DSSEs such as
    SBOMs.
  * Initialize PKCS11 slots Before Getting Token Info in
  * Sign exclusively via sigstore-go in
  * bundle create: Prevent IgnoreTlog when bundle contains SET in
  * Require bundle output or registry upload in
  * fix(load): pass NameOptions to name.ParseReference in
  * fix: honor --digestAlg when hashing a blob in verify-blob-
    attestation in https://github.com/sigstore/cosign/pull/4813
  * Deprecate Flags for v4: Certificates in
  * Deprecate flags signing config in
  * Deprecate flags bundle in
  * Fix typo in map of verify command fields unsupported for new
    bundle format in https://github.com/sigstore/cosign/pull/4853
  * Add bundle upgrade command in
  * Deprecate Flags for v4 in
  * fix: close file descriptor leaked in
    WriteSignedImageIndexImages loop in
  * fix: use Header.Set to prevent duplicate Authorization on
    retry in https://github.com/sigstore/cosign/pull/4870
  * feat(cli): add Rekor v2 flag to cosign signing-config create
  * Fix crash verifying timestamps when no timestamp was verified
  * Deprecate Flags for v4: OCI Referrers in
  * Use the configured Target Repository more consistently in
  * fix: check HTTP status code in LoadFileOrURL in
  * Fix unsafe type assertion in Rego policy evaluation by in
  * Fix Ed25519ph check to respect custom signing configs in
    sign-blob in https://github.com/sigstore/cosign/pull/4880
  * Enable initialize command output in conformance in
  * verify: return TUF errors for new bundle trusted roots in
  * Deprecate subcommands in
  * Remove docstring references to deprecated flags in
  * fix(verify): Attach detached certificates to static
    signatures via wrapped verifier in
  * fix(verify): copy CheckOpts inside VerifyNewBundle to fix
    data race in https://github.com/sigstore/cosign/pull/4917
  * Update sigstore-go to v1.2.0 in
  * **Full Changelog**:
    https://github.com/sigstore/cosign/compare/v3.0.6...v3.1.1</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1784289600">- updated to 3.1.2
  [#]# Deprecations
  * Deprecate --payload for sign and verify commands (#4991)
  [#]# Features
  * docs: add OVHcloud KMS in available external plugins (#4962)
  * Add insecure registry flag to ko publish in kind-verify-attestation workflow (#4970)
  * Deprecate --output-attestation (#4958)
  * Add bundle inspect command (#4842)
  [#]# Fixes
  * Guard against empty certificate PEM in mutate.Signature (#4998)
  * fix(download): Validate predicate type for new bundle format
  * Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
  * Fix Makefile: fall back to "unknown" version info when built outside a git repo (#5000)
  * fix(verify): skip identity validation for security keys (#5012)
  * fix: include artifactType in OCI 1.1 signature referrer manifest
  * Allow attestation download to handle both bundle types (#4996)
  * Fix panic in dockerfile verify on malformed FROM lines (#4979)
  * fix(release): restore signing-step auth and fail on image signing errors (#4978)
  * feat(signing-config): add --base-config flag to override services from base config (#4977)
  * fix: pass NewBundleFormat to KeyOpts in sign command (#4981)
  * fix: ignore build stage references in dockerfile verify (#4961)
  * fix: allow '=' in annotation values (#4957)
  [#]# Cleanup
  * Remove unused policy evaluation code (#4936)
  * Remove unused signing code (#4918)
  * Remove unused OCI code (#4935)
  * Remove unused ephemeral signer (#4938)
  [#]# Documentation
  * feat: improve verify flag shell completions (#4965)
  * docs: fix Short style and add Example fields to piv-tool subcommands (#4942)
  * docs: add Example fields to env and bundle create commands (#4941)
  * docs: fix Short style and add Example fields to pkcs11-tool subcommands</changelog>
</package>
<package pkgid="55d0155c42f9c23995a2443cae96a53c35edd4665ecc0f1d315b823168713f40825b65c4b4b7784b6709c0065534267e161775b33b127ff1ea34874c00ceda93" name="cosign-debuginfo" arch="s390x">
  <version epoch="0" ver="3.1.2" rel="76.2"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1699358400">- updated to 2.2.1 (jsc#SLE-23879)
  This release comes with a fix for
  CVE-2023-46737 / bsc#1216933 described in this [Github Security
  Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9).
  Enhancements:
  * feat: Support basic auth and bearer auth login to registry (#3310)
  * add support for ignoring certificates with pkcs11 (#3334)
  * Support ReplaceOp in Signatures (#3315)
  * feat: added ability to get image digest back via triangulate (#3255)
  * feat: add `--only` flag in `cosign copy` to copy sign, att &amp; sbom (#3247)
  * feat: add support attaching a Rekor bundle to a container (#3246)
  * feat: add support outputting rekor response on signing (#3248)
  * feat: improve dockerfile verify subcommand (#3264)
  * Add guard flag for experimental OCI 1.1 verify. (#3272)
  * Deprecate SBOM attachments (#3256)
  * feat: dedent line in cosign copy doc (#3244)
  * feat: add platform flag to cosign copy command (#3234)
  * Add SLSA 1.0 attestation support to cosign. Closes #2860 (#3219)
  * attest: pass OCI remote opts to att resolver. (#3225)
  Bug Fixes:
  * Merge pull request from GHSA-vfp6-jrw2-99g9
  * fix: allow cosign download sbom when image is absent (#3245)
  * ci: add a OCI registry test for referrers support (#3253)
  * Fix ReplaceSignatures (#3292)
  * Stop using deprecated in_toto.ProvenanceStatement (#3243)
  * Fixes #3236, disable SCT checking for a cosign verification when usin… (#3237)
  * fix: update error in `SignedEntity` to be more descriptive (#3233)
  * Fail timestamp verification if no root is provided (#3224)
  Documentation:
  * Add some docs about verifying in an air-gapped environment (#3321)
  * Update CONTRIBUTING.md (#3268)
  * docs: improves the Contribution guidelines (#3257)
  * Remove security policy (#3230)
  Others:
  * Set go to min 1.21 and update dependencies  (#3327)
  * Update contact for code of conduct (#3266)
  * Update .ko.yaml (#3240)</changelog>
  <changelog author="Marcos Bjoerkelund &lt;marcos.bjoerkelund@suse.com&gt;" date="1702382400">- updated to 2.2.2 (jsc#SLE-23879)
  v2.2.2 adds a new container with a shell,
  gcr.io/projectsigstore/cosign:vx.y.z-dev, in addition to the existing
  container gcr.io/projectsigstore/cosign:vx.y.z without a shell.
  For private deployments, we have also added an alias for
  - -insecure-skip-log, --private-infrastructure.
  Bug Fixes:
  * chore(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#3411) which fixes a bug with using Azure KMS
  * Don't require CT log keys if using a key/sk (#3415)
  * Fix copy without any flag set (#3409)
  * Update cosign generate cmd to not include newline (#3393)
  * Fix idempotency error with signing (#3371)
  Features:
  * Add --yes flag cosign import-key-pair to skip the overwrite confirmation. (#3383)
  * Use the timeout flag value in verify* commands. (#3391)
  * add --private-infrastructure flag (#3369)
  Container Updates:
  * Bump builder image to use go1.21.4 and add new cosign image tags with shell (#3373)
  Documentation:
  * Update SBOM_SPEC.md (#3358)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1706875200">- updated to 2.2.3 (jsc#SLE-23879)
  Bug Fixes:
  * Fix race condition on verification with multiple signatures attached to image (#3486)
  * fix(clean): Fix clean cmd for private registries (#3446)
  * Fixed BYO PKI verification (#3427)
  Features:
  * Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
  * Add support for OpenVEX predicate type (#3405)
  Documentation:
  * Resolves #3088: `version` sub-command expected behaviour documentation and testing (#3447)
  * add examples for cosign attach signature cmd (#3468)
  Misc:
  * Remove CertSubject function (#3467)
  * Use local rekor and fulcio instances in e2e tests (#3478)
- bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1713182400">- updated to 2.2.4 (jsc#SLE-23879)
  * Bug Fixes
  * Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  - CVE-2024-29902: Malicious attachments can cause system-wide denial of service (bsc#1222835)
  - CVE-2024-29903: Malicious artifects can cause machine-wide denial of service (bsc#1222837)
  * ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  * fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  * Honor creation timestamp for signatures again (#3549)
  * Features
  * Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)
  * Documentation
  * add oci bundle spec (#3622)
  * Correct help text of triangulate cmd (#3551)
  * Correct help text of verify-attestation policy argument (#3527)
  * feat: add OVHcloud MPR registry tested with cosign (#3639)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717156800">- add completion subpackages (bash, fish, zsh)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1721822400">- update to 2.3.0 (jsc#SLE-23879)
  * Features
  - Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface (#3693)
  - add registry options to cosign save (#3645)
  - Add debug providers command. (#3728)
  - Make config layers in ociremote mountable (#3741)
  - adds tsa cert chain check for env var or tuf targets. (#3600)
  - add --ca-roots and --ca-intermediates flags to 'cosign verify' (#3464)
  - add handling of keyless verification for all verify commands (#3761)
  * Bug Fixes
  - fix: close attestationFile (#3679)
  - Set bundleVerified to true after Rekor verification (Resolves #3740) (#3745)
  * Documentation
  - Document ImportKeyPair and LoadPrivateKey functions in pkg/cosign (#3776)</changelog>
  <changelog author="Sarah Kriesch &lt;sarah.kriesch@opensuse.org&gt;" date="1724155200">- Set CGO_ENABLED=1 for fixing s390x failed build</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1727870400">- update to 2.4.0 (jsc#SLE-23879)
  - Add new bundle support to verify-blob and verify-blob-attestation (#3796)
  - Adding protobuf bundle support to sign-blob and attest-blob (#3752)
  - Bump sigstore/sigstore to support email_verified as string or boolean (#3819)
  - Conformance testing for cosign (#3806)
  - move incremental builds per commit to GHCR instead of GCR (#3808)
  - Add support for recording creation timestamp for cosign attest (#3797)
  - Include SCT verification failure details in error message (#3799)</changelog>
  <changelog author="meissner@suse.com" date="1738756800">- Update to version 2.4.2:
  - Updated open-policy-agent to 1.1.0 library (#4036)
  - Note that only Rego v0 policies are supported at this time
  - Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
  - Add support for verifying root checksum in cosign initialize (#3953)
  - Detect if user supplied a valid protobuf bundle (#3931)
  - Add a log message if user doesn't provide --trusted-root (#3933)
  - Support mTLS towards container registry (#3922)
  - Add bundle create helper command (#3901)
  - Add trusted-root create helper command (#3876)
  Bug Fixes:
  - fix: set tls config while retaining other fields from default http transport (#4007)
  - policy fuzzer: ignore known panics (#3993)
  - Fix for multiple WithRemote options (#3982)
  - Add nightly conformance test workflow (#3979)
  - Fix copy --only for signatures + update/align docs (#3904)
- use "osc service mr" to update</changelog>
  <changelog author="meissner@suse.com" date="1740052800">- Update to version 2.4.3:
  * Enable fetching signatures without remote get. (#4047)
  * Bump sigstore/sigstore to support KMS plugins (#4073)
  * sort properly Go imports (#4071)
  * sync comment with parameter name in function signature (#4063)
  * fix go imports order to be alphabetical (#4062)
  * fix comment typo and imports order (#4061)
  * Feat/file flag completion improvements (#4028)
  * Udpate builder to use go1.23.6 (#4052)
  * Refactor verifyNewBundle into library function (#4013)
  * fix parsing error in --only for cosign copy (#4049)
  * Fix codeowners syntax, add dep-maintainers (#4046)</changelog>
  <changelog author="meissner@suse.com" date="1744545600">- Update to version 2.5.0:
  * Update sigstore-go to pick up bug fixes (#4150)
  * Update golangci-lint to v2, update golangci-lint-action (#4143)
  * Feat/non filename completions (#4115)
  * update builder to use go1.24.1 (#4116)
  * Add support for new bundle specification for attesting/verifying OCI image attestations (#3889)
  * Remove cert log line (#4113)
  * cmd/cosign/cli: fix typo in ignoreTLogMessage (#4111)
  * bump to latest scaffolding release for testing (#4099)
  * increase 2e2_test docker compose tiemout to 180s (#4091)
  * Fix replace with compliant image mediatype (#4077)
  * Add TSA certificate related flags and fields for cosign attest (#4079)
- Security issues fixed:
  - CVE-2024-6104: cosign: hashicorp/go-retryablehttp: url might write sensitive information to log file (bsc#1227031)
  - CVE-2024-51744: cosign: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232985)
  - CVE-2025-27144: cosign: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237682)
  - CVE-2025-22870: cosign: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238693)
  - CVE-2025-22868: cosign: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239204)
  - CVE-2025-22869: cosign: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239337)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1748433600">- switch to go1.24, enable fips build</changelog>
  <changelog author="meissner@suse.com" date="1752840000">- Update to version 2.5.3 (jsc#SLE-23879)
  - Add signing-config create command (#4280)
  - Allow multiple services to be specified for trusted-root create (#4285)
  - force when copying the latest image to overwrite (#4298)
  - Fix cert verification logic for trusted-root/SCTs (#4294)
  - Fix lint error for types package (#4295)
  - feat: Add OCI 1.1+ experimental support to tree (#4205)
  - Add validity period end for trusted-root create (#4271)
  - avoid double-loading trustedroot from file (#4264)
- Update to 2.5.2:
  - Do not load trusted root when CT env key is set
  - docs: improve doc for --no-upload option (#4206)
- Update to 2.5.1:
  * Features
  - Add Rekor v2 support for trusted-root create (#4242)
  - Add baseUrl and Uri to trusted-root create command
  - Upgrade to TUF v2 client with trusted root
  - Don't verify SCT for a private PKI cert (#4225)
  - Bump TSA library to relax EKU chain validation rules (#4219)
  * Bug Fixes
  - Bump sigstore-go to pick up log index=0 fix (#4162)
  - remove unused recursive flag on attest command (#4187)
  * Docs
  - Fix indentation in verify-blob cmd examples (#4160)
  * GO-2025-3660/ CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego (bsc#1246725)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1758196800">- Update to version 2.6.0:
  - Require exclusively a SigningConfig or service URLs when signing (#4403)
  - Add a terminal spinner while signing with sigstore-go (#4402)
  - Bump sigstore-go, support alternative hash algorithms with keys (#4386)
  - Add support for SigningConfig in sign/attest (#4371)
  - Support self-managed keys when signing with sigstore-go (#4368)
  - Remove SHA256 assumption in sign-blob/verify-blob (#4050)
  - introduce dockerfile to pin the go version to decouple go version from go.mod (#4369)
  - refactor: extract function to write referrer attestations (#4357)
  - Break import cycle with e2e build tag (#4370)
  - Update conformance test binary for signing config (#4367)
  - update builder image to use go1.25 (#4366)
  - Don't load content from TUF if trusted root path is specified (#4347)
  - Don't require timestamps when verifying with a key (#4337)
  - Fixes to cosign sign / verify for the new bundle format (#4346)
  - update builder to use go1.24.6 (#4334)
  - bump golangci-lint to v2.3.x (#4333)
  - Have cosign sign support bundle format (#4316)
  - Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
  - Verify subject with bundle only when checking claims (#4320)
  - Add to `attest-blob` the ability to supply a complete in-toto statement, and add to `verify-blob-attestation` the ability to verify with just a digest (#4306)</changelog>
  <changelog author="meissner@suse.com" date="1765368000">- Update to version 3.0.3:
  * 4554: Closes 4554 - Add warning when --output* is used (#4556)
  * chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542)
  * chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543)
  * chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546)
  * chore(deps): bump the actions group with 4 updates (#4544)
  * chore(deps): bump the gomod group across 1 directory with 5 updates (#4567)
  * chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568)
  * update builder to use go1.25.5 (#4566)
  * Protobuf bundle support for subcommand `clean` (#4539)
  * Add staging flag to initialize with staging TUF metadata
  * update slack invite link (#4560)
  * Updating sign-blob to also support signing with a certificate (#4547)
  * Bump sigstore library dependencies (#4532)
  * Protobuf bundle support for subcommands `save` and `load` (#4538)
  * Fix cert attachment for new bundle with signing config
  * Fix OCI verification with local cert - old bundle
  * chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519)
  * chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535)
  * chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536)
  * CVE-2025-58181: Fixed golang.org/x/crypto/ssh: invalidated number
    of mechanisms can cause unbounded memory consumption (bsc#1253913)
  * update go builder and cosign (#4529)
  * chore(deps): bump the gomod group across 1 directory with 7 updates (#4528)
  * chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520)
  * chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515)
  * chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518)
  * chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10.1 (#4521)
  * chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502)
  * chore(deps): bump the actions group across 1 directory with 2 updates (#4516)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111.0 (#4523)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4522)
  * Deprecate tlog-upload flag (#4458)
  * fix: Use signal context for `sign` cli package.
  * update offline verification directions (#4526)
  * Fix signing/verifying annotations for new bundle
  * Add support to download and attach for protobuf bundles (#4477)
  * Add --signing-algorithm flag (#3497)
  * Refactor signcommon bundle helpers
  * Add --bundle and fix --upload for new bundle
  * Pass insecure registry flags through to referrers
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109.1 (#4483)
  * Add protobuf bundle support for tree subcommand (#4491)
  * Remove stale embed import (#4492)
  * Support multiple container identities
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4484)
  * chore(deps): bump chainguard-dev/actions in the actions group (#4480)
  * chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4485)
  * chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#4486)
  * chore(deps): bump cuelang.org/go in the gomod group (#4479)
  * upgrade OSS-Fuzz build tooling (#4487)
  * Fix segfault when no attestations are found (#4472)
  * Use overridden repository for new bundle format (#4473)
  * update go to 1.25.3 (#4471)
  * Remove --out flag from `cosign initialize` (#4462)
  * chore(deps): bump the actions group with 2 updates (#4460)
  * Deprecate offline flag (#4457)
  * Deduplicate code in sign/attest* and verify* commands (#4449)
  * Cache signing config when calling initialize (#4456)
  * Update changelog for v3.0.2 (#4455)
  * chore(deps): bump google.golang.org/api from 0.250.0 to 0.251.0
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go
  * chore(deps): bump the actions group with 3 updates
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.107.2 to 3.108.0
  * choose different signature filename for KMS-signed release signatures (#4448)
  * chore(deps): bump github.com/go-jose/go-jose/v4 (#4451)
  * Update rekor-tiles version path
  * update CL for v3.0.1 release (#4447)
  * update goreleaser config for v3.0.0 release (#4446)
  * Create changelog for v3.0.0 (#4440)
  * Fetch service URLs from the TUF PGI signing config by default (#4428)
  * Create changelog for v2.6.1 (#4439)
  * chore(deps): bump google.golang.org/api from 0.249.0 to 0.250.0 (#4432)
  * chore(deps): bump the gomod group with 2 updates (#4429)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.8.0 to 1.9.0 (#4433)
  * chore(deps): bump the actions group with 3 updates (#4434)
  * chore(deps): bump github.com/go-openapi/swag from 0.24.1 to 0.25.1 (#4435)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4436)
  * chore(deps): bump github.com/go-openapi/runtime from 0.28.0 to 0.29.0 (#4437)
  * Bump module version to v3 for Cosign v3.0 (#4427)
  * Move sigstore-conformance back to tagged release (#4425)
  * Bump sigstore-go to v1.1.3 (#4423)
  * Partially populate the output of cosign verify when working with new bundles (#4416)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4419)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4418)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.105.0 to 3.107.0 (#4420)
  * chore(deps): bump chainguard-dev/actions in the actions group (#4421)
  * bump go builder to use 1.25.1 and cosign (#4417)
  * Bump sigstore-go for more precise user agents (#4413)
  * chore(deps): bump github.com/spf13/viper from 1.20.1 to 1.21.0 (#4408)
  * chore(deps): bump the actions group with 2 updates (#4407)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4410)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.104.0 to 3.105.0 (#4411)
  * Default to using the new protobuf format (#4318)</changelog>
  <changelog author="meissner@suse.com" date="1770811200">- Update to version 3.0.4:
  * CVE-2025-11065: Fixed github.com/go-viper/mapstructure/v2: sensitive
    Information leak in logs (bsc#1250620)
  * CVE-2026-22703: Fixed that cosign verification accepts any valid
    Rekor entry under certain conditions (bsc#1256496)
  * Fix bundle verify path for old bundle/trusted root (#4623)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616)
  * chore(deps): bump cuelang.org/go in the gomod group (#4615)
  * Optimize cosign tree performance by caching digest resolution (#4612)
  * Don't require a trusted root to verify offline with a key (#4613)
  * Support default services for trusted-root and signing-config creation (#4592)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602)
  * chore(deps): bump github.com/sigstore/sigstore-go (#4578)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601)
  * chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611)
  * chore(deps): bump k8s.io/client-go from 0.34.3 to 0.35.0 (#4604)
  * chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588)
  * chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586)
  * chore(deps): bump the gomod group with 5 updates (#4599)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600)
  * chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584)
  * chore(deps): bump the actions group with 3 updates (#4587)
  * chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589)
  * chore(deps): bump the gomod group with 9 updates (#4577)</changelog>
  <changelog author="meissner@suse.com" date="1771761600">- Update to version 3.0.5: (jsc#SLE-23879)
  * CVE-2026-24122: Fixed improper validation of certificates that
    outlive expired CA certificates (bsc#1258542)
  * CVE-2026-26958: Fixed filippo.io/edwards25519: failure to initialize
    receiver in MultiScalarMult can produce invalid results and lead to
    undefined behavior (bsc#1258612)
  * CVE-2026-24137: Fixed github.com/sigstore/sigstore/pkg/tuf: legacy
    TUF client allows for arbitrary file writes with target cache path
    traversal (bsc#1257139)
  * CVE-2026-22772: Fixed github.com/sigstore/fulcio: bypass MetaIssuer
    URL validation bypass can trigger SSRF to arbitrary internal services
    (bsc#1256562)
  * CVE-2026-23991: Fixed github.com/theupdateframework/go-tuf/v2: denial
    of service due to invalid TUF metadata JSON returned by TUF repository
    (bsc#1257080)
  * CVE-2026-23992: Fixed github.com/theupdateframework/go-tuf/v2:
    unauthorized modification to TUF metadata files due to a compromised
    or misconfigured TUF repository (bsc#1257085)
  * chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679)
  * chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670)
  * chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680)
  * chore(deps): bump the gomod group across 1 directory with 4 updates (#4702)
  * chore(deps): bump the actions group with 3 updates (#4703)
  * update golang builder to use go1.25.7 (#4687)
  * update golangci-lint to v2.8.x (#4688)
  * Fix typo in CLI help (#4701)
  * Support DSSE signing conformance test (#4685)
  * chore(deps): bump the actions group across 1 directory with 8 updates (#4689)
  * Deprecate rekor-entry-type flag (#4691)
  * Deprecate cosign triangulate (#4676)
  * Deprecate cosign copy (#4681)
  * Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668)
  * chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673)
  * Automatically require signed timestamp with Rekor v2 entries (#4666)
  * Fix syntax issue in conformance test, update nightly (#4664)
  * Add mTLS support for TSA client connections when signing with a signing config (#4620)
  * fix: avoid panic on malformed tlog entry body (#4652)
  * Verify validity of chain rather than just certificate (#4663)
  * Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
  * chore(deps): bump the gomod group across 1 directory with 3 updates (#4662)
  * Bump sigstore/sigstore to resolve GHSA (#4660)
  * Gracefully fail if bundle payload body is not a string (#4648)
  * fix: avoid panic on malformed replace payload (#4653)
  * chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659)
  * fix: avoid panic on malformed attestation payload (#4651)
  * fix: avoid panic on malformed tlog entries (#4649)
  * Update conformance to latest
  * docs(cosign): clarify RFC3161 revocation semantics (#4642)
  * Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
  * chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637)
  * Add origin key for ctfe trusted root
  * Add changelog updates for v3.0.4 and v2.6.2 (#4625)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778587200">- update to 3.0.6 (bsc#1261859, CVE-2026-39395):
  * Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801)
  * Handle whitespace-only certificate annotation (#4760)
  * fix(sign): closing SignerVerifier too early when signing with
    a security key (#4761)
  * Disallow --new-bundle-format and --rfc3161-timestamp (#4762)
  * support managed keys in conformance testing (#4728)
  * Add support for GCE metadata server env var (#4732)
  * fix: preserve per-layer annotations in
    WriteAttestationsReferrer (#4709)
  * Fix parsing of in-toto for string predicates
  * Mark batch of flags for deprecation (#4698)
  * disallow key and cert identity being used together
    during verification (#4636)
  * support key creation in GitLab group (#4704)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1783425600">- update to 3.1.1 (bsc#1267044,
  CVE-2026-25680,CVE-2026-42502,
  CVE-2026-27136,CVE-2026-25681,CVE-2026-42506,
  bsc#1266049, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829,
  CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833,
  CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595,
  CVE-2026-46597, CVE-2026-46598,
  bsc#1261811, CVE-2026-33815):
  * This release deprecates a number of flags related to
    verification material input for trust root material, as well
    as the bundle format, standardized across Sigstore SDKs,
    which is now the default output and input for signing and
    verifying respectively. You may continue to use the
    deprecated flags with Cosign v3.x releases. The deprecated
    flags will be removed in a future Cosign v4 release.
  * This release also updates the signing path for logging to
    Rekor v2. DSSE attestations will be logged as hashed entries,
    using the DSSE's pre-auth encoding (PAE). This should unblock
    developers who want to upload large signed DSSEs such as
    SBOMs.
  * Initialize PKCS11 slots Before Getting Token Info in
  * Sign exclusively via sigstore-go in
  * bundle create: Prevent IgnoreTlog when bundle contains SET in
  * Require bundle output or registry upload in
  * fix(load): pass NameOptions to name.ParseReference in
  * fix: honor --digestAlg when hashing a blob in verify-blob-
    attestation in https://github.com/sigstore/cosign/pull/4813
  * Deprecate Flags for v4: Certificates in
  * Deprecate flags signing config in
  * Deprecate flags bundle in
  * Fix typo in map of verify command fields unsupported for new
    bundle format in https://github.com/sigstore/cosign/pull/4853
  * Add bundle upgrade command in
  * Deprecate Flags for v4 in
  * fix: close file descriptor leaked in
    WriteSignedImageIndexImages loop in
  * fix: use Header.Set to prevent duplicate Authorization on
    retry in https://github.com/sigstore/cosign/pull/4870
  * feat(cli): add Rekor v2 flag to cosign signing-config create
  * Fix crash verifying timestamps when no timestamp was verified
  * Deprecate Flags for v4: OCI Referrers in
  * Use the configured Target Repository more consistently in
  * fix: check HTTP status code in LoadFileOrURL in
  * Fix unsafe type assertion in Rego policy evaluation by in
  * Fix Ed25519ph check to respect custom signing configs in
    sign-blob in https://github.com/sigstore/cosign/pull/4880
  * Enable initialize command output in conformance in
  * verify: return TUF errors for new bundle trusted roots in
  * Deprecate subcommands in
  * Remove docstring references to deprecated flags in
  * fix(verify): Attach detached certificates to static
    signatures via wrapped verifier in
  * fix(verify): copy CheckOpts inside VerifyNewBundle to fix
    data race in https://github.com/sigstore/cosign/pull/4917
  * Update sigstore-go to v1.2.0 in
  * **Full Changelog**:
    https://github.com/sigstore/cosign/compare/v3.0.6...v3.1.1</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1784289600">- updated to 3.1.2
  [#]# Deprecations
  * Deprecate --payload for sign and verify commands (#4991)
  [#]# Features
  * docs: add OVHcloud KMS in available external plugins (#4962)
  * Add insecure registry flag to ko publish in kind-verify-attestation workflow (#4970)
  * Deprecate --output-attestation (#4958)
  * Add bundle inspect command (#4842)
  [#]# Fixes
  * Guard against empty certificate PEM in mutate.Signature (#4998)
  * fix(download): Validate predicate type for new bundle format
  * Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
  * Fix Makefile: fall back to "unknown" version info when built outside a git repo (#5000)
  * fix(verify): skip identity validation for security keys (#5012)
  * fix: include artifactType in OCI 1.1 signature referrer manifest
  * Allow attestation download to handle both bundle types (#4996)
  * Fix panic in dockerfile verify on malformed FROM lines (#4979)
  * fix(release): restore signing-step auth and fail on image signing errors (#4978)
  * feat(signing-config): add --base-config flag to override services from base config (#4977)
  * fix: pass NewBundleFormat to KeyOpts in sign command (#4981)
  * fix: ignore build stage references in dockerfile verify (#4961)
  * fix: allow '=' in annotation values (#4957)
  [#]# Cleanup
  * Remove unused policy evaluation code (#4936)
  * Remove unused signing code (#4918)
  * Remove unused OCI code (#4935)
  * Remove unused ephemeral signer (#4938)
  [#]# Documentation
  * feat: improve verify flag shell completions (#4965)
  * docs: fix Short style and add Example fields to piv-tool subcommands (#4942)
  * docs: add Example fields to env and bundle create commands (#4941)
  * docs: fix Short style and add Example fields to pkcs11-tool subcommands</changelog>
</package>
<package pkgid="bd0b1a426735f402e5a00ce6aeb68a4d54851a55f26fe9eb6ddd224e4d309996e3742035632773eb35afc3d3d27a223c05fca9a26022c2f929d6838d408a8a6f" name="cosign-fish-completion" arch="noarch">
  <version epoch="0" ver="3.1.2" rel="76.2"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1699358400">- updated to 2.2.1 (jsc#SLE-23879)
  This release comes with a fix for
  CVE-2023-46737 / bsc#1216933 described in this [Github Security
  Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9).
  Enhancements:
  * feat: Support basic auth and bearer auth login to registry (#3310)
  * add support for ignoring certificates with pkcs11 (#3334)
  * Support ReplaceOp in Signatures (#3315)
  * feat: added ability to get image digest back via triangulate (#3255)
  * feat: add `--only` flag in `cosign copy` to copy sign, att &amp; sbom (#3247)
  * feat: add support attaching a Rekor bundle to a container (#3246)
  * feat: add support outputting rekor response on signing (#3248)
  * feat: improve dockerfile verify subcommand (#3264)
  * Add guard flag for experimental OCI 1.1 verify. (#3272)
  * Deprecate SBOM attachments (#3256)
  * feat: dedent line in cosign copy doc (#3244)
  * feat: add platform flag to cosign copy command (#3234)
  * Add SLSA 1.0 attestation support to cosign. Closes #2860 (#3219)
  * attest: pass OCI remote opts to att resolver. (#3225)
  Bug Fixes:
  * Merge pull request from GHSA-vfp6-jrw2-99g9
  * fix: allow cosign download sbom when image is absent (#3245)
  * ci: add a OCI registry test for referrers support (#3253)
  * Fix ReplaceSignatures (#3292)
  * Stop using deprecated in_toto.ProvenanceStatement (#3243)
  * Fixes #3236, disable SCT checking for a cosign verification when usin… (#3237)
  * fix: update error in `SignedEntity` to be more descriptive (#3233)
  * Fail timestamp verification if no root is provided (#3224)
  Documentation:
  * Add some docs about verifying in an air-gapped environment (#3321)
  * Update CONTRIBUTING.md (#3268)
  * docs: improves the Contribution guidelines (#3257)
  * Remove security policy (#3230)
  Others:
  * Set go to min 1.21 and update dependencies  (#3327)
  * Update contact for code of conduct (#3266)
  * Update .ko.yaml (#3240)</changelog>
  <changelog author="Marcos Bjoerkelund &lt;marcos.bjoerkelund@suse.com&gt;" date="1702382400">- updated to 2.2.2 (jsc#SLE-23879)
  v2.2.2 adds a new container with a shell,
  gcr.io/projectsigstore/cosign:vx.y.z-dev, in addition to the existing
  container gcr.io/projectsigstore/cosign:vx.y.z without a shell.
  For private deployments, we have also added an alias for
  - -insecure-skip-log, --private-infrastructure.
  Bug Fixes:
  * chore(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#3411) which fixes a bug with using Azure KMS
  * Don't require CT log keys if using a key/sk (#3415)
  * Fix copy without any flag set (#3409)
  * Update cosign generate cmd to not include newline (#3393)
  * Fix idempotency error with signing (#3371)
  Features:
  * Add --yes flag cosign import-key-pair to skip the overwrite confirmation. (#3383)
  * Use the timeout flag value in verify* commands. (#3391)
  * add --private-infrastructure flag (#3369)
  Container Updates:
  * Bump builder image to use go1.21.4 and add new cosign image tags with shell (#3373)
  Documentation:
  * Update SBOM_SPEC.md (#3358)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1706875200">- updated to 2.2.3 (jsc#SLE-23879)
  Bug Fixes:
  * Fix race condition on verification with multiple signatures attached to image (#3486)
  * fix(clean): Fix clean cmd for private registries (#3446)
  * Fixed BYO PKI verification (#3427)
  Features:
  * Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
  * Add support for OpenVEX predicate type (#3405)
  Documentation:
  * Resolves #3088: `version` sub-command expected behaviour documentation and testing (#3447)
  * add examples for cosign attach signature cmd (#3468)
  Misc:
  * Remove CertSubject function (#3467)
  * Use local rekor and fulcio instances in e2e tests (#3478)
- bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1713182400">- updated to 2.2.4 (jsc#SLE-23879)
  * Bug Fixes
  * Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  - CVE-2024-29902: Malicious attachments can cause system-wide denial of service (bsc#1222835)
  - CVE-2024-29903: Malicious artifects can cause machine-wide denial of service (bsc#1222837)
  * ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  * fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  * Honor creation timestamp for signatures again (#3549)
  * Features
  * Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)
  * Documentation
  * add oci bundle spec (#3622)
  * Correct help text of triangulate cmd (#3551)
  * Correct help text of verify-attestation policy argument (#3527)
  * feat: add OVHcloud MPR registry tested with cosign (#3639)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717156800">- add completion subpackages (bash, fish, zsh)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1721822400">- update to 2.3.0 (jsc#SLE-23879)
  * Features
  - Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface (#3693)
  - add registry options to cosign save (#3645)
  - Add debug providers command. (#3728)
  - Make config layers in ociremote mountable (#3741)
  - adds tsa cert chain check for env var or tuf targets. (#3600)
  - add --ca-roots and --ca-intermediates flags to 'cosign verify' (#3464)
  - add handling of keyless verification for all verify commands (#3761)
  * Bug Fixes
  - fix: close attestationFile (#3679)
  - Set bundleVerified to true after Rekor verification (Resolves #3740) (#3745)
  * Documentation
  - Document ImportKeyPair and LoadPrivateKey functions in pkg/cosign (#3776)</changelog>
  <changelog author="Sarah Kriesch &lt;sarah.kriesch@opensuse.org&gt;" date="1724155200">- Set CGO_ENABLED=1 for fixing s390x failed build</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1727870400">- update to 2.4.0 (jsc#SLE-23879)
  - Add new bundle support to verify-blob and verify-blob-attestation (#3796)
  - Adding protobuf bundle support to sign-blob and attest-blob (#3752)
  - Bump sigstore/sigstore to support email_verified as string or boolean (#3819)
  - Conformance testing for cosign (#3806)
  - move incremental builds per commit to GHCR instead of GCR (#3808)
  - Add support for recording creation timestamp for cosign attest (#3797)
  - Include SCT verification failure details in error message (#3799)</changelog>
  <changelog author="meissner@suse.com" date="1738756800">- Update to version 2.4.2:
  - Updated open-policy-agent to 1.1.0 library (#4036)
  - Note that only Rego v0 policies are supported at this time
  - Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
  - Add support for verifying root checksum in cosign initialize (#3953)
  - Detect if user supplied a valid protobuf bundle (#3931)
  - Add a log message if user doesn't provide --trusted-root (#3933)
  - Support mTLS towards container registry (#3922)
  - Add bundle create helper command (#3901)
  - Add trusted-root create helper command (#3876)
  Bug Fixes:
  - fix: set tls config while retaining other fields from default http transport (#4007)
  - policy fuzzer: ignore known panics (#3993)
  - Fix for multiple WithRemote options (#3982)
  - Add nightly conformance test workflow (#3979)
  - Fix copy --only for signatures + update/align docs (#3904)
- use "osc service mr" to update</changelog>
  <changelog author="meissner@suse.com" date="1740052800">- Update to version 2.4.3:
  * Enable fetching signatures without remote get. (#4047)
  * Bump sigstore/sigstore to support KMS plugins (#4073)
  * sort properly Go imports (#4071)
  * sync comment with parameter name in function signature (#4063)
  * fix go imports order to be alphabetical (#4062)
  * fix comment typo and imports order (#4061)
  * Feat/file flag completion improvements (#4028)
  * Udpate builder to use go1.23.6 (#4052)
  * Refactor verifyNewBundle into library function (#4013)
  * fix parsing error in --only for cosign copy (#4049)
  * Fix codeowners syntax, add dep-maintainers (#4046)</changelog>
  <changelog author="meissner@suse.com" date="1744545600">- Update to version 2.5.0:
  * Update sigstore-go to pick up bug fixes (#4150)
  * Update golangci-lint to v2, update golangci-lint-action (#4143)
  * Feat/non filename completions (#4115)
  * update builder to use go1.24.1 (#4116)
  * Add support for new bundle specification for attesting/verifying OCI image attestations (#3889)
  * Remove cert log line (#4113)
  * cmd/cosign/cli: fix typo in ignoreTLogMessage (#4111)
  * bump to latest scaffolding release for testing (#4099)
  * increase 2e2_test docker compose tiemout to 180s (#4091)
  * Fix replace with compliant image mediatype (#4077)
  * Add TSA certificate related flags and fields for cosign attest (#4079)
- Security issues fixed:
  - CVE-2024-6104: cosign: hashicorp/go-retryablehttp: url might write sensitive information to log file (bsc#1227031)
  - CVE-2024-51744: cosign: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232985)
  - CVE-2025-27144: cosign: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237682)
  - CVE-2025-22870: cosign: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238693)
  - CVE-2025-22868: cosign: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239204)
  - CVE-2025-22869: cosign: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239337)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1748433600">- switch to go1.24, enable fips build</changelog>
  <changelog author="meissner@suse.com" date="1752840000">- Update to version 2.5.3 (jsc#SLE-23879)
  - Add signing-config create command (#4280)
  - Allow multiple services to be specified for trusted-root create (#4285)
  - force when copying the latest image to overwrite (#4298)
  - Fix cert verification logic for trusted-root/SCTs (#4294)
  - Fix lint error for types package (#4295)
  - feat: Add OCI 1.1+ experimental support to tree (#4205)
  - Add validity period end for trusted-root create (#4271)
  - avoid double-loading trustedroot from file (#4264)
- Update to 2.5.2:
  - Do not load trusted root when CT env key is set
  - docs: improve doc for --no-upload option (#4206)
- Update to 2.5.1:
  * Features
  - Add Rekor v2 support for trusted-root create (#4242)
  - Add baseUrl and Uri to trusted-root create command
  - Upgrade to TUF v2 client with trusted root
  - Don't verify SCT for a private PKI cert (#4225)
  - Bump TSA library to relax EKU chain validation rules (#4219)
  * Bug Fixes
  - Bump sigstore-go to pick up log index=0 fix (#4162)
  - remove unused recursive flag on attest command (#4187)
  * Docs
  - Fix indentation in verify-blob cmd examples (#4160)
  * GO-2025-3660/ CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego (bsc#1246725)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1758196800">- Update to version 2.6.0:
  - Require exclusively a SigningConfig or service URLs when signing (#4403)
  - Add a terminal spinner while signing with sigstore-go (#4402)
  - Bump sigstore-go, support alternative hash algorithms with keys (#4386)
  - Add support for SigningConfig in sign/attest (#4371)
  - Support self-managed keys when signing with sigstore-go (#4368)
  - Remove SHA256 assumption in sign-blob/verify-blob (#4050)
  - introduce dockerfile to pin the go version to decouple go version from go.mod (#4369)
  - refactor: extract function to write referrer attestations (#4357)
  - Break import cycle with e2e build tag (#4370)
  - Update conformance test binary for signing config (#4367)
  - update builder image to use go1.25 (#4366)
  - Don't load content from TUF if trusted root path is specified (#4347)
  - Don't require timestamps when verifying with a key (#4337)
  - Fixes to cosign sign / verify for the new bundle format (#4346)
  - update builder to use go1.24.6 (#4334)
  - bump golangci-lint to v2.3.x (#4333)
  - Have cosign sign support bundle format (#4316)
  - Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
  - Verify subject with bundle only when checking claims (#4320)
  - Add to `attest-blob` the ability to supply a complete in-toto statement, and add to `verify-blob-attestation` the ability to verify with just a digest (#4306)</changelog>
  <changelog author="meissner@suse.com" date="1765368000">- Update to version 3.0.3:
  * 4554: Closes 4554 - Add warning when --output* is used (#4556)
  * chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542)
  * chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543)
  * chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546)
  * chore(deps): bump the actions group with 4 updates (#4544)
  * chore(deps): bump the gomod group across 1 directory with 5 updates (#4567)
  * chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568)
  * update builder to use go1.25.5 (#4566)
  * Protobuf bundle support for subcommand `clean` (#4539)
  * Add staging flag to initialize with staging TUF metadata
  * update slack invite link (#4560)
  * Updating sign-blob to also support signing with a certificate (#4547)
  * Bump sigstore library dependencies (#4532)
  * Protobuf bundle support for subcommands `save` and `load` (#4538)
  * Fix cert attachment for new bundle with signing config
  * Fix OCI verification with local cert - old bundle
  * chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519)
  * chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535)
  * chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536)
  * CVE-2025-58181: Fixed golang.org/x/crypto/ssh: invalidated number
    of mechanisms can cause unbounded memory consumption (bsc#1253913)
  * update go builder and cosign (#4529)
  * chore(deps): bump the gomod group across 1 directory with 7 updates (#4528)
  * chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520)
  * chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515)
  * chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518)
  * chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10.1 (#4521)
  * chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502)
  * chore(deps): bump the actions group across 1 directory with 2 updates (#4516)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111.0 (#4523)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4522)
  * Deprecate tlog-upload flag (#4458)
  * fix: Use signal context for `sign` cli package.
  * update offline verification directions (#4526)
  * Fix signing/verifying annotations for new bundle
  * Add support to download and attach for protobuf bundles (#4477)
  * Add --signing-algorithm flag (#3497)
  * Refactor signcommon bundle helpers
  * Add --bundle and fix --upload for new bundle
  * Pass insecure registry flags through to referrers
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109.1 (#4483)
  * Add protobuf bundle support for tree subcommand (#4491)
  * Remove stale embed import (#4492)
  * Support multiple container identities
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4484)
  * chore(deps): bump chainguard-dev/actions in the actions group (#4480)
  * chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4485)
  * chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#4486)
  * chore(deps): bump cuelang.org/go in the gomod group (#4479)
  * upgrade OSS-Fuzz build tooling (#4487)
  * Fix segfault when no attestations are found (#4472)
  * Use overridden repository for new bundle format (#4473)
  * update go to 1.25.3 (#4471)
  * Remove --out flag from `cosign initialize` (#4462)
  * chore(deps): bump the actions group with 2 updates (#4460)
  * Deprecate offline flag (#4457)
  * Deduplicate code in sign/attest* and verify* commands (#4449)
  * Cache signing config when calling initialize (#4456)
  * Update changelog for v3.0.2 (#4455)
  * chore(deps): bump google.golang.org/api from 0.250.0 to 0.251.0
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go
  * chore(deps): bump the actions group with 3 updates
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.107.2 to 3.108.0
  * choose different signature filename for KMS-signed release signatures (#4448)
  * chore(deps): bump github.com/go-jose/go-jose/v4 (#4451)
  * Update rekor-tiles version path
  * update CL for v3.0.1 release (#4447)
  * update goreleaser config for v3.0.0 release (#4446)
  * Create changelog for v3.0.0 (#4440)
  * Fetch service URLs from the TUF PGI signing config by default (#4428)
  * Create changelog for v2.6.1 (#4439)
  * chore(deps): bump google.golang.org/api from 0.249.0 to 0.250.0 (#4432)
  * chore(deps): bump the gomod group with 2 updates (#4429)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.8.0 to 1.9.0 (#4433)
  * chore(deps): bump the actions group with 3 updates (#4434)
  * chore(deps): bump github.com/go-openapi/swag from 0.24.1 to 0.25.1 (#4435)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4436)
  * chore(deps): bump github.com/go-openapi/runtime from 0.28.0 to 0.29.0 (#4437)
  * Bump module version to v3 for Cosign v3.0 (#4427)
  * Move sigstore-conformance back to tagged release (#4425)
  * Bump sigstore-go to v1.1.3 (#4423)
  * Partially populate the output of cosign verify when working with new bundles (#4416)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4419)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4418)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.105.0 to 3.107.0 (#4420)
  * chore(deps): bump chainguard-dev/actions in the actions group (#4421)
  * bump go builder to use 1.25.1 and cosign (#4417)
  * Bump sigstore-go for more precise user agents (#4413)
  * chore(deps): bump github.com/spf13/viper from 1.20.1 to 1.21.0 (#4408)
  * chore(deps): bump the actions group with 2 updates (#4407)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4410)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.104.0 to 3.105.0 (#4411)
  * Default to using the new protobuf format (#4318)</changelog>
  <changelog author="meissner@suse.com" date="1770811200">- Update to version 3.0.4:
  * CVE-2025-11065: Fixed github.com/go-viper/mapstructure/v2: sensitive
    Information leak in logs (bsc#1250620)
  * CVE-2026-22703: Fixed that cosign verification accepts any valid
    Rekor entry under certain conditions (bsc#1256496)
  * Fix bundle verify path for old bundle/trusted root (#4623)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616)
  * chore(deps): bump cuelang.org/go in the gomod group (#4615)
  * Optimize cosign tree performance by caching digest resolution (#4612)
  * Don't require a trusted root to verify offline with a key (#4613)
  * Support default services for trusted-root and signing-config creation (#4592)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602)
  * chore(deps): bump github.com/sigstore/sigstore-go (#4578)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601)
  * chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611)
  * chore(deps): bump k8s.io/client-go from 0.34.3 to 0.35.0 (#4604)
  * chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588)
  * chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586)
  * chore(deps): bump the gomod group with 5 updates (#4599)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600)
  * chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584)
  * chore(deps): bump the actions group with 3 updates (#4587)
  * chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589)
  * chore(deps): bump the gomod group with 9 updates (#4577)</changelog>
  <changelog author="meissner@suse.com" date="1771761600">- Update to version 3.0.5: (jsc#SLE-23879)
  * CVE-2026-24122: Fixed improper validation of certificates that
    outlive expired CA certificates (bsc#1258542)
  * CVE-2026-26958: Fixed filippo.io/edwards25519: failure to initialize
    receiver in MultiScalarMult can produce invalid results and lead to
    undefined behavior (bsc#1258612)
  * CVE-2026-24137: Fixed github.com/sigstore/sigstore/pkg/tuf: legacy
    TUF client allows for arbitrary file writes with target cache path
    traversal (bsc#1257139)
  * CVE-2026-22772: Fixed github.com/sigstore/fulcio: bypass MetaIssuer
    URL validation bypass can trigger SSRF to arbitrary internal services
    (bsc#1256562)
  * CVE-2026-23991: Fixed github.com/theupdateframework/go-tuf/v2: denial
    of service due to invalid TUF metadata JSON returned by TUF repository
    (bsc#1257080)
  * CVE-2026-23992: Fixed github.com/theupdateframework/go-tuf/v2:
    unauthorized modification to TUF metadata files due to a compromised
    or misconfigured TUF repository (bsc#1257085)
  * chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679)
  * chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670)
  * chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680)
  * chore(deps): bump the gomod group across 1 directory with 4 updates (#4702)
  * chore(deps): bump the actions group with 3 updates (#4703)
  * update golang builder to use go1.25.7 (#4687)
  * update golangci-lint to v2.8.x (#4688)
  * Fix typo in CLI help (#4701)
  * Support DSSE signing conformance test (#4685)
  * chore(deps): bump the actions group across 1 directory with 8 updates (#4689)
  * Deprecate rekor-entry-type flag (#4691)
  * Deprecate cosign triangulate (#4676)
  * Deprecate cosign copy (#4681)
  * Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668)
  * chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673)
  * Automatically require signed timestamp with Rekor v2 entries (#4666)
  * Fix syntax issue in conformance test, update nightly (#4664)
  * Add mTLS support for TSA client connections when signing with a signing config (#4620)
  * fix: avoid panic on malformed tlog entry body (#4652)
  * Verify validity of chain rather than just certificate (#4663)
  * Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
  * chore(deps): bump the gomod group across 1 directory with 3 updates (#4662)
  * Bump sigstore/sigstore to resolve GHSA (#4660)
  * Gracefully fail if bundle payload body is not a string (#4648)
  * fix: avoid panic on malformed replace payload (#4653)
  * chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659)
  * fix: avoid panic on malformed attestation payload (#4651)
  * fix: avoid panic on malformed tlog entries (#4649)
  * Update conformance to latest
  * docs(cosign): clarify RFC3161 revocation semantics (#4642)
  * Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
  * chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637)
  * Add origin key for ctfe trusted root
  * Add changelog updates for v3.0.4 and v2.6.2 (#4625)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778587200">- update to 3.0.6 (bsc#1261859, CVE-2026-39395):
  * Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801)
  * Handle whitespace-only certificate annotation (#4760)
  * fix(sign): closing SignerVerifier too early when signing with
    a security key (#4761)
  * Disallow --new-bundle-format and --rfc3161-timestamp (#4762)
  * support managed keys in conformance testing (#4728)
  * Add support for GCE metadata server env var (#4732)
  * fix: preserve per-layer annotations in
    WriteAttestationsReferrer (#4709)
  * Fix parsing of in-toto for string predicates
  * Mark batch of flags for deprecation (#4698)
  * disallow key and cert identity being used together
    during verification (#4636)
  * support key creation in GitLab group (#4704)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1783425600">- update to 3.1.1 (bsc#1267044,
  CVE-2026-25680,CVE-2026-42502,
  CVE-2026-27136,CVE-2026-25681,CVE-2026-42506,
  bsc#1266049, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829,
  CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833,
  CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595,
  CVE-2026-46597, CVE-2026-46598,
  bsc#1261811, CVE-2026-33815):
  * This release deprecates a number of flags related to
    verification material input for trust root material, as well
    as the bundle format, standardized across Sigstore SDKs,
    which is now the default output and input for signing and
    verifying respectively. You may continue to use the
    deprecated flags with Cosign v3.x releases. The deprecated
    flags will be removed in a future Cosign v4 release.
  * This release also updates the signing path for logging to
    Rekor v2. DSSE attestations will be logged as hashed entries,
    using the DSSE's pre-auth encoding (PAE). This should unblock
    developers who want to upload large signed DSSEs such as
    SBOMs.
  * Initialize PKCS11 slots Before Getting Token Info in
  * Sign exclusively via sigstore-go in
  * bundle create: Prevent IgnoreTlog when bundle contains SET in
  * Require bundle output or registry upload in
  * fix(load): pass NameOptions to name.ParseReference in
  * fix: honor --digestAlg when hashing a blob in verify-blob-
    attestation in https://github.com/sigstore/cosign/pull/4813
  * Deprecate Flags for v4: Certificates in
  * Deprecate flags signing config in
  * Deprecate flags bundle in
  * Fix typo in map of verify command fields unsupported for new
    bundle format in https://github.com/sigstore/cosign/pull/4853
  * Add bundle upgrade command in
  * Deprecate Flags for v4 in
  * fix: close file descriptor leaked in
    WriteSignedImageIndexImages loop in
  * fix: use Header.Set to prevent duplicate Authorization on
    retry in https://github.com/sigstore/cosign/pull/4870
  * feat(cli): add Rekor v2 flag to cosign signing-config create
  * Fix crash verifying timestamps when no timestamp was verified
  * Deprecate Flags for v4: OCI Referrers in
  * Use the configured Target Repository more consistently in
  * fix: check HTTP status code in LoadFileOrURL in
  * Fix unsafe type assertion in Rego policy evaluation by in
  * Fix Ed25519ph check to respect custom signing configs in
    sign-blob in https://github.com/sigstore/cosign/pull/4880
  * Enable initialize command output in conformance in
  * verify: return TUF errors for new bundle trusted roots in
  * Deprecate subcommands in
  * Remove docstring references to deprecated flags in
  * fix(verify): Attach detached certificates to static
    signatures via wrapped verifier in
  * fix(verify): copy CheckOpts inside VerifyNewBundle to fix
    data race in https://github.com/sigstore/cosign/pull/4917
  * Update sigstore-go to v1.2.0 in
  * **Full Changelog**:
    https://github.com/sigstore/cosign/compare/v3.0.6...v3.1.1</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1784289600">- updated to 3.1.2
  [#]# Deprecations
  * Deprecate --payload for sign and verify commands (#4991)
  [#]# Features
  * docs: add OVHcloud KMS in available external plugins (#4962)
  * Add insecure registry flag to ko publish in kind-verify-attestation workflow (#4970)
  * Deprecate --output-attestation (#4958)
  * Add bundle inspect command (#4842)
  [#]# Fixes
  * Guard against empty certificate PEM in mutate.Signature (#4998)
  * fix(download): Validate predicate type for new bundle format
  * Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
  * Fix Makefile: fall back to "unknown" version info when built outside a git repo (#5000)
  * fix(verify): skip identity validation for security keys (#5012)
  * fix: include artifactType in OCI 1.1 signature referrer manifest
  * Allow attestation download to handle both bundle types (#4996)
  * Fix panic in dockerfile verify on malformed FROM lines (#4979)
  * fix(release): restore signing-step auth and fail on image signing errors (#4978)
  * feat(signing-config): add --base-config flag to override services from base config (#4977)
  * fix: pass NewBundleFormat to KeyOpts in sign command (#4981)
  * fix: ignore build stage references in dockerfile verify (#4961)
  * fix: allow '=' in annotation values (#4957)
  [#]# Cleanup
  * Remove unused policy evaluation code (#4936)
  * Remove unused signing code (#4918)
  * Remove unused OCI code (#4935)
  * Remove unused ephemeral signer (#4938)
  [#]# Documentation
  * feat: improve verify flag shell completions (#4965)
  * docs: fix Short style and add Example fields to piv-tool subcommands (#4942)
  * docs: add Example fields to env and bundle create commands (#4941)
  * docs: fix Short style and add Example fields to pkcs11-tool subcommands</changelog>
</package>
<package pkgid="b0a881b9e2f68bd980410f52718927c5113a6ca90f1d4de0321dbb6b3f4b23711227da5142c51b66c144f5a31522698561dbeb39666cd70412c2814788200f9c" name="cosign-zsh-completion" arch="noarch">
  <version epoch="0" ver="3.1.2" rel="76.2"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1699358400">- updated to 2.2.1 (jsc#SLE-23879)
  This release comes with a fix for
  CVE-2023-46737 / bsc#1216933 described in this [Github Security
  Advisory](https://github.com/sigstore/cosign/security/advisories/GHSA-vfp6-jrw2-99g9).
  Enhancements:
  * feat: Support basic auth and bearer auth login to registry (#3310)
  * add support for ignoring certificates with pkcs11 (#3334)
  * Support ReplaceOp in Signatures (#3315)
  * feat: added ability to get image digest back via triangulate (#3255)
  * feat: add `--only` flag in `cosign copy` to copy sign, att &amp; sbom (#3247)
  * feat: add support attaching a Rekor bundle to a container (#3246)
  * feat: add support outputting rekor response on signing (#3248)
  * feat: improve dockerfile verify subcommand (#3264)
  * Add guard flag for experimental OCI 1.1 verify. (#3272)
  * Deprecate SBOM attachments (#3256)
  * feat: dedent line in cosign copy doc (#3244)
  * feat: add platform flag to cosign copy command (#3234)
  * Add SLSA 1.0 attestation support to cosign. Closes #2860 (#3219)
  * attest: pass OCI remote opts to att resolver. (#3225)
  Bug Fixes:
  * Merge pull request from GHSA-vfp6-jrw2-99g9
  * fix: allow cosign download sbom when image is absent (#3245)
  * ci: add a OCI registry test for referrers support (#3253)
  * Fix ReplaceSignatures (#3292)
  * Stop using deprecated in_toto.ProvenanceStatement (#3243)
  * Fixes #3236, disable SCT checking for a cosign verification when usin… (#3237)
  * fix: update error in `SignedEntity` to be more descriptive (#3233)
  * Fail timestamp verification if no root is provided (#3224)
  Documentation:
  * Add some docs about verifying in an air-gapped environment (#3321)
  * Update CONTRIBUTING.md (#3268)
  * docs: improves the Contribution guidelines (#3257)
  * Remove security policy (#3230)
  Others:
  * Set go to min 1.21 and update dependencies  (#3327)
  * Update contact for code of conduct (#3266)
  * Update .ko.yaml (#3240)</changelog>
  <changelog author="Marcos Bjoerkelund &lt;marcos.bjoerkelund@suse.com&gt;" date="1702382400">- updated to 2.2.2 (jsc#SLE-23879)
  v2.2.2 adds a new container with a shell,
  gcr.io/projectsigstore/cosign:vx.y.z-dev, in addition to the existing
  container gcr.io/projectsigstore/cosign:vx.y.z without a shell.
  For private deployments, we have also added an alias for
  - -insecure-skip-log, --private-infrastructure.
  Bug Fixes:
  * chore(deps): bump github.com/sigstore/sigstore from 1.7.5 to 1.7.6 (#3411) which fixes a bug with using Azure KMS
  * Don't require CT log keys if using a key/sk (#3415)
  * Fix copy without any flag set (#3409)
  * Update cosign generate cmd to not include newline (#3393)
  * Fix idempotency error with signing (#3371)
  Features:
  * Add --yes flag cosign import-key-pair to skip the overwrite confirmation. (#3383)
  * Use the timeout flag value in verify* commands. (#3391)
  * add --private-infrastructure flag (#3369)
  Container Updates:
  * Bump builder image to use go1.21.4 and add new cosign image tags with shell (#3373)
  Documentation:
  * Update SBOM_SPEC.md (#3358)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1706875200">- updated to 2.2.3 (jsc#SLE-23879)
  Bug Fixes:
  * Fix race condition on verification with multiple signatures attached to image (#3486)
  * fix(clean): Fix clean cmd for private registries (#3446)
  * Fixed BYO PKI verification (#3427)
  Features:
  * Allow for option in cosign attest and attest-blob to upload attestation as supported in Rekor (#3466)
  * Add support for OpenVEX predicate type (#3405)
  Documentation:
  * Resolves #3088: `version` sub-command expected behaviour documentation and testing (#3447)
  * add examples for cosign attach signature cmd (#3468)
  Misc:
  * Remove CertSubject function (#3467)
  * Use local rekor and fulcio instances in e2e tests (#3478)
- bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1713182400">- updated to 2.2.4 (jsc#SLE-23879)
  * Bug Fixes
  * Fixes for GHSA-88jx-383q-w4qc and GHSA-95pr-fxf5-86gv (#3661)
  - CVE-2024-29902: Malicious attachments can cause system-wide denial of service (bsc#1222835)
  - CVE-2024-29903: Malicious artifects can cause machine-wide denial of service (bsc#1222837)
  * ErrNoSignaturesFound should be used when there is no signature attached to an image. (#3526)
  * fix semgrep issues for dgryski.semgrep-go ruleset (#3541)
  * Honor creation timestamp for signatures again (#3549)
  * Features
  * Adds Support for Fulcio Client Credentials Flow, and Argument to Set Flow Explicitly (#3578)
  * Documentation
  * add oci bundle spec (#3622)
  * Correct help text of triangulate cmd (#3551)
  * Correct help text of verify-attestation policy argument (#3527)
  * feat: add OVHcloud MPR registry tested with cosign (#3639)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717156800">- add completion subpackages (bash, fish, zsh)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1721822400">- update to 2.3.0 (jsc#SLE-23879)
  * Features
  - Add PayloadProvider interface to decouple AttestationToPayloadJSON from oci.Signature interface (#3693)
  - add registry options to cosign save (#3645)
  - Add debug providers command. (#3728)
  - Make config layers in ociremote mountable (#3741)
  - adds tsa cert chain check for env var or tuf targets. (#3600)
  - add --ca-roots and --ca-intermediates flags to 'cosign verify' (#3464)
  - add handling of keyless verification for all verify commands (#3761)
  * Bug Fixes
  - fix: close attestationFile (#3679)
  - Set bundleVerified to true after Rekor verification (Resolves #3740) (#3745)
  * Documentation
  - Document ImportKeyPair and LoadPrivateKey functions in pkg/cosign (#3776)</changelog>
  <changelog author="Sarah Kriesch &lt;sarah.kriesch@opensuse.org&gt;" date="1724155200">- Set CGO_ENABLED=1 for fixing s390x failed build</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1727870400">- update to 2.4.0 (jsc#SLE-23879)
  - Add new bundle support to verify-blob and verify-blob-attestation (#3796)
  - Adding protobuf bundle support to sign-blob and attest-blob (#3752)
  - Bump sigstore/sigstore to support email_verified as string or boolean (#3819)
  - Conformance testing for cosign (#3806)
  - move incremental builds per commit to GHCR instead of GCR (#3808)
  - Add support for recording creation timestamp for cosign attest (#3797)
  - Include SCT verification failure details in error message (#3799)</changelog>
  <changelog author="meissner@suse.com" date="1738756800">- Update to version 2.4.2:
  - Updated open-policy-agent to 1.1.0 library (#4036)
  - Note that only Rego v0 policies are supported at this time
  - Add UseSignedTimestamps to CheckOpts, refactor TSA options (#4006)
  - Add support for verifying root checksum in cosign initialize (#3953)
  - Detect if user supplied a valid protobuf bundle (#3931)
  - Add a log message if user doesn't provide --trusted-root (#3933)
  - Support mTLS towards container registry (#3922)
  - Add bundle create helper command (#3901)
  - Add trusted-root create helper command (#3876)
  Bug Fixes:
  - fix: set tls config while retaining other fields from default http transport (#4007)
  - policy fuzzer: ignore known panics (#3993)
  - Fix for multiple WithRemote options (#3982)
  - Add nightly conformance test workflow (#3979)
  - Fix copy --only for signatures + update/align docs (#3904)
- use "osc service mr" to update</changelog>
  <changelog author="meissner@suse.com" date="1740052800">- Update to version 2.4.3:
  * Enable fetching signatures without remote get. (#4047)
  * Bump sigstore/sigstore to support KMS plugins (#4073)
  * sort properly Go imports (#4071)
  * sync comment with parameter name in function signature (#4063)
  * fix go imports order to be alphabetical (#4062)
  * fix comment typo and imports order (#4061)
  * Feat/file flag completion improvements (#4028)
  * Udpate builder to use go1.23.6 (#4052)
  * Refactor verifyNewBundle into library function (#4013)
  * fix parsing error in --only for cosign copy (#4049)
  * Fix codeowners syntax, add dep-maintainers (#4046)</changelog>
  <changelog author="meissner@suse.com" date="1744545600">- Update to version 2.5.0:
  * Update sigstore-go to pick up bug fixes (#4150)
  * Update golangci-lint to v2, update golangci-lint-action (#4143)
  * Feat/non filename completions (#4115)
  * update builder to use go1.24.1 (#4116)
  * Add support for new bundle specification for attesting/verifying OCI image attestations (#3889)
  * Remove cert log line (#4113)
  * cmd/cosign/cli: fix typo in ignoreTLogMessage (#4111)
  * bump to latest scaffolding release for testing (#4099)
  * increase 2e2_test docker compose tiemout to 180s (#4091)
  * Fix replace with compliant image mediatype (#4077)
  * Add TSA certificate related flags and fields for cosign attest (#4079)
- Security issues fixed:
  - CVE-2024-6104: cosign: hashicorp/go-retryablehttp: url might write sensitive information to log file (bsc#1227031)
  - CVE-2024-51744: cosign: github.com/golang-jwt/jwt/v4: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (bsc#1232985)
  - CVE-2025-27144: cosign: github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237682)
  - CVE-2025-22870: cosign: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238693)
  - CVE-2025-22868: cosign: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239204)
  - CVE-2025-22869: cosign: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239337)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1748433600">- switch to go1.24, enable fips build</changelog>
  <changelog author="meissner@suse.com" date="1752840000">- Update to version 2.5.3 (jsc#SLE-23879)
  - Add signing-config create command (#4280)
  - Allow multiple services to be specified for trusted-root create (#4285)
  - force when copying the latest image to overwrite (#4298)
  - Fix cert verification logic for trusted-root/SCTs (#4294)
  - Fix lint error for types package (#4295)
  - feat: Add OCI 1.1+ experimental support to tree (#4205)
  - Add validity period end for trusted-root create (#4271)
  - avoid double-loading trustedroot from file (#4264)
- Update to 2.5.2:
  - Do not load trusted root when CT env key is set
  - docs: improve doc for --no-upload option (#4206)
- Update to 2.5.1:
  * Features
  - Add Rekor v2 support for trusted-root create (#4242)
  - Add baseUrl and Uri to trusted-root create command
  - Upgrade to TUF v2 client with trusted root
  - Don't verify SCT for a private PKI cert (#4225)
  - Bump TSA library to relax EKU chain validation rules (#4219)
  * Bug Fixes
  - Bump sigstore-go to pick up log index=0 fix (#4162)
  - remove unused recursive flag on attest command (#4187)
  * Docs
  - Fix indentation in verify-blob cmd examples (#4160)
  * GO-2025-3660/ CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego (bsc#1246725)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1758196800">- Update to version 2.6.0:
  - Require exclusively a SigningConfig or service URLs when signing (#4403)
  - Add a terminal spinner while signing with sigstore-go (#4402)
  - Bump sigstore-go, support alternative hash algorithms with keys (#4386)
  - Add support for SigningConfig in sign/attest (#4371)
  - Support self-managed keys when signing with sigstore-go (#4368)
  - Remove SHA256 assumption in sign-blob/verify-blob (#4050)
  - introduce dockerfile to pin the go version to decouple go version from go.mod (#4369)
  - refactor: extract function to write referrer attestations (#4357)
  - Break import cycle with e2e build tag (#4370)
  - Update conformance test binary for signing config (#4367)
  - update builder image to use go1.25 (#4366)
  - Don't load content from TUF if trusted root path is specified (#4347)
  - Don't require timestamps when verifying with a key (#4337)
  - Fixes to cosign sign / verify for the new bundle format (#4346)
  - update builder to use go1.24.6 (#4334)
  - bump golangci-lint to v2.3.x (#4333)
  - Have cosign sign support bundle format (#4316)
  - Add support for SigningConfig for sign-blob/attest-blob, support Rekor v2 (#4319)
  - Verify subject with bundle only when checking claims (#4320)
  - Add to `attest-blob` the ability to supply a complete in-toto statement, and add to `verify-blob-attestation` the ability to verify with just a digest (#4306)</changelog>
  <changelog author="meissner@suse.com" date="1765368000">- Update to version 3.0.3:
  * 4554: Closes 4554 - Add warning when --output* is used (#4556)
  * chore(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.1.0 (#4545)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.111.0 to 3.113.0 (#4542)
  * chore(deps): bump github.com/awslabs/amazon-ecr-credential-helper/ecr-login (#4543)
  * chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4546)
  * chore(deps): bump the actions group with 4 updates (#4544)
  * chore(deps): bump the gomod group across 1 directory with 5 updates (#4567)
  * chore(deps): bump golang from 1.25.4 to 1.25.5 in the all group (#4568)
  * update builder to use go1.25.5 (#4566)
  * Protobuf bundle support for subcommand `clean` (#4539)
  * Add staging flag to initialize with staging TUF metadata
  * update slack invite link (#4560)
  * Updating sign-blob to also support signing with a certificate (#4547)
  * Bump sigstore library dependencies (#4532)
  * Protobuf bundle support for subcommands `save` and `load` (#4538)
  * Fix cert attachment for new bundle with signing config
  * Fix OCI verification with local cert - old bundle
  * chore(deps): bump github.com/sigstore/fulcio from 1.7.1 to 1.8.1 (#4519)
  * chore(deps): bump golang.org/x/crypto in /test/fakeoidc (#4535)
  * chore(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#4536)
  * CVE-2025-58181: Fixed golang.org/x/crypto/ssh: invalidated number
    of mechanisms can cause unbounded memory consumption (bsc#1253913)
  * update go builder and cosign (#4529)
  * chore(deps): bump the gomod group across 1 directory with 7 updates (#4528)
  * chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4478)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4520)
  * chore(deps): bump golang from 1.25.3 to 1.25.4 in the all group (#4515)
  * chore(deps): bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 (#4518)
  * chore(deps): bump cuelang.org/go from 0.14.2 to 0.15.0 (#4524)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.9.0 to 1.10.1 (#4521)
  * chore(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 (#4502)
  * chore(deps): bump the actions group across 1 directory with 2 updates (#4516)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.110.0 to 3.111.0 (#4523)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4522)
  * Deprecate tlog-upload flag (#4458)
  * fix: Use signal context for `sign` cli package.
  * update offline verification directions (#4526)
  * Fix signing/verifying annotations for new bundle
  * Add support to download and attach for protobuf bundles (#4477)
  * Add --signing-algorithm flag (#3497)
  * Refactor signcommon bundle helpers
  * Add --bundle and fix --upload for new bundle
  * Pass insecure registry flags through to referrers
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.108.0 to 3.109.1 (#4483)
  * Add protobuf bundle support for tree subcommand (#4491)
  * Remove stale embed import (#4492)
  * Support multiple container identities
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4484)
  * chore(deps): bump chainguard-dev/actions in the actions group (#4480)
  * chore(deps): bump github.com/sigstore/rekor-tiles/v2 (#4485)
  * chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (#4486)
  * chore(deps): bump cuelang.org/go in the gomod group (#4479)
  * upgrade OSS-Fuzz build tooling (#4487)
  * Fix segfault when no attestations are found (#4472)
  * Use overridden repository for new bundle format (#4473)
  * update go to 1.25.3 (#4471)
  * Remove --out flag from `cosign initialize` (#4462)
  * chore(deps): bump the actions group with 2 updates (#4460)
  * Deprecate offline flag (#4457)
  * Deduplicate code in sign/attest* and verify* commands (#4449)
  * Cache signing config when calling initialize (#4456)
  * Update changelog for v3.0.2 (#4455)
  * chore(deps): bump google.golang.org/api from 0.250.0 to 0.251.0
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go
  * chore(deps): bump the actions group with 3 updates
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.107.2 to 3.108.0
  * choose different signature filename for KMS-signed release signatures (#4448)
  * chore(deps): bump github.com/go-jose/go-jose/v4 (#4451)
  * Update rekor-tiles version path
  * update CL for v3.0.1 release (#4447)
  * update goreleaser config for v3.0.0 release (#4446)
  * Create changelog for v3.0.0 (#4440)
  * Fetch service URLs from the TUF PGI signing config by default (#4428)
  * Create changelog for v2.6.1 (#4439)
  * chore(deps): bump google.golang.org/api from 0.249.0 to 0.250.0 (#4432)
  * chore(deps): bump the gomod group with 2 updates (#4429)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.8.0 to 1.9.0 (#4433)
  * chore(deps): bump the actions group with 3 updates (#4434)
  * chore(deps): bump github.com/go-openapi/swag from 0.24.1 to 0.25.1 (#4435)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4436)
  * chore(deps): bump github.com/go-openapi/runtime from 0.28.0 to 0.29.0 (#4437)
  * Bump module version to v3 for Cosign v3.0 (#4427)
  * Move sigstore-conformance back to tagged release (#4425)
  * Bump sigstore-go to v1.1.3 (#4423)
  * Partially populate the output of cosign verify when working with new bundles (#4416)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4419)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4418)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.105.0 to 3.107.0 (#4420)
  * chore(deps): bump chainguard-dev/actions in the actions group (#4421)
  * bump go builder to use 1.25.1 and cosign (#4417)
  * Bump sigstore-go for more precise user agents (#4413)
  * chore(deps): bump github.com/spf13/viper from 1.20.1 to 1.21.0 (#4408)
  * chore(deps): bump the actions group with 2 updates (#4407)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4410)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.104.0 to 3.105.0 (#4411)
  * Default to using the new protobuf format (#4318)</changelog>
  <changelog author="meissner@suse.com" date="1770811200">- Update to version 3.0.4:
  * CVE-2025-11065: Fixed github.com/go-viper/mapstructure/v2: sensitive
    Information leak in logs (bsc#1250620)
  * CVE-2026-22703: Fixed that cosign verification accepts any valid
    Rekor entry under certain conditions (bsc#1256496)
  * Fix bundle verify path for old bundle/trusted root (#4623)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4616)
  * chore(deps): bump cuelang.org/go in the gomod group (#4615)
  * Optimize cosign tree performance by caching digest resolution (#4612)
  * Don't require a trusted root to verify offline with a key (#4613)
  * Support default services for trusted-root and signing-config creation (#4592)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4602)
  * chore(deps): bump github.com/sigstore/sigstore-go (#4578)
  * chore(deps): bump github.com/buildkite/agent/v3 from 3.114.1 to 3.115.2 (#4601)
  * chore(deps): bump google.golang.org/api from 0.257.0 to 0.258.0 (#4611)
  * chore(deps): bump k8s.io/client-go from 0.34.3 to 0.35.0 (#4604)
  * chore(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#4588)
  * chore(deps): bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 (#4586)
  * chore(deps): bump the gomod group with 5 updates (#4599)
  * chore(deps): bump github.com/open-policy-agent/opa from 1.10.1 to 1.12.1 (#4600)
  * chore(deps): bump golang.org/x/term from 0.37.0 to 0.38.0 (#4584)
  * chore(deps): bump the actions group with 3 updates (#4587)
  * chore(deps): bump actions/cache from 4.3.0 to 5.0.1 (#4589)
  * chore(deps): bump the gomod group with 9 updates (#4577)</changelog>
  <changelog author="meissner@suse.com" date="1771761600">- Update to version 3.0.5: (jsc#SLE-23879)
  * CVE-2026-24122: Fixed improper validation of certificates that
    outlive expired CA certificates (bsc#1258542)
  * CVE-2026-26958: Fixed filippo.io/edwards25519: failure to initialize
    receiver in MultiScalarMult can produce invalid results and lead to
    undefined behavior (bsc#1258612)
  * CVE-2026-24137: Fixed github.com/sigstore/sigstore/pkg/tuf: legacy
    TUF client allows for arbitrary file writes with target cache path
    traversal (bsc#1257139)
  * CVE-2026-22772: Fixed github.com/sigstore/fulcio: bypass MetaIssuer
    URL validation bypass can trigger SSRF to arbitrary internal services
    (bsc#1256562)
  * CVE-2026-23991: Fixed github.com/theupdateframework/go-tuf/v2: denial
    of service due to invalid TUF metadata JSON returned by TUF repository
    (bsc#1257080)
  * CVE-2026-23992: Fixed github.com/theupdateframework/go-tuf/v2:
    unauthorized modification to TUF metadata files due to a compromised
    or misconfigured TUF repository (bsc#1257085)
  * chore(deps): bump google.golang.org/api from 0.260.0 to 0.264.0 (#4679)
  * chore(deps): bump github.com/sigstore/rekor-tiles/v2 from 2.0.1 to 2.1.0 (#4670)
  * chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 (#4712)
  * chore(deps): bump gitlab.com/gitlab-org/api/client-go (#4680)
  * chore(deps): bump the gomod group across 1 directory with 4 updates (#4702)
  * chore(deps): bump the actions group with 3 updates (#4703)
  * update golang builder to use go1.25.7 (#4687)
  * update golangci-lint to v2.8.x (#4688)
  * Fix typo in CLI help (#4701)
  * Support DSSE signing conformance test (#4685)
  * chore(deps): bump the actions group across 1 directory with 8 updates (#4689)
  * Deprecate rekor-entry-type flag (#4691)
  * Deprecate cosign triangulate (#4676)
  * Deprecate cosign copy (#4681)
  * Enforce TSA requirement for Rekor v2, Fuclio signing (#4683)
  * chore(deps): bump github.com/theupdateframework/go-tuf/v2 (#4668)
  * chore(deps): bump golang from 1.25.5 to 1.25.6 in the all group (#4673)
  * Automatically require signed timestamp with Rekor v2 entries (#4666)
  * Fix syntax issue in conformance test, update nightly (#4664)
  * Add mTLS support for TSA client connections when signing with a signing config (#4620)
  * fix: avoid panic on malformed tlog entry body (#4652)
  * Verify validity of chain rather than just certificate (#4663)
  * Allow --local-image with --new-bundle-format for v2 and v3 signatures (#4626)
  * chore(deps): bump the gomod group across 1 directory with 3 updates (#4662)
  * Bump sigstore/sigstore to resolve GHSA (#4660)
  * Gracefully fail if bundle payload body is not a string (#4648)
  * fix: avoid panic on malformed replace payload (#4653)
  * chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 (#4659)
  * fix: avoid panic on malformed attestation payload (#4651)
  * fix: avoid panic on malformed tlog entries (#4649)
  * Update conformance to latest
  * docs(cosign): clarify RFC3161 revocation semantics (#4642)
  * Add empty predicate to cosign sign when payload type is application/vnd.in-toto+json (#4635)
  * chore(deps): bump github.com/sigstore/fulcio from 1.8.4 to 1.8.5 (#4637)
  * Add origin key for ctfe trusted root
  * Add changelog updates for v3.0.4 and v2.6.2 (#4625)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778587200">- update to 3.0.6 (bsc#1261859, CVE-2026-39395):
  * Fix DSSE predicate check (GHSA-w6c6-c85g-mmv6) (#4801)
  * Handle whitespace-only certificate annotation (#4760)
  * fix(sign): closing SignerVerifier too early when signing with
    a security key (#4761)
  * Disallow --new-bundle-format and --rfc3161-timestamp (#4762)
  * support managed keys in conformance testing (#4728)
  * Add support for GCE metadata server env var (#4732)
  * fix: preserve per-layer annotations in
    WriteAttestationsReferrer (#4709)
  * Fix parsing of in-toto for string predicates
  * Mark batch of flags for deprecation (#4698)
  * disallow key and cert identity being used together
    during verification (#4636)
  * support key creation in GitLab group (#4704)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1783425600">- update to 3.1.1 (bsc#1267044,
  CVE-2026-25680,CVE-2026-42502,
  CVE-2026-27136,CVE-2026-25681,CVE-2026-42506,
  bsc#1266049, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829,
  CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833,
  CVE-2026-39834, CVE-2026-39835, CVE-2026-42508, CVE-2026-46595,
  CVE-2026-46597, CVE-2026-46598,
  bsc#1261811, CVE-2026-33815):
  * This release deprecates a number of flags related to
    verification material input for trust root material, as well
    as the bundle format, standardized across Sigstore SDKs,
    which is now the default output and input for signing and
    verifying respectively. You may continue to use the
    deprecated flags with Cosign v3.x releases. The deprecated
    flags will be removed in a future Cosign v4 release.
  * This release also updates the signing path for logging to
    Rekor v2. DSSE attestations will be logged as hashed entries,
    using the DSSE's pre-auth encoding (PAE). This should unblock
    developers who want to upload large signed DSSEs such as
    SBOMs.
  * Initialize PKCS11 slots Before Getting Token Info in
  * Sign exclusively via sigstore-go in
  * bundle create: Prevent IgnoreTlog when bundle contains SET in
  * Require bundle output or registry upload in
  * fix(load): pass NameOptions to name.ParseReference in
  * fix: honor --digestAlg when hashing a blob in verify-blob-
    attestation in https://github.com/sigstore/cosign/pull/4813
  * Deprecate Flags for v4: Certificates in
  * Deprecate flags signing config in
  * Deprecate flags bundle in
  * Fix typo in map of verify command fields unsupported for new
    bundle format in https://github.com/sigstore/cosign/pull/4853
  * Add bundle upgrade command in
  * Deprecate Flags for v4 in
  * fix: close file descriptor leaked in
    WriteSignedImageIndexImages loop in
  * fix: use Header.Set to prevent duplicate Authorization on
    retry in https://github.com/sigstore/cosign/pull/4870
  * feat(cli): add Rekor v2 flag to cosign signing-config create
  * Fix crash verifying timestamps when no timestamp was verified
  * Deprecate Flags for v4: OCI Referrers in
  * Use the configured Target Repository more consistently in
  * fix: check HTTP status code in LoadFileOrURL in
  * Fix unsafe type assertion in Rego policy evaluation by in
  * Fix Ed25519ph check to respect custom signing configs in
    sign-blob in https://github.com/sigstore/cosign/pull/4880
  * Enable initialize command output in conformance in
  * verify: return TUF errors for new bundle trusted roots in
  * Deprecate subcommands in
  * Remove docstring references to deprecated flags in
  * fix(verify): Attach detached certificates to static
    signatures via wrapped verifier in
  * fix(verify): copy CheckOpts inside VerifyNewBundle to fix
    data race in https://github.com/sigstore/cosign/pull/4917
  * Update sigstore-go to v1.2.0 in
  * **Full Changelog**:
    https://github.com/sigstore/cosign/compare/v3.0.6...v3.1.1</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1784289600">- updated to 3.1.2
  [#]# Deprecations
  * Deprecate --payload for sign and verify commands (#4991)
  [#]# Features
  * docs: add OVHcloud KMS in available external plugins (#4962)
  * Add insecure registry flag to ko publish in kind-verify-attestation workflow (#4970)
  * Deprecate --output-attestation (#4958)
  * Add bundle inspect command (#4842)
  [#]# Fixes
  * Guard against empty certificate PEM in mutate.Signature (#4998)
  * fix(download): Validate predicate type for new bundle format
  * Skip nil subject entries in IntotoSubjectClaimVerifier (#5016)
  * Fix Makefile: fall back to "unknown" version info when built outside a git repo (#5000)
  * fix(verify): skip identity validation for security keys (#5012)
  * fix: include artifactType in OCI 1.1 signature referrer manifest
  * Allow attestation download to handle both bundle types (#4996)
  * Fix panic in dockerfile verify on malformed FROM lines (#4979)
  * fix(release): restore signing-step auth and fail on image signing errors (#4978)
  * feat(signing-config): add --base-config flag to override services from base config (#4977)
  * fix: pass NewBundleFormat to KeyOpts in sign command (#4981)
  * fix: ignore build stage references in dockerfile verify (#4961)
  * fix: allow '=' in annotation values (#4957)
  [#]# Cleanup
  * Remove unused policy evaluation code (#4936)
  * Remove unused signing code (#4918)
  * Remove unused OCI code (#4935)
  * Remove unused ephemeral signer (#4938)
  [#]# Documentation
  * feat: improve verify flag shell completions (#4965)
  * docs: fix Short style and add Example fields to piv-tool subcommands (#4942)
  * docs: add Example fields to env and bundle create commands (#4941)
  * docs: fix Short style and add Example fields to pkcs11-tool subcommands</changelog>
</package>
<package pkgid="2721e31523ea362bcadcbce57e99925416cc17860616fe01b445a6bb2190f8020704d1daf61a7142a633cba7a44ef06eb5467b0638f79ae8908796718cf11479" name="cppcodec" arch="noarch">
  <version epoch="0" ver="0.1" rel="1.36"/>
  <changelog author="mrueckert@suse.de" date="1523361600">- initial package 0.1</changelog>
</package>
<package pkgid="0938386f2623a1467c86a3254904e4dd8172c8d49ca083d67bc526de8d52ae393c0361411393ea5d1f14955201870e6dab1a9700d090997953e7fae7a14538b2" name="cppcodec" arch="src">
  <version epoch="0" ver="0.1" rel="1.36"/>
  <changelog author="mrueckert@suse.de" date="1523361600">- initial package 0.1</changelog>
</package>
<package pkgid="34e2485d2cacabc166c7b0df819aa50a05fafe1ba9995e5fb31b77f4769e46d828475b0ab852461acd221cc2647edaa9471eb3ff3fd553bc13520f84b22117ac" name="crackpkcs12" arch="s390x">
  <version epoch="0" ver="0.2.11" rel="1.5"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758456000">- initial version</changelog>
</package>
<package pkgid="b7540600b3f739108f23427183755ce79b9edcd189a2abf28cbcde915cb96bd9357f7324201a82d521b260ef5c7c33a4bc9851f3317af6b18efc8fa2574c318e" name="crackpkcs12" arch="src">
  <version epoch="0" ver="0.2.11" rel="1.5"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758456000">- initial version</changelog>
</package>
<package pkgid="3a505acbd3370a93fab014b758c14078386c96269a7f5cf4fcd1eded998c09691bb53f7afd626257cc126e66861eb82a1c84120ee9628eb131019346f960aadf" name="crackpkcs12-debuginfo" arch="s390x">
  <version epoch="0" ver="0.2.11" rel="1.5"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758456000">- initial version</changelog>
</package>
<package pkgid="7a46b47ab8799b10157facbd7c4a8e5b40475f25be803ee523ee0217996201034dc68bc0ff140aafe0522af6d38109b187be7ea3ee5316df6edf901861c74210" name="crackpkcs12-debugsource" arch="s390x">
  <version epoch="0" ver="0.2.11" rel="1.5"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1758456000">- initial version</changelog>
</package>
<package pkgid="1d269fdf3eef439d3e6694611f08721a7316118dbf509041cb4833dd1a7aa5e4c8d2ee471ffae37ec76f500c37e8709f5da1fe2207b4565f975a6802b9564ead" name="crowdsec" arch="s390x">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="dff7c97cc4c203d5e0cba2051946aada37c8228f1574360e6ce88e66c240321d30be49f3fe528033bc8b2cdccd86f7ba7b673de96d8c23840e685a4d4fc85de6" name="crowdsec" arch="src">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="d70e0a2d876f100e4992bba86cd117fe9053eca2d39c3c15e1f3fc9d8fa4b869134f3db65099c8ce454d7c994d2d55c7d73a39de73c2489cc494ae2eecb2b98f" name="crowdsec-apache2-bouncer" arch="s390x">
  <version epoch="0" ver="0.1" rel="1.10"/>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742731200">- initial packaging</changelog>
</package>
<package pkgid="b164b971d6ded35327032ce0328b8b498f0afd9e243e1d4056d14a76463be8f671698ee2a7771c3ad98c0392f498fa92f434301224176fa2c143e885748e2b00" name="crowdsec-apache2-bouncer" arch="src">
  <version epoch="0" ver="0.1" rel="1.10"/>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742731200">- initial packaging</changelog>
</package>
<package pkgid="98b7dd94a5b80a13561981bfce58e0919415c8586b108c32cb520bcdaab99b7f16847166e2b067225af9e6ebbda8c486653473fa9c3700e5bd46fdfd8a5623a5" name="crowdsec-apache2-bouncer-debuginfo" arch="s390x">
  <version epoch="0" ver="0.1" rel="1.10"/>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742731200">- initial packaging</changelog>
</package>
<package pkgid="2402cab5756319a9178f984f75828b623600927eeb599c67295a452a4e191c1441bd9e64d9378428fe1f5f57ac00509cac43026cd8bf3671ceb62ed9b492d4c7" name="crowdsec-apache2-bouncer-debugsource" arch="s390x">
  <version epoch="0" ver="0.1" rel="1.10"/>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742731200">- initial packaging</changelog>
</package>
<package pkgid="7646e9c140819c6e6a5f584e505b2fd73f5c0bde3aee7e0a33805aa8f7bc3c0ad25bcee3e1156fd60195f7d2ea003055617aeda5af364e0f85fc36f11b10673a" name="crowdsec-bash-completion" arch="noarch">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="c69bd15bbd922cce6cf579393e3d0d93a95caf9cd28521b89e0bb1a4fc5ff023211e20408bc383e75d6499a9a039c072b94b8d2f092ed0b92887cbfd856e6891" name="crowdsec-custom-bouncer" arch="s390x">
  <version epoch="0" ver="0.0.19" rel="1.26"/>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742644800">- initial packaging</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1747742400">- update to 0.0.19:
  * config: apply variable expansion to all keys
  * Makefile: use GO macro if set, to check for version
  * logging: full standard timestamp with timezone (yyyy-mm-dd)
  * Log level: don't demote trace to debug if using the -v flag
- update to 0.0.18:
  * same changelog as 0.0.19.</changelog>
</package>
<package pkgid="9c30329459fc2f50684951c8306995fa2695e6b98838849f6a94ff8ae9659e6a5a03c8dbc64d93f13983f3a94723ea67f56171a4f58aa945583ab846a47cf14e" name="crowdsec-custom-bouncer" arch="src">
  <version epoch="0" ver="0.0.19" rel="1.26"/>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742644800">- initial packaging</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1747742400">- update to 0.0.19:
  * config: apply variable expansion to all keys
  * Makefile: use GO macro if set, to check for version
  * logging: full standard timestamp with timezone (yyyy-mm-dd)
  * Log level: don't demote trace to debug if using the -v flag
- update to 0.0.18:
  * same changelog as 0.0.19.</changelog>
</package>
<package pkgid="8dfe4a0d4206961ff9e7cf68a4c78328ba5d8b7a6ccdc48c3ecd7c16ae8105f42fe4d4a32417f4f18844c15fb588c98f8430d1c52c6cf5d1587a359148378241" name="crowdsec-custom-bouncer-debuginfo" arch="s390x">
  <version epoch="0" ver="0.0.19" rel="1.26"/>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742644800">- initial packaging</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1747742400">- update to 0.0.19:
  * config: apply variable expansion to all keys
  * Makefile: use GO macro if set, to check for version
  * logging: full standard timestamp with timezone (yyyy-mm-dd)
  * Log level: don't demote trace to debug if using the -v flag
- update to 0.0.18:
  * same changelog as 0.0.19.</changelog>
</package>
<package pkgid="7b6060419da821e9f160058d1fe78b3809d56f31adfffe53c947182c7c8cdcbbf959d7d5d5b1d10f8f0a204a5f792e025cd0d30d44d252108dee1c8082fe50a8" name="crowdsec-debuginfo" arch="s390x">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="a12fd39728a2e161c25e9bebb2a6ebf61ef9fe7054d63ad22c4d80ce6a03a373c48c1a5950b714da96683dcea0ff50749e26be22570dbf2e12f7fbe463b6eb27" name="crowdsec-firewall-bouncer" arch="s390x">
  <version epoch="0" ver="0.0.34" rel="1.21"/>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1723550400">- new package crowdsec-firewall-bouncer: Crowdsec bouncer written
  in golang for firewalls. crowdsec-firewall-bouncer will fetch new
  and old decisions from a CrowdSec API to add them in a blocklist
  used by supported firewalls.
- initial version: v0.0.28:
  * Change log message "failed to flush" from info -&gt; debug
  * Add option -version in favor of -V
  * func tests: no api key and certs at the same time
  * update crowdsec/go-cs-lib/go-cs-bouncer dependencies
  * Increase ipset_size default to 131072
  * force raw output on cscli during install
  * fix vendor packaging
  * iptables: allow deny_action=TARPIT
  * use go 1.20.7, golangci-lint 1.54
  * update test dependencies</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1724068800">- Update to version 0.0.29:
  * revert go 1.22 minimal requirement
  * make: remove redundant go version check
  * update lint configuration; require go 1.22
  * update functional test
  * Add TLS auth keys to config.yaml
  * use go 1.21.9
  * update deps: crowdsec 1.6.1, go-cs-lib 0.0.10
  * emit banned IPs metrics when in ipset mode
  * Allow overriding version.System in docker builds
  * config: apply variable expansion to all keys
  * deps: update test dependencies
  * go.mod: remove reference to unused sqlite
  * deps: bump crowdsec to 1.6.0
  * CI: use go 1.21.7; bump actions
  * use go 1.21.6
  * basic PF prometheus metrics (packets, bytes, banned ip count)
  * Governance init
  * Makefile: use GO macro if set, to check for version
  * logging: full standard timestamp with timezone (yyyy-mm-dd)
  * Log level: don't demote trace to debug if using the -v flag
  * golangci-lint update
  * use go 1.21.5
  * update dependency on crowdsec and go-cs-bouncer
  * Lint
  * remove the the Before causing some systemd cycling issue.
  * allow ipset to clean up tables when receiving sigterm
  * Release action: fix asset upload</changelog>
  <changelog author="aj@ajaissle.de" date="1733918400">- Update to version 0.0.30:
  * Add support for usage metrics + improve metrics performance + improve iptables mode performance</changelog>
  <changelog author="aj@ajaissle.de" date="1733918401">- Update to version 0.0.31:
  * iptables: do not ignore logging configuration
  * update dependencies + lint
  * Pipenv cache + remove useless build flags</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1735992000">- require firewall backend
- seperate out the service file
- adapt the config file for the default firewall backend
- remove the rc service file
- remove _bouncer.sh script, as we replace it with our own script,
  which removes most of the packaging parts
- add a simple script which autoconfigures the bouncer to a local
  crowdsec instance</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740225600">- switch from always running the script, to moving it as a binary the
  user has to execute, before running the daemon</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove golang-packaging from the BR, as we only need go itself
- remove the no_strip macro, as that's not needed anymore</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- add Requires for ipset on 15.x</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- Require ipset for all distributions</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1749643200">- Update to version 0.0.33:
  * add a fix for crowdsec firewall bouncer on fedora
- update to version 0.0.32:
  * properly flush outgoing connections when adding a banned ip
  * simplify pf state flush
  * Disable timeouts for Edgerouter 10x ipsets
  * Ensure monotonic traffic metrics
  * add an option to allow adding a comment to iptables rules
  * refactor metrics registration</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1754913600">- Update to version 0.0.34:
  * enhance: allow user to specify v4 and v6 chains independantly
  * enhance: Update strconv to uint64 for 32 bit cpus
  * do not exit with an error if stopped by SIGTERM or SIGINT
  * warn user if DOCKER-USER chain is detected but not configured
  * nftables: use named counters to track processed/dropped metrics
  * Revert "enhance: Update strconv to uint64 to allow go runtime to handle 32 bit allocation"
  * enhance: Update strconv to uint64 to allow go runtime to handle 32 bit allocation
  * enhance: Allow disabling ipv4</changelog>
</package>
<package pkgid="a986619a56f5fd7969cd619f90b66b2b4d2531afd3b92183420ba2524c8667539c8178cd62ca5f542869799588b33d8420baeeef2b7828b63f748cea8b9b0ec3" name="crowdsec-firewall-bouncer" arch="src">
  <version epoch="0" ver="0.0.34" rel="1.21"/>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1723550400">- new package crowdsec-firewall-bouncer: Crowdsec bouncer written
  in golang for firewalls. crowdsec-firewall-bouncer will fetch new
  and old decisions from a CrowdSec API to add them in a blocklist
  used by supported firewalls.
- initial version: v0.0.28:
  * Change log message "failed to flush" from info -&gt; debug
  * Add option -version in favor of -V
  * func tests: no api key and certs at the same time
  * update crowdsec/go-cs-lib/go-cs-bouncer dependencies
  * Increase ipset_size default to 131072
  * force raw output on cscli during install
  * fix vendor packaging
  * iptables: allow deny_action=TARPIT
  * use go 1.20.7, golangci-lint 1.54
  * update test dependencies</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1724068800">- Update to version 0.0.29:
  * revert go 1.22 minimal requirement
  * make: remove redundant go version check
  * update lint configuration; require go 1.22
  * update functional test
  * Add TLS auth keys to config.yaml
  * use go 1.21.9
  * update deps: crowdsec 1.6.1, go-cs-lib 0.0.10
  * emit banned IPs metrics when in ipset mode
  * Allow overriding version.System in docker builds
  * config: apply variable expansion to all keys
  * deps: update test dependencies
  * go.mod: remove reference to unused sqlite
  * deps: bump crowdsec to 1.6.0
  * CI: use go 1.21.7; bump actions
  * use go 1.21.6
  * basic PF prometheus metrics (packets, bytes, banned ip count)
  * Governance init
  * Makefile: use GO macro if set, to check for version
  * logging: full standard timestamp with timezone (yyyy-mm-dd)
  * Log level: don't demote trace to debug if using the -v flag
  * golangci-lint update
  * use go 1.21.5
  * update dependency on crowdsec and go-cs-bouncer
  * Lint
  * remove the the Before causing some systemd cycling issue.
  * allow ipset to clean up tables when receiving sigterm
  * Release action: fix asset upload</changelog>
  <changelog author="aj@ajaissle.de" date="1733918400">- Update to version 0.0.30:
  * Add support for usage metrics + improve metrics performance + improve iptables mode performance</changelog>
  <changelog author="aj@ajaissle.de" date="1733918401">- Update to version 0.0.31:
  * iptables: do not ignore logging configuration
  * update dependencies + lint
  * Pipenv cache + remove useless build flags</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1735992000">- require firewall backend
- seperate out the service file
- adapt the config file for the default firewall backend
- remove the rc service file
- remove _bouncer.sh script, as we replace it with our own script,
  which removes most of the packaging parts
- add a simple script which autoconfigures the bouncer to a local
  crowdsec instance</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740225600">- switch from always running the script, to moving it as a binary the
  user has to execute, before running the daemon</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove golang-packaging from the BR, as we only need go itself
- remove the no_strip macro, as that's not needed anymore</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- add Requires for ipset on 15.x</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- Require ipset for all distributions</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1749643200">- Update to version 0.0.33:
  * add a fix for crowdsec firewall bouncer on fedora
- update to version 0.0.32:
  * properly flush outgoing connections when adding a banned ip
  * simplify pf state flush
  * Disable timeouts for Edgerouter 10x ipsets
  * Ensure monotonic traffic metrics
  * add an option to allow adding a comment to iptables rules
  * refactor metrics registration</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1754913600">- Update to version 0.0.34:
  * enhance: allow user to specify v4 and v6 chains independantly
  * enhance: Update strconv to uint64 for 32 bit cpus
  * do not exit with an error if stopped by SIGTERM or SIGINT
  * warn user if DOCKER-USER chain is detected but not configured
  * nftables: use named counters to track processed/dropped metrics
  * Revert "enhance: Update strconv to uint64 to allow go runtime to handle 32 bit allocation"
  * enhance: Update strconv to uint64 to allow go runtime to handle 32 bit allocation
  * enhance: Allow disabling ipv4</changelog>
</package>
<package pkgid="2dea8be69b738f335589603a7c74eab28648f8fb5807b25b123283e8149a63270073e866a57d2b04c0abfd2e6c6304183724bcf72b19c794c6cb6483fe730d83" name="crowdsec-firewall-bouncer-debuginfo" arch="s390x">
  <version epoch="0" ver="0.0.34" rel="1.21"/>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1723550400">- new package crowdsec-firewall-bouncer: Crowdsec bouncer written
  in golang for firewalls. crowdsec-firewall-bouncer will fetch new
  and old decisions from a CrowdSec API to add them in a blocklist
  used by supported firewalls.
- initial version: v0.0.28:
  * Change log message "failed to flush" from info -&gt; debug
  * Add option -version in favor of -V
  * func tests: no api key and certs at the same time
  * update crowdsec/go-cs-lib/go-cs-bouncer dependencies
  * Increase ipset_size default to 131072
  * force raw output on cscli during install
  * fix vendor packaging
  * iptables: allow deny_action=TARPIT
  * use go 1.20.7, golangci-lint 1.54
  * update test dependencies</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1724068800">- Update to version 0.0.29:
  * revert go 1.22 minimal requirement
  * make: remove redundant go version check
  * update lint configuration; require go 1.22
  * update functional test
  * Add TLS auth keys to config.yaml
  * use go 1.21.9
  * update deps: crowdsec 1.6.1, go-cs-lib 0.0.10
  * emit banned IPs metrics when in ipset mode
  * Allow overriding version.System in docker builds
  * config: apply variable expansion to all keys
  * deps: update test dependencies
  * go.mod: remove reference to unused sqlite
  * deps: bump crowdsec to 1.6.0
  * CI: use go 1.21.7; bump actions
  * use go 1.21.6
  * basic PF prometheus metrics (packets, bytes, banned ip count)
  * Governance init
  * Makefile: use GO macro if set, to check for version
  * logging: full standard timestamp with timezone (yyyy-mm-dd)
  * Log level: don't demote trace to debug if using the -v flag
  * golangci-lint update
  * use go 1.21.5
  * update dependency on crowdsec and go-cs-bouncer
  * Lint
  * remove the the Before causing some systemd cycling issue.
  * allow ipset to clean up tables when receiving sigterm
  * Release action: fix asset upload</changelog>
  <changelog author="aj@ajaissle.de" date="1733918400">- Update to version 0.0.30:
  * Add support for usage metrics + improve metrics performance + improve iptables mode performance</changelog>
  <changelog author="aj@ajaissle.de" date="1733918401">- Update to version 0.0.31:
  * iptables: do not ignore logging configuration
  * update dependencies + lint
  * Pipenv cache + remove useless build flags</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1735992000">- require firewall backend
- seperate out the service file
- adapt the config file for the default firewall backend
- remove the rc service file
- remove _bouncer.sh script, as we replace it with our own script,
  which removes most of the packaging parts
- add a simple script which autoconfigures the bouncer to a local
  crowdsec instance</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740225600">- switch from always running the script, to moving it as a binary the
  user has to execute, before running the daemon</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove golang-packaging from the BR, as we only need go itself
- remove the no_strip macro, as that's not needed anymore</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- add Requires for ipset on 15.x</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- Require ipset for all distributions</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1749643200">- Update to version 0.0.33:
  * add a fix for crowdsec firewall bouncer on fedora
- update to version 0.0.32:
  * properly flush outgoing connections when adding a banned ip
  * simplify pf state flush
  * Disable timeouts for Edgerouter 10x ipsets
  * Ensure monotonic traffic metrics
  * add an option to allow adding a comment to iptables rules
  * refactor metrics registration</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1754913600">- Update to version 0.0.34:
  * enhance: allow user to specify v4 and v6 chains independantly
  * enhance: Update strconv to uint64 for 32 bit cpus
  * do not exit with an error if stopped by SIGTERM or SIGINT
  * warn user if DOCKER-USER chain is detected but not configured
  * nftables: use named counters to track processed/dropped metrics
  * Revert "enhance: Update strconv to uint64 to allow go runtime to handle 32 bit allocation"
  * enhance: Update strconv to uint64 to allow go runtime to handle 32 bit allocation
  * enhance: Allow disabling ipv4</changelog>
</package>
<package pkgid="fd6d266689d0c6e04454267ea28b408acf33d97ed5c43436628aee489091cdca00d881a2c4e9f2b0e5cfe42b310ade9df57434d551492c00e378f946386e4dac" name="crowdsec-fish-completion" arch="noarch">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="0a339422eeacb557dc9eabc3a91de45e67b6c0fd3f72796e207e7832b1c933d333a9509de521af2ca6ec2edb4a1bf47bcddd089ce0ea88a0a601c67502b91569" name="crowdsec-plugin-email" arch="s390x">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="caa3a400b61cfcbeea98081cc47e0ea1d532cfd325aa92ab2652a19cf3c7e6f7558414ac30eca7e60a8126cff3e680f58a768c703ec467319d21c584de753110" name="crowdsec-plugin-email-debuginfo" arch="s390x">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="d04372a258e15c99d9c5fc8c67a1ff6bb16c4e3b73abbbcf38381588dad91a629876fd80e7670ee3d4f71c643c50cf47ec26a31fdd3f2115344d399c9e83460e" name="crowdsec-plugin-file" arch="s390x">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="eb94f8e557bd5e573debaa4f15e42d9636b33865829a1582ca2bfbe56cd71d0ae429789c2b12e688d472fbaea104bf0eb5d6b454ba3b7f64f5caebb99adc2b42" name="crowdsec-plugin-file-debuginfo" arch="s390x">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="488f2f127db6532e83412964d624acbaae62c5ec704c14583e7aff051bddae2c71fb90681b41dbd0afc3c38027900d61f30967b1fefc0f5cd22a09ec7801f811" name="crowdsec-plugin-http" arch="s390x">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="3608ecd5dd87efffa1f07ef2d25433698b2b113267ac2f2c569eaaec4dff925520e4a404daaab3d97729429dc0c26109b63ef7e9a22e016f85077cc58907cd68" name="crowdsec-plugin-http-debuginfo" arch="s390x">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="4b9b31ff681c74c89018c6eea29ea99b5a6c64b7f0acf2bcd415a6c71079dfe4af827ff3407db952d2ac8f24dab45c2533d1ba6fac5ba390d233bade7447db01" name="crowdsec-plugin-sentinel" arch="s390x">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="edcc6b02780a6f2ee64564c23d86f3cdbfc5fe27cbf0dc0f603f54231c4383bd90c039cd6579a17a32c44bd3d7c7efc1181fa64c1533b1c1f3627e9d93e28f43" name="crowdsec-plugin-sentinel-debuginfo" arch="s390x">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="b1aec6c471a265611a32d0c53b855fadcbade913398c81aecc0e319c39dad1c16838b1b0b0295f31f35d6fed397faf83f582c4c40b7fcfd12f8be0b7f7a9fa72" name="crowdsec-plugin-slack" arch="s390x">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="6f0502b550e59613908d606a4e3ae6b1397e359dc02ea91b7827220225764079ea6ecadd98972809042382757f636305413006581a8fe8ccc62865a7100f1c6c" name="crowdsec-plugin-slack-debuginfo" arch="s390x">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="bac7b7b4542a5d77c6be1ecf7d6325b345318f5144f0b3f6bab719016ec19bd04a2e911418909541f839ef3053b41d205c19388fa0ed38cf04d451afc20190c6" name="crowdsec-plugin-splunk" arch="s390x">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="4d2bfb40ded2635c471ec3f7c019e09c3047486c4be903c244aebc9a18929d4a9d6d9254f20f1b0123e33df00299f0ddc8ba38c34b59dfbd1e696d246d8297e6" name="crowdsec-plugin-splunk-debuginfo" arch="s390x">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="7c7041d637814043a0a5d5d7eaf81ffe073523e06249c1ca91eb00720f305033bd06ec2e274c0a57ea30dc5976cbcaf61467eacfc121edffcdae022699ee206b" name="crowdsec-zsh-completion" arch="noarch">
  <version epoch="0" ver="1.7.8" rel="1.7"/>
  <changelog author="rrahl0@opensuse.org" date="1738929600">- Update to version 1.6.5:
  * cscli: exclude removed commands from generated docs
  * cscli: replace '--yes' option with '--interactive'
  * cscli: when prompting, use default in case of EOF instead of going for "no"
  * merge from master (dc28ae58dc59e72981ee4724b1c72a79ba586ad8) for 1.6.5
  * ignore zero value variables for context
  * bucket: avoid crashing on malformed expression (fix #3351)
  * fix parsing of noncompliant RFC3339 timestamps missing only a timezone
  * acquisition/victorialogs: add new datasource
  * fix: use CreatedAt instead of StartAt
  * use the actual bucket name when checking for simulation mode
  * appsec: do not attempt to deduplicate native modsec rules
  * Removed last_heartbeat update in MachineUpdateBaseMetrics
  * upgrade coraza to latest version
  * README revamp
  * remove dependency from github.com/gofrs/uuid
  * pkg/cticlient: Add missing field in SmokeItem and FireItem
  * cscli: cliconfig - remove global variables and gratuitous pointer
  * enhance: Log appsec error on writing response to remediation
  * lint: enable errcheck; add allowlist and explicit checks
  * lint: gocritic/captLocal (don't capitalize local variables)
  * remove commands "cscli config backup/restore"
  * test pkg/exprhelpers: explicit message if the tag "expr_debug" is missing
  * fix: #2790
  * log warning if local items have conflicting names
  * feat(cscli): add env variable flag for dashboard setup
  * gin: do not use gin context after returning response
  * expand env var when loading acquis
  * Hubops tests
  * build(deps): bump golang.org/x/crypto from 0.26.0 to 0.31.0
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1
  * cscli hub: refact/split files; add some doc/examples
  * cscli: restyle table titles; autocomplete "cscli metrics show"
  * enhancement: Hubtest respect patterndir option set via config.yaml
  * lint: explicit error checks
  * enhancement: add logdata to appsec AccumlateTxToEvent
  * pkg/cwhub - refact Downloader
  * lint: replace type assertions and type switch on errors
  * cscli: improved hub management
  * Add possibility to configure log format #799
  * refactor pkg/leakybucket
  * refact pkg/database: clean up code and error messages
  * lint/deep-exit: avoid log.Fatal
  * loop performance optimizations / 2
  * update dependency on docker
  * cscli: print errors in plain text with -o json
  * lint/deep-exit: avoid log.Fatal
  * lint: enable more gocritic checks
  * acquisition: add some test and warning for wrong source type
  * support dump: generate pprof files with debug=1 to avoid generating an unusable heap dump
  * cscli: display expired decisions' expiration time in red
  * sigmahq: fix functional test
  * loop performance optimizations / 1
  * lint: style, autofix
  * update golangci-lint to 1.62
  * appsec: missing err check when initializing out-of-band engine
  * Allow bouncers to share API keys
  * make: improve re2/wasm check
  * better handle error when sending usage metrics
  * Support multiple appsec configs
  * context propagation: papi, loki
  * fix: Use clientIP when passing coraza
  * test for cron dependency for packaging
  * enhance: add fedora 41 (40, with provision to upgrade to 41 since there no image so far on vagrant cloud)
  * enhance: add opensuse leap 15 vagrant
  * fix: Add a check to prevent attempting to load a directory within patterns
  * fix: Ansible fedora 40 to use 40
  * fix go version for azure pipeline
  * add go minor in go.mod
  * Add explicit configuration for signals sharing and blocklists pull
  * loki: add no_ready_check option
  * readme: update bouncers link
  * add HTTP datasource
  * update checks for wrapped errors
  * Alert context appsec
  * make: allow build on ubuntu 24.10
  * refact cscli: decisions, lapi, bouncers, machines
  * make: remove obsolete/redundant parameters
  * remove unused code: HandleDeletedDecisions()
  * context propagation: OneShotAcquisition(); enable contextcheck linter
  * enhance: Remove if log check in one instance that was not needed as the logged items are not resource intensive
  * context propagation: appsec, docker, kafka, k8s datasources
  * enhance: Check if resp is nil in capi metrics and continue
  * wineventlog: add support for replaying evtx files
  * avoid deadlock when deleting decisions if PAPI is half configured
  * context propagation: StreamingAcquisition()
  * context propagation: pkg/csplugin
  * Update protobufs
  * context propagation: pkg/apiserver
  * lint/revive: check tags on non-exported struct fields
  * context propagation: apic, unit tests
  * context propagation: don't store ctx in api controller
  * Re-generate capi models
  * context propagation: pass ctx to UpdateScenario()
  * context propagation: pkg/database/alerts
  * context propagation: pkg/database/{lock,decision}
  * context propagation: pkg/database/bouncers
  * context propagation: pkg/database/machines
  * remove dependency from pkg/cwversion to pkg/acquisition
  * lint/nestif: reduce hubtest complexity
  * context propagation: pkg/database/metrics
  * context propagation: pkg/database/config
  * context propagation: bouncer list
  * context propagation: pkg/database/flush
  * context propagation: pass context to NewAPIC()
  * context propagation: explicit ctx parameter in unit tests
  * refact: alerts query
  * lint: enable (some) gocritic checks
  * enable linters: copyloopvar, intrange
  * logs and user messages: use "parse" and "serialize" instead of marshal/unmarshal
  * Update go-re2
  * context propagation: cscli {capi,lapi,papi}
  * refact pkg/database: context propagation (start)
  * refact acquisition: build profiles (optionally exclude datasources from final binary)
  * refact / split APIServer.Run() method
  * fix #3225: info-&gt;debug for trigger bucket overflow
  * refact cscli - don't export functions if not required
  * refact: cscli papi
  * refact: pkg/apiclient set and use default user agent
  * fix appsec/tls issues by cloning http transport
  * tests: prevent "make bats-fixture" to run if instance-data is locked
  * enhance: add additional explain options to hubtest
  * cscli refact: package clialert, clidecision
  * refact: reduce code nesting (acquisition/file, tests)
  * update grokky and deps
  * cscli refact: package cliitem
  * cscli dashboard: exit earlier on docker
  * Allow auto registration of machines in LAPI
  * enhance: return an error if cscli dashboard is run within a container
  * cscli refact: package cli{support, machine, bouncer}
  * cscli refact: package 'clihub'
  * cscli refact: extract packages ask, clientinfo
  * cscli refact: package 'clihubtest'
  * cscli hub update: option --with-content to keep embedded items in index; use it in docker
  * implement GetFSType on openbsd with the correct statfs struct member
  * cscli refact: notifications, simulation, papi, setup
  * cscli refact: package 'clicapi', 'clilapi'
  * pkg/cwhub: cache control / send etag header from file contents, check with HEAD req
  * pkg/cwhub: simpler accessor methods
  * cscli refact: package 'cliexplain'
  * pkg/cwhub: improve support for k8s config maps with custom items
  * cscli refact: package 'cliconsole'
  * refact (nestif): reduce complexity of pkg/leakybucket</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1740398400">- remove arch_install_post, as it's not needed anymore</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742558400">- Update to version 1.6.6:
  * introduction of a centralized allowlists
  * Parallel hubtest
  * deprecate capi_whitelists_path
  * appsec: use CA from client credentials when connecting to LAPI
  * lint: gocritic/httpNoBody
  * tests: remove modeline
  * pkg/cwhub: refact Item.State.(Downloaded | Installed)
  * refact: context propagation (apiclient, cticlient...)
  * tests: switch context.Background() -&gt; t.Context() from go 1.24
  * refact: avoid use of defer calls in loops
  * lint: gocritic/typeDefFirst (ensure type definitions come before methods)
  * file acquisition: remove redundant logging info
  * appsec: support custom CA for lapi
  * enhancement: Add additional ssl options to db configuration
  * move ParseQuery to expr helpers, add ExtractQueryParam
  * enable/disable options for console enroll - make alert context a default
  * enhance: add option to disable magic syslog RFC parsers
  * add JA4H expr helper
  * leaky bucket: reduce log verbosity
  * update appsec test runner
  * close appsec transactions after processing request
  * opensuse sets OSTYPE to linux
  * do not attempt to set db log level if no db config
  * appsec: less verbose logging for allowlists and headers check
  * enhance: Flags now superceed all log levels
  * appsec: handle SendAlert() properly for out of band matches
  * cscli: review/update argument number checking
  * crowdsec: allow -t to work if using appsec and allowlists
  * cron: avoid spamming stdout when the hub index is updated
  * cscli: allow non-local symlinks to have a different name than hub items
  * cscli hub/items: always show action plan; fix --interactive in pipes
  * silence "cscli hub update" if noop in cron jobs
  * cscli: don't attempt to download data files when url=""
  * update dependencies</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742731200">- fix service on Leap 15.x,where %{_libexecdir} resolves do
  /usr/lib, not /usr/libexec</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742817600">- seperate out the plugins to their own packages
- remove firewall bouncer from the recommends, as it's less needed than first
  assumed</changelog>
  <changelog author="rrahl0@opensuse.org" date="1742990400">- update to version 1.6.8:
  * Allowlists: fix range check in LAPI endpoint
- Update to version 1.6.7:
  * build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2
  * only warn about capi_whitelists_path being deprecated if actually in use
  * empty back-merge from release branch
  * explicit message for malformed data URL in local items
  * Allowlists: fix range check in LAPI endpoint
  * revert ActionPlan info/warning to StandardLogger
  * fix "reload causes crashing process"
  * use replace for coraza instead of renaming the entire package</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1745064000">- Add script and monthly timer for auto updating items
  installed from Crowdsec hub</changelog>
  <changelog author="Eric Torres &lt;eric.torres@its-et.me&gt;" date="1749297600">- Add randomized delay of 1h to auto hub update timer
- Fix if condition in auto-update script to properly
  execute when crowdsec service is running
- Decrease trigger interval for auto update script from one
  month to one week</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1750420800">- Update to version 1.6.9:
  * fix PAPI failure to stop on reload
  * appsec: do not query LAPI multiple times when checking auth
  * update coraza
  * PAPI: auto enable on upgrade
  * kakfa: properly start at last offset when using a consumer group
  * cscli: handle sigint/sigterm, cancel context of ongoing http req
  * modernize: replace legacy slice/map/range idioms with stdlib
  * update test/README.md
  * go.mod/sum cleanup
  * update coraza
  * CI: ensure tests don't alter the repository
  * allow watcher to self-delete on shutdown
  * deprecate option 'daemonize'
  * enhance: Remove docker acquis internal timer use docker events
  * kafka: expose batching configuration
  * feat(apiclient): add token save functionality
  * refact apiclient.Config: remove field Scenarios
  * CI: release-drafter configuration: permissions, skip-changelog label
  * refact: cleanup bats helper
  * enhance: return err if notification has no plugin type
  * Makefile: typo
  * cscli capi status: save auth token, add tests
  * refact cmd/crowdsec: remove login code obsoleted by 16d06779
  * Fix spelling mistake in metrics.go
  * CI: update codecov list and fix workflow
  * update expr to 1.17.2
  * config.yaml: make config_dir and notification_dir optional
  * use go 1.24.3
  * fix(apiserver): ensure nil is returned after setting token and expiration and before we reauthenticate
  * Fix cp -n
  * refact pkg/database: unnecessary pointers
  * CI: update action for generating docker description
  * feat(apic): add ApicAuth client and token re-authentication logic
  * refact pkg/parser: extract method, avoid calling defer in loop
  * refact: remove unused metod DeleteDecisionsWithFilter()
  * refact alert, decision filters: remove unnecessary pointers
  * CI: update lint complexity thresholds
  * allowlists: automatically expire current matching decisions on update
  * improve support for parsing time durations with 'day' units
  * refactor pkg/database/Client.createAlertChunk()
  * cscli inspect: don't show metrics or converted rules if an item is not installed
  * refact cscli: hub item - pointer receiver for consistency
  * CI: correct uv.lock path
  * CI: remove obsolete reference to directory dyn-bats
  * Fix monitorNewFiles for NFS + Remove dead tails from tail map
  * build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0
  * enhance: add listen_socket to http acquisition
  * enhance: Allow the use of 'd' suffix in profiles
  * lapi: return specific error if a unix socket path is too long for the OS
  * enable codeql for python
  * update golangci-lint
  * make CTI client available in cscli notifications
  * allowlists: check during bulk decision import
  * refact: pkg/exprhelpers/debugger, convert switch to function dispatch
  * lint/gocritic: enable importShadow, typeUnparen, unnecessaryDefer
  * refact pkg/database: dry decision count
  * refact parser Init: argument types
  * tests: refact localtest helper, use testify.suite
  * refact: logrus.GetLevel() -&gt; logrus.IsLevelEnabled()
  * fix: avoid possible race condition while compiling expressions
  * fix mysql client certificate support
  * fix: error check on postoverflow config
  * test: add cold log event assert
  * Refact pkg/database/decisions.go
  * replace go-acc, richgo with gotestsum
  * pkg/hubtest: use os.CopyFS()
  * lint/refactor: defer, reflectvaluecompare, stylecheck
  * do not return an error if we cannot fetch allowlists when starting the appsec
  * CI: golangci-lint v2
  * hubtests: correct basename check in parser tests
  * Support WithUserAgent in cti client</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1752148800">- Update to version 1.6.10:
  * cscli: Add allowlist check
  * refact pkg/acquisition: extract loop method
  * pkg/csplugin: constructors for PluginConfig, PluginConfigList
  * S3 datasource: add support for SNS format
  * refact: migrate net.IP -&gt; net/netip: part 1
  * use github.com/cenkalti/backoff/v5 for apiclient backoff
  * Fix infinite loop in decisions list for some values of limit
  * fix: Reset datafiles before loading the hub on HUP
  * refact: replace iplib with net/netip
  * HTTP datasource: allow GET/HEAD request for checking if the datasource is working
  * cscli help typos
  * fix: allowlist use content created at instead of list itself
  * move cti expr helper to pkg/cticlient
  * enhance: appsec reuse httpc optimization
  * hubtest: resolve relative path for 'cscli', 'crowdsec'
  * refact csplugin: move ProfileAlert to models
  * refact cmd/crowdsec: extract functions from runCrowdsec()
  * cscli capi register: no error if online_api_credentials.yaml does not exist
  * refact cmd/crowdsec: move plugin initialization to apiserver
  * lint: require name on interface parameters
  * refact pkg/cwhub
  * unit tests: rename ./tests, ./test_data -&gt; ./testdata
  * pkg/apiserver: remove incorrect log.Error</changelog>
  <changelog author="rrahl0@opensuse.org" date="1753272000">- Update to version 1.6.11:
  * context.Background() -&gt; t.Context()
  * fix: normalize scope within range to ensure allowlist check
  * cscli: don't assume master hub branch if version check fails (after retrying)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1758024000">- Update to version 1.7.0:
  * WAF: Improve user-experience with CRS and modsecurity rules
  * fix "cscli alerts list -s &lt;scenario&gt;" for alerts with no decisions
  * unify the output format of start_at and stop_at
  * pkg/cwhub: fix relative symlink resolution
  * fix: Postint check if api.server.enable is false
  * detect.yaml: always acquire ssh from file if present
  * cscli setup: allow skipping service detection with $CROWDSEC_SETUP_UNATTENDED_DISABLE
  * detect.yaml: avoid double acquisition on deb
  * review config/detect.yaml
  * fix rpm detect.yaml
  * cscli setup: improve service detection and datasource validation
  * install scripts: echo -e -&gt; echo (we're not requiring bash anymore)
  * move detect.yaml to /var/lib/crowdsec/data
  * fix rpm dovecot detection
  * cscli setup: skip missing items, fix collection name
  * try to improve a bit the output of 'cscli hubtest' appsec tests that are hard to read
  * restore wizard.sh --unattended
  * cscli setup improvements
  * cscli: remove "dashboard" command
  * remove the cscli_setup feature flag
  * Increase hub download timeout to 10 minutes
  * clean up buckets serialization code
  * update dependencies, use go 1.24.5
  * add detect.yaml in rpm files section
  * cscli setup: new service detection and configuration
  * feat: add swarm support to docker acquistion
  * cscli: print command name along with errors
  * fix timemachine lock
  * refact whitelist/allowlist: net.IP to net/netip
  * enhance: Add 2 time helpers for average and median
  * appsec: properly set URI in the original request object for use in hooks
  * usage metrics: report acquisition + parsers metrics to LAPI
  * improve datasource validation (goccy/go-yaml)
  * refact: pkg/database decisions filter, queries</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1760875200">- Update to version 1.7.1:
  * cscli: fix hubtest coverage (#3969)
  * `cscli hubtest --appsec` : Bail when we cannot invoke nuclei (#3798)
  * acquisition: set S3 anon creds during tests, prevent deadlock (#3961)
  * waf: store target FQDN in alert meta (#3947)
  * waf: allow glob when including seclang files (#3948)
  * refact: don't call defer in loops, enable linter (#3907)
  * refact: remove unused struct fields / 2 (#3946)
  * refact: remove unused struct fields (#3633)
  * update test_env.sh (#3829)
  * make: support CROWDSEC_API_DEV_ENV (#3931)
  * cloudwatch: fix flaxy test (#3941)
  * metrics: report platform family to console / 2 (#3938)
  * metrics: report platform family to console (#3897)
  * add remediation_sync origin (#3915)
  * refact pkg/parser: fmt, split grok.go (#3922)
  * refact pkg/parser: extract RuntimeGrokPattern (#3916)
  * build(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#3919)
  * service name typo fix (#3920)
  * cscli setup: detect auditd (#3917)
  * apiserver: prevent long bouncer names when IP is changing (bouncer@ip1@ip2..) (#3911)
  * update s3 datasource to aws sdk v2 (#3844)
  * refact pkg/parser: ExtraField / Static (#3913)
  * lint: fix nilaway warnings (part 11) (#3910)
  * lint: errcheck (#3912)
  * output: push alerts from a goroutine (#3905)
  * refact: net.Listen -&gt; listenConfig.Listen(), remove context.TODO()/Background() (#3776)
  * refact pkg/acquisition: split DataSource interface (#3900)
  * refact: net.Dial() -&gt; Dialer.DialContext() (#3670)
  * lint: errcheck, nolintlint, intrange (#3904)
  * lint: fix nilaway warnings (part 5) (#3863)
  * update golang.org/x/time, use fork instead of vendoring (#3892)
  * lint: fix nilaway warnings (part 10) (#3875)
  * lint: fix nilaway warnings (part 7) (#3865)
  * lint: fix nilaway warnings (part 6) (#3864)
  * refact cmd/crowdsec, pkg/apiserver: extract methods (#3743)
  * lint: fix nilaway warnings (part 9) (#3868)
  * pkg/database: enable upsert feature flag, use it for config items (#3895)
  * lint: fix nilaway warnings (part 3) (#3855)
  * pprof: enable block/mutex profiling with a feature flag (#3898)
  * journalctl acquisition: fix #3890 (#3893)
  * build(deps): bump astral-sh/setup-uv from 6.6.1 to 6.7.0 (#3894)
  * refact pkg/parser: small optimizations (#3891)
  * cscli support dump: collect system information with gopsutil (#3879)
  * replace cron script with systemd timer (#3842)
  * refact simulation: redundant use of pointers; log (stderr) -&gt; print (stdout) (#3889)
  * refact pkg/parser: extract method processLeaves (#3886)
  * refact pkg/parser: review formatting verbs, logs (#3887)
  * refact: exec.Command() -&gt; exec.CommandContext() (#3826)
  * build(deps): bump github/codeql-action from 3.30.2 to 3.30.3 (#3885)
  * fix: set cache defaults for parser stash (#3883)
  * lint: fix nilaway warnings (part 2) (#3854)
  * [WAF] do not iterate over all transaction variables for nothing // swap alert generation + event send order (#3884)
  * refact pkg/parser: extract method (#3849)
  * waf: add fromFile match type (#3880)
  * waf: return if we cannot create the TCP listener (#3882)
  * lint: fix nilaway warnings (part 8) (#3866)
  * lint: nosprintfhostport, ifelsechain (#3838)
  * Improve logging for file acquisition (#3778)
  * CI: update and pin actions/setup-python v6.0 (#3861)
  * update fsnotify/fsnotify (#3874)
  * update deps: testify, cobra (#3876)
  * build(deps): bump github/codeql-action from 3.30.1 to 3.30.2 (#3877)
  * lint: fix nilaway warnings (part 4), prevent data race (#3857)
  * lint: fix nilaway warnings (part 1) (#3853)
  * build(deps): bump github.com/appleboy/gin-jwt/v2 from 2.10.1 to 2.10.3 (#3772)
  * build(deps): bump github.com/go-openapi/errors from 0.22.0 to 0.22.2 (#3858)
  * build(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#3859)
  * build(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#3860)
  * build(deps): bump astral-sh/setup-uv from 6.6.0 to 6.6.1 (#3841)
  * build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#3852)
  * packaging: clean up redundant debian/install, debian/rules (#3781)
  * rpm: declare ghost file permissions (#3828)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603200">- Update to version 1.7.2:
  * deb: remove cron file (#3987)
  * Windows: Revert to windows 2022 to fix build (#3986)
  * rpm: immediately activate systemd timer (#3985)
  * rpm: package hubupdate.sh (#3979)
  * hub update: add systemd timer and service (#3977)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762603201">- Update to version 1.7.3:
  * rpm: install hubupdate with full path (#4002)
  * move hubupdate.sh to libexec (#4000)</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1765022400">- Update to version 1.7.4:
  * don't use empty path as label for LAPI hits metrics (#4106)
  * fix accessLogger setup to separate file (#4103)
  * empty back-merge from release branch (#4093)
  * pkg/acquisition: update syslog to RestartableStreamer (#4040)
  * WAF: Add `DropRequest` helper to block request in hooks (#4016)
  * waf: remove custom raw body processor and use the upstream one (#4092)
  * refact logging configuration; add log_media="syslog" (#4045)
  * docker acquisition: prevent data races (#3956)
  * remove CROWDSEC_CONTAINER_ENV (#4085)
  * refact cscli: define csconfig.Getter once (#4091)
  * Fix avoidable prometheus metrics cardinality (#4080)
  * refact load/save apic token: dependencies and sentinel errors (#4081)
  * pkg/csplugin: use backoff package to retry notifications (#3944)
  * refact pkg/database batching (#3906)
  * replace prom2json with native Prometheus parser and context-aware scraping in CLI metrics (#3932)
  * loki acquisition: remove forgotten debug print (#4062)
  * update docker/docker to moby/moby (version docker-v29.0.2) (#4048)
  * refact pkg/acquisition: split appsec.go (#4043)
  * refact pkg/acquisition: journalctl configuration (#4057)
  * cscli hubtest: better report docker/nuclei errors (#4052)
  * fix 2808: show certificate path in "lapi status" (#4053)
  * lint revive: lower complexity threshold (#4056)
  * lint: unused parameters / 2 (#4055)
  * build: check make version before running Makefile (#4054)
  * lint: unused parameters (#4049)
  * refact pkg/acquisition: split loki.go (#4034)
  * refact pkg/acquisition: split victorialogs.go (#4037)
  * refact pkg/acquisition: split wineventlog.go (#4036)
  * refact pkg/acquisition: split s3.go (#4035)
  * refact pkg/acquisition: split k8s_audit.go (#4033)
  * refact pkg/acquisition: split kinesis.go (#4032)
  * refact pkg/acquisition: split kafka.go (#4031)
  * refact pkg/acquisition: split cloudwatch.go (#4029)
  * refact pkg/acquisition: split http.go (#4030)
  * refactg pkg/acquisition: split file.go (#4038)
  * refact pkg/acquisition: split syslog.go (#4028)
  * docs: add public roadmap section to README.md (#4039)
  * pkg/acquisition: refact journalctl datasource and unified retry loop (#4023)
  * option api.server.disable_usage_metrics_export (#4021)
  * decisionStream: only select required fields from the DB (#4024)
  * papi: explicit context (#3973)
  * pkg/csplugin: remove unused function (#4019)
  * waf: extract temp state from AppsecRuntimeConfig (#3952)
  * pkg/types -&gt; new imports pt 4 (#4012)
  * pkg/types -&gt; new imports pt 3 (#4014)
  * pkg/types -&gt; new imports pt 2 (#4013)
  * pkg/types -&gt; new imports pt 1 (#4011)
  * build: optional pure-go sqlite driver (#3908)
  * pkg/types -&gt; pkg/{pipeline,fsutil,enrichment,logging...} (#4006)
  * enable linters: unnecessary-format, unused-receiver (#4001)
  * refact: remove unused struct fields and params / 3; enable linter "unused" (#3334)
  * move hubupdate.sh to libexec (#4000)
  * prevent nil deref on kinesis datasource (#3993)
  * lint: nilaway, unnecessary pointers (#3951)
  * pkg/acquisition: explicit context to datasource configuration (#3972)
  * cscli: allow "support dump" to run without hub index, add --fast option to skip cpu profiling (#3982)
  * refact journalctl tests: prevent data race (#3955)
  * lint: restrict some rules, complexity metrics (#3974)
  * lint: unused-receiver / 1 (#3975)
  * cscli: move some packages to core/ (#3949)
  * refact pkg/parser: rename DataCapture -&gt; Stash, extract methods (#3923)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- Update to version 1.7.5:
  * Changes
  - replace syscall with unix/windows packages where possible
  (#3032) @mmetc
  - pkg/acquisition: refact configuration validation and tests
  (#4187) @mmetc
  - pkg/acquisition: remove/restore mock datasources after usage
  (#4190) @mmetc
  - pkg/leakybucket: replace global variables with injected
  StateDumper (#4197) @mmetc
  - pkg/acquisition: method docs, deduplicate module names
  (#4192) @mmetc
  - errors.Wrapf -&gt; fmt.Errorf, remove dependency on
  github.com/pkg/errors (#4198) @mmetc
  - update golangci-lint 2.8 (#4194) @mmetc
  - notification plugins: readability / dry refact, unnecessary
  pointers (#4166) @mmetc
  - refact acquisition/appsec: happy path (#4183) @mmetc
  - pkg/acquisition/registry, move datasource registration to
  avoid dependency (#4189) @mmetc
  - gin middleware: drop closures (#4186) @mmetc
  - acquisition/journalctl: test cleanup (#4182) @mmetc
  - cscli hubtest: extract method finalizeRun() (#4181) @mmetc
  - refact cmd/crowdsec: remove globals ParseDump,
  BucketPourTrack (#4184) @mmetc
  - refact pkg/apiserver: happy path; nil guard (#4180) @mmetc
  - refact pkg/leakybucket: drop closures (#4178) @mmetc
  - cmd/crowdsec: rename pipeline channels (#4175) @mmetc
  - move dir debian, rpm to /build/ (#4174) @mmetc
  - refact cmd/crowdsec: remove globals, lint, etc (#4163) @mmetc
  - lint: modernize - enable slicessort, stringsseq (#4162)
  @mmetc
  - appsec: inject dependencies, avoid globals (#4148) @mmetc
  - CI: move windows build scripts to ./build/windows (#4145)
  @mmetc
  - remove obsolete readme (replaced by go generate) (#4164)
  @mmetc
  - cmd/crowdsec: refact dump.go, loops (#4158) @mmetc
  - cmd/crowdsec: refact output.go, pour.go, parse.go (#4157)
  @mmetc
  - refact: drop parserTomb, lpMetricsTomb (#4138) @mmetc
  - drop unused method Client.IsMachineRegistered() (#4121)
  @mmetc
  - CI: build with the tag "nomsgpack" to reduce binary size
  (#4151) @mmetc
  - move ./docker to ./build/docker (#4130) @mmetc
  - acquisition refact: context-aware OneShot(), for file +
  journalctl + wineventlog (#4125) @mmetc
  - lint: forbidigo (no print or printf in production, prefer
  fprint) (#4141) @mmetc
  - CI: avoid using nolint with revive (#4144) @mmetc
  - Lint: add explicit per-linter settings (#4134) @mmetc
  - refact pkg/acquisition: split docker.go (#4065) @mmetc
  - get rid of tombs in leakybucket package (#4127) @sabban
  - refact pkg/acquisition: cloudwatch configuration (#4058)
  @mmetc
  - refact pkg/acquisition: kinesis configuration (#4059) @mmetc
  - refact pkg/acquisition: k8saudit configuration (#4060) @mmetc
  - refact pkg/acquisition: http configuration (#4061) @mmetc
  - refact heartbeat: context-aware method (#4126) @mmetc
  - pkg/leakybucket refact: unexport, unused, explicit field
  names (#4123) @mmetc
  - docker build: run builds on large runner (#4120) @blotus
  * Improvements
  - docker datasource schema (#4206) @mmetc
  - lint: enable bodyclose (ensure response bodies are closed to
  avoid leaks) (#4200) @mmetc
  - feat: Add ParseKVLax for Flexible Key-Value Parsing (#4007)
  @LaurenceJJones
  - pkg/parser: avoid calling spew unless trace (#4156) @mmetc
  - leakybucket: reduce error verbosity, test for
  misconfiguration (#4087) @mmetc
  - feat(appsec): support transaction id header for request
  tracing (#4124) @LaurenceJJones
  * Bug Fixes
  - update functional tests with time-based-bf (#4217) @mmetc
  - papi: check if decision is allowlisted before adding it
  (#4196) @blotus
  - pkg/acquisition: register mock datasource for YAML tests
  (#4205) @mmetc
  - pkg/acquisition: prevent duplicate send in case of transform
  error (#4191) @mmetc
  - CI fix - exit lapi during hub tests; pass container struct
  reference instead of slice (#4202) @mmetc
  - CAPI: always reuse the stored token (#4201) @blotus
  - fix #4066: don't prepare the hub in lapi-only containers
  (#4169) @mmetc
  - fix #3991 - Acquisition config formatting in bug template
  (#4170) @mmetc
  - fix typos in function name, comments and user-facing docs
  (#4154) @mmetc
  - refact appsec tests: prevent data race (#3902) @mmetc
  - fix build issue on freebsd, add cross platform CI build and
  lint target (#4109) @mmetc
  * Chore / Deps
  - build(deps): bump actions/setup-go from 6.1.0 to 6.2.0
  (#4195) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.9 to 4.31.10
  (#4193) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.6 to 7.2.0
  (#4185) @dependabot[bot]
  - CI/tests: update bats-*, remove bats-mock (#4172) @mmetc
  - deps: update modernc.org/sqlite (#4177) @mmetc
  - CI, docker: update yq to v4.50.1 (#4179) @mmetc
  - build(deps): bump docker/setup-buildx-action from 3.11.1 to
  3.12.0 (#4167) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.8 to 4.31.9
  (#4153) @dependabot[bot]
  - update expr to 1.17.7 (#4150) @blotus
  - build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
  (#4146) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.1.5 to 7.1.6
  (#4147) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.7 to 4.31.8
  (#4135) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.6 to 4.31.7
  (#4116) @dependabot[bot]
  - CI: update and/or pin actions with tag comments (#4108)
  @mmetc
  - CI: update golangci-lint to 2.7 (#4110) @mmetc
  - make: move ./mk to ./build/mk, update gmsl (#4111) @mmetc
  * Geolite2 notice
  - This product includes GeoLite2 data created by MaxMind,
  available from https://www.maxmind.com.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515201">- Update to version 1.7.6:
  * Bug Fixes
  - cmd/crowdsec: assign overflow after parsing (#4225) @mmetc
- add include for cstring into
  vendor/github.com/wasilibs/go-re2/internal/cre2/cre2.cpp to fix failing
  compilation on Tumbleweed</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775131200">- Update to version 1.7.7:
  * CrowdSec 1.7.7 brings 2 major changes:
  - On linux, RE2 is now used by default for evaluating regexp in
    parsers
  - WAF rules can now contain a mix of AND/OR conditions without
    any limits, giving much greater flexibility when writing new
    rules
  * RE2 by default on linux
    CrowdsSec has supported for a long time using RE2 as the regexp
    engine, and with this release we make it the default.
    CrowdSec has always used the builtin Go regexp package, which
    is a Go reimplementation of the RE2 library, but with known
    performance limitations.
    The switch to RE2 will bring significantly increased regexp
    performance (one of the most critical part of CrowdSec) at the
    cost of slightly longer regexp compilation and higher baseline
    memory usage.
    Important
    If you encounter any issues with the new regexp engine, you can
    fallback to the previous Go implementation by setting the
    feature flag re2_disable_grok_support (see the documentation).
  * Other changes
    Other notable changes include:
  - a new kind attribute for alerts used to identify its source
    (a scenario, a WAF rule, a manual decision creation, ...)
  - a new cscli allowlist import command
  - support for the HTTP_PROXY environment variable in the
    notification-http plugin
  - A resource leak under high load was fixed
  * New Features
  - add LookupFile and FileMap expr helpers (#4372) @buixor
  - waf rules: allow arbitrary mix of AND and OR conditions
    (#4358) @blotus
  * Improvements
  - enable RE2 support by default on linux (#4386) @blotus
  - cscli allowlists: add import command (#4378) @blotus
  - WAF: expose more transformations from coraza (#4140) @blotus
  - Add new kind alert attribute (#4351) @blotus
  - Use environment proxy settings for notification-http (#4364)
    @op3
  * Bug Fixes
  - allowlists: apply items to existing decisions in batch
    (#4095) @blotus
  - waf: fix tests for modsec rules generation (#4385) @blotus
  - windows: add file notification plugin in MSI package (#4367)
    @blotus
  - leakroutine: call cancel after leakroutine returns (#4369)
    @blotus
  - notification-sentinel: lower-case x-ms-date header for
    correct HMAC (#4288) @ebirn
  - tests: remove temporary sqlite/plugin files from /tmp/
    (#4332) @mmetc
  - pkg/apiserver: fix scenario count in debug log (#4333) @mmetc
  - pkg/csplugin: prevent race condition, deadlock (#4294) @mmetc
  - pkg/acquisitioncontext: minimal fix for data race in tests
    (#4327) @mmetc
  - acquisition/file: minimal fix for data race in tests (#4326)
    @mmetc
  - fix lint fsutil/freebsd: unnecessary conversion (#4324)
    @mmetc
  - cscli: consistent status and usage message for unknown
    subcommands (#4320) @mmetc
  - cscli detect: set log type for caddy unit to "syslog" (#4321)
    @mmetc
  - CI: add published_at to version.crowdsec.net/latest (#4291)
    @blotus
  - cmd/crowdsec: assign overflow after parsing (#4226) @mmetc
  - waf: format as CRS match only if anomaly score is not 0
    (#4230) @blotus
  * Changes
  - build(deps): bump cryptography from 46.0.3 to 46.0.5 in
    /build/docker/test (#4298) @dependabot[bot]
  - support for waf- alias in cscli (#4347) @buixor
  - refact pkg/dumps: reduce complexity (#4209) @mmetc
  - lint: refact pkg/dumps for nilaway (#4208) @mmetc
  - refact pkg/parser: redundant indirection (#4344) @mmetc
  - refact pkg/parser: extract+embed NodeConfig in Node struct
    (#4343) @mmetc
  - move calls to trace.ReportPanic() on top of goroutines
    (#4338) @mmetc
  - pkg/csplugin: simplify notification loop; noop with empty
    queue (#4328) @mmetc
  - pkg/parsers: light refact, remove redundant code (#4213)
    @mmetc
  - refact cmd/crowdsec: encapsulate cache into alertBuffer
    (#4300) @mmetc
  - cmd/notification-*: don't provide the same context twice for
    request (#4316) @mmetc
  - don't flush 127.0.0.1 (#4315) @sabban
  - clipapi: replace tomb with errgroup (#4207) @mmetc
  - refact cmd/crowdsec: remove redundant global variable (#4299)
    @mmetc
  - refact: remove unused code in crowdsec-cli, apiserver,
    acquisition, database (#4304) @mmetc
  - refact pkg/leakybucket: trim down redundant Leaky struct
    fields (#4290) @mmetc
  - pkg/leakybucket: remove global bucketStore, unused parameters
    + tags (#4286) @mmetc
  - pkg/leakybucket: remove Simulated field from Leaky, keep it
    in config (#4285) @mmetc
  - pkg/leakybucket: extract BucketSpec from BucketFactory
    (#4284) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    part 2 (#4282) @mmetc
  - pkg/leakybucket: refact test loop, more explicit failures in
    testFile() (#4281) @mmetc
  - refact pkg/leakybucket: extract methods from LoadBucket()
    (#4279) @mmetc
  - pkg/leakybucket: replace Signal chan with explicit read/done
    chans (#4277) @mmetc
  - pkg/leakybucket: replace waitgroups with single rwlock
    (#4276) @mmetc
  - pkg/leakybucket: garbage collect: compare float with epsilon
    (#4275) @mmetc
  - pkg/leakybucket: refactor tests (#4272) @mmetc
  - pkg/leakybucket: replace sycn.Map with map + mutex (#4271)
    @mmetc
  - pkg/leakybucket: replace global counter with call to bucket
    store (#4273) @mmetc
  - pkg/leakybucket: review README.md (#4274) @mmetc
  - pkg/leakybucket: encapsulate store map + add methods (#4253)
    @mmetc
  - pkg/leakybucket: remove redundant bool var (#4252) @mmetc
  - fix hub console side (#4266) @sabban
  - version workflow fix (#4262) @sabban
  - rename the prod branch to main (#4261) @sabban
  - add version workflow (#4210) @sabban
  - pkg/leakybucket: remove unused global (#4251) @mmetc
  - pkg/leakybucket: pass bucket factories by pointer (#4250)
    @mmetc
  - pkt/leakybucket: compileScopeFilter() -&gt;
    ScopeType.CompileFilter() (#4247) @mmetc
  - pkg/leakybucket: rename OverflowFilter -&gt; OverflowProcessor
    (#4248) @mmetc
  - pkg/leakybucket: rename Buckets -&gt; BucketStore (#4246) @mmetc
  - refact leaky bayesian: method to function, unlock w/defer
    (#4242) @mmetc
  - pkg/leakybucket: early return (#4244) @mmetc
  - pkg/leakybucket: variable shorthand (#4245) @mmetc
  - pkg/leakybucket: move LeakRoutine to method, rename
    parameters (#4243) @mmetc
  - pkg/leakybucket: review bucket validation and tests (#4241)
    @mmetc
  - refact: remove unnecessary pointers to map, string, mutex
    (#4212) @mmetc
  - pkg/leakybucket: function to method
    BucketFactory.LoadBucket() (#4229) @mmetc
  - pkg/leakybucket: BucketType interface, method
    BucketFactory.Validate() (#4228) @mmetc
  * Chore / Deps
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#4382) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.6 to 4.33.0
    (#4371) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.5.0 to 7.6.0
    (#4373) @dependabot[bot]
  - build(deps): bump google.golang.org/grpc from 1.74.2 to
    1.79.3 (#4376) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.1 to 7.5.0
    (#4366) @dependabot[bot]
  - build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
    (#4319) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.5 to 4.32.6
    (#4360) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.19.2 to
    7.0.0 (#4361) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.2.0
    to 6.4.0 (#4362) @dependabot[bot]
  - build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0 (#4356) @dependabot[bot]
  - build(deps): bump docker/setup-qemu-action from 3.7.0 to
    4.0.0 (#4353) @dependabot[bot]
  - build(deps): bump actions/setup-node from 6.2.0 to 6.3.0
    (#4352) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#4354) @dependabot[bot]
  - deps: update actions and golangci-lint (#4348) @mmetc
  - build(deps): bump github/codeql-action from 4.32.4 to 4.32.5
    (#4345) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.3.0 to 7.3.1
    (#4346) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.2.0 to 6.3.0
    (#4339) @dependabot[bot]
  - build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#4342) @dependabot[bot]
  - replace trace.CatchPanic(...) with trace.ReportPanic()
    (#4336) @mmetc
  - build(deps): bump github/codeql-action from 4.32.3 to 4.32.4
    (#4322) @dependabot[bot]
  - deps: update gocron v1 -&gt; v2 (#4317) @mmetc
  - build(deps): bump docker/build-push-action from 6.19.0 to
    6.19.2 (#4306) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.2 to 4.32.3
    (#4312) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.1 to 4.32.2
    (#4292) @dependabot[bot]
  - update golangci-lint 2.9 (#4302) @mmetc
  - build(deps): bump astral-sh/setup-uv from 7.2.1 to 7.3.0
    (#4296) @dependabot[bot]
  - build(deps): bump docker/build-push-action from 6.18.0 to
    6.19.0 (#4303) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.32.0 to 4.32.1
    (#4278) @dependabot[bot]
  - build(deps): bump actions/setup-node from 4.4.0 to 6.2.0
    (#4264) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4263) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.2.0 to 7.2.1
    (#4265) @dependabot[bot]
  - build(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#4257) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.11 to 4.32.0
    (#4254) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.31.10 to
    4.31.11 (#4233) @dependabot[bot]
  - build(deps): bump actions/checkout from 6.0.1 to 6.0.2
    (#4234) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.1.0
    to 6.2.0 (#4222) @dependabot[bot]
  - build(deps): bump actions/setup-python from 6.1.0 to 6.2.0
    (#4223) @dependabot[bot]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.7.8:
  * New Features
  - WAF: OpenAPI schema validation (#4097) @blotus
  * Improvements
  - WAF: enforce body size limitation (#4355) @blotus
  - Decision stream: move to chunked transfer by default (#4413)
    @blotus
  - cscli: add --quick flag to enroll command (#4350) @blotus
  - propose an alternative, cleaner configuration for
    appsec-config (#4397) @buixor
  * Bug Fixes
  - cscli metrics: don't attempt to create a DB client if there's
    no DB config (#4451) @blotus
  - papi: don't spam logs if chan is closed (#4439) @blotus
  - alerts: use single transaction when creating alert and all
    related items (#4438) @blotus
  - LAPI: enforce maximum body size for decompression
  * Chore / Deps
  - build(deps): bump the gomod group across 1 directory with 34
    updates (#4453) @dependabot[bot]
  - build(deps): bump the github-actions group with 2 updates
    (#4447) @dependabot[bot]
  - build(deps): bump alpine from 3.21 to 3.23 in /build/docker
    in the docker group across 1 directory (#4441)
    @dependabot[bot]
  - build(deps): bump the github-actions group with 7 updates
    (#4443) @dependabot[bot]
  - build(deps): bump the uv group in /build/docker/test with 3
    updates (#4442) @dependabot[bot]
  - db: add some missing indexes (#4435) @blotus
  - Dependencies update (#4412) @blotus
  - add PAPI metrics (#4411) @blotus
  - build(deps): bump github.com/aws/aws-lambda-go from 1.47.0 to
    1.54.0 (#4402) @dependabot[bot]
  - build(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#4403) @dependabot[bot]
  - build(deps): bump github.com/google/go-querystring from 1.1.0
    to 1.2.0 (#4400) @dependabot[bot]
  - build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
    (#4404) @dependabot[bot]
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sqs
    from 1.42.3 to 1.42.25 (#4405) @dependabot[bot]
  - build(deps): bump release-drafter/release-drafter from 6.4.0
    to 7.1.1 (#4381) @dependabot[bot]
  - build(deps): bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#4388) @dependabot[bot]
  - build(deps): bump schneegans/dynamic-badges-action from 1.7.0
    to 1.8.0 (#4393) @dependabot[bot]
  - build(deps): bump astral-sh/setup-uv from 7.6.0 to 8.0.0
    (#4394) @dependabot[bot]
  - build(deps): bump github/codeql-action from 4.33.0 to 4.35.1
    (#4395) @dependabot[bot]
  - update dependabot config (#4440) @blotus
  - build(deps): bump requests from 2.32.5 to 2.33.0 in
    /build/docker/test (#4389) @dependabot[bot]
  - build(deps): bump cryptography from 46.0.5 to 46.0.6 in
    /build/docker/test (#4391) @dependabot[bot]
  - build(deps): bump pygments from 2.19.2 to 2.20.0 in
    /build/docker/test (#4396) @dependabot[bot]</changelog>
</package>
<package pkgid="1ee467d49f66f86b986ed090b5436de5552bf20f52a3321622e114e9a7a88c665654d9c83635db0f027f7dd9c59522cc8d7f8e9a674f38eb91bba004b9b4838d" name="daes" arch="s390x">
  <version epoch="0" ver="0.41" rel="4.23"/>
  <changelog author="pascal.bleser@opensuse.org" date="1251633600">- initial package (0.41)</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1494936000">- package/spec cleanup, adding license</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- use https urls</changelog>
</package>
<package pkgid="b2828b0dbddfcc7e58dab682df5fd2d8eae16b52e376a6cbbd418a95a780687a80fe7ad2eb9872696ae8b369bb14dd23139f86e8fcbd2ad3d367544985ab8810" name="daes" arch="src">
  <version epoch="0" ver="0.41" rel="4.23"/>
  <changelog author="pascal.bleser@opensuse.org" date="1251633600">- initial package (0.41)</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1494936000">- package/spec cleanup, adding license</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- use https urls</changelog>
</package>
<package pkgid="d8727d887340397f129604588d7501369c5e70e8ab010b81f34fc1d7af1ec179d0eca27c576cc9abfb5bcc5bf0f76f2b1da5bf482a6ca5d9582add0c6a0ae164" name="daes-debuginfo" arch="s390x">
  <version epoch="0" ver="0.41" rel="4.23"/>
  <changelog author="pascal.bleser@opensuse.org" date="1251633600">- initial package (0.41)</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1494936000">- package/spec cleanup, adding license</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- use https urls</changelog>
</package>
<package pkgid="90b051d0030a51fe75e9cb3ff10069e1c525d915273004e984d7cf1c2c60893325e9c09fb09d1ad9ecdd50377d00bbad709226f3a4c842174a45e09e6481207f" name="daes-debugsource" arch="s390x">
  <version epoch="0" ver="0.41" rel="4.23"/>
  <changelog author="pascal.bleser@opensuse.org" date="1251633600">- initial package (0.41)</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1494936000">- package/spec cleanup, adding license</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- use https urls</changelog>
</package>
<package pkgid="7585600aa0cf3092806ad6aeafe8062d18cc255be16fd92c8a3bac2be9296fc4f5c9836c92dddd88c16b85398754496e92c93e0f20264bd2644c02282e168a62" name="dirb" arch="s390x">
  <version epoch="0" ver="2.22" rel="2.38"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1594209600">- Initial package, version 2.22</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- switch to use https url</changelog>
</package>
<package pkgid="7cd0f9adc4416bb72368027911cb5a41ee0068ad4614407d3e1ce726afa6d6077107fea13edd85f4f9e0fdf7f91a6b6ab8e2fe7f8eaf1f2630901bc33cd194ff" name="dirb" arch="src">
  <version epoch="0" ver="2.22" rel="2.38"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1594209600">- Initial package, version 2.22</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- switch to use https url</changelog>
</package>
<package pkgid="2fcabdbd6befe6988bbcdb1ae019809be63a439bf47c8a469c0b8965ec5f07cb23b31e5a0dea48325286e683b3482be18368f1f23765dc75cb6ad34345452af5" name="dirb-debuginfo" arch="s390x">
  <version epoch="0" ver="2.22" rel="2.38"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1594209600">- Initial package, version 2.22</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- switch to use https url</changelog>
</package>
<package pkgid="bd0b4b8ef419fdacba245be5941c97be393d148011912a3d456459f263f8e7256be7d6e77f958f1ba1a8f11d86dc3b5e3a0bf30f0dbdef1946e45b0eddc1d9e1" name="dirb-debugsource" arch="s390x">
  <version epoch="0" ver="2.22" rel="2.38"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1594209600">- Initial package, version 2.22</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- switch to use https url</changelog>
</package>
<package pkgid="f7638498479e5c2e475c0e0668574f3885cc004c445aca9fa9472d944c933ce18d4f3b080bdabbe7eaa402e4aeab5fd1c7e66d535222f0315eb7c304c6639405" name="duo_unix" arch="s390x">
  <version epoch="0" ver="2.2.1" rel="1.13"/>
  <changelog author="plinnell@opensuse.org" date="1464955200">- Update to 1-9-18
  * Package cleanups and remove rpmlint warnings - still
  needs security review
- duo_unix-1.9.18:
  +Added HTTP proxy connection error handling
  +Improved compatibility with Solaris and AIX
- duo_unix-1.9.17:
  + Fixed PAM return code issue
- duo_unix-1.9.16:
  +Test fixes
  +Compilation fixes
- duo_unix-1.9.15:
  +SELinux policy module package support
  +PAM module improvements
  +Removed deprecated SHA1 Entrust CA
- duo_unix-1.9.14:
  +Added SELinux policy module
  +Improve poll(2) error handling</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1627041600">- Update to 1.11.4, detailed below.
- Fix paths in duo_unix_support tool.
- Fix RPM group for devel pkg.
- Deal with statically-linked libduo (see 1.9.20 changes).
  - should we patch the build to force dynamic linking?
  duo_unix-1.11.4:
- Added support tool to collect information (e.g. logs and PAM stacks) for debugging purposes
  duo_unix-1.11.3:
- Improved validation of BSON messages
  duo_unix-1.11.2:
- Added recommended Kerberos configuration for Duo Unix to our documentation, found at https://help.duo.com/s/article/5085. Thanks to Neal Poole at Facebook for bringing expertise and attention to this topic.
- Updated SELinux policy to allow local logins to use the pam_duo PAM module and made sshd configurable
- Added support for spaces in group names when escaped with backslashes in pam_duo.conf and login_duo.conf
- Test infrastructure updates
  duo_unix-1.11.1:
- Fixed bug causing console login to fail on certain systems
  duo_unix-1.11.0:
- Added support for GECOS field parsing based on user-supplied delimiter
- Updated README to include development/testing steps
- Minor test infrastructure updates
  duo_unix-1.10.5:
- Fixed an accidental null pointer free on systems where getaddrinfo() is unsuccessful
  duo_unix-1.10.4:
- Removed failmode decision from auth endpoint and moved it to only preauth according to standards in our other integrations
- Updated Duo Unix to speak up to TLS 1.2
- Support for LibreSSL 2.7.0 and up
- Minor memory leak fixes
- Output message when user is locked out
  duo_unix-1.10.3:
- Added support for http_proxy with SELinux enabled
  duo_unix-1.10.2:
- Added default failmode values in config files
  duo_unix-1.10.1:
- Fixed bug causing automated tests to fail on OSX
- Addressed an issue which kept configuration secrets in memory for longer than necessary
  duo_unix-1.10.0:
- Added LibreSSL support
- Added additional GECOS parsing support
- Increased OSX group count
  duo_unix-1.9.21:
- PSA-2017-002: Only allow http_proxy to be defined in configuration file instead of environment
  duo_unix-1.9.20:
- Fix installation on AIX systems
- Add support for using OpenSSL 1.1.0
- Link libduo statically to address issues with the ldconfig cache and incompatibilities between versions
- Fixed a bug that produced incorrect SNI when using a proxy
  duo_unix-1.9.19:
- Restore the http_proxy environment variable after Duo is done
- Added https_timeout config option to pam_duo
- Handles missing shell and adds default if not specified in getpwuid
- Add SNI support and a guard for systems that don't support SNI
- Bug fixes for timeouts and fallback ip addresses</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1628856000">- Fix pam_duo.conf permissions</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1645185600">duo_unix-1.12.0:
- Switched from BSON to JSON as a data interchange format
- Switched from Cram to python `unittest` for testing</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1674561600">- Patch the build to link libduo dynamically, as SUSE policy dictates.
  Upstream began linking statically in 1.9.20.</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1674648000">- Merge pam_duo into main package
- Add README.SUSE file
- Update comments in permissions file
- Misc. cleanup of spec &amp; rpmlint</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1675857600">- Update to 2.0.0.  Note the changed behavior in pam_duo for su between two
  non-root users!
  duo_unix-2.0.0:
- Changed the behavior of `su` when the target user is not root.  The target user will need to complete 2FA rather than the original user.
- login_duo resets the SIGPIPE handler when it closes its connection.
- Added logging when Duo is invoked, to assist troubleshooting.
- Updated package signing to SHA512
  duo_unix-1.12.1:
- Updated Unity to 2.5.2</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1692273600">- Update to 2.0.2 and rebase patches
- Patch licenses path
  duo_unix-2.0.2:
- Make check now successfully runs on Solaris
  duo_unix-2.0.1:
- The support script collects a few additional files for troubleshooting
- Duo API calls now use SHA512 instead of SHA1 as the HMAC algorithm</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1755604800">- Update to 2.1.0 and rebase patches.
- Remove irrelevant information about upstream OS support (e.g. "Added support
  for Fedora XX") from the changelog.
  duo_unix-2.1.0:
- Improves certificate validation for IP hostnames to mitigate CVE-2014-0139
- Duo Unix obeys rate limiting replies from the Duo cloud service
- The full path to the configuration file is logged out when Duo Unix is invoked
- API calls to Duo will account for possible time drift between Duo and the local server
- Adds support for new Duo certificate authorities
  duo_unix-2.0.4:
- Fixed multiple memory allocation leaks
- Removed some unused and unreachable code
- Addressed multiple code cleanliness issues
  duo_unix-2.0.3:
- Fixed AIX compilation bug
- Support script now fetches correct log and PAM files for Solaris and AIX</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1761048000">- Update to 2.2.1.
- Replace deprecated %%patchN calls with %%autosetup.
- As of 2.2.0, duo_unix supports Verified Duo Push, which generates a three-
  digit code you must enter into the mobile app.  This is enabled with the
  'verified_push' config option, which is mutually exclusive with 'autopush'.
  duo_unix-2.2.1:
- Verified Push option is now documented in the man pages
- Enrollment message now includes the URL
  duo_unix-2.2.0:
- Added support for Verified Push
- Updated the Duo API calls to use the Auth API v2
- SSL failures will cause API calls fail over to additional IPs when the host resolves to multiple addresses</changelog>
</package>
<package pkgid="f1bf64b39fc43ad5fd3d53202a28b3f150544957c7f1ec59c81da92b5bd721dfaf40fcf1a12f700f5837016d9881e00d69d5d630f4474bf7197b3877719ef9da" name="duo_unix" arch="src">
  <version epoch="0" ver="2.2.1" rel="1.13"/>
  <changelog author="darin@darins.net" date="1413460800">- suse packaging</changelog>
  <changelog author="darin@darins.net" date="1417435200">- update packaging to comply with SONAME policy
- add rpmlintrc</changelog>
  <changelog author="plinnell@opensuse.org" date="1464955200">- Update to 1-9-18
  * Package cleanups and remove rpmlint warnings - still
  needs security review
- duo_unix-1.9.18:
  +Added HTTP proxy connection error handling
  +Improved compatibility with Solaris and AIX
- duo_unix-1.9.17:
  + Fixed PAM return code issue
- duo_unix-1.9.16:
  +Test fixes
  +Compilation fixes
- duo_unix-1.9.15:
  +SELinux policy module package support
  +PAM module improvements
  +Removed deprecated SHA1 Entrust CA
- duo_unix-1.9.14:
  +Added SELinux policy module
  +Improve poll(2) error handling</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1627041600">- Update to 1.11.4, detailed below.
- Fix paths in duo_unix_support tool.
- Fix RPM group for devel pkg.
- Deal with statically-linked libduo (see 1.9.20 changes).
  - should we patch the build to force dynamic linking?
  duo_unix-1.11.4:
- Added support tool to collect information (e.g. logs and PAM stacks) for debugging purposes
  duo_unix-1.11.3:
- Improved validation of BSON messages
  duo_unix-1.11.2:
- Added recommended Kerberos configuration for Duo Unix to our documentation, found at https://help.duo.com/s/article/5085. Thanks to Neal Poole at Facebook for bringing expertise and attention to this topic.
- Updated SELinux policy to allow local logins to use the pam_duo PAM module and made sshd configurable
- Added support for spaces in group names when escaped with backslashes in pam_duo.conf and login_duo.conf
- Test infrastructure updates
  duo_unix-1.11.1:
- Fixed bug causing console login to fail on certain systems
  duo_unix-1.11.0:
- Added support for GECOS field parsing based on user-supplied delimiter
- Updated README to include development/testing steps
- Minor test infrastructure updates
  duo_unix-1.10.5:
- Fixed an accidental null pointer free on systems where getaddrinfo() is unsuccessful
  duo_unix-1.10.4:
- Removed failmode decision from auth endpoint and moved it to only preauth according to standards in our other integrations
- Updated Duo Unix to speak up to TLS 1.2
- Support for LibreSSL 2.7.0 and up
- Minor memory leak fixes
- Output message when user is locked out
  duo_unix-1.10.3:
- Added support for http_proxy with SELinux enabled
  duo_unix-1.10.2:
- Added default failmode values in config files
  duo_unix-1.10.1:
- Fixed bug causing automated tests to fail on OSX
- Addressed an issue which kept configuration secrets in memory for longer than necessary
  duo_unix-1.10.0:
- Added LibreSSL support
- Added additional GECOS parsing support
- Increased OSX group count
  duo_unix-1.9.21:
- PSA-2017-002: Only allow http_proxy to be defined in configuration file instead of environment
  duo_unix-1.9.20:
- Fix installation on AIX systems
- Add support for using OpenSSL 1.1.0
- Link libduo statically to address issues with the ldconfig cache and incompatibilities between versions
- Fixed a bug that produced incorrect SNI when using a proxy
  duo_unix-1.9.19:
- Restore the http_proxy environment variable after Duo is done
- Added https_timeout config option to pam_duo
- Handles missing shell and adds default if not specified in getpwuid
- Add SNI support and a guard for systems that don't support SNI
- Bug fixes for timeouts and fallback ip addresses</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1628856000">- Fix pam_duo.conf permissions</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1645185600">duo_unix-1.12.0:
- Switched from BSON to JSON as a data interchange format
- Switched from Cram to python `unittest` for testing</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1674561600">- Patch the build to link libduo dynamically, as SUSE policy dictates.
  Upstream began linking statically in 1.9.20.</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1674648000">- Merge pam_duo into main package
- Add README.SUSE file
- Update comments in permissions file
- Misc. cleanup of spec &amp; rpmlint</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1675857600">- Update to 2.0.0.  Note the changed behavior in pam_duo for su between two
  non-root users!
  duo_unix-2.0.0:
- Changed the behavior of `su` when the target user is not root.  The target user will need to complete 2FA rather than the original user.
- login_duo resets the SIGPIPE handler when it closes its connection.
- Added logging when Duo is invoked, to assist troubleshooting.
- Updated package signing to SHA512
  duo_unix-1.12.1:
- Updated Unity to 2.5.2</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1692273600">- Update to 2.0.2 and rebase patches
- Patch licenses path
  duo_unix-2.0.2:
- Make check now successfully runs on Solaris
  duo_unix-2.0.1:
- The support script collects a few additional files for troubleshooting
- Duo API calls now use SHA512 instead of SHA1 as the HMAC algorithm</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1755604800">- Update to 2.1.0 and rebase patches.
- Remove irrelevant information about upstream OS support (e.g. "Added support
  for Fedora XX") from the changelog.
  duo_unix-2.1.0:
- Improves certificate validation for IP hostnames to mitigate CVE-2014-0139
- Duo Unix obeys rate limiting replies from the Duo cloud service
- The full path to the configuration file is logged out when Duo Unix is invoked
- API calls to Duo will account for possible time drift between Duo and the local server
- Adds support for new Duo certificate authorities
  duo_unix-2.0.4:
- Fixed multiple memory allocation leaks
- Removed some unused and unreachable code
- Addressed multiple code cleanliness issues
  duo_unix-2.0.3:
- Fixed AIX compilation bug
- Support script now fetches correct log and PAM files for Solaris and AIX</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1761048000">- Update to 2.2.1.
- Replace deprecated %%patchN calls with %%autosetup.
- As of 2.2.0, duo_unix supports Verified Duo Push, which generates a three-
  digit code you must enter into the mobile app.  This is enabled with the
  'verified_push' config option, which is mutually exclusive with 'autopush'.
  duo_unix-2.2.1:
- Verified Push option is now documented in the man pages
- Enrollment message now includes the URL
  duo_unix-2.2.0:
- Added support for Verified Push
- Updated the Duo API calls to use the Auth API v2
- SSL failures will cause API calls fail over to additional IPs when the host resolves to multiple addresses</changelog>
</package>
<package pkgid="0f1d94cbcd652201996c9e7abf3d25ec52a226ba415ce4970aacbb679dab65229d6dd64ab5e455b70c9e615071ef36f7413c9d1cbfa15bc4e9b08c240b978a65" name="duo_unix-debuginfo" arch="s390x">
  <version epoch="0" ver="2.2.1" rel="1.13"/>
  <changelog author="plinnell@opensuse.org" date="1464955200">- Update to 1-9-18
  * Package cleanups and remove rpmlint warnings - still
  needs security review
- duo_unix-1.9.18:
  +Added HTTP proxy connection error handling
  +Improved compatibility with Solaris and AIX
- duo_unix-1.9.17:
  + Fixed PAM return code issue
- duo_unix-1.9.16:
  +Test fixes
  +Compilation fixes
- duo_unix-1.9.15:
  +SELinux policy module package support
  +PAM module improvements
  +Removed deprecated SHA1 Entrust CA
- duo_unix-1.9.14:
  +Added SELinux policy module
  +Improve poll(2) error handling</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1627041600">- Update to 1.11.4, detailed below.
- Fix paths in duo_unix_support tool.
- Fix RPM group for devel pkg.
- Deal with statically-linked libduo (see 1.9.20 changes).
  - should we patch the build to force dynamic linking?
  duo_unix-1.11.4:
- Added support tool to collect information (e.g. logs and PAM stacks) for debugging purposes
  duo_unix-1.11.3:
- Improved validation of BSON messages
  duo_unix-1.11.2:
- Added recommended Kerberos configuration for Duo Unix to our documentation, found at https://help.duo.com/s/article/5085. Thanks to Neal Poole at Facebook for bringing expertise and attention to this topic.
- Updated SELinux policy to allow local logins to use the pam_duo PAM module and made sshd configurable
- Added support for spaces in group names when escaped with backslashes in pam_duo.conf and login_duo.conf
- Test infrastructure updates
  duo_unix-1.11.1:
- Fixed bug causing console login to fail on certain systems
  duo_unix-1.11.0:
- Added support for GECOS field parsing based on user-supplied delimiter
- Updated README to include development/testing steps
- Minor test infrastructure updates
  duo_unix-1.10.5:
- Fixed an accidental null pointer free on systems where getaddrinfo() is unsuccessful
  duo_unix-1.10.4:
- Removed failmode decision from auth endpoint and moved it to only preauth according to standards in our other integrations
- Updated Duo Unix to speak up to TLS 1.2
- Support for LibreSSL 2.7.0 and up
- Minor memory leak fixes
- Output message when user is locked out
  duo_unix-1.10.3:
- Added support for http_proxy with SELinux enabled
  duo_unix-1.10.2:
- Added default failmode values in config files
  duo_unix-1.10.1:
- Fixed bug causing automated tests to fail on OSX
- Addressed an issue which kept configuration secrets in memory for longer than necessary
  duo_unix-1.10.0:
- Added LibreSSL support
- Added additional GECOS parsing support
- Increased OSX group count
  duo_unix-1.9.21:
- PSA-2017-002: Only allow http_proxy to be defined in configuration file instead of environment
  duo_unix-1.9.20:
- Fix installation on AIX systems
- Add support for using OpenSSL 1.1.0
- Link libduo statically to address issues with the ldconfig cache and incompatibilities between versions
- Fixed a bug that produced incorrect SNI when using a proxy
  duo_unix-1.9.19:
- Restore the http_proxy environment variable after Duo is done
- Added https_timeout config option to pam_duo
- Handles missing shell and adds default if not specified in getpwuid
- Add SNI support and a guard for systems that don't support SNI
- Bug fixes for timeouts and fallback ip addresses</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1628856000">- Fix pam_duo.conf permissions</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1645185600">duo_unix-1.12.0:
- Switched from BSON to JSON as a data interchange format
- Switched from Cram to python `unittest` for testing</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1674561600">- Patch the build to link libduo dynamically, as SUSE policy dictates.
  Upstream began linking statically in 1.9.20.</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1674648000">- Merge pam_duo into main package
- Add README.SUSE file
- Update comments in permissions file
- Misc. cleanup of spec &amp; rpmlint</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1675857600">- Update to 2.0.0.  Note the changed behavior in pam_duo for su between two
  non-root users!
  duo_unix-2.0.0:
- Changed the behavior of `su` when the target user is not root.  The target user will need to complete 2FA rather than the original user.
- login_duo resets the SIGPIPE handler when it closes its connection.
- Added logging when Duo is invoked, to assist troubleshooting.
- Updated package signing to SHA512
  duo_unix-1.12.1:
- Updated Unity to 2.5.2</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1692273600">- Update to 2.0.2 and rebase patches
- Patch licenses path
  duo_unix-2.0.2:
- Make check now successfully runs on Solaris
  duo_unix-2.0.1:
- The support script collects a few additional files for troubleshooting
- Duo API calls now use SHA512 instead of SHA1 as the HMAC algorithm</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1755604800">- Update to 2.1.0 and rebase patches.
- Remove irrelevant information about upstream OS support (e.g. "Added support
  for Fedora XX") from the changelog.
  duo_unix-2.1.0:
- Improves certificate validation for IP hostnames to mitigate CVE-2014-0139
- Duo Unix obeys rate limiting replies from the Duo cloud service
- The full path to the configuration file is logged out when Duo Unix is invoked
- API calls to Duo will account for possible time drift between Duo and the local server
- Adds support for new Duo certificate authorities
  duo_unix-2.0.4:
- Fixed multiple memory allocation leaks
- Removed some unused and unreachable code
- Addressed multiple code cleanliness issues
  duo_unix-2.0.3:
- Fixed AIX compilation bug
- Support script now fetches correct log and PAM files for Solaris and AIX</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1761048000">- Update to 2.2.1.
- Replace deprecated %%patchN calls with %%autosetup.
- As of 2.2.0, duo_unix supports Verified Duo Push, which generates a three-
  digit code you must enter into the mobile app.  This is enabled with the
  'verified_push' config option, which is mutually exclusive with 'autopush'.
  duo_unix-2.2.1:
- Verified Push option is now documented in the man pages
- Enrollment message now includes the URL
  duo_unix-2.2.0:
- Added support for Verified Push
- Updated the Duo API calls to use the Auth API v2
- SSL failures will cause API calls fail over to additional IPs when the host resolves to multiple addresses</changelog>
</package>
<package pkgid="5e8ce5b2f3b31b1e805040f59a0a49e3cb97034ec77701a839162a3627f3c192ed401f8f3056ffddb9cf6a45dbcb1a00fc6a9eedaa3880b9e4c41dc0d7f58871" name="duo_unix-devel" arch="s390x">
  <version epoch="0" ver="2.2.1" rel="1.13"/>
  <changelog author="plinnell@opensuse.org" date="1464955200">- Update to 1-9-18
  * Package cleanups and remove rpmlint warnings - still
  needs security review
- duo_unix-1.9.18:
  +Added HTTP proxy connection error handling
  +Improved compatibility with Solaris and AIX
- duo_unix-1.9.17:
  + Fixed PAM return code issue
- duo_unix-1.9.16:
  +Test fixes
  +Compilation fixes
- duo_unix-1.9.15:
  +SELinux policy module package support
  +PAM module improvements
  +Removed deprecated SHA1 Entrust CA
- duo_unix-1.9.14:
  +Added SELinux policy module
  +Improve poll(2) error handling</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1627041600">- Update to 1.11.4, detailed below.
- Fix paths in duo_unix_support tool.
- Fix RPM group for devel pkg.
- Deal with statically-linked libduo (see 1.9.20 changes).
  - should we patch the build to force dynamic linking?
  duo_unix-1.11.4:
- Added support tool to collect information (e.g. logs and PAM stacks) for debugging purposes
  duo_unix-1.11.3:
- Improved validation of BSON messages
  duo_unix-1.11.2:
- Added recommended Kerberos configuration for Duo Unix to our documentation, found at https://help.duo.com/s/article/5085. Thanks to Neal Poole at Facebook for bringing expertise and attention to this topic.
- Updated SELinux policy to allow local logins to use the pam_duo PAM module and made sshd configurable
- Added support for spaces in group names when escaped with backslashes in pam_duo.conf and login_duo.conf
- Test infrastructure updates
  duo_unix-1.11.1:
- Fixed bug causing console login to fail on certain systems
  duo_unix-1.11.0:
- Added support for GECOS field parsing based on user-supplied delimiter
- Updated README to include development/testing steps
- Minor test infrastructure updates
  duo_unix-1.10.5:
- Fixed an accidental null pointer free on systems where getaddrinfo() is unsuccessful
  duo_unix-1.10.4:
- Removed failmode decision from auth endpoint and moved it to only preauth according to standards in our other integrations
- Updated Duo Unix to speak up to TLS 1.2
- Support for LibreSSL 2.7.0 and up
- Minor memory leak fixes
- Output message when user is locked out
  duo_unix-1.10.3:
- Added support for http_proxy with SELinux enabled
  duo_unix-1.10.2:
- Added default failmode values in config files
  duo_unix-1.10.1:
- Fixed bug causing automated tests to fail on OSX
- Addressed an issue which kept configuration secrets in memory for longer than necessary
  duo_unix-1.10.0:
- Added LibreSSL support
- Added additional GECOS parsing support
- Increased OSX group count
  duo_unix-1.9.21:
- PSA-2017-002: Only allow http_proxy to be defined in configuration file instead of environment
  duo_unix-1.9.20:
- Fix installation on AIX systems
- Add support for using OpenSSL 1.1.0
- Link libduo statically to address issues with the ldconfig cache and incompatibilities between versions
- Fixed a bug that produced incorrect SNI when using a proxy
  duo_unix-1.9.19:
- Restore the http_proxy environment variable after Duo is done
- Added https_timeout config option to pam_duo
- Handles missing shell and adds default if not specified in getpwuid
- Add SNI support and a guard for systems that don't support SNI
- Bug fixes for timeouts and fallback ip addresses</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1628856000">- Fix pam_duo.conf permissions</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1645185600">duo_unix-1.12.0:
- Switched from BSON to JSON as a data interchange format
- Switched from Cram to python `unittest` for testing</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1674561600">- Patch the build to link libduo dynamically, as SUSE policy dictates.
  Upstream began linking statically in 1.9.20.</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1674648000">- Merge pam_duo into main package
- Add README.SUSE file
- Update comments in permissions file
- Misc. cleanup of spec &amp; rpmlint</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1675857600">- Update to 2.0.0.  Note the changed behavior in pam_duo for su between two
  non-root users!
  duo_unix-2.0.0:
- Changed the behavior of `su` when the target user is not root.  The target user will need to complete 2FA rather than the original user.
- login_duo resets the SIGPIPE handler when it closes its connection.
- Added logging when Duo is invoked, to assist troubleshooting.
- Updated package signing to SHA512
  duo_unix-1.12.1:
- Updated Unity to 2.5.2</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1692273600">- Update to 2.0.2 and rebase patches
- Patch licenses path
  duo_unix-2.0.2:
- Make check now successfully runs on Solaris
  duo_unix-2.0.1:
- The support script collects a few additional files for troubleshooting
- Duo API calls now use SHA512 instead of SHA1 as the HMAC algorithm</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1755604800">- Update to 2.1.0 and rebase patches.
- Remove irrelevant information about upstream OS support (e.g. "Added support
  for Fedora XX") from the changelog.
  duo_unix-2.1.0:
- Improves certificate validation for IP hostnames to mitigate CVE-2014-0139
- Duo Unix obeys rate limiting replies from the Duo cloud service
- The full path to the configuration file is logged out when Duo Unix is invoked
- API calls to Duo will account for possible time drift between Duo and the local server
- Adds support for new Duo certificate authorities
  duo_unix-2.0.4:
- Fixed multiple memory allocation leaks
- Removed some unused and unreachable code
- Addressed multiple code cleanliness issues
  duo_unix-2.0.3:
- Fixed AIX compilation bug
- Support script now fetches correct log and PAM files for Solaris and AIX</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1761048000">- Update to 2.2.1.
- Replace deprecated %%patchN calls with %%autosetup.
- As of 2.2.0, duo_unix supports Verified Duo Push, which generates a three-
  digit code you must enter into the mobile app.  This is enabled with the
  'verified_push' config option, which is mutually exclusive with 'autopush'.
  duo_unix-2.2.1:
- Verified Push option is now documented in the man pages
- Enrollment message now includes the URL
  duo_unix-2.2.0:
- Added support for Verified Push
- Updated the Duo API calls to use the Auth API v2
- SSL failures will cause API calls fail over to additional IPs when the host resolves to multiple addresses</changelog>
</package>
<package pkgid="6265f3270f1d715c82faf6b820697c7ebce6933bbfdd3ce0e25f9dba39cae961316baa39ed65cd7ddbd5de1c2b6d35a798589297b9478d22446ae1afa40727b1" name="eid-mw" arch="s390x">
  <version epoch="0" ver="5.1.29" rel="22.5"/>
  <changelog author="pth@suse.de" date="1418040000">- Add a group tag for the libs package.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1600689600">- updated to 5.0.8
  eID Viewer
  - Now supports applet 1.8 eID cards
- updated to 5.0.6
  Pkcs11
  - Now supports applet 1.8 eID cards
  - SDK now supports applet 1.8 eID cards
  Minidriver
  - Now supports applet 1.8 eID cards</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1615291200">- Drop Requires(pre): /sbin/chkconfig: there are no pre scripts
  present, so this can't be real.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1632744000">- updated to 5.0.28
  * improve translations
  * UI improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1672488000">- updated to 5.1.4
  * support new distributions
  * monitor specific resolution
  * UI improvements
  * build improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1688472000">- updated to 5.1.11
  * did not find the changes entries :/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1746273600">- updated to 5.1.21
  * again, no good changes posted by authors</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1763899200">- updated to 5.1.26
  - no good changes</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1779710400">- updated to 5.1.29
  - no good changes
- eid-mw.keyring, updated to 2025</changelog>
</package>
<package pkgid="ac8e3cc07d9833d7331e3a3c5309b5dad823e5dfe6abb7bb3a21372633b210caf0f5633722696611063f42c709864c14524a41b8f4d88f5dfc0164b78db41439" name="eid-mw" arch="src">
  <version epoch="0" ver="5.1.29" rel="22.5"/>
  <changelog author="dag@wieers.com" date="1298462400">- Included pre-built JAR files.</changelog>
  <changelog author="dag@wieers.com" date="1298462401">- Added post-install script and desktop file.</changelog>
  <changelog author="dag@wieers.com" date="1300276800">- Split eid-mw and eid-viewer packages.</changelog>
  <changelog author="frank@apsu.be" date="1300363200">- Made Revision number variable to allow continuous builds.</changelog>
  <changelog author="frank@apsu.be" date="1331640000">- Upgrade to 4.0.2</changelog>
  <changelog author="frank@apsu.be" date="1335960000">- Upgrade to 4.0.4</changelog>
  <changelog author="frank@apsu.be" date="1381752000">- Upgrade to 4.0.6</changelog>
  <changelog author="wouter.verhelst@fedict.be" date="1406721600">- Split package up into several subpackages so as to make multiarch work
  without much issues.</changelog>
  <changelog author="wouter.verhelst@fedict.be" date="1407931200">- Split up somewhat further so that openSUSE-style multiarch works, too.</changelog>
  <changelog author="pth@suse.de" date="1417694400">- Initial openSUSE package based on the spec from Google source
  and Pascal Bleser's work including eid-mw-add_missing_includes.patch..</changelog>
  <changelog author="pth@suse.de" date="1418040000">- Add a group tag for the libs package.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1600689600">- updated to 5.0.8
  eID Viewer
  - Now supports applet 1.8 eID cards
- updated to 5.0.6
  Pkcs11
  - Now supports applet 1.8 eID cards
  - SDK now supports applet 1.8 eID cards
  Minidriver
  - Now supports applet 1.8 eID cards</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1615291200">- Drop Requires(pre): /sbin/chkconfig: there are no pre scripts
  present, so this can't be real.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1632744000">- updated to 5.0.28
  * improve translations
  * UI improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1672488000">- updated to 5.1.4
  * support new distributions
  * monitor specific resolution
  * UI improvements
  * build improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1688472000">- updated to 5.1.11
  * did not find the changes entries :/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1746273600">- updated to 5.1.21
  * again, no good changes posted by authors</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1763899200">- updated to 5.1.26
  - no good changes</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1779710400">- updated to 5.1.29
  - no good changes
- eid-mw.keyring, updated to 2025</changelog>
</package>
<package pkgid="92951ed3deaaf5f3643e3bc53bbcfed54a7b6734143c9e4fd1a0fe359cb6ac9e5a1f8470329e758b0c6b3fe5f501c4bef17cc3a228007ed084b5cba9a135a022" name="eid-mw-debuginfo" arch="s390x">
  <version epoch="0" ver="5.1.29" rel="22.5"/>
  <changelog author="pth@suse.de" date="1418040000">- Add a group tag for the libs package.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1600689600">- updated to 5.0.8
  eID Viewer
  - Now supports applet 1.8 eID cards
- updated to 5.0.6
  Pkcs11
  - Now supports applet 1.8 eID cards
  - SDK now supports applet 1.8 eID cards
  Minidriver
  - Now supports applet 1.8 eID cards</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1615291200">- Drop Requires(pre): /sbin/chkconfig: there are no pre scripts
  present, so this can't be real.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1632744000">- updated to 5.0.28
  * improve translations
  * UI improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1672488000">- updated to 5.1.4
  * support new distributions
  * monitor specific resolution
  * UI improvements
  * build improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1688472000">- updated to 5.1.11
  * did not find the changes entries :/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1746273600">- updated to 5.1.21
  * again, no good changes posted by authors</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1763899200">- updated to 5.1.26
  - no good changes</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1779710400">- updated to 5.1.29
  - no good changes
- eid-mw.keyring, updated to 2025</changelog>
</package>
<package pkgid="40fcfdcfa48c56a4c38d247428993022ba9c57f2f0c05281683479bd93363497f71d83236a3f9b12d0d3bccffa25dcf32fa124c54188e3554375b98f20329d56" name="eid-mw-debugsource" arch="s390x">
  <version epoch="0" ver="5.1.29" rel="22.5"/>
  <changelog author="pth@suse.de" date="1418040000">- Add a group tag for the libs package.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1600689600">- updated to 5.0.8
  eID Viewer
  - Now supports applet 1.8 eID cards
- updated to 5.0.6
  Pkcs11
  - Now supports applet 1.8 eID cards
  - SDK now supports applet 1.8 eID cards
  Minidriver
  - Now supports applet 1.8 eID cards</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1615291200">- Drop Requires(pre): /sbin/chkconfig: there are no pre scripts
  present, so this can't be real.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1632744000">- updated to 5.0.28
  * improve translations
  * UI improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1672488000">- updated to 5.1.4
  * support new distributions
  * monitor specific resolution
  * UI improvements
  * build improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1688472000">- updated to 5.1.11
  * did not find the changes entries :/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1746273600">- updated to 5.1.21
  * again, no good changes posted by authors</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1763899200">- updated to 5.1.26
  - no good changes</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1779710400">- updated to 5.1.29
  - no good changes
- eid-mw.keyring, updated to 2025</changelog>
</package>
<package pkgid="a6f5c01ec236d3372a6813f3a27d020d9e67ac356018001cbcb773be9f6a26154ebbd9585dc297a93c310f64ce4927e691507cc7f5d5166114a1a2d9892b74de" name="eid-mw-devel" arch="s390x">
  <version epoch="0" ver="5.1.29" rel="22.5"/>
  <changelog author="pth@suse.de" date="1418040000">- Add a group tag for the libs package.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1600689600">- updated to 5.0.8
  eID Viewer
  - Now supports applet 1.8 eID cards
- updated to 5.0.6
  Pkcs11
  - Now supports applet 1.8 eID cards
  - SDK now supports applet 1.8 eID cards
  Minidriver
  - Now supports applet 1.8 eID cards</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1615291200">- Drop Requires(pre): /sbin/chkconfig: there are no pre scripts
  present, so this can't be real.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1632744000">- updated to 5.0.28
  * improve translations
  * UI improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1672488000">- updated to 5.1.4
  * support new distributions
  * monitor specific resolution
  * UI improvements
  * build improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1688472000">- updated to 5.1.11
  * did not find the changes entries :/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1746273600">- updated to 5.1.21
  * again, no good changes posted by authors</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1763899200">- updated to 5.1.26
  - no good changes</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1779710400">- updated to 5.1.29
  - no good changes
- eid-mw.keyring, updated to 2025</changelog>
</package>
<package pkgid="eee7c3d2afdce4a33f420a013c3a0548d40339d847bd934091875bbd2d0ac998debe4fdaf8066ef00aa998503e4acad40fca071824f23e5b0732b8039869cc14" name="eid-mw-firefox" arch="s390x">
  <version epoch="0" ver="5.1.29" rel="22.5"/>
  <changelog author="pth@suse.de" date="1418040000">- Add a group tag for the libs package.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1600689600">- updated to 5.0.8
  eID Viewer
  - Now supports applet 1.8 eID cards
- updated to 5.0.6
  Pkcs11
  - Now supports applet 1.8 eID cards
  - SDK now supports applet 1.8 eID cards
  Minidriver
  - Now supports applet 1.8 eID cards</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1615291200">- Drop Requires(pre): /sbin/chkconfig: there are no pre scripts
  present, so this can't be real.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1632744000">- updated to 5.0.28
  * improve translations
  * UI improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1672488000">- updated to 5.1.4
  * support new distributions
  * monitor specific resolution
  * UI improvements
  * build improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1688472000">- updated to 5.1.11
  * did not find the changes entries :/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1746273600">- updated to 5.1.21
  * again, no good changes posted by authors</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1763899200">- updated to 5.1.26
  - no good changes</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1779710400">- updated to 5.1.29
  - no good changes
- eid-mw.keyring, updated to 2025</changelog>
</package>
<package pkgid="27523531c0a019d4e380a98f91ae8c1d4d82783c7a97495aad775191f1c910b17927efd0bff272e46f1734842d5809290d85a255cb769f3f026366953473f97f" name="eid-mw-libs" arch="s390x">
  <version epoch="0" ver="5.1.29" rel="22.5"/>
  <changelog author="pth@suse.de" date="1418040000">- Add a group tag for the libs package.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1600689600">- updated to 5.0.8
  eID Viewer
  - Now supports applet 1.8 eID cards
- updated to 5.0.6
  Pkcs11
  - Now supports applet 1.8 eID cards
  - SDK now supports applet 1.8 eID cards
  Minidriver
  - Now supports applet 1.8 eID cards</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1615291200">- Drop Requires(pre): /sbin/chkconfig: there are no pre scripts
  present, so this can't be real.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1632744000">- updated to 5.0.28
  * improve translations
  * UI improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1672488000">- updated to 5.1.4
  * support new distributions
  * monitor specific resolution
  * UI improvements
  * build improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1688472000">- updated to 5.1.11
  * did not find the changes entries :/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1746273600">- updated to 5.1.21
  * again, no good changes posted by authors</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1763899200">- updated to 5.1.26
  - no good changes</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1779710400">- updated to 5.1.29
  - no good changes
- eid-mw.keyring, updated to 2025</changelog>
</package>
<package pkgid="774191b027e2cb8bbd4cf41a15ea6b87d9409ff0fac73febd2a77976172bc802d92c0cb67ed5c3e54272bb2f82ef0a8aefbc74ba5a7419fc791d2a7d3badc502" name="eid-mw-libs-debuginfo" arch="s390x">
  <version epoch="0" ver="5.1.29" rel="22.5"/>
  <changelog author="pth@suse.de" date="1418040000">- Add a group tag for the libs package.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1600689600">- updated to 5.0.8
  eID Viewer
  - Now supports applet 1.8 eID cards
- updated to 5.0.6
  Pkcs11
  - Now supports applet 1.8 eID cards
  - SDK now supports applet 1.8 eID cards
  Minidriver
  - Now supports applet 1.8 eID cards</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1615291200">- Drop Requires(pre): /sbin/chkconfig: there are no pre scripts
  present, so this can't be real.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1632744000">- updated to 5.0.28
  * improve translations
  * UI improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1672488000">- updated to 5.1.4
  * support new distributions
  * monitor specific resolution
  * UI improvements
  * build improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1688472000">- updated to 5.1.11
  * did not find the changes entries :/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1746273600">- updated to 5.1.21
  * again, no good changes posted by authors</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1763899200">- updated to 5.1.26
  - no good changes</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1779710400">- updated to 5.1.29
  - no good changes
- eid-mw.keyring, updated to 2025</changelog>
</package>
<package pkgid="b0540d2673d90f32bfc16237f865be5d219e9161077cfcdd2039ecc85303869b1bdf6901813017b24571e81ccafff606fce70016c3c05afde28c78e0b3372c1b" name="eid-viewer" arch="s390x">
  <version epoch="0" ver="5.1.29" rel="22.5"/>
  <changelog author="pth@suse.de" date="1418040000">- Add a group tag for the libs package.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1600689600">- updated to 5.0.8
  eID Viewer
  - Now supports applet 1.8 eID cards
- updated to 5.0.6
  Pkcs11
  - Now supports applet 1.8 eID cards
  - SDK now supports applet 1.8 eID cards
  Minidriver
  - Now supports applet 1.8 eID cards</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1615291200">- Drop Requires(pre): /sbin/chkconfig: there are no pre scripts
  present, so this can't be real.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1632744000">- updated to 5.0.28
  * improve translations
  * UI improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1672488000">- updated to 5.1.4
  * support new distributions
  * monitor specific resolution
  * UI improvements
  * build improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1688472000">- updated to 5.1.11
  * did not find the changes entries :/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1746273600">- updated to 5.1.21
  * again, no good changes posted by authors</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1763899200">- updated to 5.1.26
  - no good changes</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1779710400">- updated to 5.1.29
  - no good changes
- eid-mw.keyring, updated to 2025</changelog>
</package>
<package pkgid="f4cb4e7c081aff9211434a33f1e650d69b3bae500c163e620553cc06a3e416f60c5417bc30e46732b6a4f34742c5a5f5610be14acf027fb2510f5e3f3d0566c8" name="eid-viewer-debuginfo" arch="s390x">
  <version epoch="0" ver="5.1.29" rel="22.5"/>
  <changelog author="pth@suse.de" date="1418040000">- Add a group tag for the libs package.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1600689600">- updated to 5.0.8
  eID Viewer
  - Now supports applet 1.8 eID cards
- updated to 5.0.6
  Pkcs11
  - Now supports applet 1.8 eID cards
  - SDK now supports applet 1.8 eID cards
  Minidriver
  - Now supports applet 1.8 eID cards</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1615291200">- Drop Requires(pre): /sbin/chkconfig: there are no pre scripts
  present, so this can't be real.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1632744000">- updated to 5.0.28
  * improve translations
  * UI improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1672488000">- updated to 5.1.4
  * support new distributions
  * monitor specific resolution
  * UI improvements
  * build improvements</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1688472000">- updated to 5.1.11
  * did not find the changes entries :/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1746273600">- updated to 5.1.21
  * again, no good changes posted by authors</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1763899200">- updated to 5.1.26
  - no good changes</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1779710400">- updated to 5.1.29
  - no good changes
- eid-mw.keyring, updated to 2025</changelog>
</package>
<package pkgid="1281042bf7a625080050cc422d6d6f67bf5a7af81f90ad9b861ff146655fe54c67b690972a97c515d7f0b0e24e94d22974ba70ef7a39eb8be26d08946c038b74" name="eltt2" arch="s390x">
  <version epoch="0" ver="1.1~git20200616.5efe7e4" rel="1.42"/>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1617192000">- Initial version from git 1.1~git20200616.5efe7e4</changelog>
</package>
<package pkgid="c620d47d046e1bdf9c165ef8cdfaa40a255ec40b46f62cabbe46a7ac4c7ebefb5226aa0864bb1c02ec86859cbaf366ba5c98ad0cfe5a4687c1481815c5fcc852" name="eltt2" arch="src">
  <version epoch="0" ver="1.1~git20200616.5efe7e4" rel="1.42"/>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1617192000">- Initial version from git 1.1~git20200616.5efe7e4</changelog>
</package>
<package pkgid="85686d8ac97e14a68c6d44f44feebc825eac639e5990c3363320ae4d4443e15f85da0e30195d14424fa9388742be32b8417e61f6b3e15ad1d1523a70054110fc" name="eltt2-debuginfo" arch="s390x">
  <version epoch="0" ver="1.1~git20200616.5efe7e4" rel="1.42"/>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1617192000">- Initial version from git 1.1~git20200616.5efe7e4</changelog>
</package>
<package pkgid="3df2facb68d200b71f690e709b55577c217465fafd951d40022b4620250e8ecf7917ea92283a84364508dbdbd7b3b15d05b2eca1e79428fab17eb0e7b0d45c17" name="eltt2-debugsource" arch="s390x">
  <version epoch="0" ver="1.1~git20200616.5efe7e4" rel="1.42"/>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1617192000">- Initial version from git 1.1~git20200616.5efe7e4</changelog>
</package>
<package pkgid="04f8c7618915c56eef7072c9b0b95d156701cf34e5aaf1895c2dbb9a4dddd7d841f30c18566c9c7ad7b03c07d7d68f1772c1f2adad69572468e4f648fa53e1d4" name="encfs" arch="s390x">
  <version epoch="0" ver="1.9.5" rel="73.13"/>
  <changelog author="p.drouand@gmail.com" date="1457524800">- Update to version 1.8.1
  * No short chanlog available; please read
    /usr/share/doc/packages/encfs/ChangeLog</changelog>
  <changelog author="adam.majer@suse.de" date="1485950400">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1488628800">- update to 1.9.1
  * Fix empty log file creation
  * Link with libintl when available
  * add LIB_INSTALL_DIR override during build to aid in customized install
    locations
  * upgrade easylogging++
- update to 1.9
  * switch to CMake
  * OSX build improvements, RPATH setup
  * Drop Boost dependency. Uses tinyxml2 to read existing XML config archives.
  * Drop librlog dependency. Uses easylogging++ for logging.
  * add encfs_create operation
  * replace getdir with readdir
  * cleanup includes and reformat code
  * allow writes in reverse mode when no header is used
  * make use of C++11 (eg std unordered_map in place of GNU internal hashmap)
- split *.mo files to a separate package encfs-lang
- preperation to include checks
- removed cmake-libdir-name.patch and old-perm-checks.patch which are not
  needed any more
- install tinyxml2-3 if not available in the official repos
- configure-fix.patch: also not needed anymore</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1492948800">- patch 0001-Use-INITIALIZE_EASYLOGGINGPP-in-Error.cpp.patch fixes
  some undefined references. See upstream issue
  https://github.com/vgough/encfs/issues/291
  With this patch, the %cmake macro can now be used for building if
  version of cmake is greater than 3.3
- improved detection of tinyxml: now builds on more architectures
  and SLE12 SP2</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1501070400">- update to 1.9.2
  * fix a use-after-free bug that was introduced in v1.9-rc1
  * cast booleans to int before writing the XML config
  * support reading the config file from pipes
  * add "-t" option to set syslog tag
  * allow read/write in standard reverse mode
  * reject empty passwords
  * support building with openssl 1.1
- removed now unneeded 0001-Use-INITIALIZE_EASYLOGGINGPP-in-Error.cpp.patch</changelog>
  <changelog author="fvogt@suse.com" date="1516190400">- Fix combination of os_has_tinyxml and use_cmake_macro</changelog>
  <changelog author="Markus Ebner&lt;info@ebner-markus.de&gt;" date="1583496000">- update to 1.9.5
  * Correct a int/off_t buffer overflow in getSize()
  * Correct a possible write crash
  * Correct encfsctl cat and add encfsctl --reverse cat
  * Add -c &amp; -u cmdline options
  * Add --noattrcache &amp; --nodatacache cmdline options
  * Ignore .encfs6.xml file in reverse mode
  * Do not count usage on root path (to avoid resetting the --idle option)
  * Use stderr instead of stdout for error messages
  * Add the ability to disable data encryption (absolutely discouraged)
  * Add Cygwin support
- update to 1.9.4
  * Fix packaging error leading to wrong version output
  * Fix shared lib compilation (cmake -DBUILD_SHARED_LIBS=ON ..)
- update to 1.9.3
  * Fix compilation with "-std=c++11"
  * Fix a gid permission issue with allow_other
  * Fix operations on symlinks
  * Fix a race in idle unmount
  * Add --reversewrite cli option
  * Add PID to syslog logging
  * Deep code sanity check
  * Modernize coding style
  * Make codebase warnings &amp; clang-tidy clean
  * Bump FUSE_USE_VERSION to 29
  * Ensure compatibility with LibreSSL
  * Switch to vendored lib tinyxml2 &amp; easylogging
  * Reorganize man page and add missing options
  * Add gtest and micro benchmarks</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1585051200">- Disable RPATH for building</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1745582400">- fix build and simplify spec file
- use system easylogging</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747051200">- add README.openSUSE for boo#1221085, boo#1243036</changelog>
</package>
<package pkgid="923d242e25be4977b3511820790bb8d3450558c49507418e19d10506c7e09f6a593e3aa749b0fb4c2d82b73aadf429ba8f125480d3efc9d8cf5e90db62e356e2" name="encfs" arch="src">
  <version epoch="0" ver="1.9.5" rel="73.13"/>
  <changelog author="mszeredi@suse.cz" date="1277726400">- updated to version 1.6.0
  * build fixes
  * add support for version field within serialized config
  * add options to help automate filesystem creation
  * modification and access times can be changed for symlinks
  * try to maintain modtime during rename</changelog>
  <changelog author="mszeredi@suse.cz" date="1283774400">- updated to version 1.7.2
  * allow per-block random bytes to be configured independently of
    per-block MAC.
  * new IV initialization
  * fix component configuration to ease adding flags or config</changelog>
  <changelog author="mszeredi@suse.cz" date="1291377600">- updated to version 1.7.4
  * fixes bug with --reverse option setting which causes files to
    be stored incorrectly</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1314705600">- Fix build, axing all m4 macros was a bad idea...</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant/obsolete tags/sections from specfile
  (cf. packaging guidelines)</changelog>
  <changelog author="coolo@suse.com" date="1317384000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="coolo@suse.com" date="1359979200">- update license to new format</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1396353600">- applied patchencfs-1.7.4-fixReverseAbsoluteSymlinks.diff from
  https://code.google.com/p/encfs/issues/detail?id=29
  This fixes encoding of symlinks starting with a "/"
- Added patches:
  * encfs-1.7.4-fixReverseAbsoluteSymlinks.diff</changelog>
  <changelog author="Led &lt;ledest@gmail.com&gt;" date="1416225600">- fix bashism in encfssh script
- add patches:
  * encfs-1.7.4-fix-bashisms.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1426420800">- Update to version 1.8
  * No short chanlog available; please read the ChangeLog file into
    /usr/share/doc/packages/encfs/ChangeLog
- Update Url to new project home
- Use download Url as source
- Copy DESIGN.md, PERFORMANCE.mde and TRANSLATORS into doc directory
- Remove obsolete patchs
  * encfs-1.7.4-fixReverseAbsoluteSymlinks.diff
  * encfs-1.7.4-fix-bashisms.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1457524800">- Update to version 1.8.1
  * No short chanlog available; please read
    /usr/share/doc/packages/encfs/ChangeLog</changelog>
  <changelog author="adam.majer@suse.de" date="1485950400">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1488628800">- update to 1.9.1
  * Fix empty log file creation
  * Link with libintl when available
  * add LIB_INSTALL_DIR override during build to aid in customized install
    locations
  * upgrade easylogging++
- update to 1.9
  * switch to CMake
  * OSX build improvements, RPATH setup
  * Drop Boost dependency. Uses tinyxml2 to read existing XML config archives.
  * Drop librlog dependency. Uses easylogging++ for logging.
  * add encfs_create operation
  * replace getdir with readdir
  * cleanup includes and reformat code
  * allow writes in reverse mode when no header is used
  * make use of C++11 (eg std unordered_map in place of GNU internal hashmap)
- split *.mo files to a separate package encfs-lang
- preperation to include checks
- removed cmake-libdir-name.patch and old-perm-checks.patch which are not
  needed any more
- install tinyxml2-3 if not available in the official repos
- configure-fix.patch: also not needed anymore</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1492948800">- patch 0001-Use-INITIALIZE_EASYLOGGINGPP-in-Error.cpp.patch fixes
  some undefined references. See upstream issue
  https://github.com/vgough/encfs/issues/291
  With this patch, the %cmake macro can now be used for building if
  version of cmake is greater than 3.3
- improved detection of tinyxml: now builds on more architectures
  and SLE12 SP2</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1501070400">- update to 1.9.2
  * fix a use-after-free bug that was introduced in v1.9-rc1
  * cast booleans to int before writing the XML config
  * support reading the config file from pipes
  * add "-t" option to set syslog tag
  * allow read/write in standard reverse mode
  * reject empty passwords
  * support building with openssl 1.1
- removed now unneeded 0001-Use-INITIALIZE_EASYLOGGINGPP-in-Error.cpp.patch</changelog>
  <changelog author="fvogt@suse.com" date="1516190400">- Fix combination of os_has_tinyxml and use_cmake_macro</changelog>
  <changelog author="Markus Ebner&lt;info@ebner-markus.de&gt;" date="1583496000">- update to 1.9.5
  * Correct a int/off_t buffer overflow in getSize()
  * Correct a possible write crash
  * Correct encfsctl cat and add encfsctl --reverse cat
  * Add -c &amp; -u cmdline options
  * Add --noattrcache &amp; --nodatacache cmdline options
  * Ignore .encfs6.xml file in reverse mode
  * Do not count usage on root path (to avoid resetting the --idle option)
  * Use stderr instead of stdout for error messages
  * Add the ability to disable data encryption (absolutely discouraged)
  * Add Cygwin support
- update to 1.9.4
  * Fix packaging error leading to wrong version output
  * Fix shared lib compilation (cmake -DBUILD_SHARED_LIBS=ON ..)
- update to 1.9.3
  * Fix compilation with "-std=c++11"
  * Fix a gid permission issue with allow_other
  * Fix operations on symlinks
  * Fix a race in idle unmount
  * Add --reversewrite cli option
  * Add PID to syslog logging
  * Deep code sanity check
  * Modernize coding style
  * Make codebase warnings &amp; clang-tidy clean
  * Bump FUSE_USE_VERSION to 29
  * Ensure compatibility with LibreSSL
  * Switch to vendored lib tinyxml2 &amp; easylogging
  * Reorganize man page and add missing options
  * Add gtest and micro benchmarks</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1585051200">- Disable RPATH for building</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1745582400">- fix build and simplify spec file
- use system easylogging</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747051200">- add README.openSUSE for boo#1221085, boo#1243036</changelog>
</package>
<package pkgid="41b45b29f1e6ad2ce20dac534405820a195edc8f96683a5952bf2d070a60d1d1501b11067ba2b5db0eb2b3df1b938f362b1d7fb8d518562fb7e85dba6c225248" name="encfs-debuginfo" arch="s390x">
  <version epoch="0" ver="1.9.5" rel="73.13"/>
  <changelog author="p.drouand@gmail.com" date="1457524800">- Update to version 1.8.1
  * No short chanlog available; please read
    /usr/share/doc/packages/encfs/ChangeLog</changelog>
  <changelog author="adam.majer@suse.de" date="1485950400">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1488628800">- update to 1.9.1
  * Fix empty log file creation
  * Link with libintl when available
  * add LIB_INSTALL_DIR override during build to aid in customized install
    locations
  * upgrade easylogging++
- update to 1.9
  * switch to CMake
  * OSX build improvements, RPATH setup
  * Drop Boost dependency. Uses tinyxml2 to read existing XML config archives.
  * Drop librlog dependency. Uses easylogging++ for logging.
  * add encfs_create operation
  * replace getdir with readdir
  * cleanup includes and reformat code
  * allow writes in reverse mode when no header is used
  * make use of C++11 (eg std unordered_map in place of GNU internal hashmap)
- split *.mo files to a separate package encfs-lang
- preperation to include checks
- removed cmake-libdir-name.patch and old-perm-checks.patch which are not
  needed any more
- install tinyxml2-3 if not available in the official repos
- configure-fix.patch: also not needed anymore</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1492948800">- patch 0001-Use-INITIALIZE_EASYLOGGINGPP-in-Error.cpp.patch fixes
  some undefined references. See upstream issue
  https://github.com/vgough/encfs/issues/291
  With this patch, the %cmake macro can now be used for building if
  version of cmake is greater than 3.3
- improved detection of tinyxml: now builds on more architectures
  and SLE12 SP2</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1501070400">- update to 1.9.2
  * fix a use-after-free bug that was introduced in v1.9-rc1
  * cast booleans to int before writing the XML config
  * support reading the config file from pipes
  * add "-t" option to set syslog tag
  * allow read/write in standard reverse mode
  * reject empty passwords
  * support building with openssl 1.1
- removed now unneeded 0001-Use-INITIALIZE_EASYLOGGINGPP-in-Error.cpp.patch</changelog>
  <changelog author="fvogt@suse.com" date="1516190400">- Fix combination of os_has_tinyxml and use_cmake_macro</changelog>
  <changelog author="Markus Ebner&lt;info@ebner-markus.de&gt;" date="1583496000">- update to 1.9.5
  * Correct a int/off_t buffer overflow in getSize()
  * Correct a possible write crash
  * Correct encfsctl cat and add encfsctl --reverse cat
  * Add -c &amp; -u cmdline options
  * Add --noattrcache &amp; --nodatacache cmdline options
  * Ignore .encfs6.xml file in reverse mode
  * Do not count usage on root path (to avoid resetting the --idle option)
  * Use stderr instead of stdout for error messages
  * Add the ability to disable data encryption (absolutely discouraged)
  * Add Cygwin support
- update to 1.9.4
  * Fix packaging error leading to wrong version output
  * Fix shared lib compilation (cmake -DBUILD_SHARED_LIBS=ON ..)
- update to 1.9.3
  * Fix compilation with "-std=c++11"
  * Fix a gid permission issue with allow_other
  * Fix operations on symlinks
  * Fix a race in idle unmount
  * Add --reversewrite cli option
  * Add PID to syslog logging
  * Deep code sanity check
  * Modernize coding style
  * Make codebase warnings &amp; clang-tidy clean
  * Bump FUSE_USE_VERSION to 29
  * Ensure compatibility with LibreSSL
  * Switch to vendored lib tinyxml2 &amp; easylogging
  * Reorganize man page and add missing options
  * Add gtest and micro benchmarks</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1585051200">- Disable RPATH for building</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1745582400">- fix build and simplify spec file
- use system easylogging</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747051200">- add README.openSUSE for boo#1221085, boo#1243036</changelog>
</package>
<package pkgid="def1b2b63c2d18a96dd5cf25bd50d6dd4d12e30f74acd8a6839cfa0b046144050536d9323800fee38d549c174d751bd8eb8872bbfc3744a0860feca7c2b5b1b4" name="encfs-debugsource" arch="s390x">
  <version epoch="0" ver="1.9.5" rel="73.13"/>
  <changelog author="p.drouand@gmail.com" date="1457524800">- Update to version 1.8.1
  * No short chanlog available; please read
    /usr/share/doc/packages/encfs/ChangeLog</changelog>
  <changelog author="adam.majer@suse.de" date="1485950400">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1488628800">- update to 1.9.1
  * Fix empty log file creation
  * Link with libintl when available
  * add LIB_INSTALL_DIR override during build to aid in customized install
    locations
  * upgrade easylogging++
- update to 1.9
  * switch to CMake
  * OSX build improvements, RPATH setup
  * Drop Boost dependency. Uses tinyxml2 to read existing XML config archives.
  * Drop librlog dependency. Uses easylogging++ for logging.
  * add encfs_create operation
  * replace getdir with readdir
  * cleanup includes and reformat code
  * allow writes in reverse mode when no header is used
  * make use of C++11 (eg std unordered_map in place of GNU internal hashmap)
- split *.mo files to a separate package encfs-lang
- preperation to include checks
- removed cmake-libdir-name.patch and old-perm-checks.patch which are not
  needed any more
- install tinyxml2-3 if not available in the official repos
- configure-fix.patch: also not needed anymore</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1492948800">- patch 0001-Use-INITIALIZE_EASYLOGGINGPP-in-Error.cpp.patch fixes
  some undefined references. See upstream issue
  https://github.com/vgough/encfs/issues/291
  With this patch, the %cmake macro can now be used for building if
  version of cmake is greater than 3.3
- improved detection of tinyxml: now builds on more architectures
  and SLE12 SP2</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1501070400">- update to 1.9.2
  * fix a use-after-free bug that was introduced in v1.9-rc1
  * cast booleans to int before writing the XML config
  * support reading the config file from pipes
  * add "-t" option to set syslog tag
  * allow read/write in standard reverse mode
  * reject empty passwords
  * support building with openssl 1.1
- removed now unneeded 0001-Use-INITIALIZE_EASYLOGGINGPP-in-Error.cpp.patch</changelog>
  <changelog author="fvogt@suse.com" date="1516190400">- Fix combination of os_has_tinyxml and use_cmake_macro</changelog>
  <changelog author="Markus Ebner&lt;info@ebner-markus.de&gt;" date="1583496000">- update to 1.9.5
  * Correct a int/off_t buffer overflow in getSize()
  * Correct a possible write crash
  * Correct encfsctl cat and add encfsctl --reverse cat
  * Add -c &amp; -u cmdline options
  * Add --noattrcache &amp; --nodatacache cmdline options
  * Ignore .encfs6.xml file in reverse mode
  * Do not count usage on root path (to avoid resetting the --idle option)
  * Use stderr instead of stdout for error messages
  * Add the ability to disable data encryption (absolutely discouraged)
  * Add Cygwin support
- update to 1.9.4
  * Fix packaging error leading to wrong version output
  * Fix shared lib compilation (cmake -DBUILD_SHARED_LIBS=ON ..)
- update to 1.9.3
  * Fix compilation with "-std=c++11"
  * Fix a gid permission issue with allow_other
  * Fix operations on symlinks
  * Fix a race in idle unmount
  * Add --reversewrite cli option
  * Add PID to syslog logging
  * Deep code sanity check
  * Modernize coding style
  * Make codebase warnings &amp; clang-tidy clean
  * Bump FUSE_USE_VERSION to 29
  * Ensure compatibility with LibreSSL
  * Switch to vendored lib tinyxml2 &amp; easylogging
  * Reorganize man page and add missing options
  * Add gtest and micro benchmarks</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1585051200">- Disable RPATH for building</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1745582400">- fix build and simplify spec file
- use system easylogging</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747051200">- add README.openSUSE for boo#1221085, boo#1243036</changelog>
</package>
<package pkgid="f4e4d6e2746f4eaa72aa42587edc1a45bb46d218da05707c0f6635be61dd59dad688812cf029f7910d6df88082d8116d34c6f3e76659041b8de80e3704d25c06" name="encfs-lang" arch="noarch">
  <version epoch="0" ver="1.9.5" rel="73.13"/>
  <changelog author="p.drouand@gmail.com" date="1457524800">- Update to version 1.8.1
  * No short chanlog available; please read
    /usr/share/doc/packages/encfs/ChangeLog</changelog>
  <changelog author="adam.majer@suse.de" date="1485950400">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1488628800">- update to 1.9.1
  * Fix empty log file creation
  * Link with libintl when available
  * add LIB_INSTALL_DIR override during build to aid in customized install
    locations
  * upgrade easylogging++
- update to 1.9
  * switch to CMake
  * OSX build improvements, RPATH setup
  * Drop Boost dependency. Uses tinyxml2 to read existing XML config archives.
  * Drop librlog dependency. Uses easylogging++ for logging.
  * add encfs_create operation
  * replace getdir with readdir
  * cleanup includes and reformat code
  * allow writes in reverse mode when no header is used
  * make use of C++11 (eg std unordered_map in place of GNU internal hashmap)
- split *.mo files to a separate package encfs-lang
- preperation to include checks
- removed cmake-libdir-name.patch and old-perm-checks.patch which are not
  needed any more
- install tinyxml2-3 if not available in the official repos
- configure-fix.patch: also not needed anymore</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1492948800">- patch 0001-Use-INITIALIZE_EASYLOGGINGPP-in-Error.cpp.patch fixes
  some undefined references. See upstream issue
  https://github.com/vgough/encfs/issues/291
  With this patch, the %cmake macro can now be used for building if
  version of cmake is greater than 3.3
- improved detection of tinyxml: now builds on more architectures
  and SLE12 SP2</changelog>
  <changelog author="wagner-thomas@gmx.at" date="1501070400">- update to 1.9.2
  * fix a use-after-free bug that was introduced in v1.9-rc1
  * cast booleans to int before writing the XML config
  * support reading the config file from pipes
  * add "-t" option to set syslog tag
  * allow read/write in standard reverse mode
  * reject empty passwords
  * support building with openssl 1.1
- removed now unneeded 0001-Use-INITIALIZE_EASYLOGGINGPP-in-Error.cpp.patch</changelog>
  <changelog author="fvogt@suse.com" date="1516190400">- Fix combination of os_has_tinyxml and use_cmake_macro</changelog>
  <changelog author="Markus Ebner&lt;info@ebner-markus.de&gt;" date="1583496000">- update to 1.9.5
  * Correct a int/off_t buffer overflow in getSize()
  * Correct a possible write crash
  * Correct encfsctl cat and add encfsctl --reverse cat
  * Add -c &amp; -u cmdline options
  * Add --noattrcache &amp; --nodatacache cmdline options
  * Ignore .encfs6.xml file in reverse mode
  * Do not count usage on root path (to avoid resetting the --idle option)
  * Use stderr instead of stdout for error messages
  * Add the ability to disable data encryption (absolutely discouraged)
  * Add Cygwin support
- update to 1.9.4
  * Fix packaging error leading to wrong version output
  * Fix shared lib compilation (cmake -DBUILD_SHARED_LIBS=ON ..)
- update to 1.9.3
  * Fix compilation with "-std=c++11"
  * Fix a gid permission issue with allow_other
  * Fix operations on symlinks
  * Fix a race in idle unmount
  * Add --reversewrite cli option
  * Add PID to syslog logging
  * Deep code sanity check
  * Modernize coding style
  * Make codebase warnings &amp; clang-tidy clean
  * Bump FUSE_USE_VERSION to 29
  * Ensure compatibility with LibreSSL
  * Switch to vendored lib tinyxml2 &amp; easylogging
  * Reorganize man page and add missing options
  * Add gtest and micro benchmarks</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1585051200">- Disable RPATH for building</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1745582400">- fix build and simplify spec file
- use system easylogging</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1747051200">- add README.openSUSE for boo#1221085, boo#1243036</changelog>
</package>
<package pkgid="cb50237390bd4b7aed1dd8b6c5d65df9d2c2c71f064a671eaa71982b7f6cda7a4e5340b49b43e41e90d79f1f44702f5e4e364ebab56617cefff3bb38a5ecfd0e" name="etherape" arch="s390x">
  <version epoch="0" ver="0.9.22" rel="64.5"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1561982400">- Update to version 0.9.18:
  * EtherApe now is a pure GTK 3 application.
- Changes from version 0.9.17:
  * Replaced gnome-canvas with canvas supplied by GooCanvas.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1595332800">- Update to version 0.9.19.
  * Better sizing of connections lines.
  * Fix for UI crash by "MandatoryField".
  * Fix a crash happening when the capture process wasn't able to set the filter.
  * Russian translation and fixes.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1614686400">- replaced goocanvas-devel by pkgconfig(goocanvas-2.0) to use the right
  goocanvas.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1643198400">- Update to version 0.9.20:
  - fix for ticket #100, thanks to Salam for reporting it.
  - diagram refresh command, thanks to Ronald W. Henderson
  - patch to remove artifact when resizing, thanks to Ronald W. Henderson
  - reorder keyboard shortcuts, thanks to Ronald W. Henderson
  - sort by port on protocol windows, thanks to Ronald W. Henderson
  - xml output now containes also link and global protocols statistics.
  - link fades with averaging times
  - node-link ratio slider removed, ratio always fixed at 1 (links sizes
    are aligned with nodes)
  - improve statistics repeatability esp. when setting max-delay=0 (useful
    for tests or just to calculate quickly statistics of a dump file).
  - new no-display mode (command line only), disables diagram updates
    (again, mostly for testing).
  - merged link protocol and traffic timeouts.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1651147200">- fix homepage url
- spec-cleaner</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1669982400">- Add additional desktopfile for root.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="pgajdos@suse.com" date="1751976000">- added patches
  https://sourceforge.net/p/etherape/bugs/112/
  + etherape-gcc15.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1759406400">- Update to version 0.9.21:
  + GooCanvas was unsupported and getting really old, replaced by
    GtkDrawingArea.
  + --final-export is primarily meant to be used from other tools
    as a way to get statistics data from a replay.
  + Compatibility Warnings:
  - removed GooCanvas dependency, drawing now done with plain Gtk
  - new behavior for --final-export: exit after saving the XML dump
  + Changes summary:
    + Fix for gcc 15
    + Assorted refactorings and small modernizations, including
    autotools
  + Updated translations
- Drop etherape-gcc15.patch: fixed upstream
- Do not recommend the -lang package: lang packages already have
  more complex supplements, that trigger on zypper addlocale
- Drop pkgconfig(goocanvas-2.0) BuildRequires: no longer needed</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1776168000">- Update to version 0.9.22:
  - cleanups of capture code
  - clear address cache command, thanks to Ronald W. Henderson.
  - avoid multiple close event, by Ronald W. Henderson.
  - saving window size in preferences dialog, by Ronald W. Henderson.
  - F11 to make EtherApe fullscreen, by Ronald W. Henderson.
  - new georgian translation, thanks to Temuri Doghonadze.
  - documentation improvments, thanks to Ronald W. Henderson.
  - IP unknown protocols display now subject to the 'unknown ports' setting.
  - Smaller improvements and fixes.
  - One can now export Etherape data to JSON as well as XML.
  - Export file format is selected in the Preferences dialog.
  - Export menu entry icon added.
  - Updated Preferences dialog help and figures.
  - Man page updates.
  - XML escaping extended.
  - Fix for text appearance in these pull downs: Central Node and Capture filter.
  - Fix for avoiding adding duplicate legend widgets. Now using a hash table.
  - capture statistics now displayed on one line.
  - Better nodes and links expiration during low capture rates or for strict capture filters.
  - Fix for displaying a node prior to its position calculation.</changelog>
</package>
<package pkgid="5e40aea84dca1195a11fda20dd7f0ac2f38f67a275f9ecd03907613a559f8a33d7dd8c79578244d95f138d716f0cabba2c817e3bc434013f7305512288f5dbba" name="etherape" arch="src">
  <version epoch="0" ver="0.9.22" rel="64.5"/>
  <changelog author="meissner@suse.de" date="1297080000">- updated to 0.9.10
  * IPV6 support, thanks to David Flamand.
  * new statistic: average packet size.
  * added option --min-delay, to complement --max-delay when
    replaying from file. With this option you can replay a capture
    in slow-motion.
  * tweaked default service file, adding some common ports.
  * added check for invalid proto-color mappings (debian bug 566226).
  * removed bogus double assignement. Thanks to "johndoe123321".</changelog>
  <changelog author="meissner@suse.de" date="1297166400">- removed unnecessary patch</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant/obsolete tags/sections from specfile
  (cf. packaging guidelines)</changelog>
  <changelog author="meissner@suse.de" date="1316433600">- updated to 0.9.12
  * fixed a RPC remote denial of service
- updated to 0.9.11
  * EtherApe now can save a snapshot with all known nodes and relevant
    informations to an XML file. With option --final-export, a dump is
    automatically generated when a capture file is fully replayed.
    Additionally, option --signal-export enables SIGUSR1 handling, to
    dump on signal.
  * EtherApe used to have two links for connection, one for each traffic
    direction. With this release, only one link is needed, gaining more
    complete statistics and better resource usage.
  * EtherApe config file is now ~/.config/etherape, instead of the older,
    deprecated, ~/.gnome2/Etherape. Migration is automatic.
    Filter expression is now saved.
  * The old, deprecated, direct resolver was removed. Name resolution is now
    only done with the full fledged threaded resolver.</changelog>
  <changelog author="zaitor@opensuse.org" date="1380456000">- Add scrollkeeper BuildRequires, needed now due to changes made in
  gnome-doc-utils-devel.</changelog>
  <changelog author="meissner@suse.com" date="1387368000">- updated to 0.9.13
  Central node option, useful for displaying routers or proxies.
  Translations and documentation updates, plus some fixes.
  Changes summary:
  * Optional central node, based on work of Javier Fernandez-Sanguino Peña.
  * re-enabled full-screen mode, thanks to nrvale0
  * Updated spanish translation, thanks to Javier Fernandez-Sanguino Peña.
  * Added German translation, and fixed typos, thanks to Chris Leick.
  * Updated documentation.</changelog>
  <changelog author="dimstar@opensuse.org" date="1388059200">- Own %{_datadir}/omf: we don't want to rely on scrollkeeper (or
  rarian-scrollkeeper-compat) being installed and owning the
  directory. And as such, we have to declare ownership (so that it
  gets correctly removed on uninstall, if nothing relies on it
  anymore).</changelog>
  <changelog author="mpluskal@suse.com" date="1488715200">- Update to version 0.9.15 (boo#1028009):
  * fixed incorrect WLAN control frames decoding
  * fix UTF-8 encoding of several files, thanks to StrPt.
  * read system services file instead of EtherApe one, thanks to
    Zev Weiss.
  * fix race condition on exit, thanks to Zev Weiss
  * central ring option, thanks to Zev Weiss
  * tweaks to preference windows to better work with tiling
    managers, thanks to Zev Weiss.
  * static background image (Glenn Feunteun)
  * arrange nodes in 'columns' (David Goldfarb)
- Changes for version 0.9.14:
  * fixed incorrect WLAN control frames decoding
  * fix UTF-8 encoding of several files, thanks to StrPt.
  * read system services file instead of EtherApe one, thanks to
    Zev Weiss.
  * fix race condition on exit, thanks to Zev Weiss
  * central ring option, thanks to Zev Weiss
  * tweaks to preference windows to better work with tiling
    managers, thanks to Zev Weiss.
  * static background image (Glenn Feunteun)
  * arrange nodes in 'columns' (David Goldfarb)
- Packaging changes:
  * Run spec-cleaner
  * Add desktop file scriplets and corresponding dependencies
  * Split lang subpackage</changelog>
  <changelog author="jengelh@inai.de" date="1490270400">- Remove --with-pic, this is only for static libs
  (and there are _none at all_).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1526644800">- Update to version 0.9.17:
  * EtherApe now requires Gtk 2.24.
  * Fixed a bug making libglade load gnome2 libraries.
  * Sometimes node/links windows were freezing.
- Changes from version 0.9.16:
  * Require only gnome-canvas, not gnome-ui.
  * Migrate from deprecated gnome-doc-utils to yelp-tools.
  * Updated translations.
- Following upstream changes:
  * Drop scrollkeeper, pkgconfig(gnome-doc-utils) and
    pkgconfig(libgnomeui-2.0) BuildRequires.
  * Add yelp-tools, pkgconfig(glib-2.0), pkgconfig(popt) and
    pkgconfig(libgnomecanvas-2.0) BuildRequires.
  * Drop usage of sed to fix doc/C/etherape.xml, file no longer
    exists.
  * No longer pass --disable-scrollkeeper to configure, not needed.
- Rebase etherape-0.9.12-desktop.patch.
- Add conditional for desktop_database_post(un) post(un) handling,
  no longer needed on modern releases of openSUSE.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1561982400">- Update to version 0.9.18:
  * EtherApe now is a pure GTK 3 application.
- Changes from version 0.9.17:
  * Replaced gnome-canvas with canvas supplied by GooCanvas.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1595332800">- Update to version 0.9.19.
  * Better sizing of connections lines.
  * Fix for UI crash by "MandatoryField".
  * Fix a crash happening when the capture process wasn't able to set the filter.
  * Russian translation and fixes.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1614686400">- replaced goocanvas-devel by pkgconfig(goocanvas-2.0) to use the right
  goocanvas.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1643198400">- Update to version 0.9.20:
  - fix for ticket #100, thanks to Salam for reporting it.
  - diagram refresh command, thanks to Ronald W. Henderson
  - patch to remove artifact when resizing, thanks to Ronald W. Henderson
  - reorder keyboard shortcuts, thanks to Ronald W. Henderson
  - sort by port on protocol windows, thanks to Ronald W. Henderson
  - xml output now containes also link and global protocols statistics.
  - link fades with averaging times
  - node-link ratio slider removed, ratio always fixed at 1 (links sizes
    are aligned with nodes)
  - improve statistics repeatability esp. when setting max-delay=0 (useful
    for tests or just to calculate quickly statistics of a dump file).
  - new no-display mode (command line only), disables diagram updates
    (again, mostly for testing).
  - merged link protocol and traffic timeouts.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1651147200">- fix homepage url
- spec-cleaner</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1669982400">- Add additional desktopfile for root.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="pgajdos@suse.com" date="1751976000">- added patches
  https://sourceforge.net/p/etherape/bugs/112/
  + etherape-gcc15.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1759406400">- Update to version 0.9.21:
  + GooCanvas was unsupported and getting really old, replaced by
    GtkDrawingArea.
  + --final-export is primarily meant to be used from other tools
    as a way to get statistics data from a replay.
  + Compatibility Warnings:
  - removed GooCanvas dependency, drawing now done with plain Gtk
  - new behavior for --final-export: exit after saving the XML dump
  + Changes summary:
    + Fix for gcc 15
    + Assorted refactorings and small modernizations, including
    autotools
  + Updated translations
- Drop etherape-gcc15.patch: fixed upstream
- Do not recommend the -lang package: lang packages already have
  more complex supplements, that trigger on zypper addlocale
- Drop pkgconfig(goocanvas-2.0) BuildRequires: no longer needed</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1776168000">- Update to version 0.9.22:
  - cleanups of capture code
  - clear address cache command, thanks to Ronald W. Henderson.
  - avoid multiple close event, by Ronald W. Henderson.
  - saving window size in preferences dialog, by Ronald W. Henderson.
  - F11 to make EtherApe fullscreen, by Ronald W. Henderson.
  - new georgian translation, thanks to Temuri Doghonadze.
  - documentation improvments, thanks to Ronald W. Henderson.
  - IP unknown protocols display now subject to the 'unknown ports' setting.
  - Smaller improvements and fixes.
  - One can now export Etherape data to JSON as well as XML.
  - Export file format is selected in the Preferences dialog.
  - Export menu entry icon added.
  - Updated Preferences dialog help and figures.
  - Man page updates.
  - XML escaping extended.
  - Fix for text appearance in these pull downs: Central Node and Capture filter.
  - Fix for avoiding adding duplicate legend widgets. Now using a hash table.
  - capture statistics now displayed on one line.
  - Better nodes and links expiration during low capture rates or for strict capture filters.
  - Fix for displaying a node prior to its position calculation.</changelog>
</package>
<package pkgid="74c722b1bdb532fa2b486177620f08d6aa1d23da126cf42cb7288c0f8537927a80f862e5627a8782cea4aa3c89f085defba5e8dda066c668b0ef662b4539ca43" name="etherape-debuginfo" arch="s390x">
  <version epoch="0" ver="0.9.22" rel="64.5"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1561982400">- Update to version 0.9.18:
  * EtherApe now is a pure GTK 3 application.
- Changes from version 0.9.17:
  * Replaced gnome-canvas with canvas supplied by GooCanvas.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1595332800">- Update to version 0.9.19.
  * Better sizing of connections lines.
  * Fix for UI crash by "MandatoryField".
  * Fix a crash happening when the capture process wasn't able to set the filter.
  * Russian translation and fixes.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1614686400">- replaced goocanvas-devel by pkgconfig(goocanvas-2.0) to use the right
  goocanvas.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1643198400">- Update to version 0.9.20:
  - fix for ticket #100, thanks to Salam for reporting it.
  - diagram refresh command, thanks to Ronald W. Henderson
  - patch to remove artifact when resizing, thanks to Ronald W. Henderson
  - reorder keyboard shortcuts, thanks to Ronald W. Henderson
  - sort by port on protocol windows, thanks to Ronald W. Henderson
  - xml output now containes also link and global protocols statistics.
  - link fades with averaging times
  - node-link ratio slider removed, ratio always fixed at 1 (links sizes
    are aligned with nodes)
  - improve statistics repeatability esp. when setting max-delay=0 (useful
    for tests or just to calculate quickly statistics of a dump file).
  - new no-display mode (command line only), disables diagram updates
    (again, mostly for testing).
  - merged link protocol and traffic timeouts.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1651147200">- fix homepage url
- spec-cleaner</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1669982400">- Add additional desktopfile for root.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="pgajdos@suse.com" date="1751976000">- added patches
  https://sourceforge.net/p/etherape/bugs/112/
  + etherape-gcc15.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1759406400">- Update to version 0.9.21:
  + GooCanvas was unsupported and getting really old, replaced by
    GtkDrawingArea.
  + --final-export is primarily meant to be used from other tools
    as a way to get statistics data from a replay.
  + Compatibility Warnings:
  - removed GooCanvas dependency, drawing now done with plain Gtk
  - new behavior for --final-export: exit after saving the XML dump
  + Changes summary:
    + Fix for gcc 15
    + Assorted refactorings and small modernizations, including
    autotools
  + Updated translations
- Drop etherape-gcc15.patch: fixed upstream
- Do not recommend the -lang package: lang packages already have
  more complex supplements, that trigger on zypper addlocale
- Drop pkgconfig(goocanvas-2.0) BuildRequires: no longer needed</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1776168000">- Update to version 0.9.22:
  - cleanups of capture code
  - clear address cache command, thanks to Ronald W. Henderson.
  - avoid multiple close event, by Ronald W. Henderson.
  - saving window size in preferences dialog, by Ronald W. Henderson.
  - F11 to make EtherApe fullscreen, by Ronald W. Henderson.
  - new georgian translation, thanks to Temuri Doghonadze.
  - documentation improvments, thanks to Ronald W. Henderson.
  - IP unknown protocols display now subject to the 'unknown ports' setting.
  - Smaller improvements and fixes.
  - One can now export Etherape data to JSON as well as XML.
  - Export file format is selected in the Preferences dialog.
  - Export menu entry icon added.
  - Updated Preferences dialog help and figures.
  - Man page updates.
  - XML escaping extended.
  - Fix for text appearance in these pull downs: Central Node and Capture filter.
  - Fix for avoiding adding duplicate legend widgets. Now using a hash table.
  - capture statistics now displayed on one line.
  - Better nodes and links expiration during low capture rates or for strict capture filters.
  - Fix for displaying a node prior to its position calculation.</changelog>
</package>
<package pkgid="0f2e2c8782f4f24baf5522306e25ed3bd558ae4119874496ab470849b8f059c4667e9fa7809ace5bc870991491123946e12760e369ab27cd4272048def611351" name="etherape-debugsource" arch="s390x">
  <version epoch="0" ver="0.9.22" rel="64.5"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1561982400">- Update to version 0.9.18:
  * EtherApe now is a pure GTK 3 application.
- Changes from version 0.9.17:
  * Replaced gnome-canvas with canvas supplied by GooCanvas.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1595332800">- Update to version 0.9.19.
  * Better sizing of connections lines.
  * Fix for UI crash by "MandatoryField".
  * Fix a crash happening when the capture process wasn't able to set the filter.
  * Russian translation and fixes.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1614686400">- replaced goocanvas-devel by pkgconfig(goocanvas-2.0) to use the right
  goocanvas.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1643198400">- Update to version 0.9.20:
  - fix for ticket #100, thanks to Salam for reporting it.
  - diagram refresh command, thanks to Ronald W. Henderson
  - patch to remove artifact when resizing, thanks to Ronald W. Henderson
  - reorder keyboard shortcuts, thanks to Ronald W. Henderson
  - sort by port on protocol windows, thanks to Ronald W. Henderson
  - xml output now containes also link and global protocols statistics.
  - link fades with averaging times
  - node-link ratio slider removed, ratio always fixed at 1 (links sizes
    are aligned with nodes)
  - improve statistics repeatability esp. when setting max-delay=0 (useful
    for tests or just to calculate quickly statistics of a dump file).
  - new no-display mode (command line only), disables diagram updates
    (again, mostly for testing).
  - merged link protocol and traffic timeouts.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1651147200">- fix homepage url
- spec-cleaner</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1669982400">- Add additional desktopfile for root.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="pgajdos@suse.com" date="1751976000">- added patches
  https://sourceforge.net/p/etherape/bugs/112/
  + etherape-gcc15.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1759406400">- Update to version 0.9.21:
  + GooCanvas was unsupported and getting really old, replaced by
    GtkDrawingArea.
  + --final-export is primarily meant to be used from other tools
    as a way to get statistics data from a replay.
  + Compatibility Warnings:
  - removed GooCanvas dependency, drawing now done with plain Gtk
  - new behavior for --final-export: exit after saving the XML dump
  + Changes summary:
    + Fix for gcc 15
    + Assorted refactorings and small modernizations, including
    autotools
  + Updated translations
- Drop etherape-gcc15.patch: fixed upstream
- Do not recommend the -lang package: lang packages already have
  more complex supplements, that trigger on zypper addlocale
- Drop pkgconfig(goocanvas-2.0) BuildRequires: no longer needed</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1776168000">- Update to version 0.9.22:
  - cleanups of capture code
  - clear address cache command, thanks to Ronald W. Henderson.
  - avoid multiple close event, by Ronald W. Henderson.
  - saving window size in preferences dialog, by Ronald W. Henderson.
  - F11 to make EtherApe fullscreen, by Ronald W. Henderson.
  - new georgian translation, thanks to Temuri Doghonadze.
  - documentation improvments, thanks to Ronald W. Henderson.
  - IP unknown protocols display now subject to the 'unknown ports' setting.
  - Smaller improvements and fixes.
  - One can now export Etherape data to JSON as well as XML.
  - Export file format is selected in the Preferences dialog.
  - Export menu entry icon added.
  - Updated Preferences dialog help and figures.
  - Man page updates.
  - XML escaping extended.
  - Fix for text appearance in these pull downs: Central Node and Capture filter.
  - Fix for avoiding adding duplicate legend widgets. Now using a hash table.
  - capture statistics now displayed on one line.
  - Better nodes and links expiration during low capture rates or for strict capture filters.
  - Fix for displaying a node prior to its position calculation.</changelog>
</package>
<package pkgid="b065b565d09076bb84e0c7ce776638480ea887246ebc630e8ef71254499bd44f24334e0b1d3f4cd3bdf4542eb3e2bb28048a658638847d9d5bca361c4b5dd401" name="etherape-lang" arch="noarch">
  <version epoch="0" ver="0.9.22" rel="64.5"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1561982400">- Update to version 0.9.18:
  * EtherApe now is a pure GTK 3 application.
- Changes from version 0.9.17:
  * Replaced gnome-canvas with canvas supplied by GooCanvas.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1595332800">- Update to version 0.9.19.
  * Better sizing of connections lines.
  * Fix for UI crash by "MandatoryField".
  * Fix a crash happening when the capture process wasn't able to set the filter.
  * Russian translation and fixes.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1614686400">- replaced goocanvas-devel by pkgconfig(goocanvas-2.0) to use the right
  goocanvas.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1643198400">- Update to version 0.9.20:
  - fix for ticket #100, thanks to Salam for reporting it.
  - diagram refresh command, thanks to Ronald W. Henderson
  - patch to remove artifact when resizing, thanks to Ronald W. Henderson
  - reorder keyboard shortcuts, thanks to Ronald W. Henderson
  - sort by port on protocol windows, thanks to Ronald W. Henderson
  - xml output now containes also link and global protocols statistics.
  - link fades with averaging times
  - node-link ratio slider removed, ratio always fixed at 1 (links sizes
    are aligned with nodes)
  - improve statistics repeatability esp. when setting max-delay=0 (useful
    for tests or just to calculate quickly statistics of a dump file).
  - new no-display mode (command line only), disables diagram updates
    (again, mostly for testing).
  - merged link protocol and traffic timeouts.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1651147200">- fix homepage url
- spec-cleaner</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1669982400">- Add additional desktopfile for root.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="pgajdos@suse.com" date="1751976000">- added patches
  https://sourceforge.net/p/etherape/bugs/112/
  + etherape-gcc15.patch</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1759406400">- Update to version 0.9.21:
  + GooCanvas was unsupported and getting really old, replaced by
    GtkDrawingArea.
  + --final-export is primarily meant to be used from other tools
    as a way to get statistics data from a replay.
  + Compatibility Warnings:
  - removed GooCanvas dependency, drawing now done with plain Gtk
  - new behavior for --final-export: exit after saving the XML dump
  + Changes summary:
    + Fix for gcc 15
    + Assorted refactorings and small modernizations, including
    autotools
  + Updated translations
- Drop etherape-gcc15.patch: fixed upstream
- Do not recommend the -lang package: lang packages already have
  more complex supplements, that trigger on zypper addlocale
- Drop pkgconfig(goocanvas-2.0) BuildRequires: no longer needed</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1776168000">- Update to version 0.9.22:
  - cleanups of capture code
  - clear address cache command, thanks to Ronald W. Henderson.
  - avoid multiple close event, by Ronald W. Henderson.
  - saving window size in preferences dialog, by Ronald W. Henderson.
  - F11 to make EtherApe fullscreen, by Ronald W. Henderson.
  - new georgian translation, thanks to Temuri Doghonadze.
  - documentation improvments, thanks to Ronald W. Henderson.
  - IP unknown protocols display now subject to the 'unknown ports' setting.
  - Smaller improvements and fixes.
  - One can now export Etherape data to JSON as well as XML.
  - Export file format is selected in the Preferences dialog.
  - Export menu entry icon added.
  - Updated Preferences dialog help and figures.
  - Man page updates.
  - XML escaping extended.
  - Fix for text appearance in these pull downs: Central Node and Capture filter.
  - Fix for avoiding adding duplicate legend widgets. Now using a hash table.
  - capture statistics now displayed on one line.
  - Better nodes and links expiration during low capture rates or for strict capture filters.
  - Fix for displaying a node prior to its position calculation.</changelog>
</package>
<package pkgid="66e3da2333b2cab5717439f437d8db2f4470b1b232a873ef54d3b0d33387fbd056c6390995775c853d2868f655687f3924ff54bb762e22895de3fbc7c66464fd" name="evmctl" arch="s390x">
  <version epoch="0" ver="1.6.2" rel="75.18"/>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1601553600">- Fix missing new line in help
  (0001-help-Add-missing-new-line-for-ignore-violations.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1603972800">- Update to version 1.3.2
  * Bugfixes: importing keys
  * NEW: Docker based travis distro testing
  * Travis bugfixes, code cleanup, software version update,
  and script removal
  * Initial travis testing
- Remove 0001-help-Add-missing-new-line-for-ignore-violations.patch
  (patch from this release)
- Add make check + dependencies (getfattr =&gt; attr, xxd =&gt; vim)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1636113600">- Update to version 1.4
  * Elliptic curve support and tests
  * PKCS11 support and tests
  * Ability to manually specify the keyid included in the IMA xattr
  * Improve IMA measurement list per TPM bank verification
  * Linking with IBM TSS
  * Set default hash algorithm in package configuration
  * (Minimal) support and test EVM portable signatures
  * CI testing:
  * Refresh and include new distros
  * Podman support
  * GitHub Actions
  * Limit "sudo" usage
  * Misc bug fixes and code cleanup
  * Fix static analysis bug reports, memory leaks
  * Remove experimental code that was never upstreamed in the kernel
  * Use unsigned variable, remove unused variables, etc
- Upstream bumped soname to 3.0.0</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- switch to use https urls</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1678449600">- Update to version 1.5
  * CI changes:
  * New: UML kernel testing environment
  * Support for running specific test(s)
  * Update distros
  * Update software release versions
  * New features:
  * Signing fs-verity signatures
  * Reading TPM 2.0 PCRs via sysfs interface
  * New tests:
  * Missing IMA mmapped file measurements
  * Overlapping IMA policy rules
  * EVM portable signatures
  * fs-verity file measurements in the IMA measurement list
  * Build and library changes:
  * OpenSSL 3.0 version related changes
  * New configuration options: --disable-engine, --enable-sigv1
  * Deprecate IMA signature v1 format
  * Misc bug fixes and code cleanup:
  * memory leaks, bounds checking, use after free
  * Fix and update test output
  * Add missing sanity checks
  * Documentation:
  * Store the sourceforge ima-evm-utils wiki for historical
  purposes.
- Upstream bumped soname to 4.0.0
- Add BuildRequires: e2fsprogs util-linux (required by tests, which are mandatory)
- /usr/sbin to PATH (0001-fsverity.test-Add-usr-sbin-into-PATH.patch, sent to upstream ML)</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1702641600">- Update download url.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720440000">- Update to version 1.6
  https://lore.kernel.org/linux-integrity/20240703164454.61614-1-zohar@linux.ibm.com/
- Upstream bumped soname to 5.0.0
- Upstream changed license to GPL-2.0-or-later (evmctl), LGPL-2.0-or-later
  (libimaevm + devel package), and GPL-2.0-or-later WITH Linux-syscall-note
  exception (both)
  https://github.com/linux-integrity/ima-evm-utils/issues/4
  (mention both GPL and LGPL and add specific license to subpackages)
- Remove patch from upstream (0001-fsverity.test-Add-usr-sbin-into-PATH.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720699200">- Add LicenseRef-GPL-2.0-with-openssl-exception to License: (upstream has not
  yet created appropriate exception in SPDX).</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720785600">- Update project source URL.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1725278400">- Update to version 1.6.2
  https://github.com/linux-integrity/ima-evm-utils/blob/v1.6.2/NEWS
- Remove LicenseRef-GPL-2.0-with-openssl-exception (no need due relicensing of
  OpenSSL 3 or later to the Apache 2 license
  https://github.com/linux-integrity/ima-evm-utils/commit/4a4c762c8e3cbbff5f41c682deb026d22440454d )
- Upstream added COPYING (again) and COPYING.LGPL (new), add them to %license.</changelog>
</package>
<package pkgid="c29b5dbec79acf3b92dcde12361fc1704972dc958342c6ec15c080da23f7e008d152c2655a4a0458d231ddf66c7263c967acbcdacb80a7245260083786947d0d" name="evmctl-debuginfo" arch="s390x">
  <version epoch="0" ver="1.6.2" rel="75.18"/>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1601553600">- Fix missing new line in help
  (0001-help-Add-missing-new-line-for-ignore-violations.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1603972800">- Update to version 1.3.2
  * Bugfixes: importing keys
  * NEW: Docker based travis distro testing
  * Travis bugfixes, code cleanup, software version update,
  and script removal
  * Initial travis testing
- Remove 0001-help-Add-missing-new-line-for-ignore-violations.patch
  (patch from this release)
- Add make check + dependencies (getfattr =&gt; attr, xxd =&gt; vim)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1636113600">- Update to version 1.4
  * Elliptic curve support and tests
  * PKCS11 support and tests
  * Ability to manually specify the keyid included in the IMA xattr
  * Improve IMA measurement list per TPM bank verification
  * Linking with IBM TSS
  * Set default hash algorithm in package configuration
  * (Minimal) support and test EVM portable signatures
  * CI testing:
  * Refresh and include new distros
  * Podman support
  * GitHub Actions
  * Limit "sudo" usage
  * Misc bug fixes and code cleanup
  * Fix static analysis bug reports, memory leaks
  * Remove experimental code that was never upstreamed in the kernel
  * Use unsigned variable, remove unused variables, etc
- Upstream bumped soname to 3.0.0</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- switch to use https urls</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1678449600">- Update to version 1.5
  * CI changes:
  * New: UML kernel testing environment
  * Support for running specific test(s)
  * Update distros
  * Update software release versions
  * New features:
  * Signing fs-verity signatures
  * Reading TPM 2.0 PCRs via sysfs interface
  * New tests:
  * Missing IMA mmapped file measurements
  * Overlapping IMA policy rules
  * EVM portable signatures
  * fs-verity file measurements in the IMA measurement list
  * Build and library changes:
  * OpenSSL 3.0 version related changes
  * New configuration options: --disable-engine, --enable-sigv1
  * Deprecate IMA signature v1 format
  * Misc bug fixes and code cleanup:
  * memory leaks, bounds checking, use after free
  * Fix and update test output
  * Add missing sanity checks
  * Documentation:
  * Store the sourceforge ima-evm-utils wiki for historical
  purposes.
- Upstream bumped soname to 4.0.0
- Add BuildRequires: e2fsprogs util-linux (required by tests, which are mandatory)
- /usr/sbin to PATH (0001-fsverity.test-Add-usr-sbin-into-PATH.patch, sent to upstream ML)</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1702641600">- Update download url.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720440000">- Update to version 1.6
  https://lore.kernel.org/linux-integrity/20240703164454.61614-1-zohar@linux.ibm.com/
- Upstream bumped soname to 5.0.0
- Upstream changed license to GPL-2.0-or-later (evmctl), LGPL-2.0-or-later
  (libimaevm + devel package), and GPL-2.0-or-later WITH Linux-syscall-note
  exception (both)
  https://github.com/linux-integrity/ima-evm-utils/issues/4
  (mention both GPL and LGPL and add specific license to subpackages)
- Remove patch from upstream (0001-fsverity.test-Add-usr-sbin-into-PATH.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720699200">- Add LicenseRef-GPL-2.0-with-openssl-exception to License: (upstream has not
  yet created appropriate exception in SPDX).</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720785600">- Update project source URL.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1725278400">- Update to version 1.6.2
  https://github.com/linux-integrity/ima-evm-utils/blob/v1.6.2/NEWS
- Remove LicenseRef-GPL-2.0-with-openssl-exception (no need due relicensing of
  OpenSSL 3 or later to the Apache 2 license
  https://github.com/linux-integrity/ima-evm-utils/commit/4a4c762c8e3cbbff5f41c682deb026d22440454d )
- Upstream added COPYING (again) and COPYING.LGPL (new), add them to %license.</changelog>
</package>
<package pkgid="176b5db29ac89ec938d44c447fb45ebabdfb97913b2cbc380f74d0370ebbffbc17fc610ce339c26e59aa43d80117fc57f850be1b36cbc0c2c57aa7de711013d8" name="extrace" arch="s390x">
  <version epoch="0" ver="0.9" rel="7.26"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1619611200">- Initial package (git master f02ef88edf617245cbd33813561b46ccadcabfb3)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1619611201">- Moved binaries to /usr/sbin.
- Renamed pwait to extrace-pwait to avoid conflicts with the procps package.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1620734400">- Fix build on SLE-15-SP1</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1675252800">- Update to version 0.9:
  * Add option -Q to suppress runtime errors
  * With -t, print time when process execed
  * Quit when parent specified in -p exits
  * Fix likely root cause for pid_db overflow</changelog>
</package>
<package pkgid="a8bda25a3becd4a65196b07f3153ed775771a9c6b8a9febb930068d875e5c119a0bfc62d33433876c04b8506158e68cea327286e0215bcc66611afec75cb0a1e" name="extrace" arch="src">
  <version epoch="0" ver="0.9" rel="7.26"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1619611200">- Initial package (git master f02ef88edf617245cbd33813561b46ccadcabfb3)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1619611201">- Moved binaries to /usr/sbin.
- Renamed pwait to extrace-pwait to avoid conflicts with the procps package.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1620734400">- Fix build on SLE-15-SP1</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1675252800">- Update to version 0.9:
  * Add option -Q to suppress runtime errors
  * With -t, print time when process execed
  * Quit when parent specified in -p exits
  * Fix likely root cause for pid_db overflow</changelog>
</package>
<package pkgid="bd9408ca67c3783f2761ed24b4b564e8c26b85efd9a19112625623d76a9b831c3a7d73585147143973da69d93d01dafe22baca7d2299549539b7dedddff04aa1" name="extrace-debuginfo" arch="s390x">
  <version epoch="0" ver="0.9" rel="7.26"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1619611200">- Initial package (git master f02ef88edf617245cbd33813561b46ccadcabfb3)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1619611201">- Moved binaries to /usr/sbin.
- Renamed pwait to extrace-pwait to avoid conflicts with the procps package.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1620734400">- Fix build on SLE-15-SP1</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1675252800">- Update to version 0.9:
  * Add option -Q to suppress runtime errors
  * With -t, print time when process execed
  * Quit when parent specified in -p exits
  * Fix likely root cause for pid_db overflow</changelog>
</package>
<package pkgid="8190b10f7f8f352008533ab9dd4a1c735b26f44ee111d609407270e0f61130eddd33e594174fdd42f363d6ca26156c423cb44d8a5286b54991f543aed468b661" name="extrace-debugsource" arch="s390x">
  <version epoch="0" ver="0.9" rel="7.26"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1619611200">- Initial package (git master f02ef88edf617245cbd33813561b46ccadcabfb3)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1619611201">- Moved binaries to /usr/sbin.
- Renamed pwait to extrace-pwait to avoid conflicts with the procps package.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1620734400">- Fix build on SLE-15-SP1</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1675252800">- Update to version 0.9:
  * Add option -Q to suppress runtime errors
  * With -t, print time when process execed
  * Quit when parent specified in -p exits
  * Fix likely root cause for pid_db overflow</changelog>
</package>
<package pkgid="30a4c0bbba8cb11eb2525d542e575394c688a55ec01f7b7002192892322b9972cdead2e967a2cda6e8511bd0e71843b7d0f7675d51cf68d93c0a13c0be796635" name="fail2ban" arch="s390x">
  <version epoch="0" ver="1.1.1" rel="168.1"/>
  <changelog author="Lars Vogdt &lt;lars@linux-schulserver.de&gt;" date="1685966400">- use nagios-rpm-macros to define the libexecdir for SUSE distributions
  correctly (defaut here is /usr/lib/nagios/plugins)
- move conditional for %%pre scripts, to avoid any dependency or other
  stuff getting in the way on old distributions</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1725451200">- fail2ban-fix-openssh98.patch: fix to work with openssh 9.8 (bsc#1230101)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729684800">- update to 1.1.0:
  * circumvent SEGFAULT in a python's socket module by
    getaddrinfo with disabled IPv6 (gh-3438)
  * avoid sporadic error in pyinotify backend if pending file
    deleted in other thread, e. g. by flushing logs (gh-3635)
  * `action.d/cloudflare-token.conf` - fixes gh-3479, url-encode
    args by unban
  * `action.d/*ipset*`: make `maxelem` ipset option configurable
    through banaction arguments (gh-3564)
  * `filter.d/apache-common.conf` - accepts remote besides client
    (gh-3622)
  * `filter.d/mysqld-auth.conf` - matches also if no suffix in
    message (mariadb 10.3 log format, gh-3603)
  * `filter.d/nginx-*.conf` - nginx error-log filters extended
    with support of journal format (gh-3646)
  * `filter.d/postfix.conf`:
  - "rejected" rule extended to match "Access denied" too
  - avoid double counting ('lost connection after AUTH'
    together with message 'disconnect ...', gh-3505)
  - add Sender address rejected: Malformed DNS server reply
  - add to postfix syslog daemon format (gh-3690)
  - change journalmatch postfix, allow sub-units with
    postfix@-.service (gh-3692)
  * `filter.d/recidive.conf`: support for systemd-journal,
    conditional RE depending on logtype (for file or journal,
    gh-3693)
  * `filter.d/slapd.conf` - filter rewritten for single-line
    processing, matches errored result without `text=...`
    (gh-3604)
  * supports python 3.12 and 3.13 (gh-3487)
  * bundling async modules removed in python 3.12+ (fallback to
    local libraries pyasyncore/pyasynchat if import would miss
    them, gh-3487)
  * `fail2ban-client` extended (gh-2975):
  - `fail2ban-client status --all [flavor]` - returns status
    of fail2ban and all jails in usual form
  - `fail2ban-client stats` - returns statistic in form of
    table (jail, backend, found and banned counts)
  - `fail2ban-client statistic` or `fail2ban-client
    statistics` - same as `fail2ban-client stats` (aliases for
    stats)
  - `fail2ban-client status --all stats` - (undocumented,
    flavor "stats") returns statistic of all jails in form of
    python dict
  * `fail2ban-regex` extended to load settings from jail (by
    simple name it'd prefer jail to the filter now, gh-2655);
- drop fail2ban-disable-iptables-w-option.patch: only needed for
  sle10 and older, which is no longer supported (is now python &gt;=
  3.5)</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1741608000">- Add BuildRequires on setuptools, required for Python 3.12+.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1743249600">- distutils (provided by python3-setuptools) is also needed during
  time, or f2b cannot launch the systemd log analyzer backend.
- Delete all pre-SUSE-15.x build instructions.
- Delete fail2ban-opensuse-service-sfw.patch,
  fail2ban-opensuse-service.patch, sfw-fail2ban.conf,
  since this mostly part of the pristine fail2ban.service.in
  already. (Unit modified in %install for SFW.)</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1749211200">- Add %python3_fix_shebang macro</changelog>
  <changelog author="Nathan Cutler &lt;ncutler@suse.com&gt;" date="1749556800">- spec:
  * Use pyproject macros to build and install (including
    implementing manual install for files under /etc and /usr from
    the wheel)
  * some BuildRequires cleanup</changelog>
  <changelog author="Nathan Cutler &lt;ncutler@suse.com&gt;" date="1749643200">- spec:
  * simplify manual installation of files under /etc and /usr from
    the wheel</changelog>
  <changelog author="Nathan Cutler &lt;ncutler@suse.com&gt;" date="1749816000">- Add setup-py-install-dir.patch:
  * fix unit file population broken by switch to %pyproject_wheel</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1750075200">- spec:
  * Drop noarch due to /usr/bin/fail2ban-python ELF
  * noarch for monitoring subpackage</changelog>
  <changelog author="chris@computersalat.de" date="1750334400">- fix build
  * service file install
- some rpmlint fixes
- Add fail2ban_service.patch
- rebase patches
  * fail2ban-0.10.4-env-script-interpreter.patch
  * fail2ban-fix-openssh98.patch
  * fail2ban-opensuse-locations.patch
  * harden_fail2ban.service.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1781870400">- Modernize specfile constructs
- Make build recipe compatible with POSIX sh</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1787054400">- Update to 1.1.1
  * For details, see
    &lt;https://github.com/fail2ban/fail2ban/blob/1.1.1/ChangeLog&gt;.
  * The iptables filter was rewritten for supporting multiple
    chains. User-level derivations may become incompatible. Tags
    like e.g. `&lt;chain&gt;` and `&lt;_ipt_for_proto-iter&gt;` may need to be
    replaced.
  * Several rules in the Exim filter w.r.t. mode "normal" moved to
    a new mode "more", because of too risky handling. To use the
    config as before, set `mode = more` for the exim jail.
  * Fixed catastrophic backtracking explosion for REs in
    domino-smtp and dovecot filters.
  * Fixed systemd causing "too many open files" error for a lot of
    journal files and large amount of systemd jails.
  * Passing of arguments from jails to action or filter will affect
    conditional section too, e.g. setting blocktype="DROP" via jail
    for action would now apply for IPv4 and IPv6 chains.
  * jail.conf:
  * Default `banactions` need to be specified in paths-*.conf
    (maintainer level) now.
  * Since the stock fail2ban includes paths-debian.conf by default,
    banactions are nftables (can be overwritten in jail.local by
    user).
  * action.d/firewallcmd-ipset.conf: Renamed `ipsettype` to
    `ipsetbackend`. The parameter ipsettype will be used now to the
    real set type.
  * The Apache filter now recognizes AH02811 and AH10244 log messages.
  * The sshd filter was adapted to support OpenSSH 9.8's new
    "sshd-session" process and log messages.
  * sshd filter: DDoS and aggressive modes had their regex extended
    for timeout before authentication.
  * New Features and Enhancements
  * The systemd backend was extended with a new parameter called "rotated"
    that allows monitoring only actual journals and ignore a lot of rotated files by
    default.
  * The new jail option `skip_if_nologs` was added to ignore a jail
    if no logpath matches were found.
- Drop fail2ban-fix-openssh98.patch, bacause now in upstream.</changelog>
</package>
<package pkgid="cff94d883238a6aec8366027c800dbde64c6c7e22ff6209e3d5710a7573a643b1db177eeb9f163fc162195f340b221cfe5df3973597e9f957260f60bab37e3dd" name="fail2ban" arch="src">
  <version epoch="0" ver="1.1.1" rel="168.1"/>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_fail2ban.service.patch</changelog>
  <changelog author="Johannes Weberhofer &lt;jweberhofer@weberhofer.at&gt;" date="1636718400">- Added fail2ban-0.11.2-upstream-patch-python-3.9.patch to allow
  fail2ban run under under python 3.9+
- Shifted the order of the patches</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1642593600">- add python-rpm-macros buildrequires (bsc#1194752)</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1642852800">- Fail2ban can't be PartOf ipset.service and nftables.service that
  conflict with firewalld.service (as it will prevent restarting the
  latter and which are not provided anymore)
  * fail2ban-opensuse-service.patch
  * harden_fail2ban.service.patch</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1665576000">- Update to 1.0.1:
  * https://github.com/fail2ban/fail2ban/blob/1.0.1/ChangeLog
- Remove fail2ban-0.11.2-upstream-patch-python-3.9.patch.
- Remove fail2ban-0.11.2-upstream-patch-for-CVE-2021-32749.patch.
- Remove fail2ban-rpmlintrc since it's no longer needed.
- Add fail2ban.keyring.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670155200">- update to 1.0.2:
  * Update of major version of fail2ban with primary target to fix a
    dovecot-filter regression #3370.
  * See the ChangeLog for more information.</changelog>
  <changelog author="Lars Vogdt &lt;lars@linux-schulserver.de&gt;" date="1685966400">- use nagios-rpm-macros to define the libexecdir for SUSE distributions
  correctly (defaut here is /usr/lib/nagios/plugins)
- move conditional for %%pre scripts, to avoid any dependency or other
  stuff getting in the way on old distributions</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1725451200">- fail2ban-fix-openssh98.patch: fix to work with openssh 9.8 (bsc#1230101)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729684800">- update to 1.1.0:
  * circumvent SEGFAULT in a python's socket module by
    getaddrinfo with disabled IPv6 (gh-3438)
  * avoid sporadic error in pyinotify backend if pending file
    deleted in other thread, e. g. by flushing logs (gh-3635)
  * `action.d/cloudflare-token.conf` - fixes gh-3479, url-encode
    args by unban
  * `action.d/*ipset*`: make `maxelem` ipset option configurable
    through banaction arguments (gh-3564)
  * `filter.d/apache-common.conf` - accepts remote besides client
    (gh-3622)
  * `filter.d/mysqld-auth.conf` - matches also if no suffix in
    message (mariadb 10.3 log format, gh-3603)
  * `filter.d/nginx-*.conf` - nginx error-log filters extended
    with support of journal format (gh-3646)
  * `filter.d/postfix.conf`:
  - "rejected" rule extended to match "Access denied" too
  - avoid double counting ('lost connection after AUTH'
    together with message 'disconnect ...', gh-3505)
  - add Sender address rejected: Malformed DNS server reply
  - add to postfix syslog daemon format (gh-3690)
  - change journalmatch postfix, allow sub-units with
    postfix@-.service (gh-3692)
  * `filter.d/recidive.conf`: support for systemd-journal,
    conditional RE depending on logtype (for file or journal,
    gh-3693)
  * `filter.d/slapd.conf` - filter rewritten for single-line
    processing, matches errored result without `text=...`
    (gh-3604)
  * supports python 3.12 and 3.13 (gh-3487)
  * bundling async modules removed in python 3.12+ (fallback to
    local libraries pyasyncore/pyasynchat if import would miss
    them, gh-3487)
  * `fail2ban-client` extended (gh-2975):
  - `fail2ban-client status --all [flavor]` - returns status
    of fail2ban and all jails in usual form
  - `fail2ban-client stats` - returns statistic in form of
    table (jail, backend, found and banned counts)
  - `fail2ban-client statistic` or `fail2ban-client
    statistics` - same as `fail2ban-client stats` (aliases for
    stats)
  - `fail2ban-client status --all stats` - (undocumented,
    flavor "stats") returns statistic of all jails in form of
    python dict
  * `fail2ban-regex` extended to load settings from jail (by
    simple name it'd prefer jail to the filter now, gh-2655);
- drop fail2ban-disable-iptables-w-option.patch: only needed for
  sle10 and older, which is no longer supported (is now python &gt;=
  3.5)</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1741608000">- Add BuildRequires on setuptools, required for Python 3.12+.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1743249600">- distutils (provided by python3-setuptools) is also needed during
  time, or f2b cannot launch the systemd log analyzer backend.
- Delete all pre-SUSE-15.x build instructions.
- Delete fail2ban-opensuse-service-sfw.patch,
  fail2ban-opensuse-service.patch, sfw-fail2ban.conf,
  since this mostly part of the pristine fail2ban.service.in
  already. (Unit modified in %install for SFW.)</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1749211200">- Add %python3_fix_shebang macro</changelog>
  <changelog author="Nathan Cutler &lt;ncutler@suse.com&gt;" date="1749556800">- spec:
  * Use pyproject macros to build and install (including
    implementing manual install for files under /etc and /usr from
    the wheel)
  * some BuildRequires cleanup</changelog>
  <changelog author="Nathan Cutler &lt;ncutler@suse.com&gt;" date="1749643200">- spec:
  * simplify manual installation of files under /etc and /usr from
    the wheel</changelog>
  <changelog author="Nathan Cutler &lt;ncutler@suse.com&gt;" date="1749816000">- Add setup-py-install-dir.patch:
  * fix unit file population broken by switch to %pyproject_wheel</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1750075200">- spec:
  * Drop noarch due to /usr/bin/fail2ban-python ELF
  * noarch for monitoring subpackage</changelog>
  <changelog author="chris@computersalat.de" date="1750334400">- fix build
  * service file install
- some rpmlint fixes
- Add fail2ban_service.patch
- rebase patches
  * fail2ban-0.10.4-env-script-interpreter.patch
  * fail2ban-fix-openssh98.patch
  * fail2ban-opensuse-locations.patch
  * harden_fail2ban.service.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1781870400">- Modernize specfile constructs
- Make build recipe compatible with POSIX sh</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1787054400">- Update to 1.1.1
  * For details, see
    &lt;https://github.com/fail2ban/fail2ban/blob/1.1.1/ChangeLog&gt;.
  * The iptables filter was rewritten for supporting multiple
    chains. User-level derivations may become incompatible. Tags
    like e.g. `&lt;chain&gt;` and `&lt;_ipt_for_proto-iter&gt;` may need to be
    replaced.
  * Several rules in the Exim filter w.r.t. mode "normal" moved to
    a new mode "more", because of too risky handling. To use the
    config as before, set `mode = more` for the exim jail.
  * Fixed catastrophic backtracking explosion for REs in
    domino-smtp and dovecot filters.
  * Fixed systemd causing "too many open files" error for a lot of
    journal files and large amount of systemd jails.
  * Passing of arguments from jails to action or filter will affect
    conditional section too, e.g. setting blocktype="DROP" via jail
    for action would now apply for IPv4 and IPv6 chains.
  * jail.conf:
  * Default `banactions` need to be specified in paths-*.conf
    (maintainer level) now.
  * Since the stock fail2ban includes paths-debian.conf by default,
    banactions are nftables (can be overwritten in jail.local by
    user).
  * action.d/firewallcmd-ipset.conf: Renamed `ipsettype` to
    `ipsetbackend`. The parameter ipsettype will be used now to the
    real set type.
  * The Apache filter now recognizes AH02811 and AH10244 log messages.
  * The sshd filter was adapted to support OpenSSH 9.8's new
    "sshd-session" process and log messages.
  * sshd filter: DDoS and aggressive modes had their regex extended
    for timeout before authentication.
  * New Features and Enhancements
  * The systemd backend was extended with a new parameter called "rotated"
    that allows monitoring only actual journals and ignore a lot of rotated files by
    default.
  * The new jail option `skip_if_nologs` was added to ignore a jail
    if no logpath matches were found.
- Drop fail2ban-fix-openssh98.patch, bacause now in upstream.</changelog>
</package>
<package pkgid="498e1ed29a6da30d7c8f6357b50ce3bd0bdd625a661ce9e560b59a8aef9a808efe6fa7e2570133be072940d353caa343b7acd4c48fa1bc1fac2f6b722324b277" name="falco-event-generator" arch="s390x">
  <version epoch="0" ver="0.13.0" rel="1.7"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1716120000">- new package falco-event-generator: Generate a variety of suspect
  actions that are detected by Falco rulesets (but USE WITH
  CAUTION!)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1727956800">- Update to version 0.12.0:
  * increase timeout for
    syscall.DisallowedSSHConnectionNonStandardPort
  * update(events): disable
    PotentialLocalPrivilegeEscalationViaEnvironmentVariablesMisuse
  * update(events): disable JavaProcessClassFileDownload
  * use setup-go v3 gh action with go v1.23.1
  * rename files to be consistent with rules names
  * prevent zombie processes
  * move randomString() to a separate file, allowing build on macos
  * fix: Enhance Falco syscall events triggering and reliability
  * Added an event for default stable rule Detect release_agent
    File Container Escapes
  * Fix: Updated function name to the correct rule name
  * Added an event for polkit local privilege escalation
    ulnerability
  * Added an event for default rule sudo potential privilege
    escalation
  * docs(OWNERS): add alacuku (Aldo Lacuku) to approvers
  * Update events/syscall/mount_launched_in_privileged_container.go
  * adding event for this rule
  * adding an event on interpreted procs inbound network activity
  * adding an event on modify container entrypoint
  * adding an event on triggering rule
  * adding an event on interpreted procs outbound network activity
  * adding event on triggering this rule
  * adding an event on packet_socket_created_in_container
  * adding an event
  * Fix: os.Mkdir("/dev") instead if os.Mkdir("/dev/shm")
  * adding an event for disallowed_ssh_connection_non_standard_port
  * adding an event on reading environment variable from /proc
    files
  * Fix: Ptrace call is detached after a ptrace call with traceme
    argument from child process
  * Added an event for default stable rule ptrace anti debug
    attempt
  * Added documentation for the skipping actions due non-supported
    context
  * Refactor: use return.ErrSkipped to skip actions due to non
    supported context or prerequisite
  * update(pkg/runner/helper): SpawnAsWithSymlink and SpawnAs to
    copy the binary
  * Create a new binary by copying it form existing binary instead
    of creating a new binary
  * Added an event for default stable rule Drop and execute new
    binary in container
  * more explained comment on `why to use IP 169.254.169.254`
  * adding comment on clarification of IP address
  * updated comment
  * corrected an indentation error
  * Update contact_cloud_metadata_service_from_container.go
  * adding an event for contact cloud metadata service from
    container
  * Fix: Event-generator executable is loaded into memory instead
    of go binary
  * Event-generator executable path is now available to actions
  * Debris removed after functionreturn
  * Added an event for fileless execution via memfd create
  * Fix: Created a unique file under tmp dir
  * Added an event for default rule Container Drift Detected
    open+create
  * Fix: Set execute permission on file via writefile instead of
    chmod
  * Refactor command execution to use a dynamic script path and
    also added comments
  * Create /dev/shm if not exists and Remove debris at end
  * Changing the condition to trigger falco rule
  * Code size reduced
  * Created script file in dev shm folder if not exists
  * Added an event for default stable rule execution from dev shm
  * Update and rename launch_remote_file_copy_tool_in_container.go
    to launch_remote_file_copy_tools_in_container.go
  * Update launch_remote_file_copy_tool_in_container.go
  * adding event on launch remote file copy tool in container
  * Fix: Create a unique temp file instead of using any random file
    name
  * Fix: Changed the function name according to name conventions in
    documentation
  * Added an event for default rule set setuid or set setgid bit
  * Refactor: Create a unique temp directory and changed function
    name
  * created a directory and syslog file inside it
  * Added an event for default stable rule clear log activities
  * Update unexpected_udp_traffic.go
  * adding event on unexpected_udp_traffic
  * chore: don't log inside DoNothing helper
  * chore: fix copyright year
  * update(events/helper): add the DoNothing helper
  * Refactor: Just set execute permission on empty file is enough
    trigger the rule
  * Code size reduced
  * Added an event for default rule Container drift detected using
    chmod
  * Update netcat_remote_code_execution_in_container.go
  * adding event on netcat rce in container
  * Fix: Updated comments for better understanding
  * Added an event for default stable rule PTRACE attached to
    process
  * Update launch_suspicious_network_tool_in_container.go
  * Rename launch_network_tool.go to
    launch_suspicious_network_tool_in_container.go
  * Update launch_network_tool.go
  * Update launch_network_tool.go
  * adding an event of launching network tool
  * User uid is set to non zero when generating the event
  * Added an event for default rule
    UnprivilegedDelegationofPageFaultsHandlingtoaUserspaceProcess
  * Switch to a new user such that username is not equal to _apt
  * Added an event for Launch Package Management Process In
    Container
  * Update debugfs_launched_in_privilleged_container.go
  * Update debugfs_launched_in_privilleged_container.go
  * event on debugfs launched in privilleged container
  * Fix: Use MkdirTemp instead of Mkdir to create a unique temp
    directory
  * Now file is created by event generator and reads the shell
    configuration file
  * Added an event for default rule read shell configuration file
  * Added an event for default stable rule find aws credentials
  * Fix: Rule triggers irrsepective of command successful or not
  * Added an event for default rule Detect crypto miners using the
    Stratum protocol
  * Fix: First look whether curl exists or not
  * Refactor: Now http_proxy env variable set only for curl command
    not for entire event generator
  * HTTP_PROXY env variable value is reverted to its original value
    after function return
  * Added an event for default rule program run with diallowed http
    proxy env
  * Fix: createSshDirectoryUnderHome also returns a cleanup
    function
  * Fix: Helper function name changed
  * Refactored code by using  a helper function
    CreateSshDirectoryUnderHome to remove code redundancy
  * Refactored ReadSshInformation function to improve directory
    creation logic
  * Remove the created directory at end
  * Uncommented a line
  * Reduced code size
  * Using temporary data by creating them and removing them after
    completion
  * Added an event for adding ssh keys to authorized keys
  * Refactor: createSshDirectoryUnderHome also returns a cleanup
    function
  * Fix: No need to export internal utilities
  * Fix: Event should be diabled by default as it is not a stable
    rule event
  * Fix: There is no need of for loop as MkdirTemp internally does
    it
  * Added an helper function to create .ssh directory inside home
  * Refactored ReadSshInformation function to improve directory
    creation logic
  * Remove the created directory at end
  * Using temporary data by creating them and removing them after
    completion
  * Added event for default rule read ssh information
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * adding an event for modifying shell configuration file
  * Update events/syscall/delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * adding an event of deleting bash history
  * Fix: First look whether kubectl exists or not
  * Added an event for default rule kubernetes client tool launched
    in container
  * Fix: wget is just enough to trigger the rule
  * Added an event for default rule launch ingress remote file copy
    tools inside container
  * Update decoding_payload_in_container.go
  * Update decoding_payload_in_container.go
  * adding event on triggering rule
  * Update and rename change_namespace_privillege_using_unshare.go
    to change_namespace_privileges_via_unshare.go
  * Update
    events/syscall/change_namespace_privillege_using_unshare.go
  * Update change_namespace_privillege_using_unshare.go
  * adding an event on change_namespace_privilleges_using_unshare
  * Update
    events/syscall/potential_local_privillege_escalation_via_env_var_misuse.go
  * Rename potential_local_privillege_escalation_via_env_var_misuse
    to potential_local_privillege_escalation_via_env_var_misuse.go
  * event on potential local privillefe escalation via env var
    misuse
  * Update events/syscall/launch_suspicious_network_tool_on_host.go
  * Update launch_suspicious_network_tool_on_host.go
  * Rename launch_network_tool_on_host.go to
    launch_suspicious_network_tool_on_host.go
  * adding event on launch network tool on host
  * docs(events/README.md): update conventions
  * Fixed some more broken links
  * Fix broken link by replacing it with valid url
  * fix(events/syscall/remove_bulk_data_from_disk): no new
    variables on left side of :=
  * No need to return error and updated comments
  * Updated comments
  * Added comments for explaination
  * Shred a file instead of directory
  * Update remove_bulk_data_from_disk.go
  * Clean up the temp directory
  * Added event for default stable rule remove bulk data from disk
  * Added event for default rule create hidden file or directory
  * falco: create hardlink over sensitive file event added
  * Removed debris at end
  * Creates directory if it doesnt exist
  * Type in file name
  * Added event for the default rule WriteBelowMonitoredDir
  * Added event for default rule write_below_root
  * Corrected a typo
  * build: upgrade deps</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 0.13.0:
  * docs: add documentation for `suite` and each of its
    sub-commands
  * feat(suite/loader): add forward-reference check for field
    bindings
  * docs(samples): add samples covering each relevant `suite`
    feature
  * ci(.github): bump `docker/build-push-action` to `v7.1.0`
  * ci(.github): bump `docker/setup-qemu-action` to `v4.0.0`
  * ci(.github): bump `actions/checkout` to `v6.0.2`
  * ci(.github): bump `goreleaser/goreleaser-action` to `v7.2.1`
  * ci(.github): bump `docker/setup-buildx-action` to `v4.0.0`
  * ci(.github): bump `docker/login-action` to `v4.1.0`
  * ci(.github): use `ubuntu-24.04` runner everywhere
  * ci(.github): bump `setup-go` and extract go version from
    `go.mod`
  * fix(suite/loader): prevent override of reserved environment
    variables
  * fix(Dockerfile): align base image to `go.mod` Go version
  * fix(suite/cmd/explain): avoid exposing field binding
    description
  * chore(chart): add source chart
  * chore: bump go deps
  * fix(suite/cmd/explain): avoid duplicated node descriptions
  * cve fix
  * docs(suite): add `samples` folder providing some demonstrative
    samples
  * chore: bump CI golangci-lint version and migrate to golangci v2
  * ci(.github): add `/area automation` to PR template
  * docs: update `bench` and `test` documentation
  * feat(cmd)!: use HTTP output instead of gRPC output
  * feat(suite)!: replace gRPC alert retriever with HTTP alert
    retriever
  * docs(OWNERS): move `ekoops` from reviewer to approver
  * cleanup(ci): update github actions hashes
  * feat(suite/step/syscalls): allow to omit `read` `buffer` or
    `len` arg
  * feat(suite/step/syscalls): add arguments constraints support
  * update(.github): switch to multi platform build in one step
  * update(.github/workflows/publish-main.yaml): apply review
    suggetion
  * update(.github): avoid GoReleaser for pushing container images
    for `main`
  * fix(.github/publish-main.yaml): revert unnecessary override
  * fix: enable goreleaser push for `main`
  * new(.github/workflows): publish dev build for `main` branch
  * new: goreleaser config for `main` dev builds
  * feat(suite/cmd/test): output test cases information in report
    encoding
  * docs(OWNERS): add ekoops as reviewer
  * fix(suite/step/syscalls): align `read` and `write` step args
    after run
  * docs(cmd): improve `suite` command description
  * feat(decl): rename `declarative` commands namespace to `suite`
  * feat(decl/container): switch to docker client sdk
  * refactor(decl/syscalls): use composition over function pointers
  * feat(decl/fd/file): create dir hierarchy if not exist
  * feat(decl/fd/directory): create dir hierarchy if not exist
  * refactor: add osutil package
  * refactor(decl/caps): move func setting capabilities to
    capability pkg
  * feat(decl/proc-chain): create proc exe dir hierarchy if not
    exist
  * feat(decl/cmd/test): give a name to alert retriever logger
  * build: bump libcap version
  * refactor(decl/tester): remove unused report encoders code
  * feat(decl/cmd/test): groups test reports by test suite
  * docs: update copyright year to 2025
  * feat(decl/cmd/test): switch to incremental backoff in report
    retrieval
  * feat(decl/suite): add YAML, JSON and text encoders for suite
    reports
  * refactor(decl/suite): split definition from API implementation
  * refactor(decl/suite): move no-rule check logic in suite loader
  * feat(decl/cmd/test): honor ctx cancellation in report
    generation
  * fix(decl/loader): generate documentation for list items
  * feat(decl/loader): add test cases JSON schema
  * feat(decl/loader): add test cases support
  * feat(decl/loader): allow spaces in field binding syntax
  * fix(decl/runners): fix host runner delegation logic
  * feat(decl/cmd/test): introduce `--description-dir` flag
  * feat(decl/cmd/test): allow multiple description file to be
    provided
  * feat(decl/runners): improve host runner logging
  * refactor(decl): improve logging attributes propagation
  * feat(decl/cmd/test): add test suites support
  * feat(decl/suite): add test suites loading support
  * feat(decl/cmd/test): move context from logger name to
    attributes
  * fix(decl/loader): fix steps/resources name uniqueness
    enforcement
  * feat(decl): make rule and expectedOutcome conditionally
    optional
  * fix(decl/cmd/test): wait for goroutines termination upon
    failures
  * feat(decl/cmd/explain): add --format flag and YAML format
    option
  * feat(decl/cmd/explain): add explain command
  * feat(decl/loader): add yaml tag to schema documentation node
  * feat(decl/scripts): replace sh with bash
  * feat(decl/loader): add support for generating documentation
    node tree
  * fix(decl/loader): fix tests expected outcome JSON schema
  * feat(decl/loader): add test resources metadata to JSON schemas
  * feat(decl/loader): add syscall test steps metadata to JSON
    schemas
  * fix(decl/loader): fix field bindings marshaling for nested
    fields
  * feat(decl/loader): replace go-yaml/yaml with goccy/go-yaml
  * feat(decl/loader): set up two-steps unmarshaling via
    mapstructure
  * feat(decl/loader): add validator leveraging JSON schema
  * fix(decl): remove unneeded print statements
  * style(decl): replace interface{} with any
  * fix(decl/syscalls): fix system call argument value parsing
  * fix(decl/syscalls): fix symlinkat system call cleanup logic
  * fix(decl/syscalls): fix dup3 system call cleanup logic
  * fix(decl/syscalls): fix openat2 default arguments
  * feat(decl/syscalls): remove unneeded line in socket syscall
  * fix(decl/syscalls): fix linkat syscall invocation
  * cleanup(decl/cmd/test): clean test command run function
  * feat(decl/process): add process builder
  * cleanup(decl/cmd/test): move runner error logging in separate
    function
  * cleanup(decl/cmd/test): remove unneded if statement
  * feat(decl/cmd/test): omit default process in containerized
    tests
  * feat(decl): enhance process labels propagation system
  * chore(decl): add label package supporting labels handling
  * feat(decl/containers): add containerized test support
  * chore(Dockerfile): replace alpine base images with debian-based
    ones
  * feat(decl/containers): add containerd container builder
  * chore(decl): add container and container builder declaration
  * chore(decl/loader): improve container context definition
  * fix: add missing new line for better visualization of failed
    tests
  * chore(decl/scripts): conditionally disable shell script
    execution
  * fix(decl/loader): fix potential nil ptr deref in context
    validation
  * fix(decl/scripts): fix shell script SIGUSR1 handling
  * feat(decl/proc-chain): add user and capabilities support
  * feat(decl/loader): add user and capabilities fields YAML
    definition
  * chore(decl/caps): add capabilities manipulation package
  * feat(decl/syscalls): add kill system call test step
  * cleanup(decl/syscalls): remove unused ret fields
  * style(decl/loader): change switch style
  * docs(decl/write): fix typo in write system call test step
    comment
  * feat(decl/resources): add process test resource
  * feat(decl/loader): add process resource YAML definition
  * chore(decl): abstract process creation
  * feat(decl/cmd/test): add flag for specifying report output
    encoding
  * feat(decl/tester): add report yaml encoder
  * feat(decl/tester): add report json encoder
  * feat(decl/cmd/run): fallback to test command
  * feat(decl/cmd/test): add test command
  * chore(decl/config): add command shared configuration
  * feat(decl/tester): add tester
  * feat(decl/tester): add report text encoder
  * feat(decl/tester): add tester, report and report encoder
    definition
  * feat(decl/loader): remove unneded custom validation for rule
    name
  * chore(decl/alert): add alert gRPC retriever
  * feat(decl/alert): add alert and alert retriever definitions
  * chore(decl/loader): remove time and output from expected
    outcome
  * chore(decl/loader): rename expected output to expected outcome
  * feat(decl/cmd/run): add default process for empty process
    chains
  * chore(decl): make process context's executable path optional
  * chore(random): move rand sequence gen out of clientServer
    resource
  * feat(decl): add test ID support
  * feat(decl/cmd/run): store flags in command wrapper instance
  * chore(decl): rename process ID to process label and hide the
    flag
  * fix(decl): return error if openMode is negative
  * fix(decl): use SetUint for open_mode uint32 field
  * feat(decl/loader): allow empty test step list
  * feat(decl): add CLI support to run declarative tests
  * feat(decl/log): add logging support through logr and zap
  * feat(decl): rename test configuration to test description
  * feat(decl/runners): add runner builder
  * feat(decl/runners): add host runner
  * feat(decl/runners): add runners and runners builder
    declarations
  * feat(decl/loader): complete process context definition
  * feat(decl/loader): add support for test configuration
    serialization
  * chore(decl/log): add more log context in test and resource
    builders
  * feat(decl/tests): add test builder
  * feat(decl/tests): add test implementation
  * feat(decl/scripts): add test shell scripts support
  * feat(decl/tests): add tests and tests builder declarations
  * feat(decl/resources): add resource builder
  * feat(decl/fd): add memfd fd test resource
  * feat(decl/fd): add inotify fd test resource
  * feat(decl/fd): add eventpoll fd test resource
  * feat(decl/fd): add signalfd fd test resource
  * feat(decl/fd): add event fd test resource
  * feat(decl/fd): add pipe fd test resource
  * feat(decl/fd): add directory fd test resource
  * feat(decl/fd): add file fd test resource
  * feat(decl/loader): add fd resource and subtypes YAML definition
  * chore(decl/loader): move test resource spec decoding out of
    switch
  * fix(decl/loader): fix test steps and resources spec validation
  * cleanup(decl/syscalls): remove print statement in socket run
  * feat(decl/resources): add clientServer test resource
  * feat(decl/resources): add resources and resources builder
    declarations
  * feat(decl/loader): add clientServer resource YAML definition
  * fix(decl/syscalls): simplify arg parsing logic and disable lint
    issues
  * feat(decl/syscalls): add syscall test step builder
  * feat(decl/syscalls): add sendto system call test step
  * feat(decl/syscalls): add socket system call test step
  * feat(decl/syscalls): add connect system call test step
  * feat(decl/syscalls): add dup3 system call test step
  * feat(decl/syscalls): add dup2 system call test step
  * feat(decl/syscalls): add dup system call test step
  * feat(decl/syscalls): add finit_module system call test step
  * feat(decl/syscalls): add init_module system call test step
  * feat(decl/syscalls): add linkat system call test step
  * feat(decl/syscalls): add link system call test step
  * feat(decl/syscalls): add symlinkat system call test step
  * feat(decl/syscalls): add symlink system call test step
  * feat(decl/syscalls): add openat2 system call test step
  * feat(decl/syscalls): add openat system call test step
  * feat(decl/syscalls): add open system call test step
  * feat(decl/syscalls): add read system call test step
  * feat(decl/syscalls): add write system call test step
  * feat(decl/syscalls): add base system call test step
  * feat(decl/syscalls): add steps builder and syscall steps
    declaration
  * feat(decl/steps): add test steps and steps builder declarations
  * feat(decl/fields): add test step fields abstraction
  * feat(decl/loader): add tests configuration YAML definition and
    loader
  * chore(ci): switch to github provided arm64 runners.
  * update(ci): use arm64 CNCF runners for GH actions
  * chore(lint): apply linter
  * new(linter): add linter for the repository
  * build: fix cross-compilation
  * chore(dockerignore): use white-list approach
  * docs(docs): update commands
  * docs(README.md): update for v0.12</changelog>
</package>
<package pkgid="6113608ccc5c43e6307d6914e2bf0e837e4feb82bd6ab9f5deb173e2d979c16112160463fc4b640b505e30b523f929055f4cdfa8587024d7a4c307b6b3f81a81" name="falco-event-generator" arch="src">
  <version epoch="0" ver="0.13.0" rel="1.7"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1716120000">- new package falco-event-generator: Generate a variety of suspect
  actions that are detected by Falco rulesets (but USE WITH
  CAUTION!)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1727956800">- Update to version 0.12.0:
  * increase timeout for
    syscall.DisallowedSSHConnectionNonStandardPort
  * update(events): disable
    PotentialLocalPrivilegeEscalationViaEnvironmentVariablesMisuse
  * update(events): disable JavaProcessClassFileDownload
  * use setup-go v3 gh action with go v1.23.1
  * rename files to be consistent with rules names
  * prevent zombie processes
  * move randomString() to a separate file, allowing build on macos
  * fix: Enhance Falco syscall events triggering and reliability
  * Added an event for default stable rule Detect release_agent
    File Container Escapes
  * Fix: Updated function name to the correct rule name
  * Added an event for polkit local privilege escalation
    ulnerability
  * Added an event for default rule sudo potential privilege
    escalation
  * docs(OWNERS): add alacuku (Aldo Lacuku) to approvers
  * Update events/syscall/mount_launched_in_privileged_container.go
  * adding event for this rule
  * adding an event on interpreted procs inbound network activity
  * adding an event on modify container entrypoint
  * adding an event on triggering rule
  * adding an event on interpreted procs outbound network activity
  * adding event on triggering this rule
  * adding an event on packet_socket_created_in_container
  * adding an event
  * Fix: os.Mkdir("/dev") instead if os.Mkdir("/dev/shm")
  * adding an event for disallowed_ssh_connection_non_standard_port
  * adding an event on reading environment variable from /proc
    files
  * Fix: Ptrace call is detached after a ptrace call with traceme
    argument from child process
  * Added an event for default stable rule ptrace anti debug
    attempt
  * Added documentation for the skipping actions due non-supported
    context
  * Refactor: use return.ErrSkipped to skip actions due to non
    supported context or prerequisite
  * update(pkg/runner/helper): SpawnAsWithSymlink and SpawnAs to
    copy the binary
  * Create a new binary by copying it form existing binary instead
    of creating a new binary
  * Added an event for default stable rule Drop and execute new
    binary in container
  * more explained comment on `why to use IP 169.254.169.254`
  * adding comment on clarification of IP address
  * updated comment
  * corrected an indentation error
  * Update contact_cloud_metadata_service_from_container.go
  * adding an event for contact cloud metadata service from
    container
  * Fix: Event-generator executable is loaded into memory instead
    of go binary
  * Event-generator executable path is now available to actions
  * Debris removed after functionreturn
  * Added an event for fileless execution via memfd create
  * Fix: Created a unique file under tmp dir
  * Added an event for default rule Container Drift Detected
    open+create
  * Fix: Set execute permission on file via writefile instead of
    chmod
  * Refactor command execution to use a dynamic script path and
    also added comments
  * Create /dev/shm if not exists and Remove debris at end
  * Changing the condition to trigger falco rule
  * Code size reduced
  * Created script file in dev shm folder if not exists
  * Added an event for default stable rule execution from dev shm
  * Update and rename launch_remote_file_copy_tool_in_container.go
    to launch_remote_file_copy_tools_in_container.go
  * Update launch_remote_file_copy_tool_in_container.go
  * adding event on launch remote file copy tool in container
  * Fix: Create a unique temp file instead of using any random file
    name
  * Fix: Changed the function name according to name conventions in
    documentation
  * Added an event for default rule set setuid or set setgid bit
  * Refactor: Create a unique temp directory and changed function
    name
  * created a directory and syslog file inside it
  * Added an event for default stable rule clear log activities
  * Update unexpected_udp_traffic.go
  * adding event on unexpected_udp_traffic
  * chore: don't log inside DoNothing helper
  * chore: fix copyright year
  * update(events/helper): add the DoNothing helper
  * Refactor: Just set execute permission on empty file is enough
    trigger the rule
  * Code size reduced
  * Added an event for default rule Container drift detected using
    chmod
  * Update netcat_remote_code_execution_in_container.go
  * adding event on netcat rce in container
  * Fix: Updated comments for better understanding
  * Added an event for default stable rule PTRACE attached to
    process
  * Update launch_suspicious_network_tool_in_container.go
  * Rename launch_network_tool.go to
    launch_suspicious_network_tool_in_container.go
  * Update launch_network_tool.go
  * Update launch_network_tool.go
  * adding an event of launching network tool
  * User uid is set to non zero when generating the event
  * Added an event for default rule
    UnprivilegedDelegationofPageFaultsHandlingtoaUserspaceProcess
  * Switch to a new user such that username is not equal to _apt
  * Added an event for Launch Package Management Process In
    Container
  * Update debugfs_launched_in_privilleged_container.go
  * Update debugfs_launched_in_privilleged_container.go
  * event on debugfs launched in privilleged container
  * Fix: Use MkdirTemp instead of Mkdir to create a unique temp
    directory
  * Now file is created by event generator and reads the shell
    configuration file
  * Added an event for default rule read shell configuration file
  * Added an event for default stable rule find aws credentials
  * Fix: Rule triggers irrsepective of command successful or not
  * Added an event for default rule Detect crypto miners using the
    Stratum protocol
  * Fix: First look whether curl exists or not
  * Refactor: Now http_proxy env variable set only for curl command
    not for entire event generator
  * HTTP_PROXY env variable value is reverted to its original value
    after function return
  * Added an event for default rule program run with diallowed http
    proxy env
  * Fix: createSshDirectoryUnderHome also returns a cleanup
    function
  * Fix: Helper function name changed
  * Refactored code by using  a helper function
    CreateSshDirectoryUnderHome to remove code redundancy
  * Refactored ReadSshInformation function to improve directory
    creation logic
  * Remove the created directory at end
  * Uncommented a line
  * Reduced code size
  * Using temporary data by creating them and removing them after
    completion
  * Added an event for adding ssh keys to authorized keys
  * Refactor: createSshDirectoryUnderHome also returns a cleanup
    function
  * Fix: No need to export internal utilities
  * Fix: Event should be diabled by default as it is not a stable
    rule event
  * Fix: There is no need of for loop as MkdirTemp internally does
    it
  * Added an helper function to create .ssh directory inside home
  * Refactored ReadSshInformation function to improve directory
    creation logic
  * Remove the created directory at end
  * Using temporary data by creating them and removing them after
    completion
  * Added event for default rule read ssh information
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * adding an event for modifying shell configuration file
  * Update events/syscall/delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * adding an event of deleting bash history
  * Fix: First look whether kubectl exists or not
  * Added an event for default rule kubernetes client tool launched
    in container
  * Fix: wget is just enough to trigger the rule
  * Added an event for default rule launch ingress remote file copy
    tools inside container
  * Update decoding_payload_in_container.go
  * Update decoding_payload_in_container.go
  * adding event on triggering rule
  * Update and rename change_namespace_privillege_using_unshare.go
    to change_namespace_privileges_via_unshare.go
  * Update
    events/syscall/change_namespace_privillege_using_unshare.go
  * Update change_namespace_privillege_using_unshare.go
  * adding an event on change_namespace_privilleges_using_unshare
  * Update
    events/syscall/potential_local_privillege_escalation_via_env_var_misuse.go
  * Rename potential_local_privillege_escalation_via_env_var_misuse
    to potential_local_privillege_escalation_via_env_var_misuse.go
  * event on potential local privillefe escalation via env var
    misuse
  * Update events/syscall/launch_suspicious_network_tool_on_host.go
  * Update launch_suspicious_network_tool_on_host.go
  * Rename launch_network_tool_on_host.go to
    launch_suspicious_network_tool_on_host.go
  * adding event on launch network tool on host
  * docs(events/README.md): update conventions
  * Fixed some more broken links
  * Fix broken link by replacing it with valid url
  * fix(events/syscall/remove_bulk_data_from_disk): no new
    variables on left side of :=
  * No need to return error and updated comments
  * Updated comments
  * Added comments for explaination
  * Shred a file instead of directory
  * Update remove_bulk_data_from_disk.go
  * Clean up the temp directory
  * Added event for default stable rule remove bulk data from disk
  * Added event for default rule create hidden file or directory
  * falco: create hardlink over sensitive file event added
  * Removed debris at end
  * Creates directory if it doesnt exist
  * Type in file name
  * Added event for the default rule WriteBelowMonitoredDir
  * Added event for default rule write_below_root
  * Corrected a typo
  * build: upgrade deps</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 0.13.0:
  * docs: add documentation for `suite` and each of its
    sub-commands
  * feat(suite/loader): add forward-reference check for field
    bindings
  * docs(samples): add samples covering each relevant `suite`
    feature
  * ci(.github): bump `docker/build-push-action` to `v7.1.0`
  * ci(.github): bump `docker/setup-qemu-action` to `v4.0.0`
  * ci(.github): bump `actions/checkout` to `v6.0.2`
  * ci(.github): bump `goreleaser/goreleaser-action` to `v7.2.1`
  * ci(.github): bump `docker/setup-buildx-action` to `v4.0.0`
  * ci(.github): bump `docker/login-action` to `v4.1.0`
  * ci(.github): use `ubuntu-24.04` runner everywhere
  * ci(.github): bump `setup-go` and extract go version from
    `go.mod`
  * fix(suite/loader): prevent override of reserved environment
    variables
  * fix(Dockerfile): align base image to `go.mod` Go version
  * fix(suite/cmd/explain): avoid exposing field binding
    description
  * chore(chart): add source chart
  * chore: bump go deps
  * fix(suite/cmd/explain): avoid duplicated node descriptions
  * cve fix
  * docs(suite): add `samples` folder providing some demonstrative
    samples
  * chore: bump CI golangci-lint version and migrate to golangci v2
  * ci(.github): add `/area automation` to PR template
  * docs: update `bench` and `test` documentation
  * feat(cmd)!: use HTTP output instead of gRPC output
  * feat(suite)!: replace gRPC alert retriever with HTTP alert
    retriever
  * docs(OWNERS): move `ekoops` from reviewer to approver
  * cleanup(ci): update github actions hashes
  * feat(suite/step/syscalls): allow to omit `read` `buffer` or
    `len` arg
  * feat(suite/step/syscalls): add arguments constraints support
  * update(.github): switch to multi platform build in one step
  * update(.github/workflows/publish-main.yaml): apply review
    suggetion
  * update(.github): avoid GoReleaser for pushing container images
    for `main`
  * fix(.github/publish-main.yaml): revert unnecessary override
  * fix: enable goreleaser push for `main`
  * new(.github/workflows): publish dev build for `main` branch
  * new: goreleaser config for `main` dev builds
  * feat(suite/cmd/test): output test cases information in report
    encoding
  * docs(OWNERS): add ekoops as reviewer
  * fix(suite/step/syscalls): align `read` and `write` step args
    after run
  * docs(cmd): improve `suite` command description
  * feat(decl): rename `declarative` commands namespace to `suite`
  * feat(decl/container): switch to docker client sdk
  * refactor(decl/syscalls): use composition over function pointers
  * feat(decl/fd/file): create dir hierarchy if not exist
  * feat(decl/fd/directory): create dir hierarchy if not exist
  * refactor: add osutil package
  * refactor(decl/caps): move func setting capabilities to
    capability pkg
  * feat(decl/proc-chain): create proc exe dir hierarchy if not
    exist
  * feat(decl/cmd/test): give a name to alert retriever logger
  * build: bump libcap version
  * refactor(decl/tester): remove unused report encoders code
  * feat(decl/cmd/test): groups test reports by test suite
  * docs: update copyright year to 2025
  * feat(decl/cmd/test): switch to incremental backoff in report
    retrieval
  * feat(decl/suite): add YAML, JSON and text encoders for suite
    reports
  * refactor(decl/suite): split definition from API implementation
  * refactor(decl/suite): move no-rule check logic in suite loader
  * feat(decl/cmd/test): honor ctx cancellation in report
    generation
  * fix(decl/loader): generate documentation for list items
  * feat(decl/loader): add test cases JSON schema
  * feat(decl/loader): add test cases support
  * feat(decl/loader): allow spaces in field binding syntax
  * fix(decl/runners): fix host runner delegation logic
  * feat(decl/cmd/test): introduce `--description-dir` flag
  * feat(decl/cmd/test): allow multiple description file to be
    provided
  * feat(decl/runners): improve host runner logging
  * refactor(decl): improve logging attributes propagation
  * feat(decl/cmd/test): add test suites support
  * feat(decl/suite): add test suites loading support
  * feat(decl/cmd/test): move context from logger name to
    attributes
  * fix(decl/loader): fix steps/resources name uniqueness
    enforcement
  * feat(decl): make rule and expectedOutcome conditionally
    optional
  * fix(decl/cmd/test): wait for goroutines termination upon
    failures
  * feat(decl/cmd/explain): add --format flag and YAML format
    option
  * feat(decl/cmd/explain): add explain command
  * feat(decl/loader): add yaml tag to schema documentation node
  * feat(decl/scripts): replace sh with bash
  * feat(decl/loader): add support for generating documentation
    node tree
  * fix(decl/loader): fix tests expected outcome JSON schema
  * feat(decl/loader): add test resources metadata to JSON schemas
  * feat(decl/loader): add syscall test steps metadata to JSON
    schemas
  * fix(decl/loader): fix field bindings marshaling for nested
    fields
  * feat(decl/loader): replace go-yaml/yaml with goccy/go-yaml
  * feat(decl/loader): set up two-steps unmarshaling via
    mapstructure
  * feat(decl/loader): add validator leveraging JSON schema
  * fix(decl): remove unneeded print statements
  * style(decl): replace interface{} with any
  * fix(decl/syscalls): fix system call argument value parsing
  * fix(decl/syscalls): fix symlinkat system call cleanup logic
  * fix(decl/syscalls): fix dup3 system call cleanup logic
  * fix(decl/syscalls): fix openat2 default arguments
  * feat(decl/syscalls): remove unneeded line in socket syscall
  * fix(decl/syscalls): fix linkat syscall invocation
  * cleanup(decl/cmd/test): clean test command run function
  * feat(decl/process): add process builder
  * cleanup(decl/cmd/test): move runner error logging in separate
    function
  * cleanup(decl/cmd/test): remove unneded if statement
  * feat(decl/cmd/test): omit default process in containerized
    tests
  * feat(decl): enhance process labels propagation system
  * chore(decl): add label package supporting labels handling
  * feat(decl/containers): add containerized test support
  * chore(Dockerfile): replace alpine base images with debian-based
    ones
  * feat(decl/containers): add containerd container builder
  * chore(decl): add container and container builder declaration
  * chore(decl/loader): improve container context definition
  * fix: add missing new line for better visualization of failed
    tests
  * chore(decl/scripts): conditionally disable shell script
    execution
  * fix(decl/loader): fix potential nil ptr deref in context
    validation
  * fix(decl/scripts): fix shell script SIGUSR1 handling
  * feat(decl/proc-chain): add user and capabilities support
  * feat(decl/loader): add user and capabilities fields YAML
    definition
  * chore(decl/caps): add capabilities manipulation package
  * feat(decl/syscalls): add kill system call test step
  * cleanup(decl/syscalls): remove unused ret fields
  * style(decl/loader): change switch style
  * docs(decl/write): fix typo in write system call test step
    comment
  * feat(decl/resources): add process test resource
  * feat(decl/loader): add process resource YAML definition
  * chore(decl): abstract process creation
  * feat(decl/cmd/test): add flag for specifying report output
    encoding
  * feat(decl/tester): add report yaml encoder
  * feat(decl/tester): add report json encoder
  * feat(decl/cmd/run): fallback to test command
  * feat(decl/cmd/test): add test command
  * chore(decl/config): add command shared configuration
  * feat(decl/tester): add tester
  * feat(decl/tester): add report text encoder
  * feat(decl/tester): add tester, report and report encoder
    definition
  * feat(decl/loader): remove unneded custom validation for rule
    name
  * chore(decl/alert): add alert gRPC retriever
  * feat(decl/alert): add alert and alert retriever definitions
  * chore(decl/loader): remove time and output from expected
    outcome
  * chore(decl/loader): rename expected output to expected outcome
  * feat(decl/cmd/run): add default process for empty process
    chains
  * chore(decl): make process context's executable path optional
  * chore(random): move rand sequence gen out of clientServer
    resource
  * feat(decl): add test ID support
  * feat(decl/cmd/run): store flags in command wrapper instance
  * chore(decl): rename process ID to process label and hide the
    flag
  * fix(decl): return error if openMode is negative
  * fix(decl): use SetUint for open_mode uint32 field
  * feat(decl/loader): allow empty test step list
  * feat(decl): add CLI support to run declarative tests
  * feat(decl/log): add logging support through logr and zap
  * feat(decl): rename test configuration to test description
  * feat(decl/runners): add runner builder
  * feat(decl/runners): add host runner
  * feat(decl/runners): add runners and runners builder
    declarations
  * feat(decl/loader): complete process context definition
  * feat(decl/loader): add support for test configuration
    serialization
  * chore(decl/log): add more log context in test and resource
    builders
  * feat(decl/tests): add test builder
  * feat(decl/tests): add test implementation
  * feat(decl/scripts): add test shell scripts support
  * feat(decl/tests): add tests and tests builder declarations
  * feat(decl/resources): add resource builder
  * feat(decl/fd): add memfd fd test resource
  * feat(decl/fd): add inotify fd test resource
  * feat(decl/fd): add eventpoll fd test resource
  * feat(decl/fd): add signalfd fd test resource
  * feat(decl/fd): add event fd test resource
  * feat(decl/fd): add pipe fd test resource
  * feat(decl/fd): add directory fd test resource
  * feat(decl/fd): add file fd test resource
  * feat(decl/loader): add fd resource and subtypes YAML definition
  * chore(decl/loader): move test resource spec decoding out of
    switch
  * fix(decl/loader): fix test steps and resources spec validation
  * cleanup(decl/syscalls): remove print statement in socket run
  * feat(decl/resources): add clientServer test resource
  * feat(decl/resources): add resources and resources builder
    declarations
  * feat(decl/loader): add clientServer resource YAML definition
  * fix(decl/syscalls): simplify arg parsing logic and disable lint
    issues
  * feat(decl/syscalls): add syscall test step builder
  * feat(decl/syscalls): add sendto system call test step
  * feat(decl/syscalls): add socket system call test step
  * feat(decl/syscalls): add connect system call test step
  * feat(decl/syscalls): add dup3 system call test step
  * feat(decl/syscalls): add dup2 system call test step
  * feat(decl/syscalls): add dup system call test step
  * feat(decl/syscalls): add finit_module system call test step
  * feat(decl/syscalls): add init_module system call test step
  * feat(decl/syscalls): add linkat system call test step
  * feat(decl/syscalls): add link system call test step
  * feat(decl/syscalls): add symlinkat system call test step
  * feat(decl/syscalls): add symlink system call test step
  * feat(decl/syscalls): add openat2 system call test step
  * feat(decl/syscalls): add openat system call test step
  * feat(decl/syscalls): add open system call test step
  * feat(decl/syscalls): add read system call test step
  * feat(decl/syscalls): add write system call test step
  * feat(decl/syscalls): add base system call test step
  * feat(decl/syscalls): add steps builder and syscall steps
    declaration
  * feat(decl/steps): add test steps and steps builder declarations
  * feat(decl/fields): add test step fields abstraction
  * feat(decl/loader): add tests configuration YAML definition and
    loader
  * chore(ci): switch to github provided arm64 runners.
  * update(ci): use arm64 CNCF runners for GH actions
  * chore(lint): apply linter
  * new(linter): add linter for the repository
  * build: fix cross-compilation
  * chore(dockerignore): use white-list approach
  * docs(docs): update commands
  * docs(README.md): update for v0.12</changelog>
</package>
<package pkgid="09499575357f58a69dc63cf6399288ad6f424ac489b3e4b56ebf96bf5eaa25c5b85595a6f72cce91cb71b556ea1914e8a2a90797e27a9022f271fa8e3e0c770a" name="falco-event-generator-bash-completion" arch="noarch">
  <version epoch="0" ver="0.13.0" rel="1.7"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1716120000">- new package falco-event-generator: Generate a variety of suspect
  actions that are detected by Falco rulesets (but USE WITH
  CAUTION!)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1727956800">- Update to version 0.12.0:
  * increase timeout for
    syscall.DisallowedSSHConnectionNonStandardPort
  * update(events): disable
    PotentialLocalPrivilegeEscalationViaEnvironmentVariablesMisuse
  * update(events): disable JavaProcessClassFileDownload
  * use setup-go v3 gh action with go v1.23.1
  * rename files to be consistent with rules names
  * prevent zombie processes
  * move randomString() to a separate file, allowing build on macos
  * fix: Enhance Falco syscall events triggering and reliability
  * Added an event for default stable rule Detect release_agent
    File Container Escapes
  * Fix: Updated function name to the correct rule name
  * Added an event for polkit local privilege escalation
    ulnerability
  * Added an event for default rule sudo potential privilege
    escalation
  * docs(OWNERS): add alacuku (Aldo Lacuku) to approvers
  * Update events/syscall/mount_launched_in_privileged_container.go
  * adding event for this rule
  * adding an event on interpreted procs inbound network activity
  * adding an event on modify container entrypoint
  * adding an event on triggering rule
  * adding an event on interpreted procs outbound network activity
  * adding event on triggering this rule
  * adding an event on packet_socket_created_in_container
  * adding an event
  * Fix: os.Mkdir("/dev") instead if os.Mkdir("/dev/shm")
  * adding an event for disallowed_ssh_connection_non_standard_port
  * adding an event on reading environment variable from /proc
    files
  * Fix: Ptrace call is detached after a ptrace call with traceme
    argument from child process
  * Added an event for default stable rule ptrace anti debug
    attempt
  * Added documentation for the skipping actions due non-supported
    context
  * Refactor: use return.ErrSkipped to skip actions due to non
    supported context or prerequisite
  * update(pkg/runner/helper): SpawnAsWithSymlink and SpawnAs to
    copy the binary
  * Create a new binary by copying it form existing binary instead
    of creating a new binary
  * Added an event for default stable rule Drop and execute new
    binary in container
  * more explained comment on `why to use IP 169.254.169.254`
  * adding comment on clarification of IP address
  * updated comment
  * corrected an indentation error
  * Update contact_cloud_metadata_service_from_container.go
  * adding an event for contact cloud metadata service from
    container
  * Fix: Event-generator executable is loaded into memory instead
    of go binary
  * Event-generator executable path is now available to actions
  * Debris removed after functionreturn
  * Added an event for fileless execution via memfd create
  * Fix: Created a unique file under tmp dir
  * Added an event for default rule Container Drift Detected
    open+create
  * Fix: Set execute permission on file via writefile instead of
    chmod
  * Refactor command execution to use a dynamic script path and
    also added comments
  * Create /dev/shm if not exists and Remove debris at end
  * Changing the condition to trigger falco rule
  * Code size reduced
  * Created script file in dev shm folder if not exists
  * Added an event for default stable rule execution from dev shm
  * Update and rename launch_remote_file_copy_tool_in_container.go
    to launch_remote_file_copy_tools_in_container.go
  * Update launch_remote_file_copy_tool_in_container.go
  * adding event on launch remote file copy tool in container
  * Fix: Create a unique temp file instead of using any random file
    name
  * Fix: Changed the function name according to name conventions in
    documentation
  * Added an event for default rule set setuid or set setgid bit
  * Refactor: Create a unique temp directory and changed function
    name
  * created a directory and syslog file inside it
  * Added an event for default stable rule clear log activities
  * Update unexpected_udp_traffic.go
  * adding event on unexpected_udp_traffic
  * chore: don't log inside DoNothing helper
  * chore: fix copyright year
  * update(events/helper): add the DoNothing helper
  * Refactor: Just set execute permission on empty file is enough
    trigger the rule
  * Code size reduced
  * Added an event for default rule Container drift detected using
    chmod
  * Update netcat_remote_code_execution_in_container.go
  * adding event on netcat rce in container
  * Fix: Updated comments for better understanding
  * Added an event for default stable rule PTRACE attached to
    process
  * Update launch_suspicious_network_tool_in_container.go
  * Rename launch_network_tool.go to
    launch_suspicious_network_tool_in_container.go
  * Update launch_network_tool.go
  * Update launch_network_tool.go
  * adding an event of launching network tool
  * User uid is set to non zero when generating the event
  * Added an event for default rule
    UnprivilegedDelegationofPageFaultsHandlingtoaUserspaceProcess
  * Switch to a new user such that username is not equal to _apt
  * Added an event for Launch Package Management Process In
    Container
  * Update debugfs_launched_in_privilleged_container.go
  * Update debugfs_launched_in_privilleged_container.go
  * event on debugfs launched in privilleged container
  * Fix: Use MkdirTemp instead of Mkdir to create a unique temp
    directory
  * Now file is created by event generator and reads the shell
    configuration file
  * Added an event for default rule read shell configuration file
  * Added an event for default stable rule find aws credentials
  * Fix: Rule triggers irrsepective of command successful or not
  * Added an event for default rule Detect crypto miners using the
    Stratum protocol
  * Fix: First look whether curl exists or not
  * Refactor: Now http_proxy env variable set only for curl command
    not for entire event generator
  * HTTP_PROXY env variable value is reverted to its original value
    after function return
  * Added an event for default rule program run with diallowed http
    proxy env
  * Fix: createSshDirectoryUnderHome also returns a cleanup
    function
  * Fix: Helper function name changed
  * Refactored code by using  a helper function
    CreateSshDirectoryUnderHome to remove code redundancy
  * Refactored ReadSshInformation function to improve directory
    creation logic
  * Remove the created directory at end
  * Uncommented a line
  * Reduced code size
  * Using temporary data by creating them and removing them after
    completion
  * Added an event for adding ssh keys to authorized keys
  * Refactor: createSshDirectoryUnderHome also returns a cleanup
    function
  * Fix: No need to export internal utilities
  * Fix: Event should be diabled by default as it is not a stable
    rule event
  * Fix: There is no need of for loop as MkdirTemp internally does
    it
  * Added an helper function to create .ssh directory inside home
  * Refactored ReadSshInformation function to improve directory
    creation logic
  * Remove the created directory at end
  * Using temporary data by creating them and removing them after
    completion
  * Added event for default rule read ssh information
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * adding an event for modifying shell configuration file
  * Update events/syscall/delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * adding an event of deleting bash history
  * Fix: First look whether kubectl exists or not
  * Added an event for default rule kubernetes client tool launched
    in container
  * Fix: wget is just enough to trigger the rule
  * Added an event for default rule launch ingress remote file copy
    tools inside container
  * Update decoding_payload_in_container.go
  * Update decoding_payload_in_container.go
  * adding event on triggering rule
  * Update and rename change_namespace_privillege_using_unshare.go
    to change_namespace_privileges_via_unshare.go
  * Update
    events/syscall/change_namespace_privillege_using_unshare.go
  * Update change_namespace_privillege_using_unshare.go
  * adding an event on change_namespace_privilleges_using_unshare
  * Update
    events/syscall/potential_local_privillege_escalation_via_env_var_misuse.go
  * Rename potential_local_privillege_escalation_via_env_var_misuse
    to potential_local_privillege_escalation_via_env_var_misuse.go
  * event on potential local privillefe escalation via env var
    misuse
  * Update events/syscall/launch_suspicious_network_tool_on_host.go
  * Update launch_suspicious_network_tool_on_host.go
  * Rename launch_network_tool_on_host.go to
    launch_suspicious_network_tool_on_host.go
  * adding event on launch network tool on host
  * docs(events/README.md): update conventions
  * Fixed some more broken links
  * Fix broken link by replacing it with valid url
  * fix(events/syscall/remove_bulk_data_from_disk): no new
    variables on left side of :=
  * No need to return error and updated comments
  * Updated comments
  * Added comments for explaination
  * Shred a file instead of directory
  * Update remove_bulk_data_from_disk.go
  * Clean up the temp directory
  * Added event for default stable rule remove bulk data from disk
  * Added event for default rule create hidden file or directory
  * falco: create hardlink over sensitive file event added
  * Removed debris at end
  * Creates directory if it doesnt exist
  * Type in file name
  * Added event for the default rule WriteBelowMonitoredDir
  * Added event for default rule write_below_root
  * Corrected a typo
  * build: upgrade deps</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 0.13.0:
  * docs: add documentation for `suite` and each of its
    sub-commands
  * feat(suite/loader): add forward-reference check for field
    bindings
  * docs(samples): add samples covering each relevant `suite`
    feature
  * ci(.github): bump `docker/build-push-action` to `v7.1.0`
  * ci(.github): bump `docker/setup-qemu-action` to `v4.0.0`
  * ci(.github): bump `actions/checkout` to `v6.0.2`
  * ci(.github): bump `goreleaser/goreleaser-action` to `v7.2.1`
  * ci(.github): bump `docker/setup-buildx-action` to `v4.0.0`
  * ci(.github): bump `docker/login-action` to `v4.1.0`
  * ci(.github): use `ubuntu-24.04` runner everywhere
  * ci(.github): bump `setup-go` and extract go version from
    `go.mod`
  * fix(suite/loader): prevent override of reserved environment
    variables
  * fix(Dockerfile): align base image to `go.mod` Go version
  * fix(suite/cmd/explain): avoid exposing field binding
    description
  * chore(chart): add source chart
  * chore: bump go deps
  * fix(suite/cmd/explain): avoid duplicated node descriptions
  * cve fix
  * docs(suite): add `samples` folder providing some demonstrative
    samples
  * chore: bump CI golangci-lint version and migrate to golangci v2
  * ci(.github): add `/area automation` to PR template
  * docs: update `bench` and `test` documentation
  * feat(cmd)!: use HTTP output instead of gRPC output
  * feat(suite)!: replace gRPC alert retriever with HTTP alert
    retriever
  * docs(OWNERS): move `ekoops` from reviewer to approver
  * cleanup(ci): update github actions hashes
  * feat(suite/step/syscalls): allow to omit `read` `buffer` or
    `len` arg
  * feat(suite/step/syscalls): add arguments constraints support
  * update(.github): switch to multi platform build in one step
  * update(.github/workflows/publish-main.yaml): apply review
    suggetion
  * update(.github): avoid GoReleaser for pushing container images
    for `main`
  * fix(.github/publish-main.yaml): revert unnecessary override
  * fix: enable goreleaser push for `main`
  * new(.github/workflows): publish dev build for `main` branch
  * new: goreleaser config for `main` dev builds
  * feat(suite/cmd/test): output test cases information in report
    encoding
  * docs(OWNERS): add ekoops as reviewer
  * fix(suite/step/syscalls): align `read` and `write` step args
    after run
  * docs(cmd): improve `suite` command description
  * feat(decl): rename `declarative` commands namespace to `suite`
  * feat(decl/container): switch to docker client sdk
  * refactor(decl/syscalls): use composition over function pointers
  * feat(decl/fd/file): create dir hierarchy if not exist
  * feat(decl/fd/directory): create dir hierarchy if not exist
  * refactor: add osutil package
  * refactor(decl/caps): move func setting capabilities to
    capability pkg
  * feat(decl/proc-chain): create proc exe dir hierarchy if not
    exist
  * feat(decl/cmd/test): give a name to alert retriever logger
  * build: bump libcap version
  * refactor(decl/tester): remove unused report encoders code
  * feat(decl/cmd/test): groups test reports by test suite
  * docs: update copyright year to 2025
  * feat(decl/cmd/test): switch to incremental backoff in report
    retrieval
  * feat(decl/suite): add YAML, JSON and text encoders for suite
    reports
  * refactor(decl/suite): split definition from API implementation
  * refactor(decl/suite): move no-rule check logic in suite loader
  * feat(decl/cmd/test): honor ctx cancellation in report
    generation
  * fix(decl/loader): generate documentation for list items
  * feat(decl/loader): add test cases JSON schema
  * feat(decl/loader): add test cases support
  * feat(decl/loader): allow spaces in field binding syntax
  * fix(decl/runners): fix host runner delegation logic
  * feat(decl/cmd/test): introduce `--description-dir` flag
  * feat(decl/cmd/test): allow multiple description file to be
    provided
  * feat(decl/runners): improve host runner logging
  * refactor(decl): improve logging attributes propagation
  * feat(decl/cmd/test): add test suites support
  * feat(decl/suite): add test suites loading support
  * feat(decl/cmd/test): move context from logger name to
    attributes
  * fix(decl/loader): fix steps/resources name uniqueness
    enforcement
  * feat(decl): make rule and expectedOutcome conditionally
    optional
  * fix(decl/cmd/test): wait for goroutines termination upon
    failures
  * feat(decl/cmd/explain): add --format flag and YAML format
    option
  * feat(decl/cmd/explain): add explain command
  * feat(decl/loader): add yaml tag to schema documentation node
  * feat(decl/scripts): replace sh with bash
  * feat(decl/loader): add support for generating documentation
    node tree
  * fix(decl/loader): fix tests expected outcome JSON schema
  * feat(decl/loader): add test resources metadata to JSON schemas
  * feat(decl/loader): add syscall test steps metadata to JSON
    schemas
  * fix(decl/loader): fix field bindings marshaling for nested
    fields
  * feat(decl/loader): replace go-yaml/yaml with goccy/go-yaml
  * feat(decl/loader): set up two-steps unmarshaling via
    mapstructure
  * feat(decl/loader): add validator leveraging JSON schema
  * fix(decl): remove unneeded print statements
  * style(decl): replace interface{} with any
  * fix(decl/syscalls): fix system call argument value parsing
  * fix(decl/syscalls): fix symlinkat system call cleanup logic
  * fix(decl/syscalls): fix dup3 system call cleanup logic
  * fix(decl/syscalls): fix openat2 default arguments
  * feat(decl/syscalls): remove unneeded line in socket syscall
  * fix(decl/syscalls): fix linkat syscall invocation
  * cleanup(decl/cmd/test): clean test command run function
  * feat(decl/process): add process builder
  * cleanup(decl/cmd/test): move runner error logging in separate
    function
  * cleanup(decl/cmd/test): remove unneded if statement
  * feat(decl/cmd/test): omit default process in containerized
    tests
  * feat(decl): enhance process labels propagation system
  * chore(decl): add label package supporting labels handling
  * feat(decl/containers): add containerized test support
  * chore(Dockerfile): replace alpine base images with debian-based
    ones
  * feat(decl/containers): add containerd container builder
  * chore(decl): add container and container builder declaration
  * chore(decl/loader): improve container context definition
  * fix: add missing new line for better visualization of failed
    tests
  * chore(decl/scripts): conditionally disable shell script
    execution
  * fix(decl/loader): fix potential nil ptr deref in context
    validation
  * fix(decl/scripts): fix shell script SIGUSR1 handling
  * feat(decl/proc-chain): add user and capabilities support
  * feat(decl/loader): add user and capabilities fields YAML
    definition
  * chore(decl/caps): add capabilities manipulation package
  * feat(decl/syscalls): add kill system call test step
  * cleanup(decl/syscalls): remove unused ret fields
  * style(decl/loader): change switch style
  * docs(decl/write): fix typo in write system call test step
    comment
  * feat(decl/resources): add process test resource
  * feat(decl/loader): add process resource YAML definition
  * chore(decl): abstract process creation
  * feat(decl/cmd/test): add flag for specifying report output
    encoding
  * feat(decl/tester): add report yaml encoder
  * feat(decl/tester): add report json encoder
  * feat(decl/cmd/run): fallback to test command
  * feat(decl/cmd/test): add test command
  * chore(decl/config): add command shared configuration
  * feat(decl/tester): add tester
  * feat(decl/tester): add report text encoder
  * feat(decl/tester): add tester, report and report encoder
    definition
  * feat(decl/loader): remove unneded custom validation for rule
    name
  * chore(decl/alert): add alert gRPC retriever
  * feat(decl/alert): add alert and alert retriever definitions
  * chore(decl/loader): remove time and output from expected
    outcome
  * chore(decl/loader): rename expected output to expected outcome
  * feat(decl/cmd/run): add default process for empty process
    chains
  * chore(decl): make process context's executable path optional
  * chore(random): move rand sequence gen out of clientServer
    resource
  * feat(decl): add test ID support
  * feat(decl/cmd/run): store flags in command wrapper instance
  * chore(decl): rename process ID to process label and hide the
    flag
  * fix(decl): return error if openMode is negative
  * fix(decl): use SetUint for open_mode uint32 field
  * feat(decl/loader): allow empty test step list
  * feat(decl): add CLI support to run declarative tests
  * feat(decl/log): add logging support through logr and zap
  * feat(decl): rename test configuration to test description
  * feat(decl/runners): add runner builder
  * feat(decl/runners): add host runner
  * feat(decl/runners): add runners and runners builder
    declarations
  * feat(decl/loader): complete process context definition
  * feat(decl/loader): add support for test configuration
    serialization
  * chore(decl/log): add more log context in test and resource
    builders
  * feat(decl/tests): add test builder
  * feat(decl/tests): add test implementation
  * feat(decl/scripts): add test shell scripts support
  * feat(decl/tests): add tests and tests builder declarations
  * feat(decl/resources): add resource builder
  * feat(decl/fd): add memfd fd test resource
  * feat(decl/fd): add inotify fd test resource
  * feat(decl/fd): add eventpoll fd test resource
  * feat(decl/fd): add signalfd fd test resource
  * feat(decl/fd): add event fd test resource
  * feat(decl/fd): add pipe fd test resource
  * feat(decl/fd): add directory fd test resource
  * feat(decl/fd): add file fd test resource
  * feat(decl/loader): add fd resource and subtypes YAML definition
  * chore(decl/loader): move test resource spec decoding out of
    switch
  * fix(decl/loader): fix test steps and resources spec validation
  * cleanup(decl/syscalls): remove print statement in socket run
  * feat(decl/resources): add clientServer test resource
  * feat(decl/resources): add resources and resources builder
    declarations
  * feat(decl/loader): add clientServer resource YAML definition
  * fix(decl/syscalls): simplify arg parsing logic and disable lint
    issues
  * feat(decl/syscalls): add syscall test step builder
  * feat(decl/syscalls): add sendto system call test step
  * feat(decl/syscalls): add socket system call test step
  * feat(decl/syscalls): add connect system call test step
  * feat(decl/syscalls): add dup3 system call test step
  * feat(decl/syscalls): add dup2 system call test step
  * feat(decl/syscalls): add dup system call test step
  * feat(decl/syscalls): add finit_module system call test step
  * feat(decl/syscalls): add init_module system call test step
  * feat(decl/syscalls): add linkat system call test step
  * feat(decl/syscalls): add link system call test step
  * feat(decl/syscalls): add symlinkat system call test step
  * feat(decl/syscalls): add symlink system call test step
  * feat(decl/syscalls): add openat2 system call test step
  * feat(decl/syscalls): add openat system call test step
  * feat(decl/syscalls): add open system call test step
  * feat(decl/syscalls): add read system call test step
  * feat(decl/syscalls): add write system call test step
  * feat(decl/syscalls): add base system call test step
  * feat(decl/syscalls): add steps builder and syscall steps
    declaration
  * feat(decl/steps): add test steps and steps builder declarations
  * feat(decl/fields): add test step fields abstraction
  * feat(decl/loader): add tests configuration YAML definition and
    loader
  * chore(ci): switch to github provided arm64 runners.
  * update(ci): use arm64 CNCF runners for GH actions
  * chore(lint): apply linter
  * new(linter): add linter for the repository
  * build: fix cross-compilation
  * chore(dockerignore): use white-list approach
  * docs(docs): update commands
  * docs(README.md): update for v0.12</changelog>
</package>
<package pkgid="2509f382249058bcc2949c8b51a06f292c84bbfb38a30cba44c19e4e9713b5d33dc54feafd50fc95c2fb2b0c5366d38134fbe88f0e746b8e81bbd37b895224e3" name="falco-event-generator-debuginfo" arch="s390x">
  <version epoch="0" ver="0.13.0" rel="1.7"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1716120000">- new package falco-event-generator: Generate a variety of suspect
  actions that are detected by Falco rulesets (but USE WITH
  CAUTION!)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1727956800">- Update to version 0.12.0:
  * increase timeout for
    syscall.DisallowedSSHConnectionNonStandardPort
  * update(events): disable
    PotentialLocalPrivilegeEscalationViaEnvironmentVariablesMisuse
  * update(events): disable JavaProcessClassFileDownload
  * use setup-go v3 gh action with go v1.23.1
  * rename files to be consistent with rules names
  * prevent zombie processes
  * move randomString() to a separate file, allowing build on macos
  * fix: Enhance Falco syscall events triggering and reliability
  * Added an event for default stable rule Detect release_agent
    File Container Escapes
  * Fix: Updated function name to the correct rule name
  * Added an event for polkit local privilege escalation
    ulnerability
  * Added an event for default rule sudo potential privilege
    escalation
  * docs(OWNERS): add alacuku (Aldo Lacuku) to approvers
  * Update events/syscall/mount_launched_in_privileged_container.go
  * adding event for this rule
  * adding an event on interpreted procs inbound network activity
  * adding an event on modify container entrypoint
  * adding an event on triggering rule
  * adding an event on interpreted procs outbound network activity
  * adding event on triggering this rule
  * adding an event on packet_socket_created_in_container
  * adding an event
  * Fix: os.Mkdir("/dev") instead if os.Mkdir("/dev/shm")
  * adding an event for disallowed_ssh_connection_non_standard_port
  * adding an event on reading environment variable from /proc
    files
  * Fix: Ptrace call is detached after a ptrace call with traceme
    argument from child process
  * Added an event for default stable rule ptrace anti debug
    attempt
  * Added documentation for the skipping actions due non-supported
    context
  * Refactor: use return.ErrSkipped to skip actions due to non
    supported context or prerequisite
  * update(pkg/runner/helper): SpawnAsWithSymlink and SpawnAs to
    copy the binary
  * Create a new binary by copying it form existing binary instead
    of creating a new binary
  * Added an event for default stable rule Drop and execute new
    binary in container
  * more explained comment on `why to use IP 169.254.169.254`
  * adding comment on clarification of IP address
  * updated comment
  * corrected an indentation error
  * Update contact_cloud_metadata_service_from_container.go
  * adding an event for contact cloud metadata service from
    container
  * Fix: Event-generator executable is loaded into memory instead
    of go binary
  * Event-generator executable path is now available to actions
  * Debris removed after functionreturn
  * Added an event for fileless execution via memfd create
  * Fix: Created a unique file under tmp dir
  * Added an event for default rule Container Drift Detected
    open+create
  * Fix: Set execute permission on file via writefile instead of
    chmod
  * Refactor command execution to use a dynamic script path and
    also added comments
  * Create /dev/shm if not exists and Remove debris at end
  * Changing the condition to trigger falco rule
  * Code size reduced
  * Created script file in dev shm folder if not exists
  * Added an event for default stable rule execution from dev shm
  * Update and rename launch_remote_file_copy_tool_in_container.go
    to launch_remote_file_copy_tools_in_container.go
  * Update launch_remote_file_copy_tool_in_container.go
  * adding event on launch remote file copy tool in container
  * Fix: Create a unique temp file instead of using any random file
    name
  * Fix: Changed the function name according to name conventions in
    documentation
  * Added an event for default rule set setuid or set setgid bit
  * Refactor: Create a unique temp directory and changed function
    name
  * created a directory and syslog file inside it
  * Added an event for default stable rule clear log activities
  * Update unexpected_udp_traffic.go
  * adding event on unexpected_udp_traffic
  * chore: don't log inside DoNothing helper
  * chore: fix copyright year
  * update(events/helper): add the DoNothing helper
  * Refactor: Just set execute permission on empty file is enough
    trigger the rule
  * Code size reduced
  * Added an event for default rule Container drift detected using
    chmod
  * Update netcat_remote_code_execution_in_container.go
  * adding event on netcat rce in container
  * Fix: Updated comments for better understanding
  * Added an event for default stable rule PTRACE attached to
    process
  * Update launch_suspicious_network_tool_in_container.go
  * Rename launch_network_tool.go to
    launch_suspicious_network_tool_in_container.go
  * Update launch_network_tool.go
  * Update launch_network_tool.go
  * adding an event of launching network tool
  * User uid is set to non zero when generating the event
  * Added an event for default rule
    UnprivilegedDelegationofPageFaultsHandlingtoaUserspaceProcess
  * Switch to a new user such that username is not equal to _apt
  * Added an event for Launch Package Management Process In
    Container
  * Update debugfs_launched_in_privilleged_container.go
  * Update debugfs_launched_in_privilleged_container.go
  * event on debugfs launched in privilleged container
  * Fix: Use MkdirTemp instead of Mkdir to create a unique temp
    directory
  * Now file is created by event generator and reads the shell
    configuration file
  * Added an event for default rule read shell configuration file
  * Added an event for default stable rule find aws credentials
  * Fix: Rule triggers irrsepective of command successful or not
  * Added an event for default rule Detect crypto miners using the
    Stratum protocol
  * Fix: First look whether curl exists or not
  * Refactor: Now http_proxy env variable set only for curl command
    not for entire event generator
  * HTTP_PROXY env variable value is reverted to its original value
    after function return
  * Added an event for default rule program run with diallowed http
    proxy env
  * Fix: createSshDirectoryUnderHome also returns a cleanup
    function
  * Fix: Helper function name changed
  * Refactored code by using  a helper function
    CreateSshDirectoryUnderHome to remove code redundancy
  * Refactored ReadSshInformation function to improve directory
    creation logic
  * Remove the created directory at end
  * Uncommented a line
  * Reduced code size
  * Using temporary data by creating them and removing them after
    completion
  * Added an event for adding ssh keys to authorized keys
  * Refactor: createSshDirectoryUnderHome also returns a cleanup
    function
  * Fix: No need to export internal utilities
  * Fix: Event should be diabled by default as it is not a stable
    rule event
  * Fix: There is no need of for loop as MkdirTemp internally does
    it
  * Added an helper function to create .ssh directory inside home
  * Refactored ReadSshInformation function to improve directory
    creation logic
  * Remove the created directory at end
  * Using temporary data by creating them and removing them after
    completion
  * Added event for default rule read ssh information
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * adding an event for modifying shell configuration file
  * Update events/syscall/delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * adding an event of deleting bash history
  * Fix: First look whether kubectl exists or not
  * Added an event for default rule kubernetes client tool launched
    in container
  * Fix: wget is just enough to trigger the rule
  * Added an event for default rule launch ingress remote file copy
    tools inside container
  * Update decoding_payload_in_container.go
  * Update decoding_payload_in_container.go
  * adding event on triggering rule
  * Update and rename change_namespace_privillege_using_unshare.go
    to change_namespace_privileges_via_unshare.go
  * Update
    events/syscall/change_namespace_privillege_using_unshare.go
  * Update change_namespace_privillege_using_unshare.go
  * adding an event on change_namespace_privilleges_using_unshare
  * Update
    events/syscall/potential_local_privillege_escalation_via_env_var_misuse.go
  * Rename potential_local_privillege_escalation_via_env_var_misuse
    to potential_local_privillege_escalation_via_env_var_misuse.go
  * event on potential local privillefe escalation via env var
    misuse
  * Update events/syscall/launch_suspicious_network_tool_on_host.go
  * Update launch_suspicious_network_tool_on_host.go
  * Rename launch_network_tool_on_host.go to
    launch_suspicious_network_tool_on_host.go
  * adding event on launch network tool on host
  * docs(events/README.md): update conventions
  * Fixed some more broken links
  * Fix broken link by replacing it with valid url
  * fix(events/syscall/remove_bulk_data_from_disk): no new
    variables on left side of :=
  * No need to return error and updated comments
  * Updated comments
  * Added comments for explaination
  * Shred a file instead of directory
  * Update remove_bulk_data_from_disk.go
  * Clean up the temp directory
  * Added event for default stable rule remove bulk data from disk
  * Added event for default rule create hidden file or directory
  * falco: create hardlink over sensitive file event added
  * Removed debris at end
  * Creates directory if it doesnt exist
  * Type in file name
  * Added event for the default rule WriteBelowMonitoredDir
  * Added event for default rule write_below_root
  * Corrected a typo
  * build: upgrade deps</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 0.13.0:
  * docs: add documentation for `suite` and each of its
    sub-commands
  * feat(suite/loader): add forward-reference check for field
    bindings
  * docs(samples): add samples covering each relevant `suite`
    feature
  * ci(.github): bump `docker/build-push-action` to `v7.1.0`
  * ci(.github): bump `docker/setup-qemu-action` to `v4.0.0`
  * ci(.github): bump `actions/checkout` to `v6.0.2`
  * ci(.github): bump `goreleaser/goreleaser-action` to `v7.2.1`
  * ci(.github): bump `docker/setup-buildx-action` to `v4.0.0`
  * ci(.github): bump `docker/login-action` to `v4.1.0`
  * ci(.github): use `ubuntu-24.04` runner everywhere
  * ci(.github): bump `setup-go` and extract go version from
    `go.mod`
  * fix(suite/loader): prevent override of reserved environment
    variables
  * fix(Dockerfile): align base image to `go.mod` Go version
  * fix(suite/cmd/explain): avoid exposing field binding
    description
  * chore(chart): add source chart
  * chore: bump go deps
  * fix(suite/cmd/explain): avoid duplicated node descriptions
  * cve fix
  * docs(suite): add `samples` folder providing some demonstrative
    samples
  * chore: bump CI golangci-lint version and migrate to golangci v2
  * ci(.github): add `/area automation` to PR template
  * docs: update `bench` and `test` documentation
  * feat(cmd)!: use HTTP output instead of gRPC output
  * feat(suite)!: replace gRPC alert retriever with HTTP alert
    retriever
  * docs(OWNERS): move `ekoops` from reviewer to approver
  * cleanup(ci): update github actions hashes
  * feat(suite/step/syscalls): allow to omit `read` `buffer` or
    `len` arg
  * feat(suite/step/syscalls): add arguments constraints support
  * update(.github): switch to multi platform build in one step
  * update(.github/workflows/publish-main.yaml): apply review
    suggetion
  * update(.github): avoid GoReleaser for pushing container images
    for `main`
  * fix(.github/publish-main.yaml): revert unnecessary override
  * fix: enable goreleaser push for `main`
  * new(.github/workflows): publish dev build for `main` branch
  * new: goreleaser config for `main` dev builds
  * feat(suite/cmd/test): output test cases information in report
    encoding
  * docs(OWNERS): add ekoops as reviewer
  * fix(suite/step/syscalls): align `read` and `write` step args
    after run
  * docs(cmd): improve `suite` command description
  * feat(decl): rename `declarative` commands namespace to `suite`
  * feat(decl/container): switch to docker client sdk
  * refactor(decl/syscalls): use composition over function pointers
  * feat(decl/fd/file): create dir hierarchy if not exist
  * feat(decl/fd/directory): create dir hierarchy if not exist
  * refactor: add osutil package
  * refactor(decl/caps): move func setting capabilities to
    capability pkg
  * feat(decl/proc-chain): create proc exe dir hierarchy if not
    exist
  * feat(decl/cmd/test): give a name to alert retriever logger
  * build: bump libcap version
  * refactor(decl/tester): remove unused report encoders code
  * feat(decl/cmd/test): groups test reports by test suite
  * docs: update copyright year to 2025
  * feat(decl/cmd/test): switch to incremental backoff in report
    retrieval
  * feat(decl/suite): add YAML, JSON and text encoders for suite
    reports
  * refactor(decl/suite): split definition from API implementation
  * refactor(decl/suite): move no-rule check logic in suite loader
  * feat(decl/cmd/test): honor ctx cancellation in report
    generation
  * fix(decl/loader): generate documentation for list items
  * feat(decl/loader): add test cases JSON schema
  * feat(decl/loader): add test cases support
  * feat(decl/loader): allow spaces in field binding syntax
  * fix(decl/runners): fix host runner delegation logic
  * feat(decl/cmd/test): introduce `--description-dir` flag
  * feat(decl/cmd/test): allow multiple description file to be
    provided
  * feat(decl/runners): improve host runner logging
  * refactor(decl): improve logging attributes propagation
  * feat(decl/cmd/test): add test suites support
  * feat(decl/suite): add test suites loading support
  * feat(decl/cmd/test): move context from logger name to
    attributes
  * fix(decl/loader): fix steps/resources name uniqueness
    enforcement
  * feat(decl): make rule and expectedOutcome conditionally
    optional
  * fix(decl/cmd/test): wait for goroutines termination upon
    failures
  * feat(decl/cmd/explain): add --format flag and YAML format
    option
  * feat(decl/cmd/explain): add explain command
  * feat(decl/loader): add yaml tag to schema documentation node
  * feat(decl/scripts): replace sh with bash
  * feat(decl/loader): add support for generating documentation
    node tree
  * fix(decl/loader): fix tests expected outcome JSON schema
  * feat(decl/loader): add test resources metadata to JSON schemas
  * feat(decl/loader): add syscall test steps metadata to JSON
    schemas
  * fix(decl/loader): fix field bindings marshaling for nested
    fields
  * feat(decl/loader): replace go-yaml/yaml with goccy/go-yaml
  * feat(decl/loader): set up two-steps unmarshaling via
    mapstructure
  * feat(decl/loader): add validator leveraging JSON schema
  * fix(decl): remove unneeded print statements
  * style(decl): replace interface{} with any
  * fix(decl/syscalls): fix system call argument value parsing
  * fix(decl/syscalls): fix symlinkat system call cleanup logic
  * fix(decl/syscalls): fix dup3 system call cleanup logic
  * fix(decl/syscalls): fix openat2 default arguments
  * feat(decl/syscalls): remove unneeded line in socket syscall
  * fix(decl/syscalls): fix linkat syscall invocation
  * cleanup(decl/cmd/test): clean test command run function
  * feat(decl/process): add process builder
  * cleanup(decl/cmd/test): move runner error logging in separate
    function
  * cleanup(decl/cmd/test): remove unneded if statement
  * feat(decl/cmd/test): omit default process in containerized
    tests
  * feat(decl): enhance process labels propagation system
  * chore(decl): add label package supporting labels handling
  * feat(decl/containers): add containerized test support
  * chore(Dockerfile): replace alpine base images with debian-based
    ones
  * feat(decl/containers): add containerd container builder
  * chore(decl): add container and container builder declaration
  * chore(decl/loader): improve container context definition
  * fix: add missing new line for better visualization of failed
    tests
  * chore(decl/scripts): conditionally disable shell script
    execution
  * fix(decl/loader): fix potential nil ptr deref in context
    validation
  * fix(decl/scripts): fix shell script SIGUSR1 handling
  * feat(decl/proc-chain): add user and capabilities support
  * feat(decl/loader): add user and capabilities fields YAML
    definition
  * chore(decl/caps): add capabilities manipulation package
  * feat(decl/syscalls): add kill system call test step
  * cleanup(decl/syscalls): remove unused ret fields
  * style(decl/loader): change switch style
  * docs(decl/write): fix typo in write system call test step
    comment
  * feat(decl/resources): add process test resource
  * feat(decl/loader): add process resource YAML definition
  * chore(decl): abstract process creation
  * feat(decl/cmd/test): add flag for specifying report output
    encoding
  * feat(decl/tester): add report yaml encoder
  * feat(decl/tester): add report json encoder
  * feat(decl/cmd/run): fallback to test command
  * feat(decl/cmd/test): add test command
  * chore(decl/config): add command shared configuration
  * feat(decl/tester): add tester
  * feat(decl/tester): add report text encoder
  * feat(decl/tester): add tester, report and report encoder
    definition
  * feat(decl/loader): remove unneded custom validation for rule
    name
  * chore(decl/alert): add alert gRPC retriever
  * feat(decl/alert): add alert and alert retriever definitions
  * chore(decl/loader): remove time and output from expected
    outcome
  * chore(decl/loader): rename expected output to expected outcome
  * feat(decl/cmd/run): add default process for empty process
    chains
  * chore(decl): make process context's executable path optional
  * chore(random): move rand sequence gen out of clientServer
    resource
  * feat(decl): add test ID support
  * feat(decl/cmd/run): store flags in command wrapper instance
  * chore(decl): rename process ID to process label and hide the
    flag
  * fix(decl): return error if openMode is negative
  * fix(decl): use SetUint for open_mode uint32 field
  * feat(decl/loader): allow empty test step list
  * feat(decl): add CLI support to run declarative tests
  * feat(decl/log): add logging support through logr and zap
  * feat(decl): rename test configuration to test description
  * feat(decl/runners): add runner builder
  * feat(decl/runners): add host runner
  * feat(decl/runners): add runners and runners builder
    declarations
  * feat(decl/loader): complete process context definition
  * feat(decl/loader): add support for test configuration
    serialization
  * chore(decl/log): add more log context in test and resource
    builders
  * feat(decl/tests): add test builder
  * feat(decl/tests): add test implementation
  * feat(decl/scripts): add test shell scripts support
  * feat(decl/tests): add tests and tests builder declarations
  * feat(decl/resources): add resource builder
  * feat(decl/fd): add memfd fd test resource
  * feat(decl/fd): add inotify fd test resource
  * feat(decl/fd): add eventpoll fd test resource
  * feat(decl/fd): add signalfd fd test resource
  * feat(decl/fd): add event fd test resource
  * feat(decl/fd): add pipe fd test resource
  * feat(decl/fd): add directory fd test resource
  * feat(decl/fd): add file fd test resource
  * feat(decl/loader): add fd resource and subtypes YAML definition
  * chore(decl/loader): move test resource spec decoding out of
    switch
  * fix(decl/loader): fix test steps and resources spec validation
  * cleanup(decl/syscalls): remove print statement in socket run
  * feat(decl/resources): add clientServer test resource
  * feat(decl/resources): add resources and resources builder
    declarations
  * feat(decl/loader): add clientServer resource YAML definition
  * fix(decl/syscalls): simplify arg parsing logic and disable lint
    issues
  * feat(decl/syscalls): add syscall test step builder
  * feat(decl/syscalls): add sendto system call test step
  * feat(decl/syscalls): add socket system call test step
  * feat(decl/syscalls): add connect system call test step
  * feat(decl/syscalls): add dup3 system call test step
  * feat(decl/syscalls): add dup2 system call test step
  * feat(decl/syscalls): add dup system call test step
  * feat(decl/syscalls): add finit_module system call test step
  * feat(decl/syscalls): add init_module system call test step
  * feat(decl/syscalls): add linkat system call test step
  * feat(decl/syscalls): add link system call test step
  * feat(decl/syscalls): add symlinkat system call test step
  * feat(decl/syscalls): add symlink system call test step
  * feat(decl/syscalls): add openat2 system call test step
  * feat(decl/syscalls): add openat system call test step
  * feat(decl/syscalls): add open system call test step
  * feat(decl/syscalls): add read system call test step
  * feat(decl/syscalls): add write system call test step
  * feat(decl/syscalls): add base system call test step
  * feat(decl/syscalls): add steps builder and syscall steps
    declaration
  * feat(decl/steps): add test steps and steps builder declarations
  * feat(decl/fields): add test step fields abstraction
  * feat(decl/loader): add tests configuration YAML definition and
    loader
  * chore(ci): switch to github provided arm64 runners.
  * update(ci): use arm64 CNCF runners for GH actions
  * chore(lint): apply linter
  * new(linter): add linter for the repository
  * build: fix cross-compilation
  * chore(dockerignore): use white-list approach
  * docs(docs): update commands
  * docs(README.md): update for v0.12</changelog>
</package>
<package pkgid="e65c876b18b4e2e50bdf62cb3d86a1537e86fb901c68155ddd4fe76edafcd53ad5ef8f198e6167bbbb7d68d304858910c8584f9797c2f4b9966ac1e20e8a0bd1" name="falco-event-generator-debugsource" arch="s390x">
  <version epoch="0" ver="0.13.0" rel="1.7"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1716120000">- new package falco-event-generator: Generate a variety of suspect
  actions that are detected by Falco rulesets (but USE WITH
  CAUTION!)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1727956800">- Update to version 0.12.0:
  * increase timeout for
    syscall.DisallowedSSHConnectionNonStandardPort
  * update(events): disable
    PotentialLocalPrivilegeEscalationViaEnvironmentVariablesMisuse
  * update(events): disable JavaProcessClassFileDownload
  * use setup-go v3 gh action with go v1.23.1
  * rename files to be consistent with rules names
  * prevent zombie processes
  * move randomString() to a separate file, allowing build on macos
  * fix: Enhance Falco syscall events triggering and reliability
  * Added an event for default stable rule Detect release_agent
    File Container Escapes
  * Fix: Updated function name to the correct rule name
  * Added an event for polkit local privilege escalation
    ulnerability
  * Added an event for default rule sudo potential privilege
    escalation
  * docs(OWNERS): add alacuku (Aldo Lacuku) to approvers
  * Update events/syscall/mount_launched_in_privileged_container.go
  * adding event for this rule
  * adding an event on interpreted procs inbound network activity
  * adding an event on modify container entrypoint
  * adding an event on triggering rule
  * adding an event on interpreted procs outbound network activity
  * adding event on triggering this rule
  * adding an event on packet_socket_created_in_container
  * adding an event
  * Fix: os.Mkdir("/dev") instead if os.Mkdir("/dev/shm")
  * adding an event for disallowed_ssh_connection_non_standard_port
  * adding an event on reading environment variable from /proc
    files
  * Fix: Ptrace call is detached after a ptrace call with traceme
    argument from child process
  * Added an event for default stable rule ptrace anti debug
    attempt
  * Added documentation for the skipping actions due non-supported
    context
  * Refactor: use return.ErrSkipped to skip actions due to non
    supported context or prerequisite
  * update(pkg/runner/helper): SpawnAsWithSymlink and SpawnAs to
    copy the binary
  * Create a new binary by copying it form existing binary instead
    of creating a new binary
  * Added an event for default stable rule Drop and execute new
    binary in container
  * more explained comment on `why to use IP 169.254.169.254`
  * adding comment on clarification of IP address
  * updated comment
  * corrected an indentation error
  * Update contact_cloud_metadata_service_from_container.go
  * adding an event for contact cloud metadata service from
    container
  * Fix: Event-generator executable is loaded into memory instead
    of go binary
  * Event-generator executable path is now available to actions
  * Debris removed after functionreturn
  * Added an event for fileless execution via memfd create
  * Fix: Created a unique file under tmp dir
  * Added an event for default rule Container Drift Detected
    open+create
  * Fix: Set execute permission on file via writefile instead of
    chmod
  * Refactor command execution to use a dynamic script path and
    also added comments
  * Create /dev/shm if not exists and Remove debris at end
  * Changing the condition to trigger falco rule
  * Code size reduced
  * Created script file in dev shm folder if not exists
  * Added an event for default stable rule execution from dev shm
  * Update and rename launch_remote_file_copy_tool_in_container.go
    to launch_remote_file_copy_tools_in_container.go
  * Update launch_remote_file_copy_tool_in_container.go
  * adding event on launch remote file copy tool in container
  * Fix: Create a unique temp file instead of using any random file
    name
  * Fix: Changed the function name according to name conventions in
    documentation
  * Added an event for default rule set setuid or set setgid bit
  * Refactor: Create a unique temp directory and changed function
    name
  * created a directory and syslog file inside it
  * Added an event for default stable rule clear log activities
  * Update unexpected_udp_traffic.go
  * adding event on unexpected_udp_traffic
  * chore: don't log inside DoNothing helper
  * chore: fix copyright year
  * update(events/helper): add the DoNothing helper
  * Refactor: Just set execute permission on empty file is enough
    trigger the rule
  * Code size reduced
  * Added an event for default rule Container drift detected using
    chmod
  * Update netcat_remote_code_execution_in_container.go
  * adding event on netcat rce in container
  * Fix: Updated comments for better understanding
  * Added an event for default stable rule PTRACE attached to
    process
  * Update launch_suspicious_network_tool_in_container.go
  * Rename launch_network_tool.go to
    launch_suspicious_network_tool_in_container.go
  * Update launch_network_tool.go
  * Update launch_network_tool.go
  * adding an event of launching network tool
  * User uid is set to non zero when generating the event
  * Added an event for default rule
    UnprivilegedDelegationofPageFaultsHandlingtoaUserspaceProcess
  * Switch to a new user such that username is not equal to _apt
  * Added an event for Launch Package Management Process In
    Container
  * Update debugfs_launched_in_privilleged_container.go
  * Update debugfs_launched_in_privilleged_container.go
  * event on debugfs launched in privilleged container
  * Fix: Use MkdirTemp instead of Mkdir to create a unique temp
    directory
  * Now file is created by event generator and reads the shell
    configuration file
  * Added an event for default rule read shell configuration file
  * Added an event for default stable rule find aws credentials
  * Fix: Rule triggers irrsepective of command successful or not
  * Added an event for default rule Detect crypto miners using the
    Stratum protocol
  * Fix: First look whether curl exists or not
  * Refactor: Now http_proxy env variable set only for curl command
    not for entire event generator
  * HTTP_PROXY env variable value is reverted to its original value
    after function return
  * Added an event for default rule program run with diallowed http
    proxy env
  * Fix: createSshDirectoryUnderHome also returns a cleanup
    function
  * Fix: Helper function name changed
  * Refactored code by using  a helper function
    CreateSshDirectoryUnderHome to remove code redundancy
  * Refactored ReadSshInformation function to improve directory
    creation logic
  * Remove the created directory at end
  * Uncommented a line
  * Reduced code size
  * Using temporary data by creating them and removing them after
    completion
  * Added an event for adding ssh keys to authorized keys
  * Refactor: createSshDirectoryUnderHome also returns a cleanup
    function
  * Fix: No need to export internal utilities
  * Fix: Event should be diabled by default as it is not a stable
    rule event
  * Fix: There is no need of for loop as MkdirTemp internally does
    it
  * Added an helper function to create .ssh directory inside home
  * Refactored ReadSshInformation function to improve directory
    creation logic
  * Remove the created directory at end
  * Using temporary data by creating them and removing them after
    completion
  * Added event for default rule read ssh information
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * adding an event for modifying shell configuration file
  * Update events/syscall/delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * adding an event of deleting bash history
  * Fix: First look whether kubectl exists or not
  * Added an event for default rule kubernetes client tool launched
    in container
  * Fix: wget is just enough to trigger the rule
  * Added an event for default rule launch ingress remote file copy
    tools inside container
  * Update decoding_payload_in_container.go
  * Update decoding_payload_in_container.go
  * adding event on triggering rule
  * Update and rename change_namespace_privillege_using_unshare.go
    to change_namespace_privileges_via_unshare.go
  * Update
    events/syscall/change_namespace_privillege_using_unshare.go
  * Update change_namespace_privillege_using_unshare.go
  * adding an event on change_namespace_privilleges_using_unshare
  * Update
    events/syscall/potential_local_privillege_escalation_via_env_var_misuse.go
  * Rename potential_local_privillege_escalation_via_env_var_misuse
    to potential_local_privillege_escalation_via_env_var_misuse.go
  * event on potential local privillefe escalation via env var
    misuse
  * Update events/syscall/launch_suspicious_network_tool_on_host.go
  * Update launch_suspicious_network_tool_on_host.go
  * Rename launch_network_tool_on_host.go to
    launch_suspicious_network_tool_on_host.go
  * adding event on launch network tool on host
  * docs(events/README.md): update conventions
  * Fixed some more broken links
  * Fix broken link by replacing it with valid url
  * fix(events/syscall/remove_bulk_data_from_disk): no new
    variables on left side of :=
  * No need to return error and updated comments
  * Updated comments
  * Added comments for explaination
  * Shred a file instead of directory
  * Update remove_bulk_data_from_disk.go
  * Clean up the temp directory
  * Added event for default stable rule remove bulk data from disk
  * Added event for default rule create hidden file or directory
  * falco: create hardlink over sensitive file event added
  * Removed debris at end
  * Creates directory if it doesnt exist
  * Type in file name
  * Added event for the default rule WriteBelowMonitoredDir
  * Added event for default rule write_below_root
  * Corrected a typo
  * build: upgrade deps</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 0.13.0:
  * docs: add documentation for `suite` and each of its
    sub-commands
  * feat(suite/loader): add forward-reference check for field
    bindings
  * docs(samples): add samples covering each relevant `suite`
    feature
  * ci(.github): bump `docker/build-push-action` to `v7.1.0`
  * ci(.github): bump `docker/setup-qemu-action` to `v4.0.0`
  * ci(.github): bump `actions/checkout` to `v6.0.2`
  * ci(.github): bump `goreleaser/goreleaser-action` to `v7.2.1`
  * ci(.github): bump `docker/setup-buildx-action` to `v4.0.0`
  * ci(.github): bump `docker/login-action` to `v4.1.0`
  * ci(.github): use `ubuntu-24.04` runner everywhere
  * ci(.github): bump `setup-go` and extract go version from
    `go.mod`
  * fix(suite/loader): prevent override of reserved environment
    variables
  * fix(Dockerfile): align base image to `go.mod` Go version
  * fix(suite/cmd/explain): avoid exposing field binding
    description
  * chore(chart): add source chart
  * chore: bump go deps
  * fix(suite/cmd/explain): avoid duplicated node descriptions
  * cve fix
  * docs(suite): add `samples` folder providing some demonstrative
    samples
  * chore: bump CI golangci-lint version and migrate to golangci v2
  * ci(.github): add `/area automation` to PR template
  * docs: update `bench` and `test` documentation
  * feat(cmd)!: use HTTP output instead of gRPC output
  * feat(suite)!: replace gRPC alert retriever with HTTP alert
    retriever
  * docs(OWNERS): move `ekoops` from reviewer to approver
  * cleanup(ci): update github actions hashes
  * feat(suite/step/syscalls): allow to omit `read` `buffer` or
    `len` arg
  * feat(suite/step/syscalls): add arguments constraints support
  * update(.github): switch to multi platform build in one step
  * update(.github/workflows/publish-main.yaml): apply review
    suggetion
  * update(.github): avoid GoReleaser for pushing container images
    for `main`
  * fix(.github/publish-main.yaml): revert unnecessary override
  * fix: enable goreleaser push for `main`
  * new(.github/workflows): publish dev build for `main` branch
  * new: goreleaser config for `main` dev builds
  * feat(suite/cmd/test): output test cases information in report
    encoding
  * docs(OWNERS): add ekoops as reviewer
  * fix(suite/step/syscalls): align `read` and `write` step args
    after run
  * docs(cmd): improve `suite` command description
  * feat(decl): rename `declarative` commands namespace to `suite`
  * feat(decl/container): switch to docker client sdk
  * refactor(decl/syscalls): use composition over function pointers
  * feat(decl/fd/file): create dir hierarchy if not exist
  * feat(decl/fd/directory): create dir hierarchy if not exist
  * refactor: add osutil package
  * refactor(decl/caps): move func setting capabilities to
    capability pkg
  * feat(decl/proc-chain): create proc exe dir hierarchy if not
    exist
  * feat(decl/cmd/test): give a name to alert retriever logger
  * build: bump libcap version
  * refactor(decl/tester): remove unused report encoders code
  * feat(decl/cmd/test): groups test reports by test suite
  * docs: update copyright year to 2025
  * feat(decl/cmd/test): switch to incremental backoff in report
    retrieval
  * feat(decl/suite): add YAML, JSON and text encoders for suite
    reports
  * refactor(decl/suite): split definition from API implementation
  * refactor(decl/suite): move no-rule check logic in suite loader
  * feat(decl/cmd/test): honor ctx cancellation in report
    generation
  * fix(decl/loader): generate documentation for list items
  * feat(decl/loader): add test cases JSON schema
  * feat(decl/loader): add test cases support
  * feat(decl/loader): allow spaces in field binding syntax
  * fix(decl/runners): fix host runner delegation logic
  * feat(decl/cmd/test): introduce `--description-dir` flag
  * feat(decl/cmd/test): allow multiple description file to be
    provided
  * feat(decl/runners): improve host runner logging
  * refactor(decl): improve logging attributes propagation
  * feat(decl/cmd/test): add test suites support
  * feat(decl/suite): add test suites loading support
  * feat(decl/cmd/test): move context from logger name to
    attributes
  * fix(decl/loader): fix steps/resources name uniqueness
    enforcement
  * feat(decl): make rule and expectedOutcome conditionally
    optional
  * fix(decl/cmd/test): wait for goroutines termination upon
    failures
  * feat(decl/cmd/explain): add --format flag and YAML format
    option
  * feat(decl/cmd/explain): add explain command
  * feat(decl/loader): add yaml tag to schema documentation node
  * feat(decl/scripts): replace sh with bash
  * feat(decl/loader): add support for generating documentation
    node tree
  * fix(decl/loader): fix tests expected outcome JSON schema
  * feat(decl/loader): add test resources metadata to JSON schemas
  * feat(decl/loader): add syscall test steps metadata to JSON
    schemas
  * fix(decl/loader): fix field bindings marshaling for nested
    fields
  * feat(decl/loader): replace go-yaml/yaml with goccy/go-yaml
  * feat(decl/loader): set up two-steps unmarshaling via
    mapstructure
  * feat(decl/loader): add validator leveraging JSON schema
  * fix(decl): remove unneeded print statements
  * style(decl): replace interface{} with any
  * fix(decl/syscalls): fix system call argument value parsing
  * fix(decl/syscalls): fix symlinkat system call cleanup logic
  * fix(decl/syscalls): fix dup3 system call cleanup logic
  * fix(decl/syscalls): fix openat2 default arguments
  * feat(decl/syscalls): remove unneeded line in socket syscall
  * fix(decl/syscalls): fix linkat syscall invocation
  * cleanup(decl/cmd/test): clean test command run function
  * feat(decl/process): add process builder
  * cleanup(decl/cmd/test): move runner error logging in separate
    function
  * cleanup(decl/cmd/test): remove unneded if statement
  * feat(decl/cmd/test): omit default process in containerized
    tests
  * feat(decl): enhance process labels propagation system
  * chore(decl): add label package supporting labels handling
  * feat(decl/containers): add containerized test support
  * chore(Dockerfile): replace alpine base images with debian-based
    ones
  * feat(decl/containers): add containerd container builder
  * chore(decl): add container and container builder declaration
  * chore(decl/loader): improve container context definition
  * fix: add missing new line for better visualization of failed
    tests
  * chore(decl/scripts): conditionally disable shell script
    execution
  * fix(decl/loader): fix potential nil ptr deref in context
    validation
  * fix(decl/scripts): fix shell script SIGUSR1 handling
  * feat(decl/proc-chain): add user and capabilities support
  * feat(decl/loader): add user and capabilities fields YAML
    definition
  * chore(decl/caps): add capabilities manipulation package
  * feat(decl/syscalls): add kill system call test step
  * cleanup(decl/syscalls): remove unused ret fields
  * style(decl/loader): change switch style
  * docs(decl/write): fix typo in write system call test step
    comment
  * feat(decl/resources): add process test resource
  * feat(decl/loader): add process resource YAML definition
  * chore(decl): abstract process creation
  * feat(decl/cmd/test): add flag for specifying report output
    encoding
  * feat(decl/tester): add report yaml encoder
  * feat(decl/tester): add report json encoder
  * feat(decl/cmd/run): fallback to test command
  * feat(decl/cmd/test): add test command
  * chore(decl/config): add command shared configuration
  * feat(decl/tester): add tester
  * feat(decl/tester): add report text encoder
  * feat(decl/tester): add tester, report and report encoder
    definition
  * feat(decl/loader): remove unneded custom validation for rule
    name
  * chore(decl/alert): add alert gRPC retriever
  * feat(decl/alert): add alert and alert retriever definitions
  * chore(decl/loader): remove time and output from expected
    outcome
  * chore(decl/loader): rename expected output to expected outcome
  * feat(decl/cmd/run): add default process for empty process
    chains
  * chore(decl): make process context's executable path optional
  * chore(random): move rand sequence gen out of clientServer
    resource
  * feat(decl): add test ID support
  * feat(decl/cmd/run): store flags in command wrapper instance
  * chore(decl): rename process ID to process label and hide the
    flag
  * fix(decl): return error if openMode is negative
  * fix(decl): use SetUint for open_mode uint32 field
  * feat(decl/loader): allow empty test step list
  * feat(decl): add CLI support to run declarative tests
  * feat(decl/log): add logging support through logr and zap
  * feat(decl): rename test configuration to test description
  * feat(decl/runners): add runner builder
  * feat(decl/runners): add host runner
  * feat(decl/runners): add runners and runners builder
    declarations
  * feat(decl/loader): complete process context definition
  * feat(decl/loader): add support for test configuration
    serialization
  * chore(decl/log): add more log context in test and resource
    builders
  * feat(decl/tests): add test builder
  * feat(decl/tests): add test implementation
  * feat(decl/scripts): add test shell scripts support
  * feat(decl/tests): add tests and tests builder declarations
  * feat(decl/resources): add resource builder
  * feat(decl/fd): add memfd fd test resource
  * feat(decl/fd): add inotify fd test resource
  * feat(decl/fd): add eventpoll fd test resource
  * feat(decl/fd): add signalfd fd test resource
  * feat(decl/fd): add event fd test resource
  * feat(decl/fd): add pipe fd test resource
  * feat(decl/fd): add directory fd test resource
  * feat(decl/fd): add file fd test resource
  * feat(decl/loader): add fd resource and subtypes YAML definition
  * chore(decl/loader): move test resource spec decoding out of
    switch
  * fix(decl/loader): fix test steps and resources spec validation
  * cleanup(decl/syscalls): remove print statement in socket run
  * feat(decl/resources): add clientServer test resource
  * feat(decl/resources): add resources and resources builder
    declarations
  * feat(decl/loader): add clientServer resource YAML definition
  * fix(decl/syscalls): simplify arg parsing logic and disable lint
    issues
  * feat(decl/syscalls): add syscall test step builder
  * feat(decl/syscalls): add sendto system call test step
  * feat(decl/syscalls): add socket system call test step
  * feat(decl/syscalls): add connect system call test step
  * feat(decl/syscalls): add dup3 system call test step
  * feat(decl/syscalls): add dup2 system call test step
  * feat(decl/syscalls): add dup system call test step
  * feat(decl/syscalls): add finit_module system call test step
  * feat(decl/syscalls): add init_module system call test step
  * feat(decl/syscalls): add linkat system call test step
  * feat(decl/syscalls): add link system call test step
  * feat(decl/syscalls): add symlinkat system call test step
  * feat(decl/syscalls): add symlink system call test step
  * feat(decl/syscalls): add openat2 system call test step
  * feat(decl/syscalls): add openat system call test step
  * feat(decl/syscalls): add open system call test step
  * feat(decl/syscalls): add read system call test step
  * feat(decl/syscalls): add write system call test step
  * feat(decl/syscalls): add base system call test step
  * feat(decl/syscalls): add steps builder and syscall steps
    declaration
  * feat(decl/steps): add test steps and steps builder declarations
  * feat(decl/fields): add test step fields abstraction
  * feat(decl/loader): add tests configuration YAML definition and
    loader
  * chore(ci): switch to github provided arm64 runners.
  * update(ci): use arm64 CNCF runners for GH actions
  * chore(lint): apply linter
  * new(linter): add linter for the repository
  * build: fix cross-compilation
  * chore(dockerignore): use white-list approach
  * docs(docs): update commands
  * docs(README.md): update for v0.12</changelog>
</package>
<package pkgid="c92a7a3df206557324d6bde0143e2fa4ced9de7fd994264afcb01e44684b90d196fa9945f7a4a03fa150bb203f43ecdc4c2588ddb4385f118220bbe4bf241671" name="falco-event-generator-fish-completion" arch="noarch">
  <version epoch="0" ver="0.13.0" rel="1.7"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1716120000">- new package falco-event-generator: Generate a variety of suspect
  actions that are detected by Falco rulesets (but USE WITH
  CAUTION!)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1727956800">- Update to version 0.12.0:
  * increase timeout for
    syscall.DisallowedSSHConnectionNonStandardPort
  * update(events): disable
    PotentialLocalPrivilegeEscalationViaEnvironmentVariablesMisuse
  * update(events): disable JavaProcessClassFileDownload
  * use setup-go v3 gh action with go v1.23.1
  * rename files to be consistent with rules names
  * prevent zombie processes
  * move randomString() to a separate file, allowing build on macos
  * fix: Enhance Falco syscall events triggering and reliability
  * Added an event for default stable rule Detect release_agent
    File Container Escapes
  * Fix: Updated function name to the correct rule name
  * Added an event for polkit local privilege escalation
    ulnerability
  * Added an event for default rule sudo potential privilege
    escalation
  * docs(OWNERS): add alacuku (Aldo Lacuku) to approvers
  * Update events/syscall/mount_launched_in_privileged_container.go
  * adding event for this rule
  * adding an event on interpreted procs inbound network activity
  * adding an event on modify container entrypoint
  * adding an event on triggering rule
  * adding an event on interpreted procs outbound network activity
  * adding event on triggering this rule
  * adding an event on packet_socket_created_in_container
  * adding an event
  * Fix: os.Mkdir("/dev") instead if os.Mkdir("/dev/shm")
  * adding an event for disallowed_ssh_connection_non_standard_port
  * adding an event on reading environment variable from /proc
    files
  * Fix: Ptrace call is detached after a ptrace call with traceme
    argument from child process
  * Added an event for default stable rule ptrace anti debug
    attempt
  * Added documentation for the skipping actions due non-supported
    context
  * Refactor: use return.ErrSkipped to skip actions due to non
    supported context or prerequisite
  * update(pkg/runner/helper): SpawnAsWithSymlink and SpawnAs to
    copy the binary
  * Create a new binary by copying it form existing binary instead
    of creating a new binary
  * Added an event for default stable rule Drop and execute new
    binary in container
  * more explained comment on `why to use IP 169.254.169.254`
  * adding comment on clarification of IP address
  * updated comment
  * corrected an indentation error
  * Update contact_cloud_metadata_service_from_container.go
  * adding an event for contact cloud metadata service from
    container
  * Fix: Event-generator executable is loaded into memory instead
    of go binary
  * Event-generator executable path is now available to actions
  * Debris removed after functionreturn
  * Added an event for fileless execution via memfd create
  * Fix: Created a unique file under tmp dir
  * Added an event for default rule Container Drift Detected
    open+create
  * Fix: Set execute permission on file via writefile instead of
    chmod
  * Refactor command execution to use a dynamic script path and
    also added comments
  * Create /dev/shm if not exists and Remove debris at end
  * Changing the condition to trigger falco rule
  * Code size reduced
  * Created script file in dev shm folder if not exists
  * Added an event for default stable rule execution from dev shm
  * Update and rename launch_remote_file_copy_tool_in_container.go
    to launch_remote_file_copy_tools_in_container.go
  * Update launch_remote_file_copy_tool_in_container.go
  * adding event on launch remote file copy tool in container
  * Fix: Create a unique temp file instead of using any random file
    name
  * Fix: Changed the function name according to name conventions in
    documentation
  * Added an event for default rule set setuid or set setgid bit
  * Refactor: Create a unique temp directory and changed function
    name
  * created a directory and syslog file inside it
  * Added an event for default stable rule clear log activities
  * Update unexpected_udp_traffic.go
  * adding event on unexpected_udp_traffic
  * chore: don't log inside DoNothing helper
  * chore: fix copyright year
  * update(events/helper): add the DoNothing helper
  * Refactor: Just set execute permission on empty file is enough
    trigger the rule
  * Code size reduced
  * Added an event for default rule Container drift detected using
    chmod
  * Update netcat_remote_code_execution_in_container.go
  * adding event on netcat rce in container
  * Fix: Updated comments for better understanding
  * Added an event for default stable rule PTRACE attached to
    process
  * Update launch_suspicious_network_tool_in_container.go
  * Rename launch_network_tool.go to
    launch_suspicious_network_tool_in_container.go
  * Update launch_network_tool.go
  * Update launch_network_tool.go
  * adding an event of launching network tool
  * User uid is set to non zero when generating the event
  * Added an event for default rule
    UnprivilegedDelegationofPageFaultsHandlingtoaUserspaceProcess
  * Switch to a new user such that username is not equal to _apt
  * Added an event for Launch Package Management Process In
    Container
  * Update debugfs_launched_in_privilleged_container.go
  * Update debugfs_launched_in_privilleged_container.go
  * event on debugfs launched in privilleged container
  * Fix: Use MkdirTemp instead of Mkdir to create a unique temp
    directory
  * Now file is created by event generator and reads the shell
    configuration file
  * Added an event for default rule read shell configuration file
  * Added an event for default stable rule find aws credentials
  * Fix: Rule triggers irrsepective of command successful or not
  * Added an event for default rule Detect crypto miners using the
    Stratum protocol
  * Fix: First look whether curl exists or not
  * Refactor: Now http_proxy env variable set only for curl command
    not for entire event generator
  * HTTP_PROXY env variable value is reverted to its original value
    after function return
  * Added an event for default rule program run with diallowed http
    proxy env
  * Fix: createSshDirectoryUnderHome also returns a cleanup
    function
  * Fix: Helper function name changed
  * Refactored code by using  a helper function
    CreateSshDirectoryUnderHome to remove code redundancy
  * Refactored ReadSshInformation function to improve directory
    creation logic
  * Remove the created directory at end
  * Uncommented a line
  * Reduced code size
  * Using temporary data by creating them and removing them after
    completion
  * Added an event for adding ssh keys to authorized keys
  * Refactor: createSshDirectoryUnderHome also returns a cleanup
    function
  * Fix: No need to export internal utilities
  * Fix: Event should be diabled by default as it is not a stable
    rule event
  * Fix: There is no need of for loop as MkdirTemp internally does
    it
  * Added an helper function to create .ssh directory inside home
  * Refactored ReadSshInformation function to improve directory
    creation logic
  * Remove the created directory at end
  * Using temporary data by creating them and removing them after
    completion
  * Added event for default rule read ssh information
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * adding an event for modifying shell configuration file
  * Update events/syscall/delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * adding an event of deleting bash history
  * Fix: First look whether kubectl exists or not
  * Added an event for default rule kubernetes client tool launched
    in container
  * Fix: wget is just enough to trigger the rule
  * Added an event for default rule launch ingress remote file copy
    tools inside container
  * Update decoding_payload_in_container.go
  * Update decoding_payload_in_container.go
  * adding event on triggering rule
  * Update and rename change_namespace_privillege_using_unshare.go
    to change_namespace_privileges_via_unshare.go
  * Update
    events/syscall/change_namespace_privillege_using_unshare.go
  * Update change_namespace_privillege_using_unshare.go
  * adding an event on change_namespace_privilleges_using_unshare
  * Update
    events/syscall/potential_local_privillege_escalation_via_env_var_misuse.go
  * Rename potential_local_privillege_escalation_via_env_var_misuse
    to potential_local_privillege_escalation_via_env_var_misuse.go
  * event on potential local privillefe escalation via env var
    misuse
  * Update events/syscall/launch_suspicious_network_tool_on_host.go
  * Update launch_suspicious_network_tool_on_host.go
  * Rename launch_network_tool_on_host.go to
    launch_suspicious_network_tool_on_host.go
  * adding event on launch network tool on host
  * docs(events/README.md): update conventions
  * Fixed some more broken links
  * Fix broken link by replacing it with valid url
  * fix(events/syscall/remove_bulk_data_from_disk): no new
    variables on left side of :=
  * No need to return error and updated comments
  * Updated comments
  * Added comments for explaination
  * Shred a file instead of directory
  * Update remove_bulk_data_from_disk.go
  * Clean up the temp directory
  * Added event for default stable rule remove bulk data from disk
  * Added event for default rule create hidden file or directory
  * falco: create hardlink over sensitive file event added
  * Removed debris at end
  * Creates directory if it doesnt exist
  * Type in file name
  * Added event for the default rule WriteBelowMonitoredDir
  * Added event for default rule write_below_root
  * Corrected a typo
  * build: upgrade deps</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 0.13.0:
  * docs: add documentation for `suite` and each of its
    sub-commands
  * feat(suite/loader): add forward-reference check for field
    bindings
  * docs(samples): add samples covering each relevant `suite`
    feature
  * ci(.github): bump `docker/build-push-action` to `v7.1.0`
  * ci(.github): bump `docker/setup-qemu-action` to `v4.0.0`
  * ci(.github): bump `actions/checkout` to `v6.0.2`
  * ci(.github): bump `goreleaser/goreleaser-action` to `v7.2.1`
  * ci(.github): bump `docker/setup-buildx-action` to `v4.0.0`
  * ci(.github): bump `docker/login-action` to `v4.1.0`
  * ci(.github): use `ubuntu-24.04` runner everywhere
  * ci(.github): bump `setup-go` and extract go version from
    `go.mod`
  * fix(suite/loader): prevent override of reserved environment
    variables
  * fix(Dockerfile): align base image to `go.mod` Go version
  * fix(suite/cmd/explain): avoid exposing field binding
    description
  * chore(chart): add source chart
  * chore: bump go deps
  * fix(suite/cmd/explain): avoid duplicated node descriptions
  * cve fix
  * docs(suite): add `samples` folder providing some demonstrative
    samples
  * chore: bump CI golangci-lint version and migrate to golangci v2
  * ci(.github): add `/area automation` to PR template
  * docs: update `bench` and `test` documentation
  * feat(cmd)!: use HTTP output instead of gRPC output
  * feat(suite)!: replace gRPC alert retriever with HTTP alert
    retriever
  * docs(OWNERS): move `ekoops` from reviewer to approver
  * cleanup(ci): update github actions hashes
  * feat(suite/step/syscalls): allow to omit `read` `buffer` or
    `len` arg
  * feat(suite/step/syscalls): add arguments constraints support
  * update(.github): switch to multi platform build in one step
  * update(.github/workflows/publish-main.yaml): apply review
    suggetion
  * update(.github): avoid GoReleaser for pushing container images
    for `main`
  * fix(.github/publish-main.yaml): revert unnecessary override
  * fix: enable goreleaser push for `main`
  * new(.github/workflows): publish dev build for `main` branch
  * new: goreleaser config for `main` dev builds
  * feat(suite/cmd/test): output test cases information in report
    encoding
  * docs(OWNERS): add ekoops as reviewer
  * fix(suite/step/syscalls): align `read` and `write` step args
    after run
  * docs(cmd): improve `suite` command description
  * feat(decl): rename `declarative` commands namespace to `suite`
  * feat(decl/container): switch to docker client sdk
  * refactor(decl/syscalls): use composition over function pointers
  * feat(decl/fd/file): create dir hierarchy if not exist
  * feat(decl/fd/directory): create dir hierarchy if not exist
  * refactor: add osutil package
  * refactor(decl/caps): move func setting capabilities to
    capability pkg
  * feat(decl/proc-chain): create proc exe dir hierarchy if not
    exist
  * feat(decl/cmd/test): give a name to alert retriever logger
  * build: bump libcap version
  * refactor(decl/tester): remove unused report encoders code
  * feat(decl/cmd/test): groups test reports by test suite
  * docs: update copyright year to 2025
  * feat(decl/cmd/test): switch to incremental backoff in report
    retrieval
  * feat(decl/suite): add YAML, JSON and text encoders for suite
    reports
  * refactor(decl/suite): split definition from API implementation
  * refactor(decl/suite): move no-rule check logic in suite loader
  * feat(decl/cmd/test): honor ctx cancellation in report
    generation
  * fix(decl/loader): generate documentation for list items
  * feat(decl/loader): add test cases JSON schema
  * feat(decl/loader): add test cases support
  * feat(decl/loader): allow spaces in field binding syntax
  * fix(decl/runners): fix host runner delegation logic
  * feat(decl/cmd/test): introduce `--description-dir` flag
  * feat(decl/cmd/test): allow multiple description file to be
    provided
  * feat(decl/runners): improve host runner logging
  * refactor(decl): improve logging attributes propagation
  * feat(decl/cmd/test): add test suites support
  * feat(decl/suite): add test suites loading support
  * feat(decl/cmd/test): move context from logger name to
    attributes
  * fix(decl/loader): fix steps/resources name uniqueness
    enforcement
  * feat(decl): make rule and expectedOutcome conditionally
    optional
  * fix(decl/cmd/test): wait for goroutines termination upon
    failures
  * feat(decl/cmd/explain): add --format flag and YAML format
    option
  * feat(decl/cmd/explain): add explain command
  * feat(decl/loader): add yaml tag to schema documentation node
  * feat(decl/scripts): replace sh with bash
  * feat(decl/loader): add support for generating documentation
    node tree
  * fix(decl/loader): fix tests expected outcome JSON schema
  * feat(decl/loader): add test resources metadata to JSON schemas
  * feat(decl/loader): add syscall test steps metadata to JSON
    schemas
  * fix(decl/loader): fix field bindings marshaling for nested
    fields
  * feat(decl/loader): replace go-yaml/yaml with goccy/go-yaml
  * feat(decl/loader): set up two-steps unmarshaling via
    mapstructure
  * feat(decl/loader): add validator leveraging JSON schema
  * fix(decl): remove unneeded print statements
  * style(decl): replace interface{} with any
  * fix(decl/syscalls): fix system call argument value parsing
  * fix(decl/syscalls): fix symlinkat system call cleanup logic
  * fix(decl/syscalls): fix dup3 system call cleanup logic
  * fix(decl/syscalls): fix openat2 default arguments
  * feat(decl/syscalls): remove unneeded line in socket syscall
  * fix(decl/syscalls): fix linkat syscall invocation
  * cleanup(decl/cmd/test): clean test command run function
  * feat(decl/process): add process builder
  * cleanup(decl/cmd/test): move runner error logging in separate
    function
  * cleanup(decl/cmd/test): remove unneded if statement
  * feat(decl/cmd/test): omit default process in containerized
    tests
  * feat(decl): enhance process labels propagation system
  * chore(decl): add label package supporting labels handling
  * feat(decl/containers): add containerized test support
  * chore(Dockerfile): replace alpine base images with debian-based
    ones
  * feat(decl/containers): add containerd container builder
  * chore(decl): add container and container builder declaration
  * chore(decl/loader): improve container context definition
  * fix: add missing new line for better visualization of failed
    tests
  * chore(decl/scripts): conditionally disable shell script
    execution
  * fix(decl/loader): fix potential nil ptr deref in context
    validation
  * fix(decl/scripts): fix shell script SIGUSR1 handling
  * feat(decl/proc-chain): add user and capabilities support
  * feat(decl/loader): add user and capabilities fields YAML
    definition
  * chore(decl/caps): add capabilities manipulation package
  * feat(decl/syscalls): add kill system call test step
  * cleanup(decl/syscalls): remove unused ret fields
  * style(decl/loader): change switch style
  * docs(decl/write): fix typo in write system call test step
    comment
  * feat(decl/resources): add process test resource
  * feat(decl/loader): add process resource YAML definition
  * chore(decl): abstract process creation
  * feat(decl/cmd/test): add flag for specifying report output
    encoding
  * feat(decl/tester): add report yaml encoder
  * feat(decl/tester): add report json encoder
  * feat(decl/cmd/run): fallback to test command
  * feat(decl/cmd/test): add test command
  * chore(decl/config): add command shared configuration
  * feat(decl/tester): add tester
  * feat(decl/tester): add report text encoder
  * feat(decl/tester): add tester, report and report encoder
    definition
  * feat(decl/loader): remove unneded custom validation for rule
    name
  * chore(decl/alert): add alert gRPC retriever
  * feat(decl/alert): add alert and alert retriever definitions
  * chore(decl/loader): remove time and output from expected
    outcome
  * chore(decl/loader): rename expected output to expected outcome
  * feat(decl/cmd/run): add default process for empty process
    chains
  * chore(decl): make process context's executable path optional
  * chore(random): move rand sequence gen out of clientServer
    resource
  * feat(decl): add test ID support
  * feat(decl/cmd/run): store flags in command wrapper instance
  * chore(decl): rename process ID to process label and hide the
    flag
  * fix(decl): return error if openMode is negative
  * fix(decl): use SetUint for open_mode uint32 field
  * feat(decl/loader): allow empty test step list
  * feat(decl): add CLI support to run declarative tests
  * feat(decl/log): add logging support through logr and zap
  * feat(decl): rename test configuration to test description
  * feat(decl/runners): add runner builder
  * feat(decl/runners): add host runner
  * feat(decl/runners): add runners and runners builder
    declarations
  * feat(decl/loader): complete process context definition
  * feat(decl/loader): add support for test configuration
    serialization
  * chore(decl/log): add more log context in test and resource
    builders
  * feat(decl/tests): add test builder
  * feat(decl/tests): add test implementation
  * feat(decl/scripts): add test shell scripts support
  * feat(decl/tests): add tests and tests builder declarations
  * feat(decl/resources): add resource builder
  * feat(decl/fd): add memfd fd test resource
  * feat(decl/fd): add inotify fd test resource
  * feat(decl/fd): add eventpoll fd test resource
  * feat(decl/fd): add signalfd fd test resource
  * feat(decl/fd): add event fd test resource
  * feat(decl/fd): add pipe fd test resource
  * feat(decl/fd): add directory fd test resource
  * feat(decl/fd): add file fd test resource
  * feat(decl/loader): add fd resource and subtypes YAML definition
  * chore(decl/loader): move test resource spec decoding out of
    switch
  * fix(decl/loader): fix test steps and resources spec validation
  * cleanup(decl/syscalls): remove print statement in socket run
  * feat(decl/resources): add clientServer test resource
  * feat(decl/resources): add resources and resources builder
    declarations
  * feat(decl/loader): add clientServer resource YAML definition
  * fix(decl/syscalls): simplify arg parsing logic and disable lint
    issues
  * feat(decl/syscalls): add syscall test step builder
  * feat(decl/syscalls): add sendto system call test step
  * feat(decl/syscalls): add socket system call test step
  * feat(decl/syscalls): add connect system call test step
  * feat(decl/syscalls): add dup3 system call test step
  * feat(decl/syscalls): add dup2 system call test step
  * feat(decl/syscalls): add dup system call test step
  * feat(decl/syscalls): add finit_module system call test step
  * feat(decl/syscalls): add init_module system call test step
  * feat(decl/syscalls): add linkat system call test step
  * feat(decl/syscalls): add link system call test step
  * feat(decl/syscalls): add symlinkat system call test step
  * feat(decl/syscalls): add symlink system call test step
  * feat(decl/syscalls): add openat2 system call test step
  * feat(decl/syscalls): add openat system call test step
  * feat(decl/syscalls): add open system call test step
  * feat(decl/syscalls): add read system call test step
  * feat(decl/syscalls): add write system call test step
  * feat(decl/syscalls): add base system call test step
  * feat(decl/syscalls): add steps builder and syscall steps
    declaration
  * feat(decl/steps): add test steps and steps builder declarations
  * feat(decl/fields): add test step fields abstraction
  * feat(decl/loader): add tests configuration YAML definition and
    loader
  * chore(ci): switch to github provided arm64 runners.
  * update(ci): use arm64 CNCF runners for GH actions
  * chore(lint): apply linter
  * new(linter): add linter for the repository
  * build: fix cross-compilation
  * chore(dockerignore): use white-list approach
  * docs(docs): update commands
  * docs(README.md): update for v0.12</changelog>
</package>
<package pkgid="cadcaef0d801b744de2f3d65523dd11a240caf1e5a168c8b22c2b3a41e02c1f78ea17d7329a76e2bd8e7304d37768632a5e13999a74a6a0056e3a1a4217c1c9b" name="falco-event-generator-zsh-completion" arch="noarch">
  <version epoch="0" ver="0.13.0" rel="1.7"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1716120000">- new package falco-event-generator: Generate a variety of suspect
  actions that are detected by Falco rulesets (but USE WITH
  CAUTION!)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1727956800">- Update to version 0.12.0:
  * increase timeout for
    syscall.DisallowedSSHConnectionNonStandardPort
  * update(events): disable
    PotentialLocalPrivilegeEscalationViaEnvironmentVariablesMisuse
  * update(events): disable JavaProcessClassFileDownload
  * use setup-go v3 gh action with go v1.23.1
  * rename files to be consistent with rules names
  * prevent zombie processes
  * move randomString() to a separate file, allowing build on macos
  * fix: Enhance Falco syscall events triggering and reliability
  * Added an event for default stable rule Detect release_agent
    File Container Escapes
  * Fix: Updated function name to the correct rule name
  * Added an event for polkit local privilege escalation
    ulnerability
  * Added an event for default rule sudo potential privilege
    escalation
  * docs(OWNERS): add alacuku (Aldo Lacuku) to approvers
  * Update events/syscall/mount_launched_in_privileged_container.go
  * adding event for this rule
  * adding an event on interpreted procs inbound network activity
  * adding an event on modify container entrypoint
  * adding an event on triggering rule
  * adding an event on interpreted procs outbound network activity
  * adding event on triggering this rule
  * adding an event on packet_socket_created_in_container
  * adding an event
  * Fix: os.Mkdir("/dev") instead if os.Mkdir("/dev/shm")
  * adding an event for disallowed_ssh_connection_non_standard_port
  * adding an event on reading environment variable from /proc
    files
  * Fix: Ptrace call is detached after a ptrace call with traceme
    argument from child process
  * Added an event for default stable rule ptrace anti debug
    attempt
  * Added documentation for the skipping actions due non-supported
    context
  * Refactor: use return.ErrSkipped to skip actions due to non
    supported context or prerequisite
  * update(pkg/runner/helper): SpawnAsWithSymlink and SpawnAs to
    copy the binary
  * Create a new binary by copying it form existing binary instead
    of creating a new binary
  * Added an event for default stable rule Drop and execute new
    binary in container
  * more explained comment on `why to use IP 169.254.169.254`
  * adding comment on clarification of IP address
  * updated comment
  * corrected an indentation error
  * Update contact_cloud_metadata_service_from_container.go
  * adding an event for contact cloud metadata service from
    container
  * Fix: Event-generator executable is loaded into memory instead
    of go binary
  * Event-generator executable path is now available to actions
  * Debris removed after functionreturn
  * Added an event for fileless execution via memfd create
  * Fix: Created a unique file under tmp dir
  * Added an event for default rule Container Drift Detected
    open+create
  * Fix: Set execute permission on file via writefile instead of
    chmod
  * Refactor command execution to use a dynamic script path and
    also added comments
  * Create /dev/shm if not exists and Remove debris at end
  * Changing the condition to trigger falco rule
  * Code size reduced
  * Created script file in dev shm folder if not exists
  * Added an event for default stable rule execution from dev shm
  * Update and rename launch_remote_file_copy_tool_in_container.go
    to launch_remote_file_copy_tools_in_container.go
  * Update launch_remote_file_copy_tool_in_container.go
  * adding event on launch remote file copy tool in container
  * Fix: Create a unique temp file instead of using any random file
    name
  * Fix: Changed the function name according to name conventions in
    documentation
  * Added an event for default rule set setuid or set setgid bit
  * Refactor: Create a unique temp directory and changed function
    name
  * created a directory and syslog file inside it
  * Added an event for default stable rule clear log activities
  * Update unexpected_udp_traffic.go
  * adding event on unexpected_udp_traffic
  * chore: don't log inside DoNothing helper
  * chore: fix copyright year
  * update(events/helper): add the DoNothing helper
  * Refactor: Just set execute permission on empty file is enough
    trigger the rule
  * Code size reduced
  * Added an event for default rule Container drift detected using
    chmod
  * Update netcat_remote_code_execution_in_container.go
  * adding event on netcat rce in container
  * Fix: Updated comments for better understanding
  * Added an event for default stable rule PTRACE attached to
    process
  * Update launch_suspicious_network_tool_in_container.go
  * Rename launch_network_tool.go to
    launch_suspicious_network_tool_in_container.go
  * Update launch_network_tool.go
  * Update launch_network_tool.go
  * adding an event of launching network tool
  * User uid is set to non zero when generating the event
  * Added an event for default rule
    UnprivilegedDelegationofPageFaultsHandlingtoaUserspaceProcess
  * Switch to a new user such that username is not equal to _apt
  * Added an event for Launch Package Management Process In
    Container
  * Update debugfs_launched_in_privilleged_container.go
  * Update debugfs_launched_in_privilleged_container.go
  * event on debugfs launched in privilleged container
  * Fix: Use MkdirTemp instead of Mkdir to create a unique temp
    directory
  * Now file is created by event generator and reads the shell
    configuration file
  * Added an event for default rule read shell configuration file
  * Added an event for default stable rule find aws credentials
  * Fix: Rule triggers irrsepective of command successful or not
  * Added an event for default rule Detect crypto miners using the
    Stratum protocol
  * Fix: First look whether curl exists or not
  * Refactor: Now http_proxy env variable set only for curl command
    not for entire event generator
  * HTTP_PROXY env variable value is reverted to its original value
    after function return
  * Added an event for default rule program run with diallowed http
    proxy env
  * Fix: createSshDirectoryUnderHome also returns a cleanup
    function
  * Fix: Helper function name changed
  * Refactored code by using  a helper function
    CreateSshDirectoryUnderHome to remove code redundancy
  * Refactored ReadSshInformation function to improve directory
    creation logic
  * Remove the created directory at end
  * Uncommented a line
  * Reduced code size
  * Using temporary data by creating them and removing them after
    completion
  * Added an event for adding ssh keys to authorized keys
  * Refactor: createSshDirectoryUnderHome also returns a cleanup
    function
  * Fix: No need to export internal utilities
  * Fix: Event should be diabled by default as it is not a stable
    rule event
  * Fix: There is no need of for loop as MkdirTemp internally does
    it
  * Added an helper function to create .ssh directory inside home
  * Refactored ReadSshInformation function to improve directory
    creation logic
  * Remove the created directory at end
  * Using temporary data by creating them and removing them after
    completion
  * Added event for default rule read ssh information
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * Update modify_shell_configuration_file.go
  * adding an event for modifying shell configuration file
  * Update events/syscall/delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * Update delete_or_rename_shell_history.go
  * adding an event of deleting bash history
  * Fix: First look whether kubectl exists or not
  * Added an event for default rule kubernetes client tool launched
    in container
  * Fix: wget is just enough to trigger the rule
  * Added an event for default rule launch ingress remote file copy
    tools inside container
  * Update decoding_payload_in_container.go
  * Update decoding_payload_in_container.go
  * adding event on triggering rule
  * Update and rename change_namespace_privillege_using_unshare.go
    to change_namespace_privileges_via_unshare.go
  * Update
    events/syscall/change_namespace_privillege_using_unshare.go
  * Update change_namespace_privillege_using_unshare.go
  * adding an event on change_namespace_privilleges_using_unshare
  * Update
    events/syscall/potential_local_privillege_escalation_via_env_var_misuse.go
  * Rename potential_local_privillege_escalation_via_env_var_misuse
    to potential_local_privillege_escalation_via_env_var_misuse.go
  * event on potential local privillefe escalation via env var
    misuse
  * Update events/syscall/launch_suspicious_network_tool_on_host.go
  * Update launch_suspicious_network_tool_on_host.go
  * Rename launch_network_tool_on_host.go to
    launch_suspicious_network_tool_on_host.go
  * adding event on launch network tool on host
  * docs(events/README.md): update conventions
  * Fixed some more broken links
  * Fix broken link by replacing it with valid url
  * fix(events/syscall/remove_bulk_data_from_disk): no new
    variables on left side of :=
  * No need to return error and updated comments
  * Updated comments
  * Added comments for explaination
  * Shred a file instead of directory
  * Update remove_bulk_data_from_disk.go
  * Clean up the temp directory
  * Added event for default stable rule remove bulk data from disk
  * Added event for default rule create hidden file or directory
  * falco: create hardlink over sensitive file event added
  * Removed debris at end
  * Creates directory if it doesnt exist
  * Type in file name
  * Added event for the default rule WriteBelowMonitoredDir
  * Added event for default rule write_below_root
  * Corrected a typo
  * build: upgrade deps</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 0.13.0:
  * docs: add documentation for `suite` and each of its
    sub-commands
  * feat(suite/loader): add forward-reference check for field
    bindings
  * docs(samples): add samples covering each relevant `suite`
    feature
  * ci(.github): bump `docker/build-push-action` to `v7.1.0`
  * ci(.github): bump `docker/setup-qemu-action` to `v4.0.0`
  * ci(.github): bump `actions/checkout` to `v6.0.2`
  * ci(.github): bump `goreleaser/goreleaser-action` to `v7.2.1`
  * ci(.github): bump `docker/setup-buildx-action` to `v4.0.0`
  * ci(.github): bump `docker/login-action` to `v4.1.0`
  * ci(.github): use `ubuntu-24.04` runner everywhere
  * ci(.github): bump `setup-go` and extract go version from
    `go.mod`
  * fix(suite/loader): prevent override of reserved environment
    variables
  * fix(Dockerfile): align base image to `go.mod` Go version
  * fix(suite/cmd/explain): avoid exposing field binding
    description
  * chore(chart): add source chart
  * chore: bump go deps
  * fix(suite/cmd/explain): avoid duplicated node descriptions
  * cve fix
  * docs(suite): add `samples` folder providing some demonstrative
    samples
  * chore: bump CI golangci-lint version and migrate to golangci v2
  * ci(.github): add `/area automation` to PR template
  * docs: update `bench` and `test` documentation
  * feat(cmd)!: use HTTP output instead of gRPC output
  * feat(suite)!: replace gRPC alert retriever with HTTP alert
    retriever
  * docs(OWNERS): move `ekoops` from reviewer to approver
  * cleanup(ci): update github actions hashes
  * feat(suite/step/syscalls): allow to omit `read` `buffer` or
    `len` arg
  * feat(suite/step/syscalls): add arguments constraints support
  * update(.github): switch to multi platform build in one step
  * update(.github/workflows/publish-main.yaml): apply review
    suggetion
  * update(.github): avoid GoReleaser for pushing container images
    for `main`
  * fix(.github/publish-main.yaml): revert unnecessary override
  * fix: enable goreleaser push for `main`
  * new(.github/workflows): publish dev build for `main` branch
  * new: goreleaser config for `main` dev builds
  * feat(suite/cmd/test): output test cases information in report
    encoding
  * docs(OWNERS): add ekoops as reviewer
  * fix(suite/step/syscalls): align `read` and `write` step args
    after run
  * docs(cmd): improve `suite` command description
  * feat(decl): rename `declarative` commands namespace to `suite`
  * feat(decl/container): switch to docker client sdk
  * refactor(decl/syscalls): use composition over function pointers
  * feat(decl/fd/file): create dir hierarchy if not exist
  * feat(decl/fd/directory): create dir hierarchy if not exist
  * refactor: add osutil package
  * refactor(decl/caps): move func setting capabilities to
    capability pkg
  * feat(decl/proc-chain): create proc exe dir hierarchy if not
    exist
  * feat(decl/cmd/test): give a name to alert retriever logger
  * build: bump libcap version
  * refactor(decl/tester): remove unused report encoders code
  * feat(decl/cmd/test): groups test reports by test suite
  * docs: update copyright year to 2025
  * feat(decl/cmd/test): switch to incremental backoff in report
    retrieval
  * feat(decl/suite): add YAML, JSON and text encoders for suite
    reports
  * refactor(decl/suite): split definition from API implementation
  * refactor(decl/suite): move no-rule check logic in suite loader
  * feat(decl/cmd/test): honor ctx cancellation in report
    generation
  * fix(decl/loader): generate documentation for list items
  * feat(decl/loader): add test cases JSON schema
  * feat(decl/loader): add test cases support
  * feat(decl/loader): allow spaces in field binding syntax
  * fix(decl/runners): fix host runner delegation logic
  * feat(decl/cmd/test): introduce `--description-dir` flag
  * feat(decl/cmd/test): allow multiple description file to be
    provided
  * feat(decl/runners): improve host runner logging
  * refactor(decl): improve logging attributes propagation
  * feat(decl/cmd/test): add test suites support
  * feat(decl/suite): add test suites loading support
  * feat(decl/cmd/test): move context from logger name to
    attributes
  * fix(decl/loader): fix steps/resources name uniqueness
    enforcement
  * feat(decl): make rule and expectedOutcome conditionally
    optional
  * fix(decl/cmd/test): wait for goroutines termination upon
    failures
  * feat(decl/cmd/explain): add --format flag and YAML format
    option
  * feat(decl/cmd/explain): add explain command
  * feat(decl/loader): add yaml tag to schema documentation node
  * feat(decl/scripts): replace sh with bash
  * feat(decl/loader): add support for generating documentation
    node tree
  * fix(decl/loader): fix tests expected outcome JSON schema
  * feat(decl/loader): add test resources metadata to JSON schemas
  * feat(decl/loader): add syscall test steps metadata to JSON
    schemas
  * fix(decl/loader): fix field bindings marshaling for nested
    fields
  * feat(decl/loader): replace go-yaml/yaml with goccy/go-yaml
  * feat(decl/loader): set up two-steps unmarshaling via
    mapstructure
  * feat(decl/loader): add validator leveraging JSON schema
  * fix(decl): remove unneeded print statements
  * style(decl): replace interface{} with any
  * fix(decl/syscalls): fix system call argument value parsing
  * fix(decl/syscalls): fix symlinkat system call cleanup logic
  * fix(decl/syscalls): fix dup3 system call cleanup logic
  * fix(decl/syscalls): fix openat2 default arguments
  * feat(decl/syscalls): remove unneeded line in socket syscall
  * fix(decl/syscalls): fix linkat syscall invocation
  * cleanup(decl/cmd/test): clean test command run function
  * feat(decl/process): add process builder
  * cleanup(decl/cmd/test): move runner error logging in separate
    function
  * cleanup(decl/cmd/test): remove unneded if statement
  * feat(decl/cmd/test): omit default process in containerized
    tests
  * feat(decl): enhance process labels propagation system
  * chore(decl): add label package supporting labels handling
  * feat(decl/containers): add containerized test support
  * chore(Dockerfile): replace alpine base images with debian-based
    ones
  * feat(decl/containers): add containerd container builder
  * chore(decl): add container and container builder declaration
  * chore(decl/loader): improve container context definition
  * fix: add missing new line for better visualization of failed
    tests
  * chore(decl/scripts): conditionally disable shell script
    execution
  * fix(decl/loader): fix potential nil ptr deref in context
    validation
  * fix(decl/scripts): fix shell script SIGUSR1 handling
  * feat(decl/proc-chain): add user and capabilities support
  * feat(decl/loader): add user and capabilities fields YAML
    definition
  * chore(decl/caps): add capabilities manipulation package
  * feat(decl/syscalls): add kill system call test step
  * cleanup(decl/syscalls): remove unused ret fields
  * style(decl/loader): change switch style
  * docs(decl/write): fix typo in write system call test step
    comment
  * feat(decl/resources): add process test resource
  * feat(decl/loader): add process resource YAML definition
  * chore(decl): abstract process creation
  * feat(decl/cmd/test): add flag for specifying report output
    encoding
  * feat(decl/tester): add report yaml encoder
  * feat(decl/tester): add report json encoder
  * feat(decl/cmd/run): fallback to test command
  * feat(decl/cmd/test): add test command
  * chore(decl/config): add command shared configuration
  * feat(decl/tester): add tester
  * feat(decl/tester): add report text encoder
  * feat(decl/tester): add tester, report and report encoder
    definition
  * feat(decl/loader): remove unneded custom validation for rule
    name
  * chore(decl/alert): add alert gRPC retriever
  * feat(decl/alert): add alert and alert retriever definitions
  * chore(decl/loader): remove time and output from expected
    outcome
  * chore(decl/loader): rename expected output to expected outcome
  * feat(decl/cmd/run): add default process for empty process
    chains
  * chore(decl): make process context's executable path optional
  * chore(random): move rand sequence gen out of clientServer
    resource
  * feat(decl): add test ID support
  * feat(decl/cmd/run): store flags in command wrapper instance
  * chore(decl): rename process ID to process label and hide the
    flag
  * fix(decl): return error if openMode is negative
  * fix(decl): use SetUint for open_mode uint32 field
  * feat(decl/loader): allow empty test step list
  * feat(decl): add CLI support to run declarative tests
  * feat(decl/log): add logging support through logr and zap
  * feat(decl): rename test configuration to test description
  * feat(decl/runners): add runner builder
  * feat(decl/runners): add host runner
  * feat(decl/runners): add runners and runners builder
    declarations
  * feat(decl/loader): complete process context definition
  * feat(decl/loader): add support for test configuration
    serialization
  * chore(decl/log): add more log context in test and resource
    builders
  * feat(decl/tests): add test builder
  * feat(decl/tests): add test implementation
  * feat(decl/scripts): add test shell scripts support
  * feat(decl/tests): add tests and tests builder declarations
  * feat(decl/resources): add resource builder
  * feat(decl/fd): add memfd fd test resource
  * feat(decl/fd): add inotify fd test resource
  * feat(decl/fd): add eventpoll fd test resource
  * feat(decl/fd): add signalfd fd test resource
  * feat(decl/fd): add event fd test resource
  * feat(decl/fd): add pipe fd test resource
  * feat(decl/fd): add directory fd test resource
  * feat(decl/fd): add file fd test resource
  * feat(decl/loader): add fd resource and subtypes YAML definition
  * chore(decl/loader): move test resource spec decoding out of
    switch
  * fix(decl/loader): fix test steps and resources spec validation
  * cleanup(decl/syscalls): remove print statement in socket run
  * feat(decl/resources): add clientServer test resource
  * feat(decl/resources): add resources and resources builder
    declarations
  * feat(decl/loader): add clientServer resource YAML definition
  * fix(decl/syscalls): simplify arg parsing logic and disable lint
    issues
  * feat(decl/syscalls): add syscall test step builder
  * feat(decl/syscalls): add sendto system call test step
  * feat(decl/syscalls): add socket system call test step
  * feat(decl/syscalls): add connect system call test step
  * feat(decl/syscalls): add dup3 system call test step
  * feat(decl/syscalls): add dup2 system call test step
  * feat(decl/syscalls): add dup system call test step
  * feat(decl/syscalls): add finit_module system call test step
  * feat(decl/syscalls): add init_module system call test step
  * feat(decl/syscalls): add linkat system call test step
  * feat(decl/syscalls): add link system call test step
  * feat(decl/syscalls): add symlinkat system call test step
  * feat(decl/syscalls): add symlink system call test step
  * feat(decl/syscalls): add openat2 system call test step
  * feat(decl/syscalls): add openat system call test step
  * feat(decl/syscalls): add open system call test step
  * feat(decl/syscalls): add read system call test step
  * feat(decl/syscalls): add write system call test step
  * feat(decl/syscalls): add base system call test step
  * feat(decl/syscalls): add steps builder and syscall steps
    declaration
  * feat(decl/steps): add test steps and steps builder declarations
  * feat(decl/fields): add test step fields abstraction
  * feat(decl/loader): add tests configuration YAML definition and
    loader
  * chore(ci): switch to github provided arm64 runners.
  * update(ci): use arm64 CNCF runners for GH actions
  * chore(lint): apply linter
  * new(linter): add linter for the repository
  * build: fix cross-compilation
  * chore(dockerignore): use white-list approach
  * docs(docs): update commands
  * docs(README.md): update for v0.12</changelog>
</package>
<package pkgid="3078b7304634aa17a0fcf9ace26929a2600ba4f3366532eb7c348ab4152fcb263a521a36d7067933b5511234db0a5f7da85b8bbe8f0996da584fab5ab9a903ec" name="falcoctl" arch="s390x">
  <version epoch="0" ver="0.13.0" rel="27.9"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1706875200">- new package falcoctl: CLI for the Falco Cloud Native Runtime
  Security solution</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1707739200">- Update to version 0.7.2:
  * bumped helper message
  * added http-header option in driver download
  * chore(pkg/driver): ubuntu has its own specific FixupKernel
    logic now.
  * fix(pkg/driver): fixed generic kernelversion fixup method.
  * pkg/driver/flatcar: Update the script
  * fix: Dead link in PR template
  * chore(cmd): fixed up some strings.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1708776000">- Update to version 0.7.3:
  * fix(CI): add permissions to login-to-amazon-ecr job
  * new(ci): add provenance for main tag
  * fix(CI): properly get credentials for amazon ecr registry
  * new(CI): add provenance for ecr image
  * fix(ci): add permissions for AWS ecr
  * new(CI): add ecr repository</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717243200">- Update to version 0.8.0:
  * add dependabot config and update golangci-lint by @cpanato in
    [#385]
  * chore(cmd): fixed up some strings. by @FedeDP in #407
  * fix: fixed go.sum entry to fix build. by @FedeDP in #415
  * feat: adding support for KMS in cosign by @brennoo in #416
  * fix: Dead link in PR template by @krnowak in #424
  * pkg/driver/flatcar: Update the script by @krnowak in #425
  * fix(pkg/driver): fixed generic kernelversion fixup method. by
    @FedeDP in #427
  * new(cmd/driver): support user provided headers option for
    driver download by @toamto94 in #428
  * fix(pusher): correctly report artifact type by @alacuku in #442
  * Remove extra '$' character. by @thejefflarson in #458
  * feat(cmd/push): parse requirements and deps from rulesfile by
    @alacuku in #467
  * update(cmd): bumped oras to v.2.4.0. by @FedeDP in #478
  * fix(registry/push): correctly remove temporary dir by @alacuku
    in #479
  * update(tests/push): add new tests for push command by @alacuku
    in #486
  * new: driver selection logic by @FedeDP in #484
  * new(pkg/driver): try to fetch kernel headers leveraging
    driverkit library when building drivers by @FedeDP in #476
  * chore(cmd,pkg,internal): switch to use oras-go credentials
    package since oras-go-credentials is deprecated by @FedeDP in
    [#496]
  * chore(cmd/push): uniform receiver for push command by @alacuku
    in #498
  * fix(pkg/driver): fixup kernel headers download by @FedeDP in
    [#499]
  * fix(artifact/info): filter out signature tags by @alacuku in
    [#507]
  * vote: docs(OWNERS): add alacuku (Aldo Lacuku) to approvers by
    @alacuku in #497
  * cleanup(cmd/driver): drop preview tag. by @FedeDP in #506
  * fix(install): fix missing dependency signature verification by
    @LucaGuerra in #509
  * chore(cmd): dropped leftover experimental for driver-loader. by
    @FedeDP in #515
  * fix: Add backend 'https' to default index by @QJoly in #520
  * chore(internal): old ebpf probe must have lowest priority. by
    @FedeDP in #521
  * fix(pkg/driver): avoid source of crash during distro Discovery.
    by @FedeDP in #530
  * chore(build): bump go version to 1.22 by @alacuku in #533
  * add new boolean arg for 'registry push' --add-floating-tags, it
    will auto add the tags for the major and the minor versions by
    @Issif in #543
  * cleanup(cmd,pkg): moved enum to its own package. by @FedeDP in
    [#550]
  * new(pkg): use driverkit local build processor instead of
    implementing drivers build by @FedeDP in #356
  * fix(pkg/driver): create envmap if nil since driverkit expects
    it. by @FedeDP in #551
  * chore(cmd/driver): remove redundant log. by @FedeDP in #552
  * chore: updated driverkit to v0.19.2 by @FedeDP in #553
  * chore(deps): Bump google.golang.org/api from 0.178.0 to 0.180.0
    by @dependabot in #559
  * chore(deps): Bump the gomod group with 3 updates by @dependabot
    in #558
  * feat: Add --platform option to artifact/install by @kpaulisse
    in #554
  * chore(deps): Bump the actions group with 2 updates by
    @dependabot in #556
  * chore(deps): Bump golangci/golangci-lint-action from 5.3.0
    to 6.0.1 by @dependabot in #557
  * feat: Add file backend to fetcher by @kpaulisse in #555
  * new(cmd/driver): driver config namespace from env variable by
    @FedeDP in #560</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1722513600">- Update to version 0.9.0:
  * update(OWNERS): remove new line
  * update(OWNERS): add loresuso to approvers
  * chore(deps): Bump github.com/docker/docker
  * chore(pkg): bump driverkit to 0.20.0
  * chore(deps): Bump the actions group with 4 updates
  * chore(deps): Bump goreleaser/goreleaser-action from 5.1.0 to
    6.0.0
  * update(.goreleaser): bump version to v2
  * chore(deps): Bump slsa-framework/slsa-verifier in the actions
    group
  * chore(deps): Bump docker/build-push-action from 5.4.0 to 6.4.1
  * fix(push): use basename for artifacts when compressed in tar.gz
  * chore(Makefile): add .PHONY to falcoctl target
  * Add support for S3 index storage backend
  * fix: allow login to express registry as ref but actually
    extract the registry
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump the actions group across 1 directory with 4
    updates
  * chore(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1
  * feat(dockerfile): use distroless image for falcoctl docker
    image
  * chore(go.mod): bump go version to 1.22.5
  * chore(cmd/driver,pkg/driver): allow to disable kernel headers
    automatic download.
  * chore(deps): Bump google.golang.org/api from 0.185.0 to 0.186.0
  * chore(deps): Bump github.com/hashicorp/go-retryablehttp
  * chore(deps): Bump google.golang.org/api from 0.184.0 to 0.185.0
  * chore(deps): Bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  * feat(auth/basic): extend auth basic command
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 4 updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.41.0 to
    1.42.0
  * chore(deps): Bump google.golang.org/api from 0.183.0 to 0.184.0
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump golang.org/x/net from 0.25.0 to 0.26.0
  * chore(deps): Bump golang.org/x/term from 0.20.0 to 0.21.0
  * chore(deps): Bump google.golang.org/api from 0.182.0 to 0.183.0
  * chore(deps): Bump golang.org/x/sys from 0.20.0 to 0.21.0
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump docker/login-action in the actions group
  * chore(deps): Bump google.golang.org/api from 0.181.0 to 0.182.0
  * chore(deps): Bump github.com/spf13/viper from 1.18.2 to 1.19.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.17.3 to
    2.19.0</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726315200">- Update to version 0.9.1:
  * chore(deps): Bump actions/upload-artifact in the actions group
  * fix(auth/basic): bind pflags to viper only when required
  * chore(deps): Bump the actions group across 1 directory with 3
    updates
  * chore(deps): Bump the actions group with 3 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726920000">- Update to version 0.10.0:
  * fix(goreleaser): use latest tag when two tags point to the same
    commit
  * update(go,pkg): updated driverkit to v0.20.3.
  * update(driver/config): add new unit tests
  * update(driver/config)!: use the same logic to configure engine
    kind for different enviroments</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732190400">- Update to version 0.10.1:
  * update(go): bumped driverkit dep to v0.20.4.
  * fix(pkg/oci): fix Tags pagination support.
  * chore(deps): Bump cloud.google.com/go/storage from 1.46.0 to
    1.47.0
  * chore(deps): Bump google.golang.org/api from 0.205.0 to 0.206.0
  * chore(deps): Bump github.com/golang-jwt/jwt/v4 from 4.5.0 to
    4.5.1
  * chore(deps): Bump golang.org/x/oauth2 from 0.23.0 to 0.24.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump golang.org/x/net from 0.30.0 to 0.31.0
  * chore(deps): Bump golang.org/x/term from 0.25.0 to 0.26.0
  * chore(deps): Bump google.golang.org/api from 0.204.0 to 0.205.0
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.20.2 to
    2.21.0
  * chore(deps): Bump google.golang.org/api from 0.200.0 to 0.204.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.45.0 to
    1.46.0
  * chore(deps): Bump github.com/onsi/gomega from 1.34.2 to 1.35.1
  * chore(deps): Bump k8s.io/client-go from 0.30.2 to 0.31.2
  * chore(deps): Bump github.com/sigstore/cosign/v2 from 2.2.4 to
    2.4.1
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.19.0 to
    2.20.2
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): Bump k8s.io/apimachinery from 0.30.2 to 0.31.2
  * chore(deps): Bump cloud.google.com/go/storage from 1.43.0 to
    1.45.0
  * chore(deps): Bump github.com/onsi/gomega from 1.33.1 to 1.34.2
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/cilium/ebpf from 0.15.0 to 0.16.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): align go.opentelemetry.io/otel/sdk/metric with
    otel/sdk v1.29.0
  * update go to 1.22.8
  * chore(deps): Bump the gomod group across 1 directory with 11
    updates
  * chore(deps): Bump the actions group with 2 updates
  * fix(cmd): relax file perms for Falco driver config override
  * chore(deps): Bump the actions group with 4 updates
  * chore(deps): Bump the actions group with 2 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737979200">- Update to version 0.11.0:
  * fix(follow): file handling of artifacts with directories
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump the actions group with 5 updates
  * chore(deps): Bump the gomod group across 1 directory with 5
    updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.49.0 to
    1.50.0
  * chore(deps): Bump golang.org/x/net from 0.33.0 to 0.34.0
  * chore(deps): Bump k8s.io/client-go from 0.31.3 to 0.32.0
  * chore(deps): Bump k8s.io/apimachinery from 0.31.3 to 0.32.0
  * chore(go.mod): bump go version to 1.23.4
  * chore(deps): Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
  * chore(deps): Bump golang.org/x/term from 0.27.0 to 0.28.0
  * chore(deps): Bump golang.org/x/sys from 0.28.0 to 0.29.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 in the gomod group
  * chore(deps): Bump github.com/onsi/gomega in the gomod group
  * chore(deps): Bump cloud.google.com/go/storage from 1.48.0 to
    1.49.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump github.com/cilium/ebpf from 0.16.0 to 0.17.1
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump golang.org/x/net from 0.32.0 to 0.33.0
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump google.golang.org/api from 0.210.0 to 0.211.0
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): Bump actions/setup-go in the actions group
  * chore(deps): Bump the gomod group with 6 updates
  * chore(deps): Bump golang.org/x/crypto from 0.30.0 to 0.31.0
  * update(linter): remove deprecated linters
  * update(ci/linter): bump golangci-lint to v1.62.2
  * update(makefile): bump golangci-lint to v1.62.2
  * fix(mediaType): do not omit the original media type if not a
    well-known media type
  * chore(deps): Bump github.com/falcosecurity/driverkit in the
    gomod group
  * chore(deps): Bump golang.org/x/net from 0.31.0 to 0.32.0
  * chore(deps): Bump golang.org/x/term from 0.26.0 to 0.27.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.47.0 to
    1.48.0
  * chore(deps): Bump golang.org/x/sys from 0.27.0 to 0.28.0
  * chore(deps): Bump docker/build-push-action in the actions group
  * chore(deps): Bump github.com/pterm/pterm in the gomod group
  * chore(deps): Bump github.com/onsi/gomega from 1.35.1 to 1.36.0
  * chore(deps): Bump docker/metadata-action in the actions group
  * chore(deps): Bump github.com/stretchr/testify from 1.9.0 to
    1.10.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.21.0 to
    2.22.0
  * chore(deps): Bump google.golang.org/api from 0.206.0 to 0.209.0
  * chore(deps): Bump the gomod group with 3 updates
  * fix(auth/gcp): ensure correct OAuth scope for Artifact Registry
    with service account</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1742904000">- Update to version 0.11.1:
  * chore(deps): Bump aws-actions/configure-aws-credentials from
    4.0.2 to 4.0.3 in the actions group by @dependabot in #724
  * chore(deps): Bump the gomod group with 2 updates by @dependabot
    in #725
  * chore(deps): Bump the actions group with 5 updates by
    @dependabot in #730
  * Revert "chore(deps): Bump the gomod group with 2 updates" by
    @alacuku in #731
  * chore(deps): Bump golang.org/x/sys from 0.29.0 to 0.30.0 by
    @dependabot in #729
  * chore(deps): Bump golang.org/x/crypto from 0.32.0 to 0.33.0 by
    @dependabot in #728
  * chore(deps): Bump golang.org/x/oauth2 from 0.25.0 to 0.26.0 by
    @dependabot in #726
  * chore(deps): Bump github.com/distribution/distribution/v3 from
    3.0.0-rc.2 to 3.0.0-rc.3 by @dependabot in #732
  * chore(deps): Bump golang.org/x/net from 0.34.0 to 0.35.0 by
    @dependabot in #736
  * chore(deps): Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by
    @dependabot in #735
  * fix(CI): remove deprecated configuration from .golangci.yml by
    @alacuku in #739
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #737
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #740
  * chore(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.4 to
    4.0.5 by @dependabot in #742
  * chore(deps): Bump github.com/go-jose/go-jose/v3 from 3.0.3 to
    3.0.4 by @dependabot in #743
  * chore(deps): Bump the actions group with 5 updates by
    @dependabot in #744
  * fix(driver): build specific code only for linux platform by
    @alacuku in #747
  * chore(deps): Bump the gomod group across 1 directory with 5
    updates by @dependabot in #746
  * chore(deps): Bump golang.org/x/net from 0.35.0 to 0.36.0 by
    @dependabot in #748
  * chore(deps): Bump the actions group with 2 updates by
    @dependabot in #760
  * chore(toolchain): bump go to version 1.23.7 by @alacuku in #761
  * chore(deps): bump oauth2 to v0.28.0 by @alacuku in #749
  * chore(deps): Bump golang.org/x/term from 0.29.0 to 0.30.0 by
    @dependabot in #750
  * update(go.mod): bulk deps upgrade by @leogr in #762
  * chore(deps): Bump github.com/docker/cli from
    27.5.1+incompatible to 28.0.1+incompatible by @dependabot in
    [#752]
  * chore(deps): Bump github.com/redis/go-redis/v9 from 9.7.0 to
    9.7.3 by @dependabot in #764
  * chore(deps): Bump github.com/golang-jwt/jwt/v4 from 4.5.1 to
    4.5.2 by @dependabot in #766
  * chore(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to
    5.2.2 by @dependabot in #765
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #767
  * chore(deps): Bump the gomod group with 5 updates by @dependabot
    in #768
  * chore(deps): Bump google.golang.org/api from 0.224.0 to 0.227.0
    by @dependabot in #770
  * chore(deps): Bump github.com/distribution/distribution/v3 from
    3.0.0-rc.3 to 3.0.0-rc.4 by @dependabot in #771
  * chore(deps): Bump cloud.google.com/go/storage from 1.50.0 to
    1.51.0 by @dependabot in #772
  * chore(deps): Bump github.com/spf13/viper from 1.19.0 to 1.20.0
    by @dependabot in #773</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748520000">- Update to version 0.11.2:
  * chore(build): update golang and net packages
  * chore(deps): Bump the actions group with 2 updates
  * feat: change aws-sdk-go from v1 to v2
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755777600">- Update to version 0.11.3:
  * chore(deps): Bump actions/checkout from 4.2.2 to 5.0.0
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group
  * chore(deps): Bump the actions group across 1 directory with 3
    updates
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): bump driverkit to v0.21.2
  * chore(deps): bump github.com/go-oauth2/oauth2 to v4.5.3
  * chore(deps): Bump sigstore/cosign-installer in the actions
    group
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/go-viper/mapstructure/v2
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/cloudflare/circl from 1.3.8 to
    1.6.1
  * chore(deps): Bump docker/build-push-action in the actions group</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758715200">- Update to version 0.11.4:
  * chore(deps): Bump k8s.io/client-go from 0.32.3 to 0.33.4
  * chore(deps): Bump github.com/gookit/color from 1.5.4 to 1.6.0
  * chore(deps): Bump sigstore/cosign-installer in the actions
    group
  * chore(deps): Bump aws-actions/configure-aws-credentials
  * chore(deps): Bump actions/setup-go from 5.5.0 to 6.0.0
  * chore(deps): Bump github.com/stretchr/testify from 1.10.0 to
    1.11.0
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump k8s.io/api from 0.32.3 to 0.33.4
  * chore(deps): Bump golang.org/x/term from 0.32.0 to 0.34.0
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/config
  * chore(deps): Bump k8s.io/apimachinery from 0.32.3 to 0.33.4
  * chore(deps): Bump github.com/go-viper/mapstructure/v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768996800">- Update to version 0.12.0:
  * fix: use cached cosign trusted root
  * fix: support cosign v3 also for local images, improve
    trustedRoot creation behavior
  * feat(cosign): upgrade to v3 with bundle format support
  * fix: resolve file descriptor leak in follower and clarify test
    expectation
  * test(artifact): add ValidateVersion tests to document strict
    semver enforcement
  * doc: explain new behavior on tolerant semver install command
  * fix: enforce semver version validation on pushed artifact
  * fix: linting
  * fix(cmd/artifact/install): accept major-only and major.minor
    versions
  * chore(deps): Bump golangci/golangci-lint-action
  * chore(deps): Bump actions/setup-go in the actions group
  * fix: patch dependencies
  * chore(deps): Bump sigstore/cosign-installer from 3.10.0 to
    4.0.0
  * fix(.golangci.yml): correct config again
  * fix(.github): upgrade golangci-lint action to v7.0.0
  * fix(cmd/artifact/install): correctly handle error in deferred
    file close
  * chore: upgrade golangci to v2
  * fix: upgrade driverkit and transitive deps
  * chore(deps): Bump github.com/sigstore/fulcio from 1.6.6 to
    1.8.5
  * fix(install): fix file descriptor leak and improve error
    messages
  * fix: change artifactRef with artifact.ref after the rebase
  * fix: use a dedicated directory for artifact state to avoid
    writing in a watched folder of Falco, improve tests
  * added tests to state, install and follower - some other minor
    changes
  * added shared state between install and follow
  * fix: improve documentation and logs
  * fix: avoid usage of resolved refs during signature, resolve
    alternative artifact reference, add tests to
    prepareArtifactList
  * fix: change copyright year
  * fix: add cap to slice and map, make the PrepareArtifactList not
    exported
  * create specific method to prepare reference list
  * fixed logic to deduplicate refs and dependencies during
    artifact install command
  * chore(deps): Bump docker/setup-buildx-action in the actions
    group
  * chore(deps): Bump actions/checkout from 5.0.0 to 6.0.1
  * chore(deps): Bump actions/upload-artifact from 4.6.2 to 6.0.0
  * chore(deps): Bump the actions group with 2 updates
  * chore: bump golanci-linter version
  * feat: add start-up behaviour configuration for follow
  * chore: reduce version check frequency to 7 days to reduce
    registry load
  * chore(deps): Bump the actions group across 1 directory with 5
    updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769083200">- Update to version 0.12.1:
  * doc: improve state dir config documentation
  * feat(artifact): add config file support for stateDir option</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769601600">- Update to version 0.12.2:
  * chore(deps): Bump github.com/theupdateframework/go-tuf/v2
  * fix(signature): pass registry credentials to cosign for
    signature verification
  * chore(deps): Bump actions/checkout in the actions group
  * chore(deps): Bump github.com/sigstore/sigstore from 1.10.3 to
    1.10.4
  * chore(deps): Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0
  * chore(deps): Bump github.com/theupdateframework/go-tuf/v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777896000">- Update to version 0.13.0:
  * chore(deps): Bump google.golang.org/api from 0.275.0 to 0.277.0
  * chore(deps): Bump github.com/sigstore/timestamp-authority/v2
  * chore(deps): Bump the gomod group with 9 updates
  * chore(deps): Bump the actions group across 1 directory with 2
    updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump the gomod group with 3 updates
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 3 updates
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  * chore(deps): Bump cloud.google.com/go/storage from 1.61.3 to
    1.62.0
  * chore(deps): Bump the gomod group across 1 directory with 11
    updates
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump google.golang.org/api from 0.272.0 to 0.275.0
  * chore(deps): Bump the actions group across 1 directory with 7
    updates
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
  * chore(deps): Bump the gomod group across 1 directory with 8
    updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump google.golang.org/api from 0.271.0 to 0.272.0
  * chore(deps): Bump aws-actions/amazon-ecr-login in the actions
    group
  * chore(deps): Bump the gomod group with 4 updates
  * chore(deps): Bump google.golang.org/grpc from 1.79.2 to 1.79.3
  * chore(deps): Bump github.com/cilium/ebpf from 0.20.0 to 0.21.0
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.59.2 to
    1.61.3
  * chore(deps): Bump golang.org/x/net from 0.51.0 to 0.52.0
  * chore!: remove `tls` command
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump golang.org/x/crypto from 0.48.0 to 0.49.0
  * chore(deps): Bump docker/metadata-action from 5.10.0 to 6.0.0
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump github.com/google/go-containerregistry
  * chore(deps): Bump golang.org/x/sys from 0.40.0 to 0.42.0
  * chore(deps): Bump golang.org/x/oauth2 from 0.35.0 to 0.36.0
  * chore(deps): Bump docker/build-push-action from 6.19.2 to 7.0.0
  * chore(deps): Bump docker/setup-qemu-action from 3.7.0 to 4.0.0
  * chore(deps): Bump docker/setup-buildx-action from 3.12.0 to
    4.0.0
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump golang.org/x/net from 0.49.0 to 0.51.0
  * chore(deps): Bump docker/login-action from 3.7.0 to 4.0.0
  * chore(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.0
  * chore(deps): Bump actions/setup-go in the actions group
  * chore(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0
  * chore(deps): Bump the gomod group across 1 directory with 15
    updates
  * chore(deps): Bump goreleaser/goreleaser-action from 6.4.0 to
    7.0.0
  * chore!: drop legacy BPF probe support
  * chore(deps): Bump docker/build-push-action in the actions group
  * chore(deps): Bump aws-actions/configure-aws-credentials
  * chore(deps): bump oras.land/oras-go/v2 from 2.5.0 to 2.6.0
  * chore(deps): Bump github.com/cilium/ebpf from 0.17.3 to 0.19.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.51.0 to
    1.56.1
  * chore(deps): Bump github.com/onsi/gomega from 1.36.3 to 1.38.2
  * chore(deps): Bump docker/login-action in the actions group</changelog>
</package>
<package pkgid="72ea93ea669137865c5ae1445b03854b968677bdd340ff9cb06e6941ea2101f90f97610afe5218f0af66b32c065235e3648b92544db7ac39d1c459ebfcb39f33" name="falcoctl" arch="src">
  <version epoch="0" ver="0.13.0" rel="27.9"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1706875200">- new package falcoctl: CLI for the Falco Cloud Native Runtime
  Security solution</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1707739200">- Update to version 0.7.2:
  * bumped helper message
  * added http-header option in driver download
  * chore(pkg/driver): ubuntu has its own specific FixupKernel
    logic now.
  * fix(pkg/driver): fixed generic kernelversion fixup method.
  * pkg/driver/flatcar: Update the script
  * fix: Dead link in PR template
  * chore(cmd): fixed up some strings.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1708776000">- Update to version 0.7.3:
  * fix(CI): add permissions to login-to-amazon-ecr job
  * new(ci): add provenance for main tag
  * fix(CI): properly get credentials for amazon ecr registry
  * new(CI): add provenance for ecr image
  * fix(ci): add permissions for AWS ecr
  * new(CI): add ecr repository</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717243200">- Update to version 0.8.0:
  * add dependabot config and update golangci-lint by @cpanato in
    [#385]
  * chore(cmd): fixed up some strings. by @FedeDP in #407
  * fix: fixed go.sum entry to fix build. by @FedeDP in #415
  * feat: adding support for KMS in cosign by @brennoo in #416
  * fix: Dead link in PR template by @krnowak in #424
  * pkg/driver/flatcar: Update the script by @krnowak in #425
  * fix(pkg/driver): fixed generic kernelversion fixup method. by
    @FedeDP in #427
  * new(cmd/driver): support user provided headers option for
    driver download by @toamto94 in #428
  * fix(pusher): correctly report artifact type by @alacuku in #442
  * Remove extra '$' character. by @thejefflarson in #458
  * feat(cmd/push): parse requirements and deps from rulesfile by
    @alacuku in #467
  * update(cmd): bumped oras to v.2.4.0. by @FedeDP in #478
  * fix(registry/push): correctly remove temporary dir by @alacuku
    in #479
  * update(tests/push): add new tests for push command by @alacuku
    in #486
  * new: driver selection logic by @FedeDP in #484
  * new(pkg/driver): try to fetch kernel headers leveraging
    driverkit library when building drivers by @FedeDP in #476
  * chore(cmd,pkg,internal): switch to use oras-go credentials
    package since oras-go-credentials is deprecated by @FedeDP in
    [#496]
  * chore(cmd/push): uniform receiver for push command by @alacuku
    in #498
  * fix(pkg/driver): fixup kernel headers download by @FedeDP in
    [#499]
  * fix(artifact/info): filter out signature tags by @alacuku in
    [#507]
  * vote: docs(OWNERS): add alacuku (Aldo Lacuku) to approvers by
    @alacuku in #497
  * cleanup(cmd/driver): drop preview tag. by @FedeDP in #506
  * fix(install): fix missing dependency signature verification by
    @LucaGuerra in #509
  * chore(cmd): dropped leftover experimental for driver-loader. by
    @FedeDP in #515
  * fix: Add backend 'https' to default index by @QJoly in #520
  * chore(internal): old ebpf probe must have lowest priority. by
    @FedeDP in #521
  * fix(pkg/driver): avoid source of crash during distro Discovery.
    by @FedeDP in #530
  * chore(build): bump go version to 1.22 by @alacuku in #533
  * add new boolean arg for 'registry push' --add-floating-tags, it
    will auto add the tags for the major and the minor versions by
    @Issif in #543
  * cleanup(cmd,pkg): moved enum to its own package. by @FedeDP in
    [#550]
  * new(pkg): use driverkit local build processor instead of
    implementing drivers build by @FedeDP in #356
  * fix(pkg/driver): create envmap if nil since driverkit expects
    it. by @FedeDP in #551
  * chore(cmd/driver): remove redundant log. by @FedeDP in #552
  * chore: updated driverkit to v0.19.2 by @FedeDP in #553
  * chore(deps): Bump google.golang.org/api from 0.178.0 to 0.180.0
    by @dependabot in #559
  * chore(deps): Bump the gomod group with 3 updates by @dependabot
    in #558
  * feat: Add --platform option to artifact/install by @kpaulisse
    in #554
  * chore(deps): Bump the actions group with 2 updates by
    @dependabot in #556
  * chore(deps): Bump golangci/golangci-lint-action from 5.3.0
    to 6.0.1 by @dependabot in #557
  * feat: Add file backend to fetcher by @kpaulisse in #555
  * new(cmd/driver): driver config namespace from env variable by
    @FedeDP in #560</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1722513600">- Update to version 0.9.0:
  * update(OWNERS): remove new line
  * update(OWNERS): add loresuso to approvers
  * chore(deps): Bump github.com/docker/docker
  * chore(pkg): bump driverkit to 0.20.0
  * chore(deps): Bump the actions group with 4 updates
  * chore(deps): Bump goreleaser/goreleaser-action from 5.1.0 to
    6.0.0
  * update(.goreleaser): bump version to v2
  * chore(deps): Bump slsa-framework/slsa-verifier in the actions
    group
  * chore(deps): Bump docker/build-push-action from 5.4.0 to 6.4.1
  * fix(push): use basename for artifacts when compressed in tar.gz
  * chore(Makefile): add .PHONY to falcoctl target
  * Add support for S3 index storage backend
  * fix: allow login to express registry as ref but actually
    extract the registry
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump the actions group across 1 directory with 4
    updates
  * chore(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1
  * feat(dockerfile): use distroless image for falcoctl docker
    image
  * chore(go.mod): bump go version to 1.22.5
  * chore(cmd/driver,pkg/driver): allow to disable kernel headers
    automatic download.
  * chore(deps): Bump google.golang.org/api from 0.185.0 to 0.186.0
  * chore(deps): Bump github.com/hashicorp/go-retryablehttp
  * chore(deps): Bump google.golang.org/api from 0.184.0 to 0.185.0
  * chore(deps): Bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  * feat(auth/basic): extend auth basic command
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 4 updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.41.0 to
    1.42.0
  * chore(deps): Bump google.golang.org/api from 0.183.0 to 0.184.0
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump golang.org/x/net from 0.25.0 to 0.26.0
  * chore(deps): Bump golang.org/x/term from 0.20.0 to 0.21.0
  * chore(deps): Bump google.golang.org/api from 0.182.0 to 0.183.0
  * chore(deps): Bump golang.org/x/sys from 0.20.0 to 0.21.0
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump docker/login-action in the actions group
  * chore(deps): Bump google.golang.org/api from 0.181.0 to 0.182.0
  * chore(deps): Bump github.com/spf13/viper from 1.18.2 to 1.19.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.17.3 to
    2.19.0</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726315200">- Update to version 0.9.1:
  * chore(deps): Bump actions/upload-artifact in the actions group
  * fix(auth/basic): bind pflags to viper only when required
  * chore(deps): Bump the actions group across 1 directory with 3
    updates
  * chore(deps): Bump the actions group with 3 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726920000">- Update to version 0.10.0:
  * fix(goreleaser): use latest tag when two tags point to the same
    commit
  * update(go,pkg): updated driverkit to v0.20.3.
  * update(driver/config): add new unit tests
  * update(driver/config)!: use the same logic to configure engine
    kind for different enviroments</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732190400">- Update to version 0.10.1:
  * update(go): bumped driverkit dep to v0.20.4.
  * fix(pkg/oci): fix Tags pagination support.
  * chore(deps): Bump cloud.google.com/go/storage from 1.46.0 to
    1.47.0
  * chore(deps): Bump google.golang.org/api from 0.205.0 to 0.206.0
  * chore(deps): Bump github.com/golang-jwt/jwt/v4 from 4.5.0 to
    4.5.1
  * chore(deps): Bump golang.org/x/oauth2 from 0.23.0 to 0.24.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump golang.org/x/net from 0.30.0 to 0.31.0
  * chore(deps): Bump golang.org/x/term from 0.25.0 to 0.26.0
  * chore(deps): Bump google.golang.org/api from 0.204.0 to 0.205.0
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.20.2 to
    2.21.0
  * chore(deps): Bump google.golang.org/api from 0.200.0 to 0.204.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.45.0 to
    1.46.0
  * chore(deps): Bump github.com/onsi/gomega from 1.34.2 to 1.35.1
  * chore(deps): Bump k8s.io/client-go from 0.30.2 to 0.31.2
  * chore(deps): Bump github.com/sigstore/cosign/v2 from 2.2.4 to
    2.4.1
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.19.0 to
    2.20.2
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): Bump k8s.io/apimachinery from 0.30.2 to 0.31.2
  * chore(deps): Bump cloud.google.com/go/storage from 1.43.0 to
    1.45.0
  * chore(deps): Bump github.com/onsi/gomega from 1.33.1 to 1.34.2
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/cilium/ebpf from 0.15.0 to 0.16.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): align go.opentelemetry.io/otel/sdk/metric with
    otel/sdk v1.29.0
  * update go to 1.22.8
  * chore(deps): Bump the gomod group across 1 directory with 11
    updates
  * chore(deps): Bump the actions group with 2 updates
  * fix(cmd): relax file perms for Falco driver config override
  * chore(deps): Bump the actions group with 4 updates
  * chore(deps): Bump the actions group with 2 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737979200">- Update to version 0.11.0:
  * fix(follow): file handling of artifacts with directories
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump the actions group with 5 updates
  * chore(deps): Bump the gomod group across 1 directory with 5
    updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.49.0 to
    1.50.0
  * chore(deps): Bump golang.org/x/net from 0.33.0 to 0.34.0
  * chore(deps): Bump k8s.io/client-go from 0.31.3 to 0.32.0
  * chore(deps): Bump k8s.io/apimachinery from 0.31.3 to 0.32.0
  * chore(go.mod): bump go version to 1.23.4
  * chore(deps): Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
  * chore(deps): Bump golang.org/x/term from 0.27.0 to 0.28.0
  * chore(deps): Bump golang.org/x/sys from 0.28.0 to 0.29.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 in the gomod group
  * chore(deps): Bump github.com/onsi/gomega in the gomod group
  * chore(deps): Bump cloud.google.com/go/storage from 1.48.0 to
    1.49.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump github.com/cilium/ebpf from 0.16.0 to 0.17.1
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump golang.org/x/net from 0.32.0 to 0.33.0
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump google.golang.org/api from 0.210.0 to 0.211.0
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): Bump actions/setup-go in the actions group
  * chore(deps): Bump the gomod group with 6 updates
  * chore(deps): Bump golang.org/x/crypto from 0.30.0 to 0.31.0
  * update(linter): remove deprecated linters
  * update(ci/linter): bump golangci-lint to v1.62.2
  * update(makefile): bump golangci-lint to v1.62.2
  * fix(mediaType): do not omit the original media type if not a
    well-known media type
  * chore(deps): Bump github.com/falcosecurity/driverkit in the
    gomod group
  * chore(deps): Bump golang.org/x/net from 0.31.0 to 0.32.0
  * chore(deps): Bump golang.org/x/term from 0.26.0 to 0.27.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.47.0 to
    1.48.0
  * chore(deps): Bump golang.org/x/sys from 0.27.0 to 0.28.0
  * chore(deps): Bump docker/build-push-action in the actions group
  * chore(deps): Bump github.com/pterm/pterm in the gomod group
  * chore(deps): Bump github.com/onsi/gomega from 1.35.1 to 1.36.0
  * chore(deps): Bump docker/metadata-action in the actions group
  * chore(deps): Bump github.com/stretchr/testify from 1.9.0 to
    1.10.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.21.0 to
    2.22.0
  * chore(deps): Bump google.golang.org/api from 0.206.0 to 0.209.0
  * chore(deps): Bump the gomod group with 3 updates
  * fix(auth/gcp): ensure correct OAuth scope for Artifact Registry
    with service account</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1742904000">- Update to version 0.11.1:
  * chore(deps): Bump aws-actions/configure-aws-credentials from
    4.0.2 to 4.0.3 in the actions group by @dependabot in #724
  * chore(deps): Bump the gomod group with 2 updates by @dependabot
    in #725
  * chore(deps): Bump the actions group with 5 updates by
    @dependabot in #730
  * Revert "chore(deps): Bump the gomod group with 2 updates" by
    @alacuku in #731
  * chore(deps): Bump golang.org/x/sys from 0.29.0 to 0.30.0 by
    @dependabot in #729
  * chore(deps): Bump golang.org/x/crypto from 0.32.0 to 0.33.0 by
    @dependabot in #728
  * chore(deps): Bump golang.org/x/oauth2 from 0.25.0 to 0.26.0 by
    @dependabot in #726
  * chore(deps): Bump github.com/distribution/distribution/v3 from
    3.0.0-rc.2 to 3.0.0-rc.3 by @dependabot in #732
  * chore(deps): Bump golang.org/x/net from 0.34.0 to 0.35.0 by
    @dependabot in #736
  * chore(deps): Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by
    @dependabot in #735
  * fix(CI): remove deprecated configuration from .golangci.yml by
    @alacuku in #739
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #737
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #740
  * chore(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.4 to
    4.0.5 by @dependabot in #742
  * chore(deps): Bump github.com/go-jose/go-jose/v3 from 3.0.3 to
    3.0.4 by @dependabot in #743
  * chore(deps): Bump the actions group with 5 updates by
    @dependabot in #744
  * fix(driver): build specific code only for linux platform by
    @alacuku in #747
  * chore(deps): Bump the gomod group across 1 directory with 5
    updates by @dependabot in #746
  * chore(deps): Bump golang.org/x/net from 0.35.0 to 0.36.0 by
    @dependabot in #748
  * chore(deps): Bump the actions group with 2 updates by
    @dependabot in #760
  * chore(toolchain): bump go to version 1.23.7 by @alacuku in #761
  * chore(deps): bump oauth2 to v0.28.0 by @alacuku in #749
  * chore(deps): Bump golang.org/x/term from 0.29.0 to 0.30.0 by
    @dependabot in #750
  * update(go.mod): bulk deps upgrade by @leogr in #762
  * chore(deps): Bump github.com/docker/cli from
    27.5.1+incompatible to 28.0.1+incompatible by @dependabot in
    [#752]
  * chore(deps): Bump github.com/redis/go-redis/v9 from 9.7.0 to
    9.7.3 by @dependabot in #764
  * chore(deps): Bump github.com/golang-jwt/jwt/v4 from 4.5.1 to
    4.5.2 by @dependabot in #766
  * chore(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to
    5.2.2 by @dependabot in #765
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #767
  * chore(deps): Bump the gomod group with 5 updates by @dependabot
    in #768
  * chore(deps): Bump google.golang.org/api from 0.224.0 to 0.227.0
    by @dependabot in #770
  * chore(deps): Bump github.com/distribution/distribution/v3 from
    3.0.0-rc.3 to 3.0.0-rc.4 by @dependabot in #771
  * chore(deps): Bump cloud.google.com/go/storage from 1.50.0 to
    1.51.0 by @dependabot in #772
  * chore(deps): Bump github.com/spf13/viper from 1.19.0 to 1.20.0
    by @dependabot in #773</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748520000">- Update to version 0.11.2:
  * chore(build): update golang and net packages
  * chore(deps): Bump the actions group with 2 updates
  * feat: change aws-sdk-go from v1 to v2
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755777600">- Update to version 0.11.3:
  * chore(deps): Bump actions/checkout from 4.2.2 to 5.0.0
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group
  * chore(deps): Bump the actions group across 1 directory with 3
    updates
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): bump driverkit to v0.21.2
  * chore(deps): bump github.com/go-oauth2/oauth2 to v4.5.3
  * chore(deps): Bump sigstore/cosign-installer in the actions
    group
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/go-viper/mapstructure/v2
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/cloudflare/circl from 1.3.8 to
    1.6.1
  * chore(deps): Bump docker/build-push-action in the actions group</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758715200">- Update to version 0.11.4:
  * chore(deps): Bump k8s.io/client-go from 0.32.3 to 0.33.4
  * chore(deps): Bump github.com/gookit/color from 1.5.4 to 1.6.0
  * chore(deps): Bump sigstore/cosign-installer in the actions
    group
  * chore(deps): Bump aws-actions/configure-aws-credentials
  * chore(deps): Bump actions/setup-go from 5.5.0 to 6.0.0
  * chore(deps): Bump github.com/stretchr/testify from 1.10.0 to
    1.11.0
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump k8s.io/api from 0.32.3 to 0.33.4
  * chore(deps): Bump golang.org/x/term from 0.32.0 to 0.34.0
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/config
  * chore(deps): Bump k8s.io/apimachinery from 0.32.3 to 0.33.4
  * chore(deps): Bump github.com/go-viper/mapstructure/v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768996800">- Update to version 0.12.0:
  * fix: use cached cosign trusted root
  * fix: support cosign v3 also for local images, improve
    trustedRoot creation behavior
  * feat(cosign): upgrade to v3 with bundle format support
  * fix: resolve file descriptor leak in follower and clarify test
    expectation
  * test(artifact): add ValidateVersion tests to document strict
    semver enforcement
  * doc: explain new behavior on tolerant semver install command
  * fix: enforce semver version validation on pushed artifact
  * fix: linting
  * fix(cmd/artifact/install): accept major-only and major.minor
    versions
  * chore(deps): Bump golangci/golangci-lint-action
  * chore(deps): Bump actions/setup-go in the actions group
  * fix: patch dependencies
  * chore(deps): Bump sigstore/cosign-installer from 3.10.0 to
    4.0.0
  * fix(.golangci.yml): correct config again
  * fix(.github): upgrade golangci-lint action to v7.0.0
  * fix(cmd/artifact/install): correctly handle error in deferred
    file close
  * chore: upgrade golangci to v2
  * fix: upgrade driverkit and transitive deps
  * chore(deps): Bump github.com/sigstore/fulcio from 1.6.6 to
    1.8.5
  * fix(install): fix file descriptor leak and improve error
    messages
  * fix: change artifactRef with artifact.ref after the rebase
  * fix: use a dedicated directory for artifact state to avoid
    writing in a watched folder of Falco, improve tests
  * added tests to state, install and follower - some other minor
    changes
  * added shared state between install and follow
  * fix: improve documentation and logs
  * fix: avoid usage of resolved refs during signature, resolve
    alternative artifact reference, add tests to
    prepareArtifactList
  * fix: change copyright year
  * fix: add cap to slice and map, make the PrepareArtifactList not
    exported
  * create specific method to prepare reference list
  * fixed logic to deduplicate refs and dependencies during
    artifact install command
  * chore(deps): Bump docker/setup-buildx-action in the actions
    group
  * chore(deps): Bump actions/checkout from 5.0.0 to 6.0.1
  * chore(deps): Bump actions/upload-artifact from 4.6.2 to 6.0.0
  * chore(deps): Bump the actions group with 2 updates
  * chore: bump golanci-linter version
  * feat: add start-up behaviour configuration for follow
  * chore: reduce version check frequency to 7 days to reduce
    registry load
  * chore(deps): Bump the actions group across 1 directory with 5
    updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769083200">- Update to version 0.12.1:
  * doc: improve state dir config documentation
  * feat(artifact): add config file support for stateDir option</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769601600">- Update to version 0.12.2:
  * chore(deps): Bump github.com/theupdateframework/go-tuf/v2
  * fix(signature): pass registry credentials to cosign for
    signature verification
  * chore(deps): Bump actions/checkout in the actions group
  * chore(deps): Bump github.com/sigstore/sigstore from 1.10.3 to
    1.10.4
  * chore(deps): Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0
  * chore(deps): Bump github.com/theupdateframework/go-tuf/v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777896000">- Update to version 0.13.0:
  * chore(deps): Bump google.golang.org/api from 0.275.0 to 0.277.0
  * chore(deps): Bump github.com/sigstore/timestamp-authority/v2
  * chore(deps): Bump the gomod group with 9 updates
  * chore(deps): Bump the actions group across 1 directory with 2
    updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump the gomod group with 3 updates
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 3 updates
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  * chore(deps): Bump cloud.google.com/go/storage from 1.61.3 to
    1.62.0
  * chore(deps): Bump the gomod group across 1 directory with 11
    updates
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump google.golang.org/api from 0.272.0 to 0.275.0
  * chore(deps): Bump the actions group across 1 directory with 7
    updates
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
  * chore(deps): Bump the gomod group across 1 directory with 8
    updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump google.golang.org/api from 0.271.0 to 0.272.0
  * chore(deps): Bump aws-actions/amazon-ecr-login in the actions
    group
  * chore(deps): Bump the gomod group with 4 updates
  * chore(deps): Bump google.golang.org/grpc from 1.79.2 to 1.79.3
  * chore(deps): Bump github.com/cilium/ebpf from 0.20.0 to 0.21.0
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.59.2 to
    1.61.3
  * chore(deps): Bump golang.org/x/net from 0.51.0 to 0.52.0
  * chore!: remove `tls` command
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump golang.org/x/crypto from 0.48.0 to 0.49.0
  * chore(deps): Bump docker/metadata-action from 5.10.0 to 6.0.0
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump github.com/google/go-containerregistry
  * chore(deps): Bump golang.org/x/sys from 0.40.0 to 0.42.0
  * chore(deps): Bump golang.org/x/oauth2 from 0.35.0 to 0.36.0
  * chore(deps): Bump docker/build-push-action from 6.19.2 to 7.0.0
  * chore(deps): Bump docker/setup-qemu-action from 3.7.0 to 4.0.0
  * chore(deps): Bump docker/setup-buildx-action from 3.12.0 to
    4.0.0
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump golang.org/x/net from 0.49.0 to 0.51.0
  * chore(deps): Bump docker/login-action from 3.7.0 to 4.0.0
  * chore(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.0
  * chore(deps): Bump actions/setup-go in the actions group
  * chore(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0
  * chore(deps): Bump the gomod group across 1 directory with 15
    updates
  * chore(deps): Bump goreleaser/goreleaser-action from 6.4.0 to
    7.0.0
  * chore!: drop legacy BPF probe support
  * chore(deps): Bump docker/build-push-action in the actions group
  * chore(deps): Bump aws-actions/configure-aws-credentials
  * chore(deps): bump oras.land/oras-go/v2 from 2.5.0 to 2.6.0
  * chore(deps): Bump github.com/cilium/ebpf from 0.17.3 to 0.19.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.51.0 to
    1.56.1
  * chore(deps): Bump github.com/onsi/gomega from 1.36.3 to 1.38.2
  * chore(deps): Bump docker/login-action in the actions group</changelog>
</package>
<package pkgid="4b13486996ba2b4d4082cef9480cd4aadf2406fcefa13a9eb72eb7e6e719920e48a7f959dd512220e349c43087c359e8f9c50cfedcc204e447490962f0b56117" name="falcoctl-bash-completion" arch="noarch">
  <version epoch="0" ver="0.13.0" rel="27.9"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1706875200">- new package falcoctl: CLI for the Falco Cloud Native Runtime
  Security solution</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1707739200">- Update to version 0.7.2:
  * bumped helper message
  * added http-header option in driver download
  * chore(pkg/driver): ubuntu has its own specific FixupKernel
    logic now.
  * fix(pkg/driver): fixed generic kernelversion fixup method.
  * pkg/driver/flatcar: Update the script
  * fix: Dead link in PR template
  * chore(cmd): fixed up some strings.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1708776000">- Update to version 0.7.3:
  * fix(CI): add permissions to login-to-amazon-ecr job
  * new(ci): add provenance for main tag
  * fix(CI): properly get credentials for amazon ecr registry
  * new(CI): add provenance for ecr image
  * fix(ci): add permissions for AWS ecr
  * new(CI): add ecr repository</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717243200">- Update to version 0.8.0:
  * add dependabot config and update golangci-lint by @cpanato in
    [#385]
  * chore(cmd): fixed up some strings. by @FedeDP in #407
  * fix: fixed go.sum entry to fix build. by @FedeDP in #415
  * feat: adding support for KMS in cosign by @brennoo in #416
  * fix: Dead link in PR template by @krnowak in #424
  * pkg/driver/flatcar: Update the script by @krnowak in #425
  * fix(pkg/driver): fixed generic kernelversion fixup method. by
    @FedeDP in #427
  * new(cmd/driver): support user provided headers option for
    driver download by @toamto94 in #428
  * fix(pusher): correctly report artifact type by @alacuku in #442
  * Remove extra '$' character. by @thejefflarson in #458
  * feat(cmd/push): parse requirements and deps from rulesfile by
    @alacuku in #467
  * update(cmd): bumped oras to v.2.4.0. by @FedeDP in #478
  * fix(registry/push): correctly remove temporary dir by @alacuku
    in #479
  * update(tests/push): add new tests for push command by @alacuku
    in #486
  * new: driver selection logic by @FedeDP in #484
  * new(pkg/driver): try to fetch kernel headers leveraging
    driverkit library when building drivers by @FedeDP in #476
  * chore(cmd,pkg,internal): switch to use oras-go credentials
    package since oras-go-credentials is deprecated by @FedeDP in
    [#496]
  * chore(cmd/push): uniform receiver for push command by @alacuku
    in #498
  * fix(pkg/driver): fixup kernel headers download by @FedeDP in
    [#499]
  * fix(artifact/info): filter out signature tags by @alacuku in
    [#507]
  * vote: docs(OWNERS): add alacuku (Aldo Lacuku) to approvers by
    @alacuku in #497
  * cleanup(cmd/driver): drop preview tag. by @FedeDP in #506
  * fix(install): fix missing dependency signature verification by
    @LucaGuerra in #509
  * chore(cmd): dropped leftover experimental for driver-loader. by
    @FedeDP in #515
  * fix: Add backend 'https' to default index by @QJoly in #520
  * chore(internal): old ebpf probe must have lowest priority. by
    @FedeDP in #521
  * fix(pkg/driver): avoid source of crash during distro Discovery.
    by @FedeDP in #530
  * chore(build): bump go version to 1.22 by @alacuku in #533
  * add new boolean arg for 'registry push' --add-floating-tags, it
    will auto add the tags for the major and the minor versions by
    @Issif in #543
  * cleanup(cmd,pkg): moved enum to its own package. by @FedeDP in
    [#550]
  * new(pkg): use driverkit local build processor instead of
    implementing drivers build by @FedeDP in #356
  * fix(pkg/driver): create envmap if nil since driverkit expects
    it. by @FedeDP in #551
  * chore(cmd/driver): remove redundant log. by @FedeDP in #552
  * chore: updated driverkit to v0.19.2 by @FedeDP in #553
  * chore(deps): Bump google.golang.org/api from 0.178.0 to 0.180.0
    by @dependabot in #559
  * chore(deps): Bump the gomod group with 3 updates by @dependabot
    in #558
  * feat: Add --platform option to artifact/install by @kpaulisse
    in #554
  * chore(deps): Bump the actions group with 2 updates by
    @dependabot in #556
  * chore(deps): Bump golangci/golangci-lint-action from 5.3.0
    to 6.0.1 by @dependabot in #557
  * feat: Add file backend to fetcher by @kpaulisse in #555
  * new(cmd/driver): driver config namespace from env variable by
    @FedeDP in #560</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1722513600">- Update to version 0.9.0:
  * update(OWNERS): remove new line
  * update(OWNERS): add loresuso to approvers
  * chore(deps): Bump github.com/docker/docker
  * chore(pkg): bump driverkit to 0.20.0
  * chore(deps): Bump the actions group with 4 updates
  * chore(deps): Bump goreleaser/goreleaser-action from 5.1.0 to
    6.0.0
  * update(.goreleaser): bump version to v2
  * chore(deps): Bump slsa-framework/slsa-verifier in the actions
    group
  * chore(deps): Bump docker/build-push-action from 5.4.0 to 6.4.1
  * fix(push): use basename for artifacts when compressed in tar.gz
  * chore(Makefile): add .PHONY to falcoctl target
  * Add support for S3 index storage backend
  * fix: allow login to express registry as ref but actually
    extract the registry
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump the actions group across 1 directory with 4
    updates
  * chore(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1
  * feat(dockerfile): use distroless image for falcoctl docker
    image
  * chore(go.mod): bump go version to 1.22.5
  * chore(cmd/driver,pkg/driver): allow to disable kernel headers
    automatic download.
  * chore(deps): Bump google.golang.org/api from 0.185.0 to 0.186.0
  * chore(deps): Bump github.com/hashicorp/go-retryablehttp
  * chore(deps): Bump google.golang.org/api from 0.184.0 to 0.185.0
  * chore(deps): Bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  * feat(auth/basic): extend auth basic command
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 4 updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.41.0 to
    1.42.0
  * chore(deps): Bump google.golang.org/api from 0.183.0 to 0.184.0
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump golang.org/x/net from 0.25.0 to 0.26.0
  * chore(deps): Bump golang.org/x/term from 0.20.0 to 0.21.0
  * chore(deps): Bump google.golang.org/api from 0.182.0 to 0.183.0
  * chore(deps): Bump golang.org/x/sys from 0.20.0 to 0.21.0
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump docker/login-action in the actions group
  * chore(deps): Bump google.golang.org/api from 0.181.0 to 0.182.0
  * chore(deps): Bump github.com/spf13/viper from 1.18.2 to 1.19.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.17.3 to
    2.19.0</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726315200">- Update to version 0.9.1:
  * chore(deps): Bump actions/upload-artifact in the actions group
  * fix(auth/basic): bind pflags to viper only when required
  * chore(deps): Bump the actions group across 1 directory with 3
    updates
  * chore(deps): Bump the actions group with 3 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726920000">- Update to version 0.10.0:
  * fix(goreleaser): use latest tag when two tags point to the same
    commit
  * update(go,pkg): updated driverkit to v0.20.3.
  * update(driver/config): add new unit tests
  * update(driver/config)!: use the same logic to configure engine
    kind for different enviroments</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732190400">- Update to version 0.10.1:
  * update(go): bumped driverkit dep to v0.20.4.
  * fix(pkg/oci): fix Tags pagination support.
  * chore(deps): Bump cloud.google.com/go/storage from 1.46.0 to
    1.47.0
  * chore(deps): Bump google.golang.org/api from 0.205.0 to 0.206.0
  * chore(deps): Bump github.com/golang-jwt/jwt/v4 from 4.5.0 to
    4.5.1
  * chore(deps): Bump golang.org/x/oauth2 from 0.23.0 to 0.24.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump golang.org/x/net from 0.30.0 to 0.31.0
  * chore(deps): Bump golang.org/x/term from 0.25.0 to 0.26.0
  * chore(deps): Bump google.golang.org/api from 0.204.0 to 0.205.0
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.20.2 to
    2.21.0
  * chore(deps): Bump google.golang.org/api from 0.200.0 to 0.204.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.45.0 to
    1.46.0
  * chore(deps): Bump github.com/onsi/gomega from 1.34.2 to 1.35.1
  * chore(deps): Bump k8s.io/client-go from 0.30.2 to 0.31.2
  * chore(deps): Bump github.com/sigstore/cosign/v2 from 2.2.4 to
    2.4.1
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.19.0 to
    2.20.2
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): Bump k8s.io/apimachinery from 0.30.2 to 0.31.2
  * chore(deps): Bump cloud.google.com/go/storage from 1.43.0 to
    1.45.0
  * chore(deps): Bump github.com/onsi/gomega from 1.33.1 to 1.34.2
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/cilium/ebpf from 0.15.0 to 0.16.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): align go.opentelemetry.io/otel/sdk/metric with
    otel/sdk v1.29.0
  * update go to 1.22.8
  * chore(deps): Bump the gomod group across 1 directory with 11
    updates
  * chore(deps): Bump the actions group with 2 updates
  * fix(cmd): relax file perms for Falco driver config override
  * chore(deps): Bump the actions group with 4 updates
  * chore(deps): Bump the actions group with 2 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737979200">- Update to version 0.11.0:
  * fix(follow): file handling of artifacts with directories
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump the actions group with 5 updates
  * chore(deps): Bump the gomod group across 1 directory with 5
    updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.49.0 to
    1.50.0
  * chore(deps): Bump golang.org/x/net from 0.33.0 to 0.34.0
  * chore(deps): Bump k8s.io/client-go from 0.31.3 to 0.32.0
  * chore(deps): Bump k8s.io/apimachinery from 0.31.3 to 0.32.0
  * chore(go.mod): bump go version to 1.23.4
  * chore(deps): Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
  * chore(deps): Bump golang.org/x/term from 0.27.0 to 0.28.0
  * chore(deps): Bump golang.org/x/sys from 0.28.0 to 0.29.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 in the gomod group
  * chore(deps): Bump github.com/onsi/gomega in the gomod group
  * chore(deps): Bump cloud.google.com/go/storage from 1.48.0 to
    1.49.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump github.com/cilium/ebpf from 0.16.0 to 0.17.1
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump golang.org/x/net from 0.32.0 to 0.33.0
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump google.golang.org/api from 0.210.0 to 0.211.0
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): Bump actions/setup-go in the actions group
  * chore(deps): Bump the gomod group with 6 updates
  * chore(deps): Bump golang.org/x/crypto from 0.30.0 to 0.31.0
  * update(linter): remove deprecated linters
  * update(ci/linter): bump golangci-lint to v1.62.2
  * update(makefile): bump golangci-lint to v1.62.2
  * fix(mediaType): do not omit the original media type if not a
    well-known media type
  * chore(deps): Bump github.com/falcosecurity/driverkit in the
    gomod group
  * chore(deps): Bump golang.org/x/net from 0.31.0 to 0.32.0
  * chore(deps): Bump golang.org/x/term from 0.26.0 to 0.27.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.47.0 to
    1.48.0
  * chore(deps): Bump golang.org/x/sys from 0.27.0 to 0.28.0
  * chore(deps): Bump docker/build-push-action in the actions group
  * chore(deps): Bump github.com/pterm/pterm in the gomod group
  * chore(deps): Bump github.com/onsi/gomega from 1.35.1 to 1.36.0
  * chore(deps): Bump docker/metadata-action in the actions group
  * chore(deps): Bump github.com/stretchr/testify from 1.9.0 to
    1.10.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.21.0 to
    2.22.0
  * chore(deps): Bump google.golang.org/api from 0.206.0 to 0.209.0
  * chore(deps): Bump the gomod group with 3 updates
  * fix(auth/gcp): ensure correct OAuth scope for Artifact Registry
    with service account</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1742904000">- Update to version 0.11.1:
  * chore(deps): Bump aws-actions/configure-aws-credentials from
    4.0.2 to 4.0.3 in the actions group by @dependabot in #724
  * chore(deps): Bump the gomod group with 2 updates by @dependabot
    in #725
  * chore(deps): Bump the actions group with 5 updates by
    @dependabot in #730
  * Revert "chore(deps): Bump the gomod group with 2 updates" by
    @alacuku in #731
  * chore(deps): Bump golang.org/x/sys from 0.29.0 to 0.30.0 by
    @dependabot in #729
  * chore(deps): Bump golang.org/x/crypto from 0.32.0 to 0.33.0 by
    @dependabot in #728
  * chore(deps): Bump golang.org/x/oauth2 from 0.25.0 to 0.26.0 by
    @dependabot in #726
  * chore(deps): Bump github.com/distribution/distribution/v3 from
    3.0.0-rc.2 to 3.0.0-rc.3 by @dependabot in #732
  * chore(deps): Bump golang.org/x/net from 0.34.0 to 0.35.0 by
    @dependabot in #736
  * chore(deps): Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by
    @dependabot in #735
  * fix(CI): remove deprecated configuration from .golangci.yml by
    @alacuku in #739
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #737
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #740
  * chore(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.4 to
    4.0.5 by @dependabot in #742
  * chore(deps): Bump github.com/go-jose/go-jose/v3 from 3.0.3 to
    3.0.4 by @dependabot in #743
  * chore(deps): Bump the actions group with 5 updates by
    @dependabot in #744
  * fix(driver): build specific code only for linux platform by
    @alacuku in #747
  * chore(deps): Bump the gomod group across 1 directory with 5
    updates by @dependabot in #746
  * chore(deps): Bump golang.org/x/net from 0.35.0 to 0.36.0 by
    @dependabot in #748
  * chore(deps): Bump the actions group with 2 updates by
    @dependabot in #760
  * chore(toolchain): bump go to version 1.23.7 by @alacuku in #761
  * chore(deps): bump oauth2 to v0.28.0 by @alacuku in #749
  * chore(deps): Bump golang.org/x/term from 0.29.0 to 0.30.0 by
    @dependabot in #750
  * update(go.mod): bulk deps upgrade by @leogr in #762
  * chore(deps): Bump github.com/docker/cli from
    27.5.1+incompatible to 28.0.1+incompatible by @dependabot in
    [#752]
  * chore(deps): Bump github.com/redis/go-redis/v9 from 9.7.0 to
    9.7.3 by @dependabot in #764
  * chore(deps): Bump github.com/golang-jwt/jwt/v4 from 4.5.1 to
    4.5.2 by @dependabot in #766
  * chore(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to
    5.2.2 by @dependabot in #765
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #767
  * chore(deps): Bump the gomod group with 5 updates by @dependabot
    in #768
  * chore(deps): Bump google.golang.org/api from 0.224.0 to 0.227.0
    by @dependabot in #770
  * chore(deps): Bump github.com/distribution/distribution/v3 from
    3.0.0-rc.3 to 3.0.0-rc.4 by @dependabot in #771
  * chore(deps): Bump cloud.google.com/go/storage from 1.50.0 to
    1.51.0 by @dependabot in #772
  * chore(deps): Bump github.com/spf13/viper from 1.19.0 to 1.20.0
    by @dependabot in #773</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748520000">- Update to version 0.11.2:
  * chore(build): update golang and net packages
  * chore(deps): Bump the actions group with 2 updates
  * feat: change aws-sdk-go from v1 to v2
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755777600">- Update to version 0.11.3:
  * chore(deps): Bump actions/checkout from 4.2.2 to 5.0.0
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group
  * chore(deps): Bump the actions group across 1 directory with 3
    updates
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): bump driverkit to v0.21.2
  * chore(deps): bump github.com/go-oauth2/oauth2 to v4.5.3
  * chore(deps): Bump sigstore/cosign-installer in the actions
    group
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/go-viper/mapstructure/v2
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/cloudflare/circl from 1.3.8 to
    1.6.1
  * chore(deps): Bump docker/build-push-action in the actions group</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758715200">- Update to version 0.11.4:
  * chore(deps): Bump k8s.io/client-go from 0.32.3 to 0.33.4
  * chore(deps): Bump github.com/gookit/color from 1.5.4 to 1.6.0
  * chore(deps): Bump sigstore/cosign-installer in the actions
    group
  * chore(deps): Bump aws-actions/configure-aws-credentials
  * chore(deps): Bump actions/setup-go from 5.5.0 to 6.0.0
  * chore(deps): Bump github.com/stretchr/testify from 1.10.0 to
    1.11.0
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump k8s.io/api from 0.32.3 to 0.33.4
  * chore(deps): Bump golang.org/x/term from 0.32.0 to 0.34.0
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/config
  * chore(deps): Bump k8s.io/apimachinery from 0.32.3 to 0.33.4
  * chore(deps): Bump github.com/go-viper/mapstructure/v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768996800">- Update to version 0.12.0:
  * fix: use cached cosign trusted root
  * fix: support cosign v3 also for local images, improve
    trustedRoot creation behavior
  * feat(cosign): upgrade to v3 with bundle format support
  * fix: resolve file descriptor leak in follower and clarify test
    expectation
  * test(artifact): add ValidateVersion tests to document strict
    semver enforcement
  * doc: explain new behavior on tolerant semver install command
  * fix: enforce semver version validation on pushed artifact
  * fix: linting
  * fix(cmd/artifact/install): accept major-only and major.minor
    versions
  * chore(deps): Bump golangci/golangci-lint-action
  * chore(deps): Bump actions/setup-go in the actions group
  * fix: patch dependencies
  * chore(deps): Bump sigstore/cosign-installer from 3.10.0 to
    4.0.0
  * fix(.golangci.yml): correct config again
  * fix(.github): upgrade golangci-lint action to v7.0.0
  * fix(cmd/artifact/install): correctly handle error in deferred
    file close
  * chore: upgrade golangci to v2
  * fix: upgrade driverkit and transitive deps
  * chore(deps): Bump github.com/sigstore/fulcio from 1.6.6 to
    1.8.5
  * fix(install): fix file descriptor leak and improve error
    messages
  * fix: change artifactRef with artifact.ref after the rebase
  * fix: use a dedicated directory for artifact state to avoid
    writing in a watched folder of Falco, improve tests
  * added tests to state, install and follower - some other minor
    changes
  * added shared state between install and follow
  * fix: improve documentation and logs
  * fix: avoid usage of resolved refs during signature, resolve
    alternative artifact reference, add tests to
    prepareArtifactList
  * fix: change copyright year
  * fix: add cap to slice and map, make the PrepareArtifactList not
    exported
  * create specific method to prepare reference list
  * fixed logic to deduplicate refs and dependencies during
    artifact install command
  * chore(deps): Bump docker/setup-buildx-action in the actions
    group
  * chore(deps): Bump actions/checkout from 5.0.0 to 6.0.1
  * chore(deps): Bump actions/upload-artifact from 4.6.2 to 6.0.0
  * chore(deps): Bump the actions group with 2 updates
  * chore: bump golanci-linter version
  * feat: add start-up behaviour configuration for follow
  * chore: reduce version check frequency to 7 days to reduce
    registry load
  * chore(deps): Bump the actions group across 1 directory with 5
    updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769083200">- Update to version 0.12.1:
  * doc: improve state dir config documentation
  * feat(artifact): add config file support for stateDir option</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769601600">- Update to version 0.12.2:
  * chore(deps): Bump github.com/theupdateframework/go-tuf/v2
  * fix(signature): pass registry credentials to cosign for
    signature verification
  * chore(deps): Bump actions/checkout in the actions group
  * chore(deps): Bump github.com/sigstore/sigstore from 1.10.3 to
    1.10.4
  * chore(deps): Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0
  * chore(deps): Bump github.com/theupdateframework/go-tuf/v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777896000">- Update to version 0.13.0:
  * chore(deps): Bump google.golang.org/api from 0.275.0 to 0.277.0
  * chore(deps): Bump github.com/sigstore/timestamp-authority/v2
  * chore(deps): Bump the gomod group with 9 updates
  * chore(deps): Bump the actions group across 1 directory with 2
    updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump the gomod group with 3 updates
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 3 updates
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  * chore(deps): Bump cloud.google.com/go/storage from 1.61.3 to
    1.62.0
  * chore(deps): Bump the gomod group across 1 directory with 11
    updates
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump google.golang.org/api from 0.272.0 to 0.275.0
  * chore(deps): Bump the actions group across 1 directory with 7
    updates
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
  * chore(deps): Bump the gomod group across 1 directory with 8
    updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump google.golang.org/api from 0.271.0 to 0.272.0
  * chore(deps): Bump aws-actions/amazon-ecr-login in the actions
    group
  * chore(deps): Bump the gomod group with 4 updates
  * chore(deps): Bump google.golang.org/grpc from 1.79.2 to 1.79.3
  * chore(deps): Bump github.com/cilium/ebpf from 0.20.0 to 0.21.0
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.59.2 to
    1.61.3
  * chore(deps): Bump golang.org/x/net from 0.51.0 to 0.52.0
  * chore!: remove `tls` command
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump golang.org/x/crypto from 0.48.0 to 0.49.0
  * chore(deps): Bump docker/metadata-action from 5.10.0 to 6.0.0
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump github.com/google/go-containerregistry
  * chore(deps): Bump golang.org/x/sys from 0.40.0 to 0.42.0
  * chore(deps): Bump golang.org/x/oauth2 from 0.35.0 to 0.36.0
  * chore(deps): Bump docker/build-push-action from 6.19.2 to 7.0.0
  * chore(deps): Bump docker/setup-qemu-action from 3.7.0 to 4.0.0
  * chore(deps): Bump docker/setup-buildx-action from 3.12.0 to
    4.0.0
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump golang.org/x/net from 0.49.0 to 0.51.0
  * chore(deps): Bump docker/login-action from 3.7.0 to 4.0.0
  * chore(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.0
  * chore(deps): Bump actions/setup-go in the actions group
  * chore(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0
  * chore(deps): Bump the gomod group across 1 directory with 15
    updates
  * chore(deps): Bump goreleaser/goreleaser-action from 6.4.0 to
    7.0.0
  * chore!: drop legacy BPF probe support
  * chore(deps): Bump docker/build-push-action in the actions group
  * chore(deps): Bump aws-actions/configure-aws-credentials
  * chore(deps): bump oras.land/oras-go/v2 from 2.5.0 to 2.6.0
  * chore(deps): Bump github.com/cilium/ebpf from 0.17.3 to 0.19.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.51.0 to
    1.56.1
  * chore(deps): Bump github.com/onsi/gomega from 1.36.3 to 1.38.2
  * chore(deps): Bump docker/login-action in the actions group</changelog>
</package>
<package pkgid="a7bf07c752bd50eb514ea20b2110231fe10fa7c3bd8b8c3ec3f86639d20492ddbd4d33e14e076605dc1feb54f916816613bda32848f0291754fa535e40738cb0" name="falcoctl-debuginfo" arch="s390x">
  <version epoch="0" ver="0.13.0" rel="27.9"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1706875200">- new package falcoctl: CLI for the Falco Cloud Native Runtime
  Security solution</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1707739200">- Update to version 0.7.2:
  * bumped helper message
  * added http-header option in driver download
  * chore(pkg/driver): ubuntu has its own specific FixupKernel
    logic now.
  * fix(pkg/driver): fixed generic kernelversion fixup method.
  * pkg/driver/flatcar: Update the script
  * fix: Dead link in PR template
  * chore(cmd): fixed up some strings.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1708776000">- Update to version 0.7.3:
  * fix(CI): add permissions to login-to-amazon-ecr job
  * new(ci): add provenance for main tag
  * fix(CI): properly get credentials for amazon ecr registry
  * new(CI): add provenance for ecr image
  * fix(ci): add permissions for AWS ecr
  * new(CI): add ecr repository</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717243200">- Update to version 0.8.0:
  * add dependabot config and update golangci-lint by @cpanato in
    [#385]
  * chore(cmd): fixed up some strings. by @FedeDP in #407
  * fix: fixed go.sum entry to fix build. by @FedeDP in #415
  * feat: adding support for KMS in cosign by @brennoo in #416
  * fix: Dead link in PR template by @krnowak in #424
  * pkg/driver/flatcar: Update the script by @krnowak in #425
  * fix(pkg/driver): fixed generic kernelversion fixup method. by
    @FedeDP in #427
  * new(cmd/driver): support user provided headers option for
    driver download by @toamto94 in #428
  * fix(pusher): correctly report artifact type by @alacuku in #442
  * Remove extra '$' character. by @thejefflarson in #458
  * feat(cmd/push): parse requirements and deps from rulesfile by
    @alacuku in #467
  * update(cmd): bumped oras to v.2.4.0. by @FedeDP in #478
  * fix(registry/push): correctly remove temporary dir by @alacuku
    in #479
  * update(tests/push): add new tests for push command by @alacuku
    in #486
  * new: driver selection logic by @FedeDP in #484
  * new(pkg/driver): try to fetch kernel headers leveraging
    driverkit library when building drivers by @FedeDP in #476
  * chore(cmd,pkg,internal): switch to use oras-go credentials
    package since oras-go-credentials is deprecated by @FedeDP in
    [#496]
  * chore(cmd/push): uniform receiver for push command by @alacuku
    in #498
  * fix(pkg/driver): fixup kernel headers download by @FedeDP in
    [#499]
  * fix(artifact/info): filter out signature tags by @alacuku in
    [#507]
  * vote: docs(OWNERS): add alacuku (Aldo Lacuku) to approvers by
    @alacuku in #497
  * cleanup(cmd/driver): drop preview tag. by @FedeDP in #506
  * fix(install): fix missing dependency signature verification by
    @LucaGuerra in #509
  * chore(cmd): dropped leftover experimental for driver-loader. by
    @FedeDP in #515
  * fix: Add backend 'https' to default index by @QJoly in #520
  * chore(internal): old ebpf probe must have lowest priority. by
    @FedeDP in #521
  * fix(pkg/driver): avoid source of crash during distro Discovery.
    by @FedeDP in #530
  * chore(build): bump go version to 1.22 by @alacuku in #533
  * add new boolean arg for 'registry push' --add-floating-tags, it
    will auto add the tags for the major and the minor versions by
    @Issif in #543
  * cleanup(cmd,pkg): moved enum to its own package. by @FedeDP in
    [#550]
  * new(pkg): use driverkit local build processor instead of
    implementing drivers build by @FedeDP in #356
  * fix(pkg/driver): create envmap if nil since driverkit expects
    it. by @FedeDP in #551
  * chore(cmd/driver): remove redundant log. by @FedeDP in #552
  * chore: updated driverkit to v0.19.2 by @FedeDP in #553
  * chore(deps): Bump google.golang.org/api from 0.178.0 to 0.180.0
    by @dependabot in #559
  * chore(deps): Bump the gomod group with 3 updates by @dependabot
    in #558
  * feat: Add --platform option to artifact/install by @kpaulisse
    in #554
  * chore(deps): Bump the actions group with 2 updates by
    @dependabot in #556
  * chore(deps): Bump golangci/golangci-lint-action from 5.3.0
    to 6.0.1 by @dependabot in #557
  * feat: Add file backend to fetcher by @kpaulisse in #555
  * new(cmd/driver): driver config namespace from env variable by
    @FedeDP in #560</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1722513600">- Update to version 0.9.0:
  * update(OWNERS): remove new line
  * update(OWNERS): add loresuso to approvers
  * chore(deps): Bump github.com/docker/docker
  * chore(pkg): bump driverkit to 0.20.0
  * chore(deps): Bump the actions group with 4 updates
  * chore(deps): Bump goreleaser/goreleaser-action from 5.1.0 to
    6.0.0
  * update(.goreleaser): bump version to v2
  * chore(deps): Bump slsa-framework/slsa-verifier in the actions
    group
  * chore(deps): Bump docker/build-push-action from 5.4.0 to 6.4.1
  * fix(push): use basename for artifacts when compressed in tar.gz
  * chore(Makefile): add .PHONY to falcoctl target
  * Add support for S3 index storage backend
  * fix: allow login to express registry as ref but actually
    extract the registry
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump the actions group across 1 directory with 4
    updates
  * chore(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1
  * feat(dockerfile): use distroless image for falcoctl docker
    image
  * chore(go.mod): bump go version to 1.22.5
  * chore(cmd/driver,pkg/driver): allow to disable kernel headers
    automatic download.
  * chore(deps): Bump google.golang.org/api from 0.185.0 to 0.186.0
  * chore(deps): Bump github.com/hashicorp/go-retryablehttp
  * chore(deps): Bump google.golang.org/api from 0.184.0 to 0.185.0
  * chore(deps): Bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  * feat(auth/basic): extend auth basic command
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 4 updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.41.0 to
    1.42.0
  * chore(deps): Bump google.golang.org/api from 0.183.0 to 0.184.0
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump golang.org/x/net from 0.25.0 to 0.26.0
  * chore(deps): Bump golang.org/x/term from 0.20.0 to 0.21.0
  * chore(deps): Bump google.golang.org/api from 0.182.0 to 0.183.0
  * chore(deps): Bump golang.org/x/sys from 0.20.0 to 0.21.0
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump docker/login-action in the actions group
  * chore(deps): Bump google.golang.org/api from 0.181.0 to 0.182.0
  * chore(deps): Bump github.com/spf13/viper from 1.18.2 to 1.19.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.17.3 to
    2.19.0</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726315200">- Update to version 0.9.1:
  * chore(deps): Bump actions/upload-artifact in the actions group
  * fix(auth/basic): bind pflags to viper only when required
  * chore(deps): Bump the actions group across 1 directory with 3
    updates
  * chore(deps): Bump the actions group with 3 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726920000">- Update to version 0.10.0:
  * fix(goreleaser): use latest tag when two tags point to the same
    commit
  * update(go,pkg): updated driverkit to v0.20.3.
  * update(driver/config): add new unit tests
  * update(driver/config)!: use the same logic to configure engine
    kind for different enviroments</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732190400">- Update to version 0.10.1:
  * update(go): bumped driverkit dep to v0.20.4.
  * fix(pkg/oci): fix Tags pagination support.
  * chore(deps): Bump cloud.google.com/go/storage from 1.46.0 to
    1.47.0
  * chore(deps): Bump google.golang.org/api from 0.205.0 to 0.206.0
  * chore(deps): Bump github.com/golang-jwt/jwt/v4 from 4.5.0 to
    4.5.1
  * chore(deps): Bump golang.org/x/oauth2 from 0.23.0 to 0.24.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump golang.org/x/net from 0.30.0 to 0.31.0
  * chore(deps): Bump golang.org/x/term from 0.25.0 to 0.26.0
  * chore(deps): Bump google.golang.org/api from 0.204.0 to 0.205.0
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.20.2 to
    2.21.0
  * chore(deps): Bump google.golang.org/api from 0.200.0 to 0.204.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.45.0 to
    1.46.0
  * chore(deps): Bump github.com/onsi/gomega from 1.34.2 to 1.35.1
  * chore(deps): Bump k8s.io/client-go from 0.30.2 to 0.31.2
  * chore(deps): Bump github.com/sigstore/cosign/v2 from 2.2.4 to
    2.4.1
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.19.0 to
    2.20.2
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): Bump k8s.io/apimachinery from 0.30.2 to 0.31.2
  * chore(deps): Bump cloud.google.com/go/storage from 1.43.0 to
    1.45.0
  * chore(deps): Bump github.com/onsi/gomega from 1.33.1 to 1.34.2
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/cilium/ebpf from 0.15.0 to 0.16.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): align go.opentelemetry.io/otel/sdk/metric with
    otel/sdk v1.29.0
  * update go to 1.22.8
  * chore(deps): Bump the gomod group across 1 directory with 11
    updates
  * chore(deps): Bump the actions group with 2 updates
  * fix(cmd): relax file perms for Falco driver config override
  * chore(deps): Bump the actions group with 4 updates
  * chore(deps): Bump the actions group with 2 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737979200">- Update to version 0.11.0:
  * fix(follow): file handling of artifacts with directories
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump the actions group with 5 updates
  * chore(deps): Bump the gomod group across 1 directory with 5
    updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.49.0 to
    1.50.0
  * chore(deps): Bump golang.org/x/net from 0.33.0 to 0.34.0
  * chore(deps): Bump k8s.io/client-go from 0.31.3 to 0.32.0
  * chore(deps): Bump k8s.io/apimachinery from 0.31.3 to 0.32.0
  * chore(go.mod): bump go version to 1.23.4
  * chore(deps): Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
  * chore(deps): Bump golang.org/x/term from 0.27.0 to 0.28.0
  * chore(deps): Bump golang.org/x/sys from 0.28.0 to 0.29.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 in the gomod group
  * chore(deps): Bump github.com/onsi/gomega in the gomod group
  * chore(deps): Bump cloud.google.com/go/storage from 1.48.0 to
    1.49.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump github.com/cilium/ebpf from 0.16.0 to 0.17.1
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump golang.org/x/net from 0.32.0 to 0.33.0
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump google.golang.org/api from 0.210.0 to 0.211.0
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): Bump actions/setup-go in the actions group
  * chore(deps): Bump the gomod group with 6 updates
  * chore(deps): Bump golang.org/x/crypto from 0.30.0 to 0.31.0
  * update(linter): remove deprecated linters
  * update(ci/linter): bump golangci-lint to v1.62.2
  * update(makefile): bump golangci-lint to v1.62.2
  * fix(mediaType): do not omit the original media type if not a
    well-known media type
  * chore(deps): Bump github.com/falcosecurity/driverkit in the
    gomod group
  * chore(deps): Bump golang.org/x/net from 0.31.0 to 0.32.0
  * chore(deps): Bump golang.org/x/term from 0.26.0 to 0.27.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.47.0 to
    1.48.0
  * chore(deps): Bump golang.org/x/sys from 0.27.0 to 0.28.0
  * chore(deps): Bump docker/build-push-action in the actions group
  * chore(deps): Bump github.com/pterm/pterm in the gomod group
  * chore(deps): Bump github.com/onsi/gomega from 1.35.1 to 1.36.0
  * chore(deps): Bump docker/metadata-action in the actions group
  * chore(deps): Bump github.com/stretchr/testify from 1.9.0 to
    1.10.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.21.0 to
    2.22.0
  * chore(deps): Bump google.golang.org/api from 0.206.0 to 0.209.0
  * chore(deps): Bump the gomod group with 3 updates
  * fix(auth/gcp): ensure correct OAuth scope for Artifact Registry
    with service account</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1742904000">- Update to version 0.11.1:
  * chore(deps): Bump aws-actions/configure-aws-credentials from
    4.0.2 to 4.0.3 in the actions group by @dependabot in #724
  * chore(deps): Bump the gomod group with 2 updates by @dependabot
    in #725
  * chore(deps): Bump the actions group with 5 updates by
    @dependabot in #730
  * Revert "chore(deps): Bump the gomod group with 2 updates" by
    @alacuku in #731
  * chore(deps): Bump golang.org/x/sys from 0.29.0 to 0.30.0 by
    @dependabot in #729
  * chore(deps): Bump golang.org/x/crypto from 0.32.0 to 0.33.0 by
    @dependabot in #728
  * chore(deps): Bump golang.org/x/oauth2 from 0.25.0 to 0.26.0 by
    @dependabot in #726
  * chore(deps): Bump github.com/distribution/distribution/v3 from
    3.0.0-rc.2 to 3.0.0-rc.3 by @dependabot in #732
  * chore(deps): Bump golang.org/x/net from 0.34.0 to 0.35.0 by
    @dependabot in #736
  * chore(deps): Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by
    @dependabot in #735
  * fix(CI): remove deprecated configuration from .golangci.yml by
    @alacuku in #739
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #737
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #740
  * chore(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.4 to
    4.0.5 by @dependabot in #742
  * chore(deps): Bump github.com/go-jose/go-jose/v3 from 3.0.3 to
    3.0.4 by @dependabot in #743
  * chore(deps): Bump the actions group with 5 updates by
    @dependabot in #744
  * fix(driver): build specific code only for linux platform by
    @alacuku in #747
  * chore(deps): Bump the gomod group across 1 directory with 5
    updates by @dependabot in #746
  * chore(deps): Bump golang.org/x/net from 0.35.0 to 0.36.0 by
    @dependabot in #748
  * chore(deps): Bump the actions group with 2 updates by
    @dependabot in #760
  * chore(toolchain): bump go to version 1.23.7 by @alacuku in #761
  * chore(deps): bump oauth2 to v0.28.0 by @alacuku in #749
  * chore(deps): Bump golang.org/x/term from 0.29.0 to 0.30.0 by
    @dependabot in #750
  * update(go.mod): bulk deps upgrade by @leogr in #762
  * chore(deps): Bump github.com/docker/cli from
    27.5.1+incompatible to 28.0.1+incompatible by @dependabot in
    [#752]
  * chore(deps): Bump github.com/redis/go-redis/v9 from 9.7.0 to
    9.7.3 by @dependabot in #764
  * chore(deps): Bump github.com/golang-jwt/jwt/v4 from 4.5.1 to
    4.5.2 by @dependabot in #766
  * chore(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to
    5.2.2 by @dependabot in #765
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #767
  * chore(deps): Bump the gomod group with 5 updates by @dependabot
    in #768
  * chore(deps): Bump google.golang.org/api from 0.224.0 to 0.227.0
    by @dependabot in #770
  * chore(deps): Bump github.com/distribution/distribution/v3 from
    3.0.0-rc.3 to 3.0.0-rc.4 by @dependabot in #771
  * chore(deps): Bump cloud.google.com/go/storage from 1.50.0 to
    1.51.0 by @dependabot in #772
  * chore(deps): Bump github.com/spf13/viper from 1.19.0 to 1.20.0
    by @dependabot in #773</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748520000">- Update to version 0.11.2:
  * chore(build): update golang and net packages
  * chore(deps): Bump the actions group with 2 updates
  * feat: change aws-sdk-go from v1 to v2
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755777600">- Update to version 0.11.3:
  * chore(deps): Bump actions/checkout from 4.2.2 to 5.0.0
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group
  * chore(deps): Bump the actions group across 1 directory with 3
    updates
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): bump driverkit to v0.21.2
  * chore(deps): bump github.com/go-oauth2/oauth2 to v4.5.3
  * chore(deps): Bump sigstore/cosign-installer in the actions
    group
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/go-viper/mapstructure/v2
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/cloudflare/circl from 1.3.8 to
    1.6.1
  * chore(deps): Bump docker/build-push-action in the actions group</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758715200">- Update to version 0.11.4:
  * chore(deps): Bump k8s.io/client-go from 0.32.3 to 0.33.4
  * chore(deps): Bump github.com/gookit/color from 1.5.4 to 1.6.0
  * chore(deps): Bump sigstore/cosign-installer in the actions
    group
  * chore(deps): Bump aws-actions/configure-aws-credentials
  * chore(deps): Bump actions/setup-go from 5.5.0 to 6.0.0
  * chore(deps): Bump github.com/stretchr/testify from 1.10.0 to
    1.11.0
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump k8s.io/api from 0.32.3 to 0.33.4
  * chore(deps): Bump golang.org/x/term from 0.32.0 to 0.34.0
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/config
  * chore(deps): Bump k8s.io/apimachinery from 0.32.3 to 0.33.4
  * chore(deps): Bump github.com/go-viper/mapstructure/v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768996800">- Update to version 0.12.0:
  * fix: use cached cosign trusted root
  * fix: support cosign v3 also for local images, improve
    trustedRoot creation behavior
  * feat(cosign): upgrade to v3 with bundle format support
  * fix: resolve file descriptor leak in follower and clarify test
    expectation
  * test(artifact): add ValidateVersion tests to document strict
    semver enforcement
  * doc: explain new behavior on tolerant semver install command
  * fix: enforce semver version validation on pushed artifact
  * fix: linting
  * fix(cmd/artifact/install): accept major-only and major.minor
    versions
  * chore(deps): Bump golangci/golangci-lint-action
  * chore(deps): Bump actions/setup-go in the actions group
  * fix: patch dependencies
  * chore(deps): Bump sigstore/cosign-installer from 3.10.0 to
    4.0.0
  * fix(.golangci.yml): correct config again
  * fix(.github): upgrade golangci-lint action to v7.0.0
  * fix(cmd/artifact/install): correctly handle error in deferred
    file close
  * chore: upgrade golangci to v2
  * fix: upgrade driverkit and transitive deps
  * chore(deps): Bump github.com/sigstore/fulcio from 1.6.6 to
    1.8.5
  * fix(install): fix file descriptor leak and improve error
    messages
  * fix: change artifactRef with artifact.ref after the rebase
  * fix: use a dedicated directory for artifact state to avoid
    writing in a watched folder of Falco, improve tests
  * added tests to state, install and follower - some other minor
    changes
  * added shared state between install and follow
  * fix: improve documentation and logs
  * fix: avoid usage of resolved refs during signature, resolve
    alternative artifact reference, add tests to
    prepareArtifactList
  * fix: change copyright year
  * fix: add cap to slice and map, make the PrepareArtifactList not
    exported
  * create specific method to prepare reference list
  * fixed logic to deduplicate refs and dependencies during
    artifact install command
  * chore(deps): Bump docker/setup-buildx-action in the actions
    group
  * chore(deps): Bump actions/checkout from 5.0.0 to 6.0.1
  * chore(deps): Bump actions/upload-artifact from 4.6.2 to 6.0.0
  * chore(deps): Bump the actions group with 2 updates
  * chore: bump golanci-linter version
  * feat: add start-up behaviour configuration for follow
  * chore: reduce version check frequency to 7 days to reduce
    registry load
  * chore(deps): Bump the actions group across 1 directory with 5
    updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769083200">- Update to version 0.12.1:
  * doc: improve state dir config documentation
  * feat(artifact): add config file support for stateDir option</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769601600">- Update to version 0.12.2:
  * chore(deps): Bump github.com/theupdateframework/go-tuf/v2
  * fix(signature): pass registry credentials to cosign for
    signature verification
  * chore(deps): Bump actions/checkout in the actions group
  * chore(deps): Bump github.com/sigstore/sigstore from 1.10.3 to
    1.10.4
  * chore(deps): Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0
  * chore(deps): Bump github.com/theupdateframework/go-tuf/v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777896000">- Update to version 0.13.0:
  * chore(deps): Bump google.golang.org/api from 0.275.0 to 0.277.0
  * chore(deps): Bump github.com/sigstore/timestamp-authority/v2
  * chore(deps): Bump the gomod group with 9 updates
  * chore(deps): Bump the actions group across 1 directory with 2
    updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump the gomod group with 3 updates
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 3 updates
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  * chore(deps): Bump cloud.google.com/go/storage from 1.61.3 to
    1.62.0
  * chore(deps): Bump the gomod group across 1 directory with 11
    updates
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump google.golang.org/api from 0.272.0 to 0.275.0
  * chore(deps): Bump the actions group across 1 directory with 7
    updates
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
  * chore(deps): Bump the gomod group across 1 directory with 8
    updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump google.golang.org/api from 0.271.0 to 0.272.0
  * chore(deps): Bump aws-actions/amazon-ecr-login in the actions
    group
  * chore(deps): Bump the gomod group with 4 updates
  * chore(deps): Bump google.golang.org/grpc from 1.79.2 to 1.79.3
  * chore(deps): Bump github.com/cilium/ebpf from 0.20.0 to 0.21.0
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.59.2 to
    1.61.3
  * chore(deps): Bump golang.org/x/net from 0.51.0 to 0.52.0
  * chore!: remove `tls` command
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump golang.org/x/crypto from 0.48.0 to 0.49.0
  * chore(deps): Bump docker/metadata-action from 5.10.0 to 6.0.0
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump github.com/google/go-containerregistry
  * chore(deps): Bump golang.org/x/sys from 0.40.0 to 0.42.0
  * chore(deps): Bump golang.org/x/oauth2 from 0.35.0 to 0.36.0
  * chore(deps): Bump docker/build-push-action from 6.19.2 to 7.0.0
  * chore(deps): Bump docker/setup-qemu-action from 3.7.0 to 4.0.0
  * chore(deps): Bump docker/setup-buildx-action from 3.12.0 to
    4.0.0
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump golang.org/x/net from 0.49.0 to 0.51.0
  * chore(deps): Bump docker/login-action from 3.7.0 to 4.0.0
  * chore(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.0
  * chore(deps): Bump actions/setup-go in the actions group
  * chore(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0
  * chore(deps): Bump the gomod group across 1 directory with 15
    updates
  * chore(deps): Bump goreleaser/goreleaser-action from 6.4.0 to
    7.0.0
  * chore!: drop legacy BPF probe support
  * chore(deps): Bump docker/build-push-action in the actions group
  * chore(deps): Bump aws-actions/configure-aws-credentials
  * chore(deps): bump oras.land/oras-go/v2 from 2.5.0 to 2.6.0
  * chore(deps): Bump github.com/cilium/ebpf from 0.17.3 to 0.19.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.51.0 to
    1.56.1
  * chore(deps): Bump github.com/onsi/gomega from 1.36.3 to 1.38.2
  * chore(deps): Bump docker/login-action in the actions group</changelog>
</package>
<package pkgid="57df34e026480a5184cd6a0ade0985888703b1b11eaec32c807a5b116f89aeca1bcd10e17537a1c4cc7329aed0423fcc6f6bdf361a9f2001b17fa2cd1713ea13" name="falcoctl-fish-completion" arch="noarch">
  <version epoch="0" ver="0.13.0" rel="27.9"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1706875200">- new package falcoctl: CLI for the Falco Cloud Native Runtime
  Security solution</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1707739200">- Update to version 0.7.2:
  * bumped helper message
  * added http-header option in driver download
  * chore(pkg/driver): ubuntu has its own specific FixupKernel
    logic now.
  * fix(pkg/driver): fixed generic kernelversion fixup method.
  * pkg/driver/flatcar: Update the script
  * fix: Dead link in PR template
  * chore(cmd): fixed up some strings.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1708776000">- Update to version 0.7.3:
  * fix(CI): add permissions to login-to-amazon-ecr job
  * new(ci): add provenance for main tag
  * fix(CI): properly get credentials for amazon ecr registry
  * new(CI): add provenance for ecr image
  * fix(ci): add permissions for AWS ecr
  * new(CI): add ecr repository</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717243200">- Update to version 0.8.0:
  * add dependabot config and update golangci-lint by @cpanato in
    [#385]
  * chore(cmd): fixed up some strings. by @FedeDP in #407
  * fix: fixed go.sum entry to fix build. by @FedeDP in #415
  * feat: adding support for KMS in cosign by @brennoo in #416
  * fix: Dead link in PR template by @krnowak in #424
  * pkg/driver/flatcar: Update the script by @krnowak in #425
  * fix(pkg/driver): fixed generic kernelversion fixup method. by
    @FedeDP in #427
  * new(cmd/driver): support user provided headers option for
    driver download by @toamto94 in #428
  * fix(pusher): correctly report artifact type by @alacuku in #442
  * Remove extra '$' character. by @thejefflarson in #458
  * feat(cmd/push): parse requirements and deps from rulesfile by
    @alacuku in #467
  * update(cmd): bumped oras to v.2.4.0. by @FedeDP in #478
  * fix(registry/push): correctly remove temporary dir by @alacuku
    in #479
  * update(tests/push): add new tests for push command by @alacuku
    in #486
  * new: driver selection logic by @FedeDP in #484
  * new(pkg/driver): try to fetch kernel headers leveraging
    driverkit library when building drivers by @FedeDP in #476
  * chore(cmd,pkg,internal): switch to use oras-go credentials
    package since oras-go-credentials is deprecated by @FedeDP in
    [#496]
  * chore(cmd/push): uniform receiver for push command by @alacuku
    in #498
  * fix(pkg/driver): fixup kernel headers download by @FedeDP in
    [#499]
  * fix(artifact/info): filter out signature tags by @alacuku in
    [#507]
  * vote: docs(OWNERS): add alacuku (Aldo Lacuku) to approvers by
    @alacuku in #497
  * cleanup(cmd/driver): drop preview tag. by @FedeDP in #506
  * fix(install): fix missing dependency signature verification by
    @LucaGuerra in #509
  * chore(cmd): dropped leftover experimental for driver-loader. by
    @FedeDP in #515
  * fix: Add backend 'https' to default index by @QJoly in #520
  * chore(internal): old ebpf probe must have lowest priority. by
    @FedeDP in #521
  * fix(pkg/driver): avoid source of crash during distro Discovery.
    by @FedeDP in #530
  * chore(build): bump go version to 1.22 by @alacuku in #533
  * add new boolean arg for 'registry push' --add-floating-tags, it
    will auto add the tags for the major and the minor versions by
    @Issif in #543
  * cleanup(cmd,pkg): moved enum to its own package. by @FedeDP in
    [#550]
  * new(pkg): use driverkit local build processor instead of
    implementing drivers build by @FedeDP in #356
  * fix(pkg/driver): create envmap if nil since driverkit expects
    it. by @FedeDP in #551
  * chore(cmd/driver): remove redundant log. by @FedeDP in #552
  * chore: updated driverkit to v0.19.2 by @FedeDP in #553
  * chore(deps): Bump google.golang.org/api from 0.178.0 to 0.180.0
    by @dependabot in #559
  * chore(deps): Bump the gomod group with 3 updates by @dependabot
    in #558
  * feat: Add --platform option to artifact/install by @kpaulisse
    in #554
  * chore(deps): Bump the actions group with 2 updates by
    @dependabot in #556
  * chore(deps): Bump golangci/golangci-lint-action from 5.3.0
    to 6.0.1 by @dependabot in #557
  * feat: Add file backend to fetcher by @kpaulisse in #555
  * new(cmd/driver): driver config namespace from env variable by
    @FedeDP in #560</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1722513600">- Update to version 0.9.0:
  * update(OWNERS): remove new line
  * update(OWNERS): add loresuso to approvers
  * chore(deps): Bump github.com/docker/docker
  * chore(pkg): bump driverkit to 0.20.0
  * chore(deps): Bump the actions group with 4 updates
  * chore(deps): Bump goreleaser/goreleaser-action from 5.1.0 to
    6.0.0
  * update(.goreleaser): bump version to v2
  * chore(deps): Bump slsa-framework/slsa-verifier in the actions
    group
  * chore(deps): Bump docker/build-push-action from 5.4.0 to 6.4.1
  * fix(push): use basename for artifacts when compressed in tar.gz
  * chore(Makefile): add .PHONY to falcoctl target
  * Add support for S3 index storage backend
  * fix: allow login to express registry as ref but actually
    extract the registry
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump the actions group across 1 directory with 4
    updates
  * chore(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1
  * feat(dockerfile): use distroless image for falcoctl docker
    image
  * chore(go.mod): bump go version to 1.22.5
  * chore(cmd/driver,pkg/driver): allow to disable kernel headers
    automatic download.
  * chore(deps): Bump google.golang.org/api from 0.185.0 to 0.186.0
  * chore(deps): Bump github.com/hashicorp/go-retryablehttp
  * chore(deps): Bump google.golang.org/api from 0.184.0 to 0.185.0
  * chore(deps): Bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  * feat(auth/basic): extend auth basic command
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 4 updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.41.0 to
    1.42.0
  * chore(deps): Bump google.golang.org/api from 0.183.0 to 0.184.0
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump golang.org/x/net from 0.25.0 to 0.26.0
  * chore(deps): Bump golang.org/x/term from 0.20.0 to 0.21.0
  * chore(deps): Bump google.golang.org/api from 0.182.0 to 0.183.0
  * chore(deps): Bump golang.org/x/sys from 0.20.0 to 0.21.0
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump docker/login-action in the actions group
  * chore(deps): Bump google.golang.org/api from 0.181.0 to 0.182.0
  * chore(deps): Bump github.com/spf13/viper from 1.18.2 to 1.19.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.17.3 to
    2.19.0</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726315200">- Update to version 0.9.1:
  * chore(deps): Bump actions/upload-artifact in the actions group
  * fix(auth/basic): bind pflags to viper only when required
  * chore(deps): Bump the actions group across 1 directory with 3
    updates
  * chore(deps): Bump the actions group with 3 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726920000">- Update to version 0.10.0:
  * fix(goreleaser): use latest tag when two tags point to the same
    commit
  * update(go,pkg): updated driverkit to v0.20.3.
  * update(driver/config): add new unit tests
  * update(driver/config)!: use the same logic to configure engine
    kind for different enviroments</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732190400">- Update to version 0.10.1:
  * update(go): bumped driverkit dep to v0.20.4.
  * fix(pkg/oci): fix Tags pagination support.
  * chore(deps): Bump cloud.google.com/go/storage from 1.46.0 to
    1.47.0
  * chore(deps): Bump google.golang.org/api from 0.205.0 to 0.206.0
  * chore(deps): Bump github.com/golang-jwt/jwt/v4 from 4.5.0 to
    4.5.1
  * chore(deps): Bump golang.org/x/oauth2 from 0.23.0 to 0.24.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump golang.org/x/net from 0.30.0 to 0.31.0
  * chore(deps): Bump golang.org/x/term from 0.25.0 to 0.26.0
  * chore(deps): Bump google.golang.org/api from 0.204.0 to 0.205.0
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.20.2 to
    2.21.0
  * chore(deps): Bump google.golang.org/api from 0.200.0 to 0.204.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.45.0 to
    1.46.0
  * chore(deps): Bump github.com/onsi/gomega from 1.34.2 to 1.35.1
  * chore(deps): Bump k8s.io/client-go from 0.30.2 to 0.31.2
  * chore(deps): Bump github.com/sigstore/cosign/v2 from 2.2.4 to
    2.4.1
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.19.0 to
    2.20.2
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): Bump k8s.io/apimachinery from 0.30.2 to 0.31.2
  * chore(deps): Bump cloud.google.com/go/storage from 1.43.0 to
    1.45.0
  * chore(deps): Bump github.com/onsi/gomega from 1.33.1 to 1.34.2
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/cilium/ebpf from 0.15.0 to 0.16.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): align go.opentelemetry.io/otel/sdk/metric with
    otel/sdk v1.29.0
  * update go to 1.22.8
  * chore(deps): Bump the gomod group across 1 directory with 11
    updates
  * chore(deps): Bump the actions group with 2 updates
  * fix(cmd): relax file perms for Falco driver config override
  * chore(deps): Bump the actions group with 4 updates
  * chore(deps): Bump the actions group with 2 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737979200">- Update to version 0.11.0:
  * fix(follow): file handling of artifacts with directories
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump the actions group with 5 updates
  * chore(deps): Bump the gomod group across 1 directory with 5
    updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.49.0 to
    1.50.0
  * chore(deps): Bump golang.org/x/net from 0.33.0 to 0.34.0
  * chore(deps): Bump k8s.io/client-go from 0.31.3 to 0.32.0
  * chore(deps): Bump k8s.io/apimachinery from 0.31.3 to 0.32.0
  * chore(go.mod): bump go version to 1.23.4
  * chore(deps): Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
  * chore(deps): Bump golang.org/x/term from 0.27.0 to 0.28.0
  * chore(deps): Bump golang.org/x/sys from 0.28.0 to 0.29.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 in the gomod group
  * chore(deps): Bump github.com/onsi/gomega in the gomod group
  * chore(deps): Bump cloud.google.com/go/storage from 1.48.0 to
    1.49.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump github.com/cilium/ebpf from 0.16.0 to 0.17.1
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump golang.org/x/net from 0.32.0 to 0.33.0
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump google.golang.org/api from 0.210.0 to 0.211.0
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): Bump actions/setup-go in the actions group
  * chore(deps): Bump the gomod group with 6 updates
  * chore(deps): Bump golang.org/x/crypto from 0.30.0 to 0.31.0
  * update(linter): remove deprecated linters
  * update(ci/linter): bump golangci-lint to v1.62.2
  * update(makefile): bump golangci-lint to v1.62.2
  * fix(mediaType): do not omit the original media type if not a
    well-known media type
  * chore(deps): Bump github.com/falcosecurity/driverkit in the
    gomod group
  * chore(deps): Bump golang.org/x/net from 0.31.0 to 0.32.0
  * chore(deps): Bump golang.org/x/term from 0.26.0 to 0.27.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.47.0 to
    1.48.0
  * chore(deps): Bump golang.org/x/sys from 0.27.0 to 0.28.0
  * chore(deps): Bump docker/build-push-action in the actions group
  * chore(deps): Bump github.com/pterm/pterm in the gomod group
  * chore(deps): Bump github.com/onsi/gomega from 1.35.1 to 1.36.0
  * chore(deps): Bump docker/metadata-action in the actions group
  * chore(deps): Bump github.com/stretchr/testify from 1.9.0 to
    1.10.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.21.0 to
    2.22.0
  * chore(deps): Bump google.golang.org/api from 0.206.0 to 0.209.0
  * chore(deps): Bump the gomod group with 3 updates
  * fix(auth/gcp): ensure correct OAuth scope for Artifact Registry
    with service account</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1742904000">- Update to version 0.11.1:
  * chore(deps): Bump aws-actions/configure-aws-credentials from
    4.0.2 to 4.0.3 in the actions group by @dependabot in #724
  * chore(deps): Bump the gomod group with 2 updates by @dependabot
    in #725
  * chore(deps): Bump the actions group with 5 updates by
    @dependabot in #730
  * Revert "chore(deps): Bump the gomod group with 2 updates" by
    @alacuku in #731
  * chore(deps): Bump golang.org/x/sys from 0.29.0 to 0.30.0 by
    @dependabot in #729
  * chore(deps): Bump golang.org/x/crypto from 0.32.0 to 0.33.0 by
    @dependabot in #728
  * chore(deps): Bump golang.org/x/oauth2 from 0.25.0 to 0.26.0 by
    @dependabot in #726
  * chore(deps): Bump github.com/distribution/distribution/v3 from
    3.0.0-rc.2 to 3.0.0-rc.3 by @dependabot in #732
  * chore(deps): Bump golang.org/x/net from 0.34.0 to 0.35.0 by
    @dependabot in #736
  * chore(deps): Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by
    @dependabot in #735
  * fix(CI): remove deprecated configuration from .golangci.yml by
    @alacuku in #739
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #737
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #740
  * chore(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.4 to
    4.0.5 by @dependabot in #742
  * chore(deps): Bump github.com/go-jose/go-jose/v3 from 3.0.3 to
    3.0.4 by @dependabot in #743
  * chore(deps): Bump the actions group with 5 updates by
    @dependabot in #744
  * fix(driver): build specific code only for linux platform by
    @alacuku in #747
  * chore(deps): Bump the gomod group across 1 directory with 5
    updates by @dependabot in #746
  * chore(deps): Bump golang.org/x/net from 0.35.0 to 0.36.0 by
    @dependabot in #748
  * chore(deps): Bump the actions group with 2 updates by
    @dependabot in #760
  * chore(toolchain): bump go to version 1.23.7 by @alacuku in #761
  * chore(deps): bump oauth2 to v0.28.0 by @alacuku in #749
  * chore(deps): Bump golang.org/x/term from 0.29.0 to 0.30.0 by
    @dependabot in #750
  * update(go.mod): bulk deps upgrade by @leogr in #762
  * chore(deps): Bump github.com/docker/cli from
    27.5.1+incompatible to 28.0.1+incompatible by @dependabot in
    [#752]
  * chore(deps): Bump github.com/redis/go-redis/v9 from 9.7.0 to
    9.7.3 by @dependabot in #764
  * chore(deps): Bump github.com/golang-jwt/jwt/v4 from 4.5.1 to
    4.5.2 by @dependabot in #766
  * chore(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to
    5.2.2 by @dependabot in #765
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #767
  * chore(deps): Bump the gomod group with 5 updates by @dependabot
    in #768
  * chore(deps): Bump google.golang.org/api from 0.224.0 to 0.227.0
    by @dependabot in #770
  * chore(deps): Bump github.com/distribution/distribution/v3 from
    3.0.0-rc.3 to 3.0.0-rc.4 by @dependabot in #771
  * chore(deps): Bump cloud.google.com/go/storage from 1.50.0 to
    1.51.0 by @dependabot in #772
  * chore(deps): Bump github.com/spf13/viper from 1.19.0 to 1.20.0
    by @dependabot in #773</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748520000">- Update to version 0.11.2:
  * chore(build): update golang and net packages
  * chore(deps): Bump the actions group with 2 updates
  * feat: change aws-sdk-go from v1 to v2
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755777600">- Update to version 0.11.3:
  * chore(deps): Bump actions/checkout from 4.2.2 to 5.0.0
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group
  * chore(deps): Bump the actions group across 1 directory with 3
    updates
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): bump driverkit to v0.21.2
  * chore(deps): bump github.com/go-oauth2/oauth2 to v4.5.3
  * chore(deps): Bump sigstore/cosign-installer in the actions
    group
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/go-viper/mapstructure/v2
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/cloudflare/circl from 1.3.8 to
    1.6.1
  * chore(deps): Bump docker/build-push-action in the actions group</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758715200">- Update to version 0.11.4:
  * chore(deps): Bump k8s.io/client-go from 0.32.3 to 0.33.4
  * chore(deps): Bump github.com/gookit/color from 1.5.4 to 1.6.0
  * chore(deps): Bump sigstore/cosign-installer in the actions
    group
  * chore(deps): Bump aws-actions/configure-aws-credentials
  * chore(deps): Bump actions/setup-go from 5.5.0 to 6.0.0
  * chore(deps): Bump github.com/stretchr/testify from 1.10.0 to
    1.11.0
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump k8s.io/api from 0.32.3 to 0.33.4
  * chore(deps): Bump golang.org/x/term from 0.32.0 to 0.34.0
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/config
  * chore(deps): Bump k8s.io/apimachinery from 0.32.3 to 0.33.4
  * chore(deps): Bump github.com/go-viper/mapstructure/v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768996800">- Update to version 0.12.0:
  * fix: use cached cosign trusted root
  * fix: support cosign v3 also for local images, improve
    trustedRoot creation behavior
  * feat(cosign): upgrade to v3 with bundle format support
  * fix: resolve file descriptor leak in follower and clarify test
    expectation
  * test(artifact): add ValidateVersion tests to document strict
    semver enforcement
  * doc: explain new behavior on tolerant semver install command
  * fix: enforce semver version validation on pushed artifact
  * fix: linting
  * fix(cmd/artifact/install): accept major-only and major.minor
    versions
  * chore(deps): Bump golangci/golangci-lint-action
  * chore(deps): Bump actions/setup-go in the actions group
  * fix: patch dependencies
  * chore(deps): Bump sigstore/cosign-installer from 3.10.0 to
    4.0.0
  * fix(.golangci.yml): correct config again
  * fix(.github): upgrade golangci-lint action to v7.0.0
  * fix(cmd/artifact/install): correctly handle error in deferred
    file close
  * chore: upgrade golangci to v2
  * fix: upgrade driverkit and transitive deps
  * chore(deps): Bump github.com/sigstore/fulcio from 1.6.6 to
    1.8.5
  * fix(install): fix file descriptor leak and improve error
    messages
  * fix: change artifactRef with artifact.ref after the rebase
  * fix: use a dedicated directory for artifact state to avoid
    writing in a watched folder of Falco, improve tests
  * added tests to state, install and follower - some other minor
    changes
  * added shared state between install and follow
  * fix: improve documentation and logs
  * fix: avoid usage of resolved refs during signature, resolve
    alternative artifact reference, add tests to
    prepareArtifactList
  * fix: change copyright year
  * fix: add cap to slice and map, make the PrepareArtifactList not
    exported
  * create specific method to prepare reference list
  * fixed logic to deduplicate refs and dependencies during
    artifact install command
  * chore(deps): Bump docker/setup-buildx-action in the actions
    group
  * chore(deps): Bump actions/checkout from 5.0.0 to 6.0.1
  * chore(deps): Bump actions/upload-artifact from 4.6.2 to 6.0.0
  * chore(deps): Bump the actions group with 2 updates
  * chore: bump golanci-linter version
  * feat: add start-up behaviour configuration for follow
  * chore: reduce version check frequency to 7 days to reduce
    registry load
  * chore(deps): Bump the actions group across 1 directory with 5
    updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769083200">- Update to version 0.12.1:
  * doc: improve state dir config documentation
  * feat(artifact): add config file support for stateDir option</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769601600">- Update to version 0.12.2:
  * chore(deps): Bump github.com/theupdateframework/go-tuf/v2
  * fix(signature): pass registry credentials to cosign for
    signature verification
  * chore(deps): Bump actions/checkout in the actions group
  * chore(deps): Bump github.com/sigstore/sigstore from 1.10.3 to
    1.10.4
  * chore(deps): Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0
  * chore(deps): Bump github.com/theupdateframework/go-tuf/v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777896000">- Update to version 0.13.0:
  * chore(deps): Bump google.golang.org/api from 0.275.0 to 0.277.0
  * chore(deps): Bump github.com/sigstore/timestamp-authority/v2
  * chore(deps): Bump the gomod group with 9 updates
  * chore(deps): Bump the actions group across 1 directory with 2
    updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump the gomod group with 3 updates
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 3 updates
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  * chore(deps): Bump cloud.google.com/go/storage from 1.61.3 to
    1.62.0
  * chore(deps): Bump the gomod group across 1 directory with 11
    updates
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump google.golang.org/api from 0.272.0 to 0.275.0
  * chore(deps): Bump the actions group across 1 directory with 7
    updates
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
  * chore(deps): Bump the gomod group across 1 directory with 8
    updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump google.golang.org/api from 0.271.0 to 0.272.0
  * chore(deps): Bump aws-actions/amazon-ecr-login in the actions
    group
  * chore(deps): Bump the gomod group with 4 updates
  * chore(deps): Bump google.golang.org/grpc from 1.79.2 to 1.79.3
  * chore(deps): Bump github.com/cilium/ebpf from 0.20.0 to 0.21.0
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.59.2 to
    1.61.3
  * chore(deps): Bump golang.org/x/net from 0.51.0 to 0.52.0
  * chore!: remove `tls` command
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump golang.org/x/crypto from 0.48.0 to 0.49.0
  * chore(deps): Bump docker/metadata-action from 5.10.0 to 6.0.0
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump github.com/google/go-containerregistry
  * chore(deps): Bump golang.org/x/sys from 0.40.0 to 0.42.0
  * chore(deps): Bump golang.org/x/oauth2 from 0.35.0 to 0.36.0
  * chore(deps): Bump docker/build-push-action from 6.19.2 to 7.0.0
  * chore(deps): Bump docker/setup-qemu-action from 3.7.0 to 4.0.0
  * chore(deps): Bump docker/setup-buildx-action from 3.12.0 to
    4.0.0
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump golang.org/x/net from 0.49.0 to 0.51.0
  * chore(deps): Bump docker/login-action from 3.7.0 to 4.0.0
  * chore(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.0
  * chore(deps): Bump actions/setup-go in the actions group
  * chore(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0
  * chore(deps): Bump the gomod group across 1 directory with 15
    updates
  * chore(deps): Bump goreleaser/goreleaser-action from 6.4.0 to
    7.0.0
  * chore!: drop legacy BPF probe support
  * chore(deps): Bump docker/build-push-action in the actions group
  * chore(deps): Bump aws-actions/configure-aws-credentials
  * chore(deps): bump oras.land/oras-go/v2 from 2.5.0 to 2.6.0
  * chore(deps): Bump github.com/cilium/ebpf from 0.17.3 to 0.19.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.51.0 to
    1.56.1
  * chore(deps): Bump github.com/onsi/gomega from 1.36.3 to 1.38.2
  * chore(deps): Bump docker/login-action in the actions group</changelog>
</package>
<package pkgid="509ad7c52ad7af6a1562c6febb5c7343d44123ce4eba4f6602f6d794a1405f11f26516fb75b4238c8b8948f99f9c4d9533ddde418393ded59828b6ec8f4c721f" name="falcoctl-zsh-completion" arch="noarch">
  <version epoch="0" ver="0.13.0" rel="27.9"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1706875200">- new package falcoctl: CLI for the Falco Cloud Native Runtime
  Security solution</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1707739200">- Update to version 0.7.2:
  * bumped helper message
  * added http-header option in driver download
  * chore(pkg/driver): ubuntu has its own specific FixupKernel
    logic now.
  * fix(pkg/driver): fixed generic kernelversion fixup method.
  * pkg/driver/flatcar: Update the script
  * fix: Dead link in PR template
  * chore(cmd): fixed up some strings.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1708776000">- Update to version 0.7.3:
  * fix(CI): add permissions to login-to-amazon-ecr job
  * new(ci): add provenance for main tag
  * fix(CI): properly get credentials for amazon ecr registry
  * new(CI): add provenance for ecr image
  * fix(ci): add permissions for AWS ecr
  * new(CI): add ecr repository</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1717243200">- Update to version 0.8.0:
  * add dependabot config and update golangci-lint by @cpanato in
    [#385]
  * chore(cmd): fixed up some strings. by @FedeDP in #407
  * fix: fixed go.sum entry to fix build. by @FedeDP in #415
  * feat: adding support for KMS in cosign by @brennoo in #416
  * fix: Dead link in PR template by @krnowak in #424
  * pkg/driver/flatcar: Update the script by @krnowak in #425
  * fix(pkg/driver): fixed generic kernelversion fixup method. by
    @FedeDP in #427
  * new(cmd/driver): support user provided headers option for
    driver download by @toamto94 in #428
  * fix(pusher): correctly report artifact type by @alacuku in #442
  * Remove extra '$' character. by @thejefflarson in #458
  * feat(cmd/push): parse requirements and deps from rulesfile by
    @alacuku in #467
  * update(cmd): bumped oras to v.2.4.0. by @FedeDP in #478
  * fix(registry/push): correctly remove temporary dir by @alacuku
    in #479
  * update(tests/push): add new tests for push command by @alacuku
    in #486
  * new: driver selection logic by @FedeDP in #484
  * new(pkg/driver): try to fetch kernel headers leveraging
    driverkit library when building drivers by @FedeDP in #476
  * chore(cmd,pkg,internal): switch to use oras-go credentials
    package since oras-go-credentials is deprecated by @FedeDP in
    [#496]
  * chore(cmd/push): uniform receiver for push command by @alacuku
    in #498
  * fix(pkg/driver): fixup kernel headers download by @FedeDP in
    [#499]
  * fix(artifact/info): filter out signature tags by @alacuku in
    [#507]
  * vote: docs(OWNERS): add alacuku (Aldo Lacuku) to approvers by
    @alacuku in #497
  * cleanup(cmd/driver): drop preview tag. by @FedeDP in #506
  * fix(install): fix missing dependency signature verification by
    @LucaGuerra in #509
  * chore(cmd): dropped leftover experimental for driver-loader. by
    @FedeDP in #515
  * fix: Add backend 'https' to default index by @QJoly in #520
  * chore(internal): old ebpf probe must have lowest priority. by
    @FedeDP in #521
  * fix(pkg/driver): avoid source of crash during distro Discovery.
    by @FedeDP in #530
  * chore(build): bump go version to 1.22 by @alacuku in #533
  * add new boolean arg for 'registry push' --add-floating-tags, it
    will auto add the tags for the major and the minor versions by
    @Issif in #543
  * cleanup(cmd,pkg): moved enum to its own package. by @FedeDP in
    [#550]
  * new(pkg): use driverkit local build processor instead of
    implementing drivers build by @FedeDP in #356
  * fix(pkg/driver): create envmap if nil since driverkit expects
    it. by @FedeDP in #551
  * chore(cmd/driver): remove redundant log. by @FedeDP in #552
  * chore: updated driverkit to v0.19.2 by @FedeDP in #553
  * chore(deps): Bump google.golang.org/api from 0.178.0 to 0.180.0
    by @dependabot in #559
  * chore(deps): Bump the gomod group with 3 updates by @dependabot
    in #558
  * feat: Add --platform option to artifact/install by @kpaulisse
    in #554
  * chore(deps): Bump the actions group with 2 updates by
    @dependabot in #556
  * chore(deps): Bump golangci/golangci-lint-action from 5.3.0
    to 6.0.1 by @dependabot in #557
  * feat: Add file backend to fetcher by @kpaulisse in #555
  * new(cmd/driver): driver config namespace from env variable by
    @FedeDP in #560</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1722513600">- Update to version 0.9.0:
  * update(OWNERS): remove new line
  * update(OWNERS): add loresuso to approvers
  * chore(deps): Bump github.com/docker/docker
  * chore(pkg): bump driverkit to 0.20.0
  * chore(deps): Bump the actions group with 4 updates
  * chore(deps): Bump goreleaser/goreleaser-action from 5.1.0 to
    6.0.0
  * update(.goreleaser): bump version to v2
  * chore(deps): Bump slsa-framework/slsa-verifier in the actions
    group
  * chore(deps): Bump docker/build-push-action from 5.4.0 to 6.4.1
  * fix(push): use basename for artifacts when compressed in tar.gz
  * chore(Makefile): add .PHONY to falcoctl target
  * Add support for S3 index storage backend
  * fix: allow login to express registry as ref but actually
    extract the registry
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump the actions group across 1 directory with 4
    updates
  * chore(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1
  * feat(dockerfile): use distroless image for falcoctl docker
    image
  * chore(go.mod): bump go version to 1.22.5
  * chore(cmd/driver,pkg/driver): allow to disable kernel headers
    automatic download.
  * chore(deps): Bump google.golang.org/api from 0.185.0 to 0.186.0
  * chore(deps): Bump github.com/hashicorp/go-retryablehttp
  * chore(deps): Bump google.golang.org/api from 0.184.0 to 0.185.0
  * chore(deps): Bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  * feat(auth/basic): extend auth basic command
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 4 updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.41.0 to
    1.42.0
  * chore(deps): Bump google.golang.org/api from 0.183.0 to 0.184.0
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump golang.org/x/net from 0.25.0 to 0.26.0
  * chore(deps): Bump golang.org/x/term from 0.20.0 to 0.21.0
  * chore(deps): Bump google.golang.org/api from 0.182.0 to 0.183.0
  * chore(deps): Bump golang.org/x/sys from 0.20.0 to 0.21.0
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump docker/login-action in the actions group
  * chore(deps): Bump google.golang.org/api from 0.181.0 to 0.182.0
  * chore(deps): Bump github.com/spf13/viper from 1.18.2 to 1.19.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.17.3 to
    2.19.0</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726315200">- Update to version 0.9.1:
  * chore(deps): Bump actions/upload-artifact in the actions group
  * fix(auth/basic): bind pflags to viper only when required
  * chore(deps): Bump the actions group across 1 directory with 3
    updates
  * chore(deps): Bump the actions group with 3 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1726920000">- Update to version 0.10.0:
  * fix(goreleaser): use latest tag when two tags point to the same
    commit
  * update(go,pkg): updated driverkit to v0.20.3.
  * update(driver/config): add new unit tests
  * update(driver/config)!: use the same logic to configure engine
    kind for different enviroments</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732190400">- Update to version 0.10.1:
  * update(go): bumped driverkit dep to v0.20.4.
  * fix(pkg/oci): fix Tags pagination support.
  * chore(deps): Bump cloud.google.com/go/storage from 1.46.0 to
    1.47.0
  * chore(deps): Bump google.golang.org/api from 0.205.0 to 0.206.0
  * chore(deps): Bump github.com/golang-jwt/jwt/v4 from 4.5.0 to
    4.5.1
  * chore(deps): Bump golang.org/x/oauth2 from 0.23.0 to 0.24.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump golang.org/x/net from 0.30.0 to 0.31.0
  * chore(deps): Bump golang.org/x/term from 0.25.0 to 0.26.0
  * chore(deps): Bump google.golang.org/api from 0.204.0 to 0.205.0
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.20.2 to
    2.21.0
  * chore(deps): Bump google.golang.org/api from 0.200.0 to 0.204.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.45.0 to
    1.46.0
  * chore(deps): Bump github.com/onsi/gomega from 1.34.2 to 1.35.1
  * chore(deps): Bump k8s.io/client-go from 0.30.2 to 0.31.2
  * chore(deps): Bump github.com/sigstore/cosign/v2 from 2.2.4 to
    2.4.1
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.19.0 to
    2.20.2
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): Bump k8s.io/apimachinery from 0.30.2 to 0.31.2
  * chore(deps): Bump cloud.google.com/go/storage from 1.43.0 to
    1.45.0
  * chore(deps): Bump github.com/onsi/gomega from 1.33.1 to 1.34.2
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/cilium/ebpf from 0.15.0 to 0.16.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): align go.opentelemetry.io/otel/sdk/metric with
    otel/sdk v1.29.0
  * update go to 1.22.8
  * chore(deps): Bump the gomod group across 1 directory with 11
    updates
  * chore(deps): Bump the actions group with 2 updates
  * fix(cmd): relax file perms for Falco driver config override
  * chore(deps): Bump the actions group with 4 updates
  * chore(deps): Bump the actions group with 2 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737979200">- Update to version 0.11.0:
  * fix(follow): file handling of artifacts with directories
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump the actions group with 5 updates
  * chore(deps): Bump the gomod group across 1 directory with 5
    updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.49.0 to
    1.50.0
  * chore(deps): Bump golang.org/x/net from 0.33.0 to 0.34.0
  * chore(deps): Bump k8s.io/client-go from 0.31.3 to 0.32.0
  * chore(deps): Bump k8s.io/apimachinery from 0.31.3 to 0.32.0
  * chore(go.mod): bump go version to 1.23.4
  * chore(deps): Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
  * chore(deps): Bump golang.org/x/term from 0.27.0 to 0.28.0
  * chore(deps): Bump golang.org/x/sys from 0.28.0 to 0.29.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 in the gomod group
  * chore(deps): Bump github.com/onsi/gomega in the gomod group
  * chore(deps): Bump cloud.google.com/go/storage from 1.48.0 to
    1.49.0
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump github.com/cilium/ebpf from 0.16.0 to 0.17.1
  * chore(deps): Bump the gomod group with 2 updates
  * chore(deps): Bump golang.org/x/net from 0.32.0 to 0.33.0
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump google.golang.org/api from 0.210.0 to 0.211.0
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): Bump actions/setup-go in the actions group
  * chore(deps): Bump the gomod group with 6 updates
  * chore(deps): Bump golang.org/x/crypto from 0.30.0 to 0.31.0
  * update(linter): remove deprecated linters
  * update(ci/linter): bump golangci-lint to v1.62.2
  * update(makefile): bump golangci-lint to v1.62.2
  * fix(mediaType): do not omit the original media type if not a
    well-known media type
  * chore(deps): Bump github.com/falcosecurity/driverkit in the
    gomod group
  * chore(deps): Bump golang.org/x/net from 0.31.0 to 0.32.0
  * chore(deps): Bump golang.org/x/term from 0.26.0 to 0.27.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.47.0 to
    1.48.0
  * chore(deps): Bump golang.org/x/sys from 0.27.0 to 0.28.0
  * chore(deps): Bump docker/build-push-action in the actions group
  * chore(deps): Bump github.com/pterm/pterm in the gomod group
  * chore(deps): Bump github.com/onsi/gomega from 1.35.1 to 1.36.0
  * chore(deps): Bump docker/metadata-action in the actions group
  * chore(deps): Bump github.com/stretchr/testify from 1.9.0 to
    1.10.0
  * chore(deps): Bump github.com/onsi/ginkgo/v2 from 2.21.0 to
    2.22.0
  * chore(deps): Bump google.golang.org/api from 0.206.0 to 0.209.0
  * chore(deps): Bump the gomod group with 3 updates
  * fix(auth/gcp): ensure correct OAuth scope for Artifact Registry
    with service account</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1742904000">- Update to version 0.11.1:
  * chore(deps): Bump aws-actions/configure-aws-credentials from
    4.0.2 to 4.0.3 in the actions group by @dependabot in #724
  * chore(deps): Bump the gomod group with 2 updates by @dependabot
    in #725
  * chore(deps): Bump the actions group with 5 updates by
    @dependabot in #730
  * Revert "chore(deps): Bump the gomod group with 2 updates" by
    @alacuku in #731
  * chore(deps): Bump golang.org/x/sys from 0.29.0 to 0.30.0 by
    @dependabot in #729
  * chore(deps): Bump golang.org/x/crypto from 0.32.0 to 0.33.0 by
    @dependabot in #728
  * chore(deps): Bump golang.org/x/oauth2 from 0.25.0 to 0.26.0 by
    @dependabot in #726
  * chore(deps): Bump github.com/distribution/distribution/v3 from
    3.0.0-rc.2 to 3.0.0-rc.3 by @dependabot in #732
  * chore(deps): Bump golang.org/x/net from 0.34.0 to 0.35.0 by
    @dependabot in #736
  * chore(deps): Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 by
    @dependabot in #735
  * fix(CI): remove deprecated configuration from .golangci.yml by
    @alacuku in #739
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #737
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #740
  * chore(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.4 to
    4.0.5 by @dependabot in #742
  * chore(deps): Bump github.com/go-jose/go-jose/v3 from 3.0.3 to
    3.0.4 by @dependabot in #743
  * chore(deps): Bump the actions group with 5 updates by
    @dependabot in #744
  * fix(driver): build specific code only for linux platform by
    @alacuku in #747
  * chore(deps): Bump the gomod group across 1 directory with 5
    updates by @dependabot in #746
  * chore(deps): Bump golang.org/x/net from 0.35.0 to 0.36.0 by
    @dependabot in #748
  * chore(deps): Bump the actions group with 2 updates by
    @dependabot in #760
  * chore(toolchain): bump go to version 1.23.7 by @alacuku in #761
  * chore(deps): bump oauth2 to v0.28.0 by @alacuku in #749
  * chore(deps): Bump golang.org/x/term from 0.29.0 to 0.30.0 by
    @dependabot in #750
  * update(go.mod): bulk deps upgrade by @leogr in #762
  * chore(deps): Bump github.com/docker/cli from
    27.5.1+incompatible to 28.0.1+incompatible by @dependabot in
    [#752]
  * chore(deps): Bump github.com/redis/go-redis/v9 from 9.7.0 to
    9.7.3 by @dependabot in #764
  * chore(deps): Bump github.com/golang-jwt/jwt/v4 from 4.5.1 to
    4.5.2 by @dependabot in #766
  * chore(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to
    5.2.2 by @dependabot in #765
  * chore(deps): Bump the actions group with 3 updates by
    @dependabot in #767
  * chore(deps): Bump the gomod group with 5 updates by @dependabot
    in #768
  * chore(deps): Bump google.golang.org/api from 0.224.0 to 0.227.0
    by @dependabot in #770
  * chore(deps): Bump github.com/distribution/distribution/v3 from
    3.0.0-rc.3 to 3.0.0-rc.4 by @dependabot in #771
  * chore(deps): Bump cloud.google.com/go/storage from 1.50.0 to
    1.51.0 by @dependabot in #772
  * chore(deps): Bump github.com/spf13/viper from 1.19.0 to 1.20.0
    by @dependabot in #773</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748520000">- Update to version 0.11.2:
  * chore(build): update golang and net packages
  * chore(deps): Bump the actions group with 2 updates
  * feat: change aws-sdk-go from v1 to v2
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755777600">- Update to version 0.11.3:
  * chore(deps): Bump actions/checkout from 4.2.2 to 5.0.0
  * chore(deps): Bump goreleaser/goreleaser-action in the actions
    group
  * chore(deps): Bump the actions group across 1 directory with 3
    updates
  * chore(deps): Bump github.com/docker/docker
  * chore(deps): bump driverkit to v0.21.2
  * chore(deps): bump github.com/go-oauth2/oauth2 to v4.5.3
  * chore(deps): Bump sigstore/cosign-installer in the actions
    group
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/go-viper/mapstructure/v2
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump github.com/cloudflare/circl from 1.3.8 to
    1.6.1
  * chore(deps): Bump docker/build-push-action in the actions group</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758715200">- Update to version 0.11.4:
  * chore(deps): Bump k8s.io/client-go from 0.32.3 to 0.33.4
  * chore(deps): Bump github.com/gookit/color from 1.5.4 to 1.6.0
  * chore(deps): Bump sigstore/cosign-installer in the actions
    group
  * chore(deps): Bump aws-actions/configure-aws-credentials
  * chore(deps): Bump actions/setup-go from 5.5.0 to 6.0.0
  * chore(deps): Bump github.com/stretchr/testify from 1.10.0 to
    1.11.0
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump k8s.io/api from 0.32.3 to 0.33.4
  * chore(deps): Bump golang.org/x/term from 0.32.0 to 0.34.0
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/config
  * chore(deps): Bump k8s.io/apimachinery from 0.32.3 to 0.33.4
  * chore(deps): Bump github.com/go-viper/mapstructure/v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768996800">- Update to version 0.12.0:
  * fix: use cached cosign trusted root
  * fix: support cosign v3 also for local images, improve
    trustedRoot creation behavior
  * feat(cosign): upgrade to v3 with bundle format support
  * fix: resolve file descriptor leak in follower and clarify test
    expectation
  * test(artifact): add ValidateVersion tests to document strict
    semver enforcement
  * doc: explain new behavior on tolerant semver install command
  * fix: enforce semver version validation on pushed artifact
  * fix: linting
  * fix(cmd/artifact/install): accept major-only and major.minor
    versions
  * chore(deps): Bump golangci/golangci-lint-action
  * chore(deps): Bump actions/setup-go in the actions group
  * fix: patch dependencies
  * chore(deps): Bump sigstore/cosign-installer from 3.10.0 to
    4.0.0
  * fix(.golangci.yml): correct config again
  * fix(.github): upgrade golangci-lint action to v7.0.0
  * fix(cmd/artifact/install): correctly handle error in deferred
    file close
  * chore: upgrade golangci to v2
  * fix: upgrade driverkit and transitive deps
  * chore(deps): Bump github.com/sigstore/fulcio from 1.6.6 to
    1.8.5
  * fix(install): fix file descriptor leak and improve error
    messages
  * fix: change artifactRef with artifact.ref after the rebase
  * fix: use a dedicated directory for artifact state to avoid
    writing in a watched folder of Falco, improve tests
  * added tests to state, install and follower - some other minor
    changes
  * added shared state between install and follow
  * fix: improve documentation and logs
  * fix: avoid usage of resolved refs during signature, resolve
    alternative artifact reference, add tests to
    prepareArtifactList
  * fix: change copyright year
  * fix: add cap to slice and map, make the PrepareArtifactList not
    exported
  * create specific method to prepare reference list
  * fixed logic to deduplicate refs and dependencies during
    artifact install command
  * chore(deps): Bump docker/setup-buildx-action in the actions
    group
  * chore(deps): Bump actions/checkout from 5.0.0 to 6.0.1
  * chore(deps): Bump actions/upload-artifact from 4.6.2 to 6.0.0
  * chore(deps): Bump the actions group with 2 updates
  * chore: bump golanci-linter version
  * feat: add start-up behaviour configuration for follow
  * chore: reduce version check frequency to 7 days to reduce
    registry load
  * chore(deps): Bump the actions group across 1 directory with 5
    updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769083200">- Update to version 0.12.1:
  * doc: improve state dir config documentation
  * feat(artifact): add config file support for stateDir option</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769601600">- Update to version 0.12.2:
  * chore(deps): Bump github.com/theupdateframework/go-tuf/v2
  * fix(signature): pass registry credentials to cosign for
    signature verification
  * chore(deps): Bump actions/checkout in the actions group
  * chore(deps): Bump github.com/sigstore/sigstore from 1.10.3 to
    1.10.4
  * chore(deps): Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0
  * chore(deps): Bump github.com/theupdateframework/go-tuf/v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777896000">- Update to version 0.13.0:
  * chore(deps): Bump google.golang.org/api from 0.275.0 to 0.277.0
  * chore(deps): Bump github.com/sigstore/timestamp-authority/v2
  * chore(deps): Bump the gomod group with 9 updates
  * chore(deps): Bump the actions group across 1 directory with 2
    updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump the gomod group with 3 updates
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump the gomod group with 3 updates
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  * chore(deps): Bump cloud.google.com/go/storage from 1.61.3 to
    1.62.0
  * chore(deps): Bump the gomod group across 1 directory with 11
    updates
  * chore(deps): Bump github.com/distribution/distribution/v3
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump google.golang.org/api from 0.272.0 to 0.275.0
  * chore(deps): Bump the actions group across 1 directory with 7
    updates
  * chore(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
  * chore(deps): Bump the gomod group across 1 directory with 8
    updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump google.golang.org/api from 0.271.0 to 0.272.0
  * chore(deps): Bump aws-actions/amazon-ecr-login in the actions
    group
  * chore(deps): Bump the gomod group with 4 updates
  * chore(deps): Bump google.golang.org/grpc from 1.79.2 to 1.79.3
  * chore(deps): Bump github.com/cilium/ebpf from 0.20.0 to 0.21.0
  * chore(deps): Bump the actions group with 2 updates
  * chore(deps): Bump cloud.google.com/go/storage from 1.59.2 to
    1.61.3
  * chore(deps): Bump golang.org/x/net from 0.51.0 to 0.52.0
  * chore!: remove `tls` command
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump golang.org/x/crypto from 0.48.0 to 0.49.0
  * chore(deps): Bump docker/metadata-action from 5.10.0 to 6.0.0
  * chore(deps): Bump the gomod group with 5 updates
  * chore(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump github.com/google/go-containerregistry
  * chore(deps): Bump golang.org/x/sys from 0.40.0 to 0.42.0
  * chore(deps): Bump golang.org/x/oauth2 from 0.35.0 to 0.36.0
  * chore(deps): Bump docker/build-push-action from 6.19.2 to 7.0.0
  * chore(deps): Bump docker/setup-qemu-action from 3.7.0 to 4.0.0
  * chore(deps): Bump docker/setup-buildx-action from 3.12.0 to
    4.0.0
  * chore(deps): Bump github.com/docker/cli
  * chore(deps): Bump golang.org/x/net from 0.49.0 to 0.51.0
  * chore(deps): Bump docker/login-action from 3.7.0 to 4.0.0
  * chore(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.0
  * chore(deps): Bump actions/setup-go in the actions group
  * chore(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0
  * chore(deps): Bump the gomod group across 1 directory with 15
    updates
  * chore(deps): Bump goreleaser/goreleaser-action from 6.4.0 to
    7.0.0
  * chore!: drop legacy BPF probe support
  * chore(deps): Bump docker/build-push-action in the actions group
  * chore(deps): Bump aws-actions/configure-aws-credentials
  * chore(deps): bump oras.land/oras-go/v2 from 2.5.0 to 2.6.0
  * chore(deps): Bump github.com/cilium/ebpf from 0.17.3 to 0.19.0
  * chore(deps): Bump cloud.google.com/go/storage from 1.51.0 to
    1.56.1
  * chore(deps): Bump github.com/onsi/gomega from 1.36.3 to 1.38.2
  * chore(deps): Bump docker/login-action in the actions group</changelog>
</package>
<package pkgid="7737c19ed9f24e79f511d1e50713caa7cc677de87c238f73611f0bba3baea0944ffbc6f3b8c7ca3c7751d530719d8fe4344f361ff9bf4a0342acdb60950b826b" name="falcosidekick" arch="s390x">
  <version epoch="0" ver="2.34.1" rel="13.7"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1715774400">- new package falcosidekick: simple daemon for connecting Falco to
  your ecosystem</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720008000">- Update to version 2.29.0:
  * specify goreleaser version
  * Add ClientCAs to TLSServer configuration
  * Add Sumologic Output
  * Add custom TLS CA global option
  * Add test for utils sorting function
  * Added 'Install' section to systemd example in README
  * Apply suggestions from code review
  * CI: fix linting
  * Docs fix: Environment variables are all uppercase
  * Fix G402: TLS MinVersion too low
  * Fix Policy Report dead link
  * Fix condition for forwarding events to OTLP traces
  * Go fmt
  * Make S3 output compatible with non-AWS S3 API-compliant
    endpoints
  * Split docs for the outputs
  * Update README.md
  * Update README.md path to the correct one
  * Update config_example.yaml
  * Update docs/outputs/alertmanager.md
  * Update docs/outputs/syslog.md
  * Update outputs/client.go
  * Update outputs/otlp.go
  * Update release.yml
  * Update syslog.md
  * Update types/types.go
  * add Falco Talon output
  * add flattenfields + create indexte
  * add more checks for the upload on GCP Storage
  * add outputFieldFormat parameter
  * add screenshots from running whole OTLP stack (under
    docker-compose, as documented)
  * add source as label for prom metrics
  * add table of contents + fix missing link
  * address more @issif feedback (cleanup)
  * bump up go version to 1.21 + bump up alpine base image to 3.19
    + replace deprecated modules for azure
  * change the method to set the custom headers in the client.go,
    it allows now to override the content-type
  * chore: remove refs to deprecated io/ioutil
  * clarify the un-need to parse OTLP.Traces.Headers field
  * display error message according to standards
  * docs(LICENSE): add Apache 2.0
  * docs(README.md): remove leftover
  * docs(dynatrace): Fix typo in Dynatrace example image
  * docs(dynatrace): [TR-1498] Add checkcert key to example config
  * docs(dynatrace): [TR-1498] Add example image of Dynatrace
  * docs: add license headers and spdx id
  * docs: update SPDX-License-Identifier and cleanup copyright
    notices
  * feat(alertmanager): add custom headers to alert manager
  * feat(alertmanager): fix labels for alertmanager
  * feat(alertmanager): remove leading and tailing _
  * feat(alertmanager): replace __ with _ in alertmanger labels
  * feat(dynatrace): [TR-1498] Enhance Dynatrace output with
    semantic attributes
  * feat(dynatrace): [TR-1498] Implement Dynatrace output
  * feat(log_inlined_json): inline the json logs when it's possible
  * feat(quickwit_output): implement the quickwit output
  * feat: add OTLP/Traces output support
  * fix bug with extension 'source'
  * fix issue #780: duplicated headers
  * fix outputs/otlp_test.go for NewClient() using
    `types.InitClientArgs`
  * fix panic in prometheus when hostname field is missing
  * fix the docs for Dynatrace output
  * fix wrong env var for pagerduty output
  * fix(dynatrace): [TR-1706] Check for nil when parsing output
    fields and parse span.id
  * fix(dynatrace): [TR-1706] Correct Falco output name
    container.image, k8s.ns.name and Dynatrace field name
    k8s.pod.uid
  * fix(elasticsearch-doc): remove mattermost config coming from a
    cc/cl mistake
  * fix(loki): fix the deadlock in Loki integration
  * go mod tidy (using go1.20.13)
  * initialise root CAs for kafka output
  * prepare v2.29.0
  * refactor(dynatrace): [TR-1498] Remove redundant check for token
    existence
  * refactor(init_client): merge InitClient and NewClient functions
  * remove hard setting of the Mattermost Username
  * remove hard setting of the Rocketchat Username
  * remove nested functions
  * remove wrongly added local files
  * revamp the policy reporter output
  * set source to internal for the test rule
  * test(dynatrace): [TR-1706] Add unit tests for the Dynatrace
    output
  * truncate output fiels with a length &gt; 512 chars, a payload &gt;
    4096 is not accepted by a lot of outputs
  * try to use a consistent order for the output_fields and tags
    for more outputs
  * update all deps + fix issues coming with
  * update copyright year to 2024
  * update dependencies
  * update logs for TLS
  * update the installation section
  * use go 1.20 (fix CI), fix NewClient() call to use new
    `types.InitClientArgs`</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.30.0:
  * New
  - New output: Webex (PR#979 thanks to @k0rventen)
  - New output: OTLP Metrics (PR#1012 thanks to @ekoops)
  - New output: Datadog Logs (PR#1052 thanks to @yohboy)
  * Enhancement
  - Reuse of the http client for 3-4x increase of the throughput
    (PR#962 thanks to @alekmaus)
  - Improve outputs throughput handling (PR#966 thanks to
    @alekmaus)
  - Batching and gzip compression for the Elastticsearch output
    (PR#967 thanks to @alekmaus)
  - Use the same convention for the Prometheus metrics than Falco
    (PR#995)
  - Add APIKey for Elasticsearch output (PR#980 thanks to
    @alekmaus)
  - Add Pipeline configuration for Elasticsearch output (PR#981
    thanks to @alekmaus)
  - Add MessageThreadID configuration in Telegram output (PR#1008
    thanks to @vashian)
  - Support multi-architecture in build (PR#1024 thanks to
    @nickytd)
  - Add falco as source for the Datadog Events (PR#1043 thanks to
    @maxd-wttj)
  - Support AlertManager output in HA mode (PR#1051)
  * Fix
  - Fix PolicyReports created in the same namespace than previous
    event (PR#978)
  - Fix missing customFields/extraFields in the Elasticsearch
    payload (PR#1033)
  - Fix incorrect key name for CloudEvent spec attribute
    (PR#1051)
  * Warning
  - Breaking change: The Prometheus metrics have different names
    from this release, it might break the queries for the
    dashboards and alerts.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738929600">- Update to version 2.31.0:
  * prepare v2.31.0
  * add new output OTLP Logs + improve the OTLP Traces/Metrics
  * fix typo
  * Update handlers to match stats_prometheus.go
  * fix custom headers not added to loki output http/s requests
  * fix Falcosidekick name for consistency
  * change the printer for the logs
  * allow to set the format for the value in Loki log lines
  * replace dots . by underscores . in Loki labels for consistency
  * add templated fields in Loki and Prometheus outputs
  * use a global method for the logs
  * fix the failing creation of the cluster policy report
  * allow to set a template for the nats/stan subjects
  * build(deps): bump go.opentelemetry.io/otel/sdk from 1.33.0 to
    1.34.0
  * build(deps): bump the gomod group with 2 updates
  * build(deps): bump golangci/golangci-lint-action in the actions
    group
  * :bug: Removed size allocation for the loki map
  * :art: Go fmt
  * :wrench: Add NS and pod by default in loki output
  * build(deps): bump docker/setup-qemu-action in the actions group
  * remove debug line -_-
  * build(deps): bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
  * build(deps): bump google.golang.org/api from 0.211.0 to 0.214.0
  * build(deps): bump github.com/nats-io/nats.go from 1.37.0 to
    1.38.0
  * build(deps): bump go.opentelemetry.io/otel/sdk/metric
  * build(deps): bump the gomod group with 3 updates
  * build(deps): bump golang.org/x/crypto from 0.29.0 to 0.31.0
  * build(deps): bump the actions group with 3 updates
  * build(deps): bump golang.org/x/text from 0.20.0 to 0.21.0
  * build(deps): bump go.opentelemetry.io/otel/metric from 1.32.0
    to 1.33.0
  * build(deps): bump golang.org/x/sync from 0.9.0 to 0.10.0
  * build(deps): bump cloud.google.com/go/pubsub
  * build(deps): bump cloud.google.com/go/storage from 1.47.0 to
    1.48.0
  * remove the log line for OTLP Metrics (too noisy)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738929601">- Update to version 2.31.1:
  * prepare v2.31.1
  * Adding scope ScopeReadWrite for uploading file for GCS Bucket
  * build(deps): bump the actions group with 3 updates
  * build(deps): bump cloud.google.com/go/pubsub from 1.45.3 to
    1.47.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758196800">- Update to version 2.32.0:
  * What's Changed
  - Migrate v1 to v2 for aws-sdk-go by @chenliu1993 in #1170
  - fix: mattermost url by @zdeneksvarc in #1192
  - add logstash output by @thabiger in #1146
  - Allow specifying redis username by @pgporada in #1212
  - feat: add Splunk output by @fjvela in #1233
  - go, alpine and ci clean ups and updates by @cpanato in #1246
  * Dependencies
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/lambda
  - build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.38.1 to
    1.39.0
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
  - build(deps): bump github.com/jackc/pgx/v5 in the gomod group
  - build(deps): bump
    go.opentelemetry.io/contrib/bridges/otelslog
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  - build(deps): bump aws-actions/configure-aws-credentials
  - build(deps): bump go.opentelemetry.io/otel/sdk/metric
  - build(deps): bump actions/setup-go from 5.5.0 to 6.0.0
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sns
  - build(deps): bump the gomod group with 4 updates
  - build(deps): bump the actions group with 2 updates
  - build(deps): bump aws-actions/configure-aws-credentials
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sts
  - build(deps): bump actions/checkout from 4.2.2 to 5.0.0
  - build(deps): bump github.com/aws/aws-sdk-go-v2 in the gomod
    group
  - build(deps): bump docker/login-action in the actions group
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/lambda
  - build(deps): bump anchore/sbom-action in the actions group
  - build(deps): bump cloud.google.com/go/storage from 1.52.0 to
    1.56.0
  - build(deps): bump the gomod group with 2 updates
  - build(deps): bump sigstore/cosign-installer in the actions
    group
  - build(deps): bump golang.org/x/text from 0.26.0 to 0.27.0
  - build(deps): bump anchore/sbom-action in the actions group
  - build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
  - build(deps): bump the gomod group across 1 directory with 2
    updates
  - build(deps): bump the actions group across 1 directory with 3
    updates
  - build(deps): bump github.com/emersion/go-smtp from 0.21.3 to
    0.22.0
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sts
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  - build(deps): bump the gomod group with 4 updates
  - build(deps): bump
    github.com/aws/aws-sdk-go-v2/service/kinesis
  - build(deps): bump the actions group with 2 updates
  - build(deps): bump google.golang.org/api from 0.231.0 to
    0.232.0
  - build(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0
  - build(deps): bump
    go.opentelemetry.io/contrib/bridges/otelslog
  - build(deps): bump the actions group with 2 updates
  - Migrate v1 to v2 for aws-sdk-go
  - build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to
    4.0.5
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
  - build(deps): bump google.golang.org/api from 0.229.0 to
    0.231.0
  - build(deps): bump cloud.google.com/go/storage from 1.50.0 to
    1.52.0
  - build(deps): bump the actions group with 2 updates
  - build(deps): bump github.com/prometheus/client_golang
  - build(deps): bump the gomod group with 7 updates
  - build(deps): bump github.com/nats-io/nats-server/v2
  - build(deps): bump the gomod group across 1 directory with 2
    updates
  - build(deps): bump goreleaser/goreleaser-action in the actions
    group
  - build(deps): bump the actions group across 1 directory with 2
    updates
  - build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/messaging/azeventhubs
  - build(deps): bump github.com/jackc/pgx/v5 in the gomod group
  - build(deps): bump the gomod group across 1 directory with 9
    updates
  - build(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.1 to
    5.2.2
  - build(deps): bump github.com/redis/go-redis/v9 from 9.7.1 to
    9.7.3
  - build(deps): bump golang.org/x/net from 0.35.0 to 0.36.0
  - build(deps): bump go.opentelemetry.io/otel from 1.34.0 to
    1.35.0
  - build(deps): bump golang.org/x/oauth2 from 0.26.0 to 0.27.0
  - build(deps): bump google.golang.org/api from 0.220.0 to
    0.223.0
  - build(deps): bump github.com/prometheus/client_golang
  - build(deps): bump github.com/google/go-cmp from 0.6.0 to
    0.7.0
  - build(deps): bump the actions group with 3 updates
  - build(deps): bump the gomod group across 1 directory with 6
    updates
  - build(deps): bump sigstore/cosign-installer in the actions
    group
  - build(deps): bump the actions group with 3 updates
  - build(deps): bump google.golang.org/api from 0.219.0 to
    0.220.0
  - build(deps): bump golang.org/x/text from 0.21.0 to 0.22.0
  - build(deps): bump github.com/nats-io/nats.go from 1.38.0 to
    1.39.0
  - build(deps): bump golang.org/x/oauth2 from 0.25.0 to 0.26.0
  - build(deps): bump the actions group with 4 updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773144000">- Update to version 2.33.0:
  * build: migrate goreleaser signs config to cosign v3 bundle
    format
  * fix(release): add --bundle flag to cosign sign-blob for cosign
    v3 compatibility
  * fix: remove trailing comma from Dynatrace output type name
  * fix: clear correct config field on DogStatsD init failure
  * fix: clear correct config field on OTLP Metrics init failure
  * fix: use correct MinimumPriority config for RabbitMQ
  * build(deps): bump the gomod group across 1 directory with 4
    updates
  * build(deps): bump the gomod group across 1 directory with 2
    updates
  * chore: upgrade and adapt linter for go 1.26
  * build: upgrade to go 1.26
  * build(deps): bump go.opentelemetry.io/otel/sdk/log from 0.14.0
    to 0.16.0
  * build(deps): bump github.com/nats-io/nats.go from 1.48.0 to
    1.49.0
  * build(deps): bump the actions group with 2 updates
  * build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  * build(deps): bump goreleaser/goreleaser-action from 6.4.0 to
    7.0.0
  * build(deps): bump actions/checkout from 5.0.0 to 6.0.2
  * build(deps): bump aws-actions/configure-aws-credentials
  * build(deps): bump sigstore/cosign-installer from 3.10.0 to
    4.0.0
  * build(deps): bump go.opentelemetry.io/otel/sdk from 1.38.0 to
    1.40.0
  * fix(aws): update service/sqs to v1.42.22 to resolve
    ResolveEndpointV2 error
  * Update README.md
  * build(deps): bump github.com/redis/go-redis/v9 from 9.8.0 to
    9.17.3
  * build(deps): bump k8s.io/client-go from 0.32.3 to 0.35.0
  * build(deps): bump github.com/nats-io/nats-server/v2
  * build(deps): bump the actions group across 1 directory with 5
    updates
  * build(deps): bump the gomod group with 6 updates
  * build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/messaging/azeventhubs
  * feat: Add Alertmanager label 'alertname'
  * build(deps): bump golang.org/x/crypto from 0.42.0 to 0.45.0
  * Clean up go sum
  * Update aws-sdk-go-v2
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  * fix: change default alertmanager endpoint /api/v2/alerts as
    /api/v1/alerts deprecated and removed
  * build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  * build(deps): bump github.com/aws/aws-sdk-go-v2/service/sns
  * build(deps): bump
    github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs
  * build(deps): bump docker/login-action in the actions group
  * build(deps): bump the gomod group with 3 updates
  * build(deps): bump github.com/emersion/go-smtp from 0.22.0 to
    0.24.0
  * Modify AWS output to use recommended chain of configuration
    providers
  * build(deps): bump anchore/sbom-action in the actions group
  * build(deps): bump the gomod group across 1 directory with 8
    updates
  * build(deps): bump github.com/cloudevents/sdk-go/v2 from 2.15.2
    to 2.16.1
  * build(deps): bump github.com/prometheus/client_golang
  * build(deps): bump sigstore/cosign-installer in the actions
    group
  * update deprecated goreleaser docker build</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779969600">- Update to version 2.34.0:
  * fix: set CheckCert default to true for Redis output
  * Add TLS and mutual TLS support to Redis output
  * fix(deps): update vulnerable Go modules
  * fix(aws): use AWSConfig for S3 client in UploadS3
  * fix(telegram): bind MessageThreadID env var
  * build(deps): bump github.com/googleapis/gax-go/v2 from 2.15.0
    to 2.22.0
  * fix: correct AWS Security Lake config examples
  * add chronicle field validation, refactor tests
  * Apply suggestions from code review
  * feat: add Google SecOps (chronicle) output
  * build(deps): bump go.opentelemetry.io/otel/sdk/metric
  * build(deps): bump golang.org/x/oauth2 from 0.30.0 to 0.36.0
  * build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  * build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.2
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  * build(deps): bump the actions group across 1 directory with 4
    updates
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
  * ci(.github): add `/area automation` to PR template
  * build(deps): bump github.com/aws/aws-sdk-go-v2/service/kinesis
  * build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.1 to
    4.1.4
  * build(deps): bump github.com/aws/aws-sdk-go-v2/service/lambda
  * build(deps): bump
    github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs
  * build(deps): bump github.com/nats-io/nats-server/v2
  * build(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0
  * build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0
  * build(deps): bump golangci/golangci-lint-action from 8.0.0 to
    9.2.0
  * build(deps): bump the actions group across 1 directory with 6
    updates
  * build(deps): bump google.golang.org/grpc from 1.75.0 to 1.79.3
  * build(deps): bump github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0
  * build(deps): bump go.opentelemetry.io/otel/sdk from 1.41.0 to
    1.43.0
  * fix: replace dots with underscores in custom field metric
    labels</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780660800">- Update to version 2.34.1:
  * fix: prevent DoS panics from malformed output_fields in OTLP
    traces and Spyderbat outputs</changelog>
</package>
<package pkgid="97510a0b82439f1aaa7d0b9a6ae5fa7c0109c4d6e99bc286ae534e1e3440eb159675a329cbc7bae48f3c77690a3b04b9dd9ec3646ecb9b28f77d7cbe0ec765ac" name="falcosidekick" arch="src">
  <version epoch="0" ver="2.34.1" rel="13.7"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1715774400">- new package falcosidekick: simple daemon for connecting Falco to
  your ecosystem</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720008000">- Update to version 2.29.0:
  * specify goreleaser version
  * Add ClientCAs to TLSServer configuration
  * Add Sumologic Output
  * Add custom TLS CA global option
  * Add test for utils sorting function
  * Added 'Install' section to systemd example in README
  * Apply suggestions from code review
  * CI: fix linting
  * Docs fix: Environment variables are all uppercase
  * Fix G402: TLS MinVersion too low
  * Fix Policy Report dead link
  * Fix condition for forwarding events to OTLP traces
  * Go fmt
  * Make S3 output compatible with non-AWS S3 API-compliant
    endpoints
  * Split docs for the outputs
  * Update README.md
  * Update README.md path to the correct one
  * Update config_example.yaml
  * Update docs/outputs/alertmanager.md
  * Update docs/outputs/syslog.md
  * Update outputs/client.go
  * Update outputs/otlp.go
  * Update release.yml
  * Update syslog.md
  * Update types/types.go
  * add Falco Talon output
  * add flattenfields + create indexte
  * add more checks for the upload on GCP Storage
  * add outputFieldFormat parameter
  * add screenshots from running whole OTLP stack (under
    docker-compose, as documented)
  * add source as label for prom metrics
  * add table of contents + fix missing link
  * address more @issif feedback (cleanup)
  * bump up go version to 1.21 + bump up alpine base image to 3.19
    + replace deprecated modules for azure
  * change the method to set the custom headers in the client.go,
    it allows now to override the content-type
  * chore: remove refs to deprecated io/ioutil
  * clarify the un-need to parse OTLP.Traces.Headers field
  * display error message according to standards
  * docs(LICENSE): add Apache 2.0
  * docs(README.md): remove leftover
  * docs(dynatrace): Fix typo in Dynatrace example image
  * docs(dynatrace): [TR-1498] Add checkcert key to example config
  * docs(dynatrace): [TR-1498] Add example image of Dynatrace
  * docs: add license headers and spdx id
  * docs: update SPDX-License-Identifier and cleanup copyright
    notices
  * feat(alertmanager): add custom headers to alert manager
  * feat(alertmanager): fix labels for alertmanager
  * feat(alertmanager): remove leading and tailing _
  * feat(alertmanager): replace __ with _ in alertmanger labels
  * feat(dynatrace): [TR-1498] Enhance Dynatrace output with
    semantic attributes
  * feat(dynatrace): [TR-1498] Implement Dynatrace output
  * feat(log_inlined_json): inline the json logs when it's possible
  * feat(quickwit_output): implement the quickwit output
  * feat: add OTLP/Traces output support
  * fix bug with extension 'source'
  * fix issue #780: duplicated headers
  * fix outputs/otlp_test.go for NewClient() using
    `types.InitClientArgs`
  * fix panic in prometheus when hostname field is missing
  * fix the docs for Dynatrace output
  * fix wrong env var for pagerduty output
  * fix(dynatrace): [TR-1706] Check for nil when parsing output
    fields and parse span.id
  * fix(dynatrace): [TR-1706] Correct Falco output name
    container.image, k8s.ns.name and Dynatrace field name
    k8s.pod.uid
  * fix(elasticsearch-doc): remove mattermost config coming from a
    cc/cl mistake
  * fix(loki): fix the deadlock in Loki integration
  * go mod tidy (using go1.20.13)
  * initialise root CAs for kafka output
  * prepare v2.29.0
  * refactor(dynatrace): [TR-1498] Remove redundant check for token
    existence
  * refactor(init_client): merge InitClient and NewClient functions
  * remove hard setting of the Mattermost Username
  * remove hard setting of the Rocketchat Username
  * remove nested functions
  * remove wrongly added local files
  * revamp the policy reporter output
  * set source to internal for the test rule
  * test(dynatrace): [TR-1706] Add unit tests for the Dynatrace
    output
  * truncate output fiels with a length &gt; 512 chars, a payload &gt;
    4096 is not accepted by a lot of outputs
  * try to use a consistent order for the output_fields and tags
    for more outputs
  * update all deps + fix issues coming with
  * update copyright year to 2024
  * update dependencies
  * update logs for TLS
  * update the installation section
  * use go 1.20 (fix CI), fix NewClient() call to use new
    `types.InitClientArgs`</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.30.0:
  * New
  - New output: Webex (PR#979 thanks to @k0rventen)
  - New output: OTLP Metrics (PR#1012 thanks to @ekoops)
  - New output: Datadog Logs (PR#1052 thanks to @yohboy)
  * Enhancement
  - Reuse of the http client for 3-4x increase of the throughput
    (PR#962 thanks to @alekmaus)
  - Improve outputs throughput handling (PR#966 thanks to
    @alekmaus)
  - Batching and gzip compression for the Elastticsearch output
    (PR#967 thanks to @alekmaus)
  - Use the same convention for the Prometheus metrics than Falco
    (PR#995)
  - Add APIKey for Elasticsearch output (PR#980 thanks to
    @alekmaus)
  - Add Pipeline configuration for Elasticsearch output (PR#981
    thanks to @alekmaus)
  - Add MessageThreadID configuration in Telegram output (PR#1008
    thanks to @vashian)
  - Support multi-architecture in build (PR#1024 thanks to
    @nickytd)
  - Add falco as source for the Datadog Events (PR#1043 thanks to
    @maxd-wttj)
  - Support AlertManager output in HA mode (PR#1051)
  * Fix
  - Fix PolicyReports created in the same namespace than previous
    event (PR#978)
  - Fix missing customFields/extraFields in the Elasticsearch
    payload (PR#1033)
  - Fix incorrect key name for CloudEvent spec attribute
    (PR#1051)
  * Warning
  - Breaking change: The Prometheus metrics have different names
    from this release, it might break the queries for the
    dashboards and alerts.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738929600">- Update to version 2.31.0:
  * prepare v2.31.0
  * add new output OTLP Logs + improve the OTLP Traces/Metrics
  * fix typo
  * Update handlers to match stats_prometheus.go
  * fix custom headers not added to loki output http/s requests
  * fix Falcosidekick name for consistency
  * change the printer for the logs
  * allow to set the format for the value in Loki log lines
  * replace dots . by underscores . in Loki labels for consistency
  * add templated fields in Loki and Prometheus outputs
  * use a global method for the logs
  * fix the failing creation of the cluster policy report
  * allow to set a template for the nats/stan subjects
  * build(deps): bump go.opentelemetry.io/otel/sdk from 1.33.0 to
    1.34.0
  * build(deps): bump the gomod group with 2 updates
  * build(deps): bump golangci/golangci-lint-action in the actions
    group
  * :bug: Removed size allocation for the loki map
  * :art: Go fmt
  * :wrench: Add NS and pod by default in loki output
  * build(deps): bump docker/setup-qemu-action in the actions group
  * remove debug line -_-
  * build(deps): bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
  * build(deps): bump google.golang.org/api from 0.211.0 to 0.214.0
  * build(deps): bump github.com/nats-io/nats.go from 1.37.0 to
    1.38.0
  * build(deps): bump go.opentelemetry.io/otel/sdk/metric
  * build(deps): bump the gomod group with 3 updates
  * build(deps): bump golang.org/x/crypto from 0.29.0 to 0.31.0
  * build(deps): bump the actions group with 3 updates
  * build(deps): bump golang.org/x/text from 0.20.0 to 0.21.0
  * build(deps): bump go.opentelemetry.io/otel/metric from 1.32.0
    to 1.33.0
  * build(deps): bump golang.org/x/sync from 0.9.0 to 0.10.0
  * build(deps): bump cloud.google.com/go/pubsub
  * build(deps): bump cloud.google.com/go/storage from 1.47.0 to
    1.48.0
  * remove the log line for OTLP Metrics (too noisy)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738929601">- Update to version 2.31.1:
  * prepare v2.31.1
  * Adding scope ScopeReadWrite for uploading file for GCS Bucket
  * build(deps): bump the actions group with 3 updates
  * build(deps): bump cloud.google.com/go/pubsub from 1.45.3 to
    1.47.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758196800">- Update to version 2.32.0:
  * What's Changed
  - Migrate v1 to v2 for aws-sdk-go by @chenliu1993 in #1170
  - fix: mattermost url by @zdeneksvarc in #1192
  - add logstash output by @thabiger in #1146
  - Allow specifying redis username by @pgporada in #1212
  - feat: add Splunk output by @fjvela in #1233
  - go, alpine and ci clean ups and updates by @cpanato in #1246
  * Dependencies
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/lambda
  - build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.38.1 to
    1.39.0
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
  - build(deps): bump github.com/jackc/pgx/v5 in the gomod group
  - build(deps): bump
    go.opentelemetry.io/contrib/bridges/otelslog
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  - build(deps): bump aws-actions/configure-aws-credentials
  - build(deps): bump go.opentelemetry.io/otel/sdk/metric
  - build(deps): bump actions/setup-go from 5.5.0 to 6.0.0
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sns
  - build(deps): bump the gomod group with 4 updates
  - build(deps): bump the actions group with 2 updates
  - build(deps): bump aws-actions/configure-aws-credentials
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sts
  - build(deps): bump actions/checkout from 4.2.2 to 5.0.0
  - build(deps): bump github.com/aws/aws-sdk-go-v2 in the gomod
    group
  - build(deps): bump docker/login-action in the actions group
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/lambda
  - build(deps): bump anchore/sbom-action in the actions group
  - build(deps): bump cloud.google.com/go/storage from 1.52.0 to
    1.56.0
  - build(deps): bump the gomod group with 2 updates
  - build(deps): bump sigstore/cosign-installer in the actions
    group
  - build(deps): bump golang.org/x/text from 0.26.0 to 0.27.0
  - build(deps): bump anchore/sbom-action in the actions group
  - build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
  - build(deps): bump the gomod group across 1 directory with 2
    updates
  - build(deps): bump the actions group across 1 directory with 3
    updates
  - build(deps): bump github.com/emersion/go-smtp from 0.21.3 to
    0.22.0
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sts
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  - build(deps): bump the gomod group with 4 updates
  - build(deps): bump
    github.com/aws/aws-sdk-go-v2/service/kinesis
  - build(deps): bump the actions group with 2 updates
  - build(deps): bump google.golang.org/api from 0.231.0 to
    0.232.0
  - build(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0
  - build(deps): bump
    go.opentelemetry.io/contrib/bridges/otelslog
  - build(deps): bump the actions group with 2 updates
  - Migrate v1 to v2 for aws-sdk-go
  - build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to
    4.0.5
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
  - build(deps): bump google.golang.org/api from 0.229.0 to
    0.231.0
  - build(deps): bump cloud.google.com/go/storage from 1.50.0 to
    1.52.0
  - build(deps): bump the actions group with 2 updates
  - build(deps): bump github.com/prometheus/client_golang
  - build(deps): bump the gomod group with 7 updates
  - build(deps): bump github.com/nats-io/nats-server/v2
  - build(deps): bump the gomod group across 1 directory with 2
    updates
  - build(deps): bump goreleaser/goreleaser-action in the actions
    group
  - build(deps): bump the actions group across 1 directory with 2
    updates
  - build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/messaging/azeventhubs
  - build(deps): bump github.com/jackc/pgx/v5 in the gomod group
  - build(deps): bump the gomod group across 1 directory with 9
    updates
  - build(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.1 to
    5.2.2
  - build(deps): bump github.com/redis/go-redis/v9 from 9.7.1 to
    9.7.3
  - build(deps): bump golang.org/x/net from 0.35.0 to 0.36.0
  - build(deps): bump go.opentelemetry.io/otel from 1.34.0 to
    1.35.0
  - build(deps): bump golang.org/x/oauth2 from 0.26.0 to 0.27.0
  - build(deps): bump google.golang.org/api from 0.220.0 to
    0.223.0
  - build(deps): bump github.com/prometheus/client_golang
  - build(deps): bump github.com/google/go-cmp from 0.6.0 to
    0.7.0
  - build(deps): bump the actions group with 3 updates
  - build(deps): bump the gomod group across 1 directory with 6
    updates
  - build(deps): bump sigstore/cosign-installer in the actions
    group
  - build(deps): bump the actions group with 3 updates
  - build(deps): bump google.golang.org/api from 0.219.0 to
    0.220.0
  - build(deps): bump golang.org/x/text from 0.21.0 to 0.22.0
  - build(deps): bump github.com/nats-io/nats.go from 1.38.0 to
    1.39.0
  - build(deps): bump golang.org/x/oauth2 from 0.25.0 to 0.26.0
  - build(deps): bump the actions group with 4 updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773144000">- Update to version 2.33.0:
  * build: migrate goreleaser signs config to cosign v3 bundle
    format
  * fix(release): add --bundle flag to cosign sign-blob for cosign
    v3 compatibility
  * fix: remove trailing comma from Dynatrace output type name
  * fix: clear correct config field on DogStatsD init failure
  * fix: clear correct config field on OTLP Metrics init failure
  * fix: use correct MinimumPriority config for RabbitMQ
  * build(deps): bump the gomod group across 1 directory with 4
    updates
  * build(deps): bump the gomod group across 1 directory with 2
    updates
  * chore: upgrade and adapt linter for go 1.26
  * build: upgrade to go 1.26
  * build(deps): bump go.opentelemetry.io/otel/sdk/log from 0.14.0
    to 0.16.0
  * build(deps): bump github.com/nats-io/nats.go from 1.48.0 to
    1.49.0
  * build(deps): bump the actions group with 2 updates
  * build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  * build(deps): bump goreleaser/goreleaser-action from 6.4.0 to
    7.0.0
  * build(deps): bump actions/checkout from 5.0.0 to 6.0.2
  * build(deps): bump aws-actions/configure-aws-credentials
  * build(deps): bump sigstore/cosign-installer from 3.10.0 to
    4.0.0
  * build(deps): bump go.opentelemetry.io/otel/sdk from 1.38.0 to
    1.40.0
  * fix(aws): update service/sqs to v1.42.22 to resolve
    ResolveEndpointV2 error
  * Update README.md
  * build(deps): bump github.com/redis/go-redis/v9 from 9.8.0 to
    9.17.3
  * build(deps): bump k8s.io/client-go from 0.32.3 to 0.35.0
  * build(deps): bump github.com/nats-io/nats-server/v2
  * build(deps): bump the actions group across 1 directory with 5
    updates
  * build(deps): bump the gomod group with 6 updates
  * build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/messaging/azeventhubs
  * feat: Add Alertmanager label 'alertname'
  * build(deps): bump golang.org/x/crypto from 0.42.0 to 0.45.0
  * Clean up go sum
  * Update aws-sdk-go-v2
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  * fix: change default alertmanager endpoint /api/v2/alerts as
    /api/v1/alerts deprecated and removed
  * build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  * build(deps): bump github.com/aws/aws-sdk-go-v2/service/sns
  * build(deps): bump
    github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs
  * build(deps): bump docker/login-action in the actions group
  * build(deps): bump the gomod group with 3 updates
  * build(deps): bump github.com/emersion/go-smtp from 0.22.0 to
    0.24.0
  * Modify AWS output to use recommended chain of configuration
    providers
  * build(deps): bump anchore/sbom-action in the actions group
  * build(deps): bump the gomod group across 1 directory with 8
    updates
  * build(deps): bump github.com/cloudevents/sdk-go/v2 from 2.15.2
    to 2.16.1
  * build(deps): bump github.com/prometheus/client_golang
  * build(deps): bump sigstore/cosign-installer in the actions
    group
  * update deprecated goreleaser docker build</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779969600">- Update to version 2.34.0:
  * fix: set CheckCert default to true for Redis output
  * Add TLS and mutual TLS support to Redis output
  * fix(deps): update vulnerable Go modules
  * fix(aws): use AWSConfig for S3 client in UploadS3
  * fix(telegram): bind MessageThreadID env var
  * build(deps): bump github.com/googleapis/gax-go/v2 from 2.15.0
    to 2.22.0
  * fix: correct AWS Security Lake config examples
  * add chronicle field validation, refactor tests
  * Apply suggestions from code review
  * feat: add Google SecOps (chronicle) output
  * build(deps): bump go.opentelemetry.io/otel/sdk/metric
  * build(deps): bump golang.org/x/oauth2 from 0.30.0 to 0.36.0
  * build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  * build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.2
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  * build(deps): bump the actions group across 1 directory with 4
    updates
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
  * ci(.github): add `/area automation` to PR template
  * build(deps): bump github.com/aws/aws-sdk-go-v2/service/kinesis
  * build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.1 to
    4.1.4
  * build(deps): bump github.com/aws/aws-sdk-go-v2/service/lambda
  * build(deps): bump
    github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs
  * build(deps): bump github.com/nats-io/nats-server/v2
  * build(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0
  * build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0
  * build(deps): bump golangci/golangci-lint-action from 8.0.0 to
    9.2.0
  * build(deps): bump the actions group across 1 directory with 6
    updates
  * build(deps): bump google.golang.org/grpc from 1.75.0 to 1.79.3
  * build(deps): bump github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0
  * build(deps): bump go.opentelemetry.io/otel/sdk from 1.41.0 to
    1.43.0
  * fix: replace dots with underscores in custom field metric
    labels</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780660800">- Update to version 2.34.1:
  * fix: prevent DoS panics from malformed output_fields in OTLP
    traces and Spyderbat outputs</changelog>
</package>
<package pkgid="1fb9456c429ce0cfef4bab4dbdb0f897b95bf5b2717a2f3c3cf22dda9c2330c775bc591879764e5c97bf97b05486f9f03c1f0d36c7c355bf498bcbe8533aa3d1" name="falcosidekick-debuginfo" arch="s390x">
  <version epoch="0" ver="2.34.1" rel="13.7"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1715774400">- new package falcosidekick: simple daemon for connecting Falco to
  your ecosystem</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720008000">- Update to version 2.29.0:
  * specify goreleaser version
  * Add ClientCAs to TLSServer configuration
  * Add Sumologic Output
  * Add custom TLS CA global option
  * Add test for utils sorting function
  * Added 'Install' section to systemd example in README
  * Apply suggestions from code review
  * CI: fix linting
  * Docs fix: Environment variables are all uppercase
  * Fix G402: TLS MinVersion too low
  * Fix Policy Report dead link
  * Fix condition for forwarding events to OTLP traces
  * Go fmt
  * Make S3 output compatible with non-AWS S3 API-compliant
    endpoints
  * Split docs for the outputs
  * Update README.md
  * Update README.md path to the correct one
  * Update config_example.yaml
  * Update docs/outputs/alertmanager.md
  * Update docs/outputs/syslog.md
  * Update outputs/client.go
  * Update outputs/otlp.go
  * Update release.yml
  * Update syslog.md
  * Update types/types.go
  * add Falco Talon output
  * add flattenfields + create indexte
  * add more checks for the upload on GCP Storage
  * add outputFieldFormat parameter
  * add screenshots from running whole OTLP stack (under
    docker-compose, as documented)
  * add source as label for prom metrics
  * add table of contents + fix missing link
  * address more @issif feedback (cleanup)
  * bump up go version to 1.21 + bump up alpine base image to 3.19
    + replace deprecated modules for azure
  * change the method to set the custom headers in the client.go,
    it allows now to override the content-type
  * chore: remove refs to deprecated io/ioutil
  * clarify the un-need to parse OTLP.Traces.Headers field
  * display error message according to standards
  * docs(LICENSE): add Apache 2.0
  * docs(README.md): remove leftover
  * docs(dynatrace): Fix typo in Dynatrace example image
  * docs(dynatrace): [TR-1498] Add checkcert key to example config
  * docs(dynatrace): [TR-1498] Add example image of Dynatrace
  * docs: add license headers and spdx id
  * docs: update SPDX-License-Identifier and cleanup copyright
    notices
  * feat(alertmanager): add custom headers to alert manager
  * feat(alertmanager): fix labels for alertmanager
  * feat(alertmanager): remove leading and tailing _
  * feat(alertmanager): replace __ with _ in alertmanger labels
  * feat(dynatrace): [TR-1498] Enhance Dynatrace output with
    semantic attributes
  * feat(dynatrace): [TR-1498] Implement Dynatrace output
  * feat(log_inlined_json): inline the json logs when it's possible
  * feat(quickwit_output): implement the quickwit output
  * feat: add OTLP/Traces output support
  * fix bug with extension 'source'
  * fix issue #780: duplicated headers
  * fix outputs/otlp_test.go for NewClient() using
    `types.InitClientArgs`
  * fix panic in prometheus when hostname field is missing
  * fix the docs for Dynatrace output
  * fix wrong env var for pagerduty output
  * fix(dynatrace): [TR-1706] Check for nil when parsing output
    fields and parse span.id
  * fix(dynatrace): [TR-1706] Correct Falco output name
    container.image, k8s.ns.name and Dynatrace field name
    k8s.pod.uid
  * fix(elasticsearch-doc): remove mattermost config coming from a
    cc/cl mistake
  * fix(loki): fix the deadlock in Loki integration
  * go mod tidy (using go1.20.13)
  * initialise root CAs for kafka output
  * prepare v2.29.0
  * refactor(dynatrace): [TR-1498] Remove redundant check for token
    existence
  * refactor(init_client): merge InitClient and NewClient functions
  * remove hard setting of the Mattermost Username
  * remove hard setting of the Rocketchat Username
  * remove nested functions
  * remove wrongly added local files
  * revamp the policy reporter output
  * set source to internal for the test rule
  * test(dynatrace): [TR-1706] Add unit tests for the Dynatrace
    output
  * truncate output fiels with a length &gt; 512 chars, a payload &gt;
    4096 is not accepted by a lot of outputs
  * try to use a consistent order for the output_fields and tags
    for more outputs
  * update all deps + fix issues coming with
  * update copyright year to 2024
  * update dependencies
  * update logs for TLS
  * update the installation section
  * use go 1.20 (fix CI), fix NewClient() call to use new
    `types.InitClientArgs`</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.30.0:
  * New
  - New output: Webex (PR#979 thanks to @k0rventen)
  - New output: OTLP Metrics (PR#1012 thanks to @ekoops)
  - New output: Datadog Logs (PR#1052 thanks to @yohboy)
  * Enhancement
  - Reuse of the http client for 3-4x increase of the throughput
    (PR#962 thanks to @alekmaus)
  - Improve outputs throughput handling (PR#966 thanks to
    @alekmaus)
  - Batching and gzip compression for the Elastticsearch output
    (PR#967 thanks to @alekmaus)
  - Use the same convention for the Prometheus metrics than Falco
    (PR#995)
  - Add APIKey for Elasticsearch output (PR#980 thanks to
    @alekmaus)
  - Add Pipeline configuration for Elasticsearch output (PR#981
    thanks to @alekmaus)
  - Add MessageThreadID configuration in Telegram output (PR#1008
    thanks to @vashian)
  - Support multi-architecture in build (PR#1024 thanks to
    @nickytd)
  - Add falco as source for the Datadog Events (PR#1043 thanks to
    @maxd-wttj)
  - Support AlertManager output in HA mode (PR#1051)
  * Fix
  - Fix PolicyReports created in the same namespace than previous
    event (PR#978)
  - Fix missing customFields/extraFields in the Elasticsearch
    payload (PR#1033)
  - Fix incorrect key name for CloudEvent spec attribute
    (PR#1051)
  * Warning
  - Breaking change: The Prometheus metrics have different names
    from this release, it might break the queries for the
    dashboards and alerts.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738929600">- Update to version 2.31.0:
  * prepare v2.31.0
  * add new output OTLP Logs + improve the OTLP Traces/Metrics
  * fix typo
  * Update handlers to match stats_prometheus.go
  * fix custom headers not added to loki output http/s requests
  * fix Falcosidekick name for consistency
  * change the printer for the logs
  * allow to set the format for the value in Loki log lines
  * replace dots . by underscores . in Loki labels for consistency
  * add templated fields in Loki and Prometheus outputs
  * use a global method for the logs
  * fix the failing creation of the cluster policy report
  * allow to set a template for the nats/stan subjects
  * build(deps): bump go.opentelemetry.io/otel/sdk from 1.33.0 to
    1.34.0
  * build(deps): bump the gomod group with 2 updates
  * build(deps): bump golangci/golangci-lint-action in the actions
    group
  * :bug: Removed size allocation for the loki map
  * :art: Go fmt
  * :wrench: Add NS and pod by default in loki output
  * build(deps): bump docker/setup-qemu-action in the actions group
  * remove debug line -_-
  * build(deps): bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
  * build(deps): bump google.golang.org/api from 0.211.0 to 0.214.0
  * build(deps): bump github.com/nats-io/nats.go from 1.37.0 to
    1.38.0
  * build(deps): bump go.opentelemetry.io/otel/sdk/metric
  * build(deps): bump the gomod group with 3 updates
  * build(deps): bump golang.org/x/crypto from 0.29.0 to 0.31.0
  * build(deps): bump the actions group with 3 updates
  * build(deps): bump golang.org/x/text from 0.20.0 to 0.21.0
  * build(deps): bump go.opentelemetry.io/otel/metric from 1.32.0
    to 1.33.0
  * build(deps): bump golang.org/x/sync from 0.9.0 to 0.10.0
  * build(deps): bump cloud.google.com/go/pubsub
  * build(deps): bump cloud.google.com/go/storage from 1.47.0 to
    1.48.0
  * remove the log line for OTLP Metrics (too noisy)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1738929601">- Update to version 2.31.1:
  * prepare v2.31.1
  * Adding scope ScopeReadWrite for uploading file for GCS Bucket
  * build(deps): bump the actions group with 3 updates
  * build(deps): bump cloud.google.com/go/pubsub from 1.45.3 to
    1.47.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758196800">- Update to version 2.32.0:
  * What's Changed
  - Migrate v1 to v2 for aws-sdk-go by @chenliu1993 in #1170
  - fix: mattermost url by @zdeneksvarc in #1192
  - add logstash output by @thabiger in #1146
  - Allow specifying redis username by @pgporada in #1212
  - feat: add Splunk output by @fjvela in #1233
  - go, alpine and ci clean ups and updates by @cpanato in #1246
  * Dependencies
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/lambda
  - build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.38.1 to
    1.39.0
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
  - build(deps): bump github.com/jackc/pgx/v5 in the gomod group
  - build(deps): bump
    go.opentelemetry.io/contrib/bridges/otelslog
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  - build(deps): bump aws-actions/configure-aws-credentials
  - build(deps): bump go.opentelemetry.io/otel/sdk/metric
  - build(deps): bump actions/setup-go from 5.5.0 to 6.0.0
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sns
  - build(deps): bump the gomod group with 4 updates
  - build(deps): bump the actions group with 2 updates
  - build(deps): bump aws-actions/configure-aws-credentials
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sts
  - build(deps): bump actions/checkout from 4.2.2 to 5.0.0
  - build(deps): bump github.com/aws/aws-sdk-go-v2 in the gomod
    group
  - build(deps): bump docker/login-action in the actions group
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/lambda
  - build(deps): bump anchore/sbom-action in the actions group
  - build(deps): bump cloud.google.com/go/storage from 1.52.0 to
    1.56.0
  - build(deps): bump the gomod group with 2 updates
  - build(deps): bump sigstore/cosign-installer in the actions
    group
  - build(deps): bump golang.org/x/text from 0.26.0 to 0.27.0
  - build(deps): bump anchore/sbom-action in the actions group
  - build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
  - build(deps): bump the gomod group across 1 directory with 2
    updates
  - build(deps): bump the actions group across 1 directory with 3
    updates
  - build(deps): bump github.com/emersion/go-smtp from 0.21.3 to
    0.22.0
  - build(deps): bump github.com/aws/aws-sdk-go-v2/service/sts
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  - build(deps): bump the gomod group with 4 updates
  - build(deps): bump
    github.com/aws/aws-sdk-go-v2/service/kinesis
  - build(deps): bump the actions group with 2 updates
  - build(deps): bump google.golang.org/api from 0.231.0 to
    0.232.0
  - build(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0
  - build(deps): bump
    go.opentelemetry.io/contrib/bridges/otelslog
  - build(deps): bump the actions group with 2 updates
  - Migrate v1 to v2 for aws-sdk-go
  - build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to
    4.0.5
  - build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
  - build(deps): bump google.golang.org/api from 0.229.0 to
    0.231.0
  - build(deps): bump cloud.google.com/go/storage from 1.50.0 to
    1.52.0
  - build(deps): bump the actions group with 2 updates
  - build(deps): bump github.com/prometheus/client_golang
  - build(deps): bump the gomod group with 7 updates
  - build(deps): bump github.com/nats-io/nats-server/v2
  - build(deps): bump the gomod group across 1 directory with 2
    updates
  - build(deps): bump goreleaser/goreleaser-action in the actions
    group
  - build(deps): bump the actions group across 1 directory with 2
    updates
  - build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/messaging/azeventhubs
  - build(deps): bump github.com/jackc/pgx/v5 in the gomod group
  - build(deps): bump the gomod group across 1 directory with 9
    updates
  - build(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.1 to
    5.2.2
  - build(deps): bump github.com/redis/go-redis/v9 from 9.7.1 to
    9.7.3
  - build(deps): bump golang.org/x/net from 0.35.0 to 0.36.0
  - build(deps): bump go.opentelemetry.io/otel from 1.34.0 to
    1.35.0
  - build(deps): bump golang.org/x/oauth2 from 0.26.0 to 0.27.0
  - build(deps): bump google.golang.org/api from 0.220.0 to
    0.223.0
  - build(deps): bump github.com/prometheus/client_golang
  - build(deps): bump github.com/google/go-cmp from 0.6.0 to
    0.7.0
  - build(deps): bump the actions group with 3 updates
  - build(deps): bump the gomod group across 1 directory with 6
    updates
  - build(deps): bump sigstore/cosign-installer in the actions
    group
  - build(deps): bump the actions group with 3 updates
  - build(deps): bump google.golang.org/api from 0.219.0 to
    0.220.0
  - build(deps): bump golang.org/x/text from 0.21.0 to 0.22.0
  - build(deps): bump github.com/nats-io/nats.go from 1.38.0 to
    1.39.0
  - build(deps): bump golang.org/x/oauth2 from 0.25.0 to 0.26.0
  - build(deps): bump the actions group with 4 updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773144000">- Update to version 2.33.0:
  * build: migrate goreleaser signs config to cosign v3 bundle
    format
  * fix(release): add --bundle flag to cosign sign-blob for cosign
    v3 compatibility
  * fix: remove trailing comma from Dynatrace output type name
  * fix: clear correct config field on DogStatsD init failure
  * fix: clear correct config field on OTLP Metrics init failure
  * fix: use correct MinimumPriority config for RabbitMQ
  * build(deps): bump the gomod group across 1 directory with 4
    updates
  * build(deps): bump the gomod group across 1 directory with 2
    updates
  * chore: upgrade and adapt linter for go 1.26
  * build: upgrade to go 1.26
  * build(deps): bump go.opentelemetry.io/otel/sdk/log from 0.14.0
    to 0.16.0
  * build(deps): bump github.com/nats-io/nats.go from 1.48.0 to
    1.49.0
  * build(deps): bump the actions group with 2 updates
  * build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  * build(deps): bump goreleaser/goreleaser-action from 6.4.0 to
    7.0.0
  * build(deps): bump actions/checkout from 5.0.0 to 6.0.2
  * build(deps): bump aws-actions/configure-aws-credentials
  * build(deps): bump sigstore/cosign-installer from 3.10.0 to
    4.0.0
  * build(deps): bump go.opentelemetry.io/otel/sdk from 1.38.0 to
    1.40.0
  * fix(aws): update service/sqs to v1.42.22 to resolve
    ResolveEndpointV2 error
  * Update README.md
  * build(deps): bump github.com/redis/go-redis/v9 from 9.8.0 to
    9.17.3
  * build(deps): bump k8s.io/client-go from 0.32.3 to 0.35.0
  * build(deps): bump github.com/nats-io/nats-server/v2
  * build(deps): bump the actions group across 1 directory with 5
    updates
  * build(deps): bump the gomod group with 6 updates
  * build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/messaging/azeventhubs
  * feat: Add Alertmanager label 'alertname'
  * build(deps): bump golang.org/x/crypto from 0.42.0 to 0.45.0
  * Clean up go sum
  * Update aws-sdk-go-v2
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  * fix: change default alertmanager endpoint /api/v2/alerts as
    /api/v1/alerts deprecated and removed
  * build(deps): bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity
  * build(deps): bump github.com/aws/aws-sdk-go-v2/service/sns
  * build(deps): bump
    github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs
  * build(deps): bump docker/login-action in the actions group
  * build(deps): bump the gomod group with 3 updates
  * build(deps): bump github.com/emersion/go-smtp from 0.22.0 to
    0.24.0
  * Modify AWS output to use recommended chain of configuration
    providers
  * build(deps): bump anchore/sbom-action in the actions group
  * build(deps): bump the gomod group across 1 directory with 8
    updates
  * build(deps): bump github.com/cloudevents/sdk-go/v2 from 2.15.2
    to 2.16.1
  * build(deps): bump github.com/prometheus/client_golang
  * build(deps): bump sigstore/cosign-installer in the actions
    group
  * update deprecated goreleaser docker build</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779969600">- Update to version 2.34.0:
  * fix: set CheckCert default to true for Redis output
  * Add TLS and mutual TLS support to Redis output
  * fix(deps): update vulnerable Go modules
  * fix(aws): use AWSConfig for S3 client in UploadS3
  * fix(telegram): bind MessageThreadID env var
  * build(deps): bump github.com/googleapis/gax-go/v2 from 2.15.0
    to 2.22.0
  * fix: correct AWS Security Lake config examples
  * add chronicle field validation, refactor tests
  * Apply suggestions from code review
  * feat: add Google SecOps (chronicle) output
  * build(deps): bump go.opentelemetry.io/otel/sdk/metric
  * build(deps): bump golang.org/x/oauth2 from 0.30.0 to 0.36.0
  * build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  * build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.2
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
  * build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  * build(deps): bump the actions group across 1 directory with 4
    updates
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
  * build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
  * ci(.github): add `/area automation` to PR template
  * build(deps): bump github.com/aws/aws-sdk-go-v2/service/kinesis
  * build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.1 to
    4.1.4
  * build(deps): bump github.com/aws/aws-sdk-go-v2/service/lambda
  * build(deps): bump
    github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs
  * build(deps): bump github.com/nats-io/nats-server/v2
  * build(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0
  * build(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.0.0
  * build(deps): bump golangci/golangci-lint-action from 8.0.0 to
    9.2.0
  * build(deps): bump the actions group across 1 directory with 6
    updates
  * build(deps): bump google.golang.org/grpc from 1.75.0 to 1.79.3
  * build(deps): bump github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0
  * build(deps): bump go.opentelemetry.io/otel/sdk from 1.41.0 to
    1.43.0
  * fix: replace dots with underscores in custom field metric
    labels</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780660800">- Update to version 2.34.1:
  * fix: prevent DoS panics from malformed output_fields in OTLP
    traces and Spyderbat outputs</changelog>
</package>
<package pkgid="155c1e1f7804d4ecb1738f82f8b8f3fa0beb2d0485be4a0421935a7e559d06881bba7935edea78ffbed9670475c7d0a5ee77ed92d2e5f2042debfe7b8d154bf8" name="fapolicyd" arch="s390x">
  <version epoch="0" ver="1.4.3" rel="11.13"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1771588800">- initial import</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1778155200">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="08e13ec44ccd2093661b9eaca290f0fe4da21a8c594e0a9e30e4abc310353f384b9c311cff52dc352b7c950e77ef118b40cab86836d8f087ed6c3296a2333542" name="fapolicyd" arch="src">
  <version epoch="0" ver="1.4.3" rel="11.13"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1771588800">- initial import</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1778155200">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="6e86c8bbb0a3310f4100ad222b0074615119d25164d69d04ba267e084fc436e034c9faf807b2231a385fdebebad02eae8c30089565e5ed9e798d86ff8e334095" name="fapolicyd-debuginfo" arch="s390x">
  <version epoch="0" ver="1.4.3" rel="11.13"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1771588800">- initial import</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1778155200">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="f00790aade81be6b7c834739838d0620141cf89d17b7c68779e6a7a372adc47cde8ba5e37c852bf6d477e08e1ee81a05286fc32a937f7bf857d54dad59ffda46" name="fapolicyd-debugsource" arch="s390x">
  <version epoch="0" ver="1.4.3" rel="11.13"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1771588800">- initial import</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1778155200">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="ed597361c099b59f7a69cec36717c5347212d0d82ace0a445840f4c8babef8f9a4285cf02c57186fabe21629de2d4cc3f1efbde34941a72949963a62295fa5f3" name="fapolicyd-selinux" arch="noarch">
  <version epoch="0" ver="1.4.3" rel="11.13"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1771588800">- initial import</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1778155200">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="7037ea5c8104e2676f6956e65434d18abfe74c3ee2d88ef1aba178b216672dc87fa7e15b5ce456a72bd913afd6389c8260846c8688079afdcf1c7194784e2c6c" name="fdo-client" arch="s390x">
  <version epoch="0" ver="1.1.4+git20221209.c8ef757" rel="17.17"/>
  <changelog author="Stefan Schubert &lt;schubi@suse.de&gt;" date="1634299200">- This is the successor of sdo-client
  EPIC: SLE/SLE-22946</changelog>
  <changelog author="schubi@suse.com" date="1677758400">- Update to version 1.0.0+git20171208.5da1bad:
  * Use secure functions where appropriate
  * Added extern definition
  * Fix Klocwork Errors
  * Fix output
  * Fix Core Dump in Unit Test
  * Add Makefile
  * publish unit tests
  * strpcpu_s: remove unsed redundant variable overlap_bumper
  * Update LICENSE&amp;COPYING.txt</changelog>
  <changelog author="schubi@suse.com" date="1677758401">- Update to version 1.1.4+git20221209.c8ef757:
  * Readme update (#210)
  * Updating the readme with openssl 1.1.1s (#209)
  * Fix TO when IP/RV is empty string (#208)
  * * Replaced unsafe string function (#207)
  * Increase max message buffer size to 64000 (#205)
  * Update Curl version as 7.86 in Readme (#206)
  * Readme updates (#204)
  * Minimal logs by default (compile time) (#203)
  * Revert openssl3 (#201)
  * Update HTTPS connection to use TLS 1.2 (#196)
  * Openssl 3 porting (#194)
  * Add curl support for HTTP connection (#195)
  * Update NOTICE file (#192)
  * Add CURL support for HTTPS connection (#188)
  * Readme update for installing safestringlib (#191)
  * Updating the readme with openssl 1.1.1q (#187)
  * switch to host.docker.internal (#185)
  * Fix to enable compilation of CSDK in ubuntu 22 (#183)
  * Fix TO when IP is NULL (#184)
  * Update EAT-UEID value as per FIDO working draft specification (#180)
  * Revert "Update EAT-UEID value as per FIDO working draft specification (#178)" (#179)
  * Update EAT-UEID value as per FIDO working draft specification (#178)
  * Updating comments in fdonet.c (#177)
  * Upgrade OpenSSL toolkit version to 1.1.1n (#176)
  * Documentation updates (#175)
  * Add a note regarding fdosys issue (#174)
  * Update Jenkinsfile to copy PRI artifacts from master (#173)
  * Merging 1.1 dev branch to master. (#172)
  * Fix multiple owner support for CSDK devices. (#167)
  * Fix: fdo_sys:exec_cb/exec not working after initial fdo_sys:exec (#166)
  * Add implementation for fdo_sys keep-alive (#165)
  * Fix an issue with keeping in-memory Mfg PublicKey hash (#164)
  * Update/Tweak Device Status and Cred management (#163)
  * Updating EAT IANA numbers as per spec ERRATA (#160)
  * Updating Device ServiceInfo framework to handle writes (#162)
  * Add TPM support on RHEL (#161)
  * Update README for RHEL support (#159)
  * Remove disclaimer from README (#158)</changelog>
  <changelog author="Stefan Schubert &lt;schubi@suse.com&gt;" date="1699876800">- Remove build key via utils/keys_gen.sh. (bsc#1216293)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build using RPM 4.19: builddir does contain the extracted
  tartball, but can also contain special directories used by RPM,
  resolving in globbing to behave differently.</changelog>
  <changelog author="Otto Hollmann &lt;otto.hollmann@suse.com&gt;" date="1707825600">- Remove the hardcoded libopenssl-1_1-devel and replace it with
  libopenssl-devel (bsc#1219879).</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1734523200">- gcc.patch: avoid implicits when using more strict GCC14</changelog>
</package>
<package pkgid="2efc75520025e7149fabb89ea4cea36c4d439004a3b12a69f9e80ef481200aa1d2343abba8da1927cb0d4f90b6416689ac5056323a5ceb0fb78bdd040bc2f1a6" name="fdo-client" arch="src">
  <version epoch="0" ver="1.1.4+git20221209.c8ef757" rel="17.17"/>
  <changelog author="Stefan Schubert &lt;schubi@suse.de&gt;" date="1634299200">- This is the successor of sdo-client
  EPIC: SLE/SLE-22946</changelog>
  <changelog author="schubi@suse.com" date="1677758400">- Update to version 1.0.0+git20171208.5da1bad:
  * Use secure functions where appropriate
  * Added extern definition
  * Fix Klocwork Errors
  * Fix output
  * Fix Core Dump in Unit Test
  * Add Makefile
  * publish unit tests
  * strpcpu_s: remove unsed redundant variable overlap_bumper
  * Update LICENSE&amp;COPYING.txt</changelog>
  <changelog author="schubi@suse.com" date="1677758401">- Update to version 1.1.4+git20221209.c8ef757:
  * Readme update (#210)
  * Updating the readme with openssl 1.1.1s (#209)
  * Fix TO when IP/RV is empty string (#208)
  * * Replaced unsafe string function (#207)
  * Increase max message buffer size to 64000 (#205)
  * Update Curl version as 7.86 in Readme (#206)
  * Readme updates (#204)
  * Minimal logs by default (compile time) (#203)
  * Revert openssl3 (#201)
  * Update HTTPS connection to use TLS 1.2 (#196)
  * Openssl 3 porting (#194)
  * Add curl support for HTTP connection (#195)
  * Update NOTICE file (#192)
  * Add CURL support for HTTPS connection (#188)
  * Readme update for installing safestringlib (#191)
  * Updating the readme with openssl 1.1.1q (#187)
  * switch to host.docker.internal (#185)
  * Fix to enable compilation of CSDK in ubuntu 22 (#183)
  * Fix TO when IP is NULL (#184)
  * Update EAT-UEID value as per FIDO working draft specification (#180)
  * Revert "Update EAT-UEID value as per FIDO working draft specification (#178)" (#179)
  * Update EAT-UEID value as per FIDO working draft specification (#178)
  * Updating comments in fdonet.c (#177)
  * Upgrade OpenSSL toolkit version to 1.1.1n (#176)
  * Documentation updates (#175)
  * Add a note regarding fdosys issue (#174)
  * Update Jenkinsfile to copy PRI artifacts from master (#173)
  * Merging 1.1 dev branch to master. (#172)
  * Fix multiple owner support for CSDK devices. (#167)
  * Fix: fdo_sys:exec_cb/exec not working after initial fdo_sys:exec (#166)
  * Add implementation for fdo_sys keep-alive (#165)
  * Fix an issue with keeping in-memory Mfg PublicKey hash (#164)
  * Update/Tweak Device Status and Cred management (#163)
  * Updating EAT IANA numbers as per spec ERRATA (#160)
  * Updating Device ServiceInfo framework to handle writes (#162)
  * Add TPM support on RHEL (#161)
  * Update README for RHEL support (#159)
  * Remove disclaimer from README (#158)</changelog>
  <changelog author="Stefan Schubert &lt;schubi@suse.com&gt;" date="1699876800">- Remove build key via utils/keys_gen.sh. (bsc#1216293)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build using RPM 4.19: builddir does contain the extracted
  tartball, but can also contain special directories used by RPM,
  resolving in globbing to behave differently.</changelog>
  <changelog author="Otto Hollmann &lt;otto.hollmann@suse.com&gt;" date="1707825600">- Remove the hardcoded libopenssl-1_1-devel and replace it with
  libopenssl-devel (bsc#1219879).</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1734523200">- gcc.patch: avoid implicits when using more strict GCC14</changelog>
</package>
<package pkgid="304760027c934d00d31d58c02b7de6fa34c87eb66cd08f39761fe793207665c7fa95fd2ce25d2558d2167e206b9a4bea4fd754a83f33b2711df98e0fb01cbbec" name="fdo-client-debuginfo" arch="s390x">
  <version epoch="0" ver="1.1.4+git20221209.c8ef757" rel="17.17"/>
  <changelog author="Stefan Schubert &lt;schubi@suse.de&gt;" date="1634299200">- This is the successor of sdo-client
  EPIC: SLE/SLE-22946</changelog>
  <changelog author="schubi@suse.com" date="1677758400">- Update to version 1.0.0+git20171208.5da1bad:
  * Use secure functions where appropriate
  * Added extern definition
  * Fix Klocwork Errors
  * Fix output
  * Fix Core Dump in Unit Test
  * Add Makefile
  * publish unit tests
  * strpcpu_s: remove unsed redundant variable overlap_bumper
  * Update LICENSE&amp;COPYING.txt</changelog>
  <changelog author="schubi@suse.com" date="1677758401">- Update to version 1.1.4+git20221209.c8ef757:
  * Readme update (#210)
  * Updating the readme with openssl 1.1.1s (#209)
  * Fix TO when IP/RV is empty string (#208)
  * * Replaced unsafe string function (#207)
  * Increase max message buffer size to 64000 (#205)
  * Update Curl version as 7.86 in Readme (#206)
  * Readme updates (#204)
  * Minimal logs by default (compile time) (#203)
  * Revert openssl3 (#201)
  * Update HTTPS connection to use TLS 1.2 (#196)
  * Openssl 3 porting (#194)
  * Add curl support for HTTP connection (#195)
  * Update NOTICE file (#192)
  * Add CURL support for HTTPS connection (#188)
  * Readme update for installing safestringlib (#191)
  * Updating the readme with openssl 1.1.1q (#187)
  * switch to host.docker.internal (#185)
  * Fix to enable compilation of CSDK in ubuntu 22 (#183)
  * Fix TO when IP is NULL (#184)
  * Update EAT-UEID value as per FIDO working draft specification (#180)
  * Revert "Update EAT-UEID value as per FIDO working draft specification (#178)" (#179)
  * Update EAT-UEID value as per FIDO working draft specification (#178)
  * Updating comments in fdonet.c (#177)
  * Upgrade OpenSSL toolkit version to 1.1.1n (#176)
  * Documentation updates (#175)
  * Add a note regarding fdosys issue (#174)
  * Update Jenkinsfile to copy PRI artifacts from master (#173)
  * Merging 1.1 dev branch to master. (#172)
  * Fix multiple owner support for CSDK devices. (#167)
  * Fix: fdo_sys:exec_cb/exec not working after initial fdo_sys:exec (#166)
  * Add implementation for fdo_sys keep-alive (#165)
  * Fix an issue with keeping in-memory Mfg PublicKey hash (#164)
  * Update/Tweak Device Status and Cred management (#163)
  * Updating EAT IANA numbers as per spec ERRATA (#160)
  * Updating Device ServiceInfo framework to handle writes (#162)
  * Add TPM support on RHEL (#161)
  * Update README for RHEL support (#159)
  * Remove disclaimer from README (#158)</changelog>
  <changelog author="Stefan Schubert &lt;schubi@suse.com&gt;" date="1699876800">- Remove build key via utils/keys_gen.sh. (bsc#1216293)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build using RPM 4.19: builddir does contain the extracted
  tartball, but can also contain special directories used by RPM,
  resolving in globbing to behave differently.</changelog>
  <changelog author="Otto Hollmann &lt;otto.hollmann@suse.com&gt;" date="1707825600">- Remove the hardcoded libopenssl-1_1-devel and replace it with
  libopenssl-devel (bsc#1219879).</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1734523200">- gcc.patch: avoid implicits when using more strict GCC14</changelog>
</package>
<package pkgid="4f97869c90df7567747476c0117eea6b3f5bb65920e9dabce99dd07549384906f304f46a68190fee79b894c1f331d86cbd152c13b215474acd28e8b1ff8adc23" name="fdo-client-devel" arch="s390x">
  <version epoch="0" ver="1.1.4+git20221209.c8ef757" rel="17.17"/>
  <changelog author="Stefan Schubert &lt;schubi@suse.de&gt;" date="1634299200">- This is the successor of sdo-client
  EPIC: SLE/SLE-22946</changelog>
  <changelog author="schubi@suse.com" date="1677758400">- Update to version 1.0.0+git20171208.5da1bad:
  * Use secure functions where appropriate
  * Added extern definition
  * Fix Klocwork Errors
  * Fix output
  * Fix Core Dump in Unit Test
  * Add Makefile
  * publish unit tests
  * strpcpu_s: remove unsed redundant variable overlap_bumper
  * Update LICENSE&amp;COPYING.txt</changelog>
  <changelog author="schubi@suse.com" date="1677758401">- Update to version 1.1.4+git20221209.c8ef757:
  * Readme update (#210)
  * Updating the readme with openssl 1.1.1s (#209)
  * Fix TO when IP/RV is empty string (#208)
  * * Replaced unsafe string function (#207)
  * Increase max message buffer size to 64000 (#205)
  * Update Curl version as 7.86 in Readme (#206)
  * Readme updates (#204)
  * Minimal logs by default (compile time) (#203)
  * Revert openssl3 (#201)
  * Update HTTPS connection to use TLS 1.2 (#196)
  * Openssl 3 porting (#194)
  * Add curl support for HTTP connection (#195)
  * Update NOTICE file (#192)
  * Add CURL support for HTTPS connection (#188)
  * Readme update for installing safestringlib (#191)
  * Updating the readme with openssl 1.1.1q (#187)
  * switch to host.docker.internal (#185)
  * Fix to enable compilation of CSDK in ubuntu 22 (#183)
  * Fix TO when IP is NULL (#184)
  * Update EAT-UEID value as per FIDO working draft specification (#180)
  * Revert "Update EAT-UEID value as per FIDO working draft specification (#178)" (#179)
  * Update EAT-UEID value as per FIDO working draft specification (#178)
  * Updating comments in fdonet.c (#177)
  * Upgrade OpenSSL toolkit version to 1.1.1n (#176)
  * Documentation updates (#175)
  * Add a note regarding fdosys issue (#174)
  * Update Jenkinsfile to copy PRI artifacts from master (#173)
  * Merging 1.1 dev branch to master. (#172)
  * Fix multiple owner support for CSDK devices. (#167)
  * Fix: fdo_sys:exec_cb/exec not working after initial fdo_sys:exec (#166)
  * Add implementation for fdo_sys keep-alive (#165)
  * Fix an issue with keeping in-memory Mfg PublicKey hash (#164)
  * Update/Tweak Device Status and Cred management (#163)
  * Updating EAT IANA numbers as per spec ERRATA (#160)
  * Updating Device ServiceInfo framework to handle writes (#162)
  * Add TPM support on RHEL (#161)
  * Update README for RHEL support (#159)
  * Remove disclaimer from README (#158)</changelog>
  <changelog author="Stefan Schubert &lt;schubi@suse.com&gt;" date="1699876800">- Remove build key via utils/keys_gen.sh. (bsc#1216293)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1706875200">- Fix build using RPM 4.19: builddir does contain the extracted
  tartball, but can also contain special directories used by RPM,
  resolving in globbing to behave differently.</changelog>
  <changelog author="Otto Hollmann &lt;otto.hollmann@suse.com&gt;" date="1707825600">- Remove the hardcoded libopenssl-1_1-devel and replace it with
  libopenssl-devel (bsc#1219879).</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1734523200">- gcc.patch: avoid implicits when using more strict GCC14</changelog>
</package>
<package pkgid="bb9332b07f35773ef7959589b18f73781a742181562b2dcfc00b2cd4ec41573c4a90ec46d446328b33f576af21e72708bf97516a699ae9663ea891610e801da3" name="fipscheck" arch="s390x">
  <version epoch="0" ver="1.7.0" rel="47.44"/>
  <changelog author="meissner@suse.com" date="1401710400">- add baselibs.conf</changelog>
  <changelog author="jengelh@inai.de" date="1428926400">- Set RPM groups anew. Drop implicit cleaning parts.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497268800">- Port to OpenSSL 1.1 (bsc#1042649)
  Adds openssl-1_1-port.patch</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1536667200">- Updated fipscheck to 1.5.0
  * Changed source to local file since latest official release
    is not in the official releases directory.
  * Downgraded libopenssl-devel to libopenssl-1_0_0-devel because
    1.0.2 supports FIPS.</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1537444800">- Changed source back to http now that current release folder
  has current tarball.</changelog>
  <changelog author="V&#xED;t&#x11B;zslav &#x10C;&#xED;&#x17E;ek &lt;vcizek@suse.com&gt;" date="1546516800">- Use the shipped manpages instead of building them with xmlto
  in order to avoid a build cycle (fipscheck, xmlto, libxslt, libgcrypt)
  * add fipscheck-dont_generate_manpages.patch
- fix build on older distributions</changelog>
  <changelog author="V&#xED;t&#x11B;zslav &#x10C;&#xED;&#x17E;ek &lt;vcizek@suse.com&gt;" date="1568635200">- Remove #include of unused fips.h to fix build with OpenSSL 1.1.1
  (bsc#1149792)
  * add fipscheck-fips.h_not_needed.patch
- Drop obsolete openssl-1_1-port.patch (upstream)</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1605873600">- move libs to %_libdir (boo#1029961)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1667390400">- updated to 1.7.0 (from a different supplier)
  - openssl 3 support
- dropped fipscheck-dont_generate_manpages.patch (not needed)
- dropped fipscheck-fips.h_not_needed.patch (not needed)</changelog>
  <changelog author="Martin Jambor &lt;mjambor@suse.com&gt;" date="1720440000">- Backport upstream patches fipscheck-fix_check_openssl_version.patch
  and fipscheck-fix_incorrect_length_type.patch to fix C99 violations
  which are errors by default with GCC 14 [boo#1221714] - although the
  first one looks like it possibly fixes some more substantial error.</changelog>
</package>
<package pkgid="2bafc16221f8318cde263c30494ea54d559914ef6b58bf884f57171bd0aa9d613304eec3cfe969d7a168063a133638aed0ba8e3f77981abebed5227611a38c20" name="fipscheck" arch="src">
  <version epoch="0" ver="1.7.0" rel="47.44"/>
  <changelog author="meissner@suse.com" date="1390219200">- imported a generic fips helper to verify fips modules, linked
  to openssl.</changelog>
  <changelog author="cfarrell@suse.com" date="1390305600">- license update: BSD-2-Clause
  See LICENSE</changelog>
  <changelog author="meissner@suse.com" date="1401192000">- updated to 1.4.1
  - added manpages
  - fipscheck/fipshmac: Add -s option to specify the hmac suffix
  - fipshmac: Add '-d' option to specify where to put the .hmac files
  - various bugfixes</changelog>
  <changelog author="meissner@suse.com" date="1401710400">- add baselibs.conf</changelog>
  <changelog author="jengelh@inai.de" date="1428926400">- Set RPM groups anew. Drop implicit cleaning parts.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497268800">- Port to OpenSSL 1.1 (bsc#1042649)
  Adds openssl-1_1-port.patch</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1536667200">- Updated fipscheck to 1.5.0
  * Changed source to local file since latest official release
    is not in the official releases directory.
  * Downgraded libopenssl-devel to libopenssl-1_0_0-devel because
    1.0.2 supports FIPS.</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1537444800">- Changed source back to http now that current release folder
  has current tarball.</changelog>
  <changelog author="V&#xED;t&#x11B;zslav &#x10C;&#xED;&#x17E;ek &lt;vcizek@suse.com&gt;" date="1546516800">- Use the shipped manpages instead of building them with xmlto
  in order to avoid a build cycle (fipscheck, xmlto, libxslt, libgcrypt)
  * add fipscheck-dont_generate_manpages.patch
- fix build on older distributions</changelog>
  <changelog author="V&#xED;t&#x11B;zslav &#x10C;&#xED;&#x17E;ek &lt;vcizek@suse.com&gt;" date="1568635200">- Remove #include of unused fips.h to fix build with OpenSSL 1.1.1
  (bsc#1149792)
  * add fipscheck-fips.h_not_needed.patch
- Drop obsolete openssl-1_1-port.patch (upstream)</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1605873600">- move libs to %_libdir (boo#1029961)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1667390400">- updated to 1.7.0 (from a different supplier)
  - openssl 3 support
- dropped fipscheck-dont_generate_manpages.patch (not needed)
- dropped fipscheck-fips.h_not_needed.patch (not needed)</changelog>
  <changelog author="Martin Jambor &lt;mjambor@suse.com&gt;" date="1720440000">- Backport upstream patches fipscheck-fix_check_openssl_version.patch
  and fipscheck-fix_incorrect_length_type.patch to fix C99 violations
  which are errors by default with GCC 14 [boo#1221714] - although the
  first one looks like it possibly fixes some more substantial error.</changelog>
</package>
<package pkgid="518852529d9766ea313faaec2f1a8e23aec8f2239a8e053ab0520165750c9acab14d71f2f17b4ba81c3097ced69742f2b6f3bf21bbb5310e498eb460c4d662cd" name="fipscheck-debuginfo" arch="s390x">
  <version epoch="0" ver="1.7.0" rel="47.44"/>
  <changelog author="meissner@suse.com" date="1401710400">- add baselibs.conf</changelog>
  <changelog author="jengelh@inai.de" date="1428926400">- Set RPM groups anew. Drop implicit cleaning parts.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497268800">- Port to OpenSSL 1.1 (bsc#1042649)
  Adds openssl-1_1-port.patch</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1536667200">- Updated fipscheck to 1.5.0
  * Changed source to local file since latest official release
    is not in the official releases directory.
  * Downgraded libopenssl-devel to libopenssl-1_0_0-devel because
    1.0.2 supports FIPS.</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1537444800">- Changed source back to http now that current release folder
  has current tarball.</changelog>
  <changelog author="V&#xED;t&#x11B;zslav &#x10C;&#xED;&#x17E;ek &lt;vcizek@suse.com&gt;" date="1546516800">- Use the shipped manpages instead of building them with xmlto
  in order to avoid a build cycle (fipscheck, xmlto, libxslt, libgcrypt)
  * add fipscheck-dont_generate_manpages.patch
- fix build on older distributions</changelog>
  <changelog author="V&#xED;t&#x11B;zslav &#x10C;&#xED;&#x17E;ek &lt;vcizek@suse.com&gt;" date="1568635200">- Remove #include of unused fips.h to fix build with OpenSSL 1.1.1
  (bsc#1149792)
  * add fipscheck-fips.h_not_needed.patch
- Drop obsolete openssl-1_1-port.patch (upstream)</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1605873600">- move libs to %_libdir (boo#1029961)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1667390400">- updated to 1.7.0 (from a different supplier)
  - openssl 3 support
- dropped fipscheck-dont_generate_manpages.patch (not needed)
- dropped fipscheck-fips.h_not_needed.patch (not needed)</changelog>
  <changelog author="Martin Jambor &lt;mjambor@suse.com&gt;" date="1720440000">- Backport upstream patches fipscheck-fix_check_openssl_version.patch
  and fipscheck-fix_incorrect_length_type.patch to fix C99 violations
  which are errors by default with GCC 14 [boo#1221714] - although the
  first one looks like it possibly fixes some more substantial error.</changelog>
</package>
<package pkgid="2157d5015b796d5972fc61b335b2bf5daad3abd5704f4113cf4befce51a82da4570f8d1c8e04981a40c5d210cdae892d13e77882966956c00027fc9a1228a5fe" name="fipscheck-debugsource" arch="s390x">
  <version epoch="0" ver="1.7.0" rel="47.44"/>
  <changelog author="meissner@suse.com" date="1401710400">- add baselibs.conf</changelog>
  <changelog author="jengelh@inai.de" date="1428926400">- Set RPM groups anew. Drop implicit cleaning parts.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497268800">- Port to OpenSSL 1.1 (bsc#1042649)
  Adds openssl-1_1-port.patch</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1536667200">- Updated fipscheck to 1.5.0
  * Changed source to local file since latest official release
    is not in the official releases directory.
  * Downgraded libopenssl-devel to libopenssl-1_0_0-devel because
    1.0.2 supports FIPS.</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1537444800">- Changed source back to http now that current release folder
  has current tarball.</changelog>
  <changelog author="V&#xED;t&#x11B;zslav &#x10C;&#xED;&#x17E;ek &lt;vcizek@suse.com&gt;" date="1546516800">- Use the shipped manpages instead of building them with xmlto
  in order to avoid a build cycle (fipscheck, xmlto, libxslt, libgcrypt)
  * add fipscheck-dont_generate_manpages.patch
- fix build on older distributions</changelog>
  <changelog author="V&#xED;t&#x11B;zslav &#x10C;&#xED;&#x17E;ek &lt;vcizek@suse.com&gt;" date="1568635200">- Remove #include of unused fips.h to fix build with OpenSSL 1.1.1
  (bsc#1149792)
  * add fipscheck-fips.h_not_needed.patch
- Drop obsolete openssl-1_1-port.patch (upstream)</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1605873600">- move libs to %_libdir (boo#1029961)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1667390400">- updated to 1.7.0 (from a different supplier)
  - openssl 3 support
- dropped fipscheck-dont_generate_manpages.patch (not needed)
- dropped fipscheck-fips.h_not_needed.patch (not needed)</changelog>
  <changelog author="Martin Jambor &lt;mjambor@suse.com&gt;" date="1720440000">- Backport upstream patches fipscheck-fix_check_openssl_version.patch
  and fipscheck-fix_incorrect_length_type.patch to fix C99 violations
  which are errors by default with GCC 14 [boo#1221714] - although the
  first one looks like it possibly fixes some more substantial error.</changelog>
</package>
<package pkgid="c1c76fc02ca3915cce2f2c06d7a61d18c557a37c49de02bf469d99235c33ba3baeb3aa0f5f5fbcd6f2a9937e27e2d1203d897fbb17d58cf1ae871b08fec25e4c" name="fipscheck-devel" arch="s390x">
  <version epoch="0" ver="1.7.0" rel="47.44"/>
  <changelog author="meissner@suse.com" date="1401710400">- add baselibs.conf</changelog>
  <changelog author="jengelh@inai.de" date="1428926400">- Set RPM groups anew. Drop implicit cleaning parts.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497268800">- Port to OpenSSL 1.1 (bsc#1042649)
  Adds openssl-1_1-port.patch</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1536667200">- Updated fipscheck to 1.5.0
  * Changed source to local file since latest official release
    is not in the official releases directory.
  * Downgraded libopenssl-devel to libopenssl-1_0_0-devel because
    1.0.2 supports FIPS.</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1537444800">- Changed source back to http now that current release folder
  has current tarball.</changelog>
  <changelog author="V&#xED;t&#x11B;zslav &#x10C;&#xED;&#x17E;ek &lt;vcizek@suse.com&gt;" date="1546516800">- Use the shipped manpages instead of building them with xmlto
  in order to avoid a build cycle (fipscheck, xmlto, libxslt, libgcrypt)
  * add fipscheck-dont_generate_manpages.patch
- fix build on older distributions</changelog>
  <changelog author="V&#xED;t&#x11B;zslav &#x10C;&#xED;&#x17E;ek &lt;vcizek@suse.com&gt;" date="1568635200">- Remove #include of unused fips.h to fix build with OpenSSL 1.1.1
  (bsc#1149792)
  * add fipscheck-fips.h_not_needed.patch
- Drop obsolete openssl-1_1-port.patch (upstream)</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1605873600">- move libs to %_libdir (boo#1029961)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1667390400">- updated to 1.7.0 (from a different supplier)
  - openssl 3 support
- dropped fipscheck-dont_generate_manpages.patch (not needed)
- dropped fipscheck-fips.h_not_needed.patch (not needed)</changelog>
  <changelog author="Martin Jambor &lt;mjambor@suse.com&gt;" date="1720440000">- Backport upstream patches fipscheck-fix_check_openssl_version.patch
  and fipscheck-fix_incorrect_length_type.patch to fix C99 violations
  which are errors by default with GCC 14 [boo#1221714] - although the
  first one looks like it possibly fixes some more substantial error.</changelog>
</package>
<package pkgid="569e5fb759eb9b35c0a32072aa79c22fed11d5e5612d962466cd56b0b3ce02288be18a61a6c80afc1d5729669c69b4e2060f76489c75c65bf1466bc4f90c7723" name="firewalld-rpcbind-helper" arch="noarch">
  <version epoch="0" ver="0.21" rel="12.34"/>
  <changelog author="matthias.gerstner@suse.com" date="1523448000">- initial version of package</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1523880000">- Require python3 and to be in line with the Leap-15 /
  SLE-15 situation (see OBS comments in sr#595722).
- shebang.patch: use python3 in shebang for the same reasons.</changelog>
  <changelog author="jengelh@inai.de" date="1523966400">- Feed file through spec-cleaner</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1524484800">- use %doc and %license macros in a cleaner way</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1526040000">- update to new minor release that fixes bugs:
  * error in some cases when running with python3 because of a missing decode
  * error when sysconfig files have not been existing, because packages have
    not been installed yet
- dropped shebang.patch: is now covered by new release tarball</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566216000">- update to new minor release that fixes a bug that can occur with python3
  when `rpcbind -p` contains a port listing neither for udp nor for tcp. See
  [1].
  [1]: https://github.com/mgerstner/firewalld-rpcbind-helper/issues/1</changelog>
</package>
<package pkgid="399e97d023c7ae5b9f012ef043d3bece5db085510a8c86b9ba0dcfe513bb6b8a7a935de79a2bfb66f8696811f237c0d5d9c5839b1faecdf3d3e74b45f2a41ba6" name="firewalld-rpcbind-helper" arch="src">
  <version epoch="0" ver="0.21" rel="12.34"/>
  <changelog author="matthias.gerstner@suse.com" date="1523448000">- initial version of package</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1523880000">- Require python3 and to be in line with the Leap-15 /
  SLE-15 situation (see OBS comments in sr#595722).
- shebang.patch: use python3 in shebang for the same reasons.</changelog>
  <changelog author="jengelh@inai.de" date="1523966400">- Feed file through spec-cleaner</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1524484800">- use %doc and %license macros in a cleaner way</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1526040000">- update to new minor release that fixes bugs:
  * error in some cases when running with python3 because of a missing decode
  * error when sysconfig files have not been existing, because packages have
    not been installed yet
- dropped shebang.patch: is now covered by new release tarball</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1566216000">- update to new minor release that fixes a bug that can occur with python3
  when `rpcbind -p` contains a port listing neither for udp nor for tcp. See
  [1].
  [1]: https://github.com/mgerstner/firewalld-rpcbind-helper/issues/1</changelog>
</package>
<package pkgid="957df40feb9be6f433aa0c8b25443dcc305cdf56ce6e66b23dc103f9c5ffa36feeef22684dc085651d4e4856538f571a15ecdceb2bd2699ff163c0a16751cad6" name="fudo" arch="s390x">
  <version epoch="0" ver="0" rel="3.13"/>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1695729600">- initial package</changelog>
</package>
<package pkgid="bb1df44d065437e40054dc37b235c6e08472cadf69174564612446d8ede1a4a3e06404af3c783dbc6e77f6dff39915921572a9158f25a8d881a4f12186c86612" name="fudo" arch="src">
  <version epoch="0" ver="0" rel="3.13"/>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1695729600">- initial package</changelog>
</package>
<package pkgid="76d0327a8bccc234ec0ae308eb7bf3ff5077a1852f0cd5812b0f7088b1dbf36dbf097856286aebf73779cd8baeeeb150d280296e99045b698f4da7dda7d44dab" name="fudo-policy-noauth-wheel" arch="s390x">
  <version epoch="0" ver="0" rel="3.13"/>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1695729600">- initial package</changelog>
</package>
<package pkgid="379f22f6c6d3b436f05e2e20529630bc666c7c07ec499f57a337f2b157ef2e8028097d925b694b49df191b96a40af3b41ad5e857964af019ee409e02acbae23d" name="fudo-policy-selfauth-wheel" arch="s390x">
  <version epoch="0" ver="0" rel="3.13"/>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1695729600">- initial package</changelog>
</package>
<package pkgid="f9c4f4b1beafe09ec37c53f306c8528b48394d03e1a8226c39ce447680b691b7745d90778eb44801f40abc34eebe09677490b9e0a27159c59922fce217b5e1c7" name="fwbuilder" arch="s390x">
  <version epoch="0" ver="5.3.7" rel="60.104"/>
  <changelog author="chris@computersalat.de" date="1486382400">- split package
  * build fwbuilder-service independently from fwbuilder
  * update changes file</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1486468800">- Use the Source link
- Revert the source split as it's not prefered</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1486468801">- Removed the service files as they are not compatible with opensuse
  they will for instance break the network settings
  As the script generated by fwbuilders includes iptables rules
  as wel as network interface settings</changelog>
  <changelog author="jengelh@inai.de" date="1486555200">- Fix linguistic issues in description</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1486555201">- Removed item from change log that shouldn't have been
  allowed via request 450449 it's not allowed to change
  and sertianly not insert changes in the changes file</changelog>
  <changelog author="dimstar@opensuse.org" date="1512475200">- Replace openssl-devel BuildRequires with pkgconfig(openssl):
  allow OBS to fallback to openssl 1.0, since this tool links Qt4
  (which is known not to be compatible with openssl 1.1).</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1513080000">- Build using Qt5 in stead of Qt4</changelog>
  <changelog author="dimstar@opensuse.org" date="1517400000">- Add fwbuilder-qmake-without-flags.patch: Fix build in case qmake
  is started without QMAKE_CXXFLAGS being defined
  (gh#fwbuilder/fwbuilder#46).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1550145600">- Add fix-bsc1124647-segfault.patch: Fix crash described in bsc#1124647</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1622462400">- Add patch to fix build with GCC 11:
  * 0001-C-exception-specifications-are-deprecated-in-C-11.patch
- Spec cleanup</changelog>
</package>
<package pkgid="14482fb20294ec108c74ac8e827d8fe15205e116997eef82fd236621bcff62bb2101a9ccf641b1038d7732d2e13555ea0fa9f15b11f2e894a5fc53745caf4e60" name="fwbuilder" arch="src">
  <version epoch="0" ver="5.3.7" rel="60.104"/>
  <changelog author="joop.boonen@opensuse.org" date="1325937600">- Build version 5.0.1.3592</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1327492800">- Added automake and libtool as build requirement
- Used fdupes to get rid of duplicate files
- Libfwbuilder doesn't exist anymore for a long time,
  that's why the obsoletes removed</changelog>
  <changelog author="cfarrell@suse.com" date="1327924800">- license update: GPL-2.0+</changelog>
  <changelog author="dimstar@opensuse.org" date="1331985600">- Add fwbuilder-gcc47.patch: Fix build with gcc 4.7.</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1333540800">- Build version 5.1.0.3599
- Cleaned the spec file</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1354968000">- Added Requires rcs to enable reversion control
- Cleaned the spec file a bit more</changelog>
  <changelog author="mpluskal@suse.com" date="1441195200">- Use url for source
- Cleanup spec file
- Use macros for updating of desktop files and icons</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1466942400">- Build version 5.3.6 from the github repo
  * Several bugfixes for Junos, including rollback on syntax error,
    correct netmask for host objects and ssh password prompt lock-up
  * Support for Junos Access lists
  * Search for objects by port number or ip addres
  * View graphical diff and autocompile firewall when loading file
  * Support for Cisco NXOS Access lists
  * Added support for dummy objects in rules
  * Port to Qt5
- Deleted fwbuilder-gcc47.patch as it's not needed any more.
  The code has been fixed.</changelog>
  <changelog author="chris@computersalat.de" date="1472990400">- add subpackage service/SysVinit
  * added systemd service / SysVinit file
  * added default file, which will be overwritten (sent) by
    fwbuilder GUI
  * noarch package</changelog>
  <changelog author="chris@computersalat.de" date="1484481600">- Update to 5.3.7
  * iptables:
  - Feature: fwbuilder now supports conntrack instead of state module for recent iptables
  - Feature: Add support for the iptables &gt; 1.4.20 "-w" option
  - Bugfix: Fixed (potential) deadlock situation as sugested by https://github.com/antaflos
  - Bugfix: Proper handling of NAT chains
  - Feature: Add support for --kerneltz
  * junos:
  - Bugfix: Generated new ids for the IP fragmentation service objects in the standard object database
  - Bugfix: Use correct comment symbol
  * gui:
  - Bugfix: Don't delete object in locked group
  - Feature: Add new objects directly to the subfolder via context menu
  * compiler:
  - Feature: Add support for MSYS2
  - Update OSX buildscript for newer XCode
  - Feature: Add support for GCC 6.X
  - Refactor: Gain more C++11 compatability
  - Feature: W32: Add support for MXE and provide Docker environment for cross compiling</changelog>
  <changelog author="chris@computersalat.de" date="1486382400">- split package
  * build fwbuilder-service independently from fwbuilder
  * update changes file</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1486468800">- Use the Source link
- Revert the source split as it's not prefered</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1486468801">- Removed the service files as they are not compatible with opensuse
  they will for instance break the network settings
  As the script generated by fwbuilders includes iptables rules
  as wel as network interface settings</changelog>
  <changelog author="jengelh@inai.de" date="1486555200">- Fix linguistic issues in description</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1486555201">- Removed item from change log that shouldn't have been
  allowed via request 450449 it's not allowed to change
  and sertianly not insert changes in the changes file</changelog>
  <changelog author="dimstar@opensuse.org" date="1512475200">- Replace openssl-devel BuildRequires with pkgconfig(openssl):
  allow OBS to fallback to openssl 1.0, since this tool links Qt4
  (which is known not to be compatible with openssl 1.1).</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1513080000">- Build using Qt5 in stead of Qt4</changelog>
  <changelog author="dimstar@opensuse.org" date="1517400000">- Add fwbuilder-qmake-without-flags.patch: Fix build in case qmake
  is started without QMAKE_CXXFLAGS being defined
  (gh#fwbuilder/fwbuilder#46).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1550145600">- Add fix-bsc1124647-segfault.patch: Fix crash described in bsc#1124647</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1622462400">- Add patch to fix build with GCC 11:
  * 0001-C-exception-specifications-are-deprecated-in-C-11.patch
- Spec cleanup</changelog>
</package>
<package pkgid="cca33e62996070931104cdae9fe205a90bdfa96cacd47a32afd07d92554a0ffd997b8a2d7541c02fe4f3e50714a8ca3d7afa621514f6581855a5ba42c40fe2a3" name="fwbuilder-debuginfo" arch="s390x">
  <version epoch="0" ver="5.3.7" rel="60.104"/>
  <changelog author="chris@computersalat.de" date="1486382400">- split package
  * build fwbuilder-service independently from fwbuilder
  * update changes file</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1486468800">- Use the Source link
- Revert the source split as it's not prefered</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1486468801">- Removed the service files as they are not compatible with opensuse
  they will for instance break the network settings
  As the script generated by fwbuilders includes iptables rules
  as wel as network interface settings</changelog>
  <changelog author="jengelh@inai.de" date="1486555200">- Fix linguistic issues in description</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1486555201">- Removed item from change log that shouldn't have been
  allowed via request 450449 it's not allowed to change
  and sertianly not insert changes in the changes file</changelog>
  <changelog author="dimstar@opensuse.org" date="1512475200">- Replace openssl-devel BuildRequires with pkgconfig(openssl):
  allow OBS to fallback to openssl 1.0, since this tool links Qt4
  (which is known not to be compatible with openssl 1.1).</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1513080000">- Build using Qt5 in stead of Qt4</changelog>
  <changelog author="dimstar@opensuse.org" date="1517400000">- Add fwbuilder-qmake-without-flags.patch: Fix build in case qmake
  is started without QMAKE_CXXFLAGS being defined
  (gh#fwbuilder/fwbuilder#46).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1550145600">- Add fix-bsc1124647-segfault.patch: Fix crash described in bsc#1124647</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1622462400">- Add patch to fix build with GCC 11:
  * 0001-C-exception-specifications-are-deprecated-in-C-11.patch
- Spec cleanup</changelog>
</package>
<package pkgid="8e13a3d600197890cee1e63c672bc2dc359fb97e7a95479dd6dd4e0eebf5b0ef858b214a57e87b25fe85a77229c7d58fc5afb7f72dcde245f9f17cfc3cf1cef8" name="fwbuilder-debugsource" arch="s390x">
  <version epoch="0" ver="5.3.7" rel="60.104"/>
  <changelog author="chris@computersalat.de" date="1486382400">- split package
  * build fwbuilder-service independently from fwbuilder
  * update changes file</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1486468800">- Use the Source link
- Revert the source split as it's not prefered</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1486468801">- Removed the service files as they are not compatible with opensuse
  they will for instance break the network settings
  As the script generated by fwbuilders includes iptables rules
  as wel as network interface settings</changelog>
  <changelog author="jengelh@inai.de" date="1486555200">- Fix linguistic issues in description</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1486555201">- Removed item from change log that shouldn't have been
  allowed via request 450449 it's not allowed to change
  and sertianly not insert changes in the changes file</changelog>
  <changelog author="dimstar@opensuse.org" date="1512475200">- Replace openssl-devel BuildRequires with pkgconfig(openssl):
  allow OBS to fallback to openssl 1.0, since this tool links Qt4
  (which is known not to be compatible with openssl 1.1).</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1513080000">- Build using Qt5 in stead of Qt4</changelog>
  <changelog author="dimstar@opensuse.org" date="1517400000">- Add fwbuilder-qmake-without-flags.patch: Fix build in case qmake
  is started without QMAKE_CXXFLAGS being defined
  (gh#fwbuilder/fwbuilder#46).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1550145600">- Add fix-bsc1124647-segfault.patch: Fix crash described in bsc#1124647</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1622462400">- Add patch to fix build with GCC 11:
  * 0001-C-exception-specifications-are-deprecated-in-C-11.patch
- Spec cleanup</changelog>
</package>
<package pkgid="3a957da1856b4d1ccfb0dff56c19fdd410e616ebfee4e6865baf2dcd8c25f48a0807f0c5bde5f2359f0f004285a7987461cde5b862ba7f2b7354bbe20c5d7372" name="git-verify" arch="s390x">
  <version epoch="0" ver="0.0.0~git2.7b9ef1d" rel="2.48"/>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1667822400">- Initial version from commit c8529ec
  with uncommited spec and other files required for package</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1667908800">- Update to version 0.0.0~git1.2d99d6d:
  * fix missing quotes in Cargo.toml
  * Add CI</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1668513600">- Update to version 0.0.0~git2.7b9ef1d:
  * Fix verification failing for some certs</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1688040000">- Make whole package building automagically.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1691582400">- Make SPEC file building again.
- Remove replacing SPEC file from the usptream tarball.</changelog>
</package>
<package pkgid="d6a4ee5fa68bbaf52b5231af8fe5eb0bc5eae66762b0b448ce6adbb82fa5dd6be8f10930fb5382a0cda7e69a0a3cef7583fb7b89500fc4f8ed54b84306e6faa7" name="git-verify" arch="src">
  <version epoch="0" ver="0.0.0~git2.7b9ef1d" rel="2.48"/>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1667822400">- Initial version from commit c8529ec
  with uncommited spec and other files required for package</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1667908800">- Update to version 0.0.0~git1.2d99d6d:
  * fix missing quotes in Cargo.toml
  * Add CI</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1668513600">- Update to version 0.0.0~git2.7b9ef1d:
  * Fix verification failing for some certs</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1688040000">- Make whole package building automagically.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1691582400">- Make SPEC file building again.
- Remove replacing SPEC file from the usptream tarball.</changelog>
</package>
<package pkgid="55d9318674eba46451a66017553d348534d7a465e7693bf4b5bcc909e0516dd85781db80d19a147684a3c0cafff90fffcdc13d6ec7aafca5d855ef020c1fe9a8" name="git-verify-debuginfo" arch="s390x">
  <version epoch="0" ver="0.0.0~git2.7b9ef1d" rel="2.48"/>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1667822400">- Initial version from commit c8529ec
  with uncommited spec and other files required for package</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1667908800">- Update to version 0.0.0~git1.2d99d6d:
  * fix missing quotes in Cargo.toml
  * Add CI</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1668513600">- Update to version 0.0.0~git2.7b9ef1d:
  * Fix verification failing for some certs</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1688040000">- Make whole package building automagically.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1691582400">- Make SPEC file building again.
- Remove replacing SPEC file from the usptream tarball.</changelog>
</package>
<package pkgid="001aed670c8c72b4bf3ef32333fe9d39f3bf48fe13a07048ace532ab2282acfa79b065f2f57e76b5f39f3377eab6814f73294e4ee7f542a7adde56b6c851a16e" name="git-verify-debugsource" arch="s390x">
  <version epoch="0" ver="0.0.0~git2.7b9ef1d" rel="2.48"/>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1667822400">- Initial version from commit c8529ec
  with uncommited spec and other files required for package</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1667908800">- Update to version 0.0.0~git1.2d99d6d:
  * fix missing quotes in Cargo.toml
  * Add CI</changelog>
  <changelog author="jan.suse@zerebecki.de" date="1668513600">- Update to version 0.0.0~git2.7b9ef1d:
  * Fix verification failing for some certs</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1688040000">- Make whole package building automagically.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1691582400">- Make SPEC file building again.
- Remove replacing SPEC file from the usptream tarball.</changelog>
</package>
<package pkgid="24241a0a23b1342d10bdcf5f606dfa88786cf765470ad11f06d1479eaca3949f47d17192403a829b9012072c8c1657ed80e88535e07dbf3b7c1678e1ff76990e" name="go-away" arch="s390x">
  <version epoch="0" ver="0.7.0" rel="1.30"/>
  <changelog author="Mia Herkt &lt;mia@0x0.st&gt;" date="1746964800">- Initial package, v0.7.0</changelog>
</package>
<package pkgid="00709ad941ab2717dc08ee40671ee652341b429bbb008034c0a180247a0e42e5318c5b9b4da4d26c2f34ffeddd0ca36882ce0677b22b3f099065848f9c1a8709" name="go-away" arch="src">
  <version epoch="0" ver="0.7.0" rel="1.30"/>
  <changelog author="Mia Herkt &lt;mia@0x0.st&gt;" date="1746964800">- Initial package, v0.7.0</changelog>
</package>
<package pkgid="ebd493f35d7ec9ff509dccf8198e70c1b0419cbf3c1d5286959112c80a0e750ff7810da51d0e61501be2c7e3e806addb2af783c76587d06be8a766c32db7ee1b" name="go-away-debuginfo" arch="s390x">
  <version epoch="0" ver="0.7.0" rel="1.30"/>
  <changelog author="Mia Herkt &lt;mia@0x0.st&gt;" date="1746964800">- Initial package, v0.7.0</changelog>
</package>
<package pkgid="d9b8b6e23d27de6b741cd3e31c316071edc9085a747a39948f752a69db33d375496dd304f672054b23f97eaa253f8fd1932b07ca26b1b1b614aa074d0e1637db" name="google-authenticator-libpam" arch="s390x">
  <version epoch="0" ver="1.11" rel="31.2"/>
  <changelog author="dimstar@opensuse.org" date="1483963200">- Run the test suite (make test).</changelog>
  <changelog author="sfalken@opensuse.org" date="1489233600">- Explicitly package files installed by make install into _docdir:
  rpm 4.13 no longer implicitly packages those files.</changelog>
  <changelog author="Mathias Homann &lt;Mathias.Homann@opensuse.org&gt;" date="1557921600">- Update to version 1.06:
  * More reliable temp file handling (#76)
  * Various improved logging in case of failures
  * Codes are now confirmed as part of setup (#104)
  * Optional grace period (#127)
- Changes from version 1.05:
  * Fix info leak when using nullok
  * Improve error messages
- Changes from version 1.04:
  * Add man pages
  * Fix "CWE-778: Insufficient Logging".</changelog>
  <changelog author="rpm@fthiessen.de" date="1639051200">- Update to version 1.09:
  * Fixed typo preventing use of setfsgid() over setegid()
  * Fixed regression getting maximum getpwnam buf size
  * set umask before `mkstemp`
  * Add `allow_readonly` option
  * Minor linter-level changes that probably don't matter</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1644926400">- Properly install pam module to %_pam_moduledir instead of
  /lib64/security (boo#1191035).</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651060800">- added source url</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1721304000">- Recommend current qrencode version, instead of unavailable one
- Adapt to changing %_pam_moduledir on different distributions
- Update to version 1.10:
  * Remove printing QR code using Google Charts URL
  * Fix utc-time for new everything
  * set variable 'buffer' that in base32_decode to unsigned integer type
  * Slight improvement in error message formatting
  * Update config file with grace periods in all cases
  * Fix comment on open_secret_file()
  * Exit with code 1 only if build-rpm fails
  * Double check the config size
  * Add more logging for config updates
  * Shorten syslog name to work with rsyslog</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1721822400">- Migrate from tar_scm to obs_scm: be more storage efficient.
- Add tar service (buildtime) and change recompress from manual to
  buildtime: only generate tar.xz during build time to have valid
  .src.rpm.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1762862400">- Added
  * 267cbfa31bc17805c4850afd39788d97a7b5374c.patch
  * 2a1f725e83d3ffc11d229543c4c2980dffd637b9.patch
  * 6313ae4c2b475e1b73fd272434089cfc4631e14d.patch
  * 665012cf90acadac882db4738b21b7246965ee2a.patch
  * 75151df21a19e7182c09ae0118379fae890bdf5b.patch
  * a0b6cf1f022f987d21d3d9c597e9f7f9759968ba.patch
  to get proper SELinux type on secrets file (bsc#1252092)
  Already upstream via
  https://github.com/google/google-authenticator-libpam/pull/280
  can be dropped with the next release</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1785931200">- Update to version 1.11:
  * Change secret key bits to be 160 instead of 128 bits.
  * Add support for black &amp; white terminals (#268 / #270).
  * Fix `grace_period` for IPv6 link-local addresses (#265).
  * Fix potential memory leaks and malloc failure logging.
- Clean up spec file using spec-cleaner:
  * Use %make_build, %make_install, and modern
    %make_build test macros.
  * Convert libselinux-devel to pkgconfig(libselinux).
  * Remove redundant BuildRoot and %defattr tags.</changelog>
</package>
<package pkgid="79ffe4ee6fc2b64826a56d2adbbc1d7488eef2de68063c1f4bd958092f002059e86a279244bb264b0db8e570ebbe2f3f3b7085c806ca946c56c53c4c40dfad92" name="google-authenticator-libpam" arch="src">
  <version epoch="0" ver="1.11" rel="31.2"/>
  <changelog author="dimstar@opensuse.org" date="1483963200">- Initial package, version 1.03.</changelog>
  <changelog author="dimstar@opensuse.org" date="1483963201">- Recommend libqrencode3: the library is dynamically loaded if
  found in order to print qr codes (easier setup).</changelog>
  <changelog author="dimstar@opensuse.org" date="1483963202">- Run the test suite (make test).</changelog>
  <changelog author="sfalken@opensuse.org" date="1489233600">- Explicitly package files installed by make install into _docdir:
  rpm 4.13 no longer implicitly packages those files.</changelog>
  <changelog author="Mathias Homann &lt;Mathias.Homann@opensuse.org&gt;" date="1557921600">- Update to version 1.06:
  * More reliable temp file handling (#76)
  * Various improved logging in case of failures
  * Codes are now confirmed as part of setup (#104)
  * Optional grace period (#127)
- Changes from version 1.05:
  * Fix info leak when using nullok
  * Improve error messages
- Changes from version 1.04:
  * Add man pages
  * Fix "CWE-778: Insufficient Logging".</changelog>
  <changelog author="rpm@fthiessen.de" date="1639051200">- Update to version 1.09:
  * Fixed typo preventing use of setfsgid() over setegid()
  * Fixed regression getting maximum getpwnam buf size
  * set umask before `mkstemp`
  * Add `allow_readonly` option
  * Minor linter-level changes that probably don't matter</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1644926400">- Properly install pam module to %_pam_moduledir instead of
  /lib64/security (boo#1191035).</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651060800">- added source url</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1721304000">- Recommend current qrencode version, instead of unavailable one
- Adapt to changing %_pam_moduledir on different distributions
- Update to version 1.10:
  * Remove printing QR code using Google Charts URL
  * Fix utc-time for new everything
  * set variable 'buffer' that in base32_decode to unsigned integer type
  * Slight improvement in error message formatting
  * Update config file with grace periods in all cases
  * Fix comment on open_secret_file()
  * Exit with code 1 only if build-rpm fails
  * Double check the config size
  * Add more logging for config updates
  * Shorten syslog name to work with rsyslog</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1721822400">- Migrate from tar_scm to obs_scm: be more storage efficient.
- Add tar service (buildtime) and change recompress from manual to
  buildtime: only generate tar.xz during build time to have valid
  .src.rpm.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1762862400">- Added
  * 267cbfa31bc17805c4850afd39788d97a7b5374c.patch
  * 2a1f725e83d3ffc11d229543c4c2980dffd637b9.patch
  * 6313ae4c2b475e1b73fd272434089cfc4631e14d.patch
  * 665012cf90acadac882db4738b21b7246965ee2a.patch
  * 75151df21a19e7182c09ae0118379fae890bdf5b.patch
  * a0b6cf1f022f987d21d3d9c597e9f7f9759968ba.patch
  to get proper SELinux type on secrets file (bsc#1252092)
  Already upstream via
  https://github.com/google/google-authenticator-libpam/pull/280
  can be dropped with the next release</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1785931200">- Update to version 1.11:
  * Change secret key bits to be 160 instead of 128 bits.
  * Add support for black &amp; white terminals (#268 / #270).
  * Fix `grace_period` for IPv6 link-local addresses (#265).
  * Fix potential memory leaks and malloc failure logging.
- Clean up spec file using spec-cleaner:
  * Use %make_build, %make_install, and modern
    %make_build test macros.
  * Convert libselinux-devel to pkgconfig(libselinux).
  * Remove redundant BuildRoot and %defattr tags.</changelog>
</package>
<package pkgid="6f6b0417a45831b365e51cfc9e6591e500831b64e69ad8fe898f9cc5946492165028f1a298af69f754c1da277403f5278e3ced48bd6d7ec5effd01eeaee75622" name="google-authenticator-libpam-debuginfo" arch="s390x">
  <version epoch="0" ver="1.11" rel="31.2"/>
  <changelog author="dimstar@opensuse.org" date="1483963200">- Run the test suite (make test).</changelog>
  <changelog author="sfalken@opensuse.org" date="1489233600">- Explicitly package files installed by make install into _docdir:
  rpm 4.13 no longer implicitly packages those files.</changelog>
  <changelog author="Mathias Homann &lt;Mathias.Homann@opensuse.org&gt;" date="1557921600">- Update to version 1.06:
  * More reliable temp file handling (#76)
  * Various improved logging in case of failures
  * Codes are now confirmed as part of setup (#104)
  * Optional grace period (#127)
- Changes from version 1.05:
  * Fix info leak when using nullok
  * Improve error messages
- Changes from version 1.04:
  * Add man pages
  * Fix "CWE-778: Insufficient Logging".</changelog>
  <changelog author="rpm@fthiessen.de" date="1639051200">- Update to version 1.09:
  * Fixed typo preventing use of setfsgid() over setegid()
  * Fixed regression getting maximum getpwnam buf size
  * set umask before `mkstemp`
  * Add `allow_readonly` option
  * Minor linter-level changes that probably don't matter</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1644926400">- Properly install pam module to %_pam_moduledir instead of
  /lib64/security (boo#1191035).</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651060800">- added source url</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1721304000">- Recommend current qrencode version, instead of unavailable one
- Adapt to changing %_pam_moduledir on different distributions
- Update to version 1.10:
  * Remove printing QR code using Google Charts URL
  * Fix utc-time for new everything
  * set variable 'buffer' that in base32_decode to unsigned integer type
  * Slight improvement in error message formatting
  * Update config file with grace periods in all cases
  * Fix comment on open_secret_file()
  * Exit with code 1 only if build-rpm fails
  * Double check the config size
  * Add more logging for config updates
  * Shorten syslog name to work with rsyslog</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1721822400">- Migrate from tar_scm to obs_scm: be more storage efficient.
- Add tar service (buildtime) and change recompress from manual to
  buildtime: only generate tar.xz during build time to have valid
  .src.rpm.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1762862400">- Added
  * 267cbfa31bc17805c4850afd39788d97a7b5374c.patch
  * 2a1f725e83d3ffc11d229543c4c2980dffd637b9.patch
  * 6313ae4c2b475e1b73fd272434089cfc4631e14d.patch
  * 665012cf90acadac882db4738b21b7246965ee2a.patch
  * 75151df21a19e7182c09ae0118379fae890bdf5b.patch
  * a0b6cf1f022f987d21d3d9c597e9f7f9759968ba.patch
  to get proper SELinux type on secrets file (bsc#1252092)
  Already upstream via
  https://github.com/google/google-authenticator-libpam/pull/280
  can be dropped with the next release</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1785931200">- Update to version 1.11:
  * Change secret key bits to be 160 instead of 128 bits.
  * Add support for black &amp; white terminals (#268 / #270).
  * Fix `grace_period` for IPv6 link-local addresses (#265).
  * Fix potential memory leaks and malloc failure logging.
- Clean up spec file using spec-cleaner:
  * Use %make_build, %make_install, and modern
    %make_build test macros.
  * Convert libselinux-devel to pkgconfig(libselinux).
  * Remove redundant BuildRoot and %defattr tags.</changelog>
</package>
<package pkgid="0b36662a244607920f46ecf854cc974351c748bbea749a853168a69bf553d5e0b3821c8d2c7be98c6ff2cd1823eba4469e5c273913fcdbfece173f480603a934" name="google-authenticator-libpam-debugsource" arch="s390x">
  <version epoch="0" ver="1.11" rel="31.2"/>
  <changelog author="dimstar@opensuse.org" date="1483963200">- Run the test suite (make test).</changelog>
  <changelog author="sfalken@opensuse.org" date="1489233600">- Explicitly package files installed by make install into _docdir:
  rpm 4.13 no longer implicitly packages those files.</changelog>
  <changelog author="Mathias Homann &lt;Mathias.Homann@opensuse.org&gt;" date="1557921600">- Update to version 1.06:
  * More reliable temp file handling (#76)
  * Various improved logging in case of failures
  * Codes are now confirmed as part of setup (#104)
  * Optional grace period (#127)
- Changes from version 1.05:
  * Fix info leak when using nullok
  * Improve error messages
- Changes from version 1.04:
  * Add man pages
  * Fix "CWE-778: Insufficient Logging".</changelog>
  <changelog author="rpm@fthiessen.de" date="1639051200">- Update to version 1.09:
  * Fixed typo preventing use of setfsgid() over setegid()
  * Fixed regression getting maximum getpwnam buf size
  * set umask before `mkstemp`
  * Add `allow_readonly` option
  * Minor linter-level changes that probably don't matter</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1644926400">- Properly install pam module to %_pam_moduledir instead of
  /lib64/security (boo#1191035).</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651060800">- added source url</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1721304000">- Recommend current qrencode version, instead of unavailable one
- Adapt to changing %_pam_moduledir on different distributions
- Update to version 1.10:
  * Remove printing QR code using Google Charts URL
  * Fix utc-time for new everything
  * set variable 'buffer' that in base32_decode to unsigned integer type
  * Slight improvement in error message formatting
  * Update config file with grace periods in all cases
  * Fix comment on open_secret_file()
  * Exit with code 1 only if build-rpm fails
  * Double check the config size
  * Add more logging for config updates
  * Shorten syslog name to work with rsyslog</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1721822400">- Migrate from tar_scm to obs_scm: be more storage efficient.
- Add tar service (buildtime) and change recompress from manual to
  buildtime: only generate tar.xz during build time to have valid
  .src.rpm.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1762862400">- Added
  * 267cbfa31bc17805c4850afd39788d97a7b5374c.patch
  * 2a1f725e83d3ffc11d229543c4c2980dffd637b9.patch
  * 6313ae4c2b475e1b73fd272434089cfc4631e14d.patch
  * 665012cf90acadac882db4738b21b7246965ee2a.patch
  * 75151df21a19e7182c09ae0118379fae890bdf5b.patch
  * a0b6cf1f022f987d21d3d9c597e9f7f9759968ba.patch
  to get proper SELinux type on secrets file (bsc#1252092)
  Already upstream via
  https://github.com/google/google-authenticator-libpam/pull/280
  can be dropped with the next release</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1785931200">- Update to version 1.11:
  * Change secret key bits to be 160 instead of 128 bits.
  * Add support for black &amp; white terminals (#268 / #270).
  * Fix `grace_period` for IPv6 link-local addresses (#265).
  * Fix potential memory leaks and malloc failure logging.
- Clean up spec file using spec-cleaner:
  * Use %make_build, %make_install, and modern
    %make_build test macros.
  * Convert libselinux-devel to pkgconfig(libselinux).
  * Remove redundant BuildRoot and %defattr tags.</changelog>
</package>
<package pkgid="6c7e440c239f35bdffdf42c27b85fb1de24a3c4d7899aa653ad41a0ea5308c06fe2a30ea78afdac46362c18bacddd7d9de1e2be69b519911530c5e545bd6da6f" name="grant" arch="s390x">
  <version epoch="0" ver="0.6.8" rel="52.5"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758196800">- Update to version 0.3.2:
  * fix: globs were not being parsed correctly from config (#274)
  * feat: add OSI warning text (#273)
  * feat: add coloring to risk output (#272)
  * fix: update grant so it can consume it's own json as source &amp;&amp;
    stdin (#271)
  * chore: generate demo via taskfile `make demo` (#270)
  * docs: vhs gif (#269)
  * docs: modify license settings and enhance README clarity (#267)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- Update to version 0.3.3:
  * Bug Fixes
  - "grant --version" and "grant version" report different
    versions [#277 #278 @popey]
  * Additional Changes
  - bump cosign version [#287 @spiffcs]
  - cosign flag update for release [#286 @spiffcs]
  - actions: Grant validations [#275 @spiffcs]
  * Dependencies
  - chore(deps): update anchore dependencies (#283)
  - chore(deps): bump golang.org/x/term from 0.35.0 to 0.36.0
    (#280)
  - chore(deps): bump modernc.org/sqlite from 1.39.0 to 1.39.1
    (#282)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702401">- Update to version 0.3.4:
  * Bug Fixes
  - pull in syft 1.34.2 to fix panic in jar cataloger [#288
    @anchore-actions-token-generator]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761307200">- Update to version 0.4.0:
  * Added Features
  - upgrade Syft to pull in pnpm and pdm license detection
    improvements [#290 @anchore-actions-token-generator]
  * Dependencies
  - chore(deps): update anchore dependencies (#290)
  - chore(deps): bump github.com/github/go-spdx/v2 from 2.3.3 to
    2.3.4 (#289)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762257600">- Update to version 0.5.0:
  * Added Features
  - Add a supported docker image [#222 #279 @wagoodman]
  * Dependencies
  - chore(deps): bump github.com/anchore/syft from 1.36.0 to
    1.37.0 (#298)
  - chore(deps): bump actions/setup-go from 5.0.0 to 6.0.0 (#302)
  - chore(deps): bump actions/checkout from 4.1.1 to 5.0.0 (#303)
  - chore(deps): bump peter-evans/create-pull-request from 7.0.5
    to 7.0.8 (#301)
  - chore(deps): bump zizmorcore/zizmor-action from 0.1.1 to
    0.2.0 (#300)
  - chore(deps): bump github/codeql-action from 3.23.2 to 4.31.2
    (#299)
  - chore(deps): bump github.com/anchore/stereoscope from 0.1.11
    to 0.1.12 (#297)
  - chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#296)
  - chore(deps): update tools to latest versions (#294)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.8
    to 6.6.9 (#291)
  - chore(deps): bump modernc.org/sqlite from 1.39.1 to 1.40.0
    (#292)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- Update to version 0.5.1:
  * fix: add case handler for panic (#309)
  * chore(deps): update anchore dependencies (#316)
  * chore(deps): update tools to latest versions (#312)
  * chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0
    (#313)
  * chore(deps): bump docker/login-action from 3.5.0 to 3.6.0
    (#304)
  * chore(deps): bump github.com/opencontainers/selinux (#311)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.9 to
    6.7.1 (#310)
  * chore(deps): update tools to latest versions (#305)
  * chore(deps): bump github.com/containerd/containerd from 1.7.28
    to 1.7.29 (#308)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 0.5.2:
  * chore(deps): update anchore dependencies (#339)
  * chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7
    (#336)
  * chore(deps): update tools to latest versions (#335)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.9 to
    7.0.11 (#337)
  * chore(deps): bump actions/create-github-app-token from 2.2.0 to
    2.2.1 (#338)
  * chore(deps): update tools to latest versions (#332)
  * chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2
    (#333)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.4 to
    2.3.5 (#334)
  * chore(deps): update tools to latest versions (#314)
  * chore(deps): bump modernc.org/sqlite from 1.40.0 to 1.40.1
    (#317)
  * chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0
    (#321)
  * chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#322)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#323)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.2 to
    6.7.5 (#324)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.8 to
    7.0.9 (#326)
  * chore(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.3.0
    (#328)
  * chore(deps): bump actions/create-github-app-token from 2.1.4 to
    2.2.0 (#329)
  * chore(deps): bump github/codeql-action from 4.31.2 to 4.31.6
    (#330)
  * chore(deps): bump actions/checkout from 5.0.0 to 6.0.1 (#331)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 0.5.3:
  * chore(deps): bump github.com/anchore/syft from 1.38.2 to 1.39.0
    (#356)
  * chore(deps): update tools to latest versions (#355)
  * chore(deps): update tools to latest versions (#352)
  * chore(deps): bump modernc.org/sqlite from 1.40.1 to 1.41.0
    (#353)
  * signpost to docs site (#351)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.5 to
    6.7.7 (#344)
  * chore(deps): bump github.com/anchore/stereoscope from 0.1.14 to
    0.1.16 (#346)
  * chore(deps): update tools to latest versions (#340)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.11
    to 8.0.0 (#345)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#349)
  * chore(deps): bump github/codeql-action from 4.31.7 to 4.31.9
    (#350)
  * chore(deps): update anchore dependencies (#341)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132801">- Update to version 0.5.4:
  * chore(deps): update anchore dependencies (#360)
  * chore(deps): update tools to latest versions (#358)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.7 to
    6.7.8 (#357)
  * chore(deps): bump modernc.org/sqlite from 1.41.0 to 1.42.2
    (#359)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768564800">- Update to version 0.5.5:
  * chore(deps): update anchore dependencies (#375)
  * chore(deps): update tools to latest versions (#374)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#370)
  * chore(deps): bump actions/setup-go from 6.1.0 to 6.2.0 (#371)
  * chore(deps): bump modernc.org/sqlite from 1.43.0 to 1.44.0
    (#372)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.5 to
    2.3.6 (#373)
  * chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0
    (#368)
  * chore(deps): bump github/codeql-action from 4.31.9 to 4.31.10
    (#369)
  * chore(deps): update tools to latest versions (#367)
  * chore(deps): update tools to latest versions (#365)
  * chore(deps): bump modernc.org/sqlite from 1.42.2 to 1.43.0
    (#366)
  * ci: slack notify team of new grant release (#364)
  * chore(deps): update tools to latest versions (#361)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769601600">- Update to version 0.5.6:
  * chore(deps): update anchore dependencies (#386)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#384)
  * chore(deps): bump modernc.org/sqlite from 1.44.1 to 1.44.2
    (#383)
  * chore(deps): bump zizmorcore/zizmor-action from 0.3.0 to 0.4.1
    (#385)
  * chore(deps): update tools to latest versions (#382)
  * chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#381)
  * chore(deps): update tools to latest versions (#380)
  * chore(deps): update tools to latest versions (#377)
  * chore(deps): bump modernc.org/sqlite from 1.44.0 to 1.44.1
    (#378)
  * ci: configure zizmor to fail PRs, address lints (#379)
  * chore: switch to official slack action (#376)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769774400">- Update to version 0.5.7:
  * chore(deps): update anchore dependencies (#391)
  * chore(deps): bump peter-evans/create-pull-request from 8.0.0 to
    8.1.0 (#390)
  * chore(deps): update tools to latest versions (#388)
  * chore(deps): bump modernc.org/sqlite from 1.44.2 to 1.44.3
    (#389)
  * chore(deps): update tools to latest versions (#387)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770206400">- Update to version 0.5.8:
  * chore(deps): update anchore dependencies (#393)
  * chore(deps): update tools to latest versions (#392)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770811200">- Update to version 0.6.0:
  * Added Features
  - bug: Support new opensource.org license URLs [#208]
  * Bug Fixes
  - skip dir symlinks in grant license search [#399 @spiffcs]
  - bug: "[0090] ERROR unable to classify license: unable to
    read" on symlinkx [#70]
  - bug: [0000] ERROR unable to determine case for -: unable to
    determine SBOM or licenses for stdin: sbom format not
    recognized [#215 #397 @spiffcs]
  * Dependencies
  - chore(deps): update anchore dependencies (#403)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to
    5.16.5 (#402)
  - chore(deps): bump zizmorcore/zizmor-action from 0.4.1 to
    0.5.0 (#400)
  - chore(deps): update tools to latest versions (#395)
  - chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#396)
  - chore(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#394)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1771502400">- Update to version 0.6.2 (.1 was not released):
  * fix: add --provenance=false for build flags (#410)
  * chore(deps): update anchore dependencies (#409)
  * chore: bump to go 1.25.7 (#408)
  * chore(deps): update tools to latest versions (#404)
  * chore(deps): bump modernc.org/sqlite from 1.44.3 to 1.45.0
    (#405)
  * chore(deps): bump golang.org/x/term from 0.39.0 to 0.40.0
    (#406)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773144000">- Update to version 0.6.3:
  * chore(deps): update anchore dependencies (#424)
  * chore(deps): update tools to latest versions (#423)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#421)
  * chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 (#422)
  * chore(deps): update tools to latest versions (#415)
  * chore(deps): bump github.com/cloudflare/circl from 1.6.1 to
    1.6.3 (#417)
  * chore(deps): bump modernc.org/sqlite from 1.45.0 to 1.46.1
    (#418)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.6 to
    2.4.0 (#419)
  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0 (#420)
  * chore(deps): update tools to latest versions (#414)
  * chore(deps): update tools to latest versions (#407)
  * chore(deps): bump github/codeql-action from 4.31.10 to 4.32.3
    (#413)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774008000">- Update to version 0.6.4:
  * chore(deps): update anchore dependencies (#433)
  * chore(deps): bump google.golang.org/grpc from 1.76.0 to 1.79.3
    (#432)
  * chore(deps): update tools to latest versions (#426)
  * chore(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#428)
  * chore(deps): bump github/codeql-action from 4.32.3 to 4.32.6
    (#429)
  * chore(deps): bump golang.org/x/term from 0.40.0 to 0.41.0
    (#431)
  * chore(deps): update tools to latest versions (#425)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780574400">- Update to version 0.6.6 (.5 was not released):
  * update to dockers_v2 for goreleaser (#519)
  * chore(deps): update anchore dependencies (#513)
  * Pass 'contents: read' to check-gate workflow (#516)
  * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#514)
  * chore(deps): update anchore dependencies (#505)
  * chore(deps): bump the go-minor-patch group across 1 directory
    with 2 updates (#512)
  * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#511)
  * chore(deps): bump github.com/containerd/containerd/v2 (#510)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 (#509)
  * chore(deps): bump golang.org/x/term (#507)
  * remove release notification (#508)
  * Port to go-make (#506)
  * chore(deps): update anchore dependencies (#503)
  * chore(deps): update anchore dependencies (#485)
  * chore(deps): update tool versions (#495)
  * use released shared workflow (#502)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.0 (#501)
  * chore(deps): bump github.com/gookit/color from 1.6.0 to 1.6.1
    (#499)
  * Tighten workflow permissions, update release shape, and fix
    dependabot config (#498)
  * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3
    (#496)
  * chore(deps): bump slackapi/slack-github-action from 3.0.2 to
    3.0.3 (#497)
  * chore(deps): update tool versions (#493)
  * chore(deps): bump github.com/anchore/syft (#494)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.4.0 to
    2.6.0 (#486)
  * chore(deps): bump modernc.org/sqlite from 1.48.2 to 1.50.0
    (#491)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.9 to
    6.7.10 (#489)
  * chore(deps): bump slackapi/slack-github-action from 3.0.1 to
    3.0.2 (#490)
  * chore: remove common workflows (#492)
  * chore(deps): update tool versions (#488)
  * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2
    (#484)
  * chore(deps): update anchore dependencies (#480)
  * chore(deps): update tool versions (#482)
  * restore go minimum version to 1.25.8 (#481)
  * chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3
    (#478)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#479)
  * chore(deps): bump modernc.org/sqlite from 1.48.1 to 1.48.2
    (#472)
  * chore(deps): update anchore dependencies (#469)
  * chore(deps): update tool versions (#470)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to
    5.18.0 (#477)
  * chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0
    (#476)
  * chore(deps): update tools to latest versions (#451)
  * chore(deps): update tool versions (#452)
  * chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1
    (#459)
  * chore(deps): update Go version (#468)
  * chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4 (#457)
  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to
    1.43.0 (#463)
  * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
    (#462)
  * chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to
    1.8.6 (#467)
  * chore(deps): bump modernc.org/sqlite from 1.47.0 to 1.48.1
    (#465)
  * chore(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#466)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to
    6.7.9 (#464)
  * chore(deps): bump
    github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (#461)
  * chore: update zizmor workflow triggers (#456)
  * chore: add security-events write permission for zizmor (#455)
  * (chore): removing automations (#453)
  * chore(deps): update tools to latest versions (#445)
  * chore(deps): update anchore dependencies (#447)
  * chore(deps): update tool versions (#444)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to
    5.17.1 (#450)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#448)
  * chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#449)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#442)
  * chore(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0
    (#441)
  * chore(deps): pin certain go dependencies (#438)
  * fix: --dry-run status code correction (#398)
  * chore(deps): update tools to latest versions (#434)
  * chore(deps): bump slackapi/slack-github-action from 2.1.1 to
    3.0.1 (#435)
  * chore(deps): bump actions/create-github-app-token from 2.2.1 to
    3.0.0 (#436)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780920000">- Update to version 0.6.7:
  * chore(deps): update anchore dependencies (#518)
  * chore(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.1.0 (#520)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1783598400">- Update to version 0.6.8:
  * bug: non zero exit code when no denied packages reported based
    on policies [Issue #454] [PR #517 @arpitjain099]
  * chore(deps): bump
    anchore/workflows/.github/workflows/check-version-available.yaml
    (#532)
  * chore(deps): bump
    anchore/workflows/.github/workflows/release-install-script.yaml
    (#536)
  * chore(deps): bump github.com/anchore/go-collections from 0.1.0
    to 0.1.1 (#542)
  * chore(deps): bump github.com/anchore/syft from 1.45.1 to 1.46.0
    (#537)
  * chore(deps): bump github.com/anchore/clio from 0.1.0 to 0.1.1
    (#539)
  * chore(deps): bump github.com/anchore/go-logger from 0.1.0 to
    0.1.1 (#540)
  * chore(deps): bump modernc.org/sqlite from 1.52.0 to 1.53.0
    (#541)
  * chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
    (#534)
  * chore(deps): bump
    anchore/workflows/.github/workflows/codeql.yaml (#533)
  * chore(deps): bump
    anchore/workflows/.github/workflows/check-gate.yaml (#531)</changelog>
</package>
<package pkgid="5720827c594229b91d9e3f07b7cf211c3cdffb87a45757beebd46372f193e2e0fa980206451b2f873ea68aba180858636079a2707b7e41ce947362d5d56dec17" name="grant" arch="src">
  <version epoch="0" ver="0.6.8" rel="52.5"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758196800">- Update to version 0.3.2:
  * fix: globs were not being parsed correctly from config (#274)
  * feat: add OSI warning text (#273)
  * feat: add coloring to risk output (#272)
  * fix: update grant so it can consume it's own json as source &amp;&amp;
    stdin (#271)
  * chore: generate demo via taskfile `make demo` (#270)
  * docs: vhs gif (#269)
  * docs: modify license settings and enhance README clarity (#267)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- Update to version 0.3.3:
  * Bug Fixes
  - "grant --version" and "grant version" report different
    versions [#277 #278 @popey]
  * Additional Changes
  - bump cosign version [#287 @spiffcs]
  - cosign flag update for release [#286 @spiffcs]
  - actions: Grant validations [#275 @spiffcs]
  * Dependencies
  - chore(deps): update anchore dependencies (#283)
  - chore(deps): bump golang.org/x/term from 0.35.0 to 0.36.0
    (#280)
  - chore(deps): bump modernc.org/sqlite from 1.39.0 to 1.39.1
    (#282)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702401">- Update to version 0.3.4:
  * Bug Fixes
  - pull in syft 1.34.2 to fix panic in jar cataloger [#288
    @anchore-actions-token-generator]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761307200">- Update to version 0.4.0:
  * Added Features
  - upgrade Syft to pull in pnpm and pdm license detection
    improvements [#290 @anchore-actions-token-generator]
  * Dependencies
  - chore(deps): update anchore dependencies (#290)
  - chore(deps): bump github.com/github/go-spdx/v2 from 2.3.3 to
    2.3.4 (#289)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762257600">- Update to version 0.5.0:
  * Added Features
  - Add a supported docker image [#222 #279 @wagoodman]
  * Dependencies
  - chore(deps): bump github.com/anchore/syft from 1.36.0 to
    1.37.0 (#298)
  - chore(deps): bump actions/setup-go from 5.0.0 to 6.0.0 (#302)
  - chore(deps): bump actions/checkout from 4.1.1 to 5.0.0 (#303)
  - chore(deps): bump peter-evans/create-pull-request from 7.0.5
    to 7.0.8 (#301)
  - chore(deps): bump zizmorcore/zizmor-action from 0.1.1 to
    0.2.0 (#300)
  - chore(deps): bump github/codeql-action from 3.23.2 to 4.31.2
    (#299)
  - chore(deps): bump github.com/anchore/stereoscope from 0.1.11
    to 0.1.12 (#297)
  - chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#296)
  - chore(deps): update tools to latest versions (#294)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.8
    to 6.6.9 (#291)
  - chore(deps): bump modernc.org/sqlite from 1.39.1 to 1.40.0
    (#292)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- Update to version 0.5.1:
  * fix: add case handler for panic (#309)
  * chore(deps): update anchore dependencies (#316)
  * chore(deps): update tools to latest versions (#312)
  * chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0
    (#313)
  * chore(deps): bump docker/login-action from 3.5.0 to 3.6.0
    (#304)
  * chore(deps): bump github.com/opencontainers/selinux (#311)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.9 to
    6.7.1 (#310)
  * chore(deps): update tools to latest versions (#305)
  * chore(deps): bump github.com/containerd/containerd from 1.7.28
    to 1.7.29 (#308)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 0.5.2:
  * chore(deps): update anchore dependencies (#339)
  * chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7
    (#336)
  * chore(deps): update tools to latest versions (#335)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.9 to
    7.0.11 (#337)
  * chore(deps): bump actions/create-github-app-token from 2.2.0 to
    2.2.1 (#338)
  * chore(deps): update tools to latest versions (#332)
  * chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2
    (#333)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.4 to
    2.3.5 (#334)
  * chore(deps): update tools to latest versions (#314)
  * chore(deps): bump modernc.org/sqlite from 1.40.0 to 1.40.1
    (#317)
  * chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0
    (#321)
  * chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#322)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#323)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.2 to
    6.7.5 (#324)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.8 to
    7.0.9 (#326)
  * chore(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.3.0
    (#328)
  * chore(deps): bump actions/create-github-app-token from 2.1.4 to
    2.2.0 (#329)
  * chore(deps): bump github/codeql-action from 4.31.2 to 4.31.6
    (#330)
  * chore(deps): bump actions/checkout from 5.0.0 to 6.0.1 (#331)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 0.5.3:
  * chore(deps): bump github.com/anchore/syft from 1.38.2 to 1.39.0
    (#356)
  * chore(deps): update tools to latest versions (#355)
  * chore(deps): update tools to latest versions (#352)
  * chore(deps): bump modernc.org/sqlite from 1.40.1 to 1.41.0
    (#353)
  * signpost to docs site (#351)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.5 to
    6.7.7 (#344)
  * chore(deps): bump github.com/anchore/stereoscope from 0.1.14 to
    0.1.16 (#346)
  * chore(deps): update tools to latest versions (#340)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.11
    to 8.0.0 (#345)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#349)
  * chore(deps): bump github/codeql-action from 4.31.7 to 4.31.9
    (#350)
  * chore(deps): update anchore dependencies (#341)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132801">- Update to version 0.5.4:
  * chore(deps): update anchore dependencies (#360)
  * chore(deps): update tools to latest versions (#358)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.7 to
    6.7.8 (#357)
  * chore(deps): bump modernc.org/sqlite from 1.41.0 to 1.42.2
    (#359)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768564800">- Update to version 0.5.5:
  * chore(deps): update anchore dependencies (#375)
  * chore(deps): update tools to latest versions (#374)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#370)
  * chore(deps): bump actions/setup-go from 6.1.0 to 6.2.0 (#371)
  * chore(deps): bump modernc.org/sqlite from 1.43.0 to 1.44.0
    (#372)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.5 to
    2.3.6 (#373)
  * chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0
    (#368)
  * chore(deps): bump github/codeql-action from 4.31.9 to 4.31.10
    (#369)
  * chore(deps): update tools to latest versions (#367)
  * chore(deps): update tools to latest versions (#365)
  * chore(deps): bump modernc.org/sqlite from 1.42.2 to 1.43.0
    (#366)
  * ci: slack notify team of new grant release (#364)
  * chore(deps): update tools to latest versions (#361)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769601600">- Update to version 0.5.6:
  * chore(deps): update anchore dependencies (#386)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#384)
  * chore(deps): bump modernc.org/sqlite from 1.44.1 to 1.44.2
    (#383)
  * chore(deps): bump zizmorcore/zizmor-action from 0.3.0 to 0.4.1
    (#385)
  * chore(deps): update tools to latest versions (#382)
  * chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#381)
  * chore(deps): update tools to latest versions (#380)
  * chore(deps): update tools to latest versions (#377)
  * chore(deps): bump modernc.org/sqlite from 1.44.0 to 1.44.1
    (#378)
  * ci: configure zizmor to fail PRs, address lints (#379)
  * chore: switch to official slack action (#376)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769774400">- Update to version 0.5.7:
  * chore(deps): update anchore dependencies (#391)
  * chore(deps): bump peter-evans/create-pull-request from 8.0.0 to
    8.1.0 (#390)
  * chore(deps): update tools to latest versions (#388)
  * chore(deps): bump modernc.org/sqlite from 1.44.2 to 1.44.3
    (#389)
  * chore(deps): update tools to latest versions (#387)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770206400">- Update to version 0.5.8:
  * chore(deps): update anchore dependencies (#393)
  * chore(deps): update tools to latest versions (#392)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770811200">- Update to version 0.6.0:
  * Added Features
  - bug: Support new opensource.org license URLs [#208]
  * Bug Fixes
  - skip dir symlinks in grant license search [#399 @spiffcs]
  - bug: "[0090] ERROR unable to classify license: unable to
    read" on symlinkx [#70]
  - bug: [0000] ERROR unable to determine case for -: unable to
    determine SBOM or licenses for stdin: sbom format not
    recognized [#215 #397 @spiffcs]
  * Dependencies
  - chore(deps): update anchore dependencies (#403)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to
    5.16.5 (#402)
  - chore(deps): bump zizmorcore/zizmor-action from 0.4.1 to
    0.5.0 (#400)
  - chore(deps): update tools to latest versions (#395)
  - chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#396)
  - chore(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#394)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1771502400">- Update to version 0.6.2 (.1 was not released):
  * fix: add --provenance=false for build flags (#410)
  * chore(deps): update anchore dependencies (#409)
  * chore: bump to go 1.25.7 (#408)
  * chore(deps): update tools to latest versions (#404)
  * chore(deps): bump modernc.org/sqlite from 1.44.3 to 1.45.0
    (#405)
  * chore(deps): bump golang.org/x/term from 0.39.0 to 0.40.0
    (#406)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773144000">- Update to version 0.6.3:
  * chore(deps): update anchore dependencies (#424)
  * chore(deps): update tools to latest versions (#423)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#421)
  * chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 (#422)
  * chore(deps): update tools to latest versions (#415)
  * chore(deps): bump github.com/cloudflare/circl from 1.6.1 to
    1.6.3 (#417)
  * chore(deps): bump modernc.org/sqlite from 1.45.0 to 1.46.1
    (#418)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.6 to
    2.4.0 (#419)
  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0 (#420)
  * chore(deps): update tools to latest versions (#414)
  * chore(deps): update tools to latest versions (#407)
  * chore(deps): bump github/codeql-action from 4.31.10 to 4.32.3
    (#413)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774008000">- Update to version 0.6.4:
  * chore(deps): update anchore dependencies (#433)
  * chore(deps): bump google.golang.org/grpc from 1.76.0 to 1.79.3
    (#432)
  * chore(deps): update tools to latest versions (#426)
  * chore(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#428)
  * chore(deps): bump github/codeql-action from 4.32.3 to 4.32.6
    (#429)
  * chore(deps): bump golang.org/x/term from 0.40.0 to 0.41.0
    (#431)
  * chore(deps): update tools to latest versions (#425)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780574400">- Update to version 0.6.6 (.5 was not released):
  * update to dockers_v2 for goreleaser (#519)
  * chore(deps): update anchore dependencies (#513)
  * Pass 'contents: read' to check-gate workflow (#516)
  * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#514)
  * chore(deps): update anchore dependencies (#505)
  * chore(deps): bump the go-minor-patch group across 1 directory
    with 2 updates (#512)
  * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#511)
  * chore(deps): bump github.com/containerd/containerd/v2 (#510)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 (#509)
  * chore(deps): bump golang.org/x/term (#507)
  * remove release notification (#508)
  * Port to go-make (#506)
  * chore(deps): update anchore dependencies (#503)
  * chore(deps): update anchore dependencies (#485)
  * chore(deps): update tool versions (#495)
  * use released shared workflow (#502)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.0 (#501)
  * chore(deps): bump github.com/gookit/color from 1.6.0 to 1.6.1
    (#499)
  * Tighten workflow permissions, update release shape, and fix
    dependabot config (#498)
  * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3
    (#496)
  * chore(deps): bump slackapi/slack-github-action from 3.0.2 to
    3.0.3 (#497)
  * chore(deps): update tool versions (#493)
  * chore(deps): bump github.com/anchore/syft (#494)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.4.0 to
    2.6.0 (#486)
  * chore(deps): bump modernc.org/sqlite from 1.48.2 to 1.50.0
    (#491)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.9 to
    6.7.10 (#489)
  * chore(deps): bump slackapi/slack-github-action from 3.0.1 to
    3.0.2 (#490)
  * chore: remove common workflows (#492)
  * chore(deps): update tool versions (#488)
  * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2
    (#484)
  * chore(deps): update anchore dependencies (#480)
  * chore(deps): update tool versions (#482)
  * restore go minimum version to 1.25.8 (#481)
  * chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3
    (#478)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#479)
  * chore(deps): bump modernc.org/sqlite from 1.48.1 to 1.48.2
    (#472)
  * chore(deps): update anchore dependencies (#469)
  * chore(deps): update tool versions (#470)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to
    5.18.0 (#477)
  * chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0
    (#476)
  * chore(deps): update tools to latest versions (#451)
  * chore(deps): update tool versions (#452)
  * chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1
    (#459)
  * chore(deps): update Go version (#468)
  * chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4 (#457)
  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to
    1.43.0 (#463)
  * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
    (#462)
  * chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to
    1.8.6 (#467)
  * chore(deps): bump modernc.org/sqlite from 1.47.0 to 1.48.1
    (#465)
  * chore(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#466)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to
    6.7.9 (#464)
  * chore(deps): bump
    github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (#461)
  * chore: update zizmor workflow triggers (#456)
  * chore: add security-events write permission for zizmor (#455)
  * (chore): removing automations (#453)
  * chore(deps): update tools to latest versions (#445)
  * chore(deps): update anchore dependencies (#447)
  * chore(deps): update tool versions (#444)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to
    5.17.1 (#450)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#448)
  * chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#449)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#442)
  * chore(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0
    (#441)
  * chore(deps): pin certain go dependencies (#438)
  * fix: --dry-run status code correction (#398)
  * chore(deps): update tools to latest versions (#434)
  * chore(deps): bump slackapi/slack-github-action from 2.1.1 to
    3.0.1 (#435)
  * chore(deps): bump actions/create-github-app-token from 2.2.1 to
    3.0.0 (#436)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780920000">- Update to version 0.6.7:
  * chore(deps): update anchore dependencies (#518)
  * chore(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.1.0 (#520)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1783598400">- Update to version 0.6.8:
  * bug: non zero exit code when no denied packages reported based
    on policies [Issue #454] [PR #517 @arpitjain099]
  * chore(deps): bump
    anchore/workflows/.github/workflows/check-version-available.yaml
    (#532)
  * chore(deps): bump
    anchore/workflows/.github/workflows/release-install-script.yaml
    (#536)
  * chore(deps): bump github.com/anchore/go-collections from 0.1.0
    to 0.1.1 (#542)
  * chore(deps): bump github.com/anchore/syft from 1.45.1 to 1.46.0
    (#537)
  * chore(deps): bump github.com/anchore/clio from 0.1.0 to 0.1.1
    (#539)
  * chore(deps): bump github.com/anchore/go-logger from 0.1.0 to
    0.1.1 (#540)
  * chore(deps): bump modernc.org/sqlite from 1.52.0 to 1.53.0
    (#541)
  * chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
    (#534)
  * chore(deps): bump
    anchore/workflows/.github/workflows/codeql.yaml (#533)
  * chore(deps): bump
    anchore/workflows/.github/workflows/check-gate.yaml (#531)</changelog>
</package>
<package pkgid="de0359c16da251084f5c5a4abfdbba4423a3a25044a7d2e94ba53b698a629eafc13316f24d2abf449afd322940144efede0abafe7347082964f6439ec4e7b6f0" name="grant-bash-completion" arch="noarch">
  <version epoch="0" ver="0.6.8" rel="52.5"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758196800">- Update to version 0.3.2:
  * fix: globs were not being parsed correctly from config (#274)
  * feat: add OSI warning text (#273)
  * feat: add coloring to risk output (#272)
  * fix: update grant so it can consume it's own json as source &amp;&amp;
    stdin (#271)
  * chore: generate demo via taskfile `make demo` (#270)
  * docs: vhs gif (#269)
  * docs: modify license settings and enhance README clarity (#267)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- Update to version 0.3.3:
  * Bug Fixes
  - "grant --version" and "grant version" report different
    versions [#277 #278 @popey]
  * Additional Changes
  - bump cosign version [#287 @spiffcs]
  - cosign flag update for release [#286 @spiffcs]
  - actions: Grant validations [#275 @spiffcs]
  * Dependencies
  - chore(deps): update anchore dependencies (#283)
  - chore(deps): bump golang.org/x/term from 0.35.0 to 0.36.0
    (#280)
  - chore(deps): bump modernc.org/sqlite from 1.39.0 to 1.39.1
    (#282)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702401">- Update to version 0.3.4:
  * Bug Fixes
  - pull in syft 1.34.2 to fix panic in jar cataloger [#288
    @anchore-actions-token-generator]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761307200">- Update to version 0.4.0:
  * Added Features
  - upgrade Syft to pull in pnpm and pdm license detection
    improvements [#290 @anchore-actions-token-generator]
  * Dependencies
  - chore(deps): update anchore dependencies (#290)
  - chore(deps): bump github.com/github/go-spdx/v2 from 2.3.3 to
    2.3.4 (#289)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762257600">- Update to version 0.5.0:
  * Added Features
  - Add a supported docker image [#222 #279 @wagoodman]
  * Dependencies
  - chore(deps): bump github.com/anchore/syft from 1.36.0 to
    1.37.0 (#298)
  - chore(deps): bump actions/setup-go from 5.0.0 to 6.0.0 (#302)
  - chore(deps): bump actions/checkout from 4.1.1 to 5.0.0 (#303)
  - chore(deps): bump peter-evans/create-pull-request from 7.0.5
    to 7.0.8 (#301)
  - chore(deps): bump zizmorcore/zizmor-action from 0.1.1 to
    0.2.0 (#300)
  - chore(deps): bump github/codeql-action from 3.23.2 to 4.31.2
    (#299)
  - chore(deps): bump github.com/anchore/stereoscope from 0.1.11
    to 0.1.12 (#297)
  - chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#296)
  - chore(deps): update tools to latest versions (#294)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.8
    to 6.6.9 (#291)
  - chore(deps): bump modernc.org/sqlite from 1.39.1 to 1.40.0
    (#292)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- Update to version 0.5.1:
  * fix: add case handler for panic (#309)
  * chore(deps): update anchore dependencies (#316)
  * chore(deps): update tools to latest versions (#312)
  * chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0
    (#313)
  * chore(deps): bump docker/login-action from 3.5.0 to 3.6.0
    (#304)
  * chore(deps): bump github.com/opencontainers/selinux (#311)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.9 to
    6.7.1 (#310)
  * chore(deps): update tools to latest versions (#305)
  * chore(deps): bump github.com/containerd/containerd from 1.7.28
    to 1.7.29 (#308)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 0.5.2:
  * chore(deps): update anchore dependencies (#339)
  * chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7
    (#336)
  * chore(deps): update tools to latest versions (#335)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.9 to
    7.0.11 (#337)
  * chore(deps): bump actions/create-github-app-token from 2.2.0 to
    2.2.1 (#338)
  * chore(deps): update tools to latest versions (#332)
  * chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2
    (#333)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.4 to
    2.3.5 (#334)
  * chore(deps): update tools to latest versions (#314)
  * chore(deps): bump modernc.org/sqlite from 1.40.0 to 1.40.1
    (#317)
  * chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0
    (#321)
  * chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#322)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#323)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.2 to
    6.7.5 (#324)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.8 to
    7.0.9 (#326)
  * chore(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.3.0
    (#328)
  * chore(deps): bump actions/create-github-app-token from 2.1.4 to
    2.2.0 (#329)
  * chore(deps): bump github/codeql-action from 4.31.2 to 4.31.6
    (#330)
  * chore(deps): bump actions/checkout from 5.0.0 to 6.0.1 (#331)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 0.5.3:
  * chore(deps): bump github.com/anchore/syft from 1.38.2 to 1.39.0
    (#356)
  * chore(deps): update tools to latest versions (#355)
  * chore(deps): update tools to latest versions (#352)
  * chore(deps): bump modernc.org/sqlite from 1.40.1 to 1.41.0
    (#353)
  * signpost to docs site (#351)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.5 to
    6.7.7 (#344)
  * chore(deps): bump github.com/anchore/stereoscope from 0.1.14 to
    0.1.16 (#346)
  * chore(deps): update tools to latest versions (#340)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.11
    to 8.0.0 (#345)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#349)
  * chore(deps): bump github/codeql-action from 4.31.7 to 4.31.9
    (#350)
  * chore(deps): update anchore dependencies (#341)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132801">- Update to version 0.5.4:
  * chore(deps): update anchore dependencies (#360)
  * chore(deps): update tools to latest versions (#358)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.7 to
    6.7.8 (#357)
  * chore(deps): bump modernc.org/sqlite from 1.41.0 to 1.42.2
    (#359)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768564800">- Update to version 0.5.5:
  * chore(deps): update anchore dependencies (#375)
  * chore(deps): update tools to latest versions (#374)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#370)
  * chore(deps): bump actions/setup-go from 6.1.0 to 6.2.0 (#371)
  * chore(deps): bump modernc.org/sqlite from 1.43.0 to 1.44.0
    (#372)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.5 to
    2.3.6 (#373)
  * chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0
    (#368)
  * chore(deps): bump github/codeql-action from 4.31.9 to 4.31.10
    (#369)
  * chore(deps): update tools to latest versions (#367)
  * chore(deps): update tools to latest versions (#365)
  * chore(deps): bump modernc.org/sqlite from 1.42.2 to 1.43.0
    (#366)
  * ci: slack notify team of new grant release (#364)
  * chore(deps): update tools to latest versions (#361)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769601600">- Update to version 0.5.6:
  * chore(deps): update anchore dependencies (#386)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#384)
  * chore(deps): bump modernc.org/sqlite from 1.44.1 to 1.44.2
    (#383)
  * chore(deps): bump zizmorcore/zizmor-action from 0.3.0 to 0.4.1
    (#385)
  * chore(deps): update tools to latest versions (#382)
  * chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#381)
  * chore(deps): update tools to latest versions (#380)
  * chore(deps): update tools to latest versions (#377)
  * chore(deps): bump modernc.org/sqlite from 1.44.0 to 1.44.1
    (#378)
  * ci: configure zizmor to fail PRs, address lints (#379)
  * chore: switch to official slack action (#376)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769774400">- Update to version 0.5.7:
  * chore(deps): update anchore dependencies (#391)
  * chore(deps): bump peter-evans/create-pull-request from 8.0.0 to
    8.1.0 (#390)
  * chore(deps): update tools to latest versions (#388)
  * chore(deps): bump modernc.org/sqlite from 1.44.2 to 1.44.3
    (#389)
  * chore(deps): update tools to latest versions (#387)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770206400">- Update to version 0.5.8:
  * chore(deps): update anchore dependencies (#393)
  * chore(deps): update tools to latest versions (#392)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770811200">- Update to version 0.6.0:
  * Added Features
  - bug: Support new opensource.org license URLs [#208]
  * Bug Fixes
  - skip dir symlinks in grant license search [#399 @spiffcs]
  - bug: "[0090] ERROR unable to classify license: unable to
    read" on symlinkx [#70]
  - bug: [0000] ERROR unable to determine case for -: unable to
    determine SBOM or licenses for stdin: sbom format not
    recognized [#215 #397 @spiffcs]
  * Dependencies
  - chore(deps): update anchore dependencies (#403)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to
    5.16.5 (#402)
  - chore(deps): bump zizmorcore/zizmor-action from 0.4.1 to
    0.5.0 (#400)
  - chore(deps): update tools to latest versions (#395)
  - chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#396)
  - chore(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#394)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1771502400">- Update to version 0.6.2 (.1 was not released):
  * fix: add --provenance=false for build flags (#410)
  * chore(deps): update anchore dependencies (#409)
  * chore: bump to go 1.25.7 (#408)
  * chore(deps): update tools to latest versions (#404)
  * chore(deps): bump modernc.org/sqlite from 1.44.3 to 1.45.0
    (#405)
  * chore(deps): bump golang.org/x/term from 0.39.0 to 0.40.0
    (#406)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773144000">- Update to version 0.6.3:
  * chore(deps): update anchore dependencies (#424)
  * chore(deps): update tools to latest versions (#423)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#421)
  * chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 (#422)
  * chore(deps): update tools to latest versions (#415)
  * chore(deps): bump github.com/cloudflare/circl from 1.6.1 to
    1.6.3 (#417)
  * chore(deps): bump modernc.org/sqlite from 1.45.0 to 1.46.1
    (#418)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.6 to
    2.4.0 (#419)
  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0 (#420)
  * chore(deps): update tools to latest versions (#414)
  * chore(deps): update tools to latest versions (#407)
  * chore(deps): bump github/codeql-action from 4.31.10 to 4.32.3
    (#413)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774008000">- Update to version 0.6.4:
  * chore(deps): update anchore dependencies (#433)
  * chore(deps): bump google.golang.org/grpc from 1.76.0 to 1.79.3
    (#432)
  * chore(deps): update tools to latest versions (#426)
  * chore(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#428)
  * chore(deps): bump github/codeql-action from 4.32.3 to 4.32.6
    (#429)
  * chore(deps): bump golang.org/x/term from 0.40.0 to 0.41.0
    (#431)
  * chore(deps): update tools to latest versions (#425)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780574400">- Update to version 0.6.6 (.5 was not released):
  * update to dockers_v2 for goreleaser (#519)
  * chore(deps): update anchore dependencies (#513)
  * Pass 'contents: read' to check-gate workflow (#516)
  * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#514)
  * chore(deps): update anchore dependencies (#505)
  * chore(deps): bump the go-minor-patch group across 1 directory
    with 2 updates (#512)
  * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#511)
  * chore(deps): bump github.com/containerd/containerd/v2 (#510)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 (#509)
  * chore(deps): bump golang.org/x/term (#507)
  * remove release notification (#508)
  * Port to go-make (#506)
  * chore(deps): update anchore dependencies (#503)
  * chore(deps): update anchore dependencies (#485)
  * chore(deps): update tool versions (#495)
  * use released shared workflow (#502)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.0 (#501)
  * chore(deps): bump github.com/gookit/color from 1.6.0 to 1.6.1
    (#499)
  * Tighten workflow permissions, update release shape, and fix
    dependabot config (#498)
  * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3
    (#496)
  * chore(deps): bump slackapi/slack-github-action from 3.0.2 to
    3.0.3 (#497)
  * chore(deps): update tool versions (#493)
  * chore(deps): bump github.com/anchore/syft (#494)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.4.0 to
    2.6.0 (#486)
  * chore(deps): bump modernc.org/sqlite from 1.48.2 to 1.50.0
    (#491)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.9 to
    6.7.10 (#489)
  * chore(deps): bump slackapi/slack-github-action from 3.0.1 to
    3.0.2 (#490)
  * chore: remove common workflows (#492)
  * chore(deps): update tool versions (#488)
  * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2
    (#484)
  * chore(deps): update anchore dependencies (#480)
  * chore(deps): update tool versions (#482)
  * restore go minimum version to 1.25.8 (#481)
  * chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3
    (#478)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#479)
  * chore(deps): bump modernc.org/sqlite from 1.48.1 to 1.48.2
    (#472)
  * chore(deps): update anchore dependencies (#469)
  * chore(deps): update tool versions (#470)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to
    5.18.0 (#477)
  * chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0
    (#476)
  * chore(deps): update tools to latest versions (#451)
  * chore(deps): update tool versions (#452)
  * chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1
    (#459)
  * chore(deps): update Go version (#468)
  * chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4 (#457)
  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to
    1.43.0 (#463)
  * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
    (#462)
  * chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to
    1.8.6 (#467)
  * chore(deps): bump modernc.org/sqlite from 1.47.0 to 1.48.1
    (#465)
  * chore(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#466)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to
    6.7.9 (#464)
  * chore(deps): bump
    github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (#461)
  * chore: update zizmor workflow triggers (#456)
  * chore: add security-events write permission for zizmor (#455)
  * (chore): removing automations (#453)
  * chore(deps): update tools to latest versions (#445)
  * chore(deps): update anchore dependencies (#447)
  * chore(deps): update tool versions (#444)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to
    5.17.1 (#450)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#448)
  * chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#449)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#442)
  * chore(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0
    (#441)
  * chore(deps): pin certain go dependencies (#438)
  * fix: --dry-run status code correction (#398)
  * chore(deps): update tools to latest versions (#434)
  * chore(deps): bump slackapi/slack-github-action from 2.1.1 to
    3.0.1 (#435)
  * chore(deps): bump actions/create-github-app-token from 2.2.1 to
    3.0.0 (#436)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780920000">- Update to version 0.6.7:
  * chore(deps): update anchore dependencies (#518)
  * chore(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.1.0 (#520)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1783598400">- Update to version 0.6.8:
  * bug: non zero exit code when no denied packages reported based
    on policies [Issue #454] [PR #517 @arpitjain099]
  * chore(deps): bump
    anchore/workflows/.github/workflows/check-version-available.yaml
    (#532)
  * chore(deps): bump
    anchore/workflows/.github/workflows/release-install-script.yaml
    (#536)
  * chore(deps): bump github.com/anchore/go-collections from 0.1.0
    to 0.1.1 (#542)
  * chore(deps): bump github.com/anchore/syft from 1.45.1 to 1.46.0
    (#537)
  * chore(deps): bump github.com/anchore/clio from 0.1.0 to 0.1.1
    (#539)
  * chore(deps): bump github.com/anchore/go-logger from 0.1.0 to
    0.1.1 (#540)
  * chore(deps): bump modernc.org/sqlite from 1.52.0 to 1.53.0
    (#541)
  * chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
    (#534)
  * chore(deps): bump
    anchore/workflows/.github/workflows/codeql.yaml (#533)
  * chore(deps): bump
    anchore/workflows/.github/workflows/check-gate.yaml (#531)</changelog>
</package>
<package pkgid="9653f689698340fd972fc35de4e908e7fd0d337688ed5ecbd3e349ca2cd65a50a4786eb49dcbf85e88526a2c9fe81e748df9a018ef1d1817fbce897ed3671a08" name="grant-debuginfo" arch="s390x">
  <version epoch="0" ver="0.6.8" rel="52.5"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758196800">- Update to version 0.3.2:
  * fix: globs were not being parsed correctly from config (#274)
  * feat: add OSI warning text (#273)
  * feat: add coloring to risk output (#272)
  * fix: update grant so it can consume it's own json as source &amp;&amp;
    stdin (#271)
  * chore: generate demo via taskfile `make demo` (#270)
  * docs: vhs gif (#269)
  * docs: modify license settings and enhance README clarity (#267)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- Update to version 0.3.3:
  * Bug Fixes
  - "grant --version" and "grant version" report different
    versions [#277 #278 @popey]
  * Additional Changes
  - bump cosign version [#287 @spiffcs]
  - cosign flag update for release [#286 @spiffcs]
  - actions: Grant validations [#275 @spiffcs]
  * Dependencies
  - chore(deps): update anchore dependencies (#283)
  - chore(deps): bump golang.org/x/term from 0.35.0 to 0.36.0
    (#280)
  - chore(deps): bump modernc.org/sqlite from 1.39.0 to 1.39.1
    (#282)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702401">- Update to version 0.3.4:
  * Bug Fixes
  - pull in syft 1.34.2 to fix panic in jar cataloger [#288
    @anchore-actions-token-generator]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761307200">- Update to version 0.4.0:
  * Added Features
  - upgrade Syft to pull in pnpm and pdm license detection
    improvements [#290 @anchore-actions-token-generator]
  * Dependencies
  - chore(deps): update anchore dependencies (#290)
  - chore(deps): bump github.com/github/go-spdx/v2 from 2.3.3 to
    2.3.4 (#289)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762257600">- Update to version 0.5.0:
  * Added Features
  - Add a supported docker image [#222 #279 @wagoodman]
  * Dependencies
  - chore(deps): bump github.com/anchore/syft from 1.36.0 to
    1.37.0 (#298)
  - chore(deps): bump actions/setup-go from 5.0.0 to 6.0.0 (#302)
  - chore(deps): bump actions/checkout from 4.1.1 to 5.0.0 (#303)
  - chore(deps): bump peter-evans/create-pull-request from 7.0.5
    to 7.0.8 (#301)
  - chore(deps): bump zizmorcore/zizmor-action from 0.1.1 to
    0.2.0 (#300)
  - chore(deps): bump github/codeql-action from 3.23.2 to 4.31.2
    (#299)
  - chore(deps): bump github.com/anchore/stereoscope from 0.1.11
    to 0.1.12 (#297)
  - chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#296)
  - chore(deps): update tools to latest versions (#294)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.8
    to 6.6.9 (#291)
  - chore(deps): bump modernc.org/sqlite from 1.39.1 to 1.40.0
    (#292)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- Update to version 0.5.1:
  * fix: add case handler for panic (#309)
  * chore(deps): update anchore dependencies (#316)
  * chore(deps): update tools to latest versions (#312)
  * chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0
    (#313)
  * chore(deps): bump docker/login-action from 3.5.0 to 3.6.0
    (#304)
  * chore(deps): bump github.com/opencontainers/selinux (#311)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.9 to
    6.7.1 (#310)
  * chore(deps): update tools to latest versions (#305)
  * chore(deps): bump github.com/containerd/containerd from 1.7.28
    to 1.7.29 (#308)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 0.5.2:
  * chore(deps): update anchore dependencies (#339)
  * chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7
    (#336)
  * chore(deps): update tools to latest versions (#335)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.9 to
    7.0.11 (#337)
  * chore(deps): bump actions/create-github-app-token from 2.2.0 to
    2.2.1 (#338)
  * chore(deps): update tools to latest versions (#332)
  * chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2
    (#333)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.4 to
    2.3.5 (#334)
  * chore(deps): update tools to latest versions (#314)
  * chore(deps): bump modernc.org/sqlite from 1.40.0 to 1.40.1
    (#317)
  * chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0
    (#321)
  * chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#322)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#323)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.2 to
    6.7.5 (#324)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.8 to
    7.0.9 (#326)
  * chore(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.3.0
    (#328)
  * chore(deps): bump actions/create-github-app-token from 2.1.4 to
    2.2.0 (#329)
  * chore(deps): bump github/codeql-action from 4.31.2 to 4.31.6
    (#330)
  * chore(deps): bump actions/checkout from 5.0.0 to 6.0.1 (#331)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 0.5.3:
  * chore(deps): bump github.com/anchore/syft from 1.38.2 to 1.39.0
    (#356)
  * chore(deps): update tools to latest versions (#355)
  * chore(deps): update tools to latest versions (#352)
  * chore(deps): bump modernc.org/sqlite from 1.40.1 to 1.41.0
    (#353)
  * signpost to docs site (#351)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.5 to
    6.7.7 (#344)
  * chore(deps): bump github.com/anchore/stereoscope from 0.1.14 to
    0.1.16 (#346)
  * chore(deps): update tools to latest versions (#340)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.11
    to 8.0.0 (#345)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#349)
  * chore(deps): bump github/codeql-action from 4.31.7 to 4.31.9
    (#350)
  * chore(deps): update anchore dependencies (#341)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132801">- Update to version 0.5.4:
  * chore(deps): update anchore dependencies (#360)
  * chore(deps): update tools to latest versions (#358)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.7 to
    6.7.8 (#357)
  * chore(deps): bump modernc.org/sqlite from 1.41.0 to 1.42.2
    (#359)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768564800">- Update to version 0.5.5:
  * chore(deps): update anchore dependencies (#375)
  * chore(deps): update tools to latest versions (#374)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#370)
  * chore(deps): bump actions/setup-go from 6.1.0 to 6.2.0 (#371)
  * chore(deps): bump modernc.org/sqlite from 1.43.0 to 1.44.0
    (#372)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.5 to
    2.3.6 (#373)
  * chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0
    (#368)
  * chore(deps): bump github/codeql-action from 4.31.9 to 4.31.10
    (#369)
  * chore(deps): update tools to latest versions (#367)
  * chore(deps): update tools to latest versions (#365)
  * chore(deps): bump modernc.org/sqlite from 1.42.2 to 1.43.0
    (#366)
  * ci: slack notify team of new grant release (#364)
  * chore(deps): update tools to latest versions (#361)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769601600">- Update to version 0.5.6:
  * chore(deps): update anchore dependencies (#386)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#384)
  * chore(deps): bump modernc.org/sqlite from 1.44.1 to 1.44.2
    (#383)
  * chore(deps): bump zizmorcore/zizmor-action from 0.3.0 to 0.4.1
    (#385)
  * chore(deps): update tools to latest versions (#382)
  * chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#381)
  * chore(deps): update tools to latest versions (#380)
  * chore(deps): update tools to latest versions (#377)
  * chore(deps): bump modernc.org/sqlite from 1.44.0 to 1.44.1
    (#378)
  * ci: configure zizmor to fail PRs, address lints (#379)
  * chore: switch to official slack action (#376)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769774400">- Update to version 0.5.7:
  * chore(deps): update anchore dependencies (#391)
  * chore(deps): bump peter-evans/create-pull-request from 8.0.0 to
    8.1.0 (#390)
  * chore(deps): update tools to latest versions (#388)
  * chore(deps): bump modernc.org/sqlite from 1.44.2 to 1.44.3
    (#389)
  * chore(deps): update tools to latest versions (#387)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770206400">- Update to version 0.5.8:
  * chore(deps): update anchore dependencies (#393)
  * chore(deps): update tools to latest versions (#392)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770811200">- Update to version 0.6.0:
  * Added Features
  - bug: Support new opensource.org license URLs [#208]
  * Bug Fixes
  - skip dir symlinks in grant license search [#399 @spiffcs]
  - bug: "[0090] ERROR unable to classify license: unable to
    read" on symlinkx [#70]
  - bug: [0000] ERROR unable to determine case for -: unable to
    determine SBOM or licenses for stdin: sbom format not
    recognized [#215 #397 @spiffcs]
  * Dependencies
  - chore(deps): update anchore dependencies (#403)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to
    5.16.5 (#402)
  - chore(deps): bump zizmorcore/zizmor-action from 0.4.1 to
    0.5.0 (#400)
  - chore(deps): update tools to latest versions (#395)
  - chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#396)
  - chore(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#394)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1771502400">- Update to version 0.6.2 (.1 was not released):
  * fix: add --provenance=false for build flags (#410)
  * chore(deps): update anchore dependencies (#409)
  * chore: bump to go 1.25.7 (#408)
  * chore(deps): update tools to latest versions (#404)
  * chore(deps): bump modernc.org/sqlite from 1.44.3 to 1.45.0
    (#405)
  * chore(deps): bump golang.org/x/term from 0.39.0 to 0.40.0
    (#406)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773144000">- Update to version 0.6.3:
  * chore(deps): update anchore dependencies (#424)
  * chore(deps): update tools to latest versions (#423)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#421)
  * chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 (#422)
  * chore(deps): update tools to latest versions (#415)
  * chore(deps): bump github.com/cloudflare/circl from 1.6.1 to
    1.6.3 (#417)
  * chore(deps): bump modernc.org/sqlite from 1.45.0 to 1.46.1
    (#418)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.6 to
    2.4.0 (#419)
  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0 (#420)
  * chore(deps): update tools to latest versions (#414)
  * chore(deps): update tools to latest versions (#407)
  * chore(deps): bump github/codeql-action from 4.31.10 to 4.32.3
    (#413)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774008000">- Update to version 0.6.4:
  * chore(deps): update anchore dependencies (#433)
  * chore(deps): bump google.golang.org/grpc from 1.76.0 to 1.79.3
    (#432)
  * chore(deps): update tools to latest versions (#426)
  * chore(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#428)
  * chore(deps): bump github/codeql-action from 4.32.3 to 4.32.6
    (#429)
  * chore(deps): bump golang.org/x/term from 0.40.0 to 0.41.0
    (#431)
  * chore(deps): update tools to latest versions (#425)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780574400">- Update to version 0.6.6 (.5 was not released):
  * update to dockers_v2 for goreleaser (#519)
  * chore(deps): update anchore dependencies (#513)
  * Pass 'contents: read' to check-gate workflow (#516)
  * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#514)
  * chore(deps): update anchore dependencies (#505)
  * chore(deps): bump the go-minor-patch group across 1 directory
    with 2 updates (#512)
  * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#511)
  * chore(deps): bump github.com/containerd/containerd/v2 (#510)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 (#509)
  * chore(deps): bump golang.org/x/term (#507)
  * remove release notification (#508)
  * Port to go-make (#506)
  * chore(deps): update anchore dependencies (#503)
  * chore(deps): update anchore dependencies (#485)
  * chore(deps): update tool versions (#495)
  * use released shared workflow (#502)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.0 (#501)
  * chore(deps): bump github.com/gookit/color from 1.6.0 to 1.6.1
    (#499)
  * Tighten workflow permissions, update release shape, and fix
    dependabot config (#498)
  * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3
    (#496)
  * chore(deps): bump slackapi/slack-github-action from 3.0.2 to
    3.0.3 (#497)
  * chore(deps): update tool versions (#493)
  * chore(deps): bump github.com/anchore/syft (#494)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.4.0 to
    2.6.0 (#486)
  * chore(deps): bump modernc.org/sqlite from 1.48.2 to 1.50.0
    (#491)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.9 to
    6.7.10 (#489)
  * chore(deps): bump slackapi/slack-github-action from 3.0.1 to
    3.0.2 (#490)
  * chore: remove common workflows (#492)
  * chore(deps): update tool versions (#488)
  * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2
    (#484)
  * chore(deps): update anchore dependencies (#480)
  * chore(deps): update tool versions (#482)
  * restore go minimum version to 1.25.8 (#481)
  * chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3
    (#478)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#479)
  * chore(deps): bump modernc.org/sqlite from 1.48.1 to 1.48.2
    (#472)
  * chore(deps): update anchore dependencies (#469)
  * chore(deps): update tool versions (#470)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to
    5.18.0 (#477)
  * chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0
    (#476)
  * chore(deps): update tools to latest versions (#451)
  * chore(deps): update tool versions (#452)
  * chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1
    (#459)
  * chore(deps): update Go version (#468)
  * chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4 (#457)
  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to
    1.43.0 (#463)
  * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
    (#462)
  * chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to
    1.8.6 (#467)
  * chore(deps): bump modernc.org/sqlite from 1.47.0 to 1.48.1
    (#465)
  * chore(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#466)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to
    6.7.9 (#464)
  * chore(deps): bump
    github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (#461)
  * chore: update zizmor workflow triggers (#456)
  * chore: add security-events write permission for zizmor (#455)
  * (chore): removing automations (#453)
  * chore(deps): update tools to latest versions (#445)
  * chore(deps): update anchore dependencies (#447)
  * chore(deps): update tool versions (#444)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to
    5.17.1 (#450)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#448)
  * chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#449)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#442)
  * chore(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0
    (#441)
  * chore(deps): pin certain go dependencies (#438)
  * fix: --dry-run status code correction (#398)
  * chore(deps): update tools to latest versions (#434)
  * chore(deps): bump slackapi/slack-github-action from 2.1.1 to
    3.0.1 (#435)
  * chore(deps): bump actions/create-github-app-token from 2.2.1 to
    3.0.0 (#436)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780920000">- Update to version 0.6.7:
  * chore(deps): update anchore dependencies (#518)
  * chore(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.1.0 (#520)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1783598400">- Update to version 0.6.8:
  * bug: non zero exit code when no denied packages reported based
    on policies [Issue #454] [PR #517 @arpitjain099]
  * chore(deps): bump
    anchore/workflows/.github/workflows/check-version-available.yaml
    (#532)
  * chore(deps): bump
    anchore/workflows/.github/workflows/release-install-script.yaml
    (#536)
  * chore(deps): bump github.com/anchore/go-collections from 0.1.0
    to 0.1.1 (#542)
  * chore(deps): bump github.com/anchore/syft from 1.45.1 to 1.46.0
    (#537)
  * chore(deps): bump github.com/anchore/clio from 0.1.0 to 0.1.1
    (#539)
  * chore(deps): bump github.com/anchore/go-logger from 0.1.0 to
    0.1.1 (#540)
  * chore(deps): bump modernc.org/sqlite from 1.52.0 to 1.53.0
    (#541)
  * chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
    (#534)
  * chore(deps): bump
    anchore/workflows/.github/workflows/codeql.yaml (#533)
  * chore(deps): bump
    anchore/workflows/.github/workflows/check-gate.yaml (#531)</changelog>
</package>
<package pkgid="14ce524e4545ae167bbf79092c70b804d3774167848906e952be8b9df33d45e8a6dc9fe222ce6b2a1f4f9f08afa0d10a588493663c1c62165b9b6f220262993d" name="grant-debugsource" arch="s390x">
  <version epoch="0" ver="0.6.8" rel="52.5"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758196800">- Update to version 0.3.2:
  * fix: globs were not being parsed correctly from config (#274)
  * feat: add OSI warning text (#273)
  * feat: add coloring to risk output (#272)
  * fix: update grant so it can consume it's own json as source &amp;&amp;
    stdin (#271)
  * chore: generate demo via taskfile `make demo` (#270)
  * docs: vhs gif (#269)
  * docs: modify license settings and enhance README clarity (#267)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- Update to version 0.3.3:
  * Bug Fixes
  - "grant --version" and "grant version" report different
    versions [#277 #278 @popey]
  * Additional Changes
  - bump cosign version [#287 @spiffcs]
  - cosign flag update for release [#286 @spiffcs]
  - actions: Grant validations [#275 @spiffcs]
  * Dependencies
  - chore(deps): update anchore dependencies (#283)
  - chore(deps): bump golang.org/x/term from 0.35.0 to 0.36.0
    (#280)
  - chore(deps): bump modernc.org/sqlite from 1.39.0 to 1.39.1
    (#282)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702401">- Update to version 0.3.4:
  * Bug Fixes
  - pull in syft 1.34.2 to fix panic in jar cataloger [#288
    @anchore-actions-token-generator]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761307200">- Update to version 0.4.0:
  * Added Features
  - upgrade Syft to pull in pnpm and pdm license detection
    improvements [#290 @anchore-actions-token-generator]
  * Dependencies
  - chore(deps): update anchore dependencies (#290)
  - chore(deps): bump github.com/github/go-spdx/v2 from 2.3.3 to
    2.3.4 (#289)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762257600">- Update to version 0.5.0:
  * Added Features
  - Add a supported docker image [#222 #279 @wagoodman]
  * Dependencies
  - chore(deps): bump github.com/anchore/syft from 1.36.0 to
    1.37.0 (#298)
  - chore(deps): bump actions/setup-go from 5.0.0 to 6.0.0 (#302)
  - chore(deps): bump actions/checkout from 4.1.1 to 5.0.0 (#303)
  - chore(deps): bump peter-evans/create-pull-request from 7.0.5
    to 7.0.8 (#301)
  - chore(deps): bump zizmorcore/zizmor-action from 0.1.1 to
    0.2.0 (#300)
  - chore(deps): bump github/codeql-action from 3.23.2 to 4.31.2
    (#299)
  - chore(deps): bump github.com/anchore/stereoscope from 0.1.11
    to 0.1.12 (#297)
  - chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#296)
  - chore(deps): update tools to latest versions (#294)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.8
    to 6.6.9 (#291)
  - chore(deps): bump modernc.org/sqlite from 1.39.1 to 1.40.0
    (#292)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- Update to version 0.5.1:
  * fix: add case handler for panic (#309)
  * chore(deps): update anchore dependencies (#316)
  * chore(deps): update tools to latest versions (#312)
  * chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0
    (#313)
  * chore(deps): bump docker/login-action from 3.5.0 to 3.6.0
    (#304)
  * chore(deps): bump github.com/opencontainers/selinux (#311)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.9 to
    6.7.1 (#310)
  * chore(deps): update tools to latest versions (#305)
  * chore(deps): bump github.com/containerd/containerd from 1.7.28
    to 1.7.29 (#308)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 0.5.2:
  * chore(deps): update anchore dependencies (#339)
  * chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7
    (#336)
  * chore(deps): update tools to latest versions (#335)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.9 to
    7.0.11 (#337)
  * chore(deps): bump actions/create-github-app-token from 2.2.0 to
    2.2.1 (#338)
  * chore(deps): update tools to latest versions (#332)
  * chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2
    (#333)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.4 to
    2.3.5 (#334)
  * chore(deps): update tools to latest versions (#314)
  * chore(deps): bump modernc.org/sqlite from 1.40.0 to 1.40.1
    (#317)
  * chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0
    (#321)
  * chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#322)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#323)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.2 to
    6.7.5 (#324)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.8 to
    7.0.9 (#326)
  * chore(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.3.0
    (#328)
  * chore(deps): bump actions/create-github-app-token from 2.1.4 to
    2.2.0 (#329)
  * chore(deps): bump github/codeql-action from 4.31.2 to 4.31.6
    (#330)
  * chore(deps): bump actions/checkout from 5.0.0 to 6.0.1 (#331)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 0.5.3:
  * chore(deps): bump github.com/anchore/syft from 1.38.2 to 1.39.0
    (#356)
  * chore(deps): update tools to latest versions (#355)
  * chore(deps): update tools to latest versions (#352)
  * chore(deps): bump modernc.org/sqlite from 1.40.1 to 1.41.0
    (#353)
  * signpost to docs site (#351)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.5 to
    6.7.7 (#344)
  * chore(deps): bump github.com/anchore/stereoscope from 0.1.14 to
    0.1.16 (#346)
  * chore(deps): update tools to latest versions (#340)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.11
    to 8.0.0 (#345)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#349)
  * chore(deps): bump github/codeql-action from 4.31.7 to 4.31.9
    (#350)
  * chore(deps): update anchore dependencies (#341)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132801">- Update to version 0.5.4:
  * chore(deps): update anchore dependencies (#360)
  * chore(deps): update tools to latest versions (#358)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.7 to
    6.7.8 (#357)
  * chore(deps): bump modernc.org/sqlite from 1.41.0 to 1.42.2
    (#359)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768564800">- Update to version 0.5.5:
  * chore(deps): update anchore dependencies (#375)
  * chore(deps): update tools to latest versions (#374)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#370)
  * chore(deps): bump actions/setup-go from 6.1.0 to 6.2.0 (#371)
  * chore(deps): bump modernc.org/sqlite from 1.43.0 to 1.44.0
    (#372)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.5 to
    2.3.6 (#373)
  * chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0
    (#368)
  * chore(deps): bump github/codeql-action from 4.31.9 to 4.31.10
    (#369)
  * chore(deps): update tools to latest versions (#367)
  * chore(deps): update tools to latest versions (#365)
  * chore(deps): bump modernc.org/sqlite from 1.42.2 to 1.43.0
    (#366)
  * ci: slack notify team of new grant release (#364)
  * chore(deps): update tools to latest versions (#361)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769601600">- Update to version 0.5.6:
  * chore(deps): update anchore dependencies (#386)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#384)
  * chore(deps): bump modernc.org/sqlite from 1.44.1 to 1.44.2
    (#383)
  * chore(deps): bump zizmorcore/zizmor-action from 0.3.0 to 0.4.1
    (#385)
  * chore(deps): update tools to latest versions (#382)
  * chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#381)
  * chore(deps): update tools to latest versions (#380)
  * chore(deps): update tools to latest versions (#377)
  * chore(deps): bump modernc.org/sqlite from 1.44.0 to 1.44.1
    (#378)
  * ci: configure zizmor to fail PRs, address lints (#379)
  * chore: switch to official slack action (#376)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769774400">- Update to version 0.5.7:
  * chore(deps): update anchore dependencies (#391)
  * chore(deps): bump peter-evans/create-pull-request from 8.0.0 to
    8.1.0 (#390)
  * chore(deps): update tools to latest versions (#388)
  * chore(deps): bump modernc.org/sqlite from 1.44.2 to 1.44.3
    (#389)
  * chore(deps): update tools to latest versions (#387)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770206400">- Update to version 0.5.8:
  * chore(deps): update anchore dependencies (#393)
  * chore(deps): update tools to latest versions (#392)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770811200">- Update to version 0.6.0:
  * Added Features
  - bug: Support new opensource.org license URLs [#208]
  * Bug Fixes
  - skip dir symlinks in grant license search [#399 @spiffcs]
  - bug: "[0090] ERROR unable to classify license: unable to
    read" on symlinkx [#70]
  - bug: [0000] ERROR unable to determine case for -: unable to
    determine SBOM or licenses for stdin: sbom format not
    recognized [#215 #397 @spiffcs]
  * Dependencies
  - chore(deps): update anchore dependencies (#403)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to
    5.16.5 (#402)
  - chore(deps): bump zizmorcore/zizmor-action from 0.4.1 to
    0.5.0 (#400)
  - chore(deps): update tools to latest versions (#395)
  - chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#396)
  - chore(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#394)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1771502400">- Update to version 0.6.2 (.1 was not released):
  * fix: add --provenance=false for build flags (#410)
  * chore(deps): update anchore dependencies (#409)
  * chore: bump to go 1.25.7 (#408)
  * chore(deps): update tools to latest versions (#404)
  * chore(deps): bump modernc.org/sqlite from 1.44.3 to 1.45.0
    (#405)
  * chore(deps): bump golang.org/x/term from 0.39.0 to 0.40.0
    (#406)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773144000">- Update to version 0.6.3:
  * chore(deps): update anchore dependencies (#424)
  * chore(deps): update tools to latest versions (#423)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#421)
  * chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 (#422)
  * chore(deps): update tools to latest versions (#415)
  * chore(deps): bump github.com/cloudflare/circl from 1.6.1 to
    1.6.3 (#417)
  * chore(deps): bump modernc.org/sqlite from 1.45.0 to 1.46.1
    (#418)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.6 to
    2.4.0 (#419)
  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0 (#420)
  * chore(deps): update tools to latest versions (#414)
  * chore(deps): update tools to latest versions (#407)
  * chore(deps): bump github/codeql-action from 4.31.10 to 4.32.3
    (#413)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774008000">- Update to version 0.6.4:
  * chore(deps): update anchore dependencies (#433)
  * chore(deps): bump google.golang.org/grpc from 1.76.0 to 1.79.3
    (#432)
  * chore(deps): update tools to latest versions (#426)
  * chore(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#428)
  * chore(deps): bump github/codeql-action from 4.32.3 to 4.32.6
    (#429)
  * chore(deps): bump golang.org/x/term from 0.40.0 to 0.41.0
    (#431)
  * chore(deps): update tools to latest versions (#425)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780574400">- Update to version 0.6.6 (.5 was not released):
  * update to dockers_v2 for goreleaser (#519)
  * chore(deps): update anchore dependencies (#513)
  * Pass 'contents: read' to check-gate workflow (#516)
  * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#514)
  * chore(deps): update anchore dependencies (#505)
  * chore(deps): bump the go-minor-patch group across 1 directory
    with 2 updates (#512)
  * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#511)
  * chore(deps): bump github.com/containerd/containerd/v2 (#510)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 (#509)
  * chore(deps): bump golang.org/x/term (#507)
  * remove release notification (#508)
  * Port to go-make (#506)
  * chore(deps): update anchore dependencies (#503)
  * chore(deps): update anchore dependencies (#485)
  * chore(deps): update tool versions (#495)
  * use released shared workflow (#502)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.0 (#501)
  * chore(deps): bump github.com/gookit/color from 1.6.0 to 1.6.1
    (#499)
  * Tighten workflow permissions, update release shape, and fix
    dependabot config (#498)
  * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3
    (#496)
  * chore(deps): bump slackapi/slack-github-action from 3.0.2 to
    3.0.3 (#497)
  * chore(deps): update tool versions (#493)
  * chore(deps): bump github.com/anchore/syft (#494)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.4.0 to
    2.6.0 (#486)
  * chore(deps): bump modernc.org/sqlite from 1.48.2 to 1.50.0
    (#491)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.9 to
    6.7.10 (#489)
  * chore(deps): bump slackapi/slack-github-action from 3.0.1 to
    3.0.2 (#490)
  * chore: remove common workflows (#492)
  * chore(deps): update tool versions (#488)
  * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2
    (#484)
  * chore(deps): update anchore dependencies (#480)
  * chore(deps): update tool versions (#482)
  * restore go minimum version to 1.25.8 (#481)
  * chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3
    (#478)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#479)
  * chore(deps): bump modernc.org/sqlite from 1.48.1 to 1.48.2
    (#472)
  * chore(deps): update anchore dependencies (#469)
  * chore(deps): update tool versions (#470)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to
    5.18.0 (#477)
  * chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0
    (#476)
  * chore(deps): update tools to latest versions (#451)
  * chore(deps): update tool versions (#452)
  * chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1
    (#459)
  * chore(deps): update Go version (#468)
  * chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4 (#457)
  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to
    1.43.0 (#463)
  * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
    (#462)
  * chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to
    1.8.6 (#467)
  * chore(deps): bump modernc.org/sqlite from 1.47.0 to 1.48.1
    (#465)
  * chore(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#466)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to
    6.7.9 (#464)
  * chore(deps): bump
    github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (#461)
  * chore: update zizmor workflow triggers (#456)
  * chore: add security-events write permission for zizmor (#455)
  * (chore): removing automations (#453)
  * chore(deps): update tools to latest versions (#445)
  * chore(deps): update anchore dependencies (#447)
  * chore(deps): update tool versions (#444)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to
    5.17.1 (#450)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#448)
  * chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#449)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#442)
  * chore(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0
    (#441)
  * chore(deps): pin certain go dependencies (#438)
  * fix: --dry-run status code correction (#398)
  * chore(deps): update tools to latest versions (#434)
  * chore(deps): bump slackapi/slack-github-action from 2.1.1 to
    3.0.1 (#435)
  * chore(deps): bump actions/create-github-app-token from 2.2.1 to
    3.0.0 (#436)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780920000">- Update to version 0.6.7:
  * chore(deps): update anchore dependencies (#518)
  * chore(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.1.0 (#520)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1783598400">- Update to version 0.6.8:
  * bug: non zero exit code when no denied packages reported based
    on policies [Issue #454] [PR #517 @arpitjain099]
  * chore(deps): bump
    anchore/workflows/.github/workflows/check-version-available.yaml
    (#532)
  * chore(deps): bump
    anchore/workflows/.github/workflows/release-install-script.yaml
    (#536)
  * chore(deps): bump github.com/anchore/go-collections from 0.1.0
    to 0.1.1 (#542)
  * chore(deps): bump github.com/anchore/syft from 1.45.1 to 1.46.0
    (#537)
  * chore(deps): bump github.com/anchore/clio from 0.1.0 to 0.1.1
    (#539)
  * chore(deps): bump github.com/anchore/go-logger from 0.1.0 to
    0.1.1 (#540)
  * chore(deps): bump modernc.org/sqlite from 1.52.0 to 1.53.0
    (#541)
  * chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
    (#534)
  * chore(deps): bump
    anchore/workflows/.github/workflows/codeql.yaml (#533)
  * chore(deps): bump
    anchore/workflows/.github/workflows/check-gate.yaml (#531)</changelog>
</package>
<package pkgid="040cc365c192d67d2bce1b98993d040cf35f4165ff212ac744cb6340fa2f983cf8745a224f0ac143a421f42941d8b7a007bab19b44b15bf5968b1999bda90d91" name="grant-fish-completion" arch="noarch">
  <version epoch="0" ver="0.6.8" rel="52.5"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758196800">- Update to version 0.3.2:
  * fix: globs were not being parsed correctly from config (#274)
  * feat: add OSI warning text (#273)
  * feat: add coloring to risk output (#272)
  * fix: update grant so it can consume it's own json as source &amp;&amp;
    stdin (#271)
  * chore: generate demo via taskfile `make demo` (#270)
  * docs: vhs gif (#269)
  * docs: modify license settings and enhance README clarity (#267)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- Update to version 0.3.3:
  * Bug Fixes
  - "grant --version" and "grant version" report different
    versions [#277 #278 @popey]
  * Additional Changes
  - bump cosign version [#287 @spiffcs]
  - cosign flag update for release [#286 @spiffcs]
  - actions: Grant validations [#275 @spiffcs]
  * Dependencies
  - chore(deps): update anchore dependencies (#283)
  - chore(deps): bump golang.org/x/term from 0.35.0 to 0.36.0
    (#280)
  - chore(deps): bump modernc.org/sqlite from 1.39.0 to 1.39.1
    (#282)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702401">- Update to version 0.3.4:
  * Bug Fixes
  - pull in syft 1.34.2 to fix panic in jar cataloger [#288
    @anchore-actions-token-generator]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761307200">- Update to version 0.4.0:
  * Added Features
  - upgrade Syft to pull in pnpm and pdm license detection
    improvements [#290 @anchore-actions-token-generator]
  * Dependencies
  - chore(deps): update anchore dependencies (#290)
  - chore(deps): bump github.com/github/go-spdx/v2 from 2.3.3 to
    2.3.4 (#289)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762257600">- Update to version 0.5.0:
  * Added Features
  - Add a supported docker image [#222 #279 @wagoodman]
  * Dependencies
  - chore(deps): bump github.com/anchore/syft from 1.36.0 to
    1.37.0 (#298)
  - chore(deps): bump actions/setup-go from 5.0.0 to 6.0.0 (#302)
  - chore(deps): bump actions/checkout from 4.1.1 to 5.0.0 (#303)
  - chore(deps): bump peter-evans/create-pull-request from 7.0.5
    to 7.0.8 (#301)
  - chore(deps): bump zizmorcore/zizmor-action from 0.1.1 to
    0.2.0 (#300)
  - chore(deps): bump github/codeql-action from 3.23.2 to 4.31.2
    (#299)
  - chore(deps): bump github.com/anchore/stereoscope from 0.1.11
    to 0.1.12 (#297)
  - chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#296)
  - chore(deps): update tools to latest versions (#294)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.8
    to 6.6.9 (#291)
  - chore(deps): bump modernc.org/sqlite from 1.39.1 to 1.40.0
    (#292)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- Update to version 0.5.1:
  * fix: add case handler for panic (#309)
  * chore(deps): update anchore dependencies (#316)
  * chore(deps): update tools to latest versions (#312)
  * chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0
    (#313)
  * chore(deps): bump docker/login-action from 3.5.0 to 3.6.0
    (#304)
  * chore(deps): bump github.com/opencontainers/selinux (#311)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.9 to
    6.7.1 (#310)
  * chore(deps): update tools to latest versions (#305)
  * chore(deps): bump github.com/containerd/containerd from 1.7.28
    to 1.7.29 (#308)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 0.5.2:
  * chore(deps): update anchore dependencies (#339)
  * chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7
    (#336)
  * chore(deps): update tools to latest versions (#335)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.9 to
    7.0.11 (#337)
  * chore(deps): bump actions/create-github-app-token from 2.2.0 to
    2.2.1 (#338)
  * chore(deps): update tools to latest versions (#332)
  * chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2
    (#333)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.4 to
    2.3.5 (#334)
  * chore(deps): update tools to latest versions (#314)
  * chore(deps): bump modernc.org/sqlite from 1.40.0 to 1.40.1
    (#317)
  * chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0
    (#321)
  * chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#322)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#323)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.2 to
    6.7.5 (#324)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.8 to
    7.0.9 (#326)
  * chore(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.3.0
    (#328)
  * chore(deps): bump actions/create-github-app-token from 2.1.4 to
    2.2.0 (#329)
  * chore(deps): bump github/codeql-action from 4.31.2 to 4.31.6
    (#330)
  * chore(deps): bump actions/checkout from 5.0.0 to 6.0.1 (#331)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 0.5.3:
  * chore(deps): bump github.com/anchore/syft from 1.38.2 to 1.39.0
    (#356)
  * chore(deps): update tools to latest versions (#355)
  * chore(deps): update tools to latest versions (#352)
  * chore(deps): bump modernc.org/sqlite from 1.40.1 to 1.41.0
    (#353)
  * signpost to docs site (#351)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.5 to
    6.7.7 (#344)
  * chore(deps): bump github.com/anchore/stereoscope from 0.1.14 to
    0.1.16 (#346)
  * chore(deps): update tools to latest versions (#340)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.11
    to 8.0.0 (#345)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#349)
  * chore(deps): bump github/codeql-action from 4.31.7 to 4.31.9
    (#350)
  * chore(deps): update anchore dependencies (#341)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132801">- Update to version 0.5.4:
  * chore(deps): update anchore dependencies (#360)
  * chore(deps): update tools to latest versions (#358)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.7 to
    6.7.8 (#357)
  * chore(deps): bump modernc.org/sqlite from 1.41.0 to 1.42.2
    (#359)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768564800">- Update to version 0.5.5:
  * chore(deps): update anchore dependencies (#375)
  * chore(deps): update tools to latest versions (#374)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#370)
  * chore(deps): bump actions/setup-go from 6.1.0 to 6.2.0 (#371)
  * chore(deps): bump modernc.org/sqlite from 1.43.0 to 1.44.0
    (#372)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.5 to
    2.3.6 (#373)
  * chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0
    (#368)
  * chore(deps): bump github/codeql-action from 4.31.9 to 4.31.10
    (#369)
  * chore(deps): update tools to latest versions (#367)
  * chore(deps): update tools to latest versions (#365)
  * chore(deps): bump modernc.org/sqlite from 1.42.2 to 1.43.0
    (#366)
  * ci: slack notify team of new grant release (#364)
  * chore(deps): update tools to latest versions (#361)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769601600">- Update to version 0.5.6:
  * chore(deps): update anchore dependencies (#386)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#384)
  * chore(deps): bump modernc.org/sqlite from 1.44.1 to 1.44.2
    (#383)
  * chore(deps): bump zizmorcore/zizmor-action from 0.3.0 to 0.4.1
    (#385)
  * chore(deps): update tools to latest versions (#382)
  * chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#381)
  * chore(deps): update tools to latest versions (#380)
  * chore(deps): update tools to latest versions (#377)
  * chore(deps): bump modernc.org/sqlite from 1.44.0 to 1.44.1
    (#378)
  * ci: configure zizmor to fail PRs, address lints (#379)
  * chore: switch to official slack action (#376)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769774400">- Update to version 0.5.7:
  * chore(deps): update anchore dependencies (#391)
  * chore(deps): bump peter-evans/create-pull-request from 8.0.0 to
    8.1.0 (#390)
  * chore(deps): update tools to latest versions (#388)
  * chore(deps): bump modernc.org/sqlite from 1.44.2 to 1.44.3
    (#389)
  * chore(deps): update tools to latest versions (#387)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770206400">- Update to version 0.5.8:
  * chore(deps): update anchore dependencies (#393)
  * chore(deps): update tools to latest versions (#392)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770811200">- Update to version 0.6.0:
  * Added Features
  - bug: Support new opensource.org license URLs [#208]
  * Bug Fixes
  - skip dir symlinks in grant license search [#399 @spiffcs]
  - bug: "[0090] ERROR unable to classify license: unable to
    read" on symlinkx [#70]
  - bug: [0000] ERROR unable to determine case for -: unable to
    determine SBOM or licenses for stdin: sbom format not
    recognized [#215 #397 @spiffcs]
  * Dependencies
  - chore(deps): update anchore dependencies (#403)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to
    5.16.5 (#402)
  - chore(deps): bump zizmorcore/zizmor-action from 0.4.1 to
    0.5.0 (#400)
  - chore(deps): update tools to latest versions (#395)
  - chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#396)
  - chore(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#394)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1771502400">- Update to version 0.6.2 (.1 was not released):
  * fix: add --provenance=false for build flags (#410)
  * chore(deps): update anchore dependencies (#409)
  * chore: bump to go 1.25.7 (#408)
  * chore(deps): update tools to latest versions (#404)
  * chore(deps): bump modernc.org/sqlite from 1.44.3 to 1.45.0
    (#405)
  * chore(deps): bump golang.org/x/term from 0.39.0 to 0.40.0
    (#406)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773144000">- Update to version 0.6.3:
  * chore(deps): update anchore dependencies (#424)
  * chore(deps): update tools to latest versions (#423)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#421)
  * chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 (#422)
  * chore(deps): update tools to latest versions (#415)
  * chore(deps): bump github.com/cloudflare/circl from 1.6.1 to
    1.6.3 (#417)
  * chore(deps): bump modernc.org/sqlite from 1.45.0 to 1.46.1
    (#418)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.6 to
    2.4.0 (#419)
  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0 (#420)
  * chore(deps): update tools to latest versions (#414)
  * chore(deps): update tools to latest versions (#407)
  * chore(deps): bump github/codeql-action from 4.31.10 to 4.32.3
    (#413)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774008000">- Update to version 0.6.4:
  * chore(deps): update anchore dependencies (#433)
  * chore(deps): bump google.golang.org/grpc from 1.76.0 to 1.79.3
    (#432)
  * chore(deps): update tools to latest versions (#426)
  * chore(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#428)
  * chore(deps): bump github/codeql-action from 4.32.3 to 4.32.6
    (#429)
  * chore(deps): bump golang.org/x/term from 0.40.0 to 0.41.0
    (#431)
  * chore(deps): update tools to latest versions (#425)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780574400">- Update to version 0.6.6 (.5 was not released):
  * update to dockers_v2 for goreleaser (#519)
  * chore(deps): update anchore dependencies (#513)
  * Pass 'contents: read' to check-gate workflow (#516)
  * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#514)
  * chore(deps): update anchore dependencies (#505)
  * chore(deps): bump the go-minor-patch group across 1 directory
    with 2 updates (#512)
  * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#511)
  * chore(deps): bump github.com/containerd/containerd/v2 (#510)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 (#509)
  * chore(deps): bump golang.org/x/term (#507)
  * remove release notification (#508)
  * Port to go-make (#506)
  * chore(deps): update anchore dependencies (#503)
  * chore(deps): update anchore dependencies (#485)
  * chore(deps): update tool versions (#495)
  * use released shared workflow (#502)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.0 (#501)
  * chore(deps): bump github.com/gookit/color from 1.6.0 to 1.6.1
    (#499)
  * Tighten workflow permissions, update release shape, and fix
    dependabot config (#498)
  * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3
    (#496)
  * chore(deps): bump slackapi/slack-github-action from 3.0.2 to
    3.0.3 (#497)
  * chore(deps): update tool versions (#493)
  * chore(deps): bump github.com/anchore/syft (#494)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.4.0 to
    2.6.0 (#486)
  * chore(deps): bump modernc.org/sqlite from 1.48.2 to 1.50.0
    (#491)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.9 to
    6.7.10 (#489)
  * chore(deps): bump slackapi/slack-github-action from 3.0.1 to
    3.0.2 (#490)
  * chore: remove common workflows (#492)
  * chore(deps): update tool versions (#488)
  * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2
    (#484)
  * chore(deps): update anchore dependencies (#480)
  * chore(deps): update tool versions (#482)
  * restore go minimum version to 1.25.8 (#481)
  * chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3
    (#478)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#479)
  * chore(deps): bump modernc.org/sqlite from 1.48.1 to 1.48.2
    (#472)
  * chore(deps): update anchore dependencies (#469)
  * chore(deps): update tool versions (#470)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to
    5.18.0 (#477)
  * chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0
    (#476)
  * chore(deps): update tools to latest versions (#451)
  * chore(deps): update tool versions (#452)
  * chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1
    (#459)
  * chore(deps): update Go version (#468)
  * chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4 (#457)
  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to
    1.43.0 (#463)
  * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
    (#462)
  * chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to
    1.8.6 (#467)
  * chore(deps): bump modernc.org/sqlite from 1.47.0 to 1.48.1
    (#465)
  * chore(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#466)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to
    6.7.9 (#464)
  * chore(deps): bump
    github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (#461)
  * chore: update zizmor workflow triggers (#456)
  * chore: add security-events write permission for zizmor (#455)
  * (chore): removing automations (#453)
  * chore(deps): update tools to latest versions (#445)
  * chore(deps): update anchore dependencies (#447)
  * chore(deps): update tool versions (#444)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to
    5.17.1 (#450)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#448)
  * chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#449)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#442)
  * chore(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0
    (#441)
  * chore(deps): pin certain go dependencies (#438)
  * fix: --dry-run status code correction (#398)
  * chore(deps): update tools to latest versions (#434)
  * chore(deps): bump slackapi/slack-github-action from 2.1.1 to
    3.0.1 (#435)
  * chore(deps): bump actions/create-github-app-token from 2.2.1 to
    3.0.0 (#436)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780920000">- Update to version 0.6.7:
  * chore(deps): update anchore dependencies (#518)
  * chore(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.1.0 (#520)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1783598400">- Update to version 0.6.8:
  * bug: non zero exit code when no denied packages reported based
    on policies [Issue #454] [PR #517 @arpitjain099]
  * chore(deps): bump
    anchore/workflows/.github/workflows/check-version-available.yaml
    (#532)
  * chore(deps): bump
    anchore/workflows/.github/workflows/release-install-script.yaml
    (#536)
  * chore(deps): bump github.com/anchore/go-collections from 0.1.0
    to 0.1.1 (#542)
  * chore(deps): bump github.com/anchore/syft from 1.45.1 to 1.46.0
    (#537)
  * chore(deps): bump github.com/anchore/clio from 0.1.0 to 0.1.1
    (#539)
  * chore(deps): bump github.com/anchore/go-logger from 0.1.0 to
    0.1.1 (#540)
  * chore(deps): bump modernc.org/sqlite from 1.52.0 to 1.53.0
    (#541)
  * chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
    (#534)
  * chore(deps): bump
    anchore/workflows/.github/workflows/codeql.yaml (#533)
  * chore(deps): bump
    anchore/workflows/.github/workflows/check-gate.yaml (#531)</changelog>
</package>
<package pkgid="09508bf1bfe9702531d9147047ced901aac9696b9edfdb1ae6abb96a6b0f997a927a3aadf69605df2fcf7bae9386a1e55585921d61805c4e55d48c0e6e5325c3" name="grant-zsh-completion" arch="noarch">
  <version epoch="0" ver="0.6.8" rel="52.5"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758196800">- Update to version 0.3.2:
  * fix: globs were not being parsed correctly from config (#274)
  * feat: add OSI warning text (#273)
  * feat: add coloring to risk output (#272)
  * fix: update grant so it can consume it's own json as source &amp;&amp;
    stdin (#271)
  * chore: generate demo via taskfile `make demo` (#270)
  * docs: vhs gif (#269)
  * docs: modify license settings and enhance README clarity (#267)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- Update to version 0.3.3:
  * Bug Fixes
  - "grant --version" and "grant version" report different
    versions [#277 #278 @popey]
  * Additional Changes
  - bump cosign version [#287 @spiffcs]
  - cosign flag update for release [#286 @spiffcs]
  - actions: Grant validations [#275 @spiffcs]
  * Dependencies
  - chore(deps): update anchore dependencies (#283)
  - chore(deps): bump golang.org/x/term from 0.35.0 to 0.36.0
    (#280)
  - chore(deps): bump modernc.org/sqlite from 1.39.0 to 1.39.1
    (#282)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702401">- Update to version 0.3.4:
  * Bug Fixes
  - pull in syft 1.34.2 to fix panic in jar cataloger [#288
    @anchore-actions-token-generator]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761307200">- Update to version 0.4.0:
  * Added Features
  - upgrade Syft to pull in pnpm and pdm license detection
    improvements [#290 @anchore-actions-token-generator]
  * Dependencies
  - chore(deps): update anchore dependencies (#290)
  - chore(deps): bump github.com/github/go-spdx/v2 from 2.3.3 to
    2.3.4 (#289)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762257600">- Update to version 0.5.0:
  * Added Features
  - Add a supported docker image [#222 #279 @wagoodman]
  * Dependencies
  - chore(deps): bump github.com/anchore/syft from 1.36.0 to
    1.37.0 (#298)
  - chore(deps): bump actions/setup-go from 5.0.0 to 6.0.0 (#302)
  - chore(deps): bump actions/checkout from 4.1.1 to 5.0.0 (#303)
  - chore(deps): bump peter-evans/create-pull-request from 7.0.5
    to 7.0.8 (#301)
  - chore(deps): bump zizmorcore/zizmor-action from 0.1.1 to
    0.2.0 (#300)
  - chore(deps): bump github/codeql-action from 3.23.2 to 4.31.2
    (#299)
  - chore(deps): bump github.com/anchore/stereoscope from 0.1.11
    to 0.1.12 (#297)
  - chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#296)
  - chore(deps): update tools to latest versions (#294)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.8
    to 6.6.9 (#291)
  - chore(deps): bump modernc.org/sqlite from 1.39.1 to 1.40.0
    (#292)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- Update to version 0.5.1:
  * fix: add case handler for panic (#309)
  * chore(deps): update anchore dependencies (#316)
  * chore(deps): update tools to latest versions (#312)
  * chore(deps): bump golang.org/x/term from 0.36.0 to 0.37.0
    (#313)
  * chore(deps): bump docker/login-action from 3.5.0 to 3.6.0
    (#304)
  * chore(deps): bump github.com/opencontainers/selinux (#311)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.9 to
    6.7.1 (#310)
  * chore(deps): update tools to latest versions (#305)
  * chore(deps): bump github.com/containerd/containerd from 1.7.28
    to 1.7.29 (#308)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 0.5.2:
  * chore(deps): update anchore dependencies (#339)
  * chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7
    (#336)
  * chore(deps): update tools to latest versions (#335)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.9 to
    7.0.11 (#337)
  * chore(deps): bump actions/create-github-app-token from 2.2.0 to
    2.2.1 (#338)
  * chore(deps): update tools to latest versions (#332)
  * chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2
    (#333)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.4 to
    2.3.5 (#334)
  * chore(deps): update tools to latest versions (#314)
  * chore(deps): bump modernc.org/sqlite from 1.40.0 to 1.40.1
    (#317)
  * chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0
    (#321)
  * chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#322)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#323)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.2 to
    6.7.5 (#324)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.8 to
    7.0.9 (#326)
  * chore(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.3.0
    (#328)
  * chore(deps): bump actions/create-github-app-token from 2.1.4 to
    2.2.0 (#329)
  * chore(deps): bump github/codeql-action from 4.31.2 to 4.31.6
    (#330)
  * chore(deps): bump actions/checkout from 5.0.0 to 6.0.1 (#331)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 0.5.3:
  * chore(deps): bump github.com/anchore/syft from 1.38.2 to 1.39.0
    (#356)
  * chore(deps): update tools to latest versions (#355)
  * chore(deps): update tools to latest versions (#352)
  * chore(deps): bump modernc.org/sqlite from 1.40.1 to 1.41.0
    (#353)
  * signpost to docs site (#351)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.5 to
    6.7.7 (#344)
  * chore(deps): bump github.com/anchore/stereoscope from 0.1.14 to
    0.1.16 (#346)
  * chore(deps): update tools to latest versions (#340)
  * chore(deps): bump peter-evans/create-pull-request from 7.0.11
    to 8.0.0 (#345)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#349)
  * chore(deps): bump github/codeql-action from 4.31.7 to 4.31.9
    (#350)
  * chore(deps): update anchore dependencies (#341)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132801">- Update to version 0.5.4:
  * chore(deps): update anchore dependencies (#360)
  * chore(deps): update tools to latest versions (#358)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.7 to
    6.7.8 (#357)
  * chore(deps): bump modernc.org/sqlite from 1.41.0 to 1.42.2
    (#359)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768564800">- Update to version 0.5.5:
  * chore(deps): update anchore dependencies (#375)
  * chore(deps): update tools to latest versions (#374)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#370)
  * chore(deps): bump actions/setup-go from 6.1.0 to 6.2.0 (#371)
  * chore(deps): bump modernc.org/sqlite from 1.43.0 to 1.44.0
    (#372)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.5 to
    2.3.6 (#373)
  * chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0
    (#368)
  * chore(deps): bump github/codeql-action from 4.31.9 to 4.31.10
    (#369)
  * chore(deps): update tools to latest versions (#367)
  * chore(deps): update tools to latest versions (#365)
  * chore(deps): bump modernc.org/sqlite from 1.42.2 to 1.43.0
    (#366)
  * ci: slack notify team of new grant release (#364)
  * chore(deps): update tools to latest versions (#361)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769601600">- Update to version 0.5.6:
  * chore(deps): update anchore dependencies (#386)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#384)
  * chore(deps): bump modernc.org/sqlite from 1.44.1 to 1.44.2
    (#383)
  * chore(deps): bump zizmorcore/zizmor-action from 0.3.0 to 0.4.1
    (#385)
  * chore(deps): update tools to latest versions (#382)
  * chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#381)
  * chore(deps): update tools to latest versions (#380)
  * chore(deps): update tools to latest versions (#377)
  * chore(deps): bump modernc.org/sqlite from 1.44.0 to 1.44.1
    (#378)
  * ci: configure zizmor to fail PRs, address lints (#379)
  * chore: switch to official slack action (#376)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769774400">- Update to version 0.5.7:
  * chore(deps): update anchore dependencies (#391)
  * chore(deps): bump peter-evans/create-pull-request from 8.0.0 to
    8.1.0 (#390)
  * chore(deps): update tools to latest versions (#388)
  * chore(deps): bump modernc.org/sqlite from 1.44.2 to 1.44.3
    (#389)
  * chore(deps): update tools to latest versions (#387)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770206400">- Update to version 0.5.8:
  * chore(deps): update anchore dependencies (#393)
  * chore(deps): update tools to latest versions (#392)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770811200">- Update to version 0.6.0:
  * Added Features
  - bug: Support new opensource.org license URLs [#208]
  * Bug Fixes
  - skip dir symlinks in grant license search [#399 @spiffcs]
  - bug: "[0090] ERROR unable to classify license: unable to
    read" on symlinkx [#70]
  - bug: [0000] ERROR unable to determine case for -: unable to
    determine SBOM or licenses for stdin: sbom format not
    recognized [#215 #397 @spiffcs]
  * Dependencies
  - chore(deps): update anchore dependencies (#403)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to
    5.16.5 (#402)
  - chore(deps): bump zizmorcore/zizmor-action from 0.4.1 to
    0.5.0 (#400)
  - chore(deps): update tools to latest versions (#395)
  - chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#396)
  - chore(deps): bump docker/login-action from 3.6.0 to 3.7.0
    (#394)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1771502400">- Update to version 0.6.2 (.1 was not released):
  * fix: add --provenance=false for build flags (#410)
  * chore(deps): update anchore dependencies (#409)
  * chore: bump to go 1.25.7 (#408)
  * chore(deps): update tools to latest versions (#404)
  * chore(deps): bump modernc.org/sqlite from 1.44.3 to 1.45.0
    (#405)
  * chore(deps): bump golang.org/x/term from 0.39.0 to 0.40.0
    (#406)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773144000">- Update to version 0.6.3:
  * chore(deps): update anchore dependencies (#424)
  * chore(deps): update tools to latest versions (#423)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#421)
  * chore(deps): bump actions/setup-go from 6.2.0 to 6.3.0 (#422)
  * chore(deps): update tools to latest versions (#415)
  * chore(deps): bump github.com/cloudflare/circl from 1.6.1 to
    1.6.3 (#417)
  * chore(deps): bump modernc.org/sqlite from 1.45.0 to 1.46.1
    (#418)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.3.6 to
    2.4.0 (#419)
  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0 (#420)
  * chore(deps): update tools to latest versions (#414)
  * chore(deps): update tools to latest versions (#407)
  * chore(deps): bump github/codeql-action from 4.31.10 to 4.32.3
    (#413)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774008000">- Update to version 0.6.4:
  * chore(deps): update anchore dependencies (#433)
  * chore(deps): bump google.golang.org/grpc from 1.76.0 to 1.79.3
    (#432)
  * chore(deps): update tools to latest versions (#426)
  * chore(deps): bump docker/login-action from 3.7.0 to 4.0.0
    (#428)
  * chore(deps): bump github/codeql-action from 4.32.3 to 4.32.6
    (#429)
  * chore(deps): bump golang.org/x/term from 0.40.0 to 0.41.0
    (#431)
  * chore(deps): update tools to latest versions (#425)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780574400">- Update to version 0.6.6 (.5 was not released):
  * update to dockers_v2 for goreleaser (#519)
  * chore(deps): update anchore dependencies (#513)
  * Pass 'contents: read' to check-gate workflow (#516)
  * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#514)
  * chore(deps): update anchore dependencies (#505)
  * chore(deps): bump the go-minor-patch group across 1 directory
    with 2 updates (#512)
  * chore(deps): bump the actions-minor-patch group across 1
    directory with 6 updates (#511)
  * chore(deps): bump github.com/containerd/containerd/v2 (#510)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 (#509)
  * chore(deps): bump golang.org/x/term (#507)
  * remove release notification (#508)
  * Port to go-make (#506)
  * chore(deps): update anchore dependencies (#503)
  * chore(deps): update anchore dependencies (#485)
  * chore(deps): update tool versions (#495)
  * use released shared workflow (#502)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.0 (#501)
  * chore(deps): bump github.com/gookit/color from 1.6.0 to 1.6.1
    (#499)
  * Tighten workflow permissions, update release shape, and fix
    dependabot config (#498)
  * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3
    (#496)
  * chore(deps): bump slackapi/slack-github-action from 3.0.2 to
    3.0.3 (#497)
  * chore(deps): update tool versions (#493)
  * chore(deps): bump github.com/anchore/syft (#494)
  * chore(deps): bump github.com/github/go-spdx/v2 from 2.4.0 to
    2.6.0 (#486)
  * chore(deps): bump modernc.org/sqlite from 1.48.2 to 1.50.0
    (#491)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.9 to
    6.7.10 (#489)
  * chore(deps): bump slackapi/slack-github-action from 3.0.1 to
    3.0.2 (#490)
  * chore: remove common workflows (#492)
  * chore(deps): update tool versions (#488)
  * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2
    (#484)
  * chore(deps): update anchore dependencies (#480)
  * chore(deps): update tool versions (#482)
  * restore go minimum version to 1.25.8 (#481)
  * chore(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3
    (#478)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#479)
  * chore(deps): bump modernc.org/sqlite from 1.48.1 to 1.48.2
    (#472)
  * chore(deps): update anchore dependencies (#469)
  * chore(deps): update tool versions (#470)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.1 to
    5.18.0 (#477)
  * chore(deps): bump golang.org/x/term from 0.41.0 to 0.42.0
    (#476)
  * chore(deps): update tools to latest versions (#451)
  * chore(deps): update tool versions (#452)
  * chore(deps): bump github/codeql-action from 4.32.6 to 4.35.1
    (#459)
  * chore(deps): update Go version (#468)
  * chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4 (#457)
  * chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to
    1.43.0 (#463)
  * chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
    (#462)
  * chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to
    1.8.6 (#467)
  * chore(deps): bump modernc.org/sqlite from 1.47.0 to 1.48.1
    (#465)
  * chore(deps): bump docker/login-action from 4.0.0 to 4.1.0
    (#466)
  * chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.8 to
    6.7.9 (#464)
  * chore(deps): bump
    github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream (#461)
  * chore: update zizmor workflow triggers (#456)
  * chore: add security-events write permission for zizmor (#455)
  * (chore): removing automations (#453)
  * chore(deps): update tools to latest versions (#445)
  * chore(deps): update anchore dependencies (#447)
  * chore(deps): update tool versions (#444)
  * chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to
    5.17.1 (#450)
  * chore(deps): bump actions/setup-go in
    /.github/actions/bootstrap (#448)
  * chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#449)
  * chore(deps): bump actions/cache in /.github/actions/bootstrap
    (#442)
  * chore(deps): bump modernc.org/sqlite from 1.46.1 to 1.47.0
    (#441)
  * chore(deps): pin certain go dependencies (#438)
  * fix: --dry-run status code correction (#398)
  * chore(deps): update tools to latest versions (#434)
  * chore(deps): bump slackapi/slack-github-action from 2.1.1 to
    3.0.1 (#435)
  * chore(deps): bump actions/create-github-app-token from 2.2.1 to
    3.0.0 (#436)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780920000">- Update to version 0.6.7:
  * chore(deps): update anchore dependencies (#518)
  * chore(deps): bump docker/setup-buildx-action from 3.12.0 to
    4.1.0 (#520)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1783598400">- Update to version 0.6.8:
  * bug: non zero exit code when no denied packages reported based
    on policies [Issue #454] [PR #517 @arpitjain099]
  * chore(deps): bump
    anchore/workflows/.github/workflows/check-version-available.yaml
    (#532)
  * chore(deps): bump
    anchore/workflows/.github/workflows/release-install-script.yaml
    (#536)
  * chore(deps): bump github.com/anchore/go-collections from 0.1.0
    to 0.1.1 (#542)
  * chore(deps): bump github.com/anchore/syft from 1.45.1 to 1.46.0
    (#537)
  * chore(deps): bump github.com/anchore/clio from 0.1.0 to 0.1.1
    (#539)
  * chore(deps): bump github.com/anchore/go-logger from 0.1.0 to
    0.1.1 (#540)
  * chore(deps): bump modernc.org/sqlite from 1.52.0 to 1.53.0
    (#541)
  * chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7
    (#534)
  * chore(deps): bump
    anchore/workflows/.github/workflows/codeql.yaml (#533)
  * chore(deps): bump
    anchore/workflows/.github/workflows/check-gate.yaml (#531)</changelog>
</package>
<package pkgid="36d9ac837683f684f931c5f5a071f962922cfebb93e81d49db4b9d039b75f99567c7f968f8eb83c89ce30cc096c51dcd0afa4031346b1c8bd589a99c65d78a65" name="haas-proxy" arch="noarch">
  <version epoch="0" ver="1.9" rel="10.5"/>
  <changelog author="michal.hrusecky@opensuse.org" date="1507204800">- add option to show IP of the attacker</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1508155200">- rework package based on latest release</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1508328000">- better integration</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1508500800">- update to version 1.1
  * ignore warnings of permanently added host</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1508932800">- update to version 1.2
  * better help
  * not requiring root account</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1515499200">- update to version 1.3
  * various bugfixes
  * configurable loglevel
  * more key options</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1516449600">- update to version 1.4
  * support for load balanced honeypots
- switch to python3</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1519214400">- update to version 1.6
  * disable direct-tcpip traceback logs
  * device token validation</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1534852800">- update to version 1.9
  * improved logging
  * better handling of some error states
  * dynamic searching for sshpass</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1761048000">- Use pyproject macros from python-rpm-macros to build and install.
- List directories under sitelib explicitly.
- Fix requirements.</changelog>
</package>
<package pkgid="1491771e77517142345b1a2eae72e5913e486ffb9dcc8cefbd49b992a65b57af107426823506a9b0d25d60a087708864001e1329e9a95312b8836029679eb962" name="haas-proxy" arch="src">
  <version epoch="0" ver="1.9" rel="10.5"/>
  <changelog author="michal.hrusecky@opensuse.org" date="1503057600">- packaged initial version of haas-mitmproxy</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1504958400">- fix integration</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1507204800">- add option to show IP of the attacker</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1508155200">- rework package based on latest release</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1508328000">- better integration</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1508500800">- update to version 1.1
  * ignore warnings of permanently added host</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1508932800">- update to version 1.2
  * better help
  * not requiring root account</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1515499200">- update to version 1.3
  * various bugfixes
  * configurable loglevel
  * more key options</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1516449600">- update to version 1.4
  * support for load balanced honeypots
- switch to python3</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1519214400">- update to version 1.6
  * disable direct-tcpip traceback logs
  * device token validation</changelog>
  <changelog author="michal.hrusecky@opensuse.org" date="1534852800">- update to version 1.9
  * improved logging
  * better handling of some error states
  * dynamic searching for sshpass</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1761048000">- Use pyproject macros from python-rpm-macros to build and install.
- List directories under sitelib explicitly.
- Fix requirements.</changelog>
</package>
<package pkgid="c646fe6bacfa2aeee0874d32d57e140488ff90b94c06e9136885e8ebbde5445bc8d6ebb5c4a2317eed44dd581cb228b22d2c6c3d23bc7a1f81ea4dadbeaa9ae8" name="hardening-check" arch="s390x">
  <version epoch="0" ver="2.25.19" rel="17.6"/>
  <changelog author="matthias.gerstner@suse.com" date="1501761600">- initial version of package</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1507723200">- perl_regex.patch: fixes the build after a seemingly newer perl version
  complains about a bad perl regular expression contained in the makefile.
- hardening-check-rpmlintrc: suppress no-binary warning, the spec file
  explains why this package can be considered arch specific</changelog>
  <changelog author="jengelh@inai.de" date="1507723201">- Repair grammar and neutrality in the description.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- update to version 2.25.15:
  - this is now based on hardening-check found in Debian's devscripts package.
  - the standalone hardening-check package no longer exists.
  - drop perl_regex.patch no longer needed.
  - adjust to new build system complexities:
  - add makefile_fixes.patch: cut out Debian specific parts
  - add avoid_pod2man_errors.patch: silence some error diagnostics in
    Docbook sources for man pages.
  - the new version has additional support for new fortify source macros and
    branch protection checks.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757678400">- update to version 2.25.19:
  - no changes in hardening-check, this is just to silence the
    "download_files" service, which wasn't able to download the version
    2.25.15 tarball, which got deleted upstream.</changelog>
</package>
<package pkgid="4f88705072edd835800a858c4ab947ab8f9b86b54569b01cb7ae76447df6a1d375f75c2cc99a2115c40c2bcbd8c1db7d7dcaacd2433bf6026e9af5267acf7b58" name="hardening-check" arch="src">
  <version epoch="0" ver="2.25.19" rel="17.6"/>
  <changelog author="matthias.gerstner@suse.com" date="1501761600">- initial version of package</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1507723200">- perl_regex.patch: fixes the build after a seemingly newer perl version
  complains about a bad perl regular expression contained in the makefile.
- hardening-check-rpmlintrc: suppress no-binary warning, the spec file
  explains why this package can be considered arch specific</changelog>
  <changelog author="jengelh@inai.de" date="1507723201">- Repair grammar and neutrality in the description.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- update to version 2.25.15:
  - this is now based on hardening-check found in Debian's devscripts package.
  - the standalone hardening-check package no longer exists.
  - drop perl_regex.patch no longer needed.
  - adjust to new build system complexities:
  - add makefile_fixes.patch: cut out Debian specific parts
  - add avoid_pod2man_errors.patch: silence some error diagnostics in
    Docbook sources for man pages.
  - the new version has additional support for new fortify source macros and
    branch protection checks.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757678400">- update to version 2.25.19:
  - no changes in hardening-check, this is just to silence the
    "download_files" service, which wasn't able to download the version
    2.25.15 tarball, which got deleted upstream.</changelog>
</package>
<package pkgid="8f31b22cf3191dbe4e8c3cab2648313ef37f750a32bf50281e9c59e4472f452d73e5022756b5ffb567145ce50990aa790697543b0e7a0a7a1a950169574a30fb" name="hmaccalc" arch="s390x">
  <version epoch="0" ver="0.9.14" rel="19.277"/>
  <changelog author="meissner@suse.com" date="1397476800">- new package, generate certifiable HMACs for FIPS usage.
  uses the Mozilla NSS library for cryptography.</changelog>
  <changelog author="coolo@suse.com" date="1399464000">- remove prelink buildrequire - completely unneeded and unnecessarily
  increases core ring</changelog>
  <changelog author="p.drouand@gmail.com" date="1421582400">- Update to version 0.9.14
  * No changelog available</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1565784000">- hmac signatures were split from NSS core libs for SLE packaging
  compatibility but recommended and therefore not installed by
  the build process; now a build requirement (boo#1145414)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="a3c4064cecf2a4eb1ee60c13d1a7d4b447414e7918923938ae061fc82c6207efa6a208b6c72fda9342cfa5a787e3ba4936c6828073c611073b136d4b6ca62dcf" name="hmaccalc" arch="src">
  <version epoch="0" ver="0.9.14" rel="19.277"/>
  <changelog author="meissner@suse.com" date="1397476800">- new package, generate certifiable HMACs for FIPS usage.
  uses the Mozilla NSS library for cryptography.</changelog>
  <changelog author="coolo@suse.com" date="1399464000">- remove prelink buildrequire - completely unneeded and unnecessarily
  increases core ring</changelog>
  <changelog author="p.drouand@gmail.com" date="1421582400">- Update to version 0.9.14
  * No changelog available</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1565784000">- hmac signatures were split from NSS core libs for SLE packaging
  compatibility but recommended and therefore not installed by
  the build process; now a build requirement (boo#1145414)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="1251e13f4f8ecf8e177bdec3d71a770eeabe80da058a0c3f466afa8f057171938b0f4729be5b7a131f42e92913cb8089ad9a58306005ee9daf8b2fb9ad515ae9" name="hmaccalc-debuginfo" arch="s390x">
  <version epoch="0" ver="0.9.14" rel="19.277"/>
  <changelog author="meissner@suse.com" date="1397476800">- new package, generate certifiable HMACs for FIPS usage.
  uses the Mozilla NSS library for cryptography.</changelog>
  <changelog author="coolo@suse.com" date="1399464000">- remove prelink buildrequire - completely unneeded and unnecessarily
  increases core ring</changelog>
  <changelog author="p.drouand@gmail.com" date="1421582400">- Update to version 0.9.14
  * No changelog available</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1565784000">- hmac signatures were split from NSS core libs for SLE packaging
  compatibility but recommended and therefore not installed by
  the build process; now a build requirement (boo#1145414)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="2ec351abe938628822db2fd3e890f85342a94d376afbfece124bf7146df1b0372c9d23dcb948c9f9c0da18d053bf3b914318a3dcb4ad01e00bcf5d29175db942" name="hmaccalc-debugsource" arch="s390x">
  <version epoch="0" ver="0.9.14" rel="19.277"/>
  <changelog author="meissner@suse.com" date="1397476800">- new package, generate certifiable HMACs for FIPS usage.
  uses the Mozilla NSS library for cryptography.</changelog>
  <changelog author="coolo@suse.com" date="1399464000">- remove prelink buildrequire - completely unneeded and unnecessarily
  increases core ring</changelog>
  <changelog author="p.drouand@gmail.com" date="1421582400">- Update to version 0.9.14
  * No changelog available</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1565784000">- hmac signatures were split from NSS core libs for SLE packaging
  compatibility but recommended and therefore not installed by
  the build process; now a build requirement (boo#1145414)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="e73a2b6c3d5afdaf5801419a2b56c2b4423e26f06422842f6bf680b22d579ce4beafc3a31df0142961fcb5ef77ffc280e5ae4fec3a9d9a2dcc2380633c7c8e30" name="httrack" arch="s390x">
  <version epoch="0" ver="3.49.2" rel="28.29"/>
  <changelog author="malcolmlewis@opensuse.org" date="1310904000">- Initial build</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346068800">- minor specfile cleanups
- update to v3.46-1
  + New: source license is now GPLv3
  + New: Unicode filenames handling
  + New: added a "K5" feature to handle transparent proxies (Brent Palmer)
  + New: option -y to control ^Z behavior (Julian H. Stacey)
  + New: added --do-not-generate-errors option
  + New: increased maximum cookie name
  + Fixed: fixed bug in handling of update/continue with erased files or renamed files, leading to "Unexpected 412/416 error (Requested Range Not Satisfiable)" and/or "Previous cache file not found" (-1)" errors
  + Fixed: escape characters &gt;= 128 when sending GET/HEAD requests to avoid server errors
  + Fixed: do not use "delayed" extensions when the mirror is aborting
  + Fixed: generate error pages when needed (Brent Palmer)
  + Fixed: parsing issue with js files due to "script" tags (Vasiliy)
  + Fixed: anonymous FTP without password (Luiz)
  + Fixed: Makefile issues regarding parrallel build and examples (Sebastian Pipping)
  + Fixed: removed deprecated and annoying "Accept-Charset" header in requests (Piotr Engelking) (closes:#674053)
  + Fixed: replace // by / when saving rather than _/ (Brent Palmer)
  + Fixed: do not interpret ^C before mirror is finished, or after
  + Fixed: webhttrack: do not use md5sum to produce a temporary filename, but mktemp (Ryan Schmidt)
  + Fixed: document %k for custom structure (full query string)
  + Fixed: spurious "Previous file not found (erased by user ?)" messages leading to retransfer existing files in cache (Alain Desilets)
  + Fixed: --max-time now stops the mirror smoothly (Alain Desilets)
  + Fixed: number of simultaneous connections was often only one (Illyria, William Roeder)
  + Fixed: "Unexpected 412/416 error" leading to have broken files on disk
  + Fixed: interrupting an update/continue mirror session should not delete anymore previously downloaded content (William Roeder, Alain Desilets and many others)
  + Fixed: --continue/--update bug leading to download again already cached data in some cases (especially redirect/error pages)
  + Fixed: crash when using -d with non-fully-qualified hostname (Alain Desilets)
  + Fixed: typo in logs (Pascal Boulerie)
  + Fixed: random crash when interrupting the mirror (spotted by -fstack-protector) in htscoremain.c (closes:#657878)
  + Fixed: malformed format htslib.c (Moritz Muehlenhoff)
  + Fixed: default footer print format</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347278400">- break the shared libraries out into their own sub-package
- run spec-cleaner</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1377345600">- Update to 3.47.24:
  + New: support for IDNA / RFC 3492 (punycode) handling
  + New: openssl is no longer dynamically probed at stratup, but dynamically
    linked
  + Fixed: random closing of files/sockets, leading to
    "zip_zipWriteInFileInZip_failed" assertion, "bogus state" messages, or
    random garbage in downloaded files
  + Fixed: libssl.dylib is now in the search list for libssl on OSX
    (Nils Breunese)
  + Fixed: bogus charset because the meta http-equiv tag is placed too far in
    the html page
  + Fixed: incorrect \\machine\dir structure build on Windows (TomZ)
  + Fixed: do not force a file to have an extension unless it has a known type
    (such as html), or a possibly known type (if delayed checks are disabled)
  + Fixed: HTML 5 addition regarding "poster" attribute for the "video" tag
    (Jason Ronallo)
  + Fixed: memory leaks in proxytrack.c (Eric Searcy)
  + Fixed: correctly set the Z flag in hts-cache/new.txt file (Peter)
  + Fixed: parallel patch, typo regarding ICONV_LIBS (Sebastian Pipping)
  + Fixed: memory leak in hashtable, that may lead to excessive memory
    consumption
  + Fixed: on Windows, fixed possible DLL local injection (CVE-2010-5252)
  + Fixed: UTF-8 conversion bug on Linux that may lead to buggy filenames
  + Fixed: zero-length files not being properly handled (not saved on disk, not
    updated) (lugusto)
  + Fixed: serious bug that may lead to download several times the same file,
    and "Unexpected 412/416 error" errors
  + Fixed: images in CSS were sometimes not correctly detected (Martin)
  + Fixed: links within javascript events were sometimes not correctly detected
    (wquatan)
  + Fixed: webhttrack caused bus error on certain systems, such as Mac OSX, due
    to the stack size (Patrick Gundlach)
  + Fixed: bogus charset for requests when filenames have non-ascii characters
    (Steven Hsiao)
  + Fixed: bogus charset on disk when filenames have non-ascii characters
    (Steven Hsiao)
  + Fixed: fixed 260-characters path limit for Windows (lugusto)
  + Fixed: non-ascii characters encoding issue inside query string (lugusto)
  + Fixed: HTML entities not properly decoded inside URI and query string
  + Fixed: URL-encoding issue within URI
  + Fixed: --timeout alias did not work
  + Fixed: more windows-specific fixes regarding 260-character path limit
  + Fixed: escaping issue in top index
  + Fixed: Linux build cleanup (gentoo patches merge, lintian fixes et al.)
  + Fixed: Fixed div-by-zero when specifying more than 1000 connections per
    seconds (probably not very common)
  + Fixed: Mishandling of '+' in URLs introduced in 3.47-15 (sarclaudio)
  + Fixed: "Wildcard domains in cookies do not match"
    (alexei dot co at gmail dot com )
  + Fixed: buggy referer while parsing: the referer of all links in the page is
    the current page being parsed, NOT the parent page.
    (alexei dot com at gmail dot com)
  + Fixed: Russian translation fixes by Oleg Komarov (komoleg at mail dot ru)
  + New: Added .torrent =&gt; application/x-bittorrent built-in MIME type
    (alexei dot co at gmail dot com)
  + Fixed: unable to download an URL whose filename embeds special characters
    such as # (lugusto)
  + New: Croatian translation by Dominko Aždajić (domazd at mail dot ru)
  + Fixed: url-escaping regression introduced in the previous subrelease
- Added new build requirement libopenssl-devel.
- Require libhttrack2 instead of httrack (not needed) in devel package.
- Require libopenssl-devel in devel package (some httrack headers require
  openssl headers).
- Use desktop-file-utils instead of update-desktop-files for openSUSE &gt; 12.1.
- Remove config.h from htsglobal.h since it is not installed.
- Removed httrack-fix-desktop.patch and added a fix inside the spec file.
- Rebased httrack-fix-strict-aliasing-punning.patch to apply cleanly.</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1382011200">- move the html documentation back to /usr/share/httrack/html
  + See BNC#845885</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1408708800">- Update to 3.48.19:
  + Fixed: assertion failure at htslib.c:3458 (strlen(copyBuff) == qLen) seen
    on Linux
  + Fixed: infamous crashes inside the DNS cache due to a corruption within the
    option structure (E.Kalinowski/karbofos)
  + New: added minimalistic crash reporting on Windows and Linux
  + Fixed: URL list not working anymore (tom swift)
  + Fixed: FTBFS on ARM
  + Fixed: buggy FFFD (replacement character) in place of leading non-ascii
    character such as Chinese ones (aballboy)
  + Fixed: FTBFS when compiling with zlib versions &lt; 1.2.70 (sammyx)
  + Fixed: buggy SVG (Smiling Spectre)
  + Fixed: do not uncompress .tgz advertised as "streamed" (Smiling Spectre)
  + Fixed: NULL pointer dereferencing in back_unserialize (htsback.c:976)
  + Fixed: library development files
  + Fixed: --advanced-maxlinks broken (Localhost)
  + Fixed: -devel package should now be standalone
  + Fixed: assertion failure at htscore.c:244
    (len + liensbuf-&gt;string_buffer_size &lt; liensbuf-&gt;string_buffer_capa)
  + Fixed: injection-proof templates
  + Fixed: htshash.c:330 assertion failure ("error invalidating hash entry")
    (Sergey)
  + Fixed: Windows 2000 regression (fantozzi.usenet)
  + Fixed: code cleanup (aliasing issues, const correctness, safe strings)
  + New: handle --advanced-maxlinks=0 to disable maximum link limits
  + New: updated ZIP routines (zlib 1.2.8)
  + Fixed: broken 32-bit version
  + Fixed: assertion "segOutputSize &lt; segSize assertion fails at
    htscharset.c:993"
  + Fixed: new zlib version fixing CVE-2004-0797 and CVE-2005-2096
  + Fixed: more reliable crash reporting
  + Fixed: fixed infamous "hashtable internal error: cuckoo/stash collision"
    errors
  + Fixed: safety cleanup in many strings operations
  + Fixed: buggy option pannels
  + New: Enforce check against CVE-2014-0160
  + New: improved hashtables to speedup large mirrors
  + New: added unit tests
  + New: Added %a option, allowing to define the "Accept:" header line.
  + New: Added %X option, to define additional request header lines.
  + New: Added option '-%t', preserving the original file type (which may
    produce non-browseable file locally)
  + Fixed: remove scope id (% character) in dotted address resolution
    (especially for catchurl proxy)
  + Fixed: build fixes, including for Android, non-SSL releases
  + Fixed: buggy keep-alive handling, leading to waste connections
  + Fixed: removed chroot and setuid features (this is definitely not our
    business)
  + Fixed: removed MMS (Microsoft Media Server) ripping code (mmsrip) (dead
    protocol, unmaintained code, licensing issues)
  + Fixed: type mishandling when processing a redirect (such as a .PDF
    redirecting to another .PDF, with a text/html type tagged in the redirect
    message)
  + Fixed: infinite loop when attempting to download a file:/// directory on
    Unix (gp)&lt;br/&gt;
  + Fixed: removed background DNS resolution, prone to bugs
  + Fixed: do not choke on Windows 2000 because of missing SetDllDirectory()
    (Andy Hewitt)
  + Fixed: %h custom build structure parameter not taken in account (William
    Clark)
- Removed the fix for build-compare regarding build time references (not needed
  anymore).
- Rebased httrack-fix-strict-aliasing-punning.patch to apply cleanly.</changelog>
  <changelog author="rpm@fthiessen.de" date="1469880000">- Update to 3.48.22
- Spec file cleanup</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1506859200">- Updated to version 3.49.2:
  * Fixed: Buffer overflow in output option commandline argument
    (VL-ID 2068).
  * Minor fixes.
- Changes from version 3.48.23:
  * Fixed: FTBFS with openssl 1.1.0.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- url -&gt; https</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="ca089e9e718c5c4dedc72e3b2874b7e94f167be828a4e7a8bc8a35175fc6a1621cf699d067d2b78e52c156b3d52aa00a77a60d6f021026a2596a7d8380a6cc8b" name="httrack" arch="src">
  <version epoch="0" ver="3.49.2" rel="28.29"/>
  <changelog author="malcolmlewis@opensuse.org" date="1310904000">- Initial build</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346068800">- minor specfile cleanups
- update to v3.46-1
  + New: source license is now GPLv3
  + New: Unicode filenames handling
  + New: added a "K5" feature to handle transparent proxies (Brent Palmer)
  + New: option -y to control ^Z behavior (Julian H. Stacey)
  + New: added --do-not-generate-errors option
  + New: increased maximum cookie name
  + Fixed: fixed bug in handling of update/continue with erased files or renamed files, leading to "Unexpected 412/416 error (Requested Range Not Satisfiable)" and/or "Previous cache file not found" (-1)" errors
  + Fixed: escape characters &gt;= 128 when sending GET/HEAD requests to avoid server errors
  + Fixed: do not use "delayed" extensions when the mirror is aborting
  + Fixed: generate error pages when needed (Brent Palmer)
  + Fixed: parsing issue with js files due to "script" tags (Vasiliy)
  + Fixed: anonymous FTP without password (Luiz)
  + Fixed: Makefile issues regarding parrallel build and examples (Sebastian Pipping)
  + Fixed: removed deprecated and annoying "Accept-Charset" header in requests (Piotr Engelking) (closes:#674053)
  + Fixed: replace // by / when saving rather than _/ (Brent Palmer)
  + Fixed: do not interpret ^C before mirror is finished, or after
  + Fixed: webhttrack: do not use md5sum to produce a temporary filename, but mktemp (Ryan Schmidt)
  + Fixed: document %k for custom structure (full query string)
  + Fixed: spurious "Previous file not found (erased by user ?)" messages leading to retransfer existing files in cache (Alain Desilets)
  + Fixed: --max-time now stops the mirror smoothly (Alain Desilets)
  + Fixed: number of simultaneous connections was often only one (Illyria, William Roeder)
  + Fixed: "Unexpected 412/416 error" leading to have broken files on disk
  + Fixed: interrupting an update/continue mirror session should not delete anymore previously downloaded content (William Roeder, Alain Desilets and many others)
  + Fixed: --continue/--update bug leading to download again already cached data in some cases (especially redirect/error pages)
  + Fixed: crash when using -d with non-fully-qualified hostname (Alain Desilets)
  + Fixed: typo in logs (Pascal Boulerie)
  + Fixed: random crash when interrupting the mirror (spotted by -fstack-protector) in htscoremain.c (closes:#657878)
  + Fixed: malformed format htslib.c (Moritz Muehlenhoff)
  + Fixed: default footer print format</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347278400">- break the shared libraries out into their own sub-package
- run spec-cleaner</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1377345600">- Update to 3.47.24:
  + New: support for IDNA / RFC 3492 (punycode) handling
  + New: openssl is no longer dynamically probed at stratup, but dynamically
    linked
  + Fixed: random closing of files/sockets, leading to
    "zip_zipWriteInFileInZip_failed" assertion, "bogus state" messages, or
    random garbage in downloaded files
  + Fixed: libssl.dylib is now in the search list for libssl on OSX
    (Nils Breunese)
  + Fixed: bogus charset because the meta http-equiv tag is placed too far in
    the html page
  + Fixed: incorrect \\machine\dir structure build on Windows (TomZ)
  + Fixed: do not force a file to have an extension unless it has a known type
    (such as html), or a possibly known type (if delayed checks are disabled)
  + Fixed: HTML 5 addition regarding "poster" attribute for the "video" tag
    (Jason Ronallo)
  + Fixed: memory leaks in proxytrack.c (Eric Searcy)
  + Fixed: correctly set the Z flag in hts-cache/new.txt file (Peter)
  + Fixed: parallel patch, typo regarding ICONV_LIBS (Sebastian Pipping)
  + Fixed: memory leak in hashtable, that may lead to excessive memory
    consumption
  + Fixed: on Windows, fixed possible DLL local injection (CVE-2010-5252)
  + Fixed: UTF-8 conversion bug on Linux that may lead to buggy filenames
  + Fixed: zero-length files not being properly handled (not saved on disk, not
    updated) (lugusto)
  + Fixed: serious bug that may lead to download several times the same file,
    and "Unexpected 412/416 error" errors
  + Fixed: images in CSS were sometimes not correctly detected (Martin)
  + Fixed: links within javascript events were sometimes not correctly detected
    (wquatan)
  + Fixed: webhttrack caused bus error on certain systems, such as Mac OSX, due
    to the stack size (Patrick Gundlach)
  + Fixed: bogus charset for requests when filenames have non-ascii characters
    (Steven Hsiao)
  + Fixed: bogus charset on disk when filenames have non-ascii characters
    (Steven Hsiao)
  + Fixed: fixed 260-characters path limit for Windows (lugusto)
  + Fixed: non-ascii characters encoding issue inside query string (lugusto)
  + Fixed: HTML entities not properly decoded inside URI and query string
  + Fixed: URL-encoding issue within URI
  + Fixed: --timeout alias did not work
  + Fixed: more windows-specific fixes regarding 260-character path limit
  + Fixed: escaping issue in top index
  + Fixed: Linux build cleanup (gentoo patches merge, lintian fixes et al.)
  + Fixed: Fixed div-by-zero when specifying more than 1000 connections per
    seconds (probably not very common)
  + Fixed: Mishandling of '+' in URLs introduced in 3.47-15 (sarclaudio)
  + Fixed: "Wildcard domains in cookies do not match"
    (alexei dot co at gmail dot com )
  + Fixed: buggy referer while parsing: the referer of all links in the page is
    the current page being parsed, NOT the parent page.
    (alexei dot com at gmail dot com)
  + Fixed: Russian translation fixes by Oleg Komarov (komoleg at mail dot ru)
  + New: Added .torrent =&gt; application/x-bittorrent built-in MIME type
    (alexei dot co at gmail dot com)
  + Fixed: unable to download an URL whose filename embeds special characters
    such as # (lugusto)
  + New: Croatian translation by Dominko Aždajić (domazd at mail dot ru)
  + Fixed: url-escaping regression introduced in the previous subrelease
- Added new build requirement libopenssl-devel.
- Require libhttrack2 instead of httrack (not needed) in devel package.
- Require libopenssl-devel in devel package (some httrack headers require
  openssl headers).
- Use desktop-file-utils instead of update-desktop-files for openSUSE &gt; 12.1.
- Remove config.h from htsglobal.h since it is not installed.
- Removed httrack-fix-desktop.patch and added a fix inside the spec file.
- Rebased httrack-fix-strict-aliasing-punning.patch to apply cleanly.</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1382011200">- move the html documentation back to /usr/share/httrack/html
  + See BNC#845885</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1408708800">- Update to 3.48.19:
  + Fixed: assertion failure at htslib.c:3458 (strlen(copyBuff) == qLen) seen
    on Linux
  + Fixed: infamous crashes inside the DNS cache due to a corruption within the
    option structure (E.Kalinowski/karbofos)
  + New: added minimalistic crash reporting on Windows and Linux
  + Fixed: URL list not working anymore (tom swift)
  + Fixed: FTBFS on ARM
  + Fixed: buggy FFFD (replacement character) in place of leading non-ascii
    character such as Chinese ones (aballboy)
  + Fixed: FTBFS when compiling with zlib versions &lt; 1.2.70 (sammyx)
  + Fixed: buggy SVG (Smiling Spectre)
  + Fixed: do not uncompress .tgz advertised as "streamed" (Smiling Spectre)
  + Fixed: NULL pointer dereferencing in back_unserialize (htsback.c:976)
  + Fixed: library development files
  + Fixed: --advanced-maxlinks broken (Localhost)
  + Fixed: -devel package should now be standalone
  + Fixed: assertion failure at htscore.c:244
    (len + liensbuf-&gt;string_buffer_size &lt; liensbuf-&gt;string_buffer_capa)
  + Fixed: injection-proof templates
  + Fixed: htshash.c:330 assertion failure ("error invalidating hash entry")
    (Sergey)
  + Fixed: Windows 2000 regression (fantozzi.usenet)
  + Fixed: code cleanup (aliasing issues, const correctness, safe strings)
  + New: handle --advanced-maxlinks=0 to disable maximum link limits
  + New: updated ZIP routines (zlib 1.2.8)
  + Fixed: broken 32-bit version
  + Fixed: assertion "segOutputSize &lt; segSize assertion fails at
    htscharset.c:993"
  + Fixed: new zlib version fixing CVE-2004-0797 and CVE-2005-2096
  + Fixed: more reliable crash reporting
  + Fixed: fixed infamous "hashtable internal error: cuckoo/stash collision"
    errors
  + Fixed: safety cleanup in many strings operations
  + Fixed: buggy option pannels
  + New: Enforce check against CVE-2014-0160
  + New: improved hashtables to speedup large mirrors
  + New: added unit tests
  + New: Added %a option, allowing to define the "Accept:" header line.
  + New: Added %X option, to define additional request header lines.
  + New: Added option '-%t', preserving the original file type (which may
    produce non-browseable file locally)
  + Fixed: remove scope id (% character) in dotted address resolution
    (especially for catchurl proxy)
  + Fixed: build fixes, including for Android, non-SSL releases
  + Fixed: buggy keep-alive handling, leading to waste connections
  + Fixed: removed chroot and setuid features (this is definitely not our
    business)
  + Fixed: removed MMS (Microsoft Media Server) ripping code (mmsrip) (dead
    protocol, unmaintained code, licensing issues)
  + Fixed: type mishandling when processing a redirect (such as a .PDF
    redirecting to another .PDF, with a text/html type tagged in the redirect
    message)
  + Fixed: infinite loop when attempting to download a file:/// directory on
    Unix (gp)&lt;br/&gt;
  + Fixed: removed background DNS resolution, prone to bugs
  + Fixed: do not choke on Windows 2000 because of missing SetDllDirectory()
    (Andy Hewitt)
  + Fixed: %h custom build structure parameter not taken in account (William
    Clark)
- Removed the fix for build-compare regarding build time references (not needed
  anymore).
- Rebased httrack-fix-strict-aliasing-punning.patch to apply cleanly.</changelog>
  <changelog author="rpm@fthiessen.de" date="1469880000">- Update to 3.48.22
- Spec file cleanup</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1506859200">- Updated to version 3.49.2:
  * Fixed: Buffer overflow in output option commandline argument
    (VL-ID 2068).
  * Minor fixes.
- Changes from version 3.48.23:
  * Fixed: FTBFS with openssl 1.1.0.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- url -&gt; https</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="a05676cace487a3db5279f9971d926f1399494e08b65d29f43c1826250a8f0257f22178081ff0dd87146b1be58e3e2376b3e169f99dd3e0e5757b354ea136558" name="httrack-debuginfo" arch="s390x">
  <version epoch="0" ver="3.49.2" rel="28.29"/>
  <changelog author="malcolmlewis@opensuse.org" date="1310904000">- Initial build</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346068800">- minor specfile cleanups
- update to v3.46-1
  + New: source license is now GPLv3
  + New: Unicode filenames handling
  + New: added a "K5" feature to handle transparent proxies (Brent Palmer)
  + New: option -y to control ^Z behavior (Julian H. Stacey)
  + New: added --do-not-generate-errors option
  + New: increased maximum cookie name
  + Fixed: fixed bug in handling of update/continue with erased files or renamed files, leading to "Unexpected 412/416 error (Requested Range Not Satisfiable)" and/or "Previous cache file not found" (-1)" errors
  + Fixed: escape characters &gt;= 128 when sending GET/HEAD requests to avoid server errors
  + Fixed: do not use "delayed" extensions when the mirror is aborting
  + Fixed: generate error pages when needed (Brent Palmer)
  + Fixed: parsing issue with js files due to "script" tags (Vasiliy)
  + Fixed: anonymous FTP without password (Luiz)
  + Fixed: Makefile issues regarding parrallel build and examples (Sebastian Pipping)
  + Fixed: removed deprecated and annoying "Accept-Charset" header in requests (Piotr Engelking) (closes:#674053)
  + Fixed: replace // by / when saving rather than _/ (Brent Palmer)
  + Fixed: do not interpret ^C before mirror is finished, or after
  + Fixed: webhttrack: do not use md5sum to produce a temporary filename, but mktemp (Ryan Schmidt)
  + Fixed: document %k for custom structure (full query string)
  + Fixed: spurious "Previous file not found (erased by user ?)" messages leading to retransfer existing files in cache (Alain Desilets)
  + Fixed: --max-time now stops the mirror smoothly (Alain Desilets)
  + Fixed: number of simultaneous connections was often only one (Illyria, William Roeder)
  + Fixed: "Unexpected 412/416 error" leading to have broken files on disk
  + Fixed: interrupting an update/continue mirror session should not delete anymore previously downloaded content (William Roeder, Alain Desilets and many others)
  + Fixed: --continue/--update bug leading to download again already cached data in some cases (especially redirect/error pages)
  + Fixed: crash when using -d with non-fully-qualified hostname (Alain Desilets)
  + Fixed: typo in logs (Pascal Boulerie)
  + Fixed: random crash when interrupting the mirror (spotted by -fstack-protector) in htscoremain.c (closes:#657878)
  + Fixed: malformed format htslib.c (Moritz Muehlenhoff)
  + Fixed: default footer print format</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347278400">- break the shared libraries out into their own sub-package
- run spec-cleaner</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1377345600">- Update to 3.47.24:
  + New: support for IDNA / RFC 3492 (punycode) handling
  + New: openssl is no longer dynamically probed at stratup, but dynamically
    linked
  + Fixed: random closing of files/sockets, leading to
    "zip_zipWriteInFileInZip_failed" assertion, "bogus state" messages, or
    random garbage in downloaded files
  + Fixed: libssl.dylib is now in the search list for libssl on OSX
    (Nils Breunese)
  + Fixed: bogus charset because the meta http-equiv tag is placed too far in
    the html page
  + Fixed: incorrect \\machine\dir structure build on Windows (TomZ)
  + Fixed: do not force a file to have an extension unless it has a known type
    (such as html), or a possibly known type (if delayed checks are disabled)
  + Fixed: HTML 5 addition regarding "poster" attribute for the "video" tag
    (Jason Ronallo)
  + Fixed: memory leaks in proxytrack.c (Eric Searcy)
  + Fixed: correctly set the Z flag in hts-cache/new.txt file (Peter)
  + Fixed: parallel patch, typo regarding ICONV_LIBS (Sebastian Pipping)
  + Fixed: memory leak in hashtable, that may lead to excessive memory
    consumption
  + Fixed: on Windows, fixed possible DLL local injection (CVE-2010-5252)
  + Fixed: UTF-8 conversion bug on Linux that may lead to buggy filenames
  + Fixed: zero-length files not being properly handled (not saved on disk, not
    updated) (lugusto)
  + Fixed: serious bug that may lead to download several times the same file,
    and "Unexpected 412/416 error" errors
  + Fixed: images in CSS were sometimes not correctly detected (Martin)
  + Fixed: links within javascript events were sometimes not correctly detected
    (wquatan)
  + Fixed: webhttrack caused bus error on certain systems, such as Mac OSX, due
    to the stack size (Patrick Gundlach)
  + Fixed: bogus charset for requests when filenames have non-ascii characters
    (Steven Hsiao)
  + Fixed: bogus charset on disk when filenames have non-ascii characters
    (Steven Hsiao)
  + Fixed: fixed 260-characters path limit for Windows (lugusto)
  + Fixed: non-ascii characters encoding issue inside query string (lugusto)
  + Fixed: HTML entities not properly decoded inside URI and query string
  + Fixed: URL-encoding issue within URI
  + Fixed: --timeout alias did not work
  + Fixed: more windows-specific fixes regarding 260-character path limit
  + Fixed: escaping issue in top index
  + Fixed: Linux build cleanup (gentoo patches merge, lintian fixes et al.)
  + Fixed: Fixed div-by-zero when specifying more than 1000 connections per
    seconds (probably not very common)
  + Fixed: Mishandling of '+' in URLs introduced in 3.47-15 (sarclaudio)
  + Fixed: "Wildcard domains in cookies do not match"
    (alexei dot co at gmail dot com )
  + Fixed: buggy referer while parsing: the referer of all links in the page is
    the current page being parsed, NOT the parent page.
    (alexei dot com at gmail dot com)
  + Fixed: Russian translation fixes by Oleg Komarov (komoleg at mail dot ru)
  + New: Added .torrent =&gt; application/x-bittorrent built-in MIME type
    (alexei dot co at gmail dot com)
  + Fixed: unable to download an URL whose filename embeds special characters
    such as # (lugusto)
  + New: Croatian translation by Dominko Aždajić (domazd at mail dot ru)
  + Fixed: url-escaping regression introduced in the previous subrelease
- Added new build requirement libopenssl-devel.
- Require libhttrack2 instead of httrack (not needed) in devel package.
- Require libopenssl-devel in devel package (some httrack headers require
  openssl headers).
- Use desktop-file-utils instead of update-desktop-files for openSUSE &gt; 12.1.
- Remove config.h from htsglobal.h since it is not installed.
- Removed httrack-fix-desktop.patch and added a fix inside the spec file.
- Rebased httrack-fix-strict-aliasing-punning.patch to apply cleanly.</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1382011200">- move the html documentation back to /usr/share/httrack/html
  + See BNC#845885</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1408708800">- Update to 3.48.19:
  + Fixed: assertion failure at htslib.c:3458 (strlen(copyBuff) == qLen) seen
    on Linux
  + Fixed: infamous crashes inside the DNS cache due to a corruption within the
    option structure (E.Kalinowski/karbofos)
  + New: added minimalistic crash reporting on Windows and Linux
  + Fixed: URL list not working anymore (tom swift)
  + Fixed: FTBFS on ARM
  + Fixed: buggy FFFD (replacement character) in place of leading non-ascii
    character such as Chinese ones (aballboy)
  + Fixed: FTBFS when compiling with zlib versions &lt; 1.2.70 (sammyx)
  + Fixed: buggy SVG (Smiling Spectre)
  + Fixed: do not uncompress .tgz advertised as "streamed" (Smiling Spectre)
  + Fixed: NULL pointer dereferencing in back_unserialize (htsback.c:976)
  + Fixed: library development files
  + Fixed: --advanced-maxlinks broken (Localhost)
  + Fixed: -devel package should now be standalone
  + Fixed: assertion failure at htscore.c:244
    (len + liensbuf-&gt;string_buffer_size &lt; liensbuf-&gt;string_buffer_capa)
  + Fixed: injection-proof templates
  + Fixed: htshash.c:330 assertion failure ("error invalidating hash entry")
    (Sergey)
  + Fixed: Windows 2000 regression (fantozzi.usenet)
  + Fixed: code cleanup (aliasing issues, const correctness, safe strings)
  + New: handle --advanced-maxlinks=0 to disable maximum link limits
  + New: updated ZIP routines (zlib 1.2.8)
  + Fixed: broken 32-bit version
  + Fixed: assertion "segOutputSize &lt; segSize assertion fails at
    htscharset.c:993"
  + Fixed: new zlib version fixing CVE-2004-0797 and CVE-2005-2096
  + Fixed: more reliable crash reporting
  + Fixed: fixed infamous "hashtable internal error: cuckoo/stash collision"
    errors
  + Fixed: safety cleanup in many strings operations
  + Fixed: buggy option pannels
  + New: Enforce check against CVE-2014-0160
  + New: improved hashtables to speedup large mirrors
  + New: added unit tests
  + New: Added %a option, allowing to define the "Accept:" header line.
  + New: Added %X option, to define additional request header lines.
  + New: Added option '-%t', preserving the original file type (which may
    produce non-browseable file locally)
  + Fixed: remove scope id (% character) in dotted address resolution
    (especially for catchurl proxy)
  + Fixed: build fixes, including for Android, non-SSL releases
  + Fixed: buggy keep-alive handling, leading to waste connections
  + Fixed: removed chroot and setuid features (this is definitely not our
    business)
  + Fixed: removed MMS (Microsoft Media Server) ripping code (mmsrip) (dead
    protocol, unmaintained code, licensing issues)
  + Fixed: type mishandling when processing a redirect (such as a .PDF
    redirecting to another .PDF, with a text/html type tagged in the redirect
    message)
  + Fixed: infinite loop when attempting to download a file:/// directory on
    Unix (gp)&lt;br/&gt;
  + Fixed: removed background DNS resolution, prone to bugs
  + Fixed: do not choke on Windows 2000 because of missing SetDllDirectory()
    (Andy Hewitt)
  + Fixed: %h custom build structure parameter not taken in account (William
    Clark)
- Removed the fix for build-compare regarding build time references (not needed
  anymore).
- Rebased httrack-fix-strict-aliasing-punning.patch to apply cleanly.</changelog>
  <changelog author="rpm@fthiessen.de" date="1469880000">- Update to 3.48.22
- Spec file cleanup</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1506859200">- Updated to version 3.49.2:
  * Fixed: Buffer overflow in output option commandline argument
    (VL-ID 2068).
  * Minor fixes.
- Changes from version 3.48.23:
  * Fixed: FTBFS with openssl 1.1.0.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- url -&gt; https</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="5f314b4df44fbada5f6cfc1ac5fa8be1bed8285f829e1d8a1fb05ba40f130cdf60312ff43eebfd3c08de3ff3c31ebec0d2b47a9ae7fd0f8f1845acccf93e9a7a" name="httrack-debugsource" arch="s390x">
  <version epoch="0" ver="3.49.2" rel="28.29"/>
  <changelog author="malcolmlewis@opensuse.org" date="1310904000">- Initial build</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346068800">- minor specfile cleanups
- update to v3.46-1
  + New: source license is now GPLv3
  + New: Unicode filenames handling
  + New: added a "K5" feature to handle transparent proxies (Brent Palmer)
  + New: option -y to control ^Z behavior (Julian H. Stacey)
  + New: added --do-not-generate-errors option
  + New: increased maximum cookie name
  + Fixed: fixed bug in handling of update/continue with erased files or renamed files, leading to "Unexpected 412/416 error (Requested Range Not Satisfiable)" and/or "Previous cache file not found" (-1)" errors
  + Fixed: escape characters &gt;= 128 when sending GET/HEAD requests to avoid server errors
  + Fixed: do not use "delayed" extensions when the mirror is aborting
  + Fixed: generate error pages when needed (Brent Palmer)
  + Fixed: parsing issue with js files due to "script" tags (Vasiliy)
  + Fixed: anonymous FTP without password (Luiz)
  + Fixed: Makefile issues regarding parrallel build and examples (Sebastian Pipping)
  + Fixed: removed deprecated and annoying "Accept-Charset" header in requests (Piotr Engelking) (closes:#674053)
  + Fixed: replace // by / when saving rather than _/ (Brent Palmer)
  + Fixed: do not interpret ^C before mirror is finished, or after
  + Fixed: webhttrack: do not use md5sum to produce a temporary filename, but mktemp (Ryan Schmidt)
  + Fixed: document %k for custom structure (full query string)
  + Fixed: spurious "Previous file not found (erased by user ?)" messages leading to retransfer existing files in cache (Alain Desilets)
  + Fixed: --max-time now stops the mirror smoothly (Alain Desilets)
  + Fixed: number of simultaneous connections was often only one (Illyria, William Roeder)
  + Fixed: "Unexpected 412/416 error" leading to have broken files on disk
  + Fixed: interrupting an update/continue mirror session should not delete anymore previously downloaded content (William Roeder, Alain Desilets and many others)
  + Fixed: --continue/--update bug leading to download again already cached data in some cases (especially redirect/error pages)
  + Fixed: crash when using -d with non-fully-qualified hostname (Alain Desilets)
  + Fixed: typo in logs (Pascal Boulerie)
  + Fixed: random crash when interrupting the mirror (spotted by -fstack-protector) in htscoremain.c (closes:#657878)
  + Fixed: malformed format htslib.c (Moritz Muehlenhoff)
  + Fixed: default footer print format</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347278400">- break the shared libraries out into their own sub-package
- run spec-cleaner</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1377345600">- Update to 3.47.24:
  + New: support for IDNA / RFC 3492 (punycode) handling
  + New: openssl is no longer dynamically probed at stratup, but dynamically
    linked
  + Fixed: random closing of files/sockets, leading to
    "zip_zipWriteInFileInZip_failed" assertion, "bogus state" messages, or
    random garbage in downloaded files
  + Fixed: libssl.dylib is now in the search list for libssl on OSX
    (Nils Breunese)
  + Fixed: bogus charset because the meta http-equiv tag is placed too far in
    the html page
  + Fixed: incorrect \\machine\dir structure build on Windows (TomZ)
  + Fixed: do not force a file to have an extension unless it has a known type
    (such as html), or a possibly known type (if delayed checks are disabled)
  + Fixed: HTML 5 addition regarding "poster" attribute for the "video" tag
    (Jason Ronallo)
  + Fixed: memory leaks in proxytrack.c (Eric Searcy)
  + Fixed: correctly set the Z flag in hts-cache/new.txt file (Peter)
  + Fixed: parallel patch, typo regarding ICONV_LIBS (Sebastian Pipping)
  + Fixed: memory leak in hashtable, that may lead to excessive memory
    consumption
  + Fixed: on Windows, fixed possible DLL local injection (CVE-2010-5252)
  + Fixed: UTF-8 conversion bug on Linux that may lead to buggy filenames
  + Fixed: zero-length files not being properly handled (not saved on disk, not
    updated) (lugusto)
  + Fixed: serious bug that may lead to download several times the same file,
    and "Unexpected 412/416 error" errors
  + Fixed: images in CSS were sometimes not correctly detected (Martin)
  + Fixed: links within javascript events were sometimes not correctly detected
    (wquatan)
  + Fixed: webhttrack caused bus error on certain systems, such as Mac OSX, due
    to the stack size (Patrick Gundlach)
  + Fixed: bogus charset for requests when filenames have non-ascii characters
    (Steven Hsiao)
  + Fixed: bogus charset on disk when filenames have non-ascii characters
    (Steven Hsiao)
  + Fixed: fixed 260-characters path limit for Windows (lugusto)
  + Fixed: non-ascii characters encoding issue inside query string (lugusto)
  + Fixed: HTML entities not properly decoded inside URI and query string
  + Fixed: URL-encoding issue within URI
  + Fixed: --timeout alias did not work
  + Fixed: more windows-specific fixes regarding 260-character path limit
  + Fixed: escaping issue in top index
  + Fixed: Linux build cleanup (gentoo patches merge, lintian fixes et al.)
  + Fixed: Fixed div-by-zero when specifying more than 1000 connections per
    seconds (probably not very common)
  + Fixed: Mishandling of '+' in URLs introduced in 3.47-15 (sarclaudio)
  + Fixed: "Wildcard domains in cookies do not match"
    (alexei dot co at gmail dot com )
  + Fixed: buggy referer while parsing: the referer of all links in the page is
    the current page being parsed, NOT the parent page.
    (alexei dot com at gmail dot com)
  + Fixed: Russian translation fixes by Oleg Komarov (komoleg at mail dot ru)
  + New: Added .torrent =&gt; application/x-bittorrent built-in MIME type
    (alexei dot co at gmail dot com)
  + Fixed: unable to download an URL whose filename embeds special characters
    such as # (lugusto)
  + New: Croatian translation by Dominko Aždajić (domazd at mail dot ru)
  + Fixed: url-escaping regression introduced in the previous subrelease
- Added new build requirement libopenssl-devel.
- Require libhttrack2 instead of httrack (not needed) in devel package.
- Require libopenssl-devel in devel package (some httrack headers require
  openssl headers).
- Use desktop-file-utils instead of update-desktop-files for openSUSE &gt; 12.1.
- Remove config.h from htsglobal.h since it is not installed.
- Removed httrack-fix-desktop.patch and added a fix inside the spec file.
- Rebased httrack-fix-strict-aliasing-punning.patch to apply cleanly.</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1382011200">- move the html documentation back to /usr/share/httrack/html
  + See BNC#845885</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1408708800">- Update to 3.48.19:
  + Fixed: assertion failure at htslib.c:3458 (strlen(copyBuff) == qLen) seen
    on Linux
  + Fixed: infamous crashes inside the DNS cache due to a corruption within the
    option structure (E.Kalinowski/karbofos)
  + New: added minimalistic crash reporting on Windows and Linux
  + Fixed: URL list not working anymore (tom swift)
  + Fixed: FTBFS on ARM
  + Fixed: buggy FFFD (replacement character) in place of leading non-ascii
    character such as Chinese ones (aballboy)
  + Fixed: FTBFS when compiling with zlib versions &lt; 1.2.70 (sammyx)
  + Fixed: buggy SVG (Smiling Spectre)
  + Fixed: do not uncompress .tgz advertised as "streamed" (Smiling Spectre)
  + Fixed: NULL pointer dereferencing in back_unserialize (htsback.c:976)
  + Fixed: library development files
  + Fixed: --advanced-maxlinks broken (Localhost)
  + Fixed: -devel package should now be standalone
  + Fixed: assertion failure at htscore.c:244
    (len + liensbuf-&gt;string_buffer_size &lt; liensbuf-&gt;string_buffer_capa)
  + Fixed: injection-proof templates
  + Fixed: htshash.c:330 assertion failure ("error invalidating hash entry")
    (Sergey)
  + Fixed: Windows 2000 regression (fantozzi.usenet)
  + Fixed: code cleanup (aliasing issues, const correctness, safe strings)
  + New: handle --advanced-maxlinks=0 to disable maximum link limits
  + New: updated ZIP routines (zlib 1.2.8)
  + Fixed: broken 32-bit version
  + Fixed: assertion "segOutputSize &lt; segSize assertion fails at
    htscharset.c:993"
  + Fixed: new zlib version fixing CVE-2004-0797 and CVE-2005-2096
  + Fixed: more reliable crash reporting
  + Fixed: fixed infamous "hashtable internal error: cuckoo/stash collision"
    errors
  + Fixed: safety cleanup in many strings operations
  + Fixed: buggy option pannels
  + New: Enforce check against CVE-2014-0160
  + New: improved hashtables to speedup large mirrors
  + New: added unit tests
  + New: Added %a option, allowing to define the "Accept:" header line.
  + New: Added %X option, to define additional request header lines.
  + New: Added option '-%t', preserving the original file type (which may
    produce non-browseable file locally)
  + Fixed: remove scope id (% character) in dotted address resolution
    (especially for catchurl proxy)
  + Fixed: build fixes, including for Android, non-SSL releases
  + Fixed: buggy keep-alive handling, leading to waste connections
  + Fixed: removed chroot and setuid features (this is definitely not our
    business)
  + Fixed: removed MMS (Microsoft Media Server) ripping code (mmsrip) (dead
    protocol, unmaintained code, licensing issues)
  + Fixed: type mishandling when processing a redirect (such as a .PDF
    redirecting to another .PDF, with a text/html type tagged in the redirect
    message)
  + Fixed: infinite loop when attempting to download a file:/// directory on
    Unix (gp)&lt;br/&gt;
  + Fixed: removed background DNS resolution, prone to bugs
  + Fixed: do not choke on Windows 2000 because of missing SetDllDirectory()
    (Andy Hewitt)
  + Fixed: %h custom build structure parameter not taken in account (William
    Clark)
- Removed the fix for build-compare regarding build time references (not needed
  anymore).
- Rebased httrack-fix-strict-aliasing-punning.patch to apply cleanly.</changelog>
  <changelog author="rpm@fthiessen.de" date="1469880000">- Update to 3.48.22
- Spec file cleanup</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1506859200">- Updated to version 3.49.2:
  * Fixed: Buffer overflow in output option commandline argument
    (VL-ID 2068).
  * Minor fixes.
- Changes from version 3.48.23:
  * Fixed: FTBFS with openssl 1.1.0.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- url -&gt; https</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="1a71af3d88c75646d1e3adc1792d39e46225f5fc7e1af28b1e7cbaadbefea55d3d11853d35df0a0598663819409310bf594490469db839ce23c4a6bafc6c7ba4" name="httrack-devel" arch="s390x">
  <version epoch="0" ver="3.49.2" rel="28.29"/>
  <changelog author="malcolmlewis@opensuse.org" date="1310904000">- Initial build</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346068800">- minor specfile cleanups
- update to v3.46-1
  + New: source license is now GPLv3
  + New: Unicode filenames handling
  + New: added a "K5" feature to handle transparent proxies (Brent Palmer)
  + New: option -y to control ^Z behavior (Julian H. Stacey)
  + New: added --do-not-generate-errors option
  + New: increased maximum cookie name
  + Fixed: fixed bug in handling of update/continue with erased files or renamed files, leading to "Unexpected 412/416 error (Requested Range Not Satisfiable)" and/or "Previous cache file not found" (-1)" errors
  + Fixed: escape characters &gt;= 128 when sending GET/HEAD requests to avoid server errors
  + Fixed: do not use "delayed" extensions when the mirror is aborting
  + Fixed: generate error pages when needed (Brent Palmer)
  + Fixed: parsing issue with js files due to "script" tags (Vasiliy)
  + Fixed: anonymous FTP without password (Luiz)
  + Fixed: Makefile issues regarding parrallel build and examples (Sebastian Pipping)
  + Fixed: removed deprecated and annoying "Accept-Charset" header in requests (Piotr Engelking) (closes:#674053)
  + Fixed: replace // by / when saving rather than _/ (Brent Palmer)
  + Fixed: do not interpret ^C before mirror is finished, or after
  + Fixed: webhttrack: do not use md5sum to produce a temporary filename, but mktemp (Ryan Schmidt)
  + Fixed: document %k for custom structure (full query string)
  + Fixed: spurious "Previous file not found (erased by user ?)" messages leading to retransfer existing files in cache (Alain Desilets)
  + Fixed: --max-time now stops the mirror smoothly (Alain Desilets)
  + Fixed: number of simultaneous connections was often only one (Illyria, William Roeder)
  + Fixed: "Unexpected 412/416 error" leading to have broken files on disk
  + Fixed: interrupting an update/continue mirror session should not delete anymore previously downloaded content (William Roeder, Alain Desilets and many others)
  + Fixed: --continue/--update bug leading to download again already cached data in some cases (especially redirect/error pages)
  + Fixed: crash when using -d with non-fully-qualified hostname (Alain Desilets)
  + Fixed: typo in logs (Pascal Boulerie)
  + Fixed: random crash when interrupting the mirror (spotted by -fstack-protector) in htscoremain.c (closes:#657878)
  + Fixed: malformed format htslib.c (Moritz Muehlenhoff)
  + Fixed: default footer print format</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347278400">- break the shared libraries out into their own sub-package
- run spec-cleaner</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1377345600">- Update to 3.47.24:
  + New: support for IDNA / RFC 3492 (punycode) handling
  + New: openssl is no longer dynamically probed at stratup, but dynamically
    linked
  + Fixed: random closing of files/sockets, leading to
    "zip_zipWriteInFileInZip_failed" assertion, "bogus state" messages, or
    random garbage in downloaded files
  + Fixed: libssl.dylib is now in the search list for libssl on OSX
    (Nils Breunese)
  + Fixed: bogus charset because the meta http-equiv tag is placed too far in
    the html page
  + Fixed: incorrect \\machine\dir structure build on Windows (TomZ)
  + Fixed: do not force a file to have an extension unless it has a known type
    (such as html), or a possibly known type (if delayed checks are disabled)
  + Fixed: HTML 5 addition regarding "poster" attribute for the "video" tag
    (Jason Ronallo)
  + Fixed: memory leaks in proxytrack.c (Eric Searcy)
  + Fixed: correctly set the Z flag in hts-cache/new.txt file (Peter)
  + Fixed: parallel patch, typo regarding ICONV_LIBS (Sebastian Pipping)
  + Fixed: memory leak in hashtable, that may lead to excessive memory
    consumption
  + Fixed: on Windows, fixed possible DLL local injection (CVE-2010-5252)
  + Fixed: UTF-8 conversion bug on Linux that may lead to buggy filenames
  + Fixed: zero-length files not being properly handled (not saved on disk, not
    updated) (lugusto)
  + Fixed: serious bug that may lead to download several times the same file,
    and "Unexpected 412/416 error" errors
  + Fixed: images in CSS were sometimes not correctly detected (Martin)
  + Fixed: links within javascript events were sometimes not correctly detected
    (wquatan)
  + Fixed: webhttrack caused bus error on certain systems, such as Mac OSX, due
    to the stack size (Patrick Gundlach)
  + Fixed: bogus charset for requests when filenames have non-ascii characters
    (Steven Hsiao)
  + Fixed: bogus charset on disk when filenames have non-ascii characters
    (Steven Hsiao)
  + Fixed: fixed 260-characters path limit for Windows (lugusto)
  + Fixed: non-ascii characters encoding issue inside query string (lugusto)
  + Fixed: HTML entities not properly decoded inside URI and query string
  + Fixed: URL-encoding issue within URI
  + Fixed: --timeout alias did not work
  + Fixed: more windows-specific fixes regarding 260-character path limit
  + Fixed: escaping issue in top index
  + Fixed: Linux build cleanup (gentoo patches merge, lintian fixes et al.)
  + Fixed: Fixed div-by-zero when specifying more than 1000 connections per
    seconds (probably not very common)
  + Fixed: Mishandling of '+' in URLs introduced in 3.47-15 (sarclaudio)
  + Fixed: "Wildcard domains in cookies do not match"
    (alexei dot co at gmail dot com )
  + Fixed: buggy referer while parsing: the referer of all links in the page is
    the current page being parsed, NOT the parent page.
    (alexei dot com at gmail dot com)
  + Fixed: Russian translation fixes by Oleg Komarov (komoleg at mail dot ru)
  + New: Added .torrent =&gt; application/x-bittorrent built-in MIME type
    (alexei dot co at gmail dot com)
  + Fixed: unable to download an URL whose filename embeds special characters
    such as # (lugusto)
  + New: Croatian translation by Dominko Aždajić (domazd at mail dot ru)
  + Fixed: url-escaping regression introduced in the previous subrelease
- Added new build requirement libopenssl-devel.
- Require libhttrack2 instead of httrack (not needed) in devel package.
- Require libopenssl-devel in devel package (some httrack headers require
  openssl headers).
- Use desktop-file-utils instead of update-desktop-files for openSUSE &gt; 12.1.
- Remove config.h from htsglobal.h since it is not installed.
- Removed httrack-fix-desktop.patch and added a fix inside the spec file.
- Rebased httrack-fix-strict-aliasing-punning.patch to apply cleanly.</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1382011200">- move the html documentation back to /usr/share/httrack/html
  + See BNC#845885</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1408708800">- Update to 3.48.19:
  + Fixed: assertion failure at htslib.c:3458 (strlen(copyBuff) == qLen) seen
    on Linux
  + Fixed: infamous crashes inside the DNS cache due to a corruption within the
    option structure (E.Kalinowski/karbofos)
  + New: added minimalistic crash reporting on Windows and Linux
  + Fixed: URL list not working anymore (tom swift)
  + Fixed: FTBFS on ARM
  + Fixed: buggy FFFD (replacement character) in place of leading non-ascii
    character such as Chinese ones (aballboy)
  + Fixed: FTBFS when compiling with zlib versions &lt; 1.2.70 (sammyx)
  + Fixed: buggy SVG (Smiling Spectre)
  + Fixed: do not uncompress .tgz advertised as "streamed" (Smiling Spectre)
  + Fixed: NULL pointer dereferencing in back_unserialize (htsback.c:976)
  + Fixed: library development files
  + Fixed: --advanced-maxlinks broken (Localhost)
  + Fixed: -devel package should now be standalone
  + Fixed: assertion failure at htscore.c:244
    (len + liensbuf-&gt;string_buffer_size &lt; liensbuf-&gt;string_buffer_capa)
  + Fixed: injection-proof templates
  + Fixed: htshash.c:330 assertion failure ("error invalidating hash entry")
    (Sergey)
  + Fixed: Windows 2000 regression (fantozzi.usenet)
  + Fixed: code cleanup (aliasing issues, const correctness, safe strings)
  + New: handle --advanced-maxlinks=0 to disable maximum link limits
  + New: updated ZIP routines (zlib 1.2.8)
  + Fixed: broken 32-bit version
  + Fixed: assertion "segOutputSize &lt; segSize assertion fails at
    htscharset.c:993"
  + Fixed: new zlib version fixing CVE-2004-0797 and CVE-2005-2096
  + Fixed: more reliable crash reporting
  + Fixed: fixed infamous "hashtable internal error: cuckoo/stash collision"
    errors
  + Fixed: safety cleanup in many strings operations
  + Fixed: buggy option pannels
  + New: Enforce check against CVE-2014-0160
  + New: improved hashtables to speedup large mirrors
  + New: added unit tests
  + New: Added %a option, allowing to define the "Accept:" header line.
  + New: Added %X option, to define additional request header lines.
  + New: Added option '-%t', preserving the original file type (which may
    produce non-browseable file locally)
  + Fixed: remove scope id (% character) in dotted address resolution
    (especially for catchurl proxy)
  + Fixed: build fixes, including for Android, non-SSL releases
  + Fixed: buggy keep-alive handling, leading to waste connections
  + Fixed: removed chroot and setuid features (this is definitely not our
    business)
  + Fixed: removed MMS (Microsoft Media Server) ripping code (mmsrip) (dead
    protocol, unmaintained code, licensing issues)
  + Fixed: type mishandling when processing a redirect (such as a .PDF
    redirecting to another .PDF, with a text/html type tagged in the redirect
    message)
  + Fixed: infinite loop when attempting to download a file:/// directory on
    Unix (gp)&lt;br/&gt;
  + Fixed: removed background DNS resolution, prone to bugs
  + Fixed: do not choke on Windows 2000 because of missing SetDllDirectory()
    (Andy Hewitt)
  + Fixed: %h custom build structure parameter not taken in account (William
    Clark)
- Removed the fix for build-compare regarding build time references (not needed
  anymore).
- Rebased httrack-fix-strict-aliasing-punning.patch to apply cleanly.</changelog>
  <changelog author="rpm@fthiessen.de" date="1469880000">- Update to 3.48.22
- Spec file cleanup</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1506859200">- Updated to version 3.49.2:
  * Fixed: Buffer overflow in output option commandline argument
    (VL-ID 2068).
  * Minor fixes.
- Changes from version 3.48.23:
  * Fixed: FTBFS with openssl 1.1.0.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- url -&gt; https</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="408bce5f603d0ae66dcca215803b3aefeea69038bb6f75941661cf4255b15734133535d48caa21c81959c2cd8cd796fd6e1653e0de04aa94b5ee276cab39cbb2" name="hydra" arch="s390x">
  <version epoch="0" ver="9.7+git20.gbccaea1" rel="1.5"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1662638400">- Update to version 9.4
  * Switched from pcre/pcre3 to pcre2
  * Small fix for weird RTSP servers
  * Added "2=" optional parameter to http-post-form module to tell
    hydra that a "302" HTTP return code means success
  * replaced wait3 with waitpid for better compatability
- Drop patch:
  * hydra-9.3-hydra-http-form.patch (fixed upstream)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1686571200">- Update to version 9.5
  * http-form:
    + The help for http-form was wrong. the condition variable
    must always be the last parameter, not the third.
    +  Proxy support was not working correctly.
  * smb2: fix for updated libsmb2 which resulted in correct
    guessing attempts not being detected.
  * smtp: break early if the server does not allow authentication.
  * rdp: detect more return codes that say a user is disabled etc.</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1746532800">- Fix freerdp version to 2, as hydra does not compile with
  freerdp 3 (https://github.com/vanhauser-thc/thc-hydra/issues/935)
- Use common URL format in source URL
- Use pkgconfig when possible to specify BuildRequires</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1746705600">- Replace #!/bin/sh with #!/bin/bash in hydra-wizard.sh
- Remove unused BuildRequires
- Remove old / broken conditional BuildRequires
- Fix file permissions</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1747224000">- Make build recipe POSIX sh compatible (no pushd). Trim
  unnecessary `exit 1` since scriptlets run with sh -e anyway.
- Trim unquantified claims from summary line. Have the %description
  talk about hydra, not about papers or other tools.</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1753099200">- Add patch fix-prototype-mismatches.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1757678400">- Update to version 9.6
  * freerdp v2 -&gt; v3.
  * compile fixes (eg. gcc-15).
  * pop3 capability fix.
  * mysql library upgrade.
  * http-form fixes.
  * postgres custom port support.
  * smb better expired support.
  * ssh legacy cipher support.
  * http 403 support.
- Update patch:
  * fix-prototype-mismatches.patch</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1758110400">- Add conditional pkgconfig(freerdp3) BuildRequires, support for
  freerdp3 was added in version 9.6. Build with latest freerdp for
  current versions of openSUSE and SLE.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1777896000">- Update to version 9.7
  * GTK3 support for xhydra.
  * mongo v2 support.
  * POP3 buffer overflow fix.
- Build with support for MongoDBv2
- Drop patch:
  * fix-prototype-mismatches.patch</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1782475200">- Update to version 9.7+git8.g9cc84c2:
  * Various vulnerability fixes and improvements
  * Fix vulnerability in NTML encoding [CVE-2026-56766]
  * Full changelog at /usr/share/doc/packages/hydra/CHANGES</changelog>
</package>
<package pkgid="fa41fa9a6e47f4ef043ac5715176c6b30013710de5f695f165fa1c112d1a03174649b289edbc6018328a1cfc9a12f1a9136c1e96be23e55ddff91aa5ad946ff7" name="hydra" arch="src">
  <version epoch="0" ver="9.7+git20.gbccaea1" rel="1.5"/>
  <changelog author="ushamim@linux.com" date="1461499200">- Changed file permissions so only privileged users can run hydra</changelog>
  <changelog author="ushamim@linux.com" date="1474632000">- Changed versioning to match upstream versioning
- Fixed permissions, lets users read man pages</changelog>
  <changelog author="mardnh@gmx.de" date="1485518400">- Update to version 8.4
  * Proxy support re-implemented:
  - HYDRA_PROXY[_HTTP] environment can be a text file with up to 64 entries
  - HYDRA_PROXY_AUTH was deprecated, set login/password in HTTP_PROXY[_HTTP]
  * New protocol: adam6500 - this one is work in progress, please test and report
  * New protocol: rpcap - thanks to Petar Kaleychev &lt;petar.kaleychev@gmail.com&gt;
  * New command line options:
  - y : disables -x 1aA interpretation, thanks to crondaemon for the patch
  - I : ignore an existing hydra.restore file (dont wait for 10 seconds)
  * hydra-svn: works now with the current libsvn version
  * hydra-ssh: initial check for password auth support now uses login supplied
  * Fixed dpl4hydra to be able to update from the web again
  * Fixed crash when -U was used without any service (thanks to thecarterb for reporting)
  * Updated default password lists
  * The protocols vnc, xmpp, telnet, imap, nntp and pcanywhere got accidentially long
    sleep commands due a patch in 8.2, fixed
  * Added special error message for clueless users :)
- ran spec-cleaner
- fixed Group
- added patch:
  - 0001-Fix-no-return-in-nonvoid-function-in-bfg.c-41.patch</changelog>
  <changelog author="mardnh@gmx.de" date="1493812800">- Update to version 8.5
  * New command line option:
  - b : format option for -o output file (json only so far, happy for patches
    supporting others :) ) - thanks to veggiespam for the patch
  * ./configure now honors the CC enviroment variable if present
  * Fix for the restore file crash on some x64 platforms (finally! thanks to lukas227!)
  * Changed the format of the restore file to detect cross platform copies
  * Fixed a bug in the NCP module
  * Favor strrchr() over rindex()
  * Added refactoring patch by diadlo
  * Updated man page with missing command line options</changelog>
  <changelog author="mardnh@gmx.de" date="1500724800">- Update to version 8.6
  * added radmin2 module by catatonic prime - great work!
  * smb module now checks if SMBv1 is supported by the server and
    if signing is required
  * http-form module now supports URLs up to 6000 bytes
  * Fix for SSL connections that failed with
    error:00000000:lib(0):func(0):reason(0)
  * Added new command line option:
  - c TIME: seconds between login attempts (over all threads,
    so -t 1 is recommended)
  * Options put after -R (for loading a restore file) are now
    honored (and were disallowed before)
  * merged several patches by Diadlo@github to make the code
    easier readable.
  * merged a patch by Diadlo@github that moves the help output
    to the invididual module
- Remove patch (fixed upstream):
  - 0001-Fix-no-return-in-nonvoid-function-in-bfg.c-41.patch</changelog>
  <changelog author="mardnh@gmx.de" date="1546430400">- Update to version 8.8
  * New web page: https://github.com/vanhauser-thc/thc-hydra
  * added PROBLEMS file with known issues
  * rdp: disabled the module as it does not support the current
    protocol.
  * ldap: fixed a dumb strlen on a potential null pointer
  * http-get/http-post:
  - now supports H=/h= parameters same as http-form
  - 403/404 errors are now always registered as failed attempts
  * mysql module: a non-default port was not working, fixed
  * added -w timeout support to ssh module
  * fixed various memory leaks in http-form module
  * corrected hydra return code to be 0 on success
  * added patch from debian maintainers which fixes spellings
  * fixed weird crash on x64 systems
  * many warning fixes by crondaemon</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1551182400">- Update to version 8.9.1
  * Clarification for rdp error message
  * CIDR notation (hydra -l test -p test 192.168.0.0/24 ftp)
    was not detected, fixed</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1558094400">- Update to version 9.0
  * rdp: Revamped rdp module to use FreeRDP library
  * Added memcached module
  * Added mongodb module
  * http: http module now supports a= option to select http
    authentication type
  * JSON output does now truncate the file if exists.
  * Fixed svn module memory leaks
  * Fixed rtsp module potential buffer overflow
  * Fixed http module DIGEST-MD5 mode</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1615809600">- Update to version 9.2
  * fix for http-post-form optional parameters.
  * enable gcc 10 support for xhydra too.
  * removed rain mode (-r) because of inefficiency.
  * IPv6 support for Host: header for http based modules.
- Update to version 9.1
  * rdb: support for libfreerdp3.
  * new module: smb2 which also supports smb3 (uses
    libsmbclient-dev).
  * oracle: added success condition.
  * rtsp: fixed crash in MD5 auth.
  * svn: updated to support past and new API.
  * http: now supports F=/S= string matching conditions.
  * http-proxy: buffer fix, 404 success condition.
  * mysql: changed not to use mysql db as a default. if the user
    has not access to this db auth fails.
  * sasl: buffer fix.
  * fixed help for https modules.
  * added -K command line switch to disable redo attempts.
  * forgot to have the -m option in the hydra help output.
  * gcc-10 support and various cleanups.
  * added .clang-format and formatted all code
- Build with support for firebird</changelog>
  <changelog author="Lars Vogdt &lt;lars@linux-schulserver.de&gt;" date="1655726400">- Update to version 9.3
  * new module: cobaltstrike by ultimaiiii, thank you!
  * fix for ssh to support -M or ip/range
  * fix for rdp to detect empty passwords
  * fix for http-form to no send empty headers
  * fix for http on non-default ports when using with a proxy
  * for vnc/cisco/... protocols that only check for a password, skip host
    after the password is found
  * fix to support IPv6 addresses in -M
  * fix to test all entries in -C files, not exiting after the first found
  * make disappearing targets faster to terminate on
- fix URL: use the Github page instead of the old, lost homepage
- adjust filelist: README.md -&gt; README, add xhydra.png logo
- For new enough distributions (&gt;= 15.1):
  + enable freeRDP(2)    -&gt; BuildRequires: freerdp-devel
  + enable memcached     -&gt; BuildRequires: libmemcached-devel
- enable Samba(client) -&gt; BuildRequires: libsmbclient-devel
- enable MySQL/MariaDB -&gt; BuildRequires: libmariadbd-devel
- ran spec-cleaner
- add hydra-9.3-hydra-http-form.patch: fix a missing return value</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1662638400">- Update to version 9.4
  * Switched from pcre/pcre3 to pcre2
  * Small fix for weird RTSP servers
  * Added "2=" optional parameter to http-post-form module to tell
    hydra that a "302" HTTP return code means success
  * replaced wait3 with waitpid for better compatability
- Drop patch:
  * hydra-9.3-hydra-http-form.patch (fixed upstream)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1686571200">- Update to version 9.5
  * http-form:
    + The help for http-form was wrong. the condition variable
    must always be the last parameter, not the third.
    +  Proxy support was not working correctly.
  * smb2: fix for updated libsmb2 which resulted in correct
    guessing attempts not being detected.
  * smtp: break early if the server does not allow authentication.
  * rdp: detect more return codes that say a user is disabled etc.</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1746532800">- Fix freerdp version to 2, as hydra does not compile with
  freerdp 3 (https://github.com/vanhauser-thc/thc-hydra/issues/935)
- Use common URL format in source URL
- Use pkgconfig when possible to specify BuildRequires</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1746705600">- Replace #!/bin/sh with #!/bin/bash in hydra-wizard.sh
- Remove unused BuildRequires
- Remove old / broken conditional BuildRequires
- Fix file permissions</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1747224000">- Make build recipe POSIX sh compatible (no pushd). Trim
  unnecessary `exit 1` since scriptlets run with sh -e anyway.
- Trim unquantified claims from summary line. Have the %description
  talk about hydra, not about papers or other tools.</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1753099200">- Add patch fix-prototype-mismatches.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1757678400">- Update to version 9.6
  * freerdp v2 -&gt; v3.
  * compile fixes (eg. gcc-15).
  * pop3 capability fix.
  * mysql library upgrade.
  * http-form fixes.
  * postgres custom port support.
  * smb better expired support.
  * ssh legacy cipher support.
  * http 403 support.
- Update patch:
  * fix-prototype-mismatches.patch</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1758110400">- Add conditional pkgconfig(freerdp3) BuildRequires, support for
  freerdp3 was added in version 9.6. Build with latest freerdp for
  current versions of openSUSE and SLE.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1777896000">- Update to version 9.7
  * GTK3 support for xhydra.
  * mongo v2 support.
  * POP3 buffer overflow fix.
- Build with support for MongoDBv2
- Drop patch:
  * fix-prototype-mismatches.patch</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1782475200">- Update to version 9.7+git8.g9cc84c2:
  * Various vulnerability fixes and improvements
  * Fix vulnerability in NTML encoding [CVE-2026-56766]
  * Full changelog at /usr/share/doc/packages/hydra/CHANGES</changelog>
</package>
<package pkgid="661ec7a9e5de6f1942445bd8dc2100e1619c68daccc7aa6fb1f9db196f2f88ea21c7da9ba8584caacc4eb508c87c2cf1ff8b02f98d53048e803e111b446e6fcb" name="hydra-debuginfo" arch="s390x">
  <version epoch="0" ver="9.7+git20.gbccaea1" rel="1.5"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1662638400">- Update to version 9.4
  * Switched from pcre/pcre3 to pcre2
  * Small fix for weird RTSP servers
  * Added "2=" optional parameter to http-post-form module to tell
    hydra that a "302" HTTP return code means success
  * replaced wait3 with waitpid for better compatability
- Drop patch:
  * hydra-9.3-hydra-http-form.patch (fixed upstream)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1686571200">- Update to version 9.5
  * http-form:
    + The help for http-form was wrong. the condition variable
    must always be the last parameter, not the third.
    +  Proxy support was not working correctly.
  * smb2: fix for updated libsmb2 which resulted in correct
    guessing attempts not being detected.
  * smtp: break early if the server does not allow authentication.
  * rdp: detect more return codes that say a user is disabled etc.</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1746532800">- Fix freerdp version to 2, as hydra does not compile with
  freerdp 3 (https://github.com/vanhauser-thc/thc-hydra/issues/935)
- Use common URL format in source URL
- Use pkgconfig when possible to specify BuildRequires</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1746705600">- Replace #!/bin/sh with #!/bin/bash in hydra-wizard.sh
- Remove unused BuildRequires
- Remove old / broken conditional BuildRequires
- Fix file permissions</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1747224000">- Make build recipe POSIX sh compatible (no pushd). Trim
  unnecessary `exit 1` since scriptlets run with sh -e anyway.
- Trim unquantified claims from summary line. Have the %description
  talk about hydra, not about papers or other tools.</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1753099200">- Add patch fix-prototype-mismatches.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1757678400">- Update to version 9.6
  * freerdp v2 -&gt; v3.
  * compile fixes (eg. gcc-15).
  * pop3 capability fix.
  * mysql library upgrade.
  * http-form fixes.
  * postgres custom port support.
  * smb better expired support.
  * ssh legacy cipher support.
  * http 403 support.
- Update patch:
  * fix-prototype-mismatches.patch</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1758110400">- Add conditional pkgconfig(freerdp3) BuildRequires, support for
  freerdp3 was added in version 9.6. Build with latest freerdp for
  current versions of openSUSE and SLE.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1777896000">- Update to version 9.7
  * GTK3 support for xhydra.
  * mongo v2 support.
  * POP3 buffer overflow fix.
- Build with support for MongoDBv2
- Drop patch:
  * fix-prototype-mismatches.patch</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1782475200">- Update to version 9.7+git8.g9cc84c2:
  * Various vulnerability fixes and improvements
  * Fix vulnerability in NTML encoding [CVE-2026-56766]
  * Full changelog at /usr/share/doc/packages/hydra/CHANGES</changelog>
</package>
<package pkgid="fd225fa88bf9b907bae3baed738f9165fc24ed8cd9828f89fb4cf4d91123c2df20d981e022954d3043cabfa0d03317efa88312ffd2929efe20b32b1265710215" name="hydra-debugsource" arch="s390x">
  <version epoch="0" ver="9.7+git20.gbccaea1" rel="1.5"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1662638400">- Update to version 9.4
  * Switched from pcre/pcre3 to pcre2
  * Small fix for weird RTSP servers
  * Added "2=" optional parameter to http-post-form module to tell
    hydra that a "302" HTTP return code means success
  * replaced wait3 with waitpid for better compatability
- Drop patch:
  * hydra-9.3-hydra-http-form.patch (fixed upstream)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1686571200">- Update to version 9.5
  * http-form:
    + The help for http-form was wrong. the condition variable
    must always be the last parameter, not the third.
    +  Proxy support was not working correctly.
  * smb2: fix for updated libsmb2 which resulted in correct
    guessing attempts not being detected.
  * smtp: break early if the server does not allow authentication.
  * rdp: detect more return codes that say a user is disabled etc.</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1746532800">- Fix freerdp version to 2, as hydra does not compile with
  freerdp 3 (https://github.com/vanhauser-thc/thc-hydra/issues/935)
- Use common URL format in source URL
- Use pkgconfig when possible to specify BuildRequires</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1746705600">- Replace #!/bin/sh with #!/bin/bash in hydra-wizard.sh
- Remove unused BuildRequires
- Remove old / broken conditional BuildRequires
- Fix file permissions</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1747224000">- Make build recipe POSIX sh compatible (no pushd). Trim
  unnecessary `exit 1` since scriptlets run with sh -e anyway.
- Trim unquantified claims from summary line. Have the %description
  talk about hydra, not about papers or other tools.</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1753099200">- Add patch fix-prototype-mismatches.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1757678400">- Update to version 9.6
  * freerdp v2 -&gt; v3.
  * compile fixes (eg. gcc-15).
  * pop3 capability fix.
  * mysql library upgrade.
  * http-form fixes.
  * postgres custom port support.
  * smb better expired support.
  * ssh legacy cipher support.
  * http 403 support.
- Update patch:
  * fix-prototype-mismatches.patch</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1758110400">- Add conditional pkgconfig(freerdp3) BuildRequires, support for
  freerdp3 was added in version 9.6. Build with latest freerdp for
  current versions of openSUSE and SLE.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1777896000">- Update to version 9.7
  * GTK3 support for xhydra.
  * mongo v2 support.
  * POP3 buffer overflow fix.
- Build with support for MongoDBv2
- Drop patch:
  * fix-prototype-mismatches.patch</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1782475200">- Update to version 9.7+git8.g9cc84c2:
  * Various vulnerability fixes and improvements
  * Fix vulnerability in NTML encoding [CVE-2026-56766]
  * Full changelog at /usr/share/doc/packages/hydra/CHANGES</changelog>
</package>
<package pkgid="56b471a5476e6fc89a49f27f226c663db8cca1f21e43d4caa3b1e891bd0761de174677c97b5a1c7cd01590c187f95e65075521f8486754f4208fbfdcaf1b3eba" name="ibmswtpm2" arch="s390x">
  <version epoch="0" ver="183+2024+03+27" rel="50.9"/>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1597665600">- Update to upstream version 1637
  * fixes build of ibmtss 1.5.0
  * Refresh makefile.patch
  * Drop upstreamed patches
  - ibmswtpm2-fix-uninitialized.patch
  - ibmswtpm2-fix-empty-decrypt.patch
  * Fix use of uninitialized value:
    + ibmswtpm2-TcpServerPosix-Fix-use-of-uninitialized-value.patch
    + ibmswtpm2-NVDynamic-Fix-use-of-uninitialized-value.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1598961600">- Fix ppc32 build.
  + ibmswtpm2-fix-ppc32.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1664020800">- update to 1682:
  * tpm: Fix cast in BnSetBit.
  * tpm2: Fix size check in CryptSecretDecrypt
  * tpm: Port Windows code for OpenSSL 3.0
  * tpm: Update to openssl 3.0.2
  * tpm: Add command and handle tracing
  * tpm: Update for openssl 3.0.1
  * tpm: Add ECC encrypt and decrypt commands
  * Fix compilation on RISC-V
  * PlatformSvc: return error on control socket failure
  * main: set a return code if StartTcpServer fails
  * tpm: Add all updates to TPM specification 164.
- drop ibmswtpm2-fix-ppc32.patch (upstream)
- makefile.patch: refresh</changelog>
  <changelog author="Otto Hollmann &lt;otto.hollmann@suse.com&gt;" date="1678881600">- Add support for OpenSSL 3.1.x
  * Add ibmswtpm2-OpenSSL-3.1.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1701432000">- Update to version 164-2020-192.2
  * Implement the RSA 5 primes optimization.
  * Check command size for int32 overflow.
  * Add support for OpenSSL 3.1.x
  * Do not accept a NULL signKey in TPM2_CertifyX509
  * Add Nuvoton to gcc makefile
- New project URL - move to github
- Drop usptreamed ibmswtpm2-OpenSSL-3.1.patch</changelog>
  <changelog author="Otto Hollmann &lt;otto.hollmann@suse.com&gt;" date="1702382400">- Add support for OpenSSL 3.2.x
  * Add ibmswtpm2-Add-support-for-OpenSSL-3.2.x.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1712232000">- Update to version 183-2024-03-27
  * tpm: Updates to rev 180
- Drop obsolete patches
  * Drop ibmswtpm2-NVDynamic-Fix-use-of-uninitialized-value.patch - addressed upstream
  * Drop ibmswtpm2-Add-support-for-OpenSSL-3.2.x.patch - merged upstream</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1712664000">- Package LICENSE file.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1743768000">- Fix build with OpenSSL 3.5: [bsc#1241037]
  * Fails with "error Untested OpenSSL version" when building for
    the upcoming OpenSSL version 3.5.
  * Add ibmswtpm2-Build-with-OpenSSL-3.5.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1759492800">- Fix build with OpenSSL 3.6: [bsc#1250338]
  * tpm: Update to OpenSSL 3.6 [gh#kgoldman/ibmswtpm2#22]
  * Rename ibmswtpm2-Build-with-OpenSSL-3.5.patch to
    ibmswtpm2-Build-with-New-OpenSSL.patch</changelog>
</package>
<package pkgid="45865dd10a60100bb9525bc1a83257564366d75ce5743881d1ce0fb295786a3667e3798db292144899644748a6065a63418f6ff9bdcb50a926eadeb678ce2b3d" name="ibmswtpm2" arch="src">
  <version epoch="0" ver="183+2024+03+27" rel="50.9"/>
  <changelog author="msuchanek@suse.com" date="1485518400">- Import version 832 (FATE#321601)
- bits.patch: handle some 32/64bit issues
- makefile.patch: some compiler flag adjustments</changelog>
  <changelog author="jengelh@inai.de" date="1486555200">- Wrap description, drop empty scriptlets.</changelog>
  <changelog author="msuchanek@suse.com" date="1487073600">- Drop a pointer cast hack in bits.patch. It builds without the hack.</changelog>
  <changelog author="msuchanek@suse.com" date="1496664000">- fix build with gcc7: fix_unreferenced_macro-gcc7.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1510142400">- Update to upstream version 974
  - deal with openssl 1.0 vs 1.1 split (bsc#1066916)</changelog>
  <changelog author="vcizek@suse.com" date="1516104000">- Update to upstream version 1119
  * adds openssl 1.1 support (bsc#1066916)
- drop patches (upstream):
  * bits.patch
  * fix_unreferenced_macro-gcc7.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1516276800">- Enable bigendian build</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1562241600">- Update to upstream version 1332
  * fixes build of ibmtpm v1470
  * add ibmswtpm2-fix-uninitialized.patch
  * run through spec-cleaner</changelog>
  <changelog author="mgerstner &lt;matthias.gerstner@suse.com&gt;" date="1577102400">- Add ibmswtpm2-fix-empty-decrypt.patch: Fix a corner case in the emulator
  that causes an error when trying to RSA-decrypt an empty message
  (bsc#1159510). This fix was confirmed to be by the upstream author and is
  supposed to be contained in the next release.</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1597665600">- Update to upstream version 1637
  * fixes build of ibmtss 1.5.0
  * Refresh makefile.patch
  * Drop upstreamed patches
  - ibmswtpm2-fix-uninitialized.patch
  - ibmswtpm2-fix-empty-decrypt.patch
  * Fix use of uninitialized value:
    + ibmswtpm2-TcpServerPosix-Fix-use-of-uninitialized-value.patch
    + ibmswtpm2-NVDynamic-Fix-use-of-uninitialized-value.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1598961600">- Fix ppc32 build.
  + ibmswtpm2-fix-ppc32.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1664020800">- update to 1682:
  * tpm: Fix cast in BnSetBit.
  * tpm2: Fix size check in CryptSecretDecrypt
  * tpm: Port Windows code for OpenSSL 3.0
  * tpm: Update to openssl 3.0.2
  * tpm: Add command and handle tracing
  * tpm: Update for openssl 3.0.1
  * tpm: Add ECC encrypt and decrypt commands
  * Fix compilation on RISC-V
  * PlatformSvc: return error on control socket failure
  * main: set a return code if StartTcpServer fails
  * tpm: Add all updates to TPM specification 164.
- drop ibmswtpm2-fix-ppc32.patch (upstream)
- makefile.patch: refresh</changelog>
  <changelog author="Otto Hollmann &lt;otto.hollmann@suse.com&gt;" date="1678881600">- Add support for OpenSSL 3.1.x
  * Add ibmswtpm2-OpenSSL-3.1.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1701432000">- Update to version 164-2020-192.2
  * Implement the RSA 5 primes optimization.
  * Check command size for int32 overflow.
  * Add support for OpenSSL 3.1.x
  * Do not accept a NULL signKey in TPM2_CertifyX509
  * Add Nuvoton to gcc makefile
- New project URL - move to github
- Drop usptreamed ibmswtpm2-OpenSSL-3.1.patch</changelog>
  <changelog author="Otto Hollmann &lt;otto.hollmann@suse.com&gt;" date="1702382400">- Add support for OpenSSL 3.2.x
  * Add ibmswtpm2-Add-support-for-OpenSSL-3.2.x.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1712232000">- Update to version 183-2024-03-27
  * tpm: Updates to rev 180
- Drop obsolete patches
  * Drop ibmswtpm2-NVDynamic-Fix-use-of-uninitialized-value.patch - addressed upstream
  * Drop ibmswtpm2-Add-support-for-OpenSSL-3.2.x.patch - merged upstream</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1712664000">- Package LICENSE file.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1743768000">- Fix build with OpenSSL 3.5: [bsc#1241037]
  * Fails with "error Untested OpenSSL version" when building for
    the upcoming OpenSSL version 3.5.
  * Add ibmswtpm2-Build-with-OpenSSL-3.5.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1759492800">- Fix build with OpenSSL 3.6: [bsc#1250338]
  * tpm: Update to OpenSSL 3.6 [gh#kgoldman/ibmswtpm2#22]
  * Rename ibmswtpm2-Build-with-OpenSSL-3.5.patch to
    ibmswtpm2-Build-with-New-OpenSSL.patch</changelog>
</package>
<package pkgid="d402772f709a456ceb1f12d8638c4a63877c65ba980a23e35cabd16f506bcf03acfb4cc5d7cdd1fd05885f320cfde62323fb75dd3c51ff746b6f9db3e956cb56" name="ibmswtpm2-debuginfo" arch="s390x">
  <version epoch="0" ver="183+2024+03+27" rel="50.9"/>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1597665600">- Update to upstream version 1637
  * fixes build of ibmtss 1.5.0
  * Refresh makefile.patch
  * Drop upstreamed patches
  - ibmswtpm2-fix-uninitialized.patch
  - ibmswtpm2-fix-empty-decrypt.patch
  * Fix use of uninitialized value:
    + ibmswtpm2-TcpServerPosix-Fix-use-of-uninitialized-value.patch
    + ibmswtpm2-NVDynamic-Fix-use-of-uninitialized-value.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1598961600">- Fix ppc32 build.
  + ibmswtpm2-fix-ppc32.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1664020800">- update to 1682:
  * tpm: Fix cast in BnSetBit.
  * tpm2: Fix size check in CryptSecretDecrypt
  * tpm: Port Windows code for OpenSSL 3.0
  * tpm: Update to openssl 3.0.2
  * tpm: Add command and handle tracing
  * tpm: Update for openssl 3.0.1
  * tpm: Add ECC encrypt and decrypt commands
  * Fix compilation on RISC-V
  * PlatformSvc: return error on control socket failure
  * main: set a return code if StartTcpServer fails
  * tpm: Add all updates to TPM specification 164.
- drop ibmswtpm2-fix-ppc32.patch (upstream)
- makefile.patch: refresh</changelog>
  <changelog author="Otto Hollmann &lt;otto.hollmann@suse.com&gt;" date="1678881600">- Add support for OpenSSL 3.1.x
  * Add ibmswtpm2-OpenSSL-3.1.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1701432000">- Update to version 164-2020-192.2
  * Implement the RSA 5 primes optimization.
  * Check command size for int32 overflow.
  * Add support for OpenSSL 3.1.x
  * Do not accept a NULL signKey in TPM2_CertifyX509
  * Add Nuvoton to gcc makefile
- New project URL - move to github
- Drop usptreamed ibmswtpm2-OpenSSL-3.1.patch</changelog>
  <changelog author="Otto Hollmann &lt;otto.hollmann@suse.com&gt;" date="1702382400">- Add support for OpenSSL 3.2.x
  * Add ibmswtpm2-Add-support-for-OpenSSL-3.2.x.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1712232000">- Update to version 183-2024-03-27
  * tpm: Updates to rev 180
- Drop obsolete patches
  * Drop ibmswtpm2-NVDynamic-Fix-use-of-uninitialized-value.patch - addressed upstream
  * Drop ibmswtpm2-Add-support-for-OpenSSL-3.2.x.patch - merged upstream</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1712664000">- Package LICENSE file.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1743768000">- Fix build with OpenSSL 3.5: [bsc#1241037]
  * Fails with "error Untested OpenSSL version" when building for
    the upcoming OpenSSL version 3.5.
  * Add ibmswtpm2-Build-with-OpenSSL-3.5.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1759492800">- Fix build with OpenSSL 3.6: [bsc#1250338]
  * tpm: Update to OpenSSL 3.6 [gh#kgoldman/ibmswtpm2#22]
  * Rename ibmswtpm2-Build-with-OpenSSL-3.5.patch to
    ibmswtpm2-Build-with-New-OpenSSL.patch</changelog>
</package>
<package pkgid="61c70e282b012cbfe545ee8cdef4f88b34b021da912a6b4a7f91463f020cf94f6dec6236dbc177114ff74fa06d42548e6da2b1259e9968fd6daed90ee6d3fd78" name="ibmswtpm2-debugsource" arch="s390x">
  <version epoch="0" ver="183+2024+03+27" rel="50.9"/>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1597665600">- Update to upstream version 1637
  * fixes build of ibmtss 1.5.0
  * Refresh makefile.patch
  * Drop upstreamed patches
  - ibmswtpm2-fix-uninitialized.patch
  - ibmswtpm2-fix-empty-decrypt.patch
  * Fix use of uninitialized value:
    + ibmswtpm2-TcpServerPosix-Fix-use-of-uninitialized-value.patch
    + ibmswtpm2-NVDynamic-Fix-use-of-uninitialized-value.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1598961600">- Fix ppc32 build.
  + ibmswtpm2-fix-ppc32.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1664020800">- update to 1682:
  * tpm: Fix cast in BnSetBit.
  * tpm2: Fix size check in CryptSecretDecrypt
  * tpm: Port Windows code for OpenSSL 3.0
  * tpm: Update to openssl 3.0.2
  * tpm: Add command and handle tracing
  * tpm: Update for openssl 3.0.1
  * tpm: Add ECC encrypt and decrypt commands
  * Fix compilation on RISC-V
  * PlatformSvc: return error on control socket failure
  * main: set a return code if StartTcpServer fails
  * tpm: Add all updates to TPM specification 164.
- drop ibmswtpm2-fix-ppc32.patch (upstream)
- makefile.patch: refresh</changelog>
  <changelog author="Otto Hollmann &lt;otto.hollmann@suse.com&gt;" date="1678881600">- Add support for OpenSSL 3.1.x
  * Add ibmswtpm2-OpenSSL-3.1.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1701432000">- Update to version 164-2020-192.2
  * Implement the RSA 5 primes optimization.
  * Check command size for int32 overflow.
  * Add support for OpenSSL 3.1.x
  * Do not accept a NULL signKey in TPM2_CertifyX509
  * Add Nuvoton to gcc makefile
- New project URL - move to github
- Drop usptreamed ibmswtpm2-OpenSSL-3.1.patch</changelog>
  <changelog author="Otto Hollmann &lt;otto.hollmann@suse.com&gt;" date="1702382400">- Add support for OpenSSL 3.2.x
  * Add ibmswtpm2-Add-support-for-OpenSSL-3.2.x.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1712232000">- Update to version 183-2024-03-27
  * tpm: Updates to rev 180
- Drop obsolete patches
  * Drop ibmswtpm2-NVDynamic-Fix-use-of-uninitialized-value.patch - addressed upstream
  * Drop ibmswtpm2-Add-support-for-OpenSSL-3.2.x.patch - merged upstream</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1712664000">- Package LICENSE file.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1743768000">- Fix build with OpenSSL 3.5: [bsc#1241037]
  * Fails with "error Untested OpenSSL version" when building for
    the upcoming OpenSSL version 3.5.
  * Add ibmswtpm2-Build-with-OpenSSL-3.5.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1759492800">- Fix build with OpenSSL 3.6: [bsc#1250338]
  * tpm: Update to OpenSSL 3.6 [gh#kgoldman/ibmswtpm2#22]
  * Rename ibmswtpm2-Build-with-OpenSSL-3.5.patch to
    ibmswtpm2-Build-with-New-OpenSSL.patch</changelog>
</package>
<package pkgid="3ec2cc2584b388514fc2fe3381aa42df0be18da81c3e7e9cb34729d0bc195a013d3ef15edd52b26f67ca894dca5b3c3e7b018a5c0584dc7b58e5d6119c24c25d" name="ibmtss" arch="s390x">
  <version epoch="0" ver="2.4.1" rel="63.8"/>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1597665600">- Update to upstream version 1.5.0 (jsc#SLE-13828).
- Fix build warning due to -O0
  + ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- Fix uninitialized variable warning
  + ibmtss-certifyx509-Fix-uninitialized-variable.patch</changelog>
  <changelog author="Pedro Monreal Gonzalez &lt;pmonreal@suse.com&gt;" date="1601553600">- Regression fix:
  * utils: fix ABI break caused by additional argument to -rsa
  * https://sourceforge.net/p/ibmtpm20tss/mailman/message/37119441/
- Add ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1611662400">- Update to upstream version 1.6.0 (jsc#SLE-18268).
- Drop patches from this release
  - ibmtss-certifyx509-Fix-uninitialized-variable.patch
  - ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1637841600">- Fix certificate list, run all tests.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1667995200">- Build with OpenSSL 3.0 deprecated functions until fixed upstream
  in the next version update [bsc#1205042]
  * ibmtss-openssl3-deprecation.patch
- Add upstream patches to fix build with OpenSSL 3.0
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1701345600">- Update to 2.1.1:
  * Add man page for tpmproxy.
- Update to 2.1.0:
  * Parse new IMA event log template data fields.
  * Add option to verify IMA template data
  * Correct minor regression test script typos.
- Update to 2.0.0
  * Expand TPMU_SENSITIVE_COMPOSITE to handle HW TPMs that return 5
    RSA primes.  This is an ABI (not API) break.
  * Add support for TPM2_ECC_Encrypt and TPM2_ECC_Decrypt
  * Add more EFI event log handlers and event tracing.
  * SW TPM test CA now uses SHA-256, not the deprecated SHA-1.
  * Port tpmproxy for TPM 2.0 to Linux and Windows.
  * Add many new EK root certificates.
  * Remove OpenSSL functions deprecated in 3.x.
  * Fix TSS bug when using encrypt and decrypt in a PWAP session.
  * Add build flag to suppress SHA-1.
- Remove patches fixed upstream:
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch
  * ibmtss-openssl3-deprecation.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1729512000">- Update to 2.4.0:
  * Add support for EK intermediate certificates
  * Support different IMA log digest algorithms
  * add regtest
  * html documentation
- Refresh ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- tss-Commit-changelog-and-autotools-version-update.patch
- utils-Update-.so-version-to-2.4.patch</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1733227200">- Add ibmtss-2.4.0-fix-FTBFS-2026.patch to fix tests after 2026 (boo#1102840)</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1740484800">- Update to 2.4.1:
  * Issue new test EK CA root certificates with a longer validity period.
  * Remove patches upstream:
  - tss-Commit-changelog-and-autotools-version-update.patch
  - utils-Update-.so-version-to-2.4.patch
  - ibmtss-2.4.0-fix-FTBFS-2026.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1754481600">- Do not ship test data (bsc#1239985)</changelog>
</package>
<package pkgid="09c4e2b6d88de55738318d2654a47d8a0b4bc80f2b7af5f9a4e8f72d5c45572c235d28c557a4afc9c4865df8561ff3bf0121a88ed64ee137d9a5e5e34241a0b7" name="ibmtss" arch="src">
  <version epoch="0" ver="2.4.1" rel="63.8"/>
  <changelog author="jengelh@inai.de" date="1526644800">- Fix RPM groups</changelog>
  <changelog author="msuchanek@suse.com" date="1526990400">- Add post/postun ldconfig call</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1562241600">- Update to v1047 (FATE#327307, jsc#SLE-6593, jsc#SLE-9179).
  - now supports autotools
  - supports library versioning
  - installs tools with program prefx
  - remove binary tool wrapper
  - remove makefile.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1562587200">- Remove .la files</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1565352000">- Don't install duplicate headers</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1565784000">- Remove installed .cvsignore file
- Don't create already created directory</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1566648000">- Disable static libs (standard openSUSE behavior)</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1580472000">- Update to upstream version 1.3.0
- copy tpm device permission handling udev rule from tpm2-0-tss
- depend on user(tss) (boo#1162360).</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1584964800">- Fix dependencies for epoch, remove useless define.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1585310400">- Don't mess with Epoch: in the long run it can't but cause
  problems. Upstreams that don't understand the meaning of version
  numbers can't be helped with Epoch. Let's rely on the distro
  features for dist-upgrade (that has no problem with a 'version
  downgrade'.</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1597665600">- Update to upstream version 1.5.0 (jsc#SLE-13828).
- Fix build warning due to -O0
  + ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- Fix uninitialized variable warning
  + ibmtss-certifyx509-Fix-uninitialized-variable.patch</changelog>
  <changelog author="Pedro Monreal Gonzalez &lt;pmonreal@suse.com&gt;" date="1601553600">- Regression fix:
  * utils: fix ABI break caused by additional argument to -rsa
  * https://sourceforge.net/p/ibmtpm20tss/mailman/message/37119441/
- Add ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1611662400">- Update to upstream version 1.6.0 (jsc#SLE-18268).
- Drop patches from this release
  - ibmtss-certifyx509-Fix-uninitialized-variable.patch
  - ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1637841600">- Fix certificate list, run all tests.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1667995200">- Build with OpenSSL 3.0 deprecated functions until fixed upstream
  in the next version update [bsc#1205042]
  * ibmtss-openssl3-deprecation.patch
- Add upstream patches to fix build with OpenSSL 3.0
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1701345600">- Update to 2.1.1:
  * Add man page for tpmproxy.
- Update to 2.1.0:
  * Parse new IMA event log template data fields.
  * Add option to verify IMA template data
  * Correct minor regression test script typos.
- Update to 2.0.0
  * Expand TPMU_SENSITIVE_COMPOSITE to handle HW TPMs that return 5
    RSA primes.  This is an ABI (not API) break.
  * Add support for TPM2_ECC_Encrypt and TPM2_ECC_Decrypt
  * Add more EFI event log handlers and event tracing.
  * SW TPM test CA now uses SHA-256, not the deprecated SHA-1.
  * Port tpmproxy for TPM 2.0 to Linux and Windows.
  * Add many new EK root certificates.
  * Remove OpenSSL functions deprecated in 3.x.
  * Fix TSS bug when using encrypt and decrypt in a PWAP session.
  * Add build flag to suppress SHA-1.
- Remove patches fixed upstream:
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch
  * ibmtss-openssl3-deprecation.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1729512000">- Update to 2.4.0:
  * Add support for EK intermediate certificates
  * Support different IMA log digest algorithms
  * add regtest
  * html documentation
- Refresh ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- tss-Commit-changelog-and-autotools-version-update.patch
- utils-Update-.so-version-to-2.4.patch</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1733227200">- Add ibmtss-2.4.0-fix-FTBFS-2026.patch to fix tests after 2026 (boo#1102840)</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1740484800">- Update to 2.4.1:
  * Issue new test EK CA root certificates with a longer validity period.
  * Remove patches upstream:
  - tss-Commit-changelog-and-autotools-version-update.patch
  - utils-Update-.so-version-to-2.4.patch
  - ibmtss-2.4.0-fix-FTBFS-2026.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1754481600">- Do not ship test data (bsc#1239985)</changelog>
</package>
<package pkgid="26f64a78551aaea595514b94d87570ea6927eed68038ca334e40802f113f483733e3ccc4c956c7d6796035197d8d2163521d8c19b6240f7b20abbb53ba689b5a" name="ibmtss-base" arch="noarch">
  <version epoch="0" ver="2.4.1" rel="63.8"/>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1597665600">- Update to upstream version 1.5.0 (jsc#SLE-13828).
- Fix build warning due to -O0
  + ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- Fix uninitialized variable warning
  + ibmtss-certifyx509-Fix-uninitialized-variable.patch</changelog>
  <changelog author="Pedro Monreal Gonzalez &lt;pmonreal@suse.com&gt;" date="1601553600">- Regression fix:
  * utils: fix ABI break caused by additional argument to -rsa
  * https://sourceforge.net/p/ibmtpm20tss/mailman/message/37119441/
- Add ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1611662400">- Update to upstream version 1.6.0 (jsc#SLE-18268).
- Drop patches from this release
  - ibmtss-certifyx509-Fix-uninitialized-variable.patch
  - ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1637841600">- Fix certificate list, run all tests.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1667995200">- Build with OpenSSL 3.0 deprecated functions until fixed upstream
  in the next version update [bsc#1205042]
  * ibmtss-openssl3-deprecation.patch
- Add upstream patches to fix build with OpenSSL 3.0
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1701345600">- Update to 2.1.1:
  * Add man page for tpmproxy.
- Update to 2.1.0:
  * Parse new IMA event log template data fields.
  * Add option to verify IMA template data
  * Correct minor regression test script typos.
- Update to 2.0.0
  * Expand TPMU_SENSITIVE_COMPOSITE to handle HW TPMs that return 5
    RSA primes.  This is an ABI (not API) break.
  * Add support for TPM2_ECC_Encrypt and TPM2_ECC_Decrypt
  * Add more EFI event log handlers and event tracing.
  * SW TPM test CA now uses SHA-256, not the deprecated SHA-1.
  * Port tpmproxy for TPM 2.0 to Linux and Windows.
  * Add many new EK root certificates.
  * Remove OpenSSL functions deprecated in 3.x.
  * Fix TSS bug when using encrypt and decrypt in a PWAP session.
  * Add build flag to suppress SHA-1.
- Remove patches fixed upstream:
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch
  * ibmtss-openssl3-deprecation.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1729512000">- Update to 2.4.0:
  * Add support for EK intermediate certificates
  * Support different IMA log digest algorithms
  * add regtest
  * html documentation
- Refresh ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- tss-Commit-changelog-and-autotools-version-update.patch
- utils-Update-.so-version-to-2.4.patch</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1733227200">- Add ibmtss-2.4.0-fix-FTBFS-2026.patch to fix tests after 2026 (boo#1102840)</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1740484800">- Update to 2.4.1:
  * Issue new test EK CA root certificates with a longer validity period.
  * Remove patches upstream:
  - tss-Commit-changelog-and-autotools-version-update.patch
  - utils-Update-.so-version-to-2.4.patch
  - ibmtss-2.4.0-fix-FTBFS-2026.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1754481600">- Do not ship test data (bsc#1239985)</changelog>
</package>
<package pkgid="a035bab81add0baba6f570daaf386902f4eda706fe9fc4694a44bad8bdcff49ada31f03fda1b64772aa0e37bab7e9bf5961146c2fa4de5e787beed60e0c8bfad" name="ibmtss-debuginfo" arch="s390x">
  <version epoch="0" ver="2.4.1" rel="63.8"/>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1597665600">- Update to upstream version 1.5.0 (jsc#SLE-13828).
- Fix build warning due to -O0
  + ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- Fix uninitialized variable warning
  + ibmtss-certifyx509-Fix-uninitialized-variable.patch</changelog>
  <changelog author="Pedro Monreal Gonzalez &lt;pmonreal@suse.com&gt;" date="1601553600">- Regression fix:
  * utils: fix ABI break caused by additional argument to -rsa
  * https://sourceforge.net/p/ibmtpm20tss/mailman/message/37119441/
- Add ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1611662400">- Update to upstream version 1.6.0 (jsc#SLE-18268).
- Drop patches from this release
  - ibmtss-certifyx509-Fix-uninitialized-variable.patch
  - ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1637841600">- Fix certificate list, run all tests.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1667995200">- Build with OpenSSL 3.0 deprecated functions until fixed upstream
  in the next version update [bsc#1205042]
  * ibmtss-openssl3-deprecation.patch
- Add upstream patches to fix build with OpenSSL 3.0
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1701345600">- Update to 2.1.1:
  * Add man page for tpmproxy.
- Update to 2.1.0:
  * Parse new IMA event log template data fields.
  * Add option to verify IMA template data
  * Correct minor regression test script typos.
- Update to 2.0.0
  * Expand TPMU_SENSITIVE_COMPOSITE to handle HW TPMs that return 5
    RSA primes.  This is an ABI (not API) break.
  * Add support for TPM2_ECC_Encrypt and TPM2_ECC_Decrypt
  * Add more EFI event log handlers and event tracing.
  * SW TPM test CA now uses SHA-256, not the deprecated SHA-1.
  * Port tpmproxy for TPM 2.0 to Linux and Windows.
  * Add many new EK root certificates.
  * Remove OpenSSL functions deprecated in 3.x.
  * Fix TSS bug when using encrypt and decrypt in a PWAP session.
  * Add build flag to suppress SHA-1.
- Remove patches fixed upstream:
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch
  * ibmtss-openssl3-deprecation.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1729512000">- Update to 2.4.0:
  * Add support for EK intermediate certificates
  * Support different IMA log digest algorithms
  * add regtest
  * html documentation
- Refresh ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- tss-Commit-changelog-and-autotools-version-update.patch
- utils-Update-.so-version-to-2.4.patch</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1733227200">- Add ibmtss-2.4.0-fix-FTBFS-2026.patch to fix tests after 2026 (boo#1102840)</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1740484800">- Update to 2.4.1:
  * Issue new test EK CA root certificates with a longer validity period.
  * Remove patches upstream:
  - tss-Commit-changelog-and-autotools-version-update.patch
  - utils-Update-.so-version-to-2.4.patch
  - ibmtss-2.4.0-fix-FTBFS-2026.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1754481600">- Do not ship test data (bsc#1239985)</changelog>
</package>
<package pkgid="6b61d2e4c17579b626c65773a643b4ccff3b3079f5eac9da24f0f7f93ff4adb422cc58117e804beab86cede5f25244f858edad897e259612e6bcee8171f908ad" name="ibmtss-debugsource" arch="s390x">
  <version epoch="0" ver="2.4.1" rel="63.8"/>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1597665600">- Update to upstream version 1.5.0 (jsc#SLE-13828).
- Fix build warning due to -O0
  + ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- Fix uninitialized variable warning
  + ibmtss-certifyx509-Fix-uninitialized-variable.patch</changelog>
  <changelog author="Pedro Monreal Gonzalez &lt;pmonreal@suse.com&gt;" date="1601553600">- Regression fix:
  * utils: fix ABI break caused by additional argument to -rsa
  * https://sourceforge.net/p/ibmtpm20tss/mailman/message/37119441/
- Add ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1611662400">- Update to upstream version 1.6.0 (jsc#SLE-18268).
- Drop patches from this release
  - ibmtss-certifyx509-Fix-uninitialized-variable.patch
  - ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1637841600">- Fix certificate list, run all tests.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1667995200">- Build with OpenSSL 3.0 deprecated functions until fixed upstream
  in the next version update [bsc#1205042]
  * ibmtss-openssl3-deprecation.patch
- Add upstream patches to fix build with OpenSSL 3.0
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1701345600">- Update to 2.1.1:
  * Add man page for tpmproxy.
- Update to 2.1.0:
  * Parse new IMA event log template data fields.
  * Add option to verify IMA template data
  * Correct minor regression test script typos.
- Update to 2.0.0
  * Expand TPMU_SENSITIVE_COMPOSITE to handle HW TPMs that return 5
    RSA primes.  This is an ABI (not API) break.
  * Add support for TPM2_ECC_Encrypt and TPM2_ECC_Decrypt
  * Add more EFI event log handlers and event tracing.
  * SW TPM test CA now uses SHA-256, not the deprecated SHA-1.
  * Port tpmproxy for TPM 2.0 to Linux and Windows.
  * Add many new EK root certificates.
  * Remove OpenSSL functions deprecated in 3.x.
  * Fix TSS bug when using encrypt and decrypt in a PWAP session.
  * Add build flag to suppress SHA-1.
- Remove patches fixed upstream:
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch
  * ibmtss-openssl3-deprecation.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1729512000">- Update to 2.4.0:
  * Add support for EK intermediate certificates
  * Support different IMA log digest algorithms
  * add regtest
  * html documentation
- Refresh ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- tss-Commit-changelog-and-autotools-version-update.patch
- utils-Update-.so-version-to-2.4.patch</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1733227200">- Add ibmtss-2.4.0-fix-FTBFS-2026.patch to fix tests after 2026 (boo#1102840)</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1740484800">- Update to 2.4.1:
  * Issue new test EK CA root certificates with a longer validity period.
  * Remove patches upstream:
  - tss-Commit-changelog-and-autotools-version-update.patch
  - utils-Update-.so-version-to-2.4.patch
  - ibmtss-2.4.0-fix-FTBFS-2026.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1754481600">- Do not ship test data (bsc#1239985)</changelog>
</package>
<package pkgid="0056f2fd79bf92ceb61bfe71d81fb50d952c4a9640b3eb521ecfb3d1d13c54a92c0f60eb98698f7bac58eacbbc8223fc0e82992ddb2b1a9921027852eb2a634e" name="ibmtss-devel" arch="s390x">
  <version epoch="0" ver="2.4.1" rel="63.8"/>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1597665600">- Update to upstream version 1.5.0 (jsc#SLE-13828).
- Fix build warning due to -O0
  + ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- Fix uninitialized variable warning
  + ibmtss-certifyx509-Fix-uninitialized-variable.patch</changelog>
  <changelog author="Pedro Monreal Gonzalez &lt;pmonreal@suse.com&gt;" date="1601553600">- Regression fix:
  * utils: fix ABI break caused by additional argument to -rsa
  * https://sourceforge.net/p/ibmtpm20tss/mailman/message/37119441/
- Add ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1611662400">- Update to upstream version 1.6.0 (jsc#SLE-18268).
- Drop patches from this release
  - ibmtss-certifyx509-Fix-uninitialized-variable.patch
  - ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1637841600">- Fix certificate list, run all tests.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1667995200">- Build with OpenSSL 3.0 deprecated functions until fixed upstream
  in the next version update [bsc#1205042]
  * ibmtss-openssl3-deprecation.patch
- Add upstream patches to fix build with OpenSSL 3.0
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1701345600">- Update to 2.1.1:
  * Add man page for tpmproxy.
- Update to 2.1.0:
  * Parse new IMA event log template data fields.
  * Add option to verify IMA template data
  * Correct minor regression test script typos.
- Update to 2.0.0
  * Expand TPMU_SENSITIVE_COMPOSITE to handle HW TPMs that return 5
    RSA primes.  This is an ABI (not API) break.
  * Add support for TPM2_ECC_Encrypt and TPM2_ECC_Decrypt
  * Add more EFI event log handlers and event tracing.
  * SW TPM test CA now uses SHA-256, not the deprecated SHA-1.
  * Port tpmproxy for TPM 2.0 to Linux and Windows.
  * Add many new EK root certificates.
  * Remove OpenSSL functions deprecated in 3.x.
  * Fix TSS bug when using encrypt and decrypt in a PWAP session.
  * Add build flag to suppress SHA-1.
- Remove patches fixed upstream:
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch
  * ibmtss-openssl3-deprecation.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1729512000">- Update to 2.4.0:
  * Add support for EK intermediate certificates
  * Support different IMA log digest algorithms
  * add regtest
  * html documentation
- Refresh ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- tss-Commit-changelog-and-autotools-version-update.patch
- utils-Update-.so-version-to-2.4.patch</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1733227200">- Add ibmtss-2.4.0-fix-FTBFS-2026.patch to fix tests after 2026 (boo#1102840)</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1740484800">- Update to 2.4.1:
  * Issue new test EK CA root certificates with a longer validity period.
  * Remove patches upstream:
  - tss-Commit-changelog-and-autotools-version-update.patch
  - utils-Update-.so-version-to-2.4.patch
  - ibmtss-2.4.0-fix-FTBFS-2026.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1754481600">- Do not ship test data (bsc#1239985)</changelog>
</package>
<package pkgid="eb0cda8e992f50d4f452e261243231890b15d914088c34c0a563fbf9c40cdbcf194e90720078149190b3ff02232a96f3c6ad218e793d9dc4059b52f322440e3a" name="ike-scan" arch="s390x">
  <version epoch="0" ver="1.9.5~17~gc74c01f" rel="2.4"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1237550400">* Initial RPM</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1483272000">* spec file cleanup, adding license
  * moving changes to the changes file</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1754740800">- Update to version 1.9.5~17~gc74c01f
  * Remove test string dependence on C library
  * Improvements to build system
  * Fix printf format strings
- Update to version 1.9.5:
  * Update known Vendor IDs after /0 scan
  * Add an option to bind to a specific interface.
  * Added new backoff pattern for DELL SonicWall Appliance.
  * Added pattern for Cisco IOS 15.0, replaces previous IOS 12.4T
    pattern.
  * Disallow both --aggressive and --ikev2 options.
  * Update strongSwan VID fingerprints
  * Use payload type 43 for IKEv2 Vendor ID payloads.
  * Add new ID types from RFCs 5996, RFC 5282, RFC 5114, and RFC
    6467.
  * Minor change to Firewall-1 NGX vendor ID name.
  * Added support for ECP Diffie Hellman groups 19, 20 and 21.
  * Added new attribute values to maps in isakmp.c from RFC 4754,
    RFC 5903 and RFC 6407.
  * Changed GPL license text in file headers from GPL v2 to GPL v3
- Update to version 1.9.4:
  * Update Vendor Fingerprints
  * Added additional vendor IDs discovered by Jesper Kückelhahn
    while developing script for nmap based on ike-scan.
  * Added ikev2 incorrect vendor id payload type.
- Update to version 1.9.3:
  * Improve handling of --bandwidth and --interval options:
    Allow either upper or lowercase multiplier letters and give
    an error if an unknown multiplier character is used.
  * Removed syslog functionality
- Update to version 1.9.2:
  * Enable compiler protection flags if available
  * The function that converts strings to numbers is now stricter,
    and no longer permits any invalid characters.
  * Updated strongSwan 2.8.x VIDs
  * Added tests for error conditions.
  * Added IOS 12.4 to backoff patterns file.
  * Modified AIX backoff pattern.
- Update to version 1.9.1:
  * Two new strongSwan VIDs</changelog>
</package>
<package pkgid="b1bbebed12eab89605165337e99febe2734b7e26953c20102fa69ef3ab347accdca2a23a862ffcba995af65c15345ed3315f643cf9354b85efc192e2c36527b8" name="ike-scan" arch="src">
  <version epoch="0" ver="1.9.5~17~gc74c01f" rel="2.4"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1237550400">* Initial RPM</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1483272000">* spec file cleanup, adding license
  * moving changes to the changes file</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1754740800">- Update to version 1.9.5~17~gc74c01f
  * Remove test string dependence on C library
  * Improvements to build system
  * Fix printf format strings
- Update to version 1.9.5:
  * Update known Vendor IDs after /0 scan
  * Add an option to bind to a specific interface.
  * Added new backoff pattern for DELL SonicWall Appliance.
  * Added pattern for Cisco IOS 15.0, replaces previous IOS 12.4T
    pattern.
  * Disallow both --aggressive and --ikev2 options.
  * Update strongSwan VID fingerprints
  * Use payload type 43 for IKEv2 Vendor ID payloads.
  * Add new ID types from RFCs 5996, RFC 5282, RFC 5114, and RFC
    6467.
  * Minor change to Firewall-1 NGX vendor ID name.
  * Added support for ECP Diffie Hellman groups 19, 20 and 21.
  * Added new attribute values to maps in isakmp.c from RFC 4754,
    RFC 5903 and RFC 6407.
  * Changed GPL license text in file headers from GPL v2 to GPL v3
- Update to version 1.9.4:
  * Update Vendor Fingerprints
  * Added additional vendor IDs discovered by Jesper Kückelhahn
    while developing script for nmap based on ike-scan.
  * Added ikev2 incorrect vendor id payload type.
- Update to version 1.9.3:
  * Improve handling of --bandwidth and --interval options:
    Allow either upper or lowercase multiplier letters and give
    an error if an unknown multiplier character is used.
  * Removed syslog functionality
- Update to version 1.9.2:
  * Enable compiler protection flags if available
  * The function that converts strings to numbers is now stricter,
    and no longer permits any invalid characters.
  * Updated strongSwan 2.8.x VIDs
  * Added tests for error conditions.
  * Added IOS 12.4 to backoff patterns file.
  * Modified AIX backoff pattern.
- Update to version 1.9.1:
  * Two new strongSwan VIDs</changelog>
</package>
<package pkgid="ba84d256c2e026790242da1b5ffcb13a94056cc423e9f680ec9548b40d2d46152ad3e98441c43aa95cf0d2fd583e23804ab99a8bfade368812f64b7c8155c1ce" name="ike-scan-debuginfo" arch="s390x">
  <version epoch="0" ver="1.9.5~17~gc74c01f" rel="2.4"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1237550400">* Initial RPM</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1483272000">* spec file cleanup, adding license
  * moving changes to the changes file</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1754740800">- Update to version 1.9.5~17~gc74c01f
  * Remove test string dependence on C library
  * Improvements to build system
  * Fix printf format strings
- Update to version 1.9.5:
  * Update known Vendor IDs after /0 scan
  * Add an option to bind to a specific interface.
  * Added new backoff pattern for DELL SonicWall Appliance.
  * Added pattern for Cisco IOS 15.0, replaces previous IOS 12.4T
    pattern.
  * Disallow both --aggressive and --ikev2 options.
  * Update strongSwan VID fingerprints
  * Use payload type 43 for IKEv2 Vendor ID payloads.
  * Add new ID types from RFCs 5996, RFC 5282, RFC 5114, and RFC
    6467.
  * Minor change to Firewall-1 NGX vendor ID name.
  * Added support for ECP Diffie Hellman groups 19, 20 and 21.
  * Added new attribute values to maps in isakmp.c from RFC 4754,
    RFC 5903 and RFC 6407.
  * Changed GPL license text in file headers from GPL v2 to GPL v3
- Update to version 1.9.4:
  * Update Vendor Fingerprints
  * Added additional vendor IDs discovered by Jesper Kückelhahn
    while developing script for nmap based on ike-scan.
  * Added ikev2 incorrect vendor id payload type.
- Update to version 1.9.3:
  * Improve handling of --bandwidth and --interval options:
    Allow either upper or lowercase multiplier letters and give
    an error if an unknown multiplier character is used.
  * Removed syslog functionality
- Update to version 1.9.2:
  * Enable compiler protection flags if available
  * The function that converts strings to numbers is now stricter,
    and no longer permits any invalid characters.
  * Updated strongSwan 2.8.x VIDs
  * Added tests for error conditions.
  * Added IOS 12.4 to backoff patterns file.
  * Modified AIX backoff pattern.
- Update to version 1.9.1:
  * Two new strongSwan VIDs</changelog>
</package>
<package pkgid="c3de218b5476b78bb8cc8781ba87957f09bc67e9cf1e9863f6b79a22a5b4f41e30e4c96abf954130b0cf0dd4721dba864f3ee21a87d08ac85042bf16f8123513" name="ike-scan-debugsource" arch="s390x">
  <version epoch="0" ver="1.9.5~17~gc74c01f" rel="2.4"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1237550400">* Initial RPM</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1483272000">* spec file cleanup, adding license
  * moving changes to the changes file</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1754740800">- Update to version 1.9.5~17~gc74c01f
  * Remove test string dependence on C library
  * Improvements to build system
  * Fix printf format strings
- Update to version 1.9.5:
  * Update known Vendor IDs after /0 scan
  * Add an option to bind to a specific interface.
  * Added new backoff pattern for DELL SonicWall Appliance.
  * Added pattern for Cisco IOS 15.0, replaces previous IOS 12.4T
    pattern.
  * Disallow both --aggressive and --ikev2 options.
  * Update strongSwan VID fingerprints
  * Use payload type 43 for IKEv2 Vendor ID payloads.
  * Add new ID types from RFCs 5996, RFC 5282, RFC 5114, and RFC
    6467.
  * Minor change to Firewall-1 NGX vendor ID name.
  * Added support for ECP Diffie Hellman groups 19, 20 and 21.
  * Added new attribute values to maps in isakmp.c from RFC 4754,
    RFC 5903 and RFC 6407.
  * Changed GPL license text in file headers from GPL v2 to GPL v3
- Update to version 1.9.4:
  * Update Vendor Fingerprints
  * Added additional vendor IDs discovered by Jesper Kückelhahn
    while developing script for nmap based on ike-scan.
  * Added ikev2 incorrect vendor id payload type.
- Update to version 1.9.3:
  * Improve handling of --bandwidth and --interval options:
    Allow either upper or lowercase multiplier letters and give
    an error if an unknown multiplier character is used.
  * Removed syslog functionality
- Update to version 1.9.2:
  * Enable compiler protection flags if available
  * The function that converts strings to numbers is now stricter,
    and no longer permits any invalid characters.
  * Updated strongSwan 2.8.x VIDs
  * Added tests for error conditions.
  * Added IOS 12.4 to backoff patterns file.
  * Modified AIX backoff pattern.
- Update to version 1.9.1:
  * Two new strongSwan VIDs</changelog>
</package>
<package pkgid="ce6be022d8c42f0668457d30520d6cca114ac6075ddf6e93492066da0912f481535ea18c2f0602efc80d9ed670426a1560b19d92d6270763c8051790f0682b68" name="ima-evm-utils" arch="src">
  <version epoch="0" ver="1.6.2" rel="75.18"/>
  <changelog author="meissner@suse.com" date="1510142400">- ima-evm-utils-openssl1.patch: allow building against openssl 1.1 (bsc#1066947)</changelog>
  <changelog author="mpluskal@suse.com" date="1511265600">- Small spec file cleanup with spec-cleaner</changelog>
  <changelog author="pvorel@suse.cz" date="1521201600">- Update to version 1.1
  * Support the new openssl 1.1 api
  * Support for validating multiple pcrs
  * Verify the measurement list signature based on the list digest
  * Verify the "ima-sig" measurement list using multiple keys
  * Fixed parsing the measurement template data field length
  * Portable &amp; immutable EVM signatures (new format)
  * Multiple fixes that have been lingering in the next branch. Some
    are for experimental features that are not yet supported in the
    kernel.
- Drop ima-evm-utils-openssl1.patch (not needed any more as IMA got
  backward compatible support for openssl 1.1).</changelog>
  <changelog author="meissner@suse.com" date="1536753600">- ima-evm-utils-xattr.patch: xattr.h is now libattr.h</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1564488000">- Update to version 1.2.1 (included changes of unreleased v1.2)
  version 1.2 new features:
  * Generate EVM signatures based on the specified hash algorithm
  * include "security.apparmor" in EVM signature
  * Add support for writing &amp; verifying "user.xxxx" xattrs for testing
  * Support Strebog/Gost hash functions
  * Add OpenSSL engine support
  * Use of EVP_PKEY OpenSSL API to generate/verify v2 signatures
  * Support verifying multiple signatures at once
  * Support new template "buf" field and warn about other unknown fields
  * Improve OpenSSL error reporting
  * Support reading TPM 2.0 PCRs using tsspcrread
  Bug fixes and code cleanup:
  * Update manpage stylesheet detection
  * Fix xattr.h include file
  * On error when reading TPM PCRs, don't log gargabe
  * Properly return keyid string to calc_keyid_v1/v2 callers, caused by
  limiting keyid output to verbose mode
  * Fix hash buffer overflow caused by EVM support for larger hashes,
  defined MAX_DIGEST_SIZE and MAX_SIGNATURE_SIZE, and added "asserts".
  * Linked with libcrypto instead of OpenSSL
  * Updated Autotools, replacing INCLUDES with AM_CPPFLAGS
  * Include new "hash-info.gen" in tar
  * Log the hash algorithm, not just the hash value
  * Fixed memory leaks in: EV_MD_CTX, init_public_keys
  * Fixed other warnings/bugs discovered by clang, coverity
  * Remove indirect calls in verify_hash() to improve code readability
  * Don't fallback to using sha1
  * Namespace some too generic object names
  * Make functions/arrays static if possible
- Upstream bumped soname to 1.0.0 in v1.2
- Drop ima-evm-utils-xattr.patch and ima-evm-utils-fix-docbook-xsl-directory.patch (included in v1.2)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1595419200">- Update to version 1.3
  version 1.3 new features:
  * NEW ima-evm-utils regression test infrastructure with two initial
  tests:
  - ima_hash.test: calculate/verify different crypto hash algorithms
  - sign_verify.test: EVM and IMA sign/verify signature tests
  * TPM 2.0 support
  - Calculate the new per TPM 2.0 bank template data digest
  - Support original padding the SHA1 template data digest
  - Compare ALL the re-calculated TPM 2.0 bank PCRs against the
  TPM 2.0 bank PCR values
  - Calculate the per TPM bank "boot_aggregate" values, including
  PCRs 8 &amp; 9 in calculation
  - Support reading the per TPM 2.0 Bank PCRs using Intel's TSS
  - boot_aggregate.test: compare the calculated "boot_aggregate"
  values with the "boot_aggregate" value included in the IMA
  measurement.
  * TPM 1.2 support
  - Additionally support reading the TPM 1.2 PCRs from a supplied file
  ("--pcrs" option)
  * Based on original IMA LTP and standalone version support
  - Calculate the TPM 1.2 "boot_aggregate" based on the exported
  TPM 1.2 BIOS event log.
  - In addition to verifying the IMA measurement list against the
  the TPM PCRs, verify the IMA template data digest against the
  template data.  (Based on LTP "--verify" option.)
  - Ignore file measurement violations while verifying the IMA
  measurment list. (Based on LTP "--validate" option.)
  - Verify the file data signature included in the measurement list
  based on the file hash also included in the measurement list
  (--verify-sig)
  - Support original "ima" template (mixed templates not supported)
  * Support "sm3" crypto name
  Bug fixes and code cleanup:
  * Don't exit with -1 on failure, exit with 125
  * On signature verification failure, include pathname.
  * Provide minimal hash_info.h file in case one doesn't exist, needed
  by the ima-evm-utils regression tests.
  * On systems with TPM 1.2, skip "boot_aggregate.test" using sample logs
  * Fix hash_algo type comparison mismatch
  * Simplify/clean up code
  * Address compiler complaints and failures
  * Fix memory allocations and leaks
  * Sanity check provided input files are regular files
  * Revert making "tsspcrread" a compile build time decision.
  * Limit additional messages based on log level (-v)
- Add patch 0001-pcr_tss-Fix-compilation-for-old-compilers.patch
- Upstream bumped soname to 2.0.0
- Add tpm2-0-tss-devel for Tumbleweed as build dependency, for the rest ibmtss
  as runtime dependency (needed for for reading PCR in ima_boot_aggregate cmd;
  better to use libtss2-esys and libtss2-rc than require tsspcrread binary in
  runtime, but tpm2-0-tss-devel is available only for Tumbleweed) + the same
  logic as runtime dependency for devel package
- Mark COPYING as %license</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1595419201">- Fixes from previous SR (reported by fvogt):
  * Move ibmtss runtime dependency to evmctl package
  * Remove dependencies to devel package (should not be needed)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1595419202">- Remove suse_version check for tpm2-0-tss-devel as the package is available
  for back as far as SLE 12 SP2 and respective openSUSE versions (also check
  was wrong, should have been 1500).</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1595505600">- Use %autosetup -p1</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1597406400">- Update to version 1.3.1
  * "--pcrs" support for per crypto algorithm
  * Drop/rename "ima_measurement" options
  * Moved this summary from "Changelog" to "NEWS", removing
  requirement for GNU empty files
  * Distro build fixes
  * Remove 0001-pcr_tss-Fix-compilation-for-old-compilers.patch (from this
    release)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1601553600">- Fix missing new line in help
  (0001-help-Add-missing-new-line-for-ignore-violations.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1603972800">- Update to version 1.3.2
  * Bugfixes: importing keys
  * NEW: Docker based travis distro testing
  * Travis bugfixes, code cleanup, software version update,
  and script removal
  * Initial travis testing
- Remove 0001-help-Add-missing-new-line-for-ignore-violations.patch
  (patch from this release)
- Add make check + dependencies (getfattr =&gt; attr, xxd =&gt; vim)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1636113600">- Update to version 1.4
  * Elliptic curve support and tests
  * PKCS11 support and tests
  * Ability to manually specify the keyid included in the IMA xattr
  * Improve IMA measurement list per TPM bank verification
  * Linking with IBM TSS
  * Set default hash algorithm in package configuration
  * (Minimal) support and test EVM portable signatures
  * CI testing:
  * Refresh and include new distros
  * Podman support
  * GitHub Actions
  * Limit "sudo" usage
  * Misc bug fixes and code cleanup
  * Fix static analysis bug reports, memory leaks
  * Remove experimental code that was never upstreamed in the kernel
  * Use unsigned variable, remove unused variables, etc
- Upstream bumped soname to 3.0.0</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- switch to use https urls</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1678449600">- Update to version 1.5
  * CI changes:
  * New: UML kernel testing environment
  * Support for running specific test(s)
  * Update distros
  * Update software release versions
  * New features:
  * Signing fs-verity signatures
  * Reading TPM 2.0 PCRs via sysfs interface
  * New tests:
  * Missing IMA mmapped file measurements
  * Overlapping IMA policy rules
  * EVM portable signatures
  * fs-verity file measurements in the IMA measurement list
  * Build and library changes:
  * OpenSSL 3.0 version related changes
  * New configuration options: --disable-engine, --enable-sigv1
  * Deprecate IMA signature v1 format
  * Misc bug fixes and code cleanup:
  * memory leaks, bounds checking, use after free
  * Fix and update test output
  * Add missing sanity checks
  * Documentation:
  * Store the sourceforge ima-evm-utils wiki for historical
  purposes.
- Upstream bumped soname to 4.0.0
- Add BuildRequires: e2fsprogs util-linux (required by tests, which are mandatory)
- /usr/sbin to PATH (0001-fsverity.test-Add-usr-sbin-into-PATH.patch, sent to upstream ML)</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1702641600">- Update download url.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720440000">- Update to version 1.6
  https://lore.kernel.org/linux-integrity/20240703164454.61614-1-zohar@linux.ibm.com/
- Upstream bumped soname to 5.0.0
- Upstream changed license to GPL-2.0-or-later (evmctl), LGPL-2.0-or-later
  (libimaevm + devel package), and GPL-2.0-or-later WITH Linux-syscall-note
  exception (both)
  https://github.com/linux-integrity/ima-evm-utils/issues/4
  (mention both GPL and LGPL and add specific license to subpackages)
- Remove patch from upstream (0001-fsverity.test-Add-usr-sbin-into-PATH.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720699200">- Add LicenseRef-GPL-2.0-with-openssl-exception to License: (upstream has not
  yet created appropriate exception in SPDX).</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720785600">- Update project source URL.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1725278400">- Update to version 1.6.2
  https://github.com/linux-integrity/ima-evm-utils/blob/v1.6.2/NEWS
- Remove LicenseRef-GPL-2.0-with-openssl-exception (no need due relicensing of
  OpenSSL 3 or later to the Apache 2 license
  https://github.com/linux-integrity/ima-evm-utils/commit/4a4c762c8e3cbbff5f41c682deb026d22440454d )
- Upstream added COPYING (again) and COPYING.LGPL (new), add them to %license.</changelog>
</package>
<package pkgid="c3767909ca68c2192fdb490e7bfb87c6c027e28347cacb98493b2db0034a2f0613a7b36c61d3365f2cd389c6e4ff2450dde879435ef0dee52e2cb5ec37a1429b" name="ima-evm-utils-debuginfo" arch="s390x">
  <version epoch="0" ver="1.6.2" rel="75.18"/>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1601553600">- Fix missing new line in help
  (0001-help-Add-missing-new-line-for-ignore-violations.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1603972800">- Update to version 1.3.2
  * Bugfixes: importing keys
  * NEW: Docker based travis distro testing
  * Travis bugfixes, code cleanup, software version update,
  and script removal
  * Initial travis testing
- Remove 0001-help-Add-missing-new-line-for-ignore-violations.patch
  (patch from this release)
- Add make check + dependencies (getfattr =&gt; attr, xxd =&gt; vim)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1636113600">- Update to version 1.4
  * Elliptic curve support and tests
  * PKCS11 support and tests
  * Ability to manually specify the keyid included in the IMA xattr
  * Improve IMA measurement list per TPM bank verification
  * Linking with IBM TSS
  * Set default hash algorithm in package configuration
  * (Minimal) support and test EVM portable signatures
  * CI testing:
  * Refresh and include new distros
  * Podman support
  * GitHub Actions
  * Limit "sudo" usage
  * Misc bug fixes and code cleanup
  * Fix static analysis bug reports, memory leaks
  * Remove experimental code that was never upstreamed in the kernel
  * Use unsigned variable, remove unused variables, etc
- Upstream bumped soname to 3.0.0</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- switch to use https urls</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1678449600">- Update to version 1.5
  * CI changes:
  * New: UML kernel testing environment
  * Support for running specific test(s)
  * Update distros
  * Update software release versions
  * New features:
  * Signing fs-verity signatures
  * Reading TPM 2.0 PCRs via sysfs interface
  * New tests:
  * Missing IMA mmapped file measurements
  * Overlapping IMA policy rules
  * EVM portable signatures
  * fs-verity file measurements in the IMA measurement list
  * Build and library changes:
  * OpenSSL 3.0 version related changes
  * New configuration options: --disable-engine, --enable-sigv1
  * Deprecate IMA signature v1 format
  * Misc bug fixes and code cleanup:
  * memory leaks, bounds checking, use after free
  * Fix and update test output
  * Add missing sanity checks
  * Documentation:
  * Store the sourceforge ima-evm-utils wiki for historical
  purposes.
- Upstream bumped soname to 4.0.0
- Add BuildRequires: e2fsprogs util-linux (required by tests, which are mandatory)
- /usr/sbin to PATH (0001-fsverity.test-Add-usr-sbin-into-PATH.patch, sent to upstream ML)</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1702641600">- Update download url.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720440000">- Update to version 1.6
  https://lore.kernel.org/linux-integrity/20240703164454.61614-1-zohar@linux.ibm.com/
- Upstream bumped soname to 5.0.0
- Upstream changed license to GPL-2.0-or-later (evmctl), LGPL-2.0-or-later
  (libimaevm + devel package), and GPL-2.0-or-later WITH Linux-syscall-note
  exception (both)
  https://github.com/linux-integrity/ima-evm-utils/issues/4
  (mention both GPL and LGPL and add specific license to subpackages)
- Remove patch from upstream (0001-fsverity.test-Add-usr-sbin-into-PATH.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720699200">- Add LicenseRef-GPL-2.0-with-openssl-exception to License: (upstream has not
  yet created appropriate exception in SPDX).</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720785600">- Update project source URL.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1725278400">- Update to version 1.6.2
  https://github.com/linux-integrity/ima-evm-utils/blob/v1.6.2/NEWS
- Remove LicenseRef-GPL-2.0-with-openssl-exception (no need due relicensing of
  OpenSSL 3 or later to the Apache 2 license
  https://github.com/linux-integrity/ima-evm-utils/commit/4a4c762c8e3cbbff5f41c682deb026d22440454d )
- Upstream added COPYING (again) and COPYING.LGPL (new), add them to %license.</changelog>
</package>
<package pkgid="0a9c5d1e9b678db1da410ba57bda340af7e59a3d88b4d3a6e56eae4ab7a7435fbedf5ad6242e817afde12874a42c1984d5d487d4fe833bd370197696151efea8" name="ima-evm-utils-debugsource" arch="s390x">
  <version epoch="0" ver="1.6.2" rel="75.18"/>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1601553600">- Fix missing new line in help
  (0001-help-Add-missing-new-line-for-ignore-violations.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1603972800">- Update to version 1.3.2
  * Bugfixes: importing keys
  * NEW: Docker based travis distro testing
  * Travis bugfixes, code cleanup, software version update,
  and script removal
  * Initial travis testing
- Remove 0001-help-Add-missing-new-line-for-ignore-violations.patch
  (patch from this release)
- Add make check + dependencies (getfattr =&gt; attr, xxd =&gt; vim)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1636113600">- Update to version 1.4
  * Elliptic curve support and tests
  * PKCS11 support and tests
  * Ability to manually specify the keyid included in the IMA xattr
  * Improve IMA measurement list per TPM bank verification
  * Linking with IBM TSS
  * Set default hash algorithm in package configuration
  * (Minimal) support and test EVM portable signatures
  * CI testing:
  * Refresh and include new distros
  * Podman support
  * GitHub Actions
  * Limit "sudo" usage
  * Misc bug fixes and code cleanup
  * Fix static analysis bug reports, memory leaks
  * Remove experimental code that was never upstreamed in the kernel
  * Use unsigned variable, remove unused variables, etc
- Upstream bumped soname to 3.0.0</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- switch to use https urls</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1678449600">- Update to version 1.5
  * CI changes:
  * New: UML kernel testing environment
  * Support for running specific test(s)
  * Update distros
  * Update software release versions
  * New features:
  * Signing fs-verity signatures
  * Reading TPM 2.0 PCRs via sysfs interface
  * New tests:
  * Missing IMA mmapped file measurements
  * Overlapping IMA policy rules
  * EVM portable signatures
  * fs-verity file measurements in the IMA measurement list
  * Build and library changes:
  * OpenSSL 3.0 version related changes
  * New configuration options: --disable-engine, --enable-sigv1
  * Deprecate IMA signature v1 format
  * Misc bug fixes and code cleanup:
  * memory leaks, bounds checking, use after free
  * Fix and update test output
  * Add missing sanity checks
  * Documentation:
  * Store the sourceforge ima-evm-utils wiki for historical
  purposes.
- Upstream bumped soname to 4.0.0
- Add BuildRequires: e2fsprogs util-linux (required by tests, which are mandatory)
- /usr/sbin to PATH (0001-fsverity.test-Add-usr-sbin-into-PATH.patch, sent to upstream ML)</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1702641600">- Update download url.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720440000">- Update to version 1.6
  https://lore.kernel.org/linux-integrity/20240703164454.61614-1-zohar@linux.ibm.com/
- Upstream bumped soname to 5.0.0
- Upstream changed license to GPL-2.0-or-later (evmctl), LGPL-2.0-or-later
  (libimaevm + devel package), and GPL-2.0-or-later WITH Linux-syscall-note
  exception (both)
  https://github.com/linux-integrity/ima-evm-utils/issues/4
  (mention both GPL and LGPL and add specific license to subpackages)
- Remove patch from upstream (0001-fsverity.test-Add-usr-sbin-into-PATH.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720699200">- Add LicenseRef-GPL-2.0-with-openssl-exception to License: (upstream has not
  yet created appropriate exception in SPDX).</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720785600">- Update project source URL.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1725278400">- Update to version 1.6.2
  https://github.com/linux-integrity/ima-evm-utils/blob/v1.6.2/NEWS
- Remove LicenseRef-GPL-2.0-with-openssl-exception (no need due relicensing of
  OpenSSL 3 or later to the Apache 2 license
  https://github.com/linux-integrity/ima-evm-utils/commit/4a4c762c8e3cbbff5f41c682deb026d22440454d )
- Upstream added COPYING (again) and COPYING.LGPL (new), add them to %license.</changelog>
</package>
<package pkgid="3e9a084e53085af9b455cfb5966c25fd9acc2f7c2db834ced6f2d9d1df2aeef15304cf5ef7af1bba90f3e75505d2762a13c266c5172f410fc8d6836531f5b27b" name="ima-evm-utils-devel" arch="s390x">
  <version epoch="0" ver="1.6.2" rel="75.18"/>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1601553600">- Fix missing new line in help
  (0001-help-Add-missing-new-line-for-ignore-violations.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1603972800">- Update to version 1.3.2
  * Bugfixes: importing keys
  * NEW: Docker based travis distro testing
  * Travis bugfixes, code cleanup, software version update,
  and script removal
  * Initial travis testing
- Remove 0001-help-Add-missing-new-line-for-ignore-violations.patch
  (patch from this release)
- Add make check + dependencies (getfattr =&gt; attr, xxd =&gt; vim)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1636113600">- Update to version 1.4
  * Elliptic curve support and tests
  * PKCS11 support and tests
  * Ability to manually specify the keyid included in the IMA xattr
  * Improve IMA measurement list per TPM bank verification
  * Linking with IBM TSS
  * Set default hash algorithm in package configuration
  * (Minimal) support and test EVM portable signatures
  * CI testing:
  * Refresh and include new distros
  * Podman support
  * GitHub Actions
  * Limit "sudo" usage
  * Misc bug fixes and code cleanup
  * Fix static analysis bug reports, memory leaks
  * Remove experimental code that was never upstreamed in the kernel
  * Use unsigned variable, remove unused variables, etc
- Upstream bumped soname to 3.0.0</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- switch to use https urls</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1678449600">- Update to version 1.5
  * CI changes:
  * New: UML kernel testing environment
  * Support for running specific test(s)
  * Update distros
  * Update software release versions
  * New features:
  * Signing fs-verity signatures
  * Reading TPM 2.0 PCRs via sysfs interface
  * New tests:
  * Missing IMA mmapped file measurements
  * Overlapping IMA policy rules
  * EVM portable signatures
  * fs-verity file measurements in the IMA measurement list
  * Build and library changes:
  * OpenSSL 3.0 version related changes
  * New configuration options: --disable-engine, --enable-sigv1
  * Deprecate IMA signature v1 format
  * Misc bug fixes and code cleanup:
  * memory leaks, bounds checking, use after free
  * Fix and update test output
  * Add missing sanity checks
  * Documentation:
  * Store the sourceforge ima-evm-utils wiki for historical
  purposes.
- Upstream bumped soname to 4.0.0
- Add BuildRequires: e2fsprogs util-linux (required by tests, which are mandatory)
- /usr/sbin to PATH (0001-fsverity.test-Add-usr-sbin-into-PATH.patch, sent to upstream ML)</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1702641600">- Update download url.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720440000">- Update to version 1.6
  https://lore.kernel.org/linux-integrity/20240703164454.61614-1-zohar@linux.ibm.com/
- Upstream bumped soname to 5.0.0
- Upstream changed license to GPL-2.0-or-later (evmctl), LGPL-2.0-or-later
  (libimaevm + devel package), and GPL-2.0-or-later WITH Linux-syscall-note
  exception (both)
  https://github.com/linux-integrity/ima-evm-utils/issues/4
  (mention both GPL and LGPL and add specific license to subpackages)
- Remove patch from upstream (0001-fsverity.test-Add-usr-sbin-into-PATH.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720699200">- Add LicenseRef-GPL-2.0-with-openssl-exception to License: (upstream has not
  yet created appropriate exception in SPDX).</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720785600">- Update project source URL.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1725278400">- Update to version 1.6.2
  https://github.com/linux-integrity/ima-evm-utils/blob/v1.6.2/NEWS
- Remove LicenseRef-GPL-2.0-with-openssl-exception (no need due relicensing of
  OpenSSL 3 or later to the Apache 2 license
  https://github.com/linux-integrity/ima-evm-utils/commit/4a4c762c8e3cbbff5f41c682deb026d22440454d )
- Upstream added COPYING (again) and COPYING.LGPL (new), add them to %license.</changelog>
</package>
<package pkgid="ff46e89184e679b658377db3788db22efa5183bc98f09216758da8cf1b59f9c4ed60ad9e7efd79d247b5b3816d431d3a94732cb53b27f684a16c09ecc237bbdc" name="ima-inspect" arch="s390x">
  <version epoch="0" ver="0.15" rel="15.26"/>
  <changelog author="matthias.gerstner@suse.com" date="1508760000">- initial release</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1508846400">- removed openssl-devel build dependency, because ima-evm-utils-devel now
  explicitly defines that dependency with sr#536019</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1513944000">- update to upstream version 0.11 which provides new features:
  - support limitation to specific attribute types via -a switch
  - support for outputting the cryptographic primitive like digest,
  signature or HMAC as hex or binary data</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1536062400">- update to upstream minor release version 0.12 which fixes a compatibility
  issue with newer libattr-devel packages. It now uses the xattr.h from
  glibc-devel instead.</changelog>
  <changelog author="mgerstner &lt;matthias.gerstner@suse.com&gt;" date="1565956800">- update to upstream minor release version 0.13 which makes ima-inspect
  compatible with libimaevm new ABI introduced in version 1.2.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1610625600">- update to upstream minor release version 0.14 which supports additional
  digest algorithms.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1680004800">- version bump to 0.15 which fixes a compilation error on newer GCC / glibc
  versions.</changelog>
</package>
<package pkgid="cf31d4731f4d5f5c98138b11a0e2a485fca2bc347900cccceae64e1dc021e9f76fa441a402a94aadd809f6c44b831a668178bc4ca922f1c0417bd9c8c3e89d7e" name="ima-inspect" arch="src">
  <version epoch="0" ver="0.15" rel="15.26"/>
  <changelog author="matthias.gerstner@suse.com" date="1508760000">- initial release</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1508846400">- removed openssl-devel build dependency, because ima-evm-utils-devel now
  explicitly defines that dependency with sr#536019</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1513944000">- update to upstream version 0.11 which provides new features:
  - support limitation to specific attribute types via -a switch
  - support for outputting the cryptographic primitive like digest,
  signature or HMAC as hex or binary data</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1536062400">- update to upstream minor release version 0.12 which fixes a compatibility
  issue with newer libattr-devel packages. It now uses the xattr.h from
  glibc-devel instead.</changelog>
  <changelog author="mgerstner &lt;matthias.gerstner@suse.com&gt;" date="1565956800">- update to upstream minor release version 0.13 which makes ima-inspect
  compatible with libimaevm new ABI introduced in version 1.2.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1610625600">- update to upstream minor release version 0.14 which supports additional
  digest algorithms.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1680004800">- version bump to 0.15 which fixes a compilation error on newer GCC / glibc
  versions.</changelog>
</package>
<package pkgid="5f2a08eafcc1d1eb18efcb5a5fb776605a083ceab692b38beff566d734054cfc97788dc71c2a26043a359248b6ad13e37b4fec40234424f21616d64b588546e3" name="ima-inspect-debuginfo" arch="s390x">
  <version epoch="0" ver="0.15" rel="15.26"/>
  <changelog author="matthias.gerstner@suse.com" date="1508760000">- initial release</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1508846400">- removed openssl-devel build dependency, because ima-evm-utils-devel now
  explicitly defines that dependency with sr#536019</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1513944000">- update to upstream version 0.11 which provides new features:
  - support limitation to specific attribute types via -a switch
  - support for outputting the cryptographic primitive like digest,
  signature or HMAC as hex or binary data</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1536062400">- update to upstream minor release version 0.12 which fixes a compatibility
  issue with newer libattr-devel packages. It now uses the xattr.h from
  glibc-devel instead.</changelog>
  <changelog author="mgerstner &lt;matthias.gerstner@suse.com&gt;" date="1565956800">- update to upstream minor release version 0.13 which makes ima-inspect
  compatible with libimaevm new ABI introduced in version 1.2.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1610625600">- update to upstream minor release version 0.14 which supports additional
  digest algorithms.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1680004800">- version bump to 0.15 which fixes a compilation error on newer GCC / glibc
  versions.</changelog>
</package>
<package pkgid="5a851395f3d7846ac604078b21cb948af06d177645b849c02d7c6ed04dc3d58408f1cf2ef349a6e1cdbb12d8f13fbf544aa3e9723fa0ccf9e60dc1823d47e7a8" name="ima-inspect-debugsource" arch="s390x">
  <version epoch="0" ver="0.15" rel="15.26"/>
  <changelog author="matthias.gerstner@suse.com" date="1508760000">- initial release</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1508846400">- removed openssl-devel build dependency, because ima-evm-utils-devel now
  explicitly defines that dependency with sr#536019</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1513944000">- update to upstream version 0.11 which provides new features:
  - support limitation to specific attribute types via -a switch
  - support for outputting the cryptographic primitive like digest,
  signature or HMAC as hex or binary data</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1536062400">- update to upstream minor release version 0.12 which fixes a compatibility
  issue with newer libattr-devel packages. It now uses the xattr.h from
  glibc-devel instead.</changelog>
  <changelog author="mgerstner &lt;matthias.gerstner@suse.com&gt;" date="1565956800">- update to upstream minor release version 0.13 which makes ima-inspect
  compatible with libimaevm new ABI introduced in version 1.2.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1610625600">- update to upstream minor release version 0.14 which supports additional
  digest algorithms.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1680004800">- version bump to 0.15 which fixes a compilation error on newer GCC / glibc
  versions.</changelog>
</package>
<package pkgid="67d292bf7eb128b37774042e4f2dfc7b5b73aec2c8d4fa401989a38d680999f2c2931ad4c7d4c476f3050befd786ea63876aee5a020ea2ed89e6559fadb5e198" name="intel-SINIT" arch="noarch">
  <version epoch="0" ver="2.3" rel="196.27"/>
  <changelog author="meissner@novell.com" date="1304078400">- imported SINITS from http://sourceforge.net/projects/tboot/
  FATE#311820</changelog>
  <changelog author="coolo@novell.com" date="1307534400">- fix license (seems autobuild overwritten)</changelog>
  <changelog author="meissner@suse.com" date="1392811200">- fixed license to be SUSE-Firmware</changelog>
  <changelog author="meissner@suse.com" date="1392811201">- Updated to current zipfiles available from
  http://software.intel.com/en-us/articles/intel-trusted-execution-technology/</changelog>
  <changelog author="jengelh@inai.de" date="1413288000">- Specfile cleanup: avoid %fdupes on buildroot, simplify %install.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1494417600">- Updated to current zipfiles available from
  https://software.intel.com/en-us/articles/intel-trusted-execution-technology
  (new: 5th - 7th gen series broadwell/skylake/kaby lake)
- Rewrote package description and summary (was partly copied from tboot, and
  thus wrong), to be more clear and descriptive.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1511784000">- Correctly install SINIT files ending in lower case .bin into /usr/lib/sinit,
  instead of into the documentation dirs.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1604059200">- Update to current zipfiles available from
  https://software.intel.com/content/www/us/en/develop/articles/intel-trusted-execution-technology.html
  - it seems 7th_gen_i5_i7-SINIT_74.zip was replaced by
    6th_7th_gen_i5_i7-SINIT_79.zip. The old variant is still packaged though.
  - new 8th_9th_gen_i5_i7-SINIT_81.zip for Coffee Lake platforms.</changelog>
</package>
<package pkgid="59314eb2ab25d85d9bfcd2f964e2b44f6f317ffc2c338e9ce450a5936d32f34358adfee0a081b9f6a0fb2aa1858524466cb68a003b7627c1f491dcb1d1275eb1" name="intel-SINIT" arch="src">
  <version epoch="0" ver="2.3" rel="196.27"/>
  <changelog author="meissner@novell.com" date="1304078400">- imported SINITS from http://sourceforge.net/projects/tboot/
  FATE#311820</changelog>
  <changelog author="coolo@novell.com" date="1307534400">- fix license (seems autobuild overwritten)</changelog>
  <changelog author="meissner@suse.com" date="1392811200">- fixed license to be SUSE-Firmware</changelog>
  <changelog author="meissner@suse.com" date="1392811201">- Updated to current zipfiles available from
  http://software.intel.com/en-us/articles/intel-trusted-execution-technology/</changelog>
  <changelog author="jengelh@inai.de" date="1413288000">- Specfile cleanup: avoid %fdupes on buildroot, simplify %install.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1494417600">- Updated to current zipfiles available from
  https://software.intel.com/en-us/articles/intel-trusted-execution-technology
  (new: 5th - 7th gen series broadwell/skylake/kaby lake)
- Rewrote package description and summary (was partly copied from tboot, and
  thus wrong), to be more clear and descriptive.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1511784000">- Correctly install SINIT files ending in lower case .bin into /usr/lib/sinit,
  instead of into the documentation dirs.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1604059200">- Update to current zipfiles available from
  https://software.intel.com/content/www/us/en/develop/articles/intel-trusted-execution-technology.html
  - it seems 7th_gen_i5_i7-SINIT_74.zip was replaced by
    6th_7th_gen_i5_i7-SINIT_79.zip. The old variant is still packaged though.
  - new 8th_9th_gen_i5_i7-SINIT_81.zip for Coffee Lake platforms.</changelog>
</package>
<package pkgid="4ea12bc9c00b25b42442f0082054e2c1db48cd8643c2e234c2368bb6d3a6067d8aff37e8630273142e6131688f688847a5fe00a3e5aa20413950d2c046e19ed9" name="iptstate" arch="s390x">
  <version epoch="0" ver="2.2.6" rel="1.43"/>
  <changelog author="oc2pus &lt;oc2pus@arcor.de&gt;" date="1099742400">- little modifications for SuSE</changelog>
  <changelog author="oc2pus &lt;oc2pus@arcor.de&gt;" date="1114344000">- update to 1.4
  * Released 04/16/05
  * Added display of filters
  * Added a "strip" target to the Makefile
  * Changed ip/port seperator to a colon instead of comma
  * Some string concat and Makefile cleanups from Roland Illig
  * Added new features to man page
  * Added filtering for source and destination addresses
  * Added filtering of DNS states option
  * Added tagging of truncated hostnames
  * Brought man page up-to-date
  * Got rid of deprecated warnings
  * Removed libgpm req from spec file.</changelog>
  <changelog author="oc2pus &lt;oc2pus@arcor.de&gt;" date="1132315200">- rebuild SuSE-10.0</changelog>
  <changelog author="Toni Graffy &lt;toni@links2linux.de&gt;" date="1159012800">- build for packman</changelog>
  <changelog author="Toni Graffy &lt;toni@links2linux.de&gt;" date="1168084800">- update to 2.1
  * Released 10/05/06
  * Fixed bug where -s was doing what -S should do and -d was doing
  what -D should do. Thanks to Brian Nelson for catching this.
  * Add comments on the 3 functions that didn't have them in 2.0</changelog>
  <changelog author="Toni Graffy &lt;toni@links2linux.de&gt;" date="1174305600">- update to 2.2.1
  * Released 03/18/07
  * Fix formatting bug (maxes not being cleared on each round)</changelog>
  <changelog author="Pascal Bleser &lt;pascal.bleser@opensuse.org&gt;" date="1253880000">- update to 2.2.2
  * Released 09/19/09
  * Fix includes
  * Add --version (closes bug 2792918)
  * Some minor code abstractions
  * Remove old /proc based code
  * Dropped "Proto" field minimum width to 3 chars (changing title to "Prt")
  to make more room for counters
  * If we can't fit counters and there's nothing we can truncate, show a
  warning and then disable counters rather than messing up the display
  * Some style cleanups</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1471608000">- update to 2.2.6
  * Released 08/14/16
  * Fix `-b` option which didn't work in many cases
  * When we turn `lookup` mode on, automatically turn `skipdns` mode on
  * - Move to dynamic memory for state entries. Fixes #3
- update to 2.2.5
  * Released 06/01/12
  * Full support for ICMP6 including code/type display and state deletion
  * Dynamically size "State" column"
  * If we can't resolve a protocol to a name, print the number
  instead of "UNKNOWN!"
  * Don't leave a space for ":" if there's no port
- update to 2.2.4
  * Released 06/01/12
  * Improved IPv6 support - truncate addresses if they don't fit and generally
  * treat them like hostnames at display time
  * CONTRIB and man page fixes (Chris Taylor &lt;ctaylor@debian.org&gt;)
- update to 2.2.3
  * Released 04/03/11
  * IPv6 support. Closes #2848930.
  * Handle filters as in6_addr and uints instead of strings
  * Fix loopback filtering support
  * Fix formatting for ICMP states. Closes #2969917.
  * Total style overhaul: move away from tabs, use 2 spaces, various
  other style cleanups
  * Documentation updates</changelog>
</package>
<package pkgid="1a12e21682d8274d15a93927f426f7fd2f090a7b56009eee1220f4678e64abbc00e7b775bcd704331f357b148c29deaca3aa6d638b5fa07868f7c82db8fe98c4" name="iptstate" arch="src">
  <version epoch="0" ver="2.2.6" rel="1.43"/>
  <changelog author="oc2pus &lt;oc2pus@arcor.de&gt;" date="1099742400">- little modifications for SuSE</changelog>
  <changelog author="oc2pus &lt;oc2pus@arcor.de&gt;" date="1114344000">- update to 1.4
  * Released 04/16/05
  * Added display of filters
  * Added a "strip" target to the Makefile
  * Changed ip/port seperator to a colon instead of comma
  * Some string concat and Makefile cleanups from Roland Illig
  * Added new features to man page
  * Added filtering for source and destination addresses
  * Added filtering of DNS states option
  * Added tagging of truncated hostnames
  * Brought man page up-to-date
  * Got rid of deprecated warnings
  * Removed libgpm req from spec file.</changelog>
  <changelog author="oc2pus &lt;oc2pus@arcor.de&gt;" date="1132315200">- rebuild SuSE-10.0</changelog>
  <changelog author="Toni Graffy &lt;toni@links2linux.de&gt;" date="1159012800">- build for packman</changelog>
  <changelog author="Toni Graffy &lt;toni@links2linux.de&gt;" date="1168084800">- update to 2.1
  * Released 10/05/06
  * Fixed bug where -s was doing what -S should do and -d was doing
  what -D should do. Thanks to Brian Nelson for catching this.
  * Add comments on the 3 functions that didn't have them in 2.0</changelog>
  <changelog author="Toni Graffy &lt;toni@links2linux.de&gt;" date="1174305600">- update to 2.2.1
  * Released 03/18/07
  * Fix formatting bug (maxes not being cleared on each round)</changelog>
  <changelog author="Pascal Bleser &lt;pascal.bleser@opensuse.org&gt;" date="1253880000">- update to 2.2.2
  * Released 09/19/09
  * Fix includes
  * Add --version (closes bug 2792918)
  * Some minor code abstractions
  * Remove old /proc based code
  * Dropped "Proto" field minimum width to 3 chars (changing title to "Prt")
  to make more room for counters
  * If we can't fit counters and there's nothing we can truncate, show a
  warning and then disable counters rather than messing up the display
  * Some style cleanups</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1471608000">- update to 2.2.6
  * Released 08/14/16
  * Fix `-b` option which didn't work in many cases
  * When we turn `lookup` mode on, automatically turn `skipdns` mode on
  * - Move to dynamic memory for state entries. Fixes #3
- update to 2.2.5
  * Released 06/01/12
  * Full support for ICMP6 including code/type display and state deletion
  * Dynamically size "State" column"
  * If we can't resolve a protocol to a name, print the number
  instead of "UNKNOWN!"
  * Don't leave a space for ":" if there's no port
- update to 2.2.4
  * Released 06/01/12
  * Improved IPv6 support - truncate addresses if they don't fit and generally
  * treat them like hostnames at display time
  * CONTRIB and man page fixes (Chris Taylor &lt;ctaylor@debian.org&gt;)
- update to 2.2.3
  * Released 04/03/11
  * IPv6 support. Closes #2848930.
  * Handle filters as in6_addr and uints instead of strings
  * Fix loopback filtering support
  * Fix formatting for ICMP states. Closes #2969917.
  * Total style overhaul: move away from tabs, use 2 spaces, various
  other style cleanups
  * Documentation updates</changelog>
</package>
<package pkgid="73c6cafdc5d97de389a5a6c084e99ee1275f70785012c333c3d315329ba3e36ccd860b8299748ef8b21fc372f3e15430e90812f1dc4ddb10e7f12e8771fd4cc4" name="iptstate-debuginfo" arch="s390x">
  <version epoch="0" ver="2.2.6" rel="1.43"/>
  <changelog author="oc2pus &lt;oc2pus@arcor.de&gt;" date="1099742400">- little modifications for SuSE</changelog>
  <changelog author="oc2pus &lt;oc2pus@arcor.de&gt;" date="1114344000">- update to 1.4
  * Released 04/16/05
  * Added display of filters
  * Added a "strip" target to the Makefile
  * Changed ip/port seperator to a colon instead of comma
  * Some string concat and Makefile cleanups from Roland Illig
  * Added new features to man page
  * Added filtering for source and destination addresses
  * Added filtering of DNS states option
  * Added tagging of truncated hostnames
  * Brought man page up-to-date
  * Got rid of deprecated warnings
  * Removed libgpm req from spec file.</changelog>
  <changelog author="oc2pus &lt;oc2pus@arcor.de&gt;" date="1132315200">- rebuild SuSE-10.0</changelog>
  <changelog author="Toni Graffy &lt;toni@links2linux.de&gt;" date="1159012800">- build for packman</changelog>
  <changelog author="Toni Graffy &lt;toni@links2linux.de&gt;" date="1168084800">- update to 2.1
  * Released 10/05/06
  * Fixed bug where -s was doing what -S should do and -d was doing
  what -D should do. Thanks to Brian Nelson for catching this.
  * Add comments on the 3 functions that didn't have them in 2.0</changelog>
  <changelog author="Toni Graffy &lt;toni@links2linux.de&gt;" date="1174305600">- update to 2.2.1
  * Released 03/18/07
  * Fix formatting bug (maxes not being cleared on each round)</changelog>
  <changelog author="Pascal Bleser &lt;pascal.bleser@opensuse.org&gt;" date="1253880000">- update to 2.2.2
  * Released 09/19/09
  * Fix includes
  * Add --version (closes bug 2792918)
  * Some minor code abstractions
  * Remove old /proc based code
  * Dropped "Proto" field minimum width to 3 chars (changing title to "Prt")
  to make more room for counters
  * If we can't fit counters and there's nothing we can truncate, show a
  warning and then disable counters rather than messing up the display
  * Some style cleanups</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1471608000">- update to 2.2.6
  * Released 08/14/16
  * Fix `-b` option which didn't work in many cases
  * When we turn `lookup` mode on, automatically turn `skipdns` mode on
  * - Move to dynamic memory for state entries. Fixes #3
- update to 2.2.5
  * Released 06/01/12
  * Full support for ICMP6 including code/type display and state deletion
  * Dynamically size "State" column"
  * If we can't resolve a protocol to a name, print the number
  instead of "UNKNOWN!"
  * Don't leave a space for ":" if there's no port
- update to 2.2.4
  * Released 06/01/12
  * Improved IPv6 support - truncate addresses if they don't fit and generally
  * treat them like hostnames at display time
  * CONTRIB and man page fixes (Chris Taylor &lt;ctaylor@debian.org&gt;)
- update to 2.2.3
  * Released 04/03/11
  * IPv6 support. Closes #2848930.
  * Handle filters as in6_addr and uints instead of strings
  * Fix loopback filtering support
  * Fix formatting for ICMP states. Closes #2969917.
  * Total style overhaul: move away from tabs, use 2 spaces, various
  other style cleanups
  * Documentation updates</changelog>
</package>
<package pkgid="388ee3b6733aa22cf6e9d162a7ccf07414b7e89bb07ab6744a56323fd25a6cd5dff769d865deb9935ab10fdf8a4e0908454caa25729212b3b8a203ef8c82ef82" name="iptstate-debugsource" arch="s390x">
  <version epoch="0" ver="2.2.6" rel="1.43"/>
  <changelog author="oc2pus &lt;oc2pus@arcor.de&gt;" date="1099742400">- little modifications for SuSE</changelog>
  <changelog author="oc2pus &lt;oc2pus@arcor.de&gt;" date="1114344000">- update to 1.4
  * Released 04/16/05
  * Added display of filters
  * Added a "strip" target to the Makefile
  * Changed ip/port seperator to a colon instead of comma
  * Some string concat and Makefile cleanups from Roland Illig
  * Added new features to man page
  * Added filtering for source and destination addresses
  * Added filtering of DNS states option
  * Added tagging of truncated hostnames
  * Brought man page up-to-date
  * Got rid of deprecated warnings
  * Removed libgpm req from spec file.</changelog>
  <changelog author="oc2pus &lt;oc2pus@arcor.de&gt;" date="1132315200">- rebuild SuSE-10.0</changelog>
  <changelog author="Toni Graffy &lt;toni@links2linux.de&gt;" date="1159012800">- build for packman</changelog>
  <changelog author="Toni Graffy &lt;toni@links2linux.de&gt;" date="1168084800">- update to 2.1
  * Released 10/05/06
  * Fixed bug where -s was doing what -S should do and -d was doing
  what -D should do. Thanks to Brian Nelson for catching this.
  * Add comments on the 3 functions that didn't have them in 2.0</changelog>
  <changelog author="Toni Graffy &lt;toni@links2linux.de&gt;" date="1174305600">- update to 2.2.1
  * Released 03/18/07
  * Fix formatting bug (maxes not being cleared on each round)</changelog>
  <changelog author="Pascal Bleser &lt;pascal.bleser@opensuse.org&gt;" date="1253880000">- update to 2.2.2
  * Released 09/19/09
  * Fix includes
  * Add --version (closes bug 2792918)
  * Some minor code abstractions
  * Remove old /proc based code
  * Dropped "Proto" field minimum width to 3 chars (changing title to "Prt")
  to make more room for counters
  * If we can't fit counters and there's nothing we can truncate, show a
  warning and then disable counters rather than messing up the display
  * Some style cleanups</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1471608000">- update to 2.2.6
  * Released 08/14/16
  * Fix `-b` option which didn't work in many cases
  * When we turn `lookup` mode on, automatically turn `skipdns` mode on
  * - Move to dynamic memory for state entries. Fixes #3
- update to 2.2.5
  * Released 06/01/12
  * Full support for ICMP6 including code/type display and state deletion
  * Dynamically size "State" column"
  * If we can't resolve a protocol to a name, print the number
  instead of "UNKNOWN!"
  * Don't leave a space for ":" if there's no port
- update to 2.2.4
  * Released 06/01/12
  * Improved IPv6 support - truncate addresses if they don't fit and generally
  * treat them like hostnames at display time
  * CONTRIB and man page fixes (Chris Taylor &lt;ctaylor@debian.org&gt;)
- update to 2.2.3
  * Released 04/03/11
  * IPv6 support. Closes #2848930.
  * Handle filters as in6_addr and uints instead of strings
  * Fix loopback filtering support
  * Fix formatting for ICMP states. Closes #2969917.
  * Total style overhaul: move away from tabs, use 2 spaces, various
  other style cleanups
  * Documentation updates</changelog>
</package>
<package pkgid="d11e4a02ede317cdb6de287ab433232c61de8d962e0b187c94d050bcac1c9f1de5249292ffb91ac2fab05b4916d673deb3aff185e809e227c868e3b49d79b83c" name="jd-gui" arch="noarch">
  <version epoch="0" ver="1.6.6" rel="3.17"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1675080000">- First import in Factory</changelog>
</package>
<package pkgid="bd0794156f6b8d2c990758ed47070752522233420d23c8f4d6b44235241d0381d451c4aa6be42556af684ac30c73d9617d7595bc3b2ab3ad793dbd8bef2504f5" name="jd-gui" arch="src">
  <version epoch="0" ver="1.6.6" rel="3.17"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1675080000">- First import in Factory</changelog>
</package>
<package pkgid="fe41638857c313e633d41f8141e3e7a5d957265caa51e1937c92aa90d6eb670d0937ea5bd752185728ae8f9d956a823b3dc8e050ba89badf2dc2332a8a9103f6" name="john" arch="s390x">
  <version epoch="0" ver="1.9.0" rel="99.51"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1568116800">- Use noun phrase in summary. Reword description to avoid
  unspecific "Unix password".</changelog>
  <changelog author="simmphonie@opensuse.org" date="1568116801">- Fixed build for ARM and PPC. CPU with AVX support at least is
  only available for x86_64 architecture now.</changelog>
  <changelog author="simmphonie@opensuse.org" date="1570881600">- Remove fdupes check (build fails with debug packages)</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1591963200">- Fix building with gcc10
- Small cleanup of spec file with spec-cleaner</changelog>
  <changelog author="simmphonie@opensuse.org" date="1601985600">- Add cl-device.patch to handle systems that already defined
  CL_DEVICE_TOPOLOGY_AMD  gh#4331</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1615636800">- enable ztex support (fix usb dependency):
  add john-1.9.0-jumbo-gcc10.patch to fix fcommon related build failures</changelog>
  <changelog author="simmphonie@opensuse.org" date="1623153600">- add john-1.9.0-jumbo-gcc11.patch to fix alignment compile errors
  on GCC 11 gh#4611</changelog>
  <changelog author="Sarah Kriesch &lt;sarah.kriesch@opensuse.org&gt;" date="1634040000">- Upstream patch for Big Endians in s390x-upstream.patch
- Include johnswap.h in opencl_7z_fmt_plug.c with s390x.patch</changelog>
  <changelog author="lars@linux-schulserver.de - 1.9.0" date="1663243200">- disable enforcement of AVX support in the CPU: let john handle this
  during runtime automatically (bsc#1202318)</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1683547200">- Add john-1.9-python3.patch to not require python2 anymore (boo#1210583)
- Use %autopatch</changelog>
</package>
<package pkgid="3dda53d8fa4b030b2102c3ae1b04fdc51e0a8b0458c6851d2198ac85153422e0730a92816cc4bef3c1fe01179da5c614ae1050ffdab469bc49c4c28349f73d7d" name="john" arch="src">
  <version epoch="0" ver="1.9.0" rel="99.51"/>
  <changelog author="dvaleev@suse.com" date="1389355200">- Fix build on ppc64le
- added patches:
  * ppc64le.patch</changelog>
  <changelog author="lars@linux-schulserver.de" date="1418644800">- include "jumbo patch" into the build - special thanks to
  Mark Draheim for the specfile patch (closes bnc #839246)</changelog>
  <changelog author="astieger@suse.com" date="1435233600">- fix SLE 11 SP3 build</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1455710400">- as follow on of previous "jumbo patch" need two powerpc changes:
  new john-1.7.9-powerpc_BE_need_rhash_u32_swap_copy.patch
  place ppc64le.patch after application of "jumbo patch" in spec
  allow to solve partially boo #940498  for ppc64le
  but still have 4 FAILED tests for ppc64 tracked upstream by
  http://www.openwall.com/lists/john-dev/2016/02/16/1</changelog>
  <changelog author="meissner@suse.com" date="1481198400">- remove incorrect too large john.keyring ...
  The signature of these tarballs is currently with a key with MD5 hash,
  which is rejected by default.</changelog>
  <changelog author="bwiedemann@suse.com" date="1495886400">- Add reproducible.patch to sort input files to make build reproducible
  (boo#1041090)</changelog>
  <changelog author="dimstar@opensuse.org" date="1522152000">- Build against openSSL 1.0 until upstream catches up
  (boo#1078844).</changelog>
  <changelog author="simmphonie@opensuse.org" date="1559822400">- spec-file changes
  + add jumbo scripts and remove "env" from shebang
  + remove patches. In upstream already:
    + john-1.7.9-powerpc_BE_need_rhash_u32_swap_copy.patch
    + ppc64le.patch
    + reproducible.patch
  + use configure to find dependenices and CPU architecture
    + openCL support
    + multicore support with fork option
    + require CPU with AVX support at least
  + root rights are no longer required
- update to 1.9.0
  + Increased the interleaving for bcrypt on x86-64 from 2x to 3x for a major
    speedup on CPUs without SMT.  Unfortunately, this sometimes results in a minor
    performance regression when running multiple threads on CPUs with SMT.
  + Recognize the $2b$ bcrypt prefix.
  + In the generic crypt(3) format, detect descrypt with valid vs. invalid salts
    as separate id's for our heuristics on supported hash types.
  + Introduced a number of optimizations for faster handling of large password
    hash files, including loading, cracking, and "--show".  Some of these use more
    memory than before, yet in a more efficient manner.
  + Benchmark using all-different candidate passwords of length 7 by default.
  + Dropped undocumented special handling of "Mc" in 'c' and 'C' rule commands.
  + Dropped undocumented limitation of the 'M' and 'Q' rule commands where they
    would sometimes memorize/check only up to the current hash type's length limit
    yet this optimization wouldn't necessarily be transparent (e.g., if a later
    command would extract a substring from above the hash type's length limit and
    bring it to within the limit).
  + Implemented special-case handling of repeated rule commands '$', '^', '[',
    ']', '{', and '}', as well as faster handling of the 'D' command.
  + When built with "--fork" support, disallow session names with all-digit
    suffixes since these clash with those produced by "--fork".
  + Forward SIGTERM to --fork'ed children.
  + Set stdout to line buffered (rather than potentially fully buffered), except
    for "--stdout", "--show", and auxiliary programs such as "unshadow".
  + On Windows, restore normal processing of Ctrl-C in case our parent (such as
    Johnny the GUI) had disabled it.
  + Added linux-x86*-avx512 and linux-x86*-avx2 make targets, which use
    respectively AVX-512 and AVX2 for bitslice DES.
  + Added linux-mic make target for Intel MIC (first generation Xeon Phi, aka
    Knights Corner), which uses its 512-bit SIMD intrinsics for bitslice DES.
    (For second generation Xeon Phi, aka Knights Landing, use linux-x86-64-avx512.)
  + Added linux-arm64le, linux-arm32le-neon, and linux-arm32le make targets.
    (The first two of these make use of ASIMD or NEON for bitslice DES.)
  + Added linux-sparc64 make target.
  + Made a minor optimization to MMX and SSE2 assembly code for LM hash.
  + Dropped Ultrix and SCO support.
  + Don't probe for alternate config file names (like john.ini when on Unix).
  + "DokuWiki" external mode sample has been added to the default john.conf.
  + Fixed operator precedence in the external mode compiler to be the same as C.
  + Fixed an out of bounds write bug in the external mode virtual machine.
  + Fixed a bug introduced in version 1.7.4 in the wordlist rules engine, where
    some sequences of rule commands could overflow a word buffer.
  + Fixed a bug where unaligned access SSE/AVX instructions would unnecessarily
    be generated by GCC 4.6+ in the bitslice DES code in non-OpenMP builds.
  + Fixed a bug where "Warning: no OpenMP support for this hash type" could be
    printed in "--stdout" mode.
  + Made assorted other bugfixes, portability and documentation enhancements.
- version 1.7.9.8
  + Revised the incremental mode to let the current character counts grow for
    each character position independently, with the aim to improve efficiency in
    terms of successful guesses per candidate passwords tested.
  + Revised the pre-defined incremental modes, as well as external mode filters
    that are used to generate .chr files.
  + Added makechr, a script to (re-)generate .chr files.
  + Enhanced the status reporting to include four distinct speed metrics (g/s,
    p/s, c/s, and C/s).
  + Added the "--fork=N" and "--node=MIN[-MAX]/TOTAL" options for trivial
    parallel and distributed processing.
  + In the external mode compiler, treat character literals as unsigned.
  + Renamed many of the formats.
  + Updated the documentation.
  + Relaxed the license for many source files to cut-down BSD.
  + Relaxed the license for John the Ripper as a whole from GPLv2 (exact version)
    to GPLv2 or newer with optional OpenSSL and unRAR exceptions.
  + Assorted other changes have been made.</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1567425600">- Fix the sources URL. Use https.</changelog>
  <changelog author="simmphonie@opensuse.org" date="1568030400">- remove setBadness from rpmlintrc</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1568116800">- Use noun phrase in summary. Reword description to avoid
  unspecific "Unix password".</changelog>
  <changelog author="simmphonie@opensuse.org" date="1568116801">- Fixed build for ARM and PPC. CPU with AVX support at least is
  only available for x86_64 architecture now.</changelog>
  <changelog author="simmphonie@opensuse.org" date="1570881600">- Remove fdupes check (build fails with debug packages)</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1591963200">- Fix building with gcc10
- Small cleanup of spec file with spec-cleaner</changelog>
  <changelog author="simmphonie@opensuse.org" date="1601985600">- Add cl-device.patch to handle systems that already defined
  CL_DEVICE_TOPOLOGY_AMD  gh#4331</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1615636800">- enable ztex support (fix usb dependency):
  add john-1.9.0-jumbo-gcc10.patch to fix fcommon related build failures</changelog>
  <changelog author="simmphonie@opensuse.org" date="1623153600">- add john-1.9.0-jumbo-gcc11.patch to fix alignment compile errors
  on GCC 11 gh#4611</changelog>
  <changelog author="Sarah Kriesch &lt;sarah.kriesch@opensuse.org&gt;" date="1634040000">- Upstream patch for Big Endians in s390x-upstream.patch
- Include johnswap.h in opencl_7z_fmt_plug.c with s390x.patch</changelog>
  <changelog author="lars@linux-schulserver.de - 1.9.0" date="1663243200">- disable enforcement of AVX support in the CPU: let john handle this
  during runtime automatically (bsc#1202318)</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1683547200">- Add john-1.9-python3.patch to not require python2 anymore (boo#1210583)
- Use %autopatch</changelog>
</package>
<package pkgid="3f53a46b43efcd276642626067d50f7a9f18bb2223c08b88a9ca256b44cb9581fa12d455aa5f967fe5f4e448e6bb33d5070ef09a99da8c5c01811733e01ba934" name="jose" arch="s390x">
  <version epoch="0" ver="14" rel="9.4"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- initial import of C-language implementation of Javascript Object
  Signing and Encryption, for use by clevis</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1709899200">- Update to version 12
  * Clean up some FreeBSD conditions (#98)
  * Add ES256K support (#90)
  * Meson changes (#135)
  * Update CI (#8) (#129)
  * lib/openssl/rsaes.c: Fix issue where jose_hook_alg_find
    failed to find the … …existance of RSA_OAEP algorithm
  * Increase test program/scripts timeout values (#131)
  * Fix test compilation warnings (#127)
  * Adapt alg_comp test to different zlib (#142)
  * Use checkout v3 Github action to avoid warnings (#137)
  * Alternative fix for fedora:rawide (#138)
  * lib/openssl/hmac.c: rename hmac function to jhmac (#130)
  * jose: build library only as shared (#119)
  * meson: add option to disable building manpages (#118)
  * Add a more descriptive error when jwk gen fails (#105)
  * Use "command -v" instead of "which" (deprecated) (#125)
  * Test for jq existing (used in jose-jwe-enc test) (#124)
  * Correct jose_jws.3 man page example (#122)
  * lib/hsh.c: rename hsh local variable (#111)
  * Avoid master word when possible (#120)
  * Fix github action CI by setting appropriate centos
  * Fix format of jose-jwe-enc man page
  * Meson Fixes
  * ci: make ubuntu:devel and fedora:rawhide not to fail the
    pipeline
  * ci: retry when installing the deps in debian/ubuntu
  * ci: remove travis-ci</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1713268800">- Update to version 13:
  * Fix potential DoS issue with p2c header (4ee7708)
  * Build updates (#148) (dae5654)
  * Display pkg_config in test logs (#134) (5e45732)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773748800">- update to 14:
  * openssl/oct: improve bound check for len
  * jwe: fix the case when we have "zip" in the protected header
  * Avoid potential DoS with high decompression chunks</changelog>
</package>
<package pkgid="35f1c72fd9330d6f6a9df87b58b620ef1d498b5651de62d8ec2857481c255fc1b9145196488505d10fb892ad0f8051b245134a9a20e6fd88663dca4176b16bd8" name="jose" arch="src">
  <version epoch="0" ver="14" rel="9.4"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- initial import of C-language implementation of Javascript Object
  Signing and Encryption, for use by clevis</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1709899200">- Update to version 12
  * Clean up some FreeBSD conditions (#98)
  * Add ES256K support (#90)
  * Meson changes (#135)
  * Update CI (#8) (#129)
  * lib/openssl/rsaes.c: Fix issue where jose_hook_alg_find
    failed to find the … …existance of RSA_OAEP algorithm
  * Increase test program/scripts timeout values (#131)
  * Fix test compilation warnings (#127)
  * Adapt alg_comp test to different zlib (#142)
  * Use checkout v3 Github action to avoid warnings (#137)
  * Alternative fix for fedora:rawide (#138)
  * lib/openssl/hmac.c: rename hmac function to jhmac (#130)
  * jose: build library only as shared (#119)
  * meson: add option to disable building manpages (#118)
  * Add a more descriptive error when jwk gen fails (#105)
  * Use "command -v" instead of "which" (deprecated) (#125)
  * Test for jq existing (used in jose-jwe-enc test) (#124)
  * Correct jose_jws.3 man page example (#122)
  * lib/hsh.c: rename hsh local variable (#111)
  * Avoid master word when possible (#120)
  * Fix github action CI by setting appropriate centos
  * Fix format of jose-jwe-enc man page
  * Meson Fixes
  * ci: make ubuntu:devel and fedora:rawhide not to fail the
    pipeline
  * ci: retry when installing the deps in debian/ubuntu
  * ci: remove travis-ci</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1713268800">- Update to version 13:
  * Fix potential DoS issue with p2c header (4ee7708)
  * Build updates (#148) (dae5654)
  * Display pkg_config in test logs (#134) (5e45732)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773748800">- update to 14:
  * openssl/oct: improve bound check for len
  * jwe: fix the case when we have "zip" in the protected header
  * Avoid potential DoS with high decompression chunks</changelog>
</package>
<package pkgid="6347634e1212333e3f3d15cc37e11633448d5c85af53df4f318167041be501870cc7e6b26c60c6a5155e608ea88b5586acd275d5a41b72d83900b135733d025f" name="jose-debuginfo" arch="s390x">
  <version epoch="0" ver="14" rel="9.4"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- initial import of C-language implementation of Javascript Object
  Signing and Encryption, for use by clevis</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1709899200">- Update to version 12
  * Clean up some FreeBSD conditions (#98)
  * Add ES256K support (#90)
  * Meson changes (#135)
  * Update CI (#8) (#129)
  * lib/openssl/rsaes.c: Fix issue where jose_hook_alg_find
    failed to find the … …existance of RSA_OAEP algorithm
  * Increase test program/scripts timeout values (#131)
  * Fix test compilation warnings (#127)
  * Adapt alg_comp test to different zlib (#142)
  * Use checkout v3 Github action to avoid warnings (#137)
  * Alternative fix for fedora:rawide (#138)
  * lib/openssl/hmac.c: rename hmac function to jhmac (#130)
  * jose: build library only as shared (#119)
  * meson: add option to disable building manpages (#118)
  * Add a more descriptive error when jwk gen fails (#105)
  * Use "command -v" instead of "which" (deprecated) (#125)
  * Test for jq existing (used in jose-jwe-enc test) (#124)
  * Correct jose_jws.3 man page example (#122)
  * lib/hsh.c: rename hsh local variable (#111)
  * Avoid master word when possible (#120)
  * Fix github action CI by setting appropriate centos
  * Fix format of jose-jwe-enc man page
  * Meson Fixes
  * ci: make ubuntu:devel and fedora:rawhide not to fail the
    pipeline
  * ci: retry when installing the deps in debian/ubuntu
  * ci: remove travis-ci</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1713268800">- Update to version 13:
  * Fix potential DoS issue with p2c header (4ee7708)
  * Build updates (#148) (dae5654)
  * Display pkg_config in test logs (#134) (5e45732)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773748800">- update to 14:
  * openssl/oct: improve bound check for len
  * jwe: fix the case when we have "zip" in the protected header
  * Avoid potential DoS with high decompression chunks</changelog>
</package>
<package pkgid="2ac68ac9e369fad4dbb0ecc86f7fc1a6d95696dcd5d2eac34cfc8e319e20ad31ce0316d8387c6144d71b832f8f535fc936b4309f06a4f9ff02fe17ae4defea0b" name="jose-debugsource" arch="s390x">
  <version epoch="0" ver="14" rel="9.4"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- initial import of C-language implementation of Javascript Object
  Signing and Encryption, for use by clevis</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1709899200">- Update to version 12
  * Clean up some FreeBSD conditions (#98)
  * Add ES256K support (#90)
  * Meson changes (#135)
  * Update CI (#8) (#129)
  * lib/openssl/rsaes.c: Fix issue where jose_hook_alg_find
    failed to find the … …existance of RSA_OAEP algorithm
  * Increase test program/scripts timeout values (#131)
  * Fix test compilation warnings (#127)
  * Adapt alg_comp test to different zlib (#142)
  * Use checkout v3 Github action to avoid warnings (#137)
  * Alternative fix for fedora:rawide (#138)
  * lib/openssl/hmac.c: rename hmac function to jhmac (#130)
  * jose: build library only as shared (#119)
  * meson: add option to disable building manpages (#118)
  * Add a more descriptive error when jwk gen fails (#105)
  * Use "command -v" instead of "which" (deprecated) (#125)
  * Test for jq existing (used in jose-jwe-enc test) (#124)
  * Correct jose_jws.3 man page example (#122)
  * lib/hsh.c: rename hsh local variable (#111)
  * Avoid master word when possible (#120)
  * Fix github action CI by setting appropriate centos
  * Fix format of jose-jwe-enc man page
  * Meson Fixes
  * ci: make ubuntu:devel and fedora:rawhide not to fail the
    pipeline
  * ci: retry when installing the deps in debian/ubuntu
  * ci: remove travis-ci</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1713268800">- Update to version 13:
  * Fix potential DoS issue with p2c header (4ee7708)
  * Build updates (#148) (dae5654)
  * Display pkg_config in test logs (#134) (5e45732)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773748800">- update to 14:
  * openssl/oct: improve bound check for len
  * jwe: fix the case when we have "zip" in the protected header
  * Avoid potential DoS with high decompression chunks</changelog>
</package>
<package pkgid="8ae3c0c13f90cc1127eed4a35fc65e87b33aa7ec4d2430837930c7d005276766f4ae894435cb39db1468374eb29c71505489e513e42f041bad029b057b8ff142" name="kbfs" arch="s390x">
  <version epoch="0" ver="6.6.3" rel="101.1"/>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674302400">- Integrate KBFS packages previously build via own source package
  * Upstream integrated these into the same source.
  * Also includes adding kbfs-related patches
    ensure-mount-dir-exists.patch and
    ensure-service-stop-unmounts-filesystem.patch.
- Upgrade Go version used for compilation to 1.19.
- Use Systemd unit file from upstream source.
- Replace deprecated tar_scm source service by obs_scm.
- Drop the no longer required go_nostrip macro.
- Drop unnessecary use of gofilelist macro.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674648000">- Limit parallel test execution as that seems to cause failing
  builds on OBS that don't occur locally.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1690459200">- Upgrade to version 6.2.2
  * No change log provided</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1691236800">- Update the Image dependency to address CVE-2023-29408 /
  bsc#1213928. This is done via the new update-image-tiff.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.3" date="1696507200">- Update to version 6.2.3
  * Fix incomplete locking in config file handling.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.4" date="1704283200">- Update to version 6.2.4
  * Update client CA</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.8" date="1710417600">- Update to version 6.2.8
  * Bug fixes
- Refreshed update-image-tiff.patch as it no longer applied cleanly.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1718798400">- Update to version 6.3.1
  * Archive your chats/files/repos for easy backups.
  * Wrap text in spoiler to hide spoilers.
- Drop update-image-tiff.patch as upststream now uses a vendored
  version of the Image library that includes the fix.
- Update the used Go version to 1.21 which is the first version to
  support the slices modules which is now used by Keybase.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1720094400">- Update the image dependency to address CVE-2024-24792 /
  boo#1227158. This is done via the new update-golang-x-image.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1745841600">- Update to version 6.5.1
  * Fix team deletion not working
  * Chat attachments improvements
  * Miscellaneous bugfixes
- Drop update-golang-x-image.patch as upstream now ships with
  a vendored version of the Image library that includes the fix.
- Switch source download service from deprecated disabledrun to
  manualrun.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763208000">- Add update-go-crypto.patch to address bsc#1253563.
- Switch to go1.24 as required by updated libraries in
  update-go-crypto.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763812800">- Update update-go-crypto.patch to address bsc#1254023 and
  bsc#1253864.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1771588800">- Add update-filippo.io-edwards25519.patch to address bsc#1258591.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1772884800">- Update to version 6.6.0
  * Various bug fixes and performance improvements
- Add downgrade-miekg-dns.patch keeping that dependency on the same
  version as previously.
- Remove update-go-crypto.patch as the dependency was updated
  upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1774526400">- Add update-go-image.patch to address bsc#1260696.
- Switch to go1.25 as required by update go image library.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1779969600">- Update to version 6.6.2
  * Improve git default branch handling
- Drop update-go-image.patch as the dependency was updated upstream.
- Fix accidental inclusion of old vendor directory in the source
  archive.
- Drop downgrade-miekg-dns.patch as it was only a workaround for the
  old vendor directory.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1780056000">- Add update-go-crypto.patch to address boo#1266158.
- Add update-go-net.patch to address boo#1266596.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1780488000">- Update to version 6.6.3
  * Various bug fixes
- Drop update-go-crypto.patch which has been adopted upstream.
- Drop update-go-net.patch which has been adopted upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1782734400">- CVE-2026-46604: TIFF decoder can panic when decoding an invalid
  image with an out-of-bounds strip offset (bsc#1269600)
  * Add update-golang-image-1.patch and update-golang-image-2.patch
    to backport upstreams fix.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1784376000">- CVE-2026-39824: failure to reject ASCII-only Punycode-encoded labels
  * Add update-golang-net.patch to update affected dependency.</changelog>
</package>
<package pkgid="e80e11b4c920530a0fd6738f5740c5a65772d923f547694a8458cc1ae31b98bc97caf8541e4a78ee057a2f1150b936035ab5172273842158f63bfffd69ab00bd" name="kbfs-debuginfo" arch="s390x">
  <version epoch="0" ver="6.6.3" rel="101.1"/>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674302400">- Integrate KBFS packages previously build via own source package
  * Upstream integrated these into the same source.
  * Also includes adding kbfs-related patches
    ensure-mount-dir-exists.patch and
    ensure-service-stop-unmounts-filesystem.patch.
- Upgrade Go version used for compilation to 1.19.
- Use Systemd unit file from upstream source.
- Replace deprecated tar_scm source service by obs_scm.
- Drop the no longer required go_nostrip macro.
- Drop unnessecary use of gofilelist macro.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674648000">- Limit parallel test execution as that seems to cause failing
  builds on OBS that don't occur locally.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1690459200">- Upgrade to version 6.2.2
  * No change log provided</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1691236800">- Update the Image dependency to address CVE-2023-29408 /
  bsc#1213928. This is done via the new update-image-tiff.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.3" date="1696507200">- Update to version 6.2.3
  * Fix incomplete locking in config file handling.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.4" date="1704283200">- Update to version 6.2.4
  * Update client CA</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.8" date="1710417600">- Update to version 6.2.8
  * Bug fixes
- Refreshed update-image-tiff.patch as it no longer applied cleanly.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1718798400">- Update to version 6.3.1
  * Archive your chats/files/repos for easy backups.
  * Wrap text in spoiler to hide spoilers.
- Drop update-image-tiff.patch as upststream now uses a vendored
  version of the Image library that includes the fix.
- Update the used Go version to 1.21 which is the first version to
  support the slices modules which is now used by Keybase.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1720094400">- Update the image dependency to address CVE-2024-24792 /
  boo#1227158. This is done via the new update-golang-x-image.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1745841600">- Update to version 6.5.1
  * Fix team deletion not working
  * Chat attachments improvements
  * Miscellaneous bugfixes
- Drop update-golang-x-image.patch as upstream now ships with
  a vendored version of the Image library that includes the fix.
- Switch source download service from deprecated disabledrun to
  manualrun.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763208000">- Add update-go-crypto.patch to address bsc#1253563.
- Switch to go1.24 as required by updated libraries in
  update-go-crypto.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763812800">- Update update-go-crypto.patch to address bsc#1254023 and
  bsc#1253864.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1771588800">- Add update-filippo.io-edwards25519.patch to address bsc#1258591.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1772884800">- Update to version 6.6.0
  * Various bug fixes and performance improvements
- Add downgrade-miekg-dns.patch keeping that dependency on the same
  version as previously.
- Remove update-go-crypto.patch as the dependency was updated
  upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1774526400">- Add update-go-image.patch to address bsc#1260696.
- Switch to go1.25 as required by update go image library.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1779969600">- Update to version 6.6.2
  * Improve git default branch handling
- Drop update-go-image.patch as the dependency was updated upstream.
- Fix accidental inclusion of old vendor directory in the source
  archive.
- Drop downgrade-miekg-dns.patch as it was only a workaround for the
  old vendor directory.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1780056000">- Add update-go-crypto.patch to address boo#1266158.
- Add update-go-net.patch to address boo#1266596.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1780488000">- Update to version 6.6.3
  * Various bug fixes
- Drop update-go-crypto.patch which has been adopted upstream.
- Drop update-go-net.patch which has been adopted upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1782734400">- CVE-2026-46604: TIFF decoder can panic when decoding an invalid
  image with an out-of-bounds strip offset (bsc#1269600)
  * Add update-golang-image-1.patch and update-golang-image-2.patch
    to backport upstreams fix.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1784376000">- CVE-2026-39824: failure to reject ASCII-only Punycode-encoded labels
  * Add update-golang-net.patch to update affected dependency.</changelog>
</package>
<package pkgid="a29872986aa2718fcb39f624b5ff32b2d1c58519d45aa716f0b2f4c77c648609bbebcbb14110820233b104255d19e06dc51eca5291792a0e499ca1847e5a52b0" name="kbfs-git" arch="s390x">
  <version epoch="0" ver="6.6.3" rel="101.1"/>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674302400">- Integrate KBFS packages previously build via own source package
  * Upstream integrated these into the same source.
  * Also includes adding kbfs-related patches
    ensure-mount-dir-exists.patch and
    ensure-service-stop-unmounts-filesystem.patch.
- Upgrade Go version used for compilation to 1.19.
- Use Systemd unit file from upstream source.
- Replace deprecated tar_scm source service by obs_scm.
- Drop the no longer required go_nostrip macro.
- Drop unnessecary use of gofilelist macro.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674648000">- Limit parallel test execution as that seems to cause failing
  builds on OBS that don't occur locally.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1690459200">- Upgrade to version 6.2.2
  * No change log provided</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1691236800">- Update the Image dependency to address CVE-2023-29408 /
  bsc#1213928. This is done via the new update-image-tiff.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.3" date="1696507200">- Update to version 6.2.3
  * Fix incomplete locking in config file handling.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.4" date="1704283200">- Update to version 6.2.4
  * Update client CA</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.8" date="1710417600">- Update to version 6.2.8
  * Bug fixes
- Refreshed update-image-tiff.patch as it no longer applied cleanly.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1718798400">- Update to version 6.3.1
  * Archive your chats/files/repos for easy backups.
  * Wrap text in spoiler to hide spoilers.
- Drop update-image-tiff.patch as upststream now uses a vendored
  version of the Image library that includes the fix.
- Update the used Go version to 1.21 which is the first version to
  support the slices modules which is now used by Keybase.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1720094400">- Update the image dependency to address CVE-2024-24792 /
  boo#1227158. This is done via the new update-golang-x-image.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1745841600">- Update to version 6.5.1
  * Fix team deletion not working
  * Chat attachments improvements
  * Miscellaneous bugfixes
- Drop update-golang-x-image.patch as upstream now ships with
  a vendored version of the Image library that includes the fix.
- Switch source download service from deprecated disabledrun to
  manualrun.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763208000">- Add update-go-crypto.patch to address bsc#1253563.
- Switch to go1.24 as required by updated libraries in
  update-go-crypto.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763812800">- Update update-go-crypto.patch to address bsc#1254023 and
  bsc#1253864.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1771588800">- Add update-filippo.io-edwards25519.patch to address bsc#1258591.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1772884800">- Update to version 6.6.0
  * Various bug fixes and performance improvements
- Add downgrade-miekg-dns.patch keeping that dependency on the same
  version as previously.
- Remove update-go-crypto.patch as the dependency was updated
  upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1774526400">- Add update-go-image.patch to address bsc#1260696.
- Switch to go1.25 as required by update go image library.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1779969600">- Update to version 6.6.2
  * Improve git default branch handling
- Drop update-go-image.patch as the dependency was updated upstream.
- Fix accidental inclusion of old vendor directory in the source
  archive.
- Drop downgrade-miekg-dns.patch as it was only a workaround for the
  old vendor directory.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1780056000">- Add update-go-crypto.patch to address boo#1266158.
- Add update-go-net.patch to address boo#1266596.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1780488000">- Update to version 6.6.3
  * Various bug fixes
- Drop update-go-crypto.patch which has been adopted upstream.
- Drop update-go-net.patch which has been adopted upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1782734400">- CVE-2026-46604: TIFF decoder can panic when decoding an invalid
  image with an out-of-bounds strip offset (bsc#1269600)
  * Add update-golang-image-1.patch and update-golang-image-2.patch
    to backport upstreams fix.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1784376000">- CVE-2026-39824: failure to reject ASCII-only Punycode-encoded labels
  * Add update-golang-net.patch to update affected dependency.</changelog>
</package>
<package pkgid="eedac904415a090c5ec7ad3cd0e92e249719c20653d27a0638c01e65c6182e6d56f2472c37945a43d3d28f8230690b5c881a9f727a2fa68f1d7c9059fd5a9c45" name="kbfs-git-debuginfo" arch="s390x">
  <version epoch="0" ver="6.6.3" rel="101.1"/>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674302400">- Integrate KBFS packages previously build via own source package
  * Upstream integrated these into the same source.
  * Also includes adding kbfs-related patches
    ensure-mount-dir-exists.patch and
    ensure-service-stop-unmounts-filesystem.patch.
- Upgrade Go version used for compilation to 1.19.
- Use Systemd unit file from upstream source.
- Replace deprecated tar_scm source service by obs_scm.
- Drop the no longer required go_nostrip macro.
- Drop unnessecary use of gofilelist macro.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674648000">- Limit parallel test execution as that seems to cause failing
  builds on OBS that don't occur locally.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1690459200">- Upgrade to version 6.2.2
  * No change log provided</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1691236800">- Update the Image dependency to address CVE-2023-29408 /
  bsc#1213928. This is done via the new update-image-tiff.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.3" date="1696507200">- Update to version 6.2.3
  * Fix incomplete locking in config file handling.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.4" date="1704283200">- Update to version 6.2.4
  * Update client CA</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.8" date="1710417600">- Update to version 6.2.8
  * Bug fixes
- Refreshed update-image-tiff.patch as it no longer applied cleanly.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1718798400">- Update to version 6.3.1
  * Archive your chats/files/repos for easy backups.
  * Wrap text in spoiler to hide spoilers.
- Drop update-image-tiff.patch as upststream now uses a vendored
  version of the Image library that includes the fix.
- Update the used Go version to 1.21 which is the first version to
  support the slices modules which is now used by Keybase.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1720094400">- Update the image dependency to address CVE-2024-24792 /
  boo#1227158. This is done via the new update-golang-x-image.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1745841600">- Update to version 6.5.1
  * Fix team deletion not working
  * Chat attachments improvements
  * Miscellaneous bugfixes
- Drop update-golang-x-image.patch as upstream now ships with
  a vendored version of the Image library that includes the fix.
- Switch source download service from deprecated disabledrun to
  manualrun.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763208000">- Add update-go-crypto.patch to address bsc#1253563.
- Switch to go1.24 as required by updated libraries in
  update-go-crypto.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763812800">- Update update-go-crypto.patch to address bsc#1254023 and
  bsc#1253864.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1771588800">- Add update-filippo.io-edwards25519.patch to address bsc#1258591.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1772884800">- Update to version 6.6.0
  * Various bug fixes and performance improvements
- Add downgrade-miekg-dns.patch keeping that dependency on the same
  version as previously.
- Remove update-go-crypto.patch as the dependency was updated
  upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1774526400">- Add update-go-image.patch to address bsc#1260696.
- Switch to go1.25 as required by update go image library.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1779969600">- Update to version 6.6.2
  * Improve git default branch handling
- Drop update-go-image.patch as the dependency was updated upstream.
- Fix accidental inclusion of old vendor directory in the source
  archive.
- Drop downgrade-miekg-dns.patch as it was only a workaround for the
  old vendor directory.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1780056000">- Add update-go-crypto.patch to address boo#1266158.
- Add update-go-net.patch to address boo#1266596.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1780488000">- Update to version 6.6.3
  * Various bug fixes
- Drop update-go-crypto.patch which has been adopted upstream.
- Drop update-go-net.patch which has been adopted upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1782734400">- CVE-2026-46604: TIFF decoder can panic when decoding an invalid
  image with an out-of-bounds strip offset (bsc#1269600)
  * Add update-golang-image-1.patch and update-golang-image-2.patch
    to backport upstreams fix.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1784376000">- CVE-2026-39824: failure to reject ASCII-only Punycode-encoded labels
  * Add update-golang-net.patch to update affected dependency.</changelog>
</package>
<package pkgid="cc1bd7e1b32e8618be92c35637b17e4a486908aea6c098fd3dda7b25c0cf872908d55a21f663e10cbd9f7ec408026d590f7af98c9268bbf8af76b7481a1a9d0c" name="kbfs-tool" arch="s390x">
  <version epoch="0" ver="6.6.3" rel="101.1"/>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674302400">- Integrate KBFS packages previously build via own source package
  * Upstream integrated these into the same source.
  * Also includes adding kbfs-related patches
    ensure-mount-dir-exists.patch and
    ensure-service-stop-unmounts-filesystem.patch.
- Upgrade Go version used for compilation to 1.19.
- Use Systemd unit file from upstream source.
- Replace deprecated tar_scm source service by obs_scm.
- Drop the no longer required go_nostrip macro.
- Drop unnessecary use of gofilelist macro.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674648000">- Limit parallel test execution as that seems to cause failing
  builds on OBS that don't occur locally.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1690459200">- Upgrade to version 6.2.2
  * No change log provided</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1691236800">- Update the Image dependency to address CVE-2023-29408 /
  bsc#1213928. This is done via the new update-image-tiff.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.3" date="1696507200">- Update to version 6.2.3
  * Fix incomplete locking in config file handling.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.4" date="1704283200">- Update to version 6.2.4
  * Update client CA</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.8" date="1710417600">- Update to version 6.2.8
  * Bug fixes
- Refreshed update-image-tiff.patch as it no longer applied cleanly.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1718798400">- Update to version 6.3.1
  * Archive your chats/files/repos for easy backups.
  * Wrap text in spoiler to hide spoilers.
- Drop update-image-tiff.patch as upststream now uses a vendored
  version of the Image library that includes the fix.
- Update the used Go version to 1.21 which is the first version to
  support the slices modules which is now used by Keybase.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1720094400">- Update the image dependency to address CVE-2024-24792 /
  boo#1227158. This is done via the new update-golang-x-image.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1745841600">- Update to version 6.5.1
  * Fix team deletion not working
  * Chat attachments improvements
  * Miscellaneous bugfixes
- Drop update-golang-x-image.patch as upstream now ships with
  a vendored version of the Image library that includes the fix.
- Switch source download service from deprecated disabledrun to
  manualrun.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763208000">- Add update-go-crypto.patch to address bsc#1253563.
- Switch to go1.24 as required by updated libraries in
  update-go-crypto.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763812800">- Update update-go-crypto.patch to address bsc#1254023 and
  bsc#1253864.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1771588800">- Add update-filippo.io-edwards25519.patch to address bsc#1258591.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1772884800">- Update to version 6.6.0
  * Various bug fixes and performance improvements
- Add downgrade-miekg-dns.patch keeping that dependency on the same
  version as previously.
- Remove update-go-crypto.patch as the dependency was updated
  upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1774526400">- Add update-go-image.patch to address bsc#1260696.
- Switch to go1.25 as required by update go image library.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1779969600">- Update to version 6.6.2
  * Improve git default branch handling
- Drop update-go-image.patch as the dependency was updated upstream.
- Fix accidental inclusion of old vendor directory in the source
  archive.
- Drop downgrade-miekg-dns.patch as it was only a workaround for the
  old vendor directory.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1780056000">- Add update-go-crypto.patch to address boo#1266158.
- Add update-go-net.patch to address boo#1266596.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1780488000">- Update to version 6.6.3
  * Various bug fixes
- Drop update-go-crypto.patch which has been adopted upstream.
- Drop update-go-net.patch which has been adopted upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1782734400">- CVE-2026-46604: TIFF decoder can panic when decoding an invalid
  image with an out-of-bounds strip offset (bsc#1269600)
  * Add update-golang-image-1.patch and update-golang-image-2.patch
    to backport upstreams fix.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1784376000">- CVE-2026-39824: failure to reject ASCII-only Punycode-encoded labels
  * Add update-golang-net.patch to update affected dependency.</changelog>
</package>
<package pkgid="4a8872ece26b88d266e3e32d02c847e7d8cc3c9552400de09ff947ac832fd0d57851255cf3433c59f4b5cf9597b34decdc9d93258a27a92dafaccd57c08d507a" name="kbfs-tool-debuginfo" arch="s390x">
  <version epoch="0" ver="6.6.3" rel="101.1"/>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674302400">- Integrate KBFS packages previously build via own source package
  * Upstream integrated these into the same source.
  * Also includes adding kbfs-related patches
    ensure-mount-dir-exists.patch and
    ensure-service-stop-unmounts-filesystem.patch.
- Upgrade Go version used for compilation to 1.19.
- Use Systemd unit file from upstream source.
- Replace deprecated tar_scm source service by obs_scm.
- Drop the no longer required go_nostrip macro.
- Drop unnessecary use of gofilelist macro.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674648000">- Limit parallel test execution as that seems to cause failing
  builds on OBS that don't occur locally.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1690459200">- Upgrade to version 6.2.2
  * No change log provided</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1691236800">- Update the Image dependency to address CVE-2023-29408 /
  bsc#1213928. This is done via the new update-image-tiff.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.3" date="1696507200">- Update to version 6.2.3
  * Fix incomplete locking in config file handling.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.4" date="1704283200">- Update to version 6.2.4
  * Update client CA</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.8" date="1710417600">- Update to version 6.2.8
  * Bug fixes
- Refreshed update-image-tiff.patch as it no longer applied cleanly.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1718798400">- Update to version 6.3.1
  * Archive your chats/files/repos for easy backups.
  * Wrap text in spoiler to hide spoilers.
- Drop update-image-tiff.patch as upststream now uses a vendored
  version of the Image library that includes the fix.
- Update the used Go version to 1.21 which is the first version to
  support the slices modules which is now used by Keybase.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1720094400">- Update the image dependency to address CVE-2024-24792 /
  boo#1227158. This is done via the new update-golang-x-image.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1745841600">- Update to version 6.5.1
  * Fix team deletion not working
  * Chat attachments improvements
  * Miscellaneous bugfixes
- Drop update-golang-x-image.patch as upstream now ships with
  a vendored version of the Image library that includes the fix.
- Switch source download service from deprecated disabledrun to
  manualrun.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763208000">- Add update-go-crypto.patch to address bsc#1253563.
- Switch to go1.24 as required by updated libraries in
  update-go-crypto.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763812800">- Update update-go-crypto.patch to address bsc#1254023 and
  bsc#1253864.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1771588800">- Add update-filippo.io-edwards25519.patch to address bsc#1258591.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1772884800">- Update to version 6.6.0
  * Various bug fixes and performance improvements
- Add downgrade-miekg-dns.patch keeping that dependency on the same
  version as previously.
- Remove update-go-crypto.patch as the dependency was updated
  upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1774526400">- Add update-go-image.patch to address bsc#1260696.
- Switch to go1.25 as required by update go image library.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1779969600">- Update to version 6.6.2
  * Improve git default branch handling
- Drop update-go-image.patch as the dependency was updated upstream.
- Fix accidental inclusion of old vendor directory in the source
  archive.
- Drop downgrade-miekg-dns.patch as it was only a workaround for the
  old vendor directory.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1780056000">- Add update-go-crypto.patch to address boo#1266158.
- Add update-go-net.patch to address boo#1266596.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1780488000">- Update to version 6.6.3
  * Various bug fixes
- Drop update-go-crypto.patch which has been adopted upstream.
- Drop update-go-net.patch which has been adopted upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1782734400">- CVE-2026-46604: TIFF decoder can panic when decoding an invalid
  image with an out-of-bounds strip offset (bsc#1269600)
  * Add update-golang-image-1.patch and update-golang-image-2.patch
    to backport upstreams fix.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1784376000">- CVE-2026-39824: failure to reject ASCII-only Punycode-encoded labels
  * Add update-golang-net.patch to update affected dependency.</changelog>
</package>
<package pkgid="e279df3609cee4e03c68edea6b9f4ae809fe2d0faa90058c671ded1b4eb3c4036c6323d697b853460f97a11c68b7db4acbaef90a1986c31a9caeeb452eee57f6" name="keybase-client" arch="s390x">
  <version epoch="0" ver="6.6.3" rel="101.1"/>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674302400">- Integrate KBFS packages previously build via own source package
  * Upstream integrated these into the same source.
  * Also includes adding kbfs-related patches
    ensure-mount-dir-exists.patch and
    ensure-service-stop-unmounts-filesystem.patch.
- Upgrade Go version used for compilation to 1.19.
- Use Systemd unit file from upstream source.
- Replace deprecated tar_scm source service by obs_scm.
- Drop the no longer required go_nostrip macro.
- Drop unnessecary use of gofilelist macro.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674648000">- Limit parallel test execution as that seems to cause failing
  builds on OBS that don't occur locally.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1690459200">- Upgrade to version 6.2.2
  * No change log provided</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1691236800">- Update the Image dependency to address CVE-2023-29408 /
  bsc#1213928. This is done via the new update-image-tiff.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.3" date="1696507200">- Update to version 6.2.3
  * Fix incomplete locking in config file handling.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.4" date="1704283200">- Update to version 6.2.4
  * Update client CA</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.8" date="1710417600">- Update to version 6.2.8
  * Bug fixes
- Refreshed update-image-tiff.patch as it no longer applied cleanly.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1718798400">- Update to version 6.3.1
  * Archive your chats/files/repos for easy backups.
  * Wrap text in spoiler to hide spoilers.
- Drop update-image-tiff.patch as upststream now uses a vendored
  version of the Image library that includes the fix.
- Update the used Go version to 1.21 which is the first version to
  support the slices modules which is now used by Keybase.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1720094400">- Update the image dependency to address CVE-2024-24792 /
  boo#1227158. This is done via the new update-golang-x-image.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1745841600">- Update to version 6.5.1
  * Fix team deletion not working
  * Chat attachments improvements
  * Miscellaneous bugfixes
- Drop update-golang-x-image.patch as upstream now ships with
  a vendored version of the Image library that includes the fix.
- Switch source download service from deprecated disabledrun to
  manualrun.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763208000">- Add update-go-crypto.patch to address bsc#1253563.
- Switch to go1.24 as required by updated libraries in
  update-go-crypto.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763812800">- Update update-go-crypto.patch to address bsc#1254023 and
  bsc#1253864.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1771588800">- Add update-filippo.io-edwards25519.patch to address bsc#1258591.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1772884800">- Update to version 6.6.0
  * Various bug fixes and performance improvements
- Add downgrade-miekg-dns.patch keeping that dependency on the same
  version as previously.
- Remove update-go-crypto.patch as the dependency was updated
  upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1774526400">- Add update-go-image.patch to address bsc#1260696.
- Switch to go1.25 as required by update go image library.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1779969600">- Update to version 6.6.2
  * Improve git default branch handling
- Drop update-go-image.patch as the dependency was updated upstream.
- Fix accidental inclusion of old vendor directory in the source
  archive.
- Drop downgrade-miekg-dns.patch as it was only a workaround for the
  old vendor directory.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1780056000">- Add update-go-crypto.patch to address boo#1266158.
- Add update-go-net.patch to address boo#1266596.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1780488000">- Update to version 6.6.3
  * Various bug fixes
- Drop update-go-crypto.patch which has been adopted upstream.
- Drop update-go-net.patch which has been adopted upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1782734400">- CVE-2026-46604: TIFF decoder can panic when decoding an invalid
  image with an out-of-bounds strip offset (bsc#1269600)
  * Add update-golang-image-1.patch and update-golang-image-2.patch
    to backport upstreams fix.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1784376000">- CVE-2026-39824: failure to reject ASCII-only Punycode-encoded labels
  * Add update-golang-net.patch to update affected dependency.</changelog>
</package>
<package pkgid="150eb2e2a9e7fcb2e2596baca38561a17dfb2caec4151ed70a5ffe5ee8db9ee53cff8ac3aa935a53fa8cfd14d2de468ef53b2d37dded83ffd16b76d710c55bad" name="keybase-client" arch="src">
  <version epoch="0" ver="6.6.3" rel="101.1"/>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674302400">- Integrate KBFS packages previously build via own source package
  * Upstream integrated these into the same source.
  * Also includes adding kbfs-related patches
    ensure-mount-dir-exists.patch and
    ensure-service-stop-unmounts-filesystem.patch.
- Upgrade Go version used for compilation to 1.19.
- Use Systemd unit file from upstream source.
- Replace deprecated tar_scm source service by obs_scm.
- Drop the no longer required go_nostrip macro.
- Drop unnessecary use of gofilelist macro.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674648000">- Limit parallel test execution as that seems to cause failing
  builds on OBS that don't occur locally.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1690459200">- Upgrade to version 6.2.2
  * No change log provided</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1691236800">- Update the Image dependency to address CVE-2023-29408 /
  bsc#1213928. This is done via the new update-image-tiff.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.3" date="1696507200">- Update to version 6.2.3
  * Fix incomplete locking in config file handling.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.4" date="1704283200">- Update to version 6.2.4
  * Update client CA</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.8" date="1710417600">- Update to version 6.2.8
  * Bug fixes
- Refreshed update-image-tiff.patch as it no longer applied cleanly.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1718798400">- Update to version 6.3.1
  * Archive your chats/files/repos for easy backups.
  * Wrap text in spoiler to hide spoilers.
- Drop update-image-tiff.patch as upststream now uses a vendored
  version of the Image library that includes the fix.
- Update the used Go version to 1.21 which is the first version to
  support the slices modules which is now used by Keybase.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1720094400">- Update the image dependency to address CVE-2024-24792 /
  boo#1227158. This is done via the new update-golang-x-image.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1745841600">- Update to version 6.5.1
  * Fix team deletion not working
  * Chat attachments improvements
  * Miscellaneous bugfixes
- Drop update-golang-x-image.patch as upstream now ships with
  a vendored version of the Image library that includes the fix.
- Switch source download service from deprecated disabledrun to
  manualrun.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763208000">- Add update-go-crypto.patch to address bsc#1253563.
- Switch to go1.24 as required by updated libraries in
  update-go-crypto.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763812800">- Update update-go-crypto.patch to address bsc#1254023 and
  bsc#1253864.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1771588800">- Add update-filippo.io-edwards25519.patch to address bsc#1258591.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1772884800">- Update to version 6.6.0
  * Various bug fixes and performance improvements
- Add downgrade-miekg-dns.patch keeping that dependency on the same
  version as previously.
- Remove update-go-crypto.patch as the dependency was updated
  upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1774526400">- Add update-go-image.patch to address bsc#1260696.
- Switch to go1.25 as required by update go image library.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1779969600">- Update to version 6.6.2
  * Improve git default branch handling
- Drop update-go-image.patch as the dependency was updated upstream.
- Fix accidental inclusion of old vendor directory in the source
  archive.
- Drop downgrade-miekg-dns.patch as it was only a workaround for the
  old vendor directory.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1780056000">- Add update-go-crypto.patch to address boo#1266158.
- Add update-go-net.patch to address boo#1266596.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1780488000">- Update to version 6.6.3
  * Various bug fixes
- Drop update-go-crypto.patch which has been adopted upstream.
- Drop update-go-net.patch which has been adopted upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1782734400">- CVE-2026-46604: TIFF decoder can panic when decoding an invalid
  image with an out-of-bounds strip offset (bsc#1269600)
  * Add update-golang-image-1.patch and update-golang-image-2.patch
    to backport upstreams fix.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1784376000">- CVE-2026-39824: failure to reject ASCII-only Punycode-encoded labels
  * Add update-golang-net.patch to update affected dependency.</changelog>
</package>
<package pkgid="a7abb22511c7c2dcdaef2a026eba3e080f7e93da627e0af96fe26e625fc10a260b6ce2ff177226b34e9d68dba9526f9db3730850ef804da451e731a2d8a81264" name="keybase-client-debuginfo" arch="s390x">
  <version epoch="0" ver="6.6.3" rel="101.1"/>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674302400">- Integrate KBFS packages previously build via own source package
  * Upstream integrated these into the same source.
  * Also includes adding kbfs-related patches
    ensure-mount-dir-exists.patch and
    ensure-service-stop-unmounts-filesystem.patch.
- Upgrade Go version used for compilation to 1.19.
- Use Systemd unit file from upstream source.
- Replace deprecated tar_scm source service by obs_scm.
- Drop the no longer required go_nostrip macro.
- Drop unnessecary use of gofilelist macro.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674648000">- Limit parallel test execution as that seems to cause failing
  builds on OBS that don't occur locally.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1690459200">- Upgrade to version 6.2.2
  * No change log provided</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1691236800">- Update the Image dependency to address CVE-2023-29408 /
  bsc#1213928. This is done via the new update-image-tiff.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.3" date="1696507200">- Update to version 6.2.3
  * Fix incomplete locking in config file handling.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.4" date="1704283200">- Update to version 6.2.4
  * Update client CA</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.8" date="1710417600">- Update to version 6.2.8
  * Bug fixes
- Refreshed update-image-tiff.patch as it no longer applied cleanly.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1718798400">- Update to version 6.3.1
  * Archive your chats/files/repos for easy backups.
  * Wrap text in spoiler to hide spoilers.
- Drop update-image-tiff.patch as upststream now uses a vendored
  version of the Image library that includes the fix.
- Update the used Go version to 1.21 which is the first version to
  support the slices modules which is now used by Keybase.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1720094400">- Update the image dependency to address CVE-2024-24792 /
  boo#1227158. This is done via the new update-golang-x-image.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1745841600">- Update to version 6.5.1
  * Fix team deletion not working
  * Chat attachments improvements
  * Miscellaneous bugfixes
- Drop update-golang-x-image.patch as upstream now ships with
  a vendored version of the Image library that includes the fix.
- Switch source download service from deprecated disabledrun to
  manualrun.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763208000">- Add update-go-crypto.patch to address bsc#1253563.
- Switch to go1.24 as required by updated libraries in
  update-go-crypto.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763812800">- Update update-go-crypto.patch to address bsc#1254023 and
  bsc#1253864.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1771588800">- Add update-filippo.io-edwards25519.patch to address bsc#1258591.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1772884800">- Update to version 6.6.0
  * Various bug fixes and performance improvements
- Add downgrade-miekg-dns.patch keeping that dependency on the same
  version as previously.
- Remove update-go-crypto.patch as the dependency was updated
  upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1774526400">- Add update-go-image.patch to address bsc#1260696.
- Switch to go1.25 as required by update go image library.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1779969600">- Update to version 6.6.2
  * Improve git default branch handling
- Drop update-go-image.patch as the dependency was updated upstream.
- Fix accidental inclusion of old vendor directory in the source
  archive.
- Drop downgrade-miekg-dns.patch as it was only a workaround for the
  old vendor directory.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1780056000">- Add update-go-crypto.patch to address boo#1266158.
- Add update-go-net.patch to address boo#1266596.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1780488000">- Update to version 6.6.3
  * Various bug fixes
- Drop update-go-crypto.patch which has been adopted upstream.
- Drop update-go-net.patch which has been adopted upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1782734400">- CVE-2026-46604: TIFF decoder can panic when decoding an invalid
  image with an out-of-bounds strip offset (bsc#1269600)
  * Add update-golang-image-1.patch and update-golang-image-2.patch
    to backport upstreams fix.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1784376000">- CVE-2026-39824: failure to reject ASCII-only Punycode-encoded labels
  * Add update-golang-net.patch to update affected dependency.</changelog>
</package>
<package pkgid="017bc9da9752b92be4cdc64eff00316d8a9f9bb5ae008b82a4c45723b09661214e3f3debc48e2be9242069b1c423f779492711782c0e95000271ddbf76e65d84" name="keybase-client-debugsource" arch="s390x">
  <version epoch="0" ver="6.6.3" rel="101.1"/>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674302400">- Integrate KBFS packages previously build via own source package
  * Upstream integrated these into the same source.
  * Also includes adding kbfs-related patches
    ensure-mount-dir-exists.patch and
    ensure-service-stop-unmounts-filesystem.patch.
- Upgrade Go version used for compilation to 1.19.
- Use Systemd unit file from upstream source.
- Replace deprecated tar_scm source service by obs_scm.
- Drop the no longer required go_nostrip macro.
- Drop unnessecary use of gofilelist macro.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.0.2" date="1674648000">- Limit parallel test execution as that seems to cause failing
  builds on OBS that don't occur locally.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1690459200">- Upgrade to version 6.2.2
  * No change log provided</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.2" date="1691236800">- Update the Image dependency to address CVE-2023-29408 /
  bsc#1213928. This is done via the new update-image-tiff.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.3" date="1696507200">- Update to version 6.2.3
  * Fix incomplete locking in config file handling.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.4" date="1704283200">- Update to version 6.2.4
  * Update client CA</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.2.8" date="1710417600">- Update to version 6.2.8
  * Bug fixes
- Refreshed update-image-tiff.patch as it no longer applied cleanly.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1718798400">- Update to version 6.3.1
  * Archive your chats/files/repos for easy backups.
  * Wrap text in spoiler to hide spoilers.
- Drop update-image-tiff.patch as upststream now uses a vendored
  version of the Image library that includes the fix.
- Update the used Go version to 1.21 which is the first version to
  support the slices modules which is now used by Keybase.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.3.1" date="1720094400">- Update the image dependency to address CVE-2024-24792 /
  boo#1227158. This is done via the new update-golang-x-image.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1745841600">- Update to version 6.5.1
  * Fix team deletion not working
  * Chat attachments improvements
  * Miscellaneous bugfixes
- Drop update-golang-x-image.patch as upstream now ships with
  a vendored version of the Image library that includes the fix.
- Switch source download service from deprecated disabledrun to
  manualrun.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763208000">- Add update-go-crypto.patch to address bsc#1253563.
- Switch to go1.24 as required by updated libraries in
  update-go-crypto.patch.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.5.1" date="1763812800">- Update update-go-crypto.patch to address bsc#1254023 and
  bsc#1253864.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1771588800">- Add update-filippo.io-edwards25519.patch to address bsc#1258591.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1772884800">- Update to version 6.6.0
  * Various bug fixes and performance improvements
- Add downgrade-miekg-dns.patch keeping that dependency on the same
  version as previously.
- Remove update-go-crypto.patch as the dependency was updated
  upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.0" date="1774526400">- Add update-go-image.patch to address bsc#1260696.
- Switch to go1.25 as required by update go image library.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1779969600">- Update to version 6.6.2
  * Improve git default branch handling
- Drop update-go-image.patch as the dependency was updated upstream.
- Fix accidental inclusion of old vendor directory in the source
  archive.
- Drop downgrade-miekg-dns.patch as it was only a workaround for the
  old vendor directory.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt; - 6.6.2" date="1780056000">- Add update-go-crypto.patch to address boo#1266158.
- Add update-go-net.patch to address boo#1266596.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1780488000">- Update to version 6.6.3
  * Various bug fixes
- Drop update-go-crypto.patch which has been adopted upstream.
- Drop update-go-net.patch which has been adopted upstream.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1782734400">- CVE-2026-46604: TIFF decoder can panic when decoding an invalid
  image with an out-of-bounds strip offset (bsc#1269600)
  * Add update-golang-image-1.patch and update-golang-image-2.patch
    to backport upstreams fix.</changelog>
  <changelog author="Matthias Bach &lt;marix@marix.org&gt;" date="1784376000">- CVE-2026-39824: failure to reject ASCII-only Punycode-encoded labels
  * Add update-golang-net.patch to update affected dependency.</changelog>
</package>
<package pkgid="32d45ca4451e43d785eaacaaf669bab026f2ad8430fa7a7822858599937acbdd5c8a7dd9909bc424ae18e3f8fbfd32fb974c05c0ae27a0c83c4ad9a2f0e1057f" name="keychain" arch="noarch">
  <version epoch="0" ver="2.8.5" rel="38.5"/>
  <changelog author="pascal.bleser@opensuse.org" date="1249646400">- update to 2.6.9:
  + potential issues with GNU grep were fixed
  + the README file was changed to README.rst (reStructuredText)
  + the maintainership information was updated
  + the default output was simplified, so --version or --help are
    now required to show version, copyright, and license
    information
- simplification of the spec file
- add check section</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1256472000">- update to 2.7.0:
  * improved color scheme, output formatting, and the --quiet
    option
  * the lockfile() implementation was simplified for smaller code</changelog>
  <changelog author="lars@linux-schulserver.de" date="1264766400">- require openssh as ssh is dead
- remove conditions for unsupported openSUSE versions</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1274616000">- update to 2.7.1:
  * a GPG fix for pinentry issues (Gentoo bug 203871)
- removed keychain-extract_version_with_perl.patch as upstream came
  up with a more predictable way of determining the version
- removed use of and dependency on the licenses packages as it is
  now considered a bad practice after all</changelog>
  <changelog author="mrueckert@suse.de" date="1423828800">- added 0001-Update-inheritagents-for-GnuPG-v.2.1.patch:
  Backport the GPG 2.1 support from git head</changelog>
  <changelog author="p.drouand@gmail.com" date="1449057600">- Update to version 2.8.2 (boo#991003):
  * Summary: Support new ssh features, bug fix release.
  * Support for new hash algorithms
  * Remove bashisms
  * Various optimizations
  * --timeout option now gets passed to agent, doc fixes
  * RPM, Makefile fixes
- Changes from version 2.8.1
  * Summary: POSIX compatibility and bug fix release.
  * Only set PATH to a standard value if PATH is not set. Otherwise,
    do not modify.
  * Makefile Cygwin and RPM spec fixes
  * Confhost fixes. Deprecate in_path. Use command -v instead.
  * Find_pids: Modify "ps" call to work with non-GNU ps.
  * Re-introduce POSIX compatibility (remove shopt.)
- Changes from version 2.8.0
  * Support for OpenSSH 6.8 fingerprints.
  * Support for GnuPG 2.1.0.
  * Handle private keys that are symlinks, even if the associated
    public key is in the target directory rather than alongside the
    symlink.
  * Allow private keys to have extensions, such as foo.priv.
    When looking for matching public keys, look for foo.priv.pub,
    but also strip extension and look for foo.pub if foo.priv.pub
    doesn't exist.
  * Initial support for --list/-l option to list SSH keys.
  * Updated docs for fish shell usage.
- Changes from version 2.7.2beta1
  * Various changes and updates:
  * Fixes for fish.
  * Keychain will default to start only ssh-agent unless GPG is
    explicitly updated using --agents.
  * Write ~/.gpg-agent-info when launching gpg-agent.
  * Add support for injecting agents into systemd
  * Add support for --query option
  * Add --absolute flag, allowing user to set a full path without
    getting a .keychain suffix automatically appended.
  * Add --confhost option to scan ~/.ssh/config file to
    locate private key path specified there.
- Update project and download Urls
- Remove 0001-Update-inheritagents-for-GnuPG-v.2.1.patch; fixed
  on upstream release
- Perform a spec-cleaner
- Remove useless dependencies
  * perl
  * make
  * sed
  * openssh</changelog>
  <changelog author="dimstar@opensuse.org" date="1477310400">- Update to version 2.8.3:
  * Fix gpg key addition.</changelog>
  <changelog author="kbabioch@suse.com" date="1517486400">- Update to version 2.8.5:
  * Summary Various fixes and support systemd gnupg sockets
  * Some shells don't support local builtin
  * Support systemd managed gnupg sockets
  * Fix some lintian warnings in the man page
  * Fix issues loading pem keys
- Changes from 2.8.4:
  * Support of GPG2
  * Support busybox ps
  * Various optimizations
- Changed Source spec file, since upstream has migrated to GitHub</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- use https url</changelog>
  <changelog author="Christoffer Karlsson &lt;ck@ckarlsson.me&gt;" date="1742817600">- Only depend on openssh-clients, not openssh-server</changelog>
</package>
<package pkgid="ef48fe6ac096fafb90964ba7461873b5d0d0b09fd896667de038dc9b89c26f1b3d4a5240a5c6881ae1ada74ee71ee2f1270c2600644598207eb3703cbddec9c9" name="keychain" arch="src">
  <version epoch="0" ver="2.8.5" rel="38.5"/>
  <changelog author="pthomas@suse.de" date="1058788800">- Initial package.
- Add a manpage.</changelog>
  <changelog author="hmacht@suse.de" date="1075982400">- added option # norootforbuild in specfile</changelog>
  <changelog author="pth@suse.de" date="1092657600">- Update to 2.3.4</changelog>
  <changelog author="pth@suse.de" date="1100606400">- Update to 2.4.2.1</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="pth@suse.de" date="1155643200">- Update to 2.6.2
  Changes since 2.4.2.1:
  * Add inheritance support via --inherit.  Add parameters to --stop for
    more control.
  * Add gpg keys to the agent.
  * Add the --env option and automatic reading of .keychain/env.
  * Add --confirm option and corresponding regression tests.</changelog>
  <changelog author="lrupp@suse.de" date="1182254400">- update to 2.6.8:
  + Support fish: http://roo.no-ip.org/fish/
    (thanks to Ilkka Poutanen)
  + Add validinherit function: warning messages aren't emitted
    unnecessarily
  + Break out of loop when empty lockfile can't be removed
  + Make --lockwait -1 mean forever.
  + Add more locking regression tests
  + Prevent gpg_listmissing from accidentally loading keys
  + Save LC_ALL for gpg invocation so that pinentry-curses works.
- gzip the manpage
- don't remove %{buildroot} in %install - let rpm do this
- fix requires
- don't package the pod-file (same as manpage)</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1249646400">- update to 2.6.9:
  + potential issues with GNU grep were fixed
  + the README file was changed to README.rst (reStructuredText)
  + the maintainership information was updated
  + the default output was simplified, so --version or --help are
    now required to show version, copyright, and license
    information
- simplification of the spec file
- add check section</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1256472000">- update to 2.7.0:
  * improved color scheme, output formatting, and the --quiet
    option
  * the lockfile() implementation was simplified for smaller code</changelog>
  <changelog author="lars@linux-schulserver.de" date="1264766400">- require openssh as ssh is dead
- remove conditions for unsupported openSUSE versions</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1274616000">- update to 2.7.1:
  * a GPG fix for pinentry issues (Gentoo bug 203871)
- removed keychain-extract_version_with_perl.patch as upstream came
  up with a more predictable way of determining the version
- removed use of and dependency on the licenses packages as it is
  now considered a bad practice after all</changelog>
  <changelog author="mrueckert@suse.de" date="1423828800">- added 0001-Update-inheritagents-for-GnuPG-v.2.1.patch:
  Backport the GPG 2.1 support from git head</changelog>
  <changelog author="p.drouand@gmail.com" date="1449057600">- Update to version 2.8.2 (boo#991003):
  * Summary: Support new ssh features, bug fix release.
  * Support for new hash algorithms
  * Remove bashisms
  * Various optimizations
  * --timeout option now gets passed to agent, doc fixes
  * RPM, Makefile fixes
- Changes from version 2.8.1
  * Summary: POSIX compatibility and bug fix release.
  * Only set PATH to a standard value if PATH is not set. Otherwise,
    do not modify.
  * Makefile Cygwin and RPM spec fixes
  * Confhost fixes. Deprecate in_path. Use command -v instead.
  * Find_pids: Modify "ps" call to work with non-GNU ps.
  * Re-introduce POSIX compatibility (remove shopt.)
- Changes from version 2.8.0
  * Support for OpenSSH 6.8 fingerprints.
  * Support for GnuPG 2.1.0.
  * Handle private keys that are symlinks, even if the associated
    public key is in the target directory rather than alongside the
    symlink.
  * Allow private keys to have extensions, such as foo.priv.
    When looking for matching public keys, look for foo.priv.pub,
    but also strip extension and look for foo.pub if foo.priv.pub
    doesn't exist.
  * Initial support for --list/-l option to list SSH keys.
  * Updated docs for fish shell usage.
- Changes from version 2.7.2beta1
  * Various changes and updates:
  * Fixes for fish.
  * Keychain will default to start only ssh-agent unless GPG is
    explicitly updated using --agents.
  * Write ~/.gpg-agent-info when launching gpg-agent.
  * Add support for injecting agents into systemd
  * Add support for --query option
  * Add --absolute flag, allowing user to set a full path without
    getting a .keychain suffix automatically appended.
  * Add --confhost option to scan ~/.ssh/config file to
    locate private key path specified there.
- Update project and download Urls
- Remove 0001-Update-inheritagents-for-GnuPG-v.2.1.patch; fixed
  on upstream release
- Perform a spec-cleaner
- Remove useless dependencies
  * perl
  * make
  * sed
  * openssh</changelog>
  <changelog author="dimstar@opensuse.org" date="1477310400">- Update to version 2.8.3:
  * Fix gpg key addition.</changelog>
  <changelog author="kbabioch@suse.com" date="1517486400">- Update to version 2.8.5:
  * Summary Various fixes and support systemd gnupg sockets
  * Some shells don't support local builtin
  * Support systemd managed gnupg sockets
  * Fix some lintian warnings in the man page
  * Fix issues loading pem keys
- Changes from 2.8.4:
  * Support of GPG2
  * Support busybox ps
  * Various optimizations
- Changed Source spec file, since upstream has migrated to GitHub</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- use https url</changelog>
  <changelog author="Christoffer Karlsson &lt;ck@ckarlsson.me&gt;" date="1742817600">- Only depend on openssh-clients, not openssh-server</changelog>
</package>
<package pkgid="0a5ed092419f96ee08268edc294cff46bceec466536803ca81475cfd06ac0e555f7a567d2b8150e78e07df0927e90f8a8593ef36ff9a9071947e4187c9460c26" name="keylime" arch="src">
  <version epoch="0" ver="7.14.3" rel="121.3"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="04930f6ba24277d996eb447095f202704f54ea0237bde5f3196263ffa34747981980ba536d084ee9ddc60baf0be0fc4dbc1d90b743bdd96959ec969b9d3b78e9" name="keylime-config" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="121.3"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="f0ca9d588e19a8051e69b745ee8816f5da23d39fc3fb2528b108b4e444d02f5de9f8344875dab22d1498fa9d2cd3aca1ddcc4012ac70f63b9ff8e075c7182f63" name="keylime-firewalld" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="121.3"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="2032f8a272b6e125441e7781164176ce5b80d059efb941431b27cdb27592825eee4f3f013931b38fec90ff1db602319fad6278a6cab5886dceec8c7855e8bb99" name="keylime-ima-policy" arch="s390x">
  <version epoch="0" ver="0.2.9+49" rel="87.3"/>
  <changelog author="aplanas@suse.com" date="1701432000">- Update to version 0.2.3+git.1701075380.a5dc985:
  * build(deps): bump actix-rt from 2.8.0 to 2.9.0
  * Bump version to 0.2.3
  * build(deps): bump reqwest from 0.11.20 to 0.11.22
  * Bump configuration version and fix enable_iak_idevid
  * Enable test functional/iak-idevid-register-with-certificates
  * Update packit plan with new tests
  * Add certificates and certificate checking for IDevID and IAK keys (#669)</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version 0.2.4+git.1706692574.a744517:
  * Bump version to 0.2.4
  * build(deps): bump uuid from 1.4.1 to 1.7.0
  * keylime-agent.conf: Allow setting event logs paths
  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.
  * workflows: Update checkout action to version 4
  * build(deps): bump serde from 1.0.188 to 1.0.195
  * build(deps): bump pest_derive from 2.7.0 to 2.7.6
  * build(deps): bump openssl from 0.10.62 to 0.10.63
  * build(deps): bump config from 0.13.3 to 0.13.4
  * build(deps): bump base64 from 0.21.4 to 0.21.7
  * build(deps): bump tempfile from 3.8.0 to 3.9.0
  * build(deps): bump pest from 2.7.0 to 2.7.6
  * build(deps): bump actix-web from 4.4.0 to 4.4.1
  * build(deps): bump reqwest from 0.11.22 to 0.11.23
  * build(deps): bump h2 from 0.3.17 to 0.3.24
  * build(deps): bump shlex from 1.1.0 to 1.3.0
  * cargo: Bump tss-esapi to version 7.4.0
  * workflows: Fix keylime-bot token usage
  * tpm: Add error context for every possible error
  * tpm: Add AlgorithmError to TpmError
  * detect idevid template from certificates
  * build(deps): bump wiremock from 0.5.18 to 0.5.22
  * build(deps): bump thiserror from 1.0.48 to 1.0.56
  * Make use of workspace dependencies
  * build(deps): bump openssl from 0.10.57 to 0.10.62
  * packit: Bump Fedora version used for code coverage</changelog>
  <changelog author="aplanas@suse.com" date="1714478400">- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)
- Update to version 0.2.4~39:
  * build(deps): bump openssl from 0.10.63 to 0.10.64
  * build(deps): bump h2 from 0.3.24 to 0.3.26
  * build(deps): bump serde_json from 1.0.107 to 1.0.116
  * build(deps): bump actix-web from 4.4.1 to 4.5.1
  * crypto: Enable TLS 1.3
  * build(deps): bump tempfile from 3.9.0 to 3.10.1
  * build(deps): bump mio from 0.8.4 to 0.8.11
  * enable hex values to be used for tpm_ownerpassword
  * config: Support IPv6 with or without brackets
  * keylime: Implement a simple IP parser to remove brackets
  * crypto: Implement CertificateBuilder to generate certificates
  * tests: Fix coverage download by supporting arbitrary URL
  * cargo: Add testing feature to keylime library
  * Set X509 SAN with local DNSname/IP/IPv6
  * Include newest Node20 versions for Github actions
  * tpm: Add unit test for uncovered public functions
  * crypto: Implement ECC key generation support
  * crypto: Add test for match_cert_to_template()
  * Fix minor typo, format and remove end whitespaces
  * crypto: Make error types less specific
  * tests/run.sh: Run tarpaulin with a single thread
  * payloads: Remove explicit drop of channel transmitter
  * crypto: Move to keylime library
  * crypto: Add specific type for every possible error
  * tpm: Rename origin of error as source in structures
  * list_parser: Add source for error for backtrace
  * algorithms: Make errors more specific
  * typo fix for default path to measured boot log file
  * README: remove mentions of libarchive as a dependency
  * Dockerfile.wolfi: Update clang to version 17
  * docker: Remove libarchive as a dependency
  * rpm: Remove libarchive from dependencies
  * cargo: Replace compress-tools with zip crate
  * cargo: Bump ahash to version 0.8.7
  * build(deps): bump serde from 1.0.195 to 1.0.196
  * build(deps): bump libc from 0.2.152 to 0.2.153
  * build(deps): bump reqwest from 0.11.23 to 0.11.24
  * docker: Install configuration file in the correct path
  * config: Make IAK/IDevID disabled by default</changelog>
  <changelog author="aplanas@suse.com" date="1714651200">- Update to version 0.2.5~0:
  * Bump version to 0.2.5
  * cargo: Relax required version for pest crate
  * build(deps): bump log from 0.4.20 to 0.4.21
  * build(deps): bump thiserror from 1.0.56 to 1.0.59</changelog>
  <changelog author="aplanas@suse.com" date="1715860800">- Update to version 0.2.5~4:
  * Fix 'unnecessary qualification' warnings
  * fix IAK template to match IDevID
  * rpm: fix COPR RPMs build for centos-stream-10
  * Build COPR RPMs for centos-stream-10</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version 0.2.6~0:
  * Bump version to 0.2.6
  * build(deps): bump libc from 0.2.153 to 0.2.155
  * build(deps): bump serde from 1.0.196 to 1.0.203
  * rpm/fedora: Update rust macro usage
  * config: Support hostnames in registrar_ip option
  * added use of persisted IAK and IDevID and authorisation values
  * config changes
  * Adding /agent/info API to agent
  * Fix leftover 'unnecessary qualification' warnings on tests</changelog>
  <changelog author="aplanas@suse.com" date="1725278400">- Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
  * rustix 0.37.25
  * rustix 0.38.34
  * shlex  1.3.0
- Update to version 0.2.6+13:
  * Enable test functional/iak-idevid-persisted-and-protected
  * build(deps): bump uuid from 1.7.0 to 1.10.0
  * build(deps): bump openssl from 0.10.64 to 0.10.66
  * keylime-agent/src/revocation: Fix comment indentation
  * keylime/crypto: Fix indentation of documentation comment
  * build(deps): bump thiserror from 1.0.59 to 1.0.63
  * build(deps): bump serde_json from 1.0.116 to 1.0.120
  * dependabot: Extend to also monitor workflow actions
  * ci: Disable Packit CI on CentOS Stream 9
  * ci: use CODECOV_TOKEN when submitting coverage data
  * revocation: Use into() for unfallible transformation
  * secure_mount: Fix possible infinite loop
  * error: Rename enum variants to avoid clippy warning</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version 0.2.7+1:
  * dist: Enable logging for keylime library in the service
  * Bump version to 0.2.7
  * scripts: Download coverage data from Testing Farm directly
  * main: Remove unnecessary lifetime
  * cargo: Bump pretty_env_logger to version 0.5.0
  * scripts: Fix regex in download_packit_coverage.sh
  * cargo: Bump clap crate to version 4.5.23
  * cargo: Bump base64 crate to version 0.22.1
  * build(deps): bump log from 0.4.22 to 0.4.25
  * build(deps): bump serde_json from 1.0.133 to 1.0.135
  * cargo: Bump tokio crate to version 1.42.0
  * packit: Fix RPM builds on copr
  * cargo: Bump thiserror crate to version 0.2.9
  * cargo: Update reqwest to version 0.12.12
  * build(deps): bump libc from 0.2.168 to 0.2.169
  * build(deps): bump glob from 0.3.1 to 0.3.2
  * version: Implement API version validation and ordering
  * main: Support using multiple API versions for registration
  * keylime: Introduce the registrar_client module
  * Provide endpoints under multiple API versions
  * Move 'serialization' module to the keylime library
  * Drop unnecessary dependency on common::API_VERSION
  * keylime-agent.conf: Bump version to 2.3
  * build(deps): bump serde from 1.0.210 to 1.0.217
  * build(deps): bump pest_derive from 2.7.14 to 2.7.15
  * build(deps): bump pest from 2.7.14 to 2.7.15
  * build(deps): bump libc from 0.2.167 to 0.2.168
  * config: Make IAK and IDevID certificates optional
  * Fix warnings reported by clippy
  * workflows: Run job in the CI container directly
  * tests: Add unit test for device ID builder
  * main: Move IAK/IDevID related code to dedicated module
  * tests: Add script to generate IAK and IDevID certificates
  * build(deps): bump openssl from 0.10.66 to 0.10.68
  * build(deps): bump uuid from 1.10.0 to 1.11.0
  * build(deps): bump serde_json from 1.0.128 to 1.0.133
  * build(deps): bump actix-web from 4.5.1 to 4.9.0
  * build(deps): bump reqwest from 0.12.7 to 0.12.9
  * tests/setup_swtpm.sh: Add script to setup temporary TPM
  * Use a single TPM context and avoid race conditions during tests
  * config: Enable passing a hostname instead of IP
  * build(deps): bump clap from 4.3.11 to 4.5.21
  * build(deps): bump tempfile from 3.10.1 to 3.14.0
  * build(deps): bump pest_derive from 2.7.6 to 2.7.14
  * build(deps): bump pest from 2.7.6 to 2.7.14
  * build(deps): bump codecov/codecov-action from 4 to 5
  * workflows: Submit the coverage for merged PR from Fedora 41
  * tests: Use Fedora 41 to generate code coverage
  * api: Make API configuration modular
  * agent_handler: Move the /agent scope configuration
  * notifications_handler: Move the /notifications scope configuration
  * quotes_handler: Move the /quotes scope configuration to quotes_handler
  * keys_handler: Move /keys scope configuration to keys_handler
  * Use ${DESTDIR} for config
  * Fix showing wrong UUID
  * build(deps): bump actix-rt from 2.9.0 to 2.10.0
  * config: Refactor AgentConfig Source trait implementation
  * build(deps): bump log from 0.4.21 to 0.4.22
  * build(deps): bump serde_json from 1.0.120 to 1.0.128
  * tpm: check if EK certificate has valid ASN.1 DER encoding
  * build(deps): bump futures from 0.3.27 to 0.3.31
  * cargo: Bump reqwest to version 0.12.7
  * build(deps): bump serde from 1.0.203 to 1.0.210
  * tests: Add more tests to Packit CI
  * build(deps): bump docker/build-push-action from 5 to 6
  * tests: apply workarounds to known bugs</changelog>
  <changelog author="aplanas@suse.com" date="1749124800">- Update vendored crates (bsc#1243861, CVE-2024-12224)
  * idna 1.0.3
- Add Cargo_lock.patch to adjust versions that will allow the
  compilation of mbox crate
- Update to version 0.2.7+70:
  * build(deps): bump wiremock from 0.6.2 to 0.6.3
  * build(deps): bump uuid from 1.16.0 to 1.17.0
  * lib: Introduce AgentIdentity structure
  * gitignore: Add *.swp and *.orig to be ignored
  * build(deps): bump clap from 4.5.38 to 4.5.39
  * build(deps): bump tokio from 1.45.0 to 1.45.1
  * Unify Push Model structures time formats to UTC (#1016)
  * Add Quote related structures to Keylime library
  * Remove configuration file trailing whitespaces (#1012)
  * keylime-agent.conf: add all accepted TPM encryption algs
  * tpm: add policy auth for EK to activate crendential
  * Enable non standard key sizes and curves for EK and AK
  * config: Use next_back() instead of last() for iterators
  * Update to tss-esapi v7.6.0
  * Avoid duplicated call to ctx.create_ek
  * build(deps): bump clap from 4.5.23 to 4.5.38
  * Add registration for Push Model client
  * build(deps): bump tokio from 1.44.2 to 1.45.0
  * build(deps): bump chrono from 0.4.40 to 0.4.41
  * build(deps): bump tempfile from 3.17.1 to 3.20.0
  * Refactor code: move error, registration to lib
  * Move structure filling and URL selection code (#999)
  * build(deps): bump pest_derive from 2.7.15 to 2.8.0
  * build(deps): bump pest from 2.7.15 to 2.8.0
  * build(deps): bump libc from 0.2.169 to 0.2.172
  * Add Evidence/Authentication messages to prototype
  * build(deps): bump uuid from 1.15.1 to 1.16.0
  * build(deps): bump thiserror from 2.0.11 to 2.0.12
  * build(deps): bump signal-hook from 0.3.17 to 0.3.18
  * build(deps): bump log from 0.4.25 to 0.4.27
  * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
  * build(deps): bump actix-web from 4.9.0 to 4.10.2
  * build(deps): bump reqwest from 0.12.12 to 0.12.15
  * build(deps): bump serde from 1.0.217 to 1.0.219
  * Add unit tests for sessions.rs structures
  * Add auth(sessions) structures
  * Fix minor README.md issue (#988)
  * Define EvidenceHandling structures (#971)
  * Add mockoon test scenario
  * Add client certificates to push-attestation prototype
  * Cargo: bump url crate to version 2.5.4
  * Add logging to the push attestation prototype
  * Do not use certificate on insecure mode
  * common: Move the EncryptedData structure from common to the library
  * common: Move AuthTag from common to the library
  * build(deps): bump openssl from 0.10.71 to 0.10.72
  * common: Move Symmkey to library as crypto::symmkey
  * common: Remove unused constants and static values
  * build(deps): bump tokio from 1.43.0 to 1.44.2
  * Refactor code: Include AgentIdentity structure
  * Push model prototype
  * Add support for ek certificate chain, stored in TPM NVRAM.
  * Recover key_class field and set it as "asymmetric"
  * Update push model structures to latest values
  * build(deps): bump serde_json from 1.0.138 to 1.0.140
  * packit: Add identifier for each copr_build job
  * keylime-agent.conf: only mention ecdsa and rsassa for signing
  * build(deps): bump openssl from 0.10.70 to 0.10.71
  * build(deps): bump uuid from 1.13.2 to 1.15.1
  * Add capabilities_negotiation structures
  * packit: Add compatibility/api_version_compatibility test
  * build(deps): bump uuid from 1.11.0 to 1.13.2
  * build(deps): bump serde_json from 1.0.135 to 1.0.138
  * build(deps): bump thiserror from 2.0.9 to 2.0.11
  * build(deps): bump tempfile from 3.14.0 to 3.17.1
  * Allow agent to start as non-root
  * scripts: Fix coverage information downloading script
  * build(deps): bump openssl from 0.10.68 to 0.10.70
  * build(deps): bump tokio from 1.42.0 to 1.43.0</changelog>
  <changelog author="aplanas@suse.com" date="1752494400">- Update vendored crates (bsc#1242623, CVE-2025-3416)
  * openssl 0.10.73
- Update to version 0.2.7+117:
  * Increase coverage in evidence handling structure
  * Add Capabilities Negotiations resp. missing fields
  * Fix UEFI test to check file access in all cases
  * context_info_handler: Do not assume /var/lib/keylime exists
  * Fix clippy warnings about uninlined format arguments
  * attestation: Allow unwrap() in tests
  * Increase coverage (groom code, extend unit tests)
  * Include IMA/UEFI logs in Evidence Handling request
  * Include method to get all IMA entries as string
  * Send correct list of pcr banks and sign algorithms
  * Try to fix TPM tests related issues
  * Define attestation perform asynchronous
  * Perform attestation in push model agent binary
  * Refactor code to use new attestation.rs
  * Create attestation.rs for Attestation stuff
  * Move ContextInfo management to its own handler
  * Adjust context_info.rs after rebase
  * Add attestation function to ContextInfo structure
  * Add prohibited signing algorithms, avoid ecschnorr
  * keylime/config: Use macro to implement PushModelConfigTrait
  * Introduce keylime-macros and define_view_trait
  * config: Remove KeylimeConfig structure
  * config: Remove unnecessary options and lazy initialization
  * Fix pcr_bank function to send all possible slots
  * Send Content-Type:application/json on request (#1039)
  * Send correct 'key_algorithm' in certification_keys (#1035)
  * Push Model: Persist Attestation Key to file
  * Add Keylime push model binary to root GNUmakefile
  * Use singleton to avoid multiple Context allocation
  * tests: Do not assume `/var/lib/keylime` exists (#1030)
  * lib/cert: Fix race condition due to use of same file path
  * payloads: Fix race condition in tests
  * Add uefi_log_handler.rs to parse UEFI binary
  * Use IMA log parser to send correct entry count
  * Add IMA log parser
  * build(deps): bump once_cell from 1.19.0 to 1.21.3
  * lib/config/base.rs: Add more unit tests
  * lib/permissions: Add unit tests
  * keylime-agent: move JsonWrapper from common.rs to the library
  * lib/agent_data: Move agent_data related tests from common
  * common: Replace APIVersion with the library Version structure
  * keylime_agent: Move secure_mount.rs to the library
  * lib: Rename keylime_error.rs as error.rs
  * config: Move config to keylime library
  * config: Rename push_model_config to push_model
  * lib: Move permissions.rs from keylime-agent to the lib
  * Extract Capabilities Negotiation info from TPM (#1014)</changelog>
  <changelog author="aplanas@suse.com" date="1754568000">- Update vendored crates (bsc#1247193, CVE-2025-58266)
  * shlex 1.3.0
- Rebase keylime-agent.conf.diff for current configuration
- Drop Cargo_lock.patch patch, already present in Cargo.lock
- Update to version 0.2.7+141:
  * service: Use WantedBy=multi-user.target
  * rpm: Add subpackage for push-attestation agent
  * push-model: implement continuous attestation with configurable intervals
  * Retry registration forever in the state machine
  * Add Verifier URL to configuration
  * Align exp.backoff to current configuration format
  * Increase coverage of state machine (using Context)
  * Increase coverage of struct_filler.rs
  * Groom code (remove dead code)
  * Fix exponential backoff (10secs, 4xx accepted)
  * test: Add documentation test to tests/run.sh
  * tpm: Avoid running code example during documentation tests
  * state_machine: Always start the agent from the Unregistered state
  * Add fixes for the URL construction
  * Refactor evidences collection in push attestation agent
  * push-model: refactor attestation logic into a state machine
  * Fix body sending by allowing serializing strings (#1057)
  * Log ResilientClient errors/response status codes (#1055)
  * Add AK signing scheme and hash algorithm to negotiation
  * tpm: Add method to extract signing scheme and hash algorithm from AK
  * Allow custom content-type/accept headers
  * Integrate exponential backoff to registration (#1052)
  * keylime/structures: Rename ShaValues to PcrBanks
  * Add resilient_client for exponential backoff (#1048)</changelog>
  <changelog author="aplanas@suse.com" date="1755691200">- Update vendored crates (bsc#1248006, CVE-2025-55159)
  * slab 0.4.11
- Add Cargo_lock.patch patch to update slab and other dependencies
- Update to version 0.2.8+12:
  * build(deps): bump actions/checkout from 4 to 5
  * build(deps): bump cfg-if from 1.0.0 to 1.0.1
  * build(deps): bump openssl from 0.10.72 to 0.10.73
  * build(deps): bump clap from 4.5.39 to 4.5.45
  * build(deps): bump pest from 2.8.0 to 2.8.1
  * Fix clippy warnings
  * Use verifier-provided interval for continuous attestation timing
  * Add meta object with seconds_to_next_attestation to evidence response
  * Fix boot time retrieval
  * Fix IMA log format (it must be ['text/plain']) (#1073)
  * Remove unnecessary configuration fields
  * cargo: Bump retry-policies to version 0.4.0
  * Bump version to 0.2.8</changelog>
  <changelog author="aplanas@suse.com" date="1767787200">- Use tmpfiles.d for /var directories (PED-14736)
  + tmpfiles.keylime renamed to rust-keylime.conf and extended
- Update to version 0.2.8+96:
  * build(deps): bump wiremock from 0.6.4 to 0.6.5
  * build(deps): bump actions/checkout from 5 to 6
  * build(deps): bump chrono from 0.4.41 to 0.4.42
  * packit: Get coverage from Fedora 43 runs
  * Fix issues pointed out by clippy
  * Replace mutex unwraps with proper error handling in TPM library
  * Remove unused session request methods from StructureFiller
  * Fix config panic on missing ek_handle in push model agent
  * build(deps): bump tempfile from 3.21.0 to 3.23.0
  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  * Fix clippy warnings project-wide
  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  * Thread privileged resources and use MeasurementList for IMA reading
  * Add privileged resource initialization and privilege dropping to push model agent
  * Fix privilege dropping order in run_as()
  * add documentation on FQDN hostnames
  * Remove confusing logs for push mode agent
  * Set correct default Verifier port (8891-&gt;8881) (#1159)
  * Add verifier_url to reference configuration file (#1158)
  * Add TLS support for Registrar communication (#1139)
  * Fix agent handling of 403 registration responses (#1154)
  * Add minor README.md rephrasing (#1151)
  * build(deps): bump actions/checkout from 5 to 6 (#1153)
  * ci: update spec files for packit COPR build
  * docs: improve challenge encoding and async TPM documentation
  * refactor: improve middleware and error handling
  * feat: add authentication client with middleware integration
  * docker: Include keylime_push_model_agent binary
  * Include attestation_interval configuration (#1146)
  * Persist payload keys to avoid attestation failure on restart
  * crypto: Implement the load or generate pattern for keys
  * Use simple algorithm specifiers in certification_keys object (#1140)
  * tests: Enable more tests in CI
  * Fix RSA2048 algorithm reporting in keylime agent
  * Remove disabled_signing_algorithms configuration
  * rpm: Fix metadata patches to apply to current code
  * workflows/rpm.yml: Use more strict patching
  * build(deps): bump uuid from 1.17.0 to 1.18.1
  * Fix ECC algorithm selection and reporting for keylime agent
  * Improve logging consistency and coherency
  * Implement minimal RFC compliance for Location header and URI parsing (#1125)
  * Use separate keys for payload mechanism and mTLS
  * docker: update rust to 1.81 for distroless Dockerfile
  * Ensure UEFI log capabilities are set to false
  * build(deps): bump http from 1.1.0 to 1.3.1
  * build(deps): bump log from 0.4.27 to 0.4.28
  * build(deps): bump cfg-if from 1.0.1 to 1.0.3
  * build(deps): bump actix-rt from 2.10.0 to 2.11.0
  * build(deps): bump async-trait from 0.1.88 to 0.1.89
  * build(deps): bump trybuild from 1.0.105 to 1.0.110
  * Accept evidence handling structures null entries
  * workflows: Add test to check if RPM patches still apply
  * CI: Enable test add-agent-with-malformed-ek-cert
  * config: Fix singleton tests
  * FSM: Remove needless lifetime annotations (#1105)
  * rpm: Do not remove wiremock which is now available in Fedora
  * Use latest Fedora httpdate version (1.0.3)
  * Enhance coverage with parse_retry_after test
  * Fix issues reported by CI regarding unwrap() calls
  * Reuse max retries indicated to the ResilientClient
  * Include limit of retries to 5 for Retry-After
  * Add policy to handle Retry-After response headers
  * build(deps): bump wiremock from 0.6.3 to 0.6.4
  * build(deps): bump serde_json from 1.0.140 to 1.0.143
  * build(deps): bump pest_derive from 2.8.0 to 2.8.1
  * build(deps): bump syn from 2.0.90 to 2.0.106
  * build(deps): bump tempfile from 3.20.0 to 3.21.0
  * build(deps): bump thiserror from 2.0.12 to 2.0.16
  * rpm: Fix patches to apply to current master code
  * build(deps): bump anyhow from 1.0.98 to 1.0.99
  * state_machine: Automatically clean config override during tests
  * config: Implement singleton and factory pattern
  * testing: Support overriding configuration during tests
  * feat: implement standalone challenge-response authentication module
  * structures: rename session structs for clarity and fix typos
  * tpm: refactor certify_credential_with_iak() into a more generic function
  * Add Push Model Agent Mermaid FSM chart (#1095)
  * Add state to avoid exiting on wrong attestation (#1093)
  * Add 6 alphanumeric lowercase X-Request-ID header
  * Enhance Evidence Handling response parsing
  * build(deps): bump quote from 1.0.35 to 1.0.40
  * build(deps): bump libc from 0.2.172 to 0.2.175
  * build(deps): bump glob from 0.3.2 to 0.3.3
  * build(deps): bump actix-web from 4.10.2 to 4.11.0</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update vendored crates (bsc#1257908, CVE-2026-25727)
  * time 0.3.47
- Update to version 0.2.8+116:
  * build(deps): bump bytes from 1.7.2 to 1.11.1
  * api: Modify /version endpoint output in version 2.5
  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  * tests: add unit test for resolve_agent_id (#1182)
  * (pull-model): enable retry logic for registration
  * rpm: Update specfiles to apply on master
  * workflows: Add test to detect unused crates
  * lib: Drop unused crates
  * push-model: Drop unused crates
  * keylime-agent: Drop unused crates
  * build(deps): bump uuid from 1.18.1 to 1.19.0
  * Update reqwest-retry to 0.8, retry-policies to 0.5
  * rpm: Fix cargo_build macro usage on CentOS Stream
  * fix(push-model): resolve hash_ek uuid to actual EK hash
  * build(deps): bump thiserror from 2.0.16 to 2.0.17
  * workflows: Separate upstream test suite from e2e coverage
  * Send UEFI measured boot logs as raw bytes (#1173)
  * auth: Add unit tests for SecretToken implementation
  * packit: Enable push-attestation tests
  * resilient_client: Prevent authentication token leakage in logs</changelog>
  <changelog author="aplanas@suse.com" date="1774008000">- Update to version 0.2.9+8:
  * build(deps): bump thiserror from 2.0.17 to 2.0.18
  * build(deps): bump docker/login-action from 3 to 4
  * build(deps): bump docker/metadata-action from 5 to 6
  * Remove generate-bindings feature from tss-esapi
  * Use port constants instead of hardcoded values in tests
  * push-attestation: Use registrar TLS port when TLS is enabled
  * build(deps): bump docker/build-push-action from 6 to 7
  * build(deps): bump actions/upload-artifact from 6 to 7
  * dist: Make the services to conflict with each other
  * Bump version to 0.2.9
  * build(deps): bump mockoon/cli-action from 2 to 3
  * cargo: Bump tracing_subscriber to version 0.3.20
  * cargo: Bump time to version 0.3.47
  * build(deps): bump http from 1.3.1 to 1.4.0
  * Update reqwest from 0.12 to 0.13
  * build(deps): bump serde from 1.0.219 to 1.0.228
  * auth: Load CA certificate in authentication client
  * packit: Add missing e2e tests
  * registrar: Rename insecure option to disable_tls
  * push-attestation: Drop self-signed mTLS certificate generation
  * config: Add missing config options to keylime-agent.conf
  * config: Add support for "default" in registrar_api_versions option
  * config: Add support for "default" in registrar_tls_ca_cert option
  * config: Drop unused config options and constants
  * push-attestation: Drop support for mTLS to registrar
  * push-attestation: Drop mTLS support and require PoP authentication
  * build(deps): bump clap from 4.5.45 to 4.5.54
  * build(deps): bump actix-web from 4.11.0 to 4.12.1
  * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
  * resilient_client: Reauthenticate if a 403 error is received</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1774008001">- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add Cargo_toml.patch to re-generate TSS bindings</changelog>
  <changelog author="Aaron Puchert &lt;aaronpuchert@alice-dsl.net&gt;" date="1775908800">- Build with Clang &lt;= 21 for now to work around boo#1260596.</changelog>
  <changelog author="aplanas@suse.com" date="1776081600">- Update to version 0.2.9+21:
  * tests: use Express-style named params in Mockoon endpoints
  * build(deps): bump pest_derive from 2.8.1 to 2.8.6
  * build(deps): bump trybuild from 1.0.110 to 1.0.115
  * build(deps): bump log from 0.4.28 to 0.4.29
  * build(deps): bump uuid from 1.19.0 to 1.20.0
  * build(deps): bump codecov/codecov-action from 5 to 6
  * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  * build(deps): bump cfg-if from 1.0.3 to 1.0.4
  * build(deps): bump tokio from 1.49.0 to 1.50.0
  * build(deps): bump actix-web from 4.12.1 to 4.13.0
  * build(deps): bump anyhow from 1.0.99 to 1.0.102
  * build(deps): bump clap from 4.5.57 to 4.5.60
  * build(deps): bump tracing from 0.1.36 to 0.1.44</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1776081601">- Make tss-esai-sys depends on bindgen 72.1 to support llvm &gt; 21</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Remove Cargo_toml.patch (merged upstream)
- Update openssl to 0.10.81
  bsc#1270174, CVE-2026-41676
  bsc#1270999, CVE-2026-45784
  bsc#1270903, CVE-2026-44662
  bsc#1270842, CVE-2026-41898
  bsc#1270792, CVE-2026-41681
  bsc#1270699, CVE-2026-41678
  bsc#1270614, CVE-2026-41677
  bsc#1270523, CVE-2026-42327
- Update to version 0.2.9+49:
  * build(deps): bump uuid from 1.23.3 to 1.23.4
  * build(deps): bump syn from 2.0.117 to 2.0.118
  * build(deps): bump openssl from 0.10.80 to 0.10.81
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * Added new regression test into packit-ci.yaml
  * build(deps): bump actions/checkout from 6 to 7
  * build(deps): bump uuid from 1.23.1 to 1.23.3
  * build(deps): bump log from 0.4.29 to 0.4.32
  * build(deps): bump http from 1.4.0 to 1.4.2
  * build(deps): bump codecov/codecov-action from 6 to 7
  * build(deps): bump retry-policies from 0.5.1 to 0.5.2
  * fix: Remove unused base64::Engine import in context_info tests
  * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  * build(deps): bump serde_json from 1.0.149 to 1.0.150
  * build(deps): bump openssl from 0.10.79 to 0.10.80
  * agent: Hash agent ID before TPM2_Certify qualifying data
  * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  * build(deps): bump openssl from 0.10.78 to 0.10.79
  * build(deps): bump once_cell from 1.21.3 to 1.21.4
  * build(deps): bump tempfile from 3.23.0 to 3.27.0
  * push-model: cache UEFI event log bytes at startup
  * build(deps): bump quote from 1.0.40 to 1.0.45
  * build(deps): bump chrono from 0.4.42 to 0.4.44
  * build(deps): bump openssl from 0.10.73 to 0.10.78
  * build(deps): bump serde_json from 1.0.143 to 1.0.149
  * build(deps): bump syn from 2.0.106 to 2.0.117
  * build(deps): bump libc from 0.2.175 to 0.2.184
  * build(deps): bump rand from 0.9.2 to 0.9.4</changelog>
</package>
<package pkgid="4cfd7d39dbf0495ea8b97f0c59f894b7d6e1a2120889f0dc34a155a1fffa9792afe88a56f77d26ce3c85901001668de9d4117a0629ad80616c35066386ddbfee" name="keylime-logrotate" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="121.3"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="fd93faba8c71ccc2005762005d3fed4809e7ec8f3887c4ff18e99004124b013ff3b52dff36b000ff5d53c9be4d3febe7075ebdf332cfe653a8c49f5a8cf434e1" name="keylime-registrar" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="121.3"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="ad42b237efd5487b97d3ba9e2cf29c58fe8a3c4573c7cf48e5db4a6251acc4f594694d61ecdc3f14a7ba2e5e3b4a315671e43e606c81236807e8051747410e22" name="keylime-tenant" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="121.3"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="f9330361a3fa22754b56578de3c7c35b784689dd045da2d105e274a53449efeea7d602b64cb8d83e8433b3b50bb06d63c30abd8157a116e832338547760dcc53" name="keylime-tpm_cert_store" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="121.3"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="fcbc60e15631369f46a39e283185e464dd90b53f642732209288b394efe10042b65d8a4adc38d299117c402d6beab363f7d3daf5cf2af9594242a517880dcec4" name="keylime-verifier" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="121.3"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="e32a9046b174aa1c6b7e658985e47411e64b566a73466890326c37279c75533d87b8083f73d29e3ccaa3a39041f64bb035ea1d949166eb06d81fe266288d3550" name="keyutils" arch="s390x">
  <version epoch="0" ver="1.6.3" rel="87.23"/>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1551700800">- Replace krb5-devel BuildRequires with pkgconfig(krb5): Allow OBS
  to shortcut the ring0 bootstrap cycle by also using krb5-mini.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1561982400">- updated to 1.6
  - Apply various specfile cleanups from Fedora.
  - request-key: Provide a command line option to suppress helper execution.
  - request-key: Find least-wildcard match rather than first match.
  - Remove the dependency on MIT Kerberos.
  - Fix some error messages
  - keyctl_dh_compute.3: Suggest /proc/crypto for list of available hashes.
  - Fix doc and comment typos.
  - Add public key ops for encrypt, decrypt, sign and verify (needs linux-4.20).
  - Add pkg-config support for finding libkeyutils.
- upstream isn't offering PGP signatures for the source tarballs anymore</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1609761600">- update to 1.6.3:
  * Revert the change notifications that were using /dev/watch_queue.
  * Apply the change notifications that use pipe2(O_NOTIFICATION_PIPE).
  * Allow "keyctl supports" to retrieve raw capability data.
  * Allow "keyctl id" to turn a symbolic key ID into a numeric ID.
  * Allow "keyctl new_session" to name the keyring.
  * Allow "keyctl add/padd/etc." to take hex-encoded data.
  * Add "keyctl watch*" to expose kernel change notifications on keys.
  * Add caps for namespacing and notifications.
  * Set a default TTL on keys that upcall for name resolution.
  * Explicitly clear memory after it's held sensitive information.
  * Various manual page fixes.
  * Fix C++-related errors.
  * Add support for keyctl_move().
  * Add support for keyctl_capabilities().
  * Make key=val list optional for various public-key ops.
  * Fix system call signature for KEYCTL_PKEY_QUERY.
  * Fix 'keyctl pkey_query' argument passing.
  * Use keyctl_read_alloc() in dump_key_tree_aux().
  * Various manual page fixes.
- spec-cleaner run (fixup failing homepage url)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609934400">- adjust the library license to be LPGL-2.1+ only (the tools are GPL2+,
  the library is just LGPL-2.1+) (bsc#1180603)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1624536000">- Add /etc/keys/ and /usr/etc/keys/ directory (bsc#1187654)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1655812800">- Add /etc/keys/evn and /usr/etc/keys/evm together with the IMA ones</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1679572800">- Drop pkgconfig(krb5) BuildRequires: this dependency was dropped
  upstream in commit f9c7b4e4 (2018-11-02).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="1c62881ab5cb8d3bc4fc5239be9d81441b634511eb5d0f953cf8a60415ac9c593d1149e2609343b8132f3f63aa6f4e5274227f236a7565a8b51450eb2da34b03" name="keyutils" arch="src">
  <version epoch="0" ver="1.6.3" rel="87.23"/>
  <changelog author="tchvatal@suse.com" date="1375099200">- Use macros bit more and fix noreplace on folder, which is not
  good.</changelog>
  <changelog author="nfbrown@suse.com" date="1400068800">- New upstream release 1.5.9.
  Particularly adds keyctl_invalidate, needed for latest nfs-utils.
  A few minor bugfixes and usability improvements.</changelog>
  <changelog author="meissner@suse.com" date="1401969600">- correct the obsoletes and provides in baselibs.conf to be correct.
  bnc#881533</changelog>
  <changelog author="meissner@suse.com" date="1423051200">- keyutils-nodate.patch: avoid including the timestamp. bsc#916180</changelog>
  <changelog author="meissner@suse.com" date="1490097600">- move binaries from /bin to /usr/bin (bsc#1029969)
- keyutils-usr-move.patch: also adjust the request-key.conf file</changelog>
  <changelog author="meissner@suse.com" date="1493985600">- updated to 1.5.10
  - added "dh_compute" callback
  - manpage improvements</changelog>
  <changelog author="meissner@suse.com" date="1509969600">- add keyutils-devel for baselibs, to allow biarch LTP builds.
  (bsc#1061591)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="meissner@suse.com" date="1540814400">- updated to 1.5.11 (bsc#1113013)
  - Add keyring restriction support.
  - Add KDF support to the Diffie-Helman function.
  - DNS: Add support for AFS config files and SRV records</changelog>
  <changelog author="astieger@suse.com" date="1540814401">- add upstream signing key and verify source signature</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1551700800">- Replace krb5-devel BuildRequires with pkgconfig(krb5): Allow OBS
  to shortcut the ring0 bootstrap cycle by also using krb5-mini.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1561982400">- updated to 1.6
  - Apply various specfile cleanups from Fedora.
  - request-key: Provide a command line option to suppress helper execution.
  - request-key: Find least-wildcard match rather than first match.
  - Remove the dependency on MIT Kerberos.
  - Fix some error messages
  - keyctl_dh_compute.3: Suggest /proc/crypto for list of available hashes.
  - Fix doc and comment typos.
  - Add public key ops for encrypt, decrypt, sign and verify (needs linux-4.20).
  - Add pkg-config support for finding libkeyutils.
- upstream isn't offering PGP signatures for the source tarballs anymore</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1609761600">- update to 1.6.3:
  * Revert the change notifications that were using /dev/watch_queue.
  * Apply the change notifications that use pipe2(O_NOTIFICATION_PIPE).
  * Allow "keyctl supports" to retrieve raw capability data.
  * Allow "keyctl id" to turn a symbolic key ID into a numeric ID.
  * Allow "keyctl new_session" to name the keyring.
  * Allow "keyctl add/padd/etc." to take hex-encoded data.
  * Add "keyctl watch*" to expose kernel change notifications on keys.
  * Add caps for namespacing and notifications.
  * Set a default TTL on keys that upcall for name resolution.
  * Explicitly clear memory after it's held sensitive information.
  * Various manual page fixes.
  * Fix C++-related errors.
  * Add support for keyctl_move().
  * Add support for keyctl_capabilities().
  * Make key=val list optional for various public-key ops.
  * Fix system call signature for KEYCTL_PKEY_QUERY.
  * Fix 'keyctl pkey_query' argument passing.
  * Use keyctl_read_alloc() in dump_key_tree_aux().
  * Various manual page fixes.
- spec-cleaner run (fixup failing homepage url)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609934400">- adjust the library license to be LPGL-2.1+ only (the tools are GPL2+,
  the library is just LGPL-2.1+) (bsc#1180603)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1624536000">- Add /etc/keys/ and /usr/etc/keys/ directory (bsc#1187654)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1655812800">- Add /etc/keys/evn and /usr/etc/keys/evm together with the IMA ones</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1679572800">- Drop pkgconfig(krb5) BuildRequires: this dependency was dropped
  upstream in commit f9c7b4e4 (2018-11-02).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="fc2d757c595b47261226e4386920013418060165881962b72c5f9cbed44b115461dbf3976a764d922d4fe9635ccc8b33c8c96911ed9c7c75e4484040b6c48d5d" name="keyutils-debuginfo" arch="s390x">
  <version epoch="0" ver="1.6.3" rel="87.23"/>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1551700800">- Replace krb5-devel BuildRequires with pkgconfig(krb5): Allow OBS
  to shortcut the ring0 bootstrap cycle by also using krb5-mini.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1561982400">- updated to 1.6
  - Apply various specfile cleanups from Fedora.
  - request-key: Provide a command line option to suppress helper execution.
  - request-key: Find least-wildcard match rather than first match.
  - Remove the dependency on MIT Kerberos.
  - Fix some error messages
  - keyctl_dh_compute.3: Suggest /proc/crypto for list of available hashes.
  - Fix doc and comment typos.
  - Add public key ops for encrypt, decrypt, sign and verify (needs linux-4.20).
  - Add pkg-config support for finding libkeyutils.
- upstream isn't offering PGP signatures for the source tarballs anymore</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1609761600">- update to 1.6.3:
  * Revert the change notifications that were using /dev/watch_queue.
  * Apply the change notifications that use pipe2(O_NOTIFICATION_PIPE).
  * Allow "keyctl supports" to retrieve raw capability data.
  * Allow "keyctl id" to turn a symbolic key ID into a numeric ID.
  * Allow "keyctl new_session" to name the keyring.
  * Allow "keyctl add/padd/etc." to take hex-encoded data.
  * Add "keyctl watch*" to expose kernel change notifications on keys.
  * Add caps for namespacing and notifications.
  * Set a default TTL on keys that upcall for name resolution.
  * Explicitly clear memory after it's held sensitive information.
  * Various manual page fixes.
  * Fix C++-related errors.
  * Add support for keyctl_move().
  * Add support for keyctl_capabilities().
  * Make key=val list optional for various public-key ops.
  * Fix system call signature for KEYCTL_PKEY_QUERY.
  * Fix 'keyctl pkey_query' argument passing.
  * Use keyctl_read_alloc() in dump_key_tree_aux().
  * Various manual page fixes.
- spec-cleaner run (fixup failing homepage url)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609934400">- adjust the library license to be LPGL-2.1+ only (the tools are GPL2+,
  the library is just LGPL-2.1+) (bsc#1180603)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1624536000">- Add /etc/keys/ and /usr/etc/keys/ directory (bsc#1187654)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1655812800">- Add /etc/keys/evn and /usr/etc/keys/evm together with the IMA ones</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1679572800">- Drop pkgconfig(krb5) BuildRequires: this dependency was dropped
  upstream in commit f9c7b4e4 (2018-11-02).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="dc71a3b42fee31ab28d0097f5ceae18c80862685b8bf65611e31f720451776c95d975dc2a0a6c7d2d54cd133a0230c331276afca33226c5bb8d986062033840c" name="keyutils-debugsource" arch="s390x">
  <version epoch="0" ver="1.6.3" rel="87.23"/>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1551700800">- Replace krb5-devel BuildRequires with pkgconfig(krb5): Allow OBS
  to shortcut the ring0 bootstrap cycle by also using krb5-mini.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1561982400">- updated to 1.6
  - Apply various specfile cleanups from Fedora.
  - request-key: Provide a command line option to suppress helper execution.
  - request-key: Find least-wildcard match rather than first match.
  - Remove the dependency on MIT Kerberos.
  - Fix some error messages
  - keyctl_dh_compute.3: Suggest /proc/crypto for list of available hashes.
  - Fix doc and comment typos.
  - Add public key ops for encrypt, decrypt, sign and verify (needs linux-4.20).
  - Add pkg-config support for finding libkeyutils.
- upstream isn't offering PGP signatures for the source tarballs anymore</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1609761600">- update to 1.6.3:
  * Revert the change notifications that were using /dev/watch_queue.
  * Apply the change notifications that use pipe2(O_NOTIFICATION_PIPE).
  * Allow "keyctl supports" to retrieve raw capability data.
  * Allow "keyctl id" to turn a symbolic key ID into a numeric ID.
  * Allow "keyctl new_session" to name the keyring.
  * Allow "keyctl add/padd/etc." to take hex-encoded data.
  * Add "keyctl watch*" to expose kernel change notifications on keys.
  * Add caps for namespacing and notifications.
  * Set a default TTL on keys that upcall for name resolution.
  * Explicitly clear memory after it's held sensitive information.
  * Various manual page fixes.
  * Fix C++-related errors.
  * Add support for keyctl_move().
  * Add support for keyctl_capabilities().
  * Make key=val list optional for various public-key ops.
  * Fix system call signature for KEYCTL_PKEY_QUERY.
  * Fix 'keyctl pkey_query' argument passing.
  * Use keyctl_read_alloc() in dump_key_tree_aux().
  * Various manual page fixes.
- spec-cleaner run (fixup failing homepage url)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609934400">- adjust the library license to be LPGL-2.1+ only (the tools are GPL2+,
  the library is just LGPL-2.1+) (bsc#1180603)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1624536000">- Add /etc/keys/ and /usr/etc/keys/ directory (bsc#1187654)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1655812800">- Add /etc/keys/evn and /usr/etc/keys/evm together with the IMA ones</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1679572800">- Drop pkgconfig(krb5) BuildRequires: this dependency was dropped
  upstream in commit f9c7b4e4 (2018-11-02).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="4034a211fed89bdeec1c6c9a70d6794f49b688fde2164809dd2be59f37efc42b5d7d4b3c7e46c5dcebb76adb1f7b0f8ab6b74d8823c2e9254ef748e6239e51c3" name="keyutils-devel" arch="s390x">
  <version epoch="0" ver="1.6.3" rel="87.23"/>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1551700800">- Replace krb5-devel BuildRequires with pkgconfig(krb5): Allow OBS
  to shortcut the ring0 bootstrap cycle by also using krb5-mini.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1561982400">- updated to 1.6
  - Apply various specfile cleanups from Fedora.
  - request-key: Provide a command line option to suppress helper execution.
  - request-key: Find least-wildcard match rather than first match.
  - Remove the dependency on MIT Kerberos.
  - Fix some error messages
  - keyctl_dh_compute.3: Suggest /proc/crypto for list of available hashes.
  - Fix doc and comment typos.
  - Add public key ops for encrypt, decrypt, sign and verify (needs linux-4.20).
  - Add pkg-config support for finding libkeyutils.
- upstream isn't offering PGP signatures for the source tarballs anymore</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1609761600">- update to 1.6.3:
  * Revert the change notifications that were using /dev/watch_queue.
  * Apply the change notifications that use pipe2(O_NOTIFICATION_PIPE).
  * Allow "keyctl supports" to retrieve raw capability data.
  * Allow "keyctl id" to turn a symbolic key ID into a numeric ID.
  * Allow "keyctl new_session" to name the keyring.
  * Allow "keyctl add/padd/etc." to take hex-encoded data.
  * Add "keyctl watch*" to expose kernel change notifications on keys.
  * Add caps for namespacing and notifications.
  * Set a default TTL on keys that upcall for name resolution.
  * Explicitly clear memory after it's held sensitive information.
  * Various manual page fixes.
  * Fix C++-related errors.
  * Add support for keyctl_move().
  * Add support for keyctl_capabilities().
  * Make key=val list optional for various public-key ops.
  * Fix system call signature for KEYCTL_PKEY_QUERY.
  * Fix 'keyctl pkey_query' argument passing.
  * Use keyctl_read_alloc() in dump_key_tree_aux().
  * Various manual page fixes.
- spec-cleaner run (fixup failing homepage url)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609934400">- adjust the library license to be LPGL-2.1+ only (the tools are GPL2+,
  the library is just LGPL-2.1+) (bsc#1180603)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1624536000">- Add /etc/keys/ and /usr/etc/keys/ directory (bsc#1187654)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1655812800">- Add /etc/keys/evn and /usr/etc/keys/evm together with the IMA ones</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1679572800">- Drop pkgconfig(krb5) BuildRequires: this dependency was dropped
  upstream in commit f9c7b4e4 (2018-11-02).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="cf5916a426980be07215315af8510ca46364d8be6e8836c7e5eb7515f9c9a5127a3420c5e65e476185a1196b2250681007e68a05e8d4cc53b6a759a315102dcf" name="kwalletcli" arch="s390x">
  <version epoch="0" ver="3.03" rel="1.87"/>
  <changelog author="Matthias Mail&#xE4;nder &lt;mailaender@opensuse.org&gt;" date="1638619200">- update to version 3.03
  Mar 25 17:50:43 EEST 2018 - &lt;prapor@unixzone.org.ua&gt; 3.01-1
- New mainstream release</changelog>
</package>
<package pkgid="cd922c1de68da3074c80b754fc4122f7b090821543d417c1312a886a35ea38f455d4d471637e4692e743ca9a29487685db08886cd5113d367e99ff03b146091e" name="kwalletcli" arch="src">
  <version epoch="0" ver="3.03" rel="1.87"/>
  <changelog author="Matthias Mail&#xE4;nder &lt;mailaender@opensuse.org&gt;" date="1638619200">- update to version 3.03
  Mar 25 17:50:43 EEST 2018 - &lt;prapor@unixzone.org.ua&gt; 3.01-1
- New mainstream release</changelog>
</package>
<package pkgid="ef392f1e59a818fd2cf1e08859a5669ec4572977b26edcd201e70d4a521ab3194ba6e4431350c6fde782d54390ff2ca7a3063024c14ff047ddb2daca00d4739f" name="landrun" arch="s390x">
  <version epoch="0" ver="0.1.14" rel="3.15"/>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1745582400">- initial version 0.1.14</changelog>
</package>
<package pkgid="97567e5baee848c1d36952a99636bc8713a4eeb46c8ae82bb2acbad2f2a35050972187d559c6d592692c091f7abf7fd6c67e7c3af8daa1f8ca504efcf4de8e28" name="landrun" arch="src">
  <version epoch="0" ver="0.1.14" rel="3.15"/>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1745582400">- initial version 0.1.14</changelog>
</package>
<package pkgid="2df822683b9237e8fec0875eb68fb9cfefb5c8bee950efacac640cd3e012e4b41c5a7621a551809556e33cbcfed1e187e0e551284b42b57b8a4501d3b228d676" name="landrun-debuginfo" arch="s390x">
  <version epoch="0" ver="0.1.14" rel="3.15"/>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1745582400">- initial version 0.1.14</changelog>
</package>
<package pkgid="6ff2370851c7082c3e3cc87f5fa2cdd0986e02f6a302e4154989fe98640ac33f5d5429ec22b8e463135c9cfe52ac3e6012d66d84f3e00f6c7f52a5e09b811d58" name="lastpass-cli" arch="s390x">
  <version epoch="0" ver="1.6.1" rel="28.1"/>
  <changelog author="mpluskal@suse.com" date="1509019200">- Update to version 1.2.2:
  * lpass ls --format now supports "%al" to show URL
  * $VISUAL can be used in preference to $EDITOR
  * lpass edit can now directly edit multiline ssh keys
  * fields are now preserved when edited with lpass edit
  * Bugfix: use-after-free in http.c fixed
  * Bugfix: command-line completion now works for names with spaces
  * Bugfix: loading attachments from shared folders now works
  * Documentation updates</changelog>
  <changelog author="mpluskal@suse.com" date="1523016000">- Update to version 1.3.0:
  * lpass show now supports --json format
  * lpass show now supports --quiet flag to suppress prompts
  * lpass import has --keep-dupes flag which will preserve
    duplicate accounts on import
  * LPASS_PINENTRY environment variable may now be used to set
    custom path to pinentry
  * Build fix for aarch64 and others
  * New fish completions
  * Zsh completions
  * bugfix: site notes now show up in notes textarea instead of
    fields
  * spelling fixes
- Modernise spec file
- Install autocompletions</changelog>
  <changelog author="ggkioulis@suse.com" date="1528804800">- Update to version 1.3.1:
  * Revert "pins: remove GlobalSign R1/R3 pins" from Robert Copeland
  * Readme update from Wesley Schwengle
  * Add Dockerfile to create a clean build environment from Wesley Schwengle
  * Missing dependencies in readme
  * Added CLion project files to ignore list</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1559131200">- Update to version 1.3.3:
  * Decrease the time for the cli app to do things (Wesley Schwengle)
  * 'blob_load' refactor (Wesley Schwengle)
  * Fixed bug where logout requires login (Wesley Schwengle)
  * Fix non-default PKG_CONFIG_PATH on macOS (Alyssa Ross)
- Changes for version 1.3.2:
  * Don't require using make (Eli Schwartz)
  * Disable IPv6 support (Wesley Schwengle)
  * Link against Brew Curl on MacOS (Tom Sullivan)
  * Autogenerate versions from git (Wesley Schwengle/Eli Schwartz)
  * Remove memory leak in config_path_for_type (Tom Sullivan)
  * Install bash-completions in PREFIX dir (Wesley Schwengle)
  * Include libgen.h for BSD builds (Tom Sullivan)
  * Create subdirectories when determining config path (Tom Sullivan)
  * Only show basename in usage (William Casarin)
  * Fix segmentation fault on BSD while running make test (Björn Ketelaars)
  * README.md updates:
    + Brew formula installation (Thomas Haggett)
    + Ubuntu Xenial dependencies (Nick Timkovich)
    + Debian stable/testing and Ubuntu dependencies (Wesley Schwengle)</changelog>
  <changelog author="Matthias Eliasson &lt;elimat@opensuse.org&gt;" date="1591444800">- Add patch 0001-Mark-global-variable-as-extern.patch to fix builds with gcc10</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674216000">- update to 1.3.4:
  * Updating post parameter</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1715083200">- Update to 1.4.0:
  * Add support for writting encrypted URLs
  * Add support for feature flags
  * Fix shared folder username
  update to 1.3.7:
  * Add support for reading encrypted URLs (Tibor Komlossy)
  * Fix GCC 10 compatibility issue #532 (Tibor Komlossy)
  update to 1.3.6:
  * Fix version (Béla Ormos)
  update to 1.3.5:
  * Updating certificate hashes (Béla Ormos)
  Remove 0001-Mark-global-variable-as-extern.patch and
  0002-latest-ssl-cert.patch file</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622400">- Update to 1.6.1:
  * Fix adding groups to shared folders when one of the users has no
    public key
  * Improve sharing key generation and stop reusing the key as the IV
  * Remove SHA-256 support for login hashes
  * Fix password change failure
  * Fix incorrect pointer-to-pointer argument passing that broke
    compilation with GCC 14
  * Add support for URL logging
  * Fix segmentation faults on Mac OS X
  * Fix synchronisation issues that produced empty IDs
  * Fix feature flags file deletion on logout
- Add lastpass-cli-skip-placeholder-attachkey.patch: blob_write() stores
  the literal string "skipped" in the attachment-key field, which the
  parser then fed to the base64 decoder, aborting with "Could not
  unbase64 the given bytes" and failing 20 of the 21 tests</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622401">- Move the shell completions into bash-completion, zsh-completion and
  fish-completion subpackages, so a shell's completions are only pulled
  in where that shell is installed
- Install the fish completion as lpass.fish under the vendor completions
  directory: fish autoloads a completion from a file named after the
  command it completes, so the name shipped so far was never read
- Stop installing the bash completion by hand, the build system already
  installs it into the directory bash-completion declares
- Drop the bash-completion Recommends from the main package, it now
  belongs to the completion subpackage</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622402">- Build and test through the cmake macros, %cmake_build and %ctest,
  rather than driving make directly; %make_jobs is deprecated in favour
  of %cmake_build
- Build the lpass-test target explicitly in %check: it is the binary the
  suite actually drives, upstream marks it EXCLUDE_FROM_ALL, and ctest
  on its own would run every case against a binary that was never built
- Run ctest serially: the cases share one LPASS_HOME and remove the blob
  between them, so a parallel run has them deleting each other's state</changelog>
</package>
<package pkgid="21d9a02e3df92c230aab510f234752569f1573a791594fc2ccee839ad7c270106ff623a380fb8674f91eff9b0e47592d2dbc21b3244ffe32e913616829169286" name="lastpass-cli" arch="src">
  <version epoch="0" ver="1.6.1" rel="28.1"/>
  <changelog author="mpluskal@suse.com" date="1460808000">- Initial package for version 0.9.0</changelog>
  <changelog author="mpluskal@suse.com" date="1469966400">- Update to version 1.0.0:
  * New command lpass status shows whether or not the user is
    logged in with agent, from Nick Knudson
  * lpass add can now be passed --note-type=X in order to add a
    secure note using a template. Specifying an unknown note
    template will list the available templates.
  * lpass ls now shows username with --long, from Alli Witheford
  * Bash completions are now installed with make install, from
    Eli Schwartz
  * Fish shell completions supplied by Joar Wanboarg
  * Initial support for adding (lpass add --app) and editing
    applications
  * Updates to manpage for ls, passwd, add, and basic usage
    examples
  * lpass now follows XDG base directory specifications for its
    files on platforms that use it. Set LP_HOME to ~/.lpass to
    keep the previous location
  * Bugfix: resolved syncing problems on some platforms
    (notably RHEL/CentOS) related to improper multiprocess usage
    of libcurl (github #166)
  * Bugfix: lpass show no longer crashes when a searched-for field
    is not found (github #167)
  * Bugfix: lpass no longer exits with an error if the blob is
    empty but otherwise without parsing errors. This fixes the case
    where a new user could not use the application without first
    adding a site elsewhere.
  * LPASS_LOG_LEVEL learned level=8 with which lpass will also dump
    libcurl verbose logs showing all traffic for debugging (not
    recommended for general use due to potentially sensitive
    headers being logged).</changelog>
  <changelog author="mpluskal@suse.com" date="1487332800">- Update to version 1.1.2:
  * Bugfix: crash with lpass logout --color=never fixed
  * Bugfix: lpass add with secure notes works again
  * Bugfix: sort order in lpass ls is now consistent whether or not
    colors are used
  * Documentation has been enhanced to describe aliases and more
    options, with patches by Eric B. Hymowitz.
- Changes for version 1.1.1:
  * Bugfix: fix crash in lpass show for secure notes without
    attachments
  * Build: fix build on OpenBSD, from Björn Ketelaars
  * Build: fix build when using LibreSSL, from Björn Ketelaars
- Changes for version 1.1.0:
  * New command lpass import can import an existing csv file (or
    output from lpass export) into the vault lpass show and lpass
    ls learned a --format argument to enable user-specified
    printf-style formats
  * Bash completions will now complete field names if --field is
    specified after the account name
  * Build: cmake now used for building, by Filippo Cucchetto and
    with fixes by Eli Schwartz
  * Build: lpass has been updated to work with OpenSSL 1.1
  * Bugfix: crash in lpass ls -l with no last_modified_gmt fixed
  * Bugfix: secure notes editing with "Name" fields now works
    properly
  * Bugfix: editing secure note names now works (github #106)
  * Bugfix: lpass-created server secure notes are now compatible
    with the plugin
  * Bugfix: generate now uses all defined characters, by Ignat
    Korchagin
  * Bugfix: lpass show for ssh-key secure notes no longer corrupts
  * password-protected ssh keys (github #232)</changelog>
  <changelog author="mpluskal@suse.com" date="1496923200">- Update to version 1.2.0:
  * lpass show now supports new-style multiline ssh keys
  * lpass export now supports --fields=FIELDLIST argument to
  * control output, with patches from Kyle Burton
  * lpass ls now always shows empty shared folders
  * lpass edit can now set the 'master password reprompt' field in
    sites
  * lpass share create now shows the created share name
  * Bugfix: crash in lpass show fixed by Kyle Burton
  * build fixes for termux and documentation updates, from
    Christian Rondeau
  * documentation updates for Ubuntu from Craig Menning and Glenn
    Oppegard
  * Test suite now included covering basic operations
- Enable tests</changelog>
  <changelog author="mpluskal@suse.com" date="1499774400">- Update to version 1.2.1:
  * fix regression with lpass show not displaying all fields for
    secure notes</changelog>
  <changelog author="mpluskal@suse.com" date="1509019200">- Update to version 1.2.2:
  * lpass ls --format now supports "%al" to show URL
  * $VISUAL can be used in preference to $EDITOR
  * lpass edit can now directly edit multiline ssh keys
  * fields are now preserved when edited with lpass edit
  * Bugfix: use-after-free in http.c fixed
  * Bugfix: command-line completion now works for names with spaces
  * Bugfix: loading attachments from shared folders now works
  * Documentation updates</changelog>
  <changelog author="mpluskal@suse.com" date="1523016000">- Update to version 1.3.0:
  * lpass show now supports --json format
  * lpass show now supports --quiet flag to suppress prompts
  * lpass import has --keep-dupes flag which will preserve
    duplicate accounts on import
  * LPASS_PINENTRY environment variable may now be used to set
    custom path to pinentry
  * Build fix for aarch64 and others
  * New fish completions
  * Zsh completions
  * bugfix: site notes now show up in notes textarea instead of
    fields
  * spelling fixes
- Modernise spec file
- Install autocompletions</changelog>
  <changelog author="ggkioulis@suse.com" date="1528804800">- Update to version 1.3.1:
  * Revert "pins: remove GlobalSign R1/R3 pins" from Robert Copeland
  * Readme update from Wesley Schwengle
  * Add Dockerfile to create a clean build environment from Wesley Schwengle
  * Missing dependencies in readme
  * Added CLion project files to ignore list</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1559131200">- Update to version 1.3.3:
  * Decrease the time for the cli app to do things (Wesley Schwengle)
  * 'blob_load' refactor (Wesley Schwengle)
  * Fixed bug where logout requires login (Wesley Schwengle)
  * Fix non-default PKG_CONFIG_PATH on macOS (Alyssa Ross)
- Changes for version 1.3.2:
  * Don't require using make (Eli Schwartz)
  * Disable IPv6 support (Wesley Schwengle)
  * Link against Brew Curl on MacOS (Tom Sullivan)
  * Autogenerate versions from git (Wesley Schwengle/Eli Schwartz)
  * Remove memory leak in config_path_for_type (Tom Sullivan)
  * Install bash-completions in PREFIX dir (Wesley Schwengle)
  * Include libgen.h for BSD builds (Tom Sullivan)
  * Create subdirectories when determining config path (Tom Sullivan)
  * Only show basename in usage (William Casarin)
  * Fix segmentation fault on BSD while running make test (Björn Ketelaars)
  * README.md updates:
    + Brew formula installation (Thomas Haggett)
    + Ubuntu Xenial dependencies (Nick Timkovich)
    + Debian stable/testing and Ubuntu dependencies (Wesley Schwengle)</changelog>
  <changelog author="Matthias Eliasson &lt;elimat@opensuse.org&gt;" date="1591444800">- Add patch 0001-Mark-global-variable-as-extern.patch to fix builds with gcc10</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674216000">- update to 1.3.4:
  * Updating post parameter</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1715083200">- Update to 1.4.0:
  * Add support for writting encrypted URLs
  * Add support for feature flags
  * Fix shared folder username
  update to 1.3.7:
  * Add support for reading encrypted URLs (Tibor Komlossy)
  * Fix GCC 10 compatibility issue #532 (Tibor Komlossy)
  update to 1.3.6:
  * Fix version (Béla Ormos)
  update to 1.3.5:
  * Updating certificate hashes (Béla Ormos)
  Remove 0001-Mark-global-variable-as-extern.patch and
  0002-latest-ssl-cert.patch file</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622400">- Update to 1.6.1:
  * Fix adding groups to shared folders when one of the users has no
    public key
  * Improve sharing key generation and stop reusing the key as the IV
  * Remove SHA-256 support for login hashes
  * Fix password change failure
  * Fix incorrect pointer-to-pointer argument passing that broke
    compilation with GCC 14
  * Add support for URL logging
  * Fix segmentation faults on Mac OS X
  * Fix synchronisation issues that produced empty IDs
  * Fix feature flags file deletion on logout
- Add lastpass-cli-skip-placeholder-attachkey.patch: blob_write() stores
  the literal string "skipped" in the attachment-key field, which the
  parser then fed to the base64 decoder, aborting with "Could not
  unbase64 the given bytes" and failing 20 of the 21 tests</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622401">- Move the shell completions into bash-completion, zsh-completion and
  fish-completion subpackages, so a shell's completions are only pulled
  in where that shell is installed
- Install the fish completion as lpass.fish under the vendor completions
  directory: fish autoloads a completion from a file named after the
  command it completes, so the name shipped so far was never read
- Stop installing the bash completion by hand, the build system already
  installs it into the directory bash-completion declares
- Drop the bash-completion Recommends from the main package, it now
  belongs to the completion subpackage</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622402">- Build and test through the cmake macros, %cmake_build and %ctest,
  rather than driving make directly; %make_jobs is deprecated in favour
  of %cmake_build
- Build the lpass-test target explicitly in %check: it is the binary the
  suite actually drives, upstream marks it EXCLUDE_FROM_ALL, and ctest
  on its own would run every case against a binary that was never built
- Run ctest serially: the cases share one LPASS_HOME and remove the blob
  between them, so a parallel run has them deleting each other's state</changelog>
</package>
<package pkgid="c8cb0dcb17d3494b315686d0f4bd4a8860ec115dc1c015ec54baea315827cd6174a287f748ca7d7cd15cf21120003a97e00fdcba4680a3a6669496dd93e004ca" name="lastpass-cli-bash-completion" arch="noarch">
  <version epoch="0" ver="1.6.1" rel="28.1"/>
  <changelog author="mpluskal@suse.com" date="1509019200">- Update to version 1.2.2:
  * lpass ls --format now supports "%al" to show URL
  * $VISUAL can be used in preference to $EDITOR
  * lpass edit can now directly edit multiline ssh keys
  * fields are now preserved when edited with lpass edit
  * Bugfix: use-after-free in http.c fixed
  * Bugfix: command-line completion now works for names with spaces
  * Bugfix: loading attachments from shared folders now works
  * Documentation updates</changelog>
  <changelog author="mpluskal@suse.com" date="1523016000">- Update to version 1.3.0:
  * lpass show now supports --json format
  * lpass show now supports --quiet flag to suppress prompts
  * lpass import has --keep-dupes flag which will preserve
    duplicate accounts on import
  * LPASS_PINENTRY environment variable may now be used to set
    custom path to pinentry
  * Build fix for aarch64 and others
  * New fish completions
  * Zsh completions
  * bugfix: site notes now show up in notes textarea instead of
    fields
  * spelling fixes
- Modernise spec file
- Install autocompletions</changelog>
  <changelog author="ggkioulis@suse.com" date="1528804800">- Update to version 1.3.1:
  * Revert "pins: remove GlobalSign R1/R3 pins" from Robert Copeland
  * Readme update from Wesley Schwengle
  * Add Dockerfile to create a clean build environment from Wesley Schwengle
  * Missing dependencies in readme
  * Added CLion project files to ignore list</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1559131200">- Update to version 1.3.3:
  * Decrease the time for the cli app to do things (Wesley Schwengle)
  * 'blob_load' refactor (Wesley Schwengle)
  * Fixed bug where logout requires login (Wesley Schwengle)
  * Fix non-default PKG_CONFIG_PATH on macOS (Alyssa Ross)
- Changes for version 1.3.2:
  * Don't require using make (Eli Schwartz)
  * Disable IPv6 support (Wesley Schwengle)
  * Link against Brew Curl on MacOS (Tom Sullivan)
  * Autogenerate versions from git (Wesley Schwengle/Eli Schwartz)
  * Remove memory leak in config_path_for_type (Tom Sullivan)
  * Install bash-completions in PREFIX dir (Wesley Schwengle)
  * Include libgen.h for BSD builds (Tom Sullivan)
  * Create subdirectories when determining config path (Tom Sullivan)
  * Only show basename in usage (William Casarin)
  * Fix segmentation fault on BSD while running make test (Björn Ketelaars)
  * README.md updates:
    + Brew formula installation (Thomas Haggett)
    + Ubuntu Xenial dependencies (Nick Timkovich)
    + Debian stable/testing and Ubuntu dependencies (Wesley Schwengle)</changelog>
  <changelog author="Matthias Eliasson &lt;elimat@opensuse.org&gt;" date="1591444800">- Add patch 0001-Mark-global-variable-as-extern.patch to fix builds with gcc10</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674216000">- update to 1.3.4:
  * Updating post parameter</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1715083200">- Update to 1.4.0:
  * Add support for writting encrypted URLs
  * Add support for feature flags
  * Fix shared folder username
  update to 1.3.7:
  * Add support for reading encrypted URLs (Tibor Komlossy)
  * Fix GCC 10 compatibility issue #532 (Tibor Komlossy)
  update to 1.3.6:
  * Fix version (Béla Ormos)
  update to 1.3.5:
  * Updating certificate hashes (Béla Ormos)
  Remove 0001-Mark-global-variable-as-extern.patch and
  0002-latest-ssl-cert.patch file</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622400">- Update to 1.6.1:
  * Fix adding groups to shared folders when one of the users has no
    public key
  * Improve sharing key generation and stop reusing the key as the IV
  * Remove SHA-256 support for login hashes
  * Fix password change failure
  * Fix incorrect pointer-to-pointer argument passing that broke
    compilation with GCC 14
  * Add support for URL logging
  * Fix segmentation faults on Mac OS X
  * Fix synchronisation issues that produced empty IDs
  * Fix feature flags file deletion on logout
- Add lastpass-cli-skip-placeholder-attachkey.patch: blob_write() stores
  the literal string "skipped" in the attachment-key field, which the
  parser then fed to the base64 decoder, aborting with "Could not
  unbase64 the given bytes" and failing 20 of the 21 tests</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622401">- Move the shell completions into bash-completion, zsh-completion and
  fish-completion subpackages, so a shell's completions are only pulled
  in where that shell is installed
- Install the fish completion as lpass.fish under the vendor completions
  directory: fish autoloads a completion from a file named after the
  command it completes, so the name shipped so far was never read
- Stop installing the bash completion by hand, the build system already
  installs it into the directory bash-completion declares
- Drop the bash-completion Recommends from the main package, it now
  belongs to the completion subpackage</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622402">- Build and test through the cmake macros, %cmake_build and %ctest,
  rather than driving make directly; %make_jobs is deprecated in favour
  of %cmake_build
- Build the lpass-test target explicitly in %check: it is the binary the
  suite actually drives, upstream marks it EXCLUDE_FROM_ALL, and ctest
  on its own would run every case against a binary that was never built
- Run ctest serially: the cases share one LPASS_HOME and remove the blob
  between them, so a parallel run has them deleting each other's state</changelog>
</package>
<package pkgid="695c1203702d86a704645addc6c007e545c93930a46194f605de5988450e553a1672c9ead2b9d8b64f285046f5168d59c09b9db6b9e9483a45871bf9ff4c6f54" name="lastpass-cli-debuginfo" arch="s390x">
  <version epoch="0" ver="1.6.1" rel="28.1"/>
  <changelog author="mpluskal@suse.com" date="1509019200">- Update to version 1.2.2:
  * lpass ls --format now supports "%al" to show URL
  * $VISUAL can be used in preference to $EDITOR
  * lpass edit can now directly edit multiline ssh keys
  * fields are now preserved when edited with lpass edit
  * Bugfix: use-after-free in http.c fixed
  * Bugfix: command-line completion now works for names with spaces
  * Bugfix: loading attachments from shared folders now works
  * Documentation updates</changelog>
  <changelog author="mpluskal@suse.com" date="1523016000">- Update to version 1.3.0:
  * lpass show now supports --json format
  * lpass show now supports --quiet flag to suppress prompts
  * lpass import has --keep-dupes flag which will preserve
    duplicate accounts on import
  * LPASS_PINENTRY environment variable may now be used to set
    custom path to pinentry
  * Build fix for aarch64 and others
  * New fish completions
  * Zsh completions
  * bugfix: site notes now show up in notes textarea instead of
    fields
  * spelling fixes
- Modernise spec file
- Install autocompletions</changelog>
  <changelog author="ggkioulis@suse.com" date="1528804800">- Update to version 1.3.1:
  * Revert "pins: remove GlobalSign R1/R3 pins" from Robert Copeland
  * Readme update from Wesley Schwengle
  * Add Dockerfile to create a clean build environment from Wesley Schwengle
  * Missing dependencies in readme
  * Added CLion project files to ignore list</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1559131200">- Update to version 1.3.3:
  * Decrease the time for the cli app to do things (Wesley Schwengle)
  * 'blob_load' refactor (Wesley Schwengle)
  * Fixed bug where logout requires login (Wesley Schwengle)
  * Fix non-default PKG_CONFIG_PATH on macOS (Alyssa Ross)
- Changes for version 1.3.2:
  * Don't require using make (Eli Schwartz)
  * Disable IPv6 support (Wesley Schwengle)
  * Link against Brew Curl on MacOS (Tom Sullivan)
  * Autogenerate versions from git (Wesley Schwengle/Eli Schwartz)
  * Remove memory leak in config_path_for_type (Tom Sullivan)
  * Install bash-completions in PREFIX dir (Wesley Schwengle)
  * Include libgen.h for BSD builds (Tom Sullivan)
  * Create subdirectories when determining config path (Tom Sullivan)
  * Only show basename in usage (William Casarin)
  * Fix segmentation fault on BSD while running make test (Björn Ketelaars)
  * README.md updates:
    + Brew formula installation (Thomas Haggett)
    + Ubuntu Xenial dependencies (Nick Timkovich)
    + Debian stable/testing and Ubuntu dependencies (Wesley Schwengle)</changelog>
  <changelog author="Matthias Eliasson &lt;elimat@opensuse.org&gt;" date="1591444800">- Add patch 0001-Mark-global-variable-as-extern.patch to fix builds with gcc10</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674216000">- update to 1.3.4:
  * Updating post parameter</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1715083200">- Update to 1.4.0:
  * Add support for writting encrypted URLs
  * Add support for feature flags
  * Fix shared folder username
  update to 1.3.7:
  * Add support for reading encrypted URLs (Tibor Komlossy)
  * Fix GCC 10 compatibility issue #532 (Tibor Komlossy)
  update to 1.3.6:
  * Fix version (Béla Ormos)
  update to 1.3.5:
  * Updating certificate hashes (Béla Ormos)
  Remove 0001-Mark-global-variable-as-extern.patch and
  0002-latest-ssl-cert.patch file</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622400">- Update to 1.6.1:
  * Fix adding groups to shared folders when one of the users has no
    public key
  * Improve sharing key generation and stop reusing the key as the IV
  * Remove SHA-256 support for login hashes
  * Fix password change failure
  * Fix incorrect pointer-to-pointer argument passing that broke
    compilation with GCC 14
  * Add support for URL logging
  * Fix segmentation faults on Mac OS X
  * Fix synchronisation issues that produced empty IDs
  * Fix feature flags file deletion on logout
- Add lastpass-cli-skip-placeholder-attachkey.patch: blob_write() stores
  the literal string "skipped" in the attachment-key field, which the
  parser then fed to the base64 decoder, aborting with "Could not
  unbase64 the given bytes" and failing 20 of the 21 tests</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622401">- Move the shell completions into bash-completion, zsh-completion and
  fish-completion subpackages, so a shell's completions are only pulled
  in where that shell is installed
- Install the fish completion as lpass.fish under the vendor completions
  directory: fish autoloads a completion from a file named after the
  command it completes, so the name shipped so far was never read
- Stop installing the bash completion by hand, the build system already
  installs it into the directory bash-completion declares
- Drop the bash-completion Recommends from the main package, it now
  belongs to the completion subpackage</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622402">- Build and test through the cmake macros, %cmake_build and %ctest,
  rather than driving make directly; %make_jobs is deprecated in favour
  of %cmake_build
- Build the lpass-test target explicitly in %check: it is the binary the
  suite actually drives, upstream marks it EXCLUDE_FROM_ALL, and ctest
  on its own would run every case against a binary that was never built
- Run ctest serially: the cases share one LPASS_HOME and remove the blob
  between them, so a parallel run has them deleting each other's state</changelog>
</package>
<package pkgid="50e67638a6ec8a7233cf140de7da8bf5487493b0210bc91a2d832e3cf09fe4839ef827e7dac3584e1b7c4c6e1e184e9bee605fb40fe76947db244a54540acee7" name="lastpass-cli-debugsource" arch="s390x">
  <version epoch="0" ver="1.6.1" rel="28.1"/>
  <changelog author="mpluskal@suse.com" date="1509019200">- Update to version 1.2.2:
  * lpass ls --format now supports "%al" to show URL
  * $VISUAL can be used in preference to $EDITOR
  * lpass edit can now directly edit multiline ssh keys
  * fields are now preserved when edited with lpass edit
  * Bugfix: use-after-free in http.c fixed
  * Bugfix: command-line completion now works for names with spaces
  * Bugfix: loading attachments from shared folders now works
  * Documentation updates</changelog>
  <changelog author="mpluskal@suse.com" date="1523016000">- Update to version 1.3.0:
  * lpass show now supports --json format
  * lpass show now supports --quiet flag to suppress prompts
  * lpass import has --keep-dupes flag which will preserve
    duplicate accounts on import
  * LPASS_PINENTRY environment variable may now be used to set
    custom path to pinentry
  * Build fix for aarch64 and others
  * New fish completions
  * Zsh completions
  * bugfix: site notes now show up in notes textarea instead of
    fields
  * spelling fixes
- Modernise spec file
- Install autocompletions</changelog>
  <changelog author="ggkioulis@suse.com" date="1528804800">- Update to version 1.3.1:
  * Revert "pins: remove GlobalSign R1/R3 pins" from Robert Copeland
  * Readme update from Wesley Schwengle
  * Add Dockerfile to create a clean build environment from Wesley Schwengle
  * Missing dependencies in readme
  * Added CLion project files to ignore list</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1559131200">- Update to version 1.3.3:
  * Decrease the time for the cli app to do things (Wesley Schwengle)
  * 'blob_load' refactor (Wesley Schwengle)
  * Fixed bug where logout requires login (Wesley Schwengle)
  * Fix non-default PKG_CONFIG_PATH on macOS (Alyssa Ross)
- Changes for version 1.3.2:
  * Don't require using make (Eli Schwartz)
  * Disable IPv6 support (Wesley Schwengle)
  * Link against Brew Curl on MacOS (Tom Sullivan)
  * Autogenerate versions from git (Wesley Schwengle/Eli Schwartz)
  * Remove memory leak in config_path_for_type (Tom Sullivan)
  * Install bash-completions in PREFIX dir (Wesley Schwengle)
  * Include libgen.h for BSD builds (Tom Sullivan)
  * Create subdirectories when determining config path (Tom Sullivan)
  * Only show basename in usage (William Casarin)
  * Fix segmentation fault on BSD while running make test (Björn Ketelaars)
  * README.md updates:
    + Brew formula installation (Thomas Haggett)
    + Ubuntu Xenial dependencies (Nick Timkovich)
    + Debian stable/testing and Ubuntu dependencies (Wesley Schwengle)</changelog>
  <changelog author="Matthias Eliasson &lt;elimat@opensuse.org&gt;" date="1591444800">- Add patch 0001-Mark-global-variable-as-extern.patch to fix builds with gcc10</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674216000">- update to 1.3.4:
  * Updating post parameter</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1715083200">- Update to 1.4.0:
  * Add support for writting encrypted URLs
  * Add support for feature flags
  * Fix shared folder username
  update to 1.3.7:
  * Add support for reading encrypted URLs (Tibor Komlossy)
  * Fix GCC 10 compatibility issue #532 (Tibor Komlossy)
  update to 1.3.6:
  * Fix version (Béla Ormos)
  update to 1.3.5:
  * Updating certificate hashes (Béla Ormos)
  Remove 0001-Mark-global-variable-as-extern.patch and
  0002-latest-ssl-cert.patch file</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622400">- Update to 1.6.1:
  * Fix adding groups to shared folders when one of the users has no
    public key
  * Improve sharing key generation and stop reusing the key as the IV
  * Remove SHA-256 support for login hashes
  * Fix password change failure
  * Fix incorrect pointer-to-pointer argument passing that broke
    compilation with GCC 14
  * Add support for URL logging
  * Fix segmentation faults on Mac OS X
  * Fix synchronisation issues that produced empty IDs
  * Fix feature flags file deletion on logout
- Add lastpass-cli-skip-placeholder-attachkey.patch: blob_write() stores
  the literal string "skipped" in the attachment-key field, which the
  parser then fed to the base64 decoder, aborting with "Could not
  unbase64 the given bytes" and failing 20 of the 21 tests</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622401">- Move the shell completions into bash-completion, zsh-completion and
  fish-completion subpackages, so a shell's completions are only pulled
  in where that shell is installed
- Install the fish completion as lpass.fish under the vendor completions
  directory: fish autoloads a completion from a file named after the
  command it completes, so the name shipped so far was never read
- Stop installing the bash completion by hand, the build system already
  installs it into the directory bash-completion declares
- Drop the bash-completion Recommends from the main package, it now
  belongs to the completion subpackage</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622402">- Build and test through the cmake macros, %cmake_build and %ctest,
  rather than driving make directly; %make_jobs is deprecated in favour
  of %cmake_build
- Build the lpass-test target explicitly in %check: it is the binary the
  suite actually drives, upstream marks it EXCLUDE_FROM_ALL, and ctest
  on its own would run every case against a binary that was never built
- Run ctest serially: the cases share one LPASS_HOME and remove the blob
  between them, so a parallel run has them deleting each other's state</changelog>
</package>
<package pkgid="24331cf641ec3537453e65153a0dd529bc645e46a8cdd665ffb9a8742f94033f5a848a08a45cd5607a8c2028e8732db377bff20a24cffd9eaba91be69005d61e" name="lastpass-cli-fish-completion" arch="noarch">
  <version epoch="0" ver="1.6.1" rel="28.1"/>
  <changelog author="mpluskal@suse.com" date="1509019200">- Update to version 1.2.2:
  * lpass ls --format now supports "%al" to show URL
  * $VISUAL can be used in preference to $EDITOR
  * lpass edit can now directly edit multiline ssh keys
  * fields are now preserved when edited with lpass edit
  * Bugfix: use-after-free in http.c fixed
  * Bugfix: command-line completion now works for names with spaces
  * Bugfix: loading attachments from shared folders now works
  * Documentation updates</changelog>
  <changelog author="mpluskal@suse.com" date="1523016000">- Update to version 1.3.0:
  * lpass show now supports --json format
  * lpass show now supports --quiet flag to suppress prompts
  * lpass import has --keep-dupes flag which will preserve
    duplicate accounts on import
  * LPASS_PINENTRY environment variable may now be used to set
    custom path to pinentry
  * Build fix for aarch64 and others
  * New fish completions
  * Zsh completions
  * bugfix: site notes now show up in notes textarea instead of
    fields
  * spelling fixes
- Modernise spec file
- Install autocompletions</changelog>
  <changelog author="ggkioulis@suse.com" date="1528804800">- Update to version 1.3.1:
  * Revert "pins: remove GlobalSign R1/R3 pins" from Robert Copeland
  * Readme update from Wesley Schwengle
  * Add Dockerfile to create a clean build environment from Wesley Schwengle
  * Missing dependencies in readme
  * Added CLion project files to ignore list</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1559131200">- Update to version 1.3.3:
  * Decrease the time for the cli app to do things (Wesley Schwengle)
  * 'blob_load' refactor (Wesley Schwengle)
  * Fixed bug where logout requires login (Wesley Schwengle)
  * Fix non-default PKG_CONFIG_PATH on macOS (Alyssa Ross)
- Changes for version 1.3.2:
  * Don't require using make (Eli Schwartz)
  * Disable IPv6 support (Wesley Schwengle)
  * Link against Brew Curl on MacOS (Tom Sullivan)
  * Autogenerate versions from git (Wesley Schwengle/Eli Schwartz)
  * Remove memory leak in config_path_for_type (Tom Sullivan)
  * Install bash-completions in PREFIX dir (Wesley Schwengle)
  * Include libgen.h for BSD builds (Tom Sullivan)
  * Create subdirectories when determining config path (Tom Sullivan)
  * Only show basename in usage (William Casarin)
  * Fix segmentation fault on BSD while running make test (Björn Ketelaars)
  * README.md updates:
    + Brew formula installation (Thomas Haggett)
    + Ubuntu Xenial dependencies (Nick Timkovich)
    + Debian stable/testing and Ubuntu dependencies (Wesley Schwengle)</changelog>
  <changelog author="Matthias Eliasson &lt;elimat@opensuse.org&gt;" date="1591444800">- Add patch 0001-Mark-global-variable-as-extern.patch to fix builds with gcc10</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674216000">- update to 1.3.4:
  * Updating post parameter</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1715083200">- Update to 1.4.0:
  * Add support for writting encrypted URLs
  * Add support for feature flags
  * Fix shared folder username
  update to 1.3.7:
  * Add support for reading encrypted URLs (Tibor Komlossy)
  * Fix GCC 10 compatibility issue #532 (Tibor Komlossy)
  update to 1.3.6:
  * Fix version (Béla Ormos)
  update to 1.3.5:
  * Updating certificate hashes (Béla Ormos)
  Remove 0001-Mark-global-variable-as-extern.patch and
  0002-latest-ssl-cert.patch file</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622400">- Update to 1.6.1:
  * Fix adding groups to shared folders when one of the users has no
    public key
  * Improve sharing key generation and stop reusing the key as the IV
  * Remove SHA-256 support for login hashes
  * Fix password change failure
  * Fix incorrect pointer-to-pointer argument passing that broke
    compilation with GCC 14
  * Add support for URL logging
  * Fix segmentation faults on Mac OS X
  * Fix synchronisation issues that produced empty IDs
  * Fix feature flags file deletion on logout
- Add lastpass-cli-skip-placeholder-attachkey.patch: blob_write() stores
  the literal string "skipped" in the attachment-key field, which the
  parser then fed to the base64 decoder, aborting with "Could not
  unbase64 the given bytes" and failing 20 of the 21 tests</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622401">- Move the shell completions into bash-completion, zsh-completion and
  fish-completion subpackages, so a shell's completions are only pulled
  in where that shell is installed
- Install the fish completion as lpass.fish under the vendor completions
  directory: fish autoloads a completion from a file named after the
  command it completes, so the name shipped so far was never read
- Stop installing the bash completion by hand, the build system already
  installs it into the directory bash-completion declares
- Drop the bash-completion Recommends from the main package, it now
  belongs to the completion subpackage</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622402">- Build and test through the cmake macros, %cmake_build and %ctest,
  rather than driving make directly; %make_jobs is deprecated in favour
  of %cmake_build
- Build the lpass-test target explicitly in %check: it is the binary the
  suite actually drives, upstream marks it EXCLUDE_FROM_ALL, and ctest
  on its own would run every case against a binary that was never built
- Run ctest serially: the cases share one LPASS_HOME and remove the blob
  between them, so a parallel run has them deleting each other's state</changelog>
</package>
<package pkgid="f4f73b1b5f2ce869a7e52de9a3e720ed894923d1f4f9a00d7f9ee6d7595bab1da0b35f16e9d15cedb0e42faa9f33b675cceb6c034387523b843c06b49495a614" name="lastpass-cli-zsh-completion" arch="noarch">
  <version epoch="0" ver="1.6.1" rel="28.1"/>
  <changelog author="mpluskal@suse.com" date="1509019200">- Update to version 1.2.2:
  * lpass ls --format now supports "%al" to show URL
  * $VISUAL can be used in preference to $EDITOR
  * lpass edit can now directly edit multiline ssh keys
  * fields are now preserved when edited with lpass edit
  * Bugfix: use-after-free in http.c fixed
  * Bugfix: command-line completion now works for names with spaces
  * Bugfix: loading attachments from shared folders now works
  * Documentation updates</changelog>
  <changelog author="mpluskal@suse.com" date="1523016000">- Update to version 1.3.0:
  * lpass show now supports --json format
  * lpass show now supports --quiet flag to suppress prompts
  * lpass import has --keep-dupes flag which will preserve
    duplicate accounts on import
  * LPASS_PINENTRY environment variable may now be used to set
    custom path to pinentry
  * Build fix for aarch64 and others
  * New fish completions
  * Zsh completions
  * bugfix: site notes now show up in notes textarea instead of
    fields
  * spelling fixes
- Modernise spec file
- Install autocompletions</changelog>
  <changelog author="ggkioulis@suse.com" date="1528804800">- Update to version 1.3.1:
  * Revert "pins: remove GlobalSign R1/R3 pins" from Robert Copeland
  * Readme update from Wesley Schwengle
  * Add Dockerfile to create a clean build environment from Wesley Schwengle
  * Missing dependencies in readme
  * Added CLion project files to ignore list</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1559131200">- Update to version 1.3.3:
  * Decrease the time for the cli app to do things (Wesley Schwengle)
  * 'blob_load' refactor (Wesley Schwengle)
  * Fixed bug where logout requires login (Wesley Schwengle)
  * Fix non-default PKG_CONFIG_PATH on macOS (Alyssa Ross)
- Changes for version 1.3.2:
  * Don't require using make (Eli Schwartz)
  * Disable IPv6 support (Wesley Schwengle)
  * Link against Brew Curl on MacOS (Tom Sullivan)
  * Autogenerate versions from git (Wesley Schwengle/Eli Schwartz)
  * Remove memory leak in config_path_for_type (Tom Sullivan)
  * Install bash-completions in PREFIX dir (Wesley Schwengle)
  * Include libgen.h for BSD builds (Tom Sullivan)
  * Create subdirectories when determining config path (Tom Sullivan)
  * Only show basename in usage (William Casarin)
  * Fix segmentation fault on BSD while running make test (Björn Ketelaars)
  * README.md updates:
    + Brew formula installation (Thomas Haggett)
    + Ubuntu Xenial dependencies (Nick Timkovich)
    + Debian stable/testing and Ubuntu dependencies (Wesley Schwengle)</changelog>
  <changelog author="Matthias Eliasson &lt;elimat@opensuse.org&gt;" date="1591444800">- Add patch 0001-Mark-global-variable-as-extern.patch to fix builds with gcc10</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674216000">- update to 1.3.4:
  * Updating post parameter</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1715083200">- Update to 1.4.0:
  * Add support for writting encrypted URLs
  * Add support for feature flags
  * Fix shared folder username
  update to 1.3.7:
  * Add support for reading encrypted URLs (Tibor Komlossy)
  * Fix GCC 10 compatibility issue #532 (Tibor Komlossy)
  update to 1.3.6:
  * Fix version (Béla Ormos)
  update to 1.3.5:
  * Updating certificate hashes (Béla Ormos)
  Remove 0001-Mark-global-variable-as-extern.patch and
  0002-latest-ssl-cert.patch file</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622400">- Update to 1.6.1:
  * Fix adding groups to shared folders when one of the users has no
    public key
  * Improve sharing key generation and stop reusing the key as the IV
  * Remove SHA-256 support for login hashes
  * Fix password change failure
  * Fix incorrect pointer-to-pointer argument passing that broke
    compilation with GCC 14
  * Add support for URL logging
  * Fix segmentation faults on Mac OS X
  * Fix synchronisation issues that produced empty IDs
  * Fix feature flags file deletion on logout
- Add lastpass-cli-skip-placeholder-attachkey.patch: blob_write() stores
  the literal string "skipped" in the attachment-key field, which the
  parser then fed to the base64 decoder, aborting with "Could not
  unbase64 the given bytes" and failing 20 of the 21 tests</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622401">- Move the shell completions into bash-completion, zsh-completion and
  fish-completion subpackages, so a shell's completions are only pulled
  in where that shell is installed
- Install the fish completion as lpass.fish under the vendor completions
  directory: fish autoloads a completion from a file named after the
  command it completes, so the name shipped so far was never read
- Stop installing the bash completion by hand, the build system already
  installs it into the directory bash-completion declares
- Drop the bash-completion Recommends from the main package, it now
  belongs to the completion subpackage</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1786622402">- Build and test through the cmake macros, %cmake_build and %ctest,
  rather than driving make directly; %make_jobs is deprecated in favour
  of %cmake_build
- Build the lpass-test target explicitly in %check: it is the binary the
  suite actually drives, upstream marks it EXCLUDE_FROM_ALL, and ctest
  on its own would run every case against a binary that was never built
- Run ctest serially: the cases share one LPASS_HOME and remove the blob
  between them, so a parallel run has them deleting each other's state</changelog>
</package>
<package pkgid="e5c5c75aaaa6edd79222ab2cca9f2351e79ee0614d30418244a9ddf9428fb99c049d60e052837ff72b0e7b5d5fcb60bfe756e277c223df3324d05f99b5b2a6a4" name="libargon2-1" arch="s390x">
  <version epoch="0" ver="20190702" rel="34.19"/>
  <changelog author="hpj@urpla.net" date="1485604800">- make sure to call cc with -pthread option (implies -lpthread)
- run test suite</changelog>
  <changelog author="adam@mizerski.pl" date="1487851200">- moved argon2-specs.pdf to doc subpackage
- added packaging of man page</changelog>
  <changelog author="meissner@suse.com" date="1492516800">- ship libargon2.pc (bsc#1034441)</changelog>
  <changelog author="lnussel@suse.de" date="1515499200">- Update to version 0.0+git20171227.670229c:
  * Added ABI version number
  * AVX2/AVX-512F optimizations of BLAMKA
  * Set Argon2 version number from the command line
  * New bindings
  * Minor bug and warning fixes (no security issue)
- use _service file</changelog>
  <changelog author="jengelh@inai.de" date="1515499201">- Update description.</changelog>
  <changelog author="lnussel@suse.de" date="1517313600">- add baselibs.conf as cryptsetup also has 32bit variants</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1589284800">- Update to version 0.0+git20190520.62358ba (boo#1170512):
  * Fix the Makefile to install libargon2.pc.
  * Wait for already running threads if a thread creation failed.
  * Added Argon2 Erlang binding.
  * Additional JVM bindings (Jargon2).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1650715200">- Fix version of package: 20190702 is the upstream version number
  of the package
- Replaced optflags.patch with adjust-makefile.patch, the
  patch will now also allow to set the file permissions of installed
  libraries. This fixes the rpmlint error: shared-library-not-executable</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651060800">- use a source url</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="6dca261523b2d82ca11fb7ddae4ed74e76cc0f71bdcd1f00e14d6bbde3c4ccb44d1e925ffe30a1190fe4c683447a8526431bdae60559cb43dbca228374a42a56" name="libargon2-1-debuginfo" arch="s390x">
  <version epoch="0" ver="20190702" rel="34.19"/>
  <changelog author="hpj@urpla.net" date="1485604800">- make sure to call cc with -pthread option (implies -lpthread)
- run test suite</changelog>
  <changelog author="adam@mizerski.pl" date="1487851200">- moved argon2-specs.pdf to doc subpackage
- added packaging of man page</changelog>
  <changelog author="meissner@suse.com" date="1492516800">- ship libargon2.pc (bsc#1034441)</changelog>
  <changelog author="lnussel@suse.de" date="1515499200">- Update to version 0.0+git20171227.670229c:
  * Added ABI version number
  * AVX2/AVX-512F optimizations of BLAMKA
  * Set Argon2 version number from the command line
  * New bindings
  * Minor bug and warning fixes (no security issue)
- use _service file</changelog>
  <changelog author="jengelh@inai.de" date="1515499201">- Update description.</changelog>
  <changelog author="lnussel@suse.de" date="1517313600">- add baselibs.conf as cryptsetup also has 32bit variants</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1589284800">- Update to version 0.0+git20190520.62358ba (boo#1170512):
  * Fix the Makefile to install libargon2.pc.
  * Wait for already running threads if a thread creation failed.
  * Added Argon2 Erlang binding.
  * Additional JVM bindings (Jargon2).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1650715200">- Fix version of package: 20190702 is the upstream version number
  of the package
- Replaced optflags.patch with adjust-makefile.patch, the
  patch will now also allow to set the file permissions of installed
  libraries. This fixes the rpmlint error: shared-library-not-executable</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651060800">- use a source url</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708430400">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="d000dda9fa31a43e5dff58fe4b7c9ed49c1d8401cf981f27f8ef07274fe597349e37976b42c925aa77169e72eb58b8b2d96a682ac13912da5547b32e79494143" name="libaudit1" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.5"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1649678400">- Modernize specfile constructs.</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.de&gt;" date="1671105600">- Enable build for ARM (32-bit)
- Update to version 3.0.9:
  * In auditd, release the async flush lock on stop
  * Don't allow auditd to log directly into /var/log when log_group is non-zero
  * Cleanup krb5 memory leaks on error paths
  * Update auditd.cron to use auditctl --signal
  * In auparse, if too many fields, realloc array bigger (Paul Wolneykien)
  * In auparse, special case kernel module name interpretation
  * If overflow_action is ignore, don't treat as an error
  (3.0.8)
  * Add gcc function attributes for access and allocation
  * Add some more man pages (MIZUTA Takeshi)
  * In auditd, change the reinitializing of the plugin queue
  * Fix path normalization in auparse (Sergio Correia)
  * In libaudit, handle ECONNREFUSED for network uid/gid lookups (Enzo Matsumiya)
  * In audisp-remote, fix hang with disk_low_action=suspend (Enzo Matsumiya)
  * Drop ProtectHome from auditd.service as it interferes with rules
  (3.0.7)
  * Add support for the OPENAT2 record type (Richard Guy Briggs)
  * In auditd, close the logging file descriptor when logging is suspended
  * Update the capabilities lookup table to match 5.16 kernel
  * Improve interpretation of renamat &amp; faccessat family of syscalls
  * Update syscall table for the 5.16 kernel
  * Reduce dependency from initscripts to initscripts-service
- Refresh patches (context adjusment):
  * audit-allow-manual-stop.patch
  * audit-ausearch-do-not-require-tclass.patch
  * audit-no-gss.patch
  * enable-stop-rules.patch
  * fix-hardened-service.patch
  * harden_auditd.service.patch
- Remove patches (fixed by version update):
  * libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
  * audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Giuliano Belinassi &lt;giuliano.belinassi@suse.com&gt;" date="1679313600">- Enable livepatching on main library on x86_64.</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Add new headers 'audit_logging.h' and 'audit-records.h' for
    audit-devel</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec: add requirement for 'awk' package (bsc#1231236)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="e00a0fb183e92c3989eaf431d6cdbc2c57b8aa06cbaa3e80040ee5a5b73fb0be339228188bfadefb65b060f12713a2efa6533ec7c097eca5cdc4649944459d43" name="libaudit1-debuginfo" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.5"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1649678400">- Modernize specfile constructs.</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.de&gt;" date="1671105600">- Enable build for ARM (32-bit)
- Update to version 3.0.9:
  * In auditd, release the async flush lock on stop
  * Don't allow auditd to log directly into /var/log when log_group is non-zero
  * Cleanup krb5 memory leaks on error paths
  * Update auditd.cron to use auditctl --signal
  * In auparse, if too many fields, realloc array bigger (Paul Wolneykien)
  * In auparse, special case kernel module name interpretation
  * If overflow_action is ignore, don't treat as an error
  (3.0.8)
  * Add gcc function attributes for access and allocation
  * Add some more man pages (MIZUTA Takeshi)
  * In auditd, change the reinitializing of the plugin queue
  * Fix path normalization in auparse (Sergio Correia)
  * In libaudit, handle ECONNREFUSED for network uid/gid lookups (Enzo Matsumiya)
  * In audisp-remote, fix hang with disk_low_action=suspend (Enzo Matsumiya)
  * Drop ProtectHome from auditd.service as it interferes with rules
  (3.0.7)
  * Add support for the OPENAT2 record type (Richard Guy Briggs)
  * In auditd, close the logging file descriptor when logging is suspended
  * Update the capabilities lookup table to match 5.16 kernel
  * Improve interpretation of renamat &amp; faccessat family of syscalls
  * Update syscall table for the 5.16 kernel
  * Reduce dependency from initscripts to initscripts-service
- Refresh patches (context adjusment):
  * audit-allow-manual-stop.patch
  * audit-ausearch-do-not-require-tclass.patch
  * audit-no-gss.patch
  * enable-stop-rules.patch
  * fix-hardened-service.patch
  * harden_auditd.service.patch
- Remove patches (fixed by version update):
  * libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
  * audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Giuliano Belinassi &lt;giuliano.belinassi@suse.com&gt;" date="1679313600">- Enable livepatching on main library on x86_64.</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Add new headers 'audit_logging.h' and 'audit-records.h' for
    audit-devel</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec: add requirement for 'awk' package (bsc#1231236)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="06fcaedfb760ca588c4afd4c29259fc501b4eb3e6be097972abcd67e68097318223e1a1d89c8757cc211a417c4c4bbee9bcb127478151c5e8cc784a98ae0a138" name="libauparse0" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.5"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1649678400">- Modernize specfile constructs.</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.de&gt;" date="1671105600">- Enable build for ARM (32-bit)
- Update to version 3.0.9:
  * In auditd, release the async flush lock on stop
  * Don't allow auditd to log directly into /var/log when log_group is non-zero
  * Cleanup krb5 memory leaks on error paths
  * Update auditd.cron to use auditctl --signal
  * In auparse, if too many fields, realloc array bigger (Paul Wolneykien)
  * In auparse, special case kernel module name interpretation
  * If overflow_action is ignore, don't treat as an error
  (3.0.8)
  * Add gcc function attributes for access and allocation
  * Add some more man pages (MIZUTA Takeshi)
  * In auditd, change the reinitializing of the plugin queue
  * Fix path normalization in auparse (Sergio Correia)
  * In libaudit, handle ECONNREFUSED for network uid/gid lookups (Enzo Matsumiya)
  * In audisp-remote, fix hang with disk_low_action=suspend (Enzo Matsumiya)
  * Drop ProtectHome from auditd.service as it interferes with rules
  (3.0.7)
  * Add support for the OPENAT2 record type (Richard Guy Briggs)
  * In auditd, close the logging file descriptor when logging is suspended
  * Update the capabilities lookup table to match 5.16 kernel
  * Improve interpretation of renamat &amp; faccessat family of syscalls
  * Update syscall table for the 5.16 kernel
  * Reduce dependency from initscripts to initscripts-service
- Refresh patches (context adjusment):
  * audit-allow-manual-stop.patch
  * audit-ausearch-do-not-require-tclass.patch
  * audit-no-gss.patch
  * enable-stop-rules.patch
  * fix-hardened-service.patch
  * harden_auditd.service.patch
- Remove patches (fixed by version update):
  * libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
  * audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Giuliano Belinassi &lt;giuliano.belinassi@suse.com&gt;" date="1679313600">- Enable livepatching on main library on x86_64.</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Add new headers 'audit_logging.h' and 'audit-records.h' for
    audit-devel</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec: add requirement for 'awk' package (bsc#1231236)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="b812c48bf7ff8bf8128ca9885c94dba6c3522261f5def2d6dabfaadfd90df532f2ea624d8999f117e601be0c3de28f57fae770bef6d047360aaea34dc0f3dbdb" name="libauparse0-debuginfo" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.5"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1649678400">- Modernize specfile constructs.</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.de&gt;" date="1671105600">- Enable build for ARM (32-bit)
- Update to version 3.0.9:
  * In auditd, release the async flush lock on stop
  * Don't allow auditd to log directly into /var/log when log_group is non-zero
  * Cleanup krb5 memory leaks on error paths
  * Update auditd.cron to use auditctl --signal
  * In auparse, if too many fields, realloc array bigger (Paul Wolneykien)
  * In auparse, special case kernel module name interpretation
  * If overflow_action is ignore, don't treat as an error
  (3.0.8)
  * Add gcc function attributes for access and allocation
  * Add some more man pages (MIZUTA Takeshi)
  * In auditd, change the reinitializing of the plugin queue
  * Fix path normalization in auparse (Sergio Correia)
  * In libaudit, handle ECONNREFUSED for network uid/gid lookups (Enzo Matsumiya)
  * In audisp-remote, fix hang with disk_low_action=suspend (Enzo Matsumiya)
  * Drop ProtectHome from auditd.service as it interferes with rules
  (3.0.7)
  * Add support for the OPENAT2 record type (Richard Guy Briggs)
  * In auditd, close the logging file descriptor when logging is suspended
  * Update the capabilities lookup table to match 5.16 kernel
  * Improve interpretation of renamat &amp; faccessat family of syscalls
  * Update syscall table for the 5.16 kernel
  * Reduce dependency from initscripts to initscripts-service
- Refresh patches (context adjusment):
  * audit-allow-manual-stop.patch
  * audit-ausearch-do-not-require-tclass.patch
  * audit-no-gss.patch
  * enable-stop-rules.patch
  * fix-hardened-service.patch
  * harden_auditd.service.patch
- Remove patches (fixed by version update):
  * libaudit-fix-unhandled-ECONNREFUSED-from-getpwnam-25.patch
  * audisp-remote-fix-hang-with-disk_low_action-suspend-.patch</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Giuliano Belinassi &lt;giuliano.belinassi@suse.com&gt;" date="1679313600">- Enable livepatching on main library on x86_64.</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Add new headers 'audit_logging.h' and 'audit-records.h' for
    audit-devel</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec: add requirement for 'awk' package (bsc#1231236)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="e43a5986dc0261ff379aa3f2dcff37781fc1fdf6948fc068a9a0dc234a5bbb9df66ea4371fc1db5a4ab4ecf2be22591701464525df1810b04fdace49f4002004" name="libb2" arch="src">
  <version epoch="0" ver="0.98.1" rel="8.4"/>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1552478400">- Initial release for openSUSE</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1761566400">- Add patch to make sure optflags are used:
  * fix-cflags.patch</changelog>
</package>
<package pkgid="c7032cfbab5d583bb4099785193419bedf437cb732fa1a53f701e4e432698e9c6f9c2e548f237db4b8498c41aaffbd575cfab6362e670eba7b34e18dc360d5c2" name="libb2-1" arch="s390x">
  <version epoch="0" ver="0.98.1" rel="8.4"/>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1552478400">- Initial release for openSUSE</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1761566400">- Add patch to make sure optflags are used:
  * fix-cflags.patch</changelog>
</package>
<package pkgid="653442befa6987df99169c775b8895851ed389836ea70fead2332cee01ed0e0286219d05c31d6bd480cb15c59f4ef658d645aae02f40b6c9a645acf499c8251b" name="libb2-1-debuginfo" arch="s390x">
  <version epoch="0" ver="0.98.1" rel="8.4"/>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1552478400">- Initial release for openSUSE</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1761566400">- Add patch to make sure optflags are used:
  * fix-cflags.patch</changelog>
</package>
<package pkgid="b22fe54bc222acbb41c93967bf35bd0998c58ea4c578770b55df3405d7286137c26d277c6e00627d47f9e16155ea372ba24bd2092da960d3fd5421362af780cd" name="libb2-debugsource" arch="s390x">
  <version epoch="0" ver="0.98.1" rel="8.4"/>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1552478400">- Initial release for openSUSE</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1761566400">- Add patch to make sure optflags are used:
  * fix-cflags.patch</changelog>
</package>
<package pkgid="0a04260859c59c5eaf89ce9802401fb550d1a799667ef722317436ff52b56a4a2700d223f3658ead9cf9a08314deaefe6de483df205f4fd3933c215b3ec63f30" name="libb2-devel" arch="s390x">
  <version epoch="0" ver="0.98.1" rel="8.4"/>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1552478400">- Initial release for openSUSE</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1761566400">- Add patch to make sure optflags are used:
  * fix-cflags.patch</changelog>
</package>
<package pkgid="d7ce2b5e8effa1a55b4b47eb9d10a20ec45e86b869c1a2d3d469bccd9d20ab494a81d8be6af18efcf2f0c84783716c4c326e1cce6048174bb211ca0352956236" name="libbsd" arch="src">
  <version epoch="0" ver="0.11.7" rel="32.52"/>
  <changelog author="crrodriguez@opensuse.org" date="1329480000">- Cleanup spec file for factory submission</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1345464000">- Version 0.4.2, swithes to autoconf build system.</changelog>
  <changelog author="idonmez@suse.com" date="1346932800">- Fix installation on SLE</changelog>
  <changelog author="jengelh@inai.de" date="1346932801">- Avoid unnecessary complex install line on Redhatish
- Compact file list, add helpful URLs to specfile</changelog>
  <changelog author="dhall@wustl.edu" date="1414670400">- update to version 0.7.0</changelog>
  <changelog author="mpluskal@suse.com" date="1431086400">- Add gpg signature
- Use fdupes to remove duplicate files
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1449662400">- Update to 0.8.0
  * See attached ChangeLog for details</changelog>
  <changelog author="mpluskal@suse.com" date="1451131200">- Update to 0.8.1
  * Use local SHA512 header
  * Unify most arc4random Unix hooks into a single file
  * Add support for GNU/kFreeBSD for closefrom() and getentropy()
  * Fix getentropy implementation to use the correct system hooks
  * Add missing copyright and license headers
  * Relicense my contribution to BSD-2-clause
  * Switch COPYING to Debian copyright machine readable format 1.0
  * Use the non-overlayed libbsd headers when we need our own definitions
  * Add missing include to &lt;md5.h&gt;
  * Turn &lt;bsd/bsd.h&gt; inert when using LIBBSD_OVERLAY
  * test: Add new unit tests for individual headers usage
  * Add support for GNU/Hurd to getentropy()</changelog>
  <changelog author="idonmez@suse.com" date="1451304000">- Split static library into libbsd-ctor-static package.</changelog>
  <changelog author="mpluskal@suse.com" date="1463486400">- Update to version 0.8.3:
  * Fix unportable sizeof() usage
  * Fix file descriptor leak in HASHFileChunk helper
  * Switch URLs from http or git to https
  * build: Support clock_gettime() provided in librt
  * man: Fix ungrammatical construct
  * test: Add a unit test for md5
  * Add missing &lt;fcntl.h&gt; includes
- Changes for 0.8.2:
  * test: Fix success return code for arc4random unit test
  * test: Add missing &lt;sys/stat.h&gt; include
  * Fix heap buffer overflow in fgetwln()
  * test: Fix race condition in headers-*.sh
- Enable internal tests
- Use correct package categories</changelog>
  <changelog author="mpluskal@suse.com" date="1508414400">- Update to version 0.8.6:
  * test:
    + Fix nlist() unit test on IA64 and PowerPC 64-bit ELFv1
  * Fix handling of non-contiguous argv + envp in setproctitle()
- Changes for version 0.8.5:
  * test:
    + Handle libtool executable names in getprogname() unit test
    + Remove unused variable in nlist() unit test
  * man:
    + Ship and install libbsd(7)
    + Update man page sections in titles and references
  * Fix ELF definitions for PowerPC in local-elf.h
  * Fix ELF definitions for MIPS in local-elf.h
- Changes for version 0.8.4:
  * Add support for RISC-V
  * Support GCC deprecated attribute for GCC older than 4.5
  * Fix the __progname check to avoid the optimizer discarding the symbol
  * Gracefully handle lack of system &lt;sys/cdefs.h&gt;
  * Do not provide funopen() on musl
  * Try &lt;linux/a.out.h&gt; if &lt;a.out.h&gt; is not present
  * Do not use legacy BSD u_* types
  * Import &lt;sys/time.h&gt; for some of its macros</changelog>
  <changelog author="avindra@opensuse.org" date="1516795200">- Update to version 0.8.7:
  * Fix &lt;sys/cdefs.h&gt; for gcc with no __has_include or
    __has_include_next support
  * man: Document on what other BSDs arc4random(3) is present
  * Handle several functions now being provided by glibc
  * test: Fix nlist(3) unit test on IA64
- switch to mirror temporarily, per announce:
  https://lists.freedesktop.org/archives/libbsd/2018-January/000166.html</changelog>
  <changelog author="mpluskal@suse.com" date="1530100800">- Update to version 0.9.1:
  * Add __arraycount() macro.
  * Add flopenat() function.
  * Add strtoi() and strtou() functions.
  * Add several new vis and unvis functions.
  * Add pidfile_fileno() function, and struct pidfh is now opaque.
  * The humanize_number() now understands HN_IEC_PREFIXES.
  * The fmtcheck() function supports all standard printf(3)
    conversions.
  * The getentropy(), and thus arc4random() functions will not
    block anymore on Linux on boot when there's not enough entropy
    available.
  * The arc4random() function handles direct clone() calls better.</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1556020800">- Disable LTO - symbol versioning unsupported by GCC (boo#1133096).</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1576497600">- Update to version 0.10.0:
  * Several security related fixes for nlist() reported by Daniel
    Hodson and one by Coverity Scan.
  * Preliminary and partial Windows porting, thanks to Aaron
    Dierking.
  * Fix for a leak in the vis family of functions.
  * Fix for a configure check to not unnecessarily link against
    librt.
  * General portability fixes for musl, uClibc, macOS and
    GNU/kFreeBSD.
  * New architectures support for nlist().
  * Switch the &lt;err.h&gt; *c() functions to be standalone and add
    err(), warn(), errx() and warnx() familiy of functions in case
    the system lacks them.
  * Several man page fixes.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1623067200">- Drop --with-pic (no effect with --disable-static).
- Make description neutral; adhere to noun phrasing.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1650024000">- update to 0.11.6:
  * import pwcache module from OpenBSD
  * use libmd for hashing functions
  * Fix message digest library checks
  * Switch libmd wrapper to dlsym
  * Enable .init_array support when building with LTO
  * Switch md5 back to direct linking
- reenable LTO</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1650456000">- add missing devel requires</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1665144000">- update to 0.11.7:
  * man: Discourage using the library in non-overlay mode
  * include: Adjust reallocarray() per glibc adoption
  * include: Adjust arc4random() per glibc adoption
  * include: explicit_bzero() requires _DEFAULT_SOURCE
  * include: Simplify glibc version dependent macro handling
  * doc: Switch references from pkg-config to pkgconf
  * doc: Add missing empty line to separate README sections
  * doc: Refer to the main git repository as primary
  * test: Fix explicit_bzero() test on the Hurd
  * fgetwln: Add comment about lack of getwline(3) for recommendation
  * setmode: Dot not use saveset after free
  * man: Rewrite gerprogname(3bsd) from scratch
  * man: Lowercase man page title
  * man: Document that some arc4random(3) functions are now in glibc 2.36
  * Sync arc4random(3) implementation from OpenBSD
  * Fix ELF support for big endian SH
  * man: Use -compact also for alternative functions in libbsd(7)
  * getentropy: Fix function cast for getauxval()</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1678881600">- Add libbsd-glibc-2.34-closefrom.patch to avoid conflicting
  with function provided by glibc 2.34</changelog>
</package>
<package pkgid="b3863b29c27ca54c8270e720bf245c87736fff40564fec9192df9e5e8f315c0c5241ea309e2cc87f1fd7d2702ac8e1a8cfcc34a53c3a9f65784332229f6e4f65" name="libbsd-ctor-static" arch="s390x">
  <version epoch="0" ver="0.11.7" rel="32.52"/>
  <changelog author="mpluskal@suse.com" date="1508414400">- Update to version 0.8.6:
  * test:
    + Fix nlist() unit test on IA64 and PowerPC 64-bit ELFv1
  * Fix handling of non-contiguous argv + envp in setproctitle()
- Changes for version 0.8.5:
  * test:
    + Handle libtool executable names in getprogname() unit test
    + Remove unused variable in nlist() unit test
  * man:
    + Ship and install libbsd(7)
    + Update man page sections in titles and references
  * Fix ELF definitions for PowerPC in local-elf.h
  * Fix ELF definitions for MIPS in local-elf.h
- Changes for version 0.8.4:
  * Add support for RISC-V
  * Support GCC deprecated attribute for GCC older than 4.5
  * Fix the __progname check to avoid the optimizer discarding the symbol
  * Gracefully handle lack of system &lt;sys/cdefs.h&gt;
  * Do not provide funopen() on musl
  * Try &lt;linux/a.out.h&gt; if &lt;a.out.h&gt; is not present
  * Do not use legacy BSD u_* types
  * Import &lt;sys/time.h&gt; for some of its macros</changelog>
  <changelog author="avindra@opensuse.org" date="1516795200">- Update to version 0.8.7:
  * Fix &lt;sys/cdefs.h&gt; for gcc with no __has_include or
    __has_include_next support
  * man: Document on what other BSDs arc4random(3) is present
  * Handle several functions now being provided by glibc
  * test: Fix nlist(3) unit test on IA64
- switch to mirror temporarily, per announce:
  https://lists.freedesktop.org/archives/libbsd/2018-January/000166.html</changelog>
  <changelog author="mpluskal@suse.com" date="1530100800">- Update to version 0.9.1:
  * Add __arraycount() macro.
  * Add flopenat() function.
  * Add strtoi() and strtou() functions.
  * Add several new vis and unvis functions.
  * Add pidfile_fileno() function, and struct pidfh is now opaque.
  * The humanize_number() now understands HN_IEC_PREFIXES.
  * The fmtcheck() function supports all standard printf(3)
    conversions.
  * The getentropy(), and thus arc4random() functions will not
    block anymore on Linux on boot when there's not enough entropy
    available.
  * The arc4random() function handles direct clone() calls better.</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1556020800">- Disable LTO - symbol versioning unsupported by GCC (boo#1133096).</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1576497600">- Update to version 0.10.0:
  * Several security related fixes for nlist() reported by Daniel
    Hodson and one by Coverity Scan.
  * Preliminary and partial Windows porting, thanks to Aaron
    Dierking.
  * Fix for a leak in the vis family of functions.
  * Fix for a configure check to not unnecessarily link against
    librt.
  * General portability fixes for musl, uClibc, macOS and
    GNU/kFreeBSD.
  * New architectures support for nlist().
  * Switch the &lt;err.h&gt; *c() functions to be standalone and add
    err(), warn(), errx() and warnx() familiy of functions in case
    the system lacks them.
  * Several man page fixes.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1623067200">- Drop --with-pic (no effect with --disable-static).
- Make description neutral; adhere to noun phrasing.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1650024000">- update to 0.11.6:
  * import pwcache module from OpenBSD
  * use libmd for hashing functions
  * Fix message digest library checks
  * Switch libmd wrapper to dlsym
  * Enable .init_array support when building with LTO
  * Switch md5 back to direct linking
- reenable LTO</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1650456000">- add missing devel requires</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1665144000">- update to 0.11.7:
  * man: Discourage using the library in non-overlay mode
  * include: Adjust reallocarray() per glibc adoption
  * include: Adjust arc4random() per glibc adoption
  * include: explicit_bzero() requires _DEFAULT_SOURCE
  * include: Simplify glibc version dependent macro handling
  * doc: Switch references from pkg-config to pkgconf
  * doc: Add missing empty line to separate README sections
  * doc: Refer to the main git repository as primary
  * test: Fix explicit_bzero() test on the Hurd
  * fgetwln: Add comment about lack of getwline(3) for recommendation
  * setmode: Dot not use saveset after free
  * man: Rewrite gerprogname(3bsd) from scratch
  * man: Lowercase man page title
  * man: Document that some arc4random(3) functions are now in glibc 2.36
  * Sync arc4random(3) implementation from OpenBSD
  * Fix ELF support for big endian SH
  * man: Use -compact also for alternative functions in libbsd(7)
  * getentropy: Fix function cast for getauxval()</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1678881600">- Add libbsd-glibc-2.34-closefrom.patch to avoid conflicting
  with function provided by glibc 2.34</changelog>
</package>
<package pkgid="58add9671dae1e23fc1a7eab84c743d7b5a23fc49fab4faf28fbb2263ffef5f94fb69f70ab1222e04f3407de5c1532dfc11eb72f5c15f52b0204aa462d547487" name="libbsd-debugsource" arch="s390x">
  <version epoch="0" ver="0.11.7" rel="32.52"/>
  <changelog author="mpluskal@suse.com" date="1508414400">- Update to version 0.8.6:
  * test:
    + Fix nlist() unit test on IA64 and PowerPC 64-bit ELFv1
  * Fix handling of non-contiguous argv + envp in setproctitle()
- Changes for version 0.8.5:
  * test:
    + Handle libtool executable names in getprogname() unit test
    + Remove unused variable in nlist() unit test
  * man:
    + Ship and install libbsd(7)
    + Update man page sections in titles and references
  * Fix ELF definitions for PowerPC in local-elf.h
  * Fix ELF definitions for MIPS in local-elf.h
- Changes for version 0.8.4:
  * Add support for RISC-V
  * Support GCC deprecated attribute for GCC older than 4.5
  * Fix the __progname check to avoid the optimizer discarding the symbol
  * Gracefully handle lack of system &lt;sys/cdefs.h&gt;
  * Do not provide funopen() on musl
  * Try &lt;linux/a.out.h&gt; if &lt;a.out.h&gt; is not present
  * Do not use legacy BSD u_* types
  * Import &lt;sys/time.h&gt; for some of its macros</changelog>
  <changelog author="avindra@opensuse.org" date="1516795200">- Update to version 0.8.7:
  * Fix &lt;sys/cdefs.h&gt; for gcc with no __has_include or
    __has_include_next support
  * man: Document on what other BSDs arc4random(3) is present
  * Handle several functions now being provided by glibc
  * test: Fix nlist(3) unit test on IA64
- switch to mirror temporarily, per announce:
  https://lists.freedesktop.org/archives/libbsd/2018-January/000166.html</changelog>
  <changelog author="mpluskal@suse.com" date="1530100800">- Update to version 0.9.1:
  * Add __arraycount() macro.
  * Add flopenat() function.
  * Add strtoi() and strtou() functions.
  * Add several new vis and unvis functions.
  * Add pidfile_fileno() function, and struct pidfh is now opaque.
  * The humanize_number() now understands HN_IEC_PREFIXES.
  * The fmtcheck() function supports all standard printf(3)
    conversions.
  * The getentropy(), and thus arc4random() functions will not
    block anymore on Linux on boot when there's not enough entropy
    available.
  * The arc4random() function handles direct clone() calls better.</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1556020800">- Disable LTO - symbol versioning unsupported by GCC (boo#1133096).</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1576497600">- Update to version 0.10.0:
  * Several security related fixes for nlist() reported by Daniel
    Hodson and one by Coverity Scan.
  * Preliminary and partial Windows porting, thanks to Aaron
    Dierking.
  * Fix for a leak in the vis family of functions.
  * Fix for a configure check to not unnecessarily link against
    librt.
  * General portability fixes for musl, uClibc, macOS and
    GNU/kFreeBSD.
  * New architectures support for nlist().
  * Switch the &lt;err.h&gt; *c() functions to be standalone and add
    err(), warn(), errx() and warnx() familiy of functions in case
    the system lacks them.
  * Several man page fixes.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1623067200">- Drop --with-pic (no effect with --disable-static).
- Make description neutral; adhere to noun phrasing.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1650024000">- update to 0.11.6:
  * import pwcache module from OpenBSD
  * use libmd for hashing functions
  * Fix message digest library checks
  * Switch libmd wrapper to dlsym
  * Enable .init_array support when building with LTO
  * Switch md5 back to direct linking
- reenable LTO</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1650456000">- add missing devel requires</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1665144000">- update to 0.11.7:
  * man: Discourage using the library in non-overlay mode
  * include: Adjust reallocarray() per glibc adoption
  * include: Adjust arc4random() per glibc adoption
  * include: explicit_bzero() requires _DEFAULT_SOURCE
  * include: Simplify glibc version dependent macro handling
  * doc: Switch references from pkg-config to pkgconf
  * doc: Add missing empty line to separate README sections
  * doc: Refer to the main git repository as primary
  * test: Fix explicit_bzero() test on the Hurd
  * fgetwln: Add comment about lack of getwline(3) for recommendation
  * setmode: Dot not use saveset after free
  * man: Rewrite gerprogname(3bsd) from scratch
  * man: Lowercase man page title
  * man: Document that some arc4random(3) functions are now in glibc 2.36
  * Sync arc4random(3) implementation from OpenBSD
  * Fix ELF support for big endian SH
  * man: Use -compact also for alternative functions in libbsd(7)
  * getentropy: Fix function cast for getauxval()</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1678881600">- Add libbsd-glibc-2.34-closefrom.patch to avoid conflicting
  with function provided by glibc 2.34</changelog>
</package>
<package pkgid="5d8be721d54c86804d490f06f3d065bf566e28fd00a512c60af14d860b035fc68ab4e5e4b178cc1046c89f1607e92723e38f479865fc2c10214be5fcd8965958" name="libbsd-devel" arch="s390x">
  <version epoch="0" ver="0.11.7" rel="32.52"/>
  <changelog author="mpluskal@suse.com" date="1508414400">- Update to version 0.8.6:
  * test:
    + Fix nlist() unit test on IA64 and PowerPC 64-bit ELFv1
  * Fix handling of non-contiguous argv + envp in setproctitle()
- Changes for version 0.8.5:
  * test:
    + Handle libtool executable names in getprogname() unit test
    + Remove unused variable in nlist() unit test
  * man:
    + Ship and install libbsd(7)
    + Update man page sections in titles and references
  * Fix ELF definitions for PowerPC in local-elf.h
  * Fix ELF definitions for MIPS in local-elf.h
- Changes for version 0.8.4:
  * Add support for RISC-V
  * Support GCC deprecated attribute for GCC older than 4.5
  * Fix the __progname check to avoid the optimizer discarding the symbol
  * Gracefully handle lack of system &lt;sys/cdefs.h&gt;
  * Do not provide funopen() on musl
  * Try &lt;linux/a.out.h&gt; if &lt;a.out.h&gt; is not present
  * Do not use legacy BSD u_* types
  * Import &lt;sys/time.h&gt; for some of its macros</changelog>
  <changelog author="avindra@opensuse.org" date="1516795200">- Update to version 0.8.7:
  * Fix &lt;sys/cdefs.h&gt; for gcc with no __has_include or
    __has_include_next support
  * man: Document on what other BSDs arc4random(3) is present
  * Handle several functions now being provided by glibc
  * test: Fix nlist(3) unit test on IA64
- switch to mirror temporarily, per announce:
  https://lists.freedesktop.org/archives/libbsd/2018-January/000166.html</changelog>
  <changelog author="mpluskal@suse.com" date="1530100800">- Update to version 0.9.1:
  * Add __arraycount() macro.
  * Add flopenat() function.
  * Add strtoi() and strtou() functions.
  * Add several new vis and unvis functions.
  * Add pidfile_fileno() function, and struct pidfh is now opaque.
  * The humanize_number() now understands HN_IEC_PREFIXES.
  * The fmtcheck() function supports all standard printf(3)
    conversions.
  * The getentropy(), and thus arc4random() functions will not
    block anymore on Linux on boot when there's not enough entropy
    available.
  * The arc4random() function handles direct clone() calls better.</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1556020800">- Disable LTO - symbol versioning unsupported by GCC (boo#1133096).</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1576497600">- Update to version 0.10.0:
  * Several security related fixes for nlist() reported by Daniel
    Hodson and one by Coverity Scan.
  * Preliminary and partial Windows porting, thanks to Aaron
    Dierking.
  * Fix for a leak in the vis family of functions.
  * Fix for a configure check to not unnecessarily link against
    librt.
  * General portability fixes for musl, uClibc, macOS and
    GNU/kFreeBSD.
  * New architectures support for nlist().
  * Switch the &lt;err.h&gt; *c() functions to be standalone and add
    err(), warn(), errx() and warnx() familiy of functions in case
    the system lacks them.
  * Several man page fixes.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1623067200">- Drop --with-pic (no effect with --disable-static).
- Make description neutral; adhere to noun phrasing.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1650024000">- update to 0.11.6:
  * import pwcache module from OpenBSD
  * use libmd for hashing functions
  * Fix message digest library checks
  * Switch libmd wrapper to dlsym
  * Enable .init_array support when building with LTO
  * Switch md5 back to direct linking
- reenable LTO</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1650456000">- add missing devel requires</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1665144000">- update to 0.11.7:
  * man: Discourage using the library in non-overlay mode
  * include: Adjust reallocarray() per glibc adoption
  * include: Adjust arc4random() per glibc adoption
  * include: explicit_bzero() requires _DEFAULT_SOURCE
  * include: Simplify glibc version dependent macro handling
  * doc: Switch references from pkg-config to pkgconf
  * doc: Add missing empty line to separate README sections
  * doc: Refer to the main git repository as primary
  * test: Fix explicit_bzero() test on the Hurd
  * fgetwln: Add comment about lack of getwline(3) for recommendation
  * setmode: Dot not use saveset after free
  * man: Rewrite gerprogname(3bsd) from scratch
  * man: Lowercase man page title
  * man: Document that some arc4random(3) functions are now in glibc 2.36
  * Sync arc4random(3) implementation from OpenBSD
  * Fix ELF support for big endian SH
  * man: Use -compact also for alternative functions in libbsd(7)
  * getentropy: Fix function cast for getauxval()</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1678881600">- Add libbsd-glibc-2.34-closefrom.patch to avoid conflicting
  with function provided by glibc 2.34</changelog>
</package>
<package pkgid="8144d9a35edcfb88d8572652901cf40126a4305cf7c8cb0e29b2d08cc17150090eaa6c9da728dbd2fb1d66078bfad00c078123ae7cec9112872ebcd6fbad95b6" name="libbsd0" arch="s390x">
  <version epoch="0" ver="0.11.7" rel="32.52"/>
  <changelog author="mpluskal@suse.com" date="1508414400">- Update to version 0.8.6:
  * test:
    + Fix nlist() unit test on IA64 and PowerPC 64-bit ELFv1
  * Fix handling of non-contiguous argv + envp in setproctitle()
- Changes for version 0.8.5:
  * test:
    + Handle libtool executable names in getprogname() unit test
    + Remove unused variable in nlist() unit test
  * man:
    + Ship and install libbsd(7)
    + Update man page sections in titles and references
  * Fix ELF definitions for PowerPC in local-elf.h
  * Fix ELF definitions for MIPS in local-elf.h
- Changes for version 0.8.4:
  * Add support for RISC-V
  * Support GCC deprecated attribute for GCC older than 4.5
  * Fix the __progname check to avoid the optimizer discarding the symbol
  * Gracefully handle lack of system &lt;sys/cdefs.h&gt;
  * Do not provide funopen() on musl
  * Try &lt;linux/a.out.h&gt; if &lt;a.out.h&gt; is not present
  * Do not use legacy BSD u_* types
  * Import &lt;sys/time.h&gt; for some of its macros</changelog>
  <changelog author="avindra@opensuse.org" date="1516795200">- Update to version 0.8.7:
  * Fix &lt;sys/cdefs.h&gt; for gcc with no __has_include or
    __has_include_next support
  * man: Document on what other BSDs arc4random(3) is present
  * Handle several functions now being provided by glibc
  * test: Fix nlist(3) unit test on IA64
- switch to mirror temporarily, per announce:
  https://lists.freedesktop.org/archives/libbsd/2018-January/000166.html</changelog>
  <changelog author="mpluskal@suse.com" date="1530100800">- Update to version 0.9.1:
  * Add __arraycount() macro.
  * Add flopenat() function.
  * Add strtoi() and strtou() functions.
  * Add several new vis and unvis functions.
  * Add pidfile_fileno() function, and struct pidfh is now opaque.
  * The humanize_number() now understands HN_IEC_PREFIXES.
  * The fmtcheck() function supports all standard printf(3)
    conversions.
  * The getentropy(), and thus arc4random() functions will not
    block anymore on Linux on boot when there's not enough entropy
    available.
  * The arc4random() function handles direct clone() calls better.</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1556020800">- Disable LTO - symbol versioning unsupported by GCC (boo#1133096).</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1576497600">- Update to version 0.10.0:
  * Several security related fixes for nlist() reported by Daniel
    Hodson and one by Coverity Scan.
  * Preliminary and partial Windows porting, thanks to Aaron
    Dierking.
  * Fix for a leak in the vis family of functions.
  * Fix for a configure check to not unnecessarily link against
    librt.
  * General portability fixes for musl, uClibc, macOS and
    GNU/kFreeBSD.
  * New architectures support for nlist().
  * Switch the &lt;err.h&gt; *c() functions to be standalone and add
    err(), warn(), errx() and warnx() familiy of functions in case
    the system lacks them.
  * Several man page fixes.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1623067200">- Drop --with-pic (no effect with --disable-static).
- Make description neutral; adhere to noun phrasing.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1650024000">- update to 0.11.6:
  * import pwcache module from OpenBSD
  * use libmd for hashing functions
  * Fix message digest library checks
  * Switch libmd wrapper to dlsym
  * Enable .init_array support when building with LTO
  * Switch md5 back to direct linking
- reenable LTO</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1650456000">- add missing devel requires</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1665144000">- update to 0.11.7:
  * man: Discourage using the library in non-overlay mode
  * include: Adjust reallocarray() per glibc adoption
  * include: Adjust arc4random() per glibc adoption
  * include: explicit_bzero() requires _DEFAULT_SOURCE
  * include: Simplify glibc version dependent macro handling
  * doc: Switch references from pkg-config to pkgconf
  * doc: Add missing empty line to separate README sections
  * doc: Refer to the main git repository as primary
  * test: Fix explicit_bzero() test on the Hurd
  * fgetwln: Add comment about lack of getwline(3) for recommendation
  * setmode: Dot not use saveset after free
  * man: Rewrite gerprogname(3bsd) from scratch
  * man: Lowercase man page title
  * man: Document that some arc4random(3) functions are now in glibc 2.36
  * Sync arc4random(3) implementation from OpenBSD
  * Fix ELF support for big endian SH
  * man: Use -compact also for alternative functions in libbsd(7)
  * getentropy: Fix function cast for getauxval()</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1678881600">- Add libbsd-glibc-2.34-closefrom.patch to avoid conflicting
  with function provided by glibc 2.34</changelog>
</package>
<package pkgid="3509c3277aeea12f5e2d3e799bedc07b22a815f3e2c7698b07d586d10960a294f168c01496f22763d112f982d858d418da0a9178d6ed19c358f803b66bfbc27d" name="libbsd0-debuginfo" arch="s390x">
  <version epoch="0" ver="0.11.7" rel="32.52"/>
  <changelog author="mpluskal@suse.com" date="1508414400">- Update to version 0.8.6:
  * test:
    + Fix nlist() unit test on IA64 and PowerPC 64-bit ELFv1
  * Fix handling of non-contiguous argv + envp in setproctitle()
- Changes for version 0.8.5:
  * test:
    + Handle libtool executable names in getprogname() unit test
    + Remove unused variable in nlist() unit test
  * man:
    + Ship and install libbsd(7)
    + Update man page sections in titles and references
  * Fix ELF definitions for PowerPC in local-elf.h
  * Fix ELF definitions for MIPS in local-elf.h
- Changes for version 0.8.4:
  * Add support for RISC-V
  * Support GCC deprecated attribute for GCC older than 4.5
  * Fix the __progname check to avoid the optimizer discarding the symbol
  * Gracefully handle lack of system &lt;sys/cdefs.h&gt;
  * Do not provide funopen() on musl
  * Try &lt;linux/a.out.h&gt; if &lt;a.out.h&gt; is not present
  * Do not use legacy BSD u_* types
  * Import &lt;sys/time.h&gt; for some of its macros</changelog>
  <changelog author="avindra@opensuse.org" date="1516795200">- Update to version 0.8.7:
  * Fix &lt;sys/cdefs.h&gt; for gcc with no __has_include or
    __has_include_next support
  * man: Document on what other BSDs arc4random(3) is present
  * Handle several functions now being provided by glibc
  * test: Fix nlist(3) unit test on IA64
- switch to mirror temporarily, per announce:
  https://lists.freedesktop.org/archives/libbsd/2018-January/000166.html</changelog>
  <changelog author="mpluskal@suse.com" date="1530100800">- Update to version 0.9.1:
  * Add __arraycount() macro.
  * Add flopenat() function.
  * Add strtoi() and strtou() functions.
  * Add several new vis and unvis functions.
  * Add pidfile_fileno() function, and struct pidfh is now opaque.
  * The humanize_number() now understands HN_IEC_PREFIXES.
  * The fmtcheck() function supports all standard printf(3)
    conversions.
  * The getentropy(), and thus arc4random() functions will not
    block anymore on Linux on boot when there's not enough entropy
    available.
  * The arc4random() function handles direct clone() calls better.</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1556020800">- Disable LTO - symbol versioning unsupported by GCC (boo#1133096).</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1576497600">- Update to version 0.10.0:
  * Several security related fixes for nlist() reported by Daniel
    Hodson and one by Coverity Scan.
  * Preliminary and partial Windows porting, thanks to Aaron
    Dierking.
  * Fix for a leak in the vis family of functions.
  * Fix for a configure check to not unnecessarily link against
    librt.
  * General portability fixes for musl, uClibc, macOS and
    GNU/kFreeBSD.
  * New architectures support for nlist().
  * Switch the &lt;err.h&gt; *c() functions to be standalone and add
    err(), warn(), errx() and warnx() familiy of functions in case
    the system lacks them.
  * Several man page fixes.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1623067200">- Drop --with-pic (no effect with --disable-static).
- Make description neutral; adhere to noun phrasing.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1650024000">- update to 0.11.6:
  * import pwcache module from OpenBSD
  * use libmd for hashing functions
  * Fix message digest library checks
  * Switch libmd wrapper to dlsym
  * Enable .init_array support when building with LTO
  * Switch md5 back to direct linking
- reenable LTO</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1650456000">- add missing devel requires</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1665144000">- update to 0.11.7:
  * man: Discourage using the library in non-overlay mode
  * include: Adjust reallocarray() per glibc adoption
  * include: Adjust arc4random() per glibc adoption
  * include: explicit_bzero() requires _DEFAULT_SOURCE
  * include: Simplify glibc version dependent macro handling
  * doc: Switch references from pkg-config to pkgconf
  * doc: Add missing empty line to separate README sections
  * doc: Refer to the main git repository as primary
  * test: Fix explicit_bzero() test on the Hurd
  * fgetwln: Add comment about lack of getwline(3) for recommendation
  * setmode: Dot not use saveset after free
  * man: Rewrite gerprogname(3bsd) from scratch
  * man: Lowercase man page title
  * man: Document that some arc4random(3) functions are now in glibc 2.36
  * Sync arc4random(3) implementation from OpenBSD
  * Fix ELF support for big endian SH
  * man: Use -compact also for alternative functions in libbsd(7)
  * getentropy: Fix function cast for getauxval()</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1678881600">- Add libbsd-glibc-2.34-closefrom.patch to avoid conflicting
  with function provided by glibc 2.34</changelog>
</package>
<package pkgid="85047efbf9962a957ff01f2484b3403fea2af26d7f1fbdcaee301603f10f5083aaa97819ac50cdf94e23986f03d5e759fff08f07c5cdb9452cd1cefc7bd55292" name="libcap-ng" arch="src">
  <version epoch="0" ver="0.8.5" rel="54.22"/>
  <changelog author="coolo@novell.com" date="1289217600">- fix requires</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1314792000">-  Update to version 0.6.6
- Add CAP_SYSLOG and CAP_WAKE_ALARM (needed for newish kernels)</changelog>
  <changelog author="uli@suse.com" date="1317816000">- cross-build workaround: make sure no attempt is made to build
  python stuff even if it's installed on the host system</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1329048000">- Move libraries back to %{_libdir}, /usr merge project</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1363176000">- version 0.7.3
- Make file opens use the cloexec flag (Cristian Rodríguez)
- Add CAP_BLOCK_SUSPEND
- Fix possible segfaults when CAP_LAST_CAP is larger than the lookup table
- In pscap, don't drop capabilities when running with capabilities
- Add CAP_COMPROMISE_KERNEL
- Define FTW_CONTINUE in case its not defined in libc
- Use glibc for xattr.h if available
- Make sure stderr is used consistently in utils
- Fix logic causing file based capabilities to not be supported when it should</changelog>
  <changelog author="meissner@suse.com" date="1363262400">- use source url</changelog>
  <changelog author="tchvatal@suse.com" date="1400155200">- Version bupm to 0.7.4
- Cleanup with spec-cleaner
- Remove useless specification of attributes
- Really split the two spec files instead of copying them to avoid
  the huge ifdefing.
  + more readable
  - version must be edited in two places when bumping</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1403179200">- Remove unused BuildRequires on libattr-devel</changelog>
  <changelog author="p.drouand@gmail.com" date="1449057600">- Update to version 0.7.7
  * Make sure all types used in _lnode are defined in proc-llist.h
  * Fix python binding test for old kernels
  * Fix leaked FD in library init
- Changes from version 0.7.6
  * Fix python3 support
- Changes from version 0.7.5
  * Make python3 supported
  * In python bindings test, clamp CAP_LAST_CAP with /proc/.../cap_last_cap
  * Update table for 3.16 kernel</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1495022400">- Update to version 0.7.8:
  * Improve Python3 support
  * Fix the thread separation test
  * Correct typo in cap_pacct text
  * Update man page for captest
  * Fix sscanf string lengths in netcap
  * Correct linking of python3 module</changelog>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to version 0.7.9:
  * Detect and output a couple errors in filecap
  * Use pthread_atfork to optionally reset the pid and related info
    on fork
- cleanup with spec-cleaner
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1518955201">- Remove ineffective --with-pic. Fix SRPM group. Redo descriptions.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Move %doc to %license for licenses</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1565265600">- Own %{_datadir}/aclocal: when we might switch to pkgconf instead
  of pkg-config, nothing in the build root is 'accidentally' owning
  this directory for us.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1589284800">- Update to 0.7.10:
  * Update capng_change_id man page
  * Add capng_have_permitted_capabilities function
  * Update filecap to output which set the capabilities are in
  * Fix filecap to not output an error when a file has no capabilities
  * Add udplite support to netcap
  * Fix usage of pthread_atfork (Joe Orton)
  * Mark processes in child user namespaces with * (Danila Kiver)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to 0.7.11
  * Really clear bounding set if asked in capng_change_id
  * Add CAP_PERFMON, CAP_BPF, &amp; CAP_CHECKPOINT_RESTORE
  * Avoid malloc/free in capng_apply (Natanael Copa)
  * If procfs is not available, get bounding set via prctl
- Removed unneeded rules from rpmlintrc</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1652097600">- Update to 0.8.3:
  * Add vararg support to python bindings for capng_updatev
  * Add support for ambient capabilities
  * Add support for V3 filesystem capabilities
  * If procfs is not available, leave last_cap as CAP_LAST_CAP
  * If bounding and ambient not found in status, try prctl method
  * In capng_apply, move ambient caps to the end of the transaction
  * In capng_apply, return errors more aggressively.
  * In capng_apply, if the action includes the bounding set,resync with the kernel
  * Fix signed/unsigned warning in cap-ng.c
  * In capng_apply, return a unique error code to diagnose any failure
  * In capng_have_capability, return 0 for failure
  * Add the libdrop_ambient admin tool
  * In capng_apply, if we blew up in bounding set, allow setting capabilities
  * If PR_CAP_AMBIENT is not available, do not build libdrop_ambient
  * Improve last_cap check
  * Fix parameters to capng_updatev python bindings to be signed
  * Detect capability options at runtime to make containerization easier (ntkme)
  * Initialize the library when linked statically
  * Add gcc function attributes for deallocation</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1704196800">- Update to version 0.8.4
  * In capng_change_id, clear PR_SET_KEEPCAPS if returning an error
  * pscap: add -p option for reporting a specified process
  * Annotate function prototypes to warn if results are unused
  * Drop python2 support</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716206400">- Update to version 0.8.5:
  * Remove python global exception handler since it's deprecated
  * Make the utilities link against just built libraries
  * Remove unused macro in cap-ng.h
- Remove libcap-ng.rpmlintrc, it doesn't seem to be used any more.</changelog>
</package>
<package pkgid="f35f781b1fabf7197f9311460e9dc0ad06ea9ca298a87095957f18877a06e1ffd1eb9c04645f8aee3bf50409608638914ae7d3f690eab9a5a5921c965f239b23" name="libcap-ng-debugsource" arch="s390x">
  <version epoch="0" ver="0.8.5" rel="54.22"/>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to version 0.7.9:
  * Detect and output a couple errors in filecap
  * Use pthread_atfork to optionally reset the pid and related info
    on fork
- cleanup with spec-cleaner
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1518955201">- Remove ineffective --with-pic. Fix SRPM group. Redo descriptions.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Move %doc to %license for licenses</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1565265600">- Own %{_datadir}/aclocal: when we might switch to pkgconf instead
  of pkg-config, nothing in the build root is 'accidentally' owning
  this directory for us.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1589284800">- Update to 0.7.10:
  * Update capng_change_id man page
  * Add capng_have_permitted_capabilities function
  * Update filecap to output which set the capabilities are in
  * Fix filecap to not output an error when a file has no capabilities
  * Add udplite support to netcap
  * Fix usage of pthread_atfork (Joe Orton)
  * Mark processes in child user namespaces with * (Danila Kiver)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to 0.7.11
  * Really clear bounding set if asked in capng_change_id
  * Add CAP_PERFMON, CAP_BPF, &amp; CAP_CHECKPOINT_RESTORE
  * Avoid malloc/free in capng_apply (Natanael Copa)
  * If procfs is not available, get bounding set via prctl
- Removed unneeded rules from rpmlintrc</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1652097600">- Update to 0.8.3:
  * Add vararg support to python bindings for capng_updatev
  * Add support for ambient capabilities
  * Add support for V3 filesystem capabilities
  * If procfs is not available, leave last_cap as CAP_LAST_CAP
  * If bounding and ambient not found in status, try prctl method
  * In capng_apply, move ambient caps to the end of the transaction
  * In capng_apply, return errors more aggressively.
  * In capng_apply, if the action includes the bounding set,resync with the kernel
  * Fix signed/unsigned warning in cap-ng.c
  * In capng_apply, return a unique error code to diagnose any failure
  * In capng_have_capability, return 0 for failure
  * Add the libdrop_ambient admin tool
  * In capng_apply, if we blew up in bounding set, allow setting capabilities
  * If PR_CAP_AMBIENT is not available, do not build libdrop_ambient
  * Improve last_cap check
  * Fix parameters to capng_updatev python bindings to be signed
  * Detect capability options at runtime to make containerization easier (ntkme)
  * Initialize the library when linked statically
  * Add gcc function attributes for deallocation</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1704196800">- Update to version 0.8.4
  * In capng_change_id, clear PR_SET_KEEPCAPS if returning an error
  * pscap: add -p option for reporting a specified process
  * Annotate function prototypes to warn if results are unused
  * Drop python2 support</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716206400">- Update to version 0.8.5:
  * Remove python global exception handler since it's deprecated
  * Make the utilities link against just built libraries
  * Remove unused macro in cap-ng.h
- Remove libcap-ng.rpmlintrc, it doesn't seem to be used any more.</changelog>
</package>
<package pkgid="3c6f9c12e998320cf7953d07cffcf3d716cbcc9fed14b911fc255a24fb587f192595ac42a1e8d70ac2f91386f26ad776dffe198a81872d7e233f67f1acbe254f" name="libcap-ng-devel" arch="s390x">
  <version epoch="0" ver="0.8.5" rel="54.22"/>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to version 0.7.9:
  * Detect and output a couple errors in filecap
  * Use pthread_atfork to optionally reset the pid and related info
    on fork
- cleanup with spec-cleaner
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1518955201">- Remove ineffective --with-pic. Fix SRPM group. Redo descriptions.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Move %doc to %license for licenses</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1565265600">- Own %{_datadir}/aclocal: when we might switch to pkgconf instead
  of pkg-config, nothing in the build root is 'accidentally' owning
  this directory for us.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1589284800">- Update to 0.7.10:
  * Update capng_change_id man page
  * Add capng_have_permitted_capabilities function
  * Update filecap to output which set the capabilities are in
  * Fix filecap to not output an error when a file has no capabilities
  * Add udplite support to netcap
  * Fix usage of pthread_atfork (Joe Orton)
  * Mark processes in child user namespaces with * (Danila Kiver)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to 0.7.11
  * Really clear bounding set if asked in capng_change_id
  * Add CAP_PERFMON, CAP_BPF, &amp; CAP_CHECKPOINT_RESTORE
  * Avoid malloc/free in capng_apply (Natanael Copa)
  * If procfs is not available, get bounding set via prctl
- Removed unneeded rules from rpmlintrc</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1652097600">- Update to 0.8.3:
  * Add vararg support to python bindings for capng_updatev
  * Add support for ambient capabilities
  * Add support for V3 filesystem capabilities
  * If procfs is not available, leave last_cap as CAP_LAST_CAP
  * If bounding and ambient not found in status, try prctl method
  * In capng_apply, move ambient caps to the end of the transaction
  * In capng_apply, return errors more aggressively.
  * In capng_apply, if the action includes the bounding set,resync with the kernel
  * Fix signed/unsigned warning in cap-ng.c
  * In capng_apply, return a unique error code to diagnose any failure
  * In capng_have_capability, return 0 for failure
  * Add the libdrop_ambient admin tool
  * In capng_apply, if we blew up in bounding set, allow setting capabilities
  * If PR_CAP_AMBIENT is not available, do not build libdrop_ambient
  * Improve last_cap check
  * Fix parameters to capng_updatev python bindings to be signed
  * Detect capability options at runtime to make containerization easier (ntkme)
  * Initialize the library when linked statically
  * Add gcc function attributes for deallocation</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1704196800">- Update to version 0.8.4
  * In capng_change_id, clear PR_SET_KEEPCAPS if returning an error
  * pscap: add -p option for reporting a specified process
  * Annotate function prototypes to warn if results are unused
  * Drop python2 support</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716206400">- Update to version 0.8.5:
  * Remove python global exception handler since it's deprecated
  * Make the utilities link against just built libraries
  * Remove unused macro in cap-ng.h
- Remove libcap-ng.rpmlintrc, it doesn't seem to be used any more.</changelog>
</package>
<package pkgid="3392192049cd18304d337092dca9a1adad6c59162da0e04bd739bbb17e6a95ce388a9cb40c858c9f2eb01a4cda46c3978498cbfdc04fcc1b9e4cd9c963ba6c39" name="libcap-ng-python" arch="src">
  <version epoch="0" ver="0.8.5" rel="54.21"/>
  <changelog author="coolo@novell.com" date="1287057600">- split out python packages now that libcap-ng is used in many
  low level tools it creates cycles</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1288785600">- update to 0.6.5:
  * works around a problem in the Linux 2.6.36 kernel headers
  * fixes a segfault when using filecap on a specific file</changelog>
  <changelog author="coolo@novell.com" date="1289217600">- fix requires</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1314792000">-  Update to version 0.6.6
- Add CAP_SYSLOG and CAP_WAKE_ALARM (needed for newish kernels)</changelog>
  <changelog author="uli@suse.com" date="1317816000">- cross-build workaround: make sure no attempt is made to build
  python stuff even if it's installed on the host system</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1329048000">- Move libraries back to %{_libdir}, /usr merge project</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1363176000">- version 0.7.3
- Make file opens use the cloexec flag (Cristian Rodríguez)
- Add CAP_BLOCK_SUSPEND
- Fix possible segfaults when CAP_LAST_CAP is larger than the lookup table
- In pscap, don't drop capabilities when running with capabilities
- Add CAP_COMPROMISE_KERNEL
- Define FTW_CONTINUE in case its not defined in libc
- Use glibc for xattr.h if available
- Make sure stderr is used consistently in utils
- Fix logic causing file based capabilities to not be supported when it should</changelog>
  <changelog author="meissner@suse.com" date="1363262400">- use source url</changelog>
  <changelog author="tchvatal@suse.com" date="1400155200">- Version bupm to 0.7.4
- Cleanup with spec-cleaner
- Remove useless specification of attributes
- Really split the two spec files instead of copying them to avoid
  the huge ifdefing.
  + more readable
  - version must be edited in two places when bumping</changelog>
  <changelog author="p.drouand@gmail.com" date="1449057600">- Update to version 0.7.7
  * Make sure all types used in _lnode are defined in proc-llist.h
  * Fix python binding test for old kernels
  * Fix leaked FD in library init
- Changes from version 0.7.6
  * Fix python3 support
- Changes from version 0.7.5
  * Make python3 supported
  * In python bindings test, clamp CAP_LAST_CAP with /proc/.../cap_last_cap
  * Update table for 3.16 kernel</changelog>
  <changelog author="tchvatal@suse.com" date="1449489600">- Fix build by passing --without-python3 argument. For now we are
  fine with py2 bindings only</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1495022400">- Update to version 0.7.8:
  * Improve Python3 support
  * Fix the thread separation test
  * Correct typo in cap_pacct text
  * Update man page for captest
  * Fix sscanf string lengths in netcap
  * Correct linking of python3 module</changelog>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to version 0.7.9:
  * Fix byte compiling python3 bindings
  * Rework spec file to show new python2/3 separation
- cleanup with spec-cleaner
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1518955201">- Remove ineffective --with-pic. Fix SRPM group. Redo descriptions.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Switch to singlespec approach to allow building of python3
  bindings</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1589284800">- Update to 0.7.10:
  * Update capng_change_id man page
  * Add capng_have_permitted_capabilities function
  * Update filecap to output which set the capabilities are in
  * Fix filecap to not output an error when a file has no capabilities
  * Add udplite support to netcap
  * Fix usage of pthread_atfork (Joe Orton)
  * Mark processes in child user namespaces with * (Danila Kiver)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to 0.7.11
  * Really clear bounding set if asked in capng_change_id
  * Add CAP_PERFMON, CAP_BPF, &amp; CAP_CHECKPOINT_RESTORE
  * Avoid malloc/free in capng_apply (Natanael Copa)
  * If procfs is not available, get bounding set via prctl</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1652097600">- Update to 0.8.3:
  * Add vararg support to python bindings for capng_updatev
  * Add support for ambient capabilities
  * Add support for V3 filesystem capabilities
  * If procfs is not available, leave last_cap as CAP_LAST_CAP
  * If bounding and ambient not found in status, try prctl method
  * In capng_apply, move ambient caps to the end of the transaction
  * In capng_apply, return errors more aggressively.
  * In capng_apply, if the action includes the bounding set,resync with the kernel
  * Fix signed/unsigned warning in cap-ng.c
  * In capng_apply, return a unique error code to diagnose any failure
  * In capng_have_capability, return 0 for failure
  * Add the libdrop_ambient admin tool
  * In capng_apply, if we blew up in bounding set, allow setting capabilities
  * If PR_CAP_AMBIENT is not available, do not build libdrop_ambient
  * Improve last_cap check
  * Fix parameters to capng_updatev python bindings to be signed
  * Detect capability options at runtime to make containerization easier (ntkme)
  * Initialize the library when linked statically
  * Add gcc function attributes for deallocation</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1704196800">- Update to version 0.8.4
  * In capng_change_id, clear PR_SET_KEEPCAPS if returning an error
  * pscap: add -p option for reporting a specified process
  * Annotate function prototypes to warn if results are unused
  * Drop python2 support</changelog>
</package>
<package pkgid="cba956f60f8a43c3dbc9ac234852c6010e76f0eea5d4e67293d384ee0d9479353f3fd090dab04f98e1633693b44b567d3e2b34e82c61c58bdcdd4f016dc7ee27" name="libcap-ng-python-debugsource" arch="s390x">
  <version epoch="0" ver="0.8.5" rel="54.21"/>
  <changelog author="tchvatal@suse.com" date="1449489600">- Fix build by passing --without-python3 argument. For now we are
  fine with py2 bindings only</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1495022400">- Update to version 0.7.8:
  * Improve Python3 support
  * Fix the thread separation test
  * Correct typo in cap_pacct text
  * Update man page for captest
  * Fix sscanf string lengths in netcap
  * Correct linking of python3 module</changelog>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to version 0.7.9:
  * Fix byte compiling python3 bindings
  * Rework spec file to show new python2/3 separation
- cleanup with spec-cleaner
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1518955201">- Remove ineffective --with-pic. Fix SRPM group. Redo descriptions.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Switch to singlespec approach to allow building of python3
  bindings</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1589284800">- Update to 0.7.10:
  * Update capng_change_id man page
  * Add capng_have_permitted_capabilities function
  * Update filecap to output which set the capabilities are in
  * Fix filecap to not output an error when a file has no capabilities
  * Add udplite support to netcap
  * Fix usage of pthread_atfork (Joe Orton)
  * Mark processes in child user namespaces with * (Danila Kiver)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to 0.7.11
  * Really clear bounding set if asked in capng_change_id
  * Add CAP_PERFMON, CAP_BPF, &amp; CAP_CHECKPOINT_RESTORE
  * Avoid malloc/free in capng_apply (Natanael Copa)
  * If procfs is not available, get bounding set via prctl</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1652097600">- Update to 0.8.3:
  * Add vararg support to python bindings for capng_updatev
  * Add support for ambient capabilities
  * Add support for V3 filesystem capabilities
  * If procfs is not available, leave last_cap as CAP_LAST_CAP
  * If bounding and ambient not found in status, try prctl method
  * In capng_apply, move ambient caps to the end of the transaction
  * In capng_apply, return errors more aggressively.
  * In capng_apply, if the action includes the bounding set,resync with the kernel
  * Fix signed/unsigned warning in cap-ng.c
  * In capng_apply, return a unique error code to diagnose any failure
  * In capng_have_capability, return 0 for failure
  * Add the libdrop_ambient admin tool
  * In capng_apply, if we blew up in bounding set, allow setting capabilities
  * If PR_CAP_AMBIENT is not available, do not build libdrop_ambient
  * Improve last_cap check
  * Fix parameters to capng_updatev python bindings to be signed
  * Detect capability options at runtime to make containerization easier (ntkme)
  * Initialize the library when linked statically
  * Add gcc function attributes for deallocation</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1704196800">- Update to version 0.8.4
  * In capng_change_id, clear PR_SET_KEEPCAPS if returning an error
  * pscap: add -p option for reporting a specified process
  * Annotate function prototypes to warn if results are unused
  * Drop python2 support</changelog>
</package>
<package pkgid="5d76927ca4223c44059e392c3ce43eaa0e0f66e45a94d81f265d86d21ef117f4b3237f986628c32cdd8826f87bc0bbadd8851b8e6f6af0a3fbb4077eebba494d" name="libcap-ng-utils" arch="s390x">
  <version epoch="0" ver="0.8.5" rel="54.22"/>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to version 0.7.9:
  * Detect and output a couple errors in filecap
  * Use pthread_atfork to optionally reset the pid and related info
    on fork
- cleanup with spec-cleaner
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1518955201">- Remove ineffective --with-pic. Fix SRPM group. Redo descriptions.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Move %doc to %license for licenses</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1565265600">- Own %{_datadir}/aclocal: when we might switch to pkgconf instead
  of pkg-config, nothing in the build root is 'accidentally' owning
  this directory for us.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1589284800">- Update to 0.7.10:
  * Update capng_change_id man page
  * Add capng_have_permitted_capabilities function
  * Update filecap to output which set the capabilities are in
  * Fix filecap to not output an error when a file has no capabilities
  * Add udplite support to netcap
  * Fix usage of pthread_atfork (Joe Orton)
  * Mark processes in child user namespaces with * (Danila Kiver)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to 0.7.11
  * Really clear bounding set if asked in capng_change_id
  * Add CAP_PERFMON, CAP_BPF, &amp; CAP_CHECKPOINT_RESTORE
  * Avoid malloc/free in capng_apply (Natanael Copa)
  * If procfs is not available, get bounding set via prctl
- Removed unneeded rules from rpmlintrc</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1652097600">- Update to 0.8.3:
  * Add vararg support to python bindings for capng_updatev
  * Add support for ambient capabilities
  * Add support for V3 filesystem capabilities
  * If procfs is not available, leave last_cap as CAP_LAST_CAP
  * If bounding and ambient not found in status, try prctl method
  * In capng_apply, move ambient caps to the end of the transaction
  * In capng_apply, return errors more aggressively.
  * In capng_apply, if the action includes the bounding set,resync with the kernel
  * Fix signed/unsigned warning in cap-ng.c
  * In capng_apply, return a unique error code to diagnose any failure
  * In capng_have_capability, return 0 for failure
  * Add the libdrop_ambient admin tool
  * In capng_apply, if we blew up in bounding set, allow setting capabilities
  * If PR_CAP_AMBIENT is not available, do not build libdrop_ambient
  * Improve last_cap check
  * Fix parameters to capng_updatev python bindings to be signed
  * Detect capability options at runtime to make containerization easier (ntkme)
  * Initialize the library when linked statically
  * Add gcc function attributes for deallocation</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1704196800">- Update to version 0.8.4
  * In capng_change_id, clear PR_SET_KEEPCAPS if returning an error
  * pscap: add -p option for reporting a specified process
  * Annotate function prototypes to warn if results are unused
  * Drop python2 support</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716206400">- Update to version 0.8.5:
  * Remove python global exception handler since it's deprecated
  * Make the utilities link against just built libraries
  * Remove unused macro in cap-ng.h
- Remove libcap-ng.rpmlintrc, it doesn't seem to be used any more.</changelog>
</package>
<package pkgid="d4095f9e26bf24689e1a6424d0b625c0911b615e3c0fe2c32156d99470455af9b9e6e3b367234dc692df00a918dd4214bb41751b27d90222739c11a11ce888db" name="libcap-ng-utils-debuginfo" arch="s390x">
  <version epoch="0" ver="0.8.5" rel="54.22"/>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to version 0.7.9:
  * Detect and output a couple errors in filecap
  * Use pthread_atfork to optionally reset the pid and related info
    on fork
- cleanup with spec-cleaner
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1518955201">- Remove ineffective --with-pic. Fix SRPM group. Redo descriptions.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Move %doc to %license for licenses</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1565265600">- Own %{_datadir}/aclocal: when we might switch to pkgconf instead
  of pkg-config, nothing in the build root is 'accidentally' owning
  this directory for us.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1589284800">- Update to 0.7.10:
  * Update capng_change_id man page
  * Add capng_have_permitted_capabilities function
  * Update filecap to output which set the capabilities are in
  * Fix filecap to not output an error when a file has no capabilities
  * Add udplite support to netcap
  * Fix usage of pthread_atfork (Joe Orton)
  * Mark processes in child user namespaces with * (Danila Kiver)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to 0.7.11
  * Really clear bounding set if asked in capng_change_id
  * Add CAP_PERFMON, CAP_BPF, &amp; CAP_CHECKPOINT_RESTORE
  * Avoid malloc/free in capng_apply (Natanael Copa)
  * If procfs is not available, get bounding set via prctl
- Removed unneeded rules from rpmlintrc</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1652097600">- Update to 0.8.3:
  * Add vararg support to python bindings for capng_updatev
  * Add support for ambient capabilities
  * Add support for V3 filesystem capabilities
  * If procfs is not available, leave last_cap as CAP_LAST_CAP
  * If bounding and ambient not found in status, try prctl method
  * In capng_apply, move ambient caps to the end of the transaction
  * In capng_apply, return errors more aggressively.
  * In capng_apply, if the action includes the bounding set,resync with the kernel
  * Fix signed/unsigned warning in cap-ng.c
  * In capng_apply, return a unique error code to diagnose any failure
  * In capng_have_capability, return 0 for failure
  * Add the libdrop_ambient admin tool
  * In capng_apply, if we blew up in bounding set, allow setting capabilities
  * If PR_CAP_AMBIENT is not available, do not build libdrop_ambient
  * Improve last_cap check
  * Fix parameters to capng_updatev python bindings to be signed
  * Detect capability options at runtime to make containerization easier (ntkme)
  * Initialize the library when linked statically
  * Add gcc function attributes for deallocation</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1704196800">- Update to version 0.8.4
  * In capng_change_id, clear PR_SET_KEEPCAPS if returning an error
  * pscap: add -p option for reporting a specified process
  * Annotate function prototypes to warn if results are unused
  * Drop python2 support</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716206400">- Update to version 0.8.5:
  * Remove python global exception handler since it's deprecated
  * Make the utilities link against just built libraries
  * Remove unused macro in cap-ng.h
- Remove libcap-ng.rpmlintrc, it doesn't seem to be used any more.</changelog>
</package>
<package pkgid="28f1403250ae3a40beb6db89e0530cfd56adfbae0ce743bbbeb733736f16434a464e20c64ec65c0d2762928f0cac2c3b1cd3905cdbcca1e2be4c25b1c11b4ecb" name="libcap-ng0" arch="s390x">
  <version epoch="0" ver="0.8.5" rel="54.22"/>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to version 0.7.9:
  * Detect and output a couple errors in filecap
  * Use pthread_atfork to optionally reset the pid and related info
    on fork
- cleanup with spec-cleaner
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1518955201">- Remove ineffective --with-pic. Fix SRPM group. Redo descriptions.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Move %doc to %license for licenses</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1565265600">- Own %{_datadir}/aclocal: when we might switch to pkgconf instead
  of pkg-config, nothing in the build root is 'accidentally' owning
  this directory for us.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1589284800">- Update to 0.7.10:
  * Update capng_change_id man page
  * Add capng_have_permitted_capabilities function
  * Update filecap to output which set the capabilities are in
  * Fix filecap to not output an error when a file has no capabilities
  * Add udplite support to netcap
  * Fix usage of pthread_atfork (Joe Orton)
  * Mark processes in child user namespaces with * (Danila Kiver)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to 0.7.11
  * Really clear bounding set if asked in capng_change_id
  * Add CAP_PERFMON, CAP_BPF, &amp; CAP_CHECKPOINT_RESTORE
  * Avoid malloc/free in capng_apply (Natanael Copa)
  * If procfs is not available, get bounding set via prctl
- Removed unneeded rules from rpmlintrc</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1652097600">- Update to 0.8.3:
  * Add vararg support to python bindings for capng_updatev
  * Add support for ambient capabilities
  * Add support for V3 filesystem capabilities
  * If procfs is not available, leave last_cap as CAP_LAST_CAP
  * If bounding and ambient not found in status, try prctl method
  * In capng_apply, move ambient caps to the end of the transaction
  * In capng_apply, return errors more aggressively.
  * In capng_apply, if the action includes the bounding set,resync with the kernel
  * Fix signed/unsigned warning in cap-ng.c
  * In capng_apply, return a unique error code to diagnose any failure
  * In capng_have_capability, return 0 for failure
  * Add the libdrop_ambient admin tool
  * In capng_apply, if we blew up in bounding set, allow setting capabilities
  * If PR_CAP_AMBIENT is not available, do not build libdrop_ambient
  * Improve last_cap check
  * Fix parameters to capng_updatev python bindings to be signed
  * Detect capability options at runtime to make containerization easier (ntkme)
  * Initialize the library when linked statically
  * Add gcc function attributes for deallocation</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1704196800">- Update to version 0.8.4
  * In capng_change_id, clear PR_SET_KEEPCAPS if returning an error
  * pscap: add -p option for reporting a specified process
  * Annotate function prototypes to warn if results are unused
  * Drop python2 support</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716206400">- Update to version 0.8.5:
  * Remove python global exception handler since it's deprecated
  * Make the utilities link against just built libraries
  * Remove unused macro in cap-ng.h
- Remove libcap-ng.rpmlintrc, it doesn't seem to be used any more.</changelog>
</package>
<package pkgid="2f8ff8af11ca5bf5ff53b8e00910c7de8e30882f22c977e2cd3088cfa8794dc96492f7844522c93abe8801801107433c2c3b44bb88925e27aea6990b815a34a5" name="libcap-ng0-debuginfo" arch="s390x">
  <version epoch="0" ver="0.8.5" rel="54.22"/>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to version 0.7.9:
  * Detect and output a couple errors in filecap
  * Use pthread_atfork to optionally reset the pid and related info
    on fork
- cleanup with spec-cleaner
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1518955201">- Remove ineffective --with-pic. Fix SRPM group. Redo descriptions.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Move %doc to %license for licenses</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1565265600">- Own %{_datadir}/aclocal: when we might switch to pkgconf instead
  of pkg-config, nothing in the build root is 'accidentally' owning
  this directory for us.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1589284800">- Update to 0.7.10:
  * Update capng_change_id man page
  * Add capng_have_permitted_capabilities function
  * Update filecap to output which set the capabilities are in
  * Fix filecap to not output an error when a file has no capabilities
  * Add udplite support to netcap
  * Fix usage of pthread_atfork (Joe Orton)
  * Mark processes in child user namespaces with * (Danila Kiver)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to 0.7.11
  * Really clear bounding set if asked in capng_change_id
  * Add CAP_PERFMON, CAP_BPF, &amp; CAP_CHECKPOINT_RESTORE
  * Avoid malloc/free in capng_apply (Natanael Copa)
  * If procfs is not available, get bounding set via prctl
- Removed unneeded rules from rpmlintrc</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1652097600">- Update to 0.8.3:
  * Add vararg support to python bindings for capng_updatev
  * Add support for ambient capabilities
  * Add support for V3 filesystem capabilities
  * If procfs is not available, leave last_cap as CAP_LAST_CAP
  * If bounding and ambient not found in status, try prctl method
  * In capng_apply, move ambient caps to the end of the transaction
  * In capng_apply, return errors more aggressively.
  * In capng_apply, if the action includes the bounding set,resync with the kernel
  * Fix signed/unsigned warning in cap-ng.c
  * In capng_apply, return a unique error code to diagnose any failure
  * In capng_have_capability, return 0 for failure
  * Add the libdrop_ambient admin tool
  * In capng_apply, if we blew up in bounding set, allow setting capabilities
  * If PR_CAP_AMBIENT is not available, do not build libdrop_ambient
  * Improve last_cap check
  * Fix parameters to capng_updatev python bindings to be signed
  * Detect capability options at runtime to make containerization easier (ntkme)
  * Initialize the library when linked statically
  * Add gcc function attributes for deallocation</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1704196800">- Update to version 0.8.4
  * In capng_change_id, clear PR_SET_KEEPCAPS if returning an error
  * pscap: add -p option for reporting a specified process
  * Annotate function prototypes to warn if results are unused
  * Drop python2 support</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716206400">- Update to version 0.8.5:
  * Remove python global exception handler since it's deprecated
  * Make the utilities link against just built libraries
  * Remove unused macro in cap-ng.h
- Remove libcap-ng.rpmlintrc, it doesn't seem to be used any more.</changelog>
</package>
<package pkgid="285fbd707fead3e5c49f1d4070c9943da8ddbe0201b386ab4c01add49d606e007a1445aae5cb61e5a3209f5c529ca216da5cd1bb267bd6f5d5881f3c66158fc9" name="libcdk6_3_4" arch="s390x">
  <version epoch="0" ver="5.0.20230201" rel="189.27"/>
  <changelog author="meissner@suse.com" date="1419854400">- fixed url, added .asc and keyring</changelog>
  <changelog author="p.drouand@gmail.com" date="1446379200">- Update to version 5.0.20150928
  * build ".deb" test-package with ncurses6, using versioned symbols.
  * modifications from ncurses/xterm to allow alternate to /bin/sh for
    configure-shell, while dropping support for non-POSIX shell such
    as Solaris.
  * updated/integrated changes for versioned symbols from ncurses6.
  * CF_DISABLE_LIBTOOL_VERSION when using -version-info (the native
    libtool mode), get the ABI_VERSION value from $VERSION (which comes
    from CF_VERSION_INFO)
  * CF_ADD_INCDIR fix an infinite loop when the include-directory to be
    added does not exist (bdo#786436)
  * CF_WITH_NCURSES_ETC add --with-screen option
  * CF_SUBDIR_PATH change this to a loop, adding /usr/pkg (NetBSD) and
    /opt/local (Mac OSX)
  * update config.guess, config.sub</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1550836800">- Update to version 5.0.20190220
  * 2019/02/20
    + updated rpm spec-file, for test-builds.
    + added pkgsrc files, for test-builds.
    + updated FreeBSD port-files, for test-builds.
    + add getCdkTitle, which uses new display encoding "&lt;#10&gt;" for newline
    in the example which demonstrates it, mentry_ex2 (prompted by
    discussion with Stéphane Goujet).
    + fix similar memory leaks in setCDKRadioItems and setCDKSelectionItems
    + fix memory leak in setCDKScrollItems (report by Stéphane Goujet).
    + make functionKey parameter to getchCDKObject optional
    (suggested by Stéphane Goujet).
    + modify test-packages to adjust includes in cdk.h when using test
    package for ncurses6 which would confuse test-package for cdk-perl.
    + change shlib-version in test-package to "abi", for better
    compatibility with the test-package for cdk-perl.
    + add manpage for cdk5-config
    + documentation improvements (report by Stéphane Goujet).
    + add check in drawCDKScrollCurrent() in case the list is not
    initialized (report by Stéphane Goujet).
    + modify writeCharAttrib to replace the color in the target cell rather
    than OR'ing it from the source-attribute (patch by Aarian P. Aleahmad)
    + add a null-pointer check in viewer.c's PatternNotFound() function
    (report by "c").
    + improve macros/markup in manpages.
    + updated configure macros, from lynx and ncurses development:
    CF_ADD_INCDIR, CF_CC_ENV_FLAGS, CF_CURSES_CPPFLAGS, CF_CURSES_LIBS,
    CF_FIND_LINKAGE, CF_GCC_WARNINGS, CF_GNU_SOURCE, CF_LD_RPATH_OPT,
    CF_NCURSES_CONFIG, CF_PDCURSES_X11, CF_POSIX_C_SOURCE, CF_PROG_EXT,
    CF_SHARED_OPTS, CF_TRY_XOPEN_SOURCE, CF_WITH_VERSIONED_SYMS,
    CF_XOPEN_CURSES, CF_XOPEN_SOURCE, CF_X_ATHENA_CPPFLAGS
    + update config.guess, config.sub
  * 2018/03/06
    + update versioned-symbol list for reRegisterCDKObject (prompted by
    Debian #892114, which adopted a different set of symbol versions
    such as "5.0.20161120", cf: 2014/11/06).
    + updated configure macros, from lynx development:  CF_CURSES_FUNCS,
    CF_CURSES_LIBS, CF_MAKEFLAGS, CF_NCURSES_CONFIG, CF_SHARED_OPTS
    + update config.guess, config.sub
  * 2017/12/09
    + updated ftp url in test-packages, etc.
    + updated configure macros CF_CC_ENV_FLAGS, CF_SHARED_OPTS
    + update config.guess, config.sub
  * 2017/09/18
    + updated configure macros:
    + CF_ADD_CFLAGS improve formatting of generated lists using
    CF_APPEND_TEXT
    + CF_CC_ENV_FLAGS - two changes
    a) revise the expression generating $cf_flags to actually work when
    there is more than one option.
    b) correct the parameter passed to CF_ADD_CFLAGS, which was the
    whole list rather than the current parameter.
    + CF_CURSES_LIBS reorganize to handle the case where initscr is a
    macro.
    + CF_NCURSES_CONFIG add check for term.h when using pkg-config
    + CF_NCURSES_VERSION use prototype for main
    + CF_SHARED_OPTS workaround for PGI compiler
    + CF_WITH_LIBTOOL use SIGQUIT(3) rather than SIGTRAP(5) in trap
    commands.  Fix a few places in configure/build scripts where
    DESTDIR and rpath were combined.
    + update config.guess, config.sub
  * 2016/12/10
    + improve formatting of manpages, using bullets
    + add -C and -R options to matrix_ex.c to exercise the col/row spacing
    features of matrix widget.
    + modify matrix widget to highlight the current cell for the cases
    when col/row spacing are greater than zero.
  * 2016/12/04
    + cleanup change for color pairs in 2016/11/20
    + modify initCDKScreen() to simplify initialization of curses by
    calling initscr() in this function after initializing the locale.
    That fixes a problem using PuTTY with CDK when built using ncurses
    (report by Marc Smith).
  * 2016/11/20
    + fix warnings from cppcheck 1.76.1
    + updated configure macros:
    + CF_CC_ENV_FLAGS don't limit the check to -I, -U and -D options,
    since the added options can include various compiler options before
    and after preprocessor options.
    + CF_GNU_SOURCE recent glibc (Debian 2.23-4 for example) has
    misordered ifdef/checks for new symbol _DEFAULT_SOURCE, producing
    warning messages when only _GNU_SOURCE is defined.  Add a followup
    check to define _DEFAULT_SOURCE.
    + CF_LD_RPATH_OPT change FreeBSD to use -Wl,-rpath rather than -rpath
    option.  According to FreeBSD #178732, either works since FreeBSD
    4.x; however scons does not accept anything except the -Wl,-rpath
    form.
    + CF_PROG_LINT add cpplint to programs to use; drop ad hoc tdlint and
    alint.
    + CF_WITH_NCURSES_ETC add check for ncurses pthreads
    + CF_XOPEN_SOURCE add "uclinux" to list of Linux's and use
    _GNU_SOURCE for cygwin headers, tested with cygwin 2.3, 2.5
    + CF__ADD_SHLIB_RULES improve scripting for ldconfig to avoid warning
    messages if no permissions
    + update config.guess, config.sub
    &gt; patches by Aarian P. Aleahmad:
    + modify encodeAttribute() to allow up to 256 color pairs.
    + corrected assignment in scroller_SetPosition(), to show highlighted
    member.
    + improve the way attributes are applied to Mentry widgets.
    + improve Entry widget by using newwin rather than subwin, as well
    as passing arguments to callback function.
  * 2016/11/19
    + add reRegisterCDKObject()
  * 2016/01/31
    + fix a few of the lintian errors in package/debian
    + fix some too-wide tables in manpages, which caused Debian lintian
    errors.
    + take lower-limit's formatted length into account in slider, etc.,
    (patch by Guido Meusch).
    + make similar repainting-fixes for radio.c and marquee.c
    + fix repainting of Scroll widget when it has no box-outline
    (patch by Manuel Schmitz).
    + add highlight and callbackData members to CDKBUTTON, as well as
    macros for setting/getting the highlight value.  Use the highlight to
    override the default A_REVERSE used in CDK button (patch by Aarian P.
    Aleahmad).
    + fix two bugs in template.c (patch by Aarian P. Aleahmad):
    + in cleanCDKTemplate, fill all of the info string with nulls
    + in setCDKTemplateValue, call cleanCDKTemplate whether or not
    the pointer for newValue passed by the caller was a null.
    + updated configure macros:
    + CF_LIB_PREFIX, CF_WITH_LIBTOOL, and CF_XOPEN_SOURCE, build-fixes
    for OS/2
    + CF_XOPEN_CURSES, improve check, making it define NCURSES_WIDECHAR
    if we happen to be building on a platform (such as OSX) where we do
    not define _XOPEN_SOURCE or _XOPEN_SOURCE_EXTENDED
    + CF_WITH_VERSIONED_SYMS, avoid ncurses build error on ppc64
    architecture the nm tool is reporting _is_missing in Data section
    for ppc64 (by comparison ppc64le is reporting it in Text section)
    + update config.guess, config.sub
  * 2015/09/28
    + build ".deb" test-package with ncurses6, using versioned symbols.
    + updated configure macros:
    + modifications from ncurses/xterm to allow alternate to /bin/sh for
    configure-shell, while dropping support for non-POSIX shell such
    as Solaris.
    + updated/integrated changes for versioned symbols from ncurses6.
    + CF_DISABLE_LIBTOOL_VERSION when using -version-info (the native
    libtool mode), get the ABI_VERSION value from $VERSION (which comes
    from CF_VERSION_INFO)
    + CF_ADD_INCDIR fix an infinite loop when the include-directory to be
    added does not exist (Debian #786436)
    + CF_WITH_NCURSES_ETC add --with-screen option
    + CF_SUBDIR_PATH change this to a loop, adding /usr/pkg (NetBSD) and
    /opt/local (Mac OSX)
    + update config.guess, config.sub
  * 2015/01/03
    + modify cdk-config.in to work with systems where libdir is /usr/lib64
    (patch by Peter Hyman).
    + corrected example for cdk_display.3 manpage (patch by Loïc
    work in non-POSIX locales (report by Mart Stöör).</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551182400">- Update to version 5.0.20190224
  + use HDR_ROOTNAME rather than PACKAGE in top-level makefile, to
    simplify building cdk and cdkw packages with non-conflicting paths.
  + add "check" rule to top-level makefile, for testing Arch Linux
    package.
  + modify test-package for RPMs to work with SUSE and Mageia.
- Enable wide version of libcdk(w)
- Enable ABI soname of the shared libraries
  + Somehow strange ABI 6.2.4 but RELEASE version is still 5.0</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551268800">- Remove debugging code from spec file</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551787200">- Update to version 5.0.20190303
  + deprecate installCDKLibrary rule by install.libs, which is used in
    the newer shared-library macros.
  + conditionally-comment action lines for the part of install-rules
    which conflict with the newer shared-library rules (report by Tom
    Brownridge).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620043200">- Update to version 5.0.20210324
  * Spelling fixes, per codespell
  * Updated build system</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1650974400">- Resolve rpmlint report "libcdk5.x86_64: E:
  shlib-policy-name-error SONAME: libcdk.so.6.2.4, expected
  package suffix: 6_2_4"</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1687521600">- Update to version 5.0.20230201
  + improve compiler-warnings in configure-checks.
  + change library dependencies in rpm spec-file.
  + update license in test-packages.
  + relicense as MIT-X11
  + reduce shellcheck warnings in support-scripts
  + updated configure script to work around regression in GNU grep 3.8
  + updated configure macros from xterm and ncurses development
  + update config.guess, config.sub
  + fix cppcheck style-warnings.
  + improve makefile header-dependencies by accounting for all generated
    headers (report/patch by Sergei Trofimovich).
  + updated configure macros from xterm and ncurses development:
    CF_ADD_INCDIR CF_APPEND_CFLAGS CF_DISABLE_ECHO CF_MAKEFLAGS
    CF_NCURSES_CONFIG CF_NCURSES_LIBS CF_PKG_CONFIG CF_REMOVE_CFLAGS
    CF_SHARED_OPTS CF_TRY_XOPEN_SOURCE CF_XOPEN_SOURCE
  + build-fix for HP-UX curses, which provides only part of the ACS_xxx
    definitions compatible with chtype's.
  + correct calls on SetViewSize in scroll.c, overlooked in 2005/04/24
    (report by Brad Hines).
  + updated configure macros from xterm and ncurses development:
    CF_C11_NORETURN CF_CHECK_LIBTOOL_VERSION CF_CONST_X_STRING
    CF_DISABLE_LEAKS CF_FUNC_LSTAT CF_GETOPT_HEADER CF_NCURSES_CONFIG
    CF_NO_LEAKS_OPTION CF_SHARED_OPTS CF_UTF8_LIB CF_XOPEN_CURSES
    CF_XOPEN_SOURCE
  + update config.guess, config.sub
  + updated configure script, for _Noreturn and exit_curses checks.
  + spelling fixes, per codespell.
  + updated configure script, for quoting/escaping fixes
  + update config.guess, config.sub
  + updated configure script, for compiler-warnings
  + update config.guess, config.sub
  + updated configure script, to work around ncurses 6.2 vs xcode's c99
    "-W" option.
  + update config.guess, config.sub
  + fix issues found with check-manpage
  + updated configure macros, from xterm and ncurses development:
    CF_ADD_LIBS CF_GCC_VERSION CF_GCC_WARNINGS CF_PROG_CC CF_PROG_LINT
    CF_X_TOOLKIT
  + update config.guess, config.sub</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1687521601">- Let libcdk6_3_4 conflict with older libcdk6_2_4</changelog>
</package>
<package pkgid="8992129732a57e90b008259aed84f3ddb16dfa39b55125f618393d34597568f03cfc139b183c9e61e5e6cca1c3587b3b68e738cf56c3850f5960a575b6a05905" name="libcdk6_3_4-debuginfo" arch="s390x">
  <version epoch="0" ver="5.0.20230201" rel="189.27"/>
  <changelog author="meissner@suse.com" date="1419854400">- fixed url, added .asc and keyring</changelog>
  <changelog author="p.drouand@gmail.com" date="1446379200">- Update to version 5.0.20150928
  * build ".deb" test-package with ncurses6, using versioned symbols.
  * modifications from ncurses/xterm to allow alternate to /bin/sh for
    configure-shell, while dropping support for non-POSIX shell such
    as Solaris.
  * updated/integrated changes for versioned symbols from ncurses6.
  * CF_DISABLE_LIBTOOL_VERSION when using -version-info (the native
    libtool mode), get the ABI_VERSION value from $VERSION (which comes
    from CF_VERSION_INFO)
  * CF_ADD_INCDIR fix an infinite loop when the include-directory to be
    added does not exist (bdo#786436)
  * CF_WITH_NCURSES_ETC add --with-screen option
  * CF_SUBDIR_PATH change this to a loop, adding /usr/pkg (NetBSD) and
    /opt/local (Mac OSX)
  * update config.guess, config.sub</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1550836800">- Update to version 5.0.20190220
  * 2019/02/20
    + updated rpm spec-file, for test-builds.
    + added pkgsrc files, for test-builds.
    + updated FreeBSD port-files, for test-builds.
    + add getCdkTitle, which uses new display encoding "&lt;#10&gt;" for newline
    in the example which demonstrates it, mentry_ex2 (prompted by
    discussion with Stéphane Goujet).
    + fix similar memory leaks in setCDKRadioItems and setCDKSelectionItems
    + fix memory leak in setCDKScrollItems (report by Stéphane Goujet).
    + make functionKey parameter to getchCDKObject optional
    (suggested by Stéphane Goujet).
    + modify test-packages to adjust includes in cdk.h when using test
    package for ncurses6 which would confuse test-package for cdk-perl.
    + change shlib-version in test-package to "abi", for better
    compatibility with the test-package for cdk-perl.
    + add manpage for cdk5-config
    + documentation improvements (report by Stéphane Goujet).
    + add check in drawCDKScrollCurrent() in case the list is not
    initialized (report by Stéphane Goujet).
    + modify writeCharAttrib to replace the color in the target cell rather
    than OR'ing it from the source-attribute (patch by Aarian P. Aleahmad)
    + add a null-pointer check in viewer.c's PatternNotFound() function
    (report by "c").
    + improve macros/markup in manpages.
    + updated configure macros, from lynx and ncurses development:
    CF_ADD_INCDIR, CF_CC_ENV_FLAGS, CF_CURSES_CPPFLAGS, CF_CURSES_LIBS,
    CF_FIND_LINKAGE, CF_GCC_WARNINGS, CF_GNU_SOURCE, CF_LD_RPATH_OPT,
    CF_NCURSES_CONFIG, CF_PDCURSES_X11, CF_POSIX_C_SOURCE, CF_PROG_EXT,
    CF_SHARED_OPTS, CF_TRY_XOPEN_SOURCE, CF_WITH_VERSIONED_SYMS,
    CF_XOPEN_CURSES, CF_XOPEN_SOURCE, CF_X_ATHENA_CPPFLAGS
    + update config.guess, config.sub
  * 2018/03/06
    + update versioned-symbol list for reRegisterCDKObject (prompted by
    Debian #892114, which adopted a different set of symbol versions
    such as "5.0.20161120", cf: 2014/11/06).
    + updated configure macros, from lynx development:  CF_CURSES_FUNCS,
    CF_CURSES_LIBS, CF_MAKEFLAGS, CF_NCURSES_CONFIG, CF_SHARED_OPTS
    + update config.guess, config.sub
  * 2017/12/09
    + updated ftp url in test-packages, etc.
    + updated configure macros CF_CC_ENV_FLAGS, CF_SHARED_OPTS
    + update config.guess, config.sub
  * 2017/09/18
    + updated configure macros:
    + CF_ADD_CFLAGS improve formatting of generated lists using
    CF_APPEND_TEXT
    + CF_CC_ENV_FLAGS - two changes
    a) revise the expression generating $cf_flags to actually work when
    there is more than one option.
    b) correct the parameter passed to CF_ADD_CFLAGS, which was the
    whole list rather than the current parameter.
    + CF_CURSES_LIBS reorganize to handle the case where initscr is a
    macro.
    + CF_NCURSES_CONFIG add check for term.h when using pkg-config
    + CF_NCURSES_VERSION use prototype for main
    + CF_SHARED_OPTS workaround for PGI compiler
    + CF_WITH_LIBTOOL use SIGQUIT(3) rather than SIGTRAP(5) in trap
    commands.  Fix a few places in configure/build scripts where
    DESTDIR and rpath were combined.
    + update config.guess, config.sub
  * 2016/12/10
    + improve formatting of manpages, using bullets
    + add -C and -R options to matrix_ex.c to exercise the col/row spacing
    features of matrix widget.
    + modify matrix widget to highlight the current cell for the cases
    when col/row spacing are greater than zero.
  * 2016/12/04
    + cleanup change for color pairs in 2016/11/20
    + modify initCDKScreen() to simplify initialization of curses by
    calling initscr() in this function after initializing the locale.
    That fixes a problem using PuTTY with CDK when built using ncurses
    (report by Marc Smith).
  * 2016/11/20
    + fix warnings from cppcheck 1.76.1
    + updated configure macros:
    + CF_CC_ENV_FLAGS don't limit the check to -I, -U and -D options,
    since the added options can include various compiler options before
    and after preprocessor options.
    + CF_GNU_SOURCE recent glibc (Debian 2.23-4 for example) has
    misordered ifdef/checks for new symbol _DEFAULT_SOURCE, producing
    warning messages when only _GNU_SOURCE is defined.  Add a followup
    check to define _DEFAULT_SOURCE.
    + CF_LD_RPATH_OPT change FreeBSD to use -Wl,-rpath rather than -rpath
    option.  According to FreeBSD #178732, either works since FreeBSD
    4.x; however scons does not accept anything except the -Wl,-rpath
    form.
    + CF_PROG_LINT add cpplint to programs to use; drop ad hoc tdlint and
    alint.
    + CF_WITH_NCURSES_ETC add check for ncurses pthreads
    + CF_XOPEN_SOURCE add "uclinux" to list of Linux's and use
    _GNU_SOURCE for cygwin headers, tested with cygwin 2.3, 2.5
    + CF__ADD_SHLIB_RULES improve scripting for ldconfig to avoid warning
    messages if no permissions
    + update config.guess, config.sub
    &gt; patches by Aarian P. Aleahmad:
    + modify encodeAttribute() to allow up to 256 color pairs.
    + corrected assignment in scroller_SetPosition(), to show highlighted
    member.
    + improve the way attributes are applied to Mentry widgets.
    + improve Entry widget by using newwin rather than subwin, as well
    as passing arguments to callback function.
  * 2016/11/19
    + add reRegisterCDKObject()
  * 2016/01/31
    + fix a few of the lintian errors in package/debian
    + fix some too-wide tables in manpages, which caused Debian lintian
    errors.
    + take lower-limit's formatted length into account in slider, etc.,
    (patch by Guido Meusch).
    + make similar repainting-fixes for radio.c and marquee.c
    + fix repainting of Scroll widget when it has no box-outline
    (patch by Manuel Schmitz).
    + add highlight and callbackData members to CDKBUTTON, as well as
    macros for setting/getting the highlight value.  Use the highlight to
    override the default A_REVERSE used in CDK button (patch by Aarian P.
    Aleahmad).
    + fix two bugs in template.c (patch by Aarian P. Aleahmad):
    + in cleanCDKTemplate, fill all of the info string with nulls
    + in setCDKTemplateValue, call cleanCDKTemplate whether or not
    the pointer for newValue passed by the caller was a null.
    + updated configure macros:
    + CF_LIB_PREFIX, CF_WITH_LIBTOOL, and CF_XOPEN_SOURCE, build-fixes
    for OS/2
    + CF_XOPEN_CURSES, improve check, making it define NCURSES_WIDECHAR
    if we happen to be building on a platform (such as OSX) where we do
    not define _XOPEN_SOURCE or _XOPEN_SOURCE_EXTENDED
    + CF_WITH_VERSIONED_SYMS, avoid ncurses build error on ppc64
    architecture the nm tool is reporting _is_missing in Data section
    for ppc64 (by comparison ppc64le is reporting it in Text section)
    + update config.guess, config.sub
  * 2015/09/28
    + build ".deb" test-package with ncurses6, using versioned symbols.
    + updated configure macros:
    + modifications from ncurses/xterm to allow alternate to /bin/sh for
    configure-shell, while dropping support for non-POSIX shell such
    as Solaris.
    + updated/integrated changes for versioned symbols from ncurses6.
    + CF_DISABLE_LIBTOOL_VERSION when using -version-info (the native
    libtool mode), get the ABI_VERSION value from $VERSION (which comes
    from CF_VERSION_INFO)
    + CF_ADD_INCDIR fix an infinite loop when the include-directory to be
    added does not exist (Debian #786436)
    + CF_WITH_NCURSES_ETC add --with-screen option
    + CF_SUBDIR_PATH change this to a loop, adding /usr/pkg (NetBSD) and
    /opt/local (Mac OSX)
    + update config.guess, config.sub
  * 2015/01/03
    + modify cdk-config.in to work with systems where libdir is /usr/lib64
    (patch by Peter Hyman).
    + corrected example for cdk_display.3 manpage (patch by Loïc
    work in non-POSIX locales (report by Mart Stöör).</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551182400">- Update to version 5.0.20190224
  + use HDR_ROOTNAME rather than PACKAGE in top-level makefile, to
    simplify building cdk and cdkw packages with non-conflicting paths.
  + add "check" rule to top-level makefile, for testing Arch Linux
    package.
  + modify test-package for RPMs to work with SUSE and Mageia.
- Enable wide version of libcdk(w)
- Enable ABI soname of the shared libraries
  + Somehow strange ABI 6.2.4 but RELEASE version is still 5.0</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551268800">- Remove debugging code from spec file</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1551787200">- Update to version 5.0.20190303
  + deprecate installCDKLibrary rule by install.libs, which is used in
    the newer shared-library macros.
  + conditionally-comment action lines for the part of install-rules
    which conflict with the newer shared-library rules (report by Tom
    Brownridge).</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620043200">- Update to version 5.0.20210324
  * Spelling fixes, per codespell
  * Updated build system</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1650974400">- Resolve rpmlint report "libcdk5.x86_64: E:
  shlib-policy-name-error SONAME: libcdk.so.6.2.4, expected
  package suffix: 6_2_4"</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1687521600">- Update to version 5.0.20230201
  + improve compiler-warnings in configure-checks.
  + change library dependencies in rpm spec-file.
  + update license in test-packages.
  + relicense as MIT-X11
  + reduce shellcheck warnings in support-scripts
  + updated configure script to work around regression in GNU grep 3.8
  + updated configure macros from xterm and ncurses development
  + update config.guess, config.sub
  + fix cppcheck style-warnings.
  + improve makefile header-dependencies by accounting for all generated
    headers (report/patch by Sergei Trofimovich).
  + updated configure macros from xterm and ncurses development:
    CF_ADD_INCDIR CF_APPEND_CFLAGS CF_DISABLE_ECHO CF_MAKEFLAGS
    CF_NCURSES_CONFIG CF_NCURSES_LIBS CF_PKG_CONFIG CF_REMOVE_CFLAGS
    CF_SHARED_OPTS CF_TRY_XOPEN_SOURCE CF_XOPEN_SOURCE
  + build-fix for HP-UX curses, which provides only part of the ACS_xxx
    definitions compatible with chtype's.
  + correct calls on SetViewSize in scroll.c, overlooked in 2005/04/24
    (report by Brad Hines).
  + updated configure macros from xterm and ncurses development:
    CF_C11_NORETURN CF_CHECK_LIBTOOL_VERSION CF_CONST_X_STRING
    CF_DISABLE_LEAKS CF_FUNC_LSTAT CF_GETOPT_HEADER CF_NCURSES_CONFIG
    CF_NO_LEAKS_OPTION CF_SHARED_OPTS CF_UTF8_LIB CF_XOPEN_CURSES
    CF_XOPEN_SOURCE
  + update config.guess, config.sub
  + updated configure script, for _Noreturn and exit_curses checks.
  + spelling fixes, per codespell.
  + updated configure script, for quoting/escaping fixes
  + update config.guess, config.sub
  + updated configure script, for compiler-warnings
  + update config.guess, config.sub
  + updated configure script, to work around ncurses 6.2 vs xcode's c99
    "-W" option.
  + update config.guess, config.sub
  + fix issues found with check-manpage
  + updated configure macros, from xterm and ncurses development:
    CF_ADD_LIBS CF_GCC_VERSION CF_GCC_WARNINGS CF_PROG_CC CF_PROG_LINT
    CF_X_TOOLKIT
  + update config.guess, config.sub</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1687521601">- Let libcdk6_3_4 conflict with older libcdk6_2_4</changelog>
</package>
<package pkgid="4c43054c7249ab2352f900f773c54eb6013d86ffd7b2467cd2a9ac17bc242b90c5cac1b9d2f884667772bb51e72e3149400a4390c892223e051b6034bfefd23a" name="libclamav12" arch="s390x">
  <version epoch="0" ver="1.5.4" rel="339.1"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1737633600">- Drop the version dependency on libcurl. Building against versions
  older than 7.45 does not fail anymore, but disables support for
  fdpassing in clamonacc. This only affects SLE-12 up to SP3.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1739188800">- bsc#1236949: Fix location of license files.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1742817600">- bsc#1239957: Build with PIE.
- Eliminate some UTF-8 NBSP characters from the changes file.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1748433600">- bsc#1243565: Add clamav-freshclam_test.patch to fix a race
  condition between the mockup servers started by different test
  cases in freshclam_test.py.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1750334400">- New version 1.4.3:
  ClamAV 1.4.3 is a patch release with the following fixes:
  * CVE-2025-20260, bsc#1245054: Fixed a possible buffer overflow
    write bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition or enable remote code
    execution. This issue only affects configurations where both:
  - The max file-size scan limit is set greater than or equal to 1024MB.
  - The max scan-size scan limit is set greater than or equal to 1025MB.
    The code flaw was present prior to version 1.0.0, but a change in
    version 1.0.0 that enables larger allocations based on untrusted data
    made it possible to trigger this bug.
    This issue affects all currently supported versions.
  * CVE-2025-20234, bsc#1245055: Fixed a possible buffer overflow
    read bug in the UDF file parser that may write to a temp file
    and thus disclose information, or it may crash and cause a
    denial-of-service (DoS) condition.
    This issue was introduced in version 1.2.0.
  * Fixed a possible use-after-free bug in the Xz decompression module in
    the bundled lzma-sdk library.
    This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a
    copy of the lzma-sdk with some performance changes specific to
    libclamav, plus select bug fixes like this one in lieu of a full
    upgrade to newer lzma-sdk.
    This issue affects all ClamAV versions at least as far back as 0.99.4.
  * Windows: Fixed a build install issue when a DLL dependency such as
    libcrypto has the exact same name as one provided by the Windows
    operating system.
- Renew clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1751284800">- bsc#1240363, clamav-disable-administrative-commands.patch: clamd:
  Add an option to toggle SHUTDOWN, RELOAD, STATS and VERSION.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1759924800">- New version 1.5.0:
  * Added checks to determine if an OLE2-based Microsoft Office
    document is encrypted.
  * Added the ability to record URIs found in HTML if the
    generate-JSON-metadata feature is enabled.
  * Added the ability to record URIs found in PDFs if the
    generate-JSON-metadata feature is enabled.
  * Added regex support for the clamd.conf OnAccessExcludePath
    config option.
  * Added CVD signing/verification with external .sign files.
  * Freshclam, ClamD, ClamScan, and Sigtool: Added an option to
    enable FIPS-like limits disabling MD5 and SHA1 from being used
    for verifying digital signatures or for being used to trust a
    file when checking for false positives (bsc#1221954).
  * ClamD: Added an option to disable select administrative
    commands including SHUTDOWN, RELOAD, STATS and VERSION.
  * libclamav: Added extended hashing functions with a "flags"
    parameter that allows the caller to choose if they want to
    bypass FIPS hash algorithm limits.
  * See the release announcement for the full list of changes:
    https://blog.clamav.net/2025/10/clamav-150-released.html
- Obsoleted patches:
  * clamav-freshclam_test.patch
  * clamav-disable-administrative-commands.patch
  * clamav-fips.patch
- Use macros for library versions
- Remove service symlinks: rcclamd, rcfreshclam, rcclamav-milter,
  and clamonacc.
- Use rust 1.86 for SLE-12 and SLE-15-SP2.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760443200">- Add json-c-json-c-0.18-20240915.tar.gz and link it statically
  into libclamav on SLE-12, because version 0.12 is too old.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760616000">- New version: 1.5.1:
  * Fixed a significant performance issue when scanning some PE
    files.
  * Fixed an issue recording file entries from a ZIP archive
    central directory which resulted in
    "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
    ClamScan --alert-exceeds-max command line option or ClamD
    AlertExceedsMax config file option.
  * Improved performance when scanning TNEF email attachments.
  * Fixed an issue with recording metadata for OOXML office
    documents.
  * Fixed an issue with signature matches for VBA in OLE2 office
    documents.
  * Loosened overly restrictive rules for embedded file
    identification and increased the limit for finding PE files
    embedded in other PE files.
  * Fixed an issue with extracting some RAR archives embedded in
    other files.
  * Fixed an issue with calculating fuzzy hashes affecting some
    images by updating the version for several Rust library
    dependencies.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1762257600">- Add clamav-workaround.patch to work around symbol removals in
  version 1.5.0 and 1.5.1.</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1763208000">- Build with older rust 1.87 for reproducible builds (boo#1249404)</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1763726400">- Provide a better fix for boo#1249404 by disabling debug mode.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1764331200">- Fix testsuite error on SLE-15-SP6 by falling back to rust1.86.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770724800">- jsc-PED-14819: Support transactional updates.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770984000">- bsc#1258072: Require main and library packages to be of the same
  version and release. Given that all the core functionality is
  in the libraries it makes little sense to update the main
  package alone.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1772712000">- New version 1.5.2:
  * bsc#1259207, CVE-2026-20031: Fixed an error handling bug in the
    HTML file parser that may crash the program and cause a
    denial-of-service (DoS) condition. This issue was introduced in
    version 1.1.0.
  * Fixed a possible infinite loop when scanning some JPEG files by
    upgrading affected ClamAV dependency, a Rust image library.
  * The CVD verification process will now ignore certificate files
    in the CVD certs directory when the user lacks read permissions.
  * Freshclam: Fix CLD verification bug with PrivateMirror option.
  * Upgraded the Rust bytes dependency to a newer version to
    resolve RUSTSEC-2026-0007 advisory.
  * Fixed a possible crash caused by invalid pointer alignment on
    some platforms.
  * Minimal required Rust version is now 1.87.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1773316800">- Disable build for 32 bit ix86 because of testsuite failures with
  rust &gt;= 1.87 that upstream is not planning to fix.
- Run the test suite on all SUSE releases.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1782907200">- update to 1.5.3
  ClamAV 1.5.3 is a patch release with the following fixes:
  * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
  * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
  * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
  * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
  * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
  * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
  * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
  * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
  * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
  * Metadata preclass scans now run before the final scan verdict.
  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1784894400">- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to
  fix path traversal vulnerability in OneNote parser.
- Add clamav-vendor-cve-2026-46671.tar.gz to provide the
  sanitise-file-name Rust crate required by the security fix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1786881600">- update to 1.5.4
  ClamAV 1.5.4 is a patch release with the following fixes:
  * CVE-2026-20337, bsc#1274597:
    Fixed ZIP catalogue capacity tracking that could write beyond a heap
    allocation while indexing local file headers.
  * CVE-2026-20345, bsc#1274600:
    Fixed an indexing error while converting GPT partition names that could
    read or write beyond a stack-allocated partition entry.
  * CVE-2026-20339, bsc#1274599:
    Fixed an integer overflow in the PESpin unpacker that could allocate an
    undersized buffer and then write beyond it while rebuilding a PE file.
  * CVE-2026-20338, bsc#1274598:
    Fixed ownership handling while merging ZIP catalogue records that could
    cause an invalid free while scanning a malformed archive.
  * CVE-2026-20346, bsc#1274601:
    Fixed an integer underflow in the PDF parser that could cause a crash while
    reading a malformed hex string.
  * CVE-2026-20347, bsc#1274602:
    Fixed undefined behavior and integer overflow in the Mach-O parser that
    could cause a crash while scanning a malformed Mach-O file.
  * CVE-2026-20348, bsc#1274603:
    Fixed XAR parser size handling that could request an excessive allocation
    or exceed scan limits while decompressing a malformed table of contents.
  * CVE-2025-8088:
    Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
    The fix rejects path separators in NTFS alternate data stream names to
    prevent extraction outside ClamAV's temporary scan directory on Windows.
  * Fixed thread-safety issues in the clamd STATS command that could disclose
    process memory or crash the daemon while scans and STATS requests run
    concurrently. Also fixed partial socket-write handling used for large STATS
    responses.
  * FreeBSD: Restored support for safe quarantine move and remove actions while
    preserving protection against source-path replacement races.
  * Fixed an OpenSSL library-context leak in legacy hashing helpers when a
    requested message digest cannot be fetched, such as when the default
    provider is unavailable in a FIPS-enabled environment.
  * Upgraded the Rust crossbeam-epoch dependency to resolve the
    RUSTSEC-2026-0204 advisory.</changelog>
</package>
<package pkgid="4593519a188bf9bd075cd92e313b5d150c357f488f09a44e125c9b728e770a97362731c881a04eb5ae9673a3e350255a6b618437ccbd1994146940f30ad52e1a" name="libclamav12-debuginfo" arch="s390x">
  <version epoch="0" ver="1.5.4" rel="339.1"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1737633600">- Drop the version dependency on libcurl. Building against versions
  older than 7.45 does not fail anymore, but disables support for
  fdpassing in clamonacc. This only affects SLE-12 up to SP3.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1739188800">- bsc#1236949: Fix location of license files.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1742817600">- bsc#1239957: Build with PIE.
- Eliminate some UTF-8 NBSP characters from the changes file.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1748433600">- bsc#1243565: Add clamav-freshclam_test.patch to fix a race
  condition between the mockup servers started by different test
  cases in freshclam_test.py.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1750334400">- New version 1.4.3:
  ClamAV 1.4.3 is a patch release with the following fixes:
  * CVE-2025-20260, bsc#1245054: Fixed a possible buffer overflow
    write bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition or enable remote code
    execution. This issue only affects configurations where both:
  - The max file-size scan limit is set greater than or equal to 1024MB.
  - The max scan-size scan limit is set greater than or equal to 1025MB.
    The code flaw was present prior to version 1.0.0, but a change in
    version 1.0.0 that enables larger allocations based on untrusted data
    made it possible to trigger this bug.
    This issue affects all currently supported versions.
  * CVE-2025-20234, bsc#1245055: Fixed a possible buffer overflow
    read bug in the UDF file parser that may write to a temp file
    and thus disclose information, or it may crash and cause a
    denial-of-service (DoS) condition.
    This issue was introduced in version 1.2.0.
  * Fixed a possible use-after-free bug in the Xz decompression module in
    the bundled lzma-sdk library.
    This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a
    copy of the lzma-sdk with some performance changes specific to
    libclamav, plus select bug fixes like this one in lieu of a full
    upgrade to newer lzma-sdk.
    This issue affects all ClamAV versions at least as far back as 0.99.4.
  * Windows: Fixed a build install issue when a DLL dependency such as
    libcrypto has the exact same name as one provided by the Windows
    operating system.
- Renew clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1751284800">- bsc#1240363, clamav-disable-administrative-commands.patch: clamd:
  Add an option to toggle SHUTDOWN, RELOAD, STATS and VERSION.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1759924800">- New version 1.5.0:
  * Added checks to determine if an OLE2-based Microsoft Office
    document is encrypted.
  * Added the ability to record URIs found in HTML if the
    generate-JSON-metadata feature is enabled.
  * Added the ability to record URIs found in PDFs if the
    generate-JSON-metadata feature is enabled.
  * Added regex support for the clamd.conf OnAccessExcludePath
    config option.
  * Added CVD signing/verification with external .sign files.
  * Freshclam, ClamD, ClamScan, and Sigtool: Added an option to
    enable FIPS-like limits disabling MD5 and SHA1 from being used
    for verifying digital signatures or for being used to trust a
    file when checking for false positives (bsc#1221954).
  * ClamD: Added an option to disable select administrative
    commands including SHUTDOWN, RELOAD, STATS and VERSION.
  * libclamav: Added extended hashing functions with a "flags"
    parameter that allows the caller to choose if they want to
    bypass FIPS hash algorithm limits.
  * See the release announcement for the full list of changes:
    https://blog.clamav.net/2025/10/clamav-150-released.html
- Obsoleted patches:
  * clamav-freshclam_test.patch
  * clamav-disable-administrative-commands.patch
  * clamav-fips.patch
- Use macros for library versions
- Remove service symlinks: rcclamd, rcfreshclam, rcclamav-milter,
  and clamonacc.
- Use rust 1.86 for SLE-12 and SLE-15-SP2.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760443200">- Add json-c-json-c-0.18-20240915.tar.gz and link it statically
  into libclamav on SLE-12, because version 0.12 is too old.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760616000">- New version: 1.5.1:
  * Fixed a significant performance issue when scanning some PE
    files.
  * Fixed an issue recording file entries from a ZIP archive
    central directory which resulted in
    "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
    ClamScan --alert-exceeds-max command line option or ClamD
    AlertExceedsMax config file option.
  * Improved performance when scanning TNEF email attachments.
  * Fixed an issue with recording metadata for OOXML office
    documents.
  * Fixed an issue with signature matches for VBA in OLE2 office
    documents.
  * Loosened overly restrictive rules for embedded file
    identification and increased the limit for finding PE files
    embedded in other PE files.
  * Fixed an issue with extracting some RAR archives embedded in
    other files.
  * Fixed an issue with calculating fuzzy hashes affecting some
    images by updating the version for several Rust library
    dependencies.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1762257600">- Add clamav-workaround.patch to work around symbol removals in
  version 1.5.0 and 1.5.1.</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1763208000">- Build with older rust 1.87 for reproducible builds (boo#1249404)</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1763726400">- Provide a better fix for boo#1249404 by disabling debug mode.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1764331200">- Fix testsuite error on SLE-15-SP6 by falling back to rust1.86.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770724800">- jsc-PED-14819: Support transactional updates.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770984000">- bsc#1258072: Require main and library packages to be of the same
  version and release. Given that all the core functionality is
  in the libraries it makes little sense to update the main
  package alone.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1772712000">- New version 1.5.2:
  * bsc#1259207, CVE-2026-20031: Fixed an error handling bug in the
    HTML file parser that may crash the program and cause a
    denial-of-service (DoS) condition. This issue was introduced in
    version 1.1.0.
  * Fixed a possible infinite loop when scanning some JPEG files by
    upgrading affected ClamAV dependency, a Rust image library.
  * The CVD verification process will now ignore certificate files
    in the CVD certs directory when the user lacks read permissions.
  * Freshclam: Fix CLD verification bug with PrivateMirror option.
  * Upgraded the Rust bytes dependency to a newer version to
    resolve RUSTSEC-2026-0007 advisory.
  * Fixed a possible crash caused by invalid pointer alignment on
    some platforms.
  * Minimal required Rust version is now 1.87.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1773316800">- Disable build for 32 bit ix86 because of testsuite failures with
  rust &gt;= 1.87 that upstream is not planning to fix.
- Run the test suite on all SUSE releases.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1782907200">- update to 1.5.3
  ClamAV 1.5.3 is a patch release with the following fixes:
  * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
  * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
  * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
  * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
  * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
  * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
  * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
  * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
  * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
  * Metadata preclass scans now run before the final scan verdict.
  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1784894400">- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to
  fix path traversal vulnerability in OneNote parser.
- Add clamav-vendor-cve-2026-46671.tar.gz to provide the
  sanitise-file-name Rust crate required by the security fix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1786881600">- update to 1.5.4
  ClamAV 1.5.4 is a patch release with the following fixes:
  * CVE-2026-20337, bsc#1274597:
    Fixed ZIP catalogue capacity tracking that could write beyond a heap
    allocation while indexing local file headers.
  * CVE-2026-20345, bsc#1274600:
    Fixed an indexing error while converting GPT partition names that could
    read or write beyond a stack-allocated partition entry.
  * CVE-2026-20339, bsc#1274599:
    Fixed an integer overflow in the PESpin unpacker that could allocate an
    undersized buffer and then write beyond it while rebuilding a PE file.
  * CVE-2026-20338, bsc#1274598:
    Fixed ownership handling while merging ZIP catalogue records that could
    cause an invalid free while scanning a malformed archive.
  * CVE-2026-20346, bsc#1274601:
    Fixed an integer underflow in the PDF parser that could cause a crash while
    reading a malformed hex string.
  * CVE-2026-20347, bsc#1274602:
    Fixed undefined behavior and integer overflow in the Mach-O parser that
    could cause a crash while scanning a malformed Mach-O file.
  * CVE-2026-20348, bsc#1274603:
    Fixed XAR parser size handling that could request an excessive allocation
    or exceed scan limits while decompressing a malformed table of contents.
  * CVE-2025-8088:
    Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
    The fix rejects path separators in NTFS alternate data stream names to
    prevent extraction outside ClamAV's temporary scan directory on Windows.
  * Fixed thread-safety issues in the clamd STATS command that could disclose
    process memory or crash the daemon while scans and STATS requests run
    concurrently. Also fixed partial socket-write handling used for large STATS
    responses.
  * FreeBSD: Restored support for safe quarantine move and remove actions while
    preserving protection against source-path replacement races.
  * Fixed an OpenSSL library-context leak in legacy hashing helpers when a
    requested message digest cannot be fetched, such as when the default
    provider is unavailable in a FIPS-enabled environment.
  * Upgraded the Rust crossbeam-epoch dependency to resolve the
    RUSTSEC-2026-0204 advisory.</changelog>
</package>
<package pkgid="8c9d864cda82d2ff375f35511ad5f245f59b67078e44b7e5151e80b7df20d996e72c988cb5b027dc6ad857658542b603cf2b35031589c0a632cf267e3f15ce66" name="libclamav9" arch="s390x">
  <version epoch="0" ver="0.103.11" rel="5.5"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612612800">- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612872000">- Don't daemonize freshclam, but use a systemd timer instead to
  trigger updates
  + timer.freshclam
  % service.freshclam
  % clamav-conf.patch
- Remove obsolete patch (replaced by SOURCE_DATE_EPOCH)
  - clamav-disable-timestamps.patch
- Fix unit test
  + clamav-ck_assert_msg.patch
- Cleanup spec
  * use pkgconfig() to resolve BuildRequires where upstream uses it
  * rework creating vscan user (new system-user in Tumbleweed)
  * remove obsolete configure option --disable-zlib-vcheck</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1614254400">- Package clamav-milter in a subpackage
- Remove virus signatures upon uninstall
- Check for database existence before starting clamd
- Restart clamd when it exits</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1617796800">- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
- Update package signing key (from https://www.clamav.net/downloads)
  % clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1617969600">- Use a split-provides for clamav-milter instead of recommending it.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1635940800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1641988800">- Update to 0.103.5
  * CVE-2022-20698: Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https source urls</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1651752000">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1659700800">- Update to 0.103.7
  - Zip parser: tolerate 2-byte overlap in file entries
  - Fix bug with logical signature Intermediates feature
  - Update to UnRAR v6.1.7
  - Patch UnRAR: allow skipping files in solid archives
  - Patch UnRAR: limit dict winsize to 1GB</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1676462400">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.
- Package huge .html documentation in a separate subpackage.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1692187200">- Update to 0.103.9
  * CVE-2023-20197: Fixed a possible denial of service vulnerability in
    the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through
    1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8
    through 0.103.0. (boo#1214342)
  * Fixed compiler warnings that may turn into errors in Clang 16.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1692360000">- Renew clamav.keyring .</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1698235200">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1711368000">- Rename the package to clamav0 to make way for the 1.x package.</changelog>
</package>
<package pkgid="f272e994fb65991b88a6c71a5bf3b38cfe4d63941d68396ba527305f540a326eb2fc0f0671a50654cd668aa6c0c87e9c7821b9c9ea21ede54ec5eadac7c14120" name="libclamav9-debuginfo" arch="s390x">
  <version epoch="0" ver="0.103.11" rel="5.5"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612612800">- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612872000">- Don't daemonize freshclam, but use a systemd timer instead to
  trigger updates
  + timer.freshclam
  % service.freshclam
  % clamav-conf.patch
- Remove obsolete patch (replaced by SOURCE_DATE_EPOCH)
  - clamav-disable-timestamps.patch
- Fix unit test
  + clamav-ck_assert_msg.patch
- Cleanup spec
  * use pkgconfig() to resolve BuildRequires where upstream uses it
  * rework creating vscan user (new system-user in Tumbleweed)
  * remove obsolete configure option --disable-zlib-vcheck</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1614254400">- Package clamav-milter in a subpackage
- Remove virus signatures upon uninstall
- Check for database existence before starting clamd
- Restart clamd when it exits</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1617796800">- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
- Update package signing key (from https://www.clamav.net/downloads)
  % clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1617969600">- Use a split-provides for clamav-milter instead of recommending it.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1635940800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1641988800">- Update to 0.103.5
  * CVE-2022-20698: Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https source urls</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1651752000">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1659700800">- Update to 0.103.7
  - Zip parser: tolerate 2-byte overlap in file entries
  - Fix bug with logical signature Intermediates feature
  - Update to UnRAR v6.1.7
  - Patch UnRAR: allow skipping files in solid archives
  - Patch UnRAR: limit dict winsize to 1GB</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1676462400">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.
- Package huge .html documentation in a separate subpackage.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1692187200">- Update to 0.103.9
  * CVE-2023-20197: Fixed a possible denial of service vulnerability in
    the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through
    1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8
    through 0.103.0. (boo#1214342)
  * Fixed compiler warnings that may turn into errors in Clang 16.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1692360000">- Renew clamav.keyring .</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1698235200">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1711368000">- Rename the package to clamav0 to make way for the 1.x package.</changelog>
</package>
<package pkgid="ba72fe3888a27cdaef2c80e1fc00c2d5dc8b8833a910adf411d7b257569a728b9e37ab532b30a4584efc3fa4b5ba6f23cf4b4f8dd4a61e1a71c5da47e6c7f81c" name="libclammspack0" arch="s390x">
  <version epoch="0" ver="1.5.4" rel="339.1"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1737633600">- Drop the version dependency on libcurl. Building against versions
  older than 7.45 does not fail anymore, but disables support for
  fdpassing in clamonacc. This only affects SLE-12 up to SP3.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1739188800">- bsc#1236949: Fix location of license files.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1742817600">- bsc#1239957: Build with PIE.
- Eliminate some UTF-8 NBSP characters from the changes file.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1748433600">- bsc#1243565: Add clamav-freshclam_test.patch to fix a race
  condition between the mockup servers started by different test
  cases in freshclam_test.py.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1750334400">- New version 1.4.3:
  ClamAV 1.4.3 is a patch release with the following fixes:
  * CVE-2025-20260, bsc#1245054: Fixed a possible buffer overflow
    write bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition or enable remote code
    execution. This issue only affects configurations where both:
  - The max file-size scan limit is set greater than or equal to 1024MB.
  - The max scan-size scan limit is set greater than or equal to 1025MB.
    The code flaw was present prior to version 1.0.0, but a change in
    version 1.0.0 that enables larger allocations based on untrusted data
    made it possible to trigger this bug.
    This issue affects all currently supported versions.
  * CVE-2025-20234, bsc#1245055: Fixed a possible buffer overflow
    read bug in the UDF file parser that may write to a temp file
    and thus disclose information, or it may crash and cause a
    denial-of-service (DoS) condition.
    This issue was introduced in version 1.2.0.
  * Fixed a possible use-after-free bug in the Xz decompression module in
    the bundled lzma-sdk library.
    This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a
    copy of the lzma-sdk with some performance changes specific to
    libclamav, plus select bug fixes like this one in lieu of a full
    upgrade to newer lzma-sdk.
    This issue affects all ClamAV versions at least as far back as 0.99.4.
  * Windows: Fixed a build install issue when a DLL dependency such as
    libcrypto has the exact same name as one provided by the Windows
    operating system.
- Renew clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1751284800">- bsc#1240363, clamav-disable-administrative-commands.patch: clamd:
  Add an option to toggle SHUTDOWN, RELOAD, STATS and VERSION.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1759924800">- New version 1.5.0:
  * Added checks to determine if an OLE2-based Microsoft Office
    document is encrypted.
  * Added the ability to record URIs found in HTML if the
    generate-JSON-metadata feature is enabled.
  * Added the ability to record URIs found in PDFs if the
    generate-JSON-metadata feature is enabled.
  * Added regex support for the clamd.conf OnAccessExcludePath
    config option.
  * Added CVD signing/verification with external .sign files.
  * Freshclam, ClamD, ClamScan, and Sigtool: Added an option to
    enable FIPS-like limits disabling MD5 and SHA1 from being used
    for verifying digital signatures or for being used to trust a
    file when checking for false positives (bsc#1221954).
  * ClamD: Added an option to disable select administrative
    commands including SHUTDOWN, RELOAD, STATS and VERSION.
  * libclamav: Added extended hashing functions with a "flags"
    parameter that allows the caller to choose if they want to
    bypass FIPS hash algorithm limits.
  * See the release announcement for the full list of changes:
    https://blog.clamav.net/2025/10/clamav-150-released.html
- Obsoleted patches:
  * clamav-freshclam_test.patch
  * clamav-disable-administrative-commands.patch
  * clamav-fips.patch
- Use macros for library versions
- Remove service symlinks: rcclamd, rcfreshclam, rcclamav-milter,
  and clamonacc.
- Use rust 1.86 for SLE-12 and SLE-15-SP2.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760443200">- Add json-c-json-c-0.18-20240915.tar.gz and link it statically
  into libclamav on SLE-12, because version 0.12 is too old.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760616000">- New version: 1.5.1:
  * Fixed a significant performance issue when scanning some PE
    files.
  * Fixed an issue recording file entries from a ZIP archive
    central directory which resulted in
    "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
    ClamScan --alert-exceeds-max command line option or ClamD
    AlertExceedsMax config file option.
  * Improved performance when scanning TNEF email attachments.
  * Fixed an issue with recording metadata for OOXML office
    documents.
  * Fixed an issue with signature matches for VBA in OLE2 office
    documents.
  * Loosened overly restrictive rules for embedded file
    identification and increased the limit for finding PE files
    embedded in other PE files.
  * Fixed an issue with extracting some RAR archives embedded in
    other files.
  * Fixed an issue with calculating fuzzy hashes affecting some
    images by updating the version for several Rust library
    dependencies.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1762257600">- Add clamav-workaround.patch to work around symbol removals in
  version 1.5.0 and 1.5.1.</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1763208000">- Build with older rust 1.87 for reproducible builds (boo#1249404)</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1763726400">- Provide a better fix for boo#1249404 by disabling debug mode.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1764331200">- Fix testsuite error on SLE-15-SP6 by falling back to rust1.86.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770724800">- jsc-PED-14819: Support transactional updates.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770984000">- bsc#1258072: Require main and library packages to be of the same
  version and release. Given that all the core functionality is
  in the libraries it makes little sense to update the main
  package alone.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1772712000">- New version 1.5.2:
  * bsc#1259207, CVE-2026-20031: Fixed an error handling bug in the
    HTML file parser that may crash the program and cause a
    denial-of-service (DoS) condition. This issue was introduced in
    version 1.1.0.
  * Fixed a possible infinite loop when scanning some JPEG files by
    upgrading affected ClamAV dependency, a Rust image library.
  * The CVD verification process will now ignore certificate files
    in the CVD certs directory when the user lacks read permissions.
  * Freshclam: Fix CLD verification bug with PrivateMirror option.
  * Upgraded the Rust bytes dependency to a newer version to
    resolve RUSTSEC-2026-0007 advisory.
  * Fixed a possible crash caused by invalid pointer alignment on
    some platforms.
  * Minimal required Rust version is now 1.87.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1773316800">- Disable build for 32 bit ix86 because of testsuite failures with
  rust &gt;= 1.87 that upstream is not planning to fix.
- Run the test suite on all SUSE releases.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1782907200">- update to 1.5.3
  ClamAV 1.5.3 is a patch release with the following fixes:
  * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
  * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
  * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
  * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
  * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
  * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
  * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
  * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
  * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
  * Metadata preclass scans now run before the final scan verdict.
  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1784894400">- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to
  fix path traversal vulnerability in OneNote parser.
- Add clamav-vendor-cve-2026-46671.tar.gz to provide the
  sanitise-file-name Rust crate required by the security fix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1786881600">- update to 1.5.4
  ClamAV 1.5.4 is a patch release with the following fixes:
  * CVE-2026-20337, bsc#1274597:
    Fixed ZIP catalogue capacity tracking that could write beyond a heap
    allocation while indexing local file headers.
  * CVE-2026-20345, bsc#1274600:
    Fixed an indexing error while converting GPT partition names that could
    read or write beyond a stack-allocated partition entry.
  * CVE-2026-20339, bsc#1274599:
    Fixed an integer overflow in the PESpin unpacker that could allocate an
    undersized buffer and then write beyond it while rebuilding a PE file.
  * CVE-2026-20338, bsc#1274598:
    Fixed ownership handling while merging ZIP catalogue records that could
    cause an invalid free while scanning a malformed archive.
  * CVE-2026-20346, bsc#1274601:
    Fixed an integer underflow in the PDF parser that could cause a crash while
    reading a malformed hex string.
  * CVE-2026-20347, bsc#1274602:
    Fixed undefined behavior and integer overflow in the Mach-O parser that
    could cause a crash while scanning a malformed Mach-O file.
  * CVE-2026-20348, bsc#1274603:
    Fixed XAR parser size handling that could request an excessive allocation
    or exceed scan limits while decompressing a malformed table of contents.
  * CVE-2025-8088:
    Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
    The fix rejects path separators in NTFS alternate data stream names to
    prevent extraction outside ClamAV's temporary scan directory on Windows.
  * Fixed thread-safety issues in the clamd STATS command that could disclose
    process memory or crash the daemon while scans and STATS requests run
    concurrently. Also fixed partial socket-write handling used for large STATS
    responses.
  * FreeBSD: Restored support for safe quarantine move and remove actions while
    preserving protection against source-path replacement races.
  * Fixed an OpenSSL library-context leak in legacy hashing helpers when a
    requested message digest cannot be fetched, such as when the default
    provider is unavailable in a FIPS-enabled environment.
  * Upgraded the Rust crossbeam-epoch dependency to resolve the
    RUSTSEC-2026-0204 advisory.</changelog>
</package>
<package pkgid="a3a67c49329668ebcbab723f1f73d4fed4815d75f88c4049722d41f6d14534714f885d3911737a5bf6c0c396b552fb02db6c2780a65d4c52eac482072e62aa63" name="libclammspack0-debuginfo" arch="s390x">
  <version epoch="0" ver="1.5.4" rel="339.1"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1737633600">- Drop the version dependency on libcurl. Building against versions
  older than 7.45 does not fail anymore, but disables support for
  fdpassing in clamonacc. This only affects SLE-12 up to SP3.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1739188800">- bsc#1236949: Fix location of license files.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1742817600">- bsc#1239957: Build with PIE.
- Eliminate some UTF-8 NBSP characters from the changes file.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1748433600">- bsc#1243565: Add clamav-freshclam_test.patch to fix a race
  condition between the mockup servers started by different test
  cases in freshclam_test.py.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1750334400">- New version 1.4.3:
  ClamAV 1.4.3 is a patch release with the following fixes:
  * CVE-2025-20260, bsc#1245054: Fixed a possible buffer overflow
    write bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition or enable remote code
    execution. This issue only affects configurations where both:
  - The max file-size scan limit is set greater than or equal to 1024MB.
  - The max scan-size scan limit is set greater than or equal to 1025MB.
    The code flaw was present prior to version 1.0.0, but a change in
    version 1.0.0 that enables larger allocations based on untrusted data
    made it possible to trigger this bug.
    This issue affects all currently supported versions.
  * CVE-2025-20234, bsc#1245055: Fixed a possible buffer overflow
    read bug in the UDF file parser that may write to a temp file
    and thus disclose information, or it may crash and cause a
    denial-of-service (DoS) condition.
    This issue was introduced in version 1.2.0.
  * Fixed a possible use-after-free bug in the Xz decompression module in
    the bundled lzma-sdk library.
    This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a
    copy of the lzma-sdk with some performance changes specific to
    libclamav, plus select bug fixes like this one in lieu of a full
    upgrade to newer lzma-sdk.
    This issue affects all ClamAV versions at least as far back as 0.99.4.
  * Windows: Fixed a build install issue when a DLL dependency such as
    libcrypto has the exact same name as one provided by the Windows
    operating system.
- Renew clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1751284800">- bsc#1240363, clamav-disable-administrative-commands.patch: clamd:
  Add an option to toggle SHUTDOWN, RELOAD, STATS and VERSION.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1759924800">- New version 1.5.0:
  * Added checks to determine if an OLE2-based Microsoft Office
    document is encrypted.
  * Added the ability to record URIs found in HTML if the
    generate-JSON-metadata feature is enabled.
  * Added the ability to record URIs found in PDFs if the
    generate-JSON-metadata feature is enabled.
  * Added regex support for the clamd.conf OnAccessExcludePath
    config option.
  * Added CVD signing/verification with external .sign files.
  * Freshclam, ClamD, ClamScan, and Sigtool: Added an option to
    enable FIPS-like limits disabling MD5 and SHA1 from being used
    for verifying digital signatures or for being used to trust a
    file when checking for false positives (bsc#1221954).
  * ClamD: Added an option to disable select administrative
    commands including SHUTDOWN, RELOAD, STATS and VERSION.
  * libclamav: Added extended hashing functions with a "flags"
    parameter that allows the caller to choose if they want to
    bypass FIPS hash algorithm limits.
  * See the release announcement for the full list of changes:
    https://blog.clamav.net/2025/10/clamav-150-released.html
- Obsoleted patches:
  * clamav-freshclam_test.patch
  * clamav-disable-administrative-commands.patch
  * clamav-fips.patch
- Use macros for library versions
- Remove service symlinks: rcclamd, rcfreshclam, rcclamav-milter,
  and clamonacc.
- Use rust 1.86 for SLE-12 and SLE-15-SP2.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760443200">- Add json-c-json-c-0.18-20240915.tar.gz and link it statically
  into libclamav on SLE-12, because version 0.12 is too old.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760616000">- New version: 1.5.1:
  * Fixed a significant performance issue when scanning some PE
    files.
  * Fixed an issue recording file entries from a ZIP archive
    central directory which resulted in
    "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
    ClamScan --alert-exceeds-max command line option or ClamD
    AlertExceedsMax config file option.
  * Improved performance when scanning TNEF email attachments.
  * Fixed an issue with recording metadata for OOXML office
    documents.
  * Fixed an issue with signature matches for VBA in OLE2 office
    documents.
  * Loosened overly restrictive rules for embedded file
    identification and increased the limit for finding PE files
    embedded in other PE files.
  * Fixed an issue with extracting some RAR archives embedded in
    other files.
  * Fixed an issue with calculating fuzzy hashes affecting some
    images by updating the version for several Rust library
    dependencies.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1762257600">- Add clamav-workaround.patch to work around symbol removals in
  version 1.5.0 and 1.5.1.</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1763208000">- Build with older rust 1.87 for reproducible builds (boo#1249404)</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1763726400">- Provide a better fix for boo#1249404 by disabling debug mode.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1764331200">- Fix testsuite error on SLE-15-SP6 by falling back to rust1.86.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770724800">- jsc-PED-14819: Support transactional updates.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770984000">- bsc#1258072: Require main and library packages to be of the same
  version and release. Given that all the core functionality is
  in the libraries it makes little sense to update the main
  package alone.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1772712000">- New version 1.5.2:
  * bsc#1259207, CVE-2026-20031: Fixed an error handling bug in the
    HTML file parser that may crash the program and cause a
    denial-of-service (DoS) condition. This issue was introduced in
    version 1.1.0.
  * Fixed a possible infinite loop when scanning some JPEG files by
    upgrading affected ClamAV dependency, a Rust image library.
  * The CVD verification process will now ignore certificate files
    in the CVD certs directory when the user lacks read permissions.
  * Freshclam: Fix CLD verification bug with PrivateMirror option.
  * Upgraded the Rust bytes dependency to a newer version to
    resolve RUSTSEC-2026-0007 advisory.
  * Fixed a possible crash caused by invalid pointer alignment on
    some platforms.
  * Minimal required Rust version is now 1.87.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1773316800">- Disable build for 32 bit ix86 because of testsuite failures with
  rust &gt;= 1.87 that upstream is not planning to fix.
- Run the test suite on all SUSE releases.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1782907200">- update to 1.5.3
  ClamAV 1.5.3 is a patch release with the following fixes:
  * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
  * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
  * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
  * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
  * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
  * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
  * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
  * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
  * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
  * Metadata preclass scans now run before the final scan verdict.
  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1784894400">- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to
  fix path traversal vulnerability in OneNote parser.
- Add clamav-vendor-cve-2026-46671.tar.gz to provide the
  sanitise-file-name Rust crate required by the security fix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1786881600">- update to 1.5.4
  ClamAV 1.5.4 is a patch release with the following fixes:
  * CVE-2026-20337, bsc#1274597:
    Fixed ZIP catalogue capacity tracking that could write beyond a heap
    allocation while indexing local file headers.
  * CVE-2026-20345, bsc#1274600:
    Fixed an indexing error while converting GPT partition names that could
    read or write beyond a stack-allocated partition entry.
  * CVE-2026-20339, bsc#1274599:
    Fixed an integer overflow in the PESpin unpacker that could allocate an
    undersized buffer and then write beyond it while rebuilding a PE file.
  * CVE-2026-20338, bsc#1274598:
    Fixed ownership handling while merging ZIP catalogue records that could
    cause an invalid free while scanning a malformed archive.
  * CVE-2026-20346, bsc#1274601:
    Fixed an integer underflow in the PDF parser that could cause a crash while
    reading a malformed hex string.
  * CVE-2026-20347, bsc#1274602:
    Fixed undefined behavior and integer overflow in the Mach-O parser that
    could cause a crash while scanning a malformed Mach-O file.
  * CVE-2026-20348, bsc#1274603:
    Fixed XAR parser size handling that could request an excessive allocation
    or exceed scan limits while decompressing a malformed table of contents.
  * CVE-2025-8088:
    Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
    The fix rejects path separators in NTFS alternate data stream names to
    prevent extraction outside ClamAV's temporary scan directory on Windows.
  * Fixed thread-safety issues in the clamd STATS command that could disclose
    process memory or crash the daemon while scans and STATS requests run
    concurrently. Also fixed partial socket-write handling used for large STATS
    responses.
  * FreeBSD: Restored support for safe quarantine move and remove actions while
    preserving protection against source-path replacement races.
  * Fixed an OpenSSL library-context leak in legacy hashing helpers when a
    requested message digest cannot be fetched, such as when the default
    provider is unavailable in a FIPS-enabled environment.
  * Upgraded the Rust crossbeam-epoch dependency to resolve the
    RUSTSEC-2026-0204 advisory.</changelog>
</package>
<package pkgid="7134d9255a98bdfdcd0468654638a7e69147edb72d3d249b88461f604f97e49035e60828d9a2d67de626ff27bb36cd019c2aaa1ac134e9ebaf6e37a1079aabeb" name="libdrop_ambient-devel" arch="s390x">
  <version epoch="0" ver="0.8.5" rel="54.22"/>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to version 0.7.9:
  * Detect and output a couple errors in filecap
  * Use pthread_atfork to optionally reset the pid and related info
    on fork
- cleanup with spec-cleaner
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1518955201">- Remove ineffective --with-pic. Fix SRPM group. Redo descriptions.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Move %doc to %license for licenses</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1565265600">- Own %{_datadir}/aclocal: when we might switch to pkgconf instead
  of pkg-config, nothing in the build root is 'accidentally' owning
  this directory for us.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1589284800">- Update to 0.7.10:
  * Update capng_change_id man page
  * Add capng_have_permitted_capabilities function
  * Update filecap to output which set the capabilities are in
  * Fix filecap to not output an error when a file has no capabilities
  * Add udplite support to netcap
  * Fix usage of pthread_atfork (Joe Orton)
  * Mark processes in child user namespaces with * (Danila Kiver)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to 0.7.11
  * Really clear bounding set if asked in capng_change_id
  * Add CAP_PERFMON, CAP_BPF, &amp; CAP_CHECKPOINT_RESTORE
  * Avoid malloc/free in capng_apply (Natanael Copa)
  * If procfs is not available, get bounding set via prctl
- Removed unneeded rules from rpmlintrc</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1652097600">- Update to 0.8.3:
  * Add vararg support to python bindings for capng_updatev
  * Add support for ambient capabilities
  * Add support for V3 filesystem capabilities
  * If procfs is not available, leave last_cap as CAP_LAST_CAP
  * If bounding and ambient not found in status, try prctl method
  * In capng_apply, move ambient caps to the end of the transaction
  * In capng_apply, return errors more aggressively.
  * In capng_apply, if the action includes the bounding set,resync with the kernel
  * Fix signed/unsigned warning in cap-ng.c
  * In capng_apply, return a unique error code to diagnose any failure
  * In capng_have_capability, return 0 for failure
  * Add the libdrop_ambient admin tool
  * In capng_apply, if we blew up in bounding set, allow setting capabilities
  * If PR_CAP_AMBIENT is not available, do not build libdrop_ambient
  * Improve last_cap check
  * Fix parameters to capng_updatev python bindings to be signed
  * Detect capability options at runtime to make containerization easier (ntkme)
  * Initialize the library when linked statically
  * Add gcc function attributes for deallocation</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1704196800">- Update to version 0.8.4
  * In capng_change_id, clear PR_SET_KEEPCAPS if returning an error
  * pscap: add -p option for reporting a specified process
  * Annotate function prototypes to warn if results are unused
  * Drop python2 support</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716206400">- Update to version 0.8.5:
  * Remove python global exception handler since it's deprecated
  * Make the utilities link against just built libraries
  * Remove unused macro in cap-ng.h
- Remove libcap-ng.rpmlintrc, it doesn't seem to be used any more.</changelog>
</package>
<package pkgid="c0979036f35d56eff10e57535922476041cdc153afe333052fe188944ab5f9c9407dd065dcb86689a351ad42b9fc355fc400dd76b430b5f84a9f4821d65c8acb" name="libdrop_ambient0" arch="s390x">
  <version epoch="0" ver="0.8.5" rel="54.22"/>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to version 0.7.9:
  * Detect and output a couple errors in filecap
  * Use pthread_atfork to optionally reset the pid and related info
    on fork
- cleanup with spec-cleaner
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1518955201">- Remove ineffective --with-pic. Fix SRPM group. Redo descriptions.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Move %doc to %license for licenses</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1565265600">- Own %{_datadir}/aclocal: when we might switch to pkgconf instead
  of pkg-config, nothing in the build root is 'accidentally' owning
  this directory for us.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1589284800">- Update to 0.7.10:
  * Update capng_change_id man page
  * Add capng_have_permitted_capabilities function
  * Update filecap to output which set the capabilities are in
  * Fix filecap to not output an error when a file has no capabilities
  * Add udplite support to netcap
  * Fix usage of pthread_atfork (Joe Orton)
  * Mark processes in child user namespaces with * (Danila Kiver)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to 0.7.11
  * Really clear bounding set if asked in capng_change_id
  * Add CAP_PERFMON, CAP_BPF, &amp; CAP_CHECKPOINT_RESTORE
  * Avoid malloc/free in capng_apply (Natanael Copa)
  * If procfs is not available, get bounding set via prctl
- Removed unneeded rules from rpmlintrc</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1652097600">- Update to 0.8.3:
  * Add vararg support to python bindings for capng_updatev
  * Add support for ambient capabilities
  * Add support for V3 filesystem capabilities
  * If procfs is not available, leave last_cap as CAP_LAST_CAP
  * If bounding and ambient not found in status, try prctl method
  * In capng_apply, move ambient caps to the end of the transaction
  * In capng_apply, return errors more aggressively.
  * In capng_apply, if the action includes the bounding set,resync with the kernel
  * Fix signed/unsigned warning in cap-ng.c
  * In capng_apply, return a unique error code to diagnose any failure
  * In capng_have_capability, return 0 for failure
  * Add the libdrop_ambient admin tool
  * In capng_apply, if we blew up in bounding set, allow setting capabilities
  * If PR_CAP_AMBIENT is not available, do not build libdrop_ambient
  * Improve last_cap check
  * Fix parameters to capng_updatev python bindings to be signed
  * Detect capability options at runtime to make containerization easier (ntkme)
  * Initialize the library when linked statically
  * Add gcc function attributes for deallocation</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1704196800">- Update to version 0.8.4
  * In capng_change_id, clear PR_SET_KEEPCAPS if returning an error
  * pscap: add -p option for reporting a specified process
  * Annotate function prototypes to warn if results are unused
  * Drop python2 support</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716206400">- Update to version 0.8.5:
  * Remove python global exception handler since it's deprecated
  * Make the utilities link against just built libraries
  * Remove unused macro in cap-ng.h
- Remove libcap-ng.rpmlintrc, it doesn't seem to be used any more.</changelog>
</package>
<package pkgid="515778f00e89333ef4714532d9b8d73894e06b9aa62c449e177d6dfa5d53af091be398168f70ffc6f2642093b1f0ac7b631f2b40896bfc7b3d9cc6a58f7807c6" name="libdrop_ambient0-debuginfo" arch="s390x">
  <version epoch="0" ver="0.8.5" rel="54.22"/>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to version 0.7.9:
  * Detect and output a couple errors in filecap
  * Use pthread_atfork to optionally reset the pid and related info
    on fork
- cleanup with spec-cleaner
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1518955201">- Remove ineffective --with-pic. Fix SRPM group. Redo descriptions.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Move %doc to %license for licenses</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1565265600">- Own %{_datadir}/aclocal: when we might switch to pkgconf instead
  of pkg-config, nothing in the build root is 'accidentally' owning
  this directory for us.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1589284800">- Update to 0.7.10:
  * Update capng_change_id man page
  * Add capng_have_permitted_capabilities function
  * Update filecap to output which set the capabilities are in
  * Fix filecap to not output an error when a file has no capabilities
  * Add udplite support to netcap
  * Fix usage of pthread_atfork (Joe Orton)
  * Mark processes in child user namespaces with * (Danila Kiver)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to 0.7.11
  * Really clear bounding set if asked in capng_change_id
  * Add CAP_PERFMON, CAP_BPF, &amp; CAP_CHECKPOINT_RESTORE
  * Avoid malloc/free in capng_apply (Natanael Copa)
  * If procfs is not available, get bounding set via prctl
- Removed unneeded rules from rpmlintrc</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1652097600">- Update to 0.8.3:
  * Add vararg support to python bindings for capng_updatev
  * Add support for ambient capabilities
  * Add support for V3 filesystem capabilities
  * If procfs is not available, leave last_cap as CAP_LAST_CAP
  * If bounding and ambient not found in status, try prctl method
  * In capng_apply, move ambient caps to the end of the transaction
  * In capng_apply, return errors more aggressively.
  * In capng_apply, if the action includes the bounding set,resync with the kernel
  * Fix signed/unsigned warning in cap-ng.c
  * In capng_apply, return a unique error code to diagnose any failure
  * In capng_have_capability, return 0 for failure
  * Add the libdrop_ambient admin tool
  * In capng_apply, if we blew up in bounding set, allow setting capabilities
  * If PR_CAP_AMBIENT is not available, do not build libdrop_ambient
  * Improve last_cap check
  * Fix parameters to capng_updatev python bindings to be signed
  * Detect capability options at runtime to make containerization easier (ntkme)
  * Initialize the library when linked statically
  * Add gcc function attributes for deallocation</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1704196800">- Update to version 0.8.4
  * In capng_change_id, clear PR_SET_KEEPCAPS if returning an error
  * pscap: add -p option for reporting a specified process
  * Annotate function prototypes to warn if results are unused
  * Drop python2 support</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716206400">- Update to version 0.8.5:
  * Remove python global exception handler since it's deprecated
  * Make the utilities link against just built libraries
  * Remove unused macro in cap-ng.h
- Remove libcap-ng.rpmlintrc, it doesn't seem to be used any more.</changelog>
</package>
<package pkgid="750f671ca2df11d86effda71c119917d576efc6c30f381c9f0886f989b2a09218bb1ec914d4c3be03f7eccccebedde66d53dcd121b7b83ad68912eea6f95ecd9" name="libduo3" arch="s390x">
  <version epoch="0" ver="2.2.1" rel="1.13"/>
  <changelog author="plinnell@opensuse.org" date="1464955200">- Update to 1-9-18
  * Package cleanups and remove rpmlint warnings - still
  needs security review
- duo_unix-1.9.18:
  +Added HTTP proxy connection error handling
  +Improved compatibility with Solaris and AIX
- duo_unix-1.9.17:
  + Fixed PAM return code issue
- duo_unix-1.9.16:
  +Test fixes
  +Compilation fixes
- duo_unix-1.9.15:
  +SELinux policy module package support
  +PAM module improvements
  +Removed deprecated SHA1 Entrust CA
- duo_unix-1.9.14:
  +Added SELinux policy module
  +Improve poll(2) error handling</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1627041600">- Update to 1.11.4, detailed below.
- Fix paths in duo_unix_support tool.
- Fix RPM group for devel pkg.
- Deal with statically-linked libduo (see 1.9.20 changes).
  - should we patch the build to force dynamic linking?
  duo_unix-1.11.4:
- Added support tool to collect information (e.g. logs and PAM stacks) for debugging purposes
  duo_unix-1.11.3:
- Improved validation of BSON messages
  duo_unix-1.11.2:
- Added recommended Kerberos configuration for Duo Unix to our documentation, found at https://help.duo.com/s/article/5085. Thanks to Neal Poole at Facebook for bringing expertise and attention to this topic.
- Updated SELinux policy to allow local logins to use the pam_duo PAM module and made sshd configurable
- Added support for spaces in group names when escaped with backslashes in pam_duo.conf and login_duo.conf
- Test infrastructure updates
  duo_unix-1.11.1:
- Fixed bug causing console login to fail on certain systems
  duo_unix-1.11.0:
- Added support for GECOS field parsing based on user-supplied delimiter
- Updated README to include development/testing steps
- Minor test infrastructure updates
  duo_unix-1.10.5:
- Fixed an accidental null pointer free on systems where getaddrinfo() is unsuccessful
  duo_unix-1.10.4:
- Removed failmode decision from auth endpoint and moved it to only preauth according to standards in our other integrations
- Updated Duo Unix to speak up to TLS 1.2
- Support for LibreSSL 2.7.0 and up
- Minor memory leak fixes
- Output message when user is locked out
  duo_unix-1.10.3:
- Added support for http_proxy with SELinux enabled
  duo_unix-1.10.2:
- Added default failmode values in config files
  duo_unix-1.10.1:
- Fixed bug causing automated tests to fail on OSX
- Addressed an issue which kept configuration secrets in memory for longer than necessary
  duo_unix-1.10.0:
- Added LibreSSL support
- Added additional GECOS parsing support
- Increased OSX group count
  duo_unix-1.9.21:
- PSA-2017-002: Only allow http_proxy to be defined in configuration file instead of environment
  duo_unix-1.9.20:
- Fix installation on AIX systems
- Add support for using OpenSSL 1.1.0
- Link libduo statically to address issues with the ldconfig cache and incompatibilities between versions
- Fixed a bug that produced incorrect SNI when using a proxy
  duo_unix-1.9.19:
- Restore the http_proxy environment variable after Duo is done
- Added https_timeout config option to pam_duo
- Handles missing shell and adds default if not specified in getpwuid
- Add SNI support and a guard for systems that don't support SNI
- Bug fixes for timeouts and fallback ip addresses</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1628856000">- Fix pam_duo.conf permissions</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1645185600">duo_unix-1.12.0:
- Switched from BSON to JSON as a data interchange format
- Switched from Cram to python `unittest` for testing</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1674561600">- Patch the build to link libduo dynamically, as SUSE policy dictates.
  Upstream began linking statically in 1.9.20.</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1674648000">- Merge pam_duo into main package
- Add README.SUSE file
- Update comments in permissions file
- Misc. cleanup of spec &amp; rpmlint</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1675857600">- Update to 2.0.0.  Note the changed behavior in pam_duo for su between two
  non-root users!
  duo_unix-2.0.0:
- Changed the behavior of `su` when the target user is not root.  The target user will need to complete 2FA rather than the original user.
- login_duo resets the SIGPIPE handler when it closes its connection.
- Added logging when Duo is invoked, to assist troubleshooting.
- Updated package signing to SHA512
  duo_unix-1.12.1:
- Updated Unity to 2.5.2</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1692273600">- Update to 2.0.2 and rebase patches
- Patch licenses path
  duo_unix-2.0.2:
- Make check now successfully runs on Solaris
  duo_unix-2.0.1:
- The support script collects a few additional files for troubleshooting
- Duo API calls now use SHA512 instead of SHA1 as the HMAC algorithm</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1755604800">- Update to 2.1.0 and rebase patches.
- Remove irrelevant information about upstream OS support (e.g. "Added support
  for Fedora XX") from the changelog.
  duo_unix-2.1.0:
- Improves certificate validation for IP hostnames to mitigate CVE-2014-0139
- Duo Unix obeys rate limiting replies from the Duo cloud service
- The full path to the configuration file is logged out when Duo Unix is invoked
- API calls to Duo will account for possible time drift between Duo and the local server
- Adds support for new Duo certificate authorities
  duo_unix-2.0.4:
- Fixed multiple memory allocation leaks
- Removed some unused and unreachable code
- Addressed multiple code cleanliness issues
  duo_unix-2.0.3:
- Fixed AIX compilation bug
- Support script now fetches correct log and PAM files for Solaris and AIX</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1761048000">- Update to 2.2.1.
- Replace deprecated %%patchN calls with %%autosetup.
- As of 2.2.0, duo_unix supports Verified Duo Push, which generates a three-
  digit code you must enter into the mobile app.  This is enabled with the
  'verified_push' config option, which is mutually exclusive with 'autopush'.
  duo_unix-2.2.1:
- Verified Push option is now documented in the man pages
- Enrollment message now includes the URL
  duo_unix-2.2.0:
- Added support for Verified Push
- Updated the Duo API calls to use the Auth API v2
- SSL failures will cause API calls fail over to additional IPs when the host resolves to multiple addresses</changelog>
</package>
<package pkgid="129474b3c344f185104cfe5eb02cb1faefa16296348ac2c5da27fc0ca81cb10a9e6968a15d2417fe5d7b3f25f52c55ab646ffb4f29522fe4bbc1578a3d101e16" name="libduo3-debuginfo" arch="s390x">
  <version epoch="0" ver="2.2.1" rel="1.13"/>
  <changelog author="plinnell@opensuse.org" date="1464955200">- Update to 1-9-18
  * Package cleanups and remove rpmlint warnings - still
  needs security review
- duo_unix-1.9.18:
  +Added HTTP proxy connection error handling
  +Improved compatibility with Solaris and AIX
- duo_unix-1.9.17:
  + Fixed PAM return code issue
- duo_unix-1.9.16:
  +Test fixes
  +Compilation fixes
- duo_unix-1.9.15:
  +SELinux policy module package support
  +PAM module improvements
  +Removed deprecated SHA1 Entrust CA
- duo_unix-1.9.14:
  +Added SELinux policy module
  +Improve poll(2) error handling</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1627041600">- Update to 1.11.4, detailed below.
- Fix paths in duo_unix_support tool.
- Fix RPM group for devel pkg.
- Deal with statically-linked libduo (see 1.9.20 changes).
  - should we patch the build to force dynamic linking?
  duo_unix-1.11.4:
- Added support tool to collect information (e.g. logs and PAM stacks) for debugging purposes
  duo_unix-1.11.3:
- Improved validation of BSON messages
  duo_unix-1.11.2:
- Added recommended Kerberos configuration for Duo Unix to our documentation, found at https://help.duo.com/s/article/5085. Thanks to Neal Poole at Facebook for bringing expertise and attention to this topic.
- Updated SELinux policy to allow local logins to use the pam_duo PAM module and made sshd configurable
- Added support for spaces in group names when escaped with backslashes in pam_duo.conf and login_duo.conf
- Test infrastructure updates
  duo_unix-1.11.1:
- Fixed bug causing console login to fail on certain systems
  duo_unix-1.11.0:
- Added support for GECOS field parsing based on user-supplied delimiter
- Updated README to include development/testing steps
- Minor test infrastructure updates
  duo_unix-1.10.5:
- Fixed an accidental null pointer free on systems where getaddrinfo() is unsuccessful
  duo_unix-1.10.4:
- Removed failmode decision from auth endpoint and moved it to only preauth according to standards in our other integrations
- Updated Duo Unix to speak up to TLS 1.2
- Support for LibreSSL 2.7.0 and up
- Minor memory leak fixes
- Output message when user is locked out
  duo_unix-1.10.3:
- Added support for http_proxy with SELinux enabled
  duo_unix-1.10.2:
- Added default failmode values in config files
  duo_unix-1.10.1:
- Fixed bug causing automated tests to fail on OSX
- Addressed an issue which kept configuration secrets in memory for longer than necessary
  duo_unix-1.10.0:
- Added LibreSSL support
- Added additional GECOS parsing support
- Increased OSX group count
  duo_unix-1.9.21:
- PSA-2017-002: Only allow http_proxy to be defined in configuration file instead of environment
  duo_unix-1.9.20:
- Fix installation on AIX systems
- Add support for using OpenSSL 1.1.0
- Link libduo statically to address issues with the ldconfig cache and incompatibilities between versions
- Fixed a bug that produced incorrect SNI when using a proxy
  duo_unix-1.9.19:
- Restore the http_proxy environment variable after Duo is done
- Added https_timeout config option to pam_duo
- Handles missing shell and adds default if not specified in getpwuid
- Add SNI support and a guard for systems that don't support SNI
- Bug fixes for timeouts and fallback ip addresses</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1628856000">- Fix pam_duo.conf permissions</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1645185600">duo_unix-1.12.0:
- Switched from BSON to JSON as a data interchange format
- Switched from Cram to python `unittest` for testing</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1674561600">- Patch the build to link libduo dynamically, as SUSE policy dictates.
  Upstream began linking statically in 1.9.20.</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1674648000">- Merge pam_duo into main package
- Add README.SUSE file
- Update comments in permissions file
- Misc. cleanup of spec &amp; rpmlint</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1675857600">- Update to 2.0.0.  Note the changed behavior in pam_duo for su between two
  non-root users!
  duo_unix-2.0.0:
- Changed the behavior of `su` when the target user is not root.  The target user will need to complete 2FA rather than the original user.
- login_duo resets the SIGPIPE handler when it closes its connection.
- Added logging when Duo is invoked, to assist troubleshooting.
- Updated package signing to SHA512
  duo_unix-1.12.1:
- Updated Unity to 2.5.2</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1692273600">- Update to 2.0.2 and rebase patches
- Patch licenses path
  duo_unix-2.0.2:
- Make check now successfully runs on Solaris
  duo_unix-2.0.1:
- The support script collects a few additional files for troubleshooting
- Duo API calls now use SHA512 instead of SHA1 as the HMAC algorithm</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1755604800">- Update to 2.1.0 and rebase patches.
- Remove irrelevant information about upstream OS support (e.g. "Added support
  for Fedora XX") from the changelog.
  duo_unix-2.1.0:
- Improves certificate validation for IP hostnames to mitigate CVE-2014-0139
- Duo Unix obeys rate limiting replies from the Duo cloud service
- The full path to the configuration file is logged out when Duo Unix is invoked
- API calls to Duo will account for possible time drift between Duo and the local server
- Adds support for new Duo certificate authorities
  duo_unix-2.0.4:
- Fixed multiple memory allocation leaks
- Removed some unused and unreachable code
- Addressed multiple code cleanliness issues
  duo_unix-2.0.3:
- Fixed AIX compilation bug
- Support script now fetches correct log and PAM files for Solaris and AIX</changelog>
  <changelog author="Andrew Daugherity &lt;adaugherity@tamu.edu&gt;" date="1761048000">- Update to 2.2.1.
- Replace deprecated %%patchN calls with %%autosetup.
- As of 2.2.0, duo_unix supports Verified Duo Push, which generates a three-
  digit code you must enter into the mobile app.  This is enabled with the
  'verified_push' config option, which is mutually exclusive with 'autopush'.
  duo_unix-2.2.1:
- Verified Push option is now documented in the man pages
- Enrollment message now includes the URL
  duo_unix-2.2.0:
- Added support for Verified Push
- Updated the Duo API calls to use the Auth API v2
- SSL failures will cause API calls fail over to additional IPs when the host resolves to multiple addresses</changelog>
</package>
<package pkgid="0b5d85df03d8afbe74a2130652090ef5f9f250aca020543fa9463a39f51963d3cfc7020a8452629bf47d51675da552a66f53095fb456b0a015ee355b35a8a147" name="libest" arch="src">
  <version epoch="0" ver="3.2.0+git20220922" rel="1.34"/>
  <changelog author="Perry Werneck &lt;perry.werneck@gmail.com&gt;" date="1723636800">- First build on obs</changelog>
  <changelog author="obs-service-tar-scm@invalid" date="1736337600">- Update to version 3.2.0+git20220922:
  * src/est/est_locl.h: add missing extern on e_ctx_ssl_exdata_index
  * Update estserver.c
  * Add back in the #define to alias snprintf to _snprintf, but do it only for older versions of MSVC.
  * Correctly set Content-Length on SSKG responses.  Issue presented in PR #85.  Build the headers to obtain the counts instead of maintaining constants to represent their sizes.
  * Integrate proposed changes and improvements from https://github.com/cisco/libest/pull/81 after integration with internal version. - Enable use of an external and non-Cisco implementation of SafeC, both locally and system/distro installed - Change method for enable/disable options in configure.ac when possible - Make example build optional. Default enabled. - Get JNI building (OpenSSL 1.1.x and when client-only is enabled) - Additional Coverity defect fix in /test util code.</changelog>
</package>
<package pkgid="60ea9d9b7c8b39336ef48dc60f9be343cbaffa961921b255f00919197ad2f3e15d65fd8c7aeaa2eee7d412f2881a2711e69f515330a2652b945da90509a4eb6d" name="libest-debuginfo" arch="s390x">
  <version epoch="0" ver="3.2.0+git20220922" rel="1.34"/>
  <changelog author="Perry Werneck &lt;perry.werneck@gmail.com&gt;" date="1723636800">- First build on obs</changelog>
  <changelog author="obs-service-tar-scm@invalid" date="1736337600">- Update to version 3.2.0+git20220922:
  * src/est/est_locl.h: add missing extern on e_ctx_ssl_exdata_index
  * Update estserver.c
  * Add back in the #define to alias snprintf to _snprintf, but do it only for older versions of MSVC.
  * Correctly set Content-Length on SSKG responses.  Issue presented in PR #85.  Build the headers to obtain the counts instead of maintaining constants to represent their sizes.
  * Integrate proposed changes and improvements from https://github.com/cisco/libest/pull/81 after integration with internal version. - Enable use of an external and non-Cisco implementation of SafeC, both locally and system/distro installed - Change method for enable/disable options in configure.ac when possible - Make example build optional. Default enabled. - Get JNI building (OpenSSL 1.1.x and when client-only is enabled) - Additional Coverity defect fix in /test util code.</changelog>
</package>
<package pkgid="0004e7ee020ecd868f0d1997baa2217bf0b6ca9464f15497f3cd0dddce16afb184ae4e95a088fb1e733ab43c376d023da3bf6a55bebf5a3ebf27c1bf3f61efbd" name="libest-debugsource" arch="s390x">
  <version epoch="0" ver="3.2.0+git20220922" rel="1.34"/>
  <changelog author="Perry Werneck &lt;perry.werneck@gmail.com&gt;" date="1723636800">- First build on obs</changelog>
  <changelog author="obs-service-tar-scm@invalid" date="1736337600">- Update to version 3.2.0+git20220922:
  * src/est/est_locl.h: add missing extern on e_ctx_ssl_exdata_index
  * Update estserver.c
  * Add back in the #define to alias snprintf to _snprintf, but do it only for older versions of MSVC.
  * Correctly set Content-Length on SSKG responses.  Issue presented in PR #85.  Build the headers to obtain the counts instead of maintaining constants to represent their sizes.
  * Integrate proposed changes and improvements from https://github.com/cisco/libest/pull/81 after integration with internal version. - Enable use of an external and non-Cisco implementation of SafeC, both locally and system/distro installed - Change method for enable/disable options in configure.ac when possible - Make example build optional. Default enabled. - Get JNI building (OpenSSL 1.1.x and when client-only is enabled) - Additional Coverity defect fix in /test util code.</changelog>
</package>
<package pkgid="c1c496ba66654eb5732ad6d27d6da6effb5096e6cf90a4e724eb97cfab0648b3b6f4b8f6415efec3e6bac863cd06e03e6f29d9f5666c825332cdd1b55c83b169" name="libest-devel" arch="s390x">
  <version epoch="0" ver="3.2.0+git20220922" rel="1.34"/>
  <changelog author="Perry Werneck &lt;perry.werneck@gmail.com&gt;" date="1723636800">- First build on obs</changelog>
  <changelog author="obs-service-tar-scm@invalid" date="1736337600">- Update to version 3.2.0+git20220922:
  * src/est/est_locl.h: add missing extern on e_ctx_ssl_exdata_index
  * Update estserver.c
  * Add back in the #define to alias snprintf to _snprintf, but do it only for older versions of MSVC.
  * Correctly set Content-Length on SSKG responses.  Issue presented in PR #85.  Build the headers to obtain the counts instead of maintaining constants to represent their sizes.
  * Integrate proposed changes and improvements from https://github.com/cisco/libest/pull/81 after integration with internal version. - Enable use of an external and non-Cisco implementation of SafeC, both locally and system/distro installed - Change method for enable/disable options in configure.ac when possible - Make example build optional. Default enabled. - Get JNI building (OpenSSL 1.1.x and when client-only is enabled) - Additional Coverity defect fix in /test util code.</changelog>
</package>
<package pkgid="8e5e0f39ede769ca41486fbb24effcda2eca98ced23d20c040e1e4906b561ad1d488eda54f85e804262a133fa4c71961aa58e7abfc78dfa35db1891d21f25846" name="libest-server" arch="s390x">
  <version epoch="0" ver="3.2.0+git20220922" rel="1.34"/>
  <changelog author="Perry Werneck &lt;perry.werneck@gmail.com&gt;" date="1723636800">- First build on obs</changelog>
  <changelog author="obs-service-tar-scm@invalid" date="1736337600">- Update to version 3.2.0+git20220922:
  * src/est/est_locl.h: add missing extern on e_ctx_ssl_exdata_index
  * Update estserver.c
  * Add back in the #define to alias snprintf to _snprintf, but do it only for older versions of MSVC.
  * Correctly set Content-Length on SSKG responses.  Issue presented in PR #85.  Build the headers to obtain the counts instead of maintaining constants to represent their sizes.
  * Integrate proposed changes and improvements from https://github.com/cisco/libest/pull/81 after integration with internal version. - Enable use of an external and non-Cisco implementation of SafeC, both locally and system/distro installed - Change method for enable/disable options in configure.ac when possible - Make example build optional. Default enabled. - Get JNI building (OpenSSL 1.1.x and when client-only is enabled) - Additional Coverity defect fix in /test util code.</changelog>
</package>
<package pkgid="7432ed0ae5b46e7933cc2b77934ed14eced27c576a40d5f397b484b78277ffc8453f03df0173d7c1aee3ef73b99459cb71f4abad759f521cdc1ecf03d8b9cdb8" name="libest-server-debuginfo" arch="s390x">
  <version epoch="0" ver="3.2.0+git20220922" rel="1.34"/>
  <changelog author="Perry Werneck &lt;perry.werneck@gmail.com&gt;" date="1723636800">- First build on obs</changelog>
  <changelog author="obs-service-tar-scm@invalid" date="1736337600">- Update to version 3.2.0+git20220922:
  * src/est/est_locl.h: add missing extern on e_ctx_ssl_exdata_index
  * Update estserver.c
  * Add back in the #define to alias snprintf to _snprintf, but do it only for older versions of MSVC.
  * Correctly set Content-Length on SSKG responses.  Issue presented in PR #85.  Build the headers to obtain the counts instead of maintaining constants to represent their sizes.
  * Integrate proposed changes and improvements from https://github.com/cisco/libest/pull/81 after integration with internal version. - Enable use of an external and non-Cisco implementation of SafeC, both locally and system/distro installed - Change method for enable/disable options in configure.ac when possible - Make example build optional. Default enabled. - Get JNI building (OpenSSL 1.1.x and when client-only is enabled) - Additional Coverity defect fix in /test util code.</changelog>
</package>
<package pkgid="3833951bd1bdd7b8e469beb17c04a8dae9a778ba725cbd22b4283317583af426f6a332db82dc4e8a03cbc8bb2ff7e41c381bc7fdcd09d0f52e2573093bd6150e" name="libest-tools" arch="s390x">
  <version epoch="0" ver="3.2.0+git20220922" rel="1.34"/>
  <changelog author="Perry Werneck &lt;perry.werneck@gmail.com&gt;" date="1723636800">- First build on obs</changelog>
  <changelog author="obs-service-tar-scm@invalid" date="1736337600">- Update to version 3.2.0+git20220922:
  * src/est/est_locl.h: add missing extern on e_ctx_ssl_exdata_index
  * Update estserver.c
  * Add back in the #define to alias snprintf to _snprintf, but do it only for older versions of MSVC.
  * Correctly set Content-Length on SSKG responses.  Issue presented in PR #85.  Build the headers to obtain the counts instead of maintaining constants to represent their sizes.
  * Integrate proposed changes and improvements from https://github.com/cisco/libest/pull/81 after integration with internal version. - Enable use of an external and non-Cisco implementation of SafeC, both locally and system/distro installed - Change method for enable/disable options in configure.ac when possible - Make example build optional. Default enabled. - Get JNI building (OpenSSL 1.1.x and when client-only is enabled) - Additional Coverity defect fix in /test util code.</changelog>
</package>
<package pkgid="019d832598be1f33fd95cf77517cfc0ce69a294a0adc21607bfd59291cc380dc7fcd001543d245e029685ac6bc1c3c8961d2f7aae7bba5e921bf2d120d994be3" name="libest-tools-debuginfo" arch="s390x">
  <version epoch="0" ver="3.2.0+git20220922" rel="1.34"/>
  <changelog author="Perry Werneck &lt;perry.werneck@gmail.com&gt;" date="1723636800">- First build on obs</changelog>
  <changelog author="obs-service-tar-scm@invalid" date="1736337600">- Update to version 3.2.0+git20220922:
  * src/est/est_locl.h: add missing extern on e_ctx_ssl_exdata_index
  * Update estserver.c
  * Add back in the #define to alias snprintf to _snprintf, but do it only for older versions of MSVC.
  * Correctly set Content-Length on SSKG responses.  Issue presented in PR #85.  Build the headers to obtain the counts instead of maintaining constants to represent their sizes.
  * Integrate proposed changes and improvements from https://github.com/cisco/libest/pull/81 after integration with internal version. - Enable use of an external and non-Cisco implementation of SafeC, both locally and system/distro installed - Change method for enable/disable options in configure.ac when possible - Make example build optional. Default enabled. - Get JNI building (OpenSSL 1.1.x and when client-only is enabled) - Additional Coverity defect fix in /test util code.</changelog>
</package>
<package pkgid="795843bce05260fd480a0ce06e99068f09662817731ee1f5ee7cea32c784403adfe13e19c38342a291a89fc814db0ddb70bf4b4586cf1d38293820b281d36ee2" name="libest3" arch="s390x">
  <version epoch="0" ver="3.2.0+git20220922" rel="1.34"/>
  <changelog author="Perry Werneck &lt;perry.werneck@gmail.com&gt;" date="1723636800">- First build on obs</changelog>
  <changelog author="obs-service-tar-scm@invalid" date="1736337600">- Update to version 3.2.0+git20220922:
  * src/est/est_locl.h: add missing extern on e_ctx_ssl_exdata_index
  * Update estserver.c
  * Add back in the #define to alias snprintf to _snprintf, but do it only for older versions of MSVC.
  * Correctly set Content-Length on SSKG responses.  Issue presented in PR #85.  Build the headers to obtain the counts instead of maintaining constants to represent their sizes.
  * Integrate proposed changes and improvements from https://github.com/cisco/libest/pull/81 after integration with internal version. - Enable use of an external and non-Cisco implementation of SafeC, both locally and system/distro installed - Change method for enable/disable options in configure.ac when possible - Make example build optional. Default enabled. - Get JNI building (OpenSSL 1.1.x and when client-only is enabled) - Additional Coverity defect fix in /test util code.</changelog>
</package>
<package pkgid="7e2b72fd7ce1fa28c97c0ec253dc9a2b0010ef6a566018d523507e9bf1b269830ad29e09de93acadd9554a11d8b8a78c3e3f18714365e1d864401004b7bf3a21" name="libest3-debuginfo" arch="s390x">
  <version epoch="0" ver="3.2.0+git20220922" rel="1.34"/>
  <changelog author="Perry Werneck &lt;perry.werneck@gmail.com&gt;" date="1723636800">- First build on obs</changelog>
  <changelog author="obs-service-tar-scm@invalid" date="1736337600">- Update to version 3.2.0+git20220922:
  * src/est/est_locl.h: add missing extern on e_ctx_ssl_exdata_index
  * Update estserver.c
  * Add back in the #define to alias snprintf to _snprintf, but do it only for older versions of MSVC.
  * Correctly set Content-Length on SSKG responses.  Issue presented in PR #85.  Build the headers to obtain the counts instead of maintaining constants to represent their sizes.
  * Integrate proposed changes and improvements from https://github.com/cisco/libest/pull/81 after integration with internal version. - Enable use of an external and non-Cisco implementation of SafeC, both locally and system/distro installed - Change method for enable/disable options in configure.ac when possible - Make example build optional. Default enabled. - Get JNI building (OpenSSL 1.1.x and when client-only is enabled) - Additional Coverity defect fix in /test util code.</changelog>
</package>
<package pkgid="7006612de28adca4d7fb08c22bb6c40f8ad8f9eedf28526bab8f6f7e9117663350333970859ff5093897c197ffb31a61ba72057ba72c974452c2254211253b78" name="libfido2-1" arch="s390x">
  <version epoch="0" ver="1.16.0" rel="55.7"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1631620800">- Update to version 1.8.0:
  * Dropped 'Requires.private' entry from pkg-config file.
  * Better support for FIDO 2.1 authenticators.
  * Support for Windows's native webauthn API.
  * Support for attestation format 'none'.
  * New API calls:
  - fido_assert_set_clientdata;
  - fido_cbor_info_algorithm_cose;
  - fido_cbor_info_algorithm_count;
  - fido_cbor_info_algorithm_type;
  - fido_cbor_info_transports_len;
  - fido_cbor_info_transports_ptr;
  - fido_cred_set_clientdata;
  - fido_cred_set_id;
  - fido_credman_set_dev_rk;
  - fido_dev_is_winhello.
  * fido2-token: new -Sc option to update a resident credential.
  * Documentation and reliability fixes.
  * HID access serialisation on Linux.
- disable fix-cmake-linking.patch, not needed currently</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1632225600">- Removed fix-cmake-linking.patch because no longer needed</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1635768000">- Version 1.9.0 (2021-10-27)
  * Enabled NFC support on Linux.
  * Added OpenSSL 3.0 compatibility.
  * Removed OpenSSL 1.0 compatibility.
  * Support for FIDO 2.1 "minPinLength" extension.
  * Support for COSE_EDDSA, COSE_ES256, and COSE_RS1 attestation.
  * Support for TPM 2.0 attestation.
  * Support for device timeouts; see fido_dev_set_timeout().
  * New API calls:
  - es256_pk_from_EVP_PKEY;
  - fido_cred_attstmt_len;
  - fido_cred_attstmt_ptr;
  - fido_cred_pin_minlen;
  - fido_cred_set_attstmt;
  - fido_cred_set_pin_minlen;
  - fido_dev_set_pin_minlen_rpid;
  - fido_dev_set_timeout;
  - rs256_pk_from_EVP_PKEY.
  * Reliability and portability fixes.
  * Better handling of HID devices without identification strings; gh#381.
  * Fixed detection of Windows’s native webauthn API; gh#382.</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1641816000">- Use BuildRequires: openssl-devel instead of forcing 1.1 since 3.x
  is now supported.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1648468800">- Version 1.10.0 (2022-01-17)
  * hid_osx: handle devices with paths &gt; 511 bytes; gh#462.
  * bio: fix CTAP2 canonical CBOR encoding in fido_bio_dev_enroll_*(); gh#480.
  * winhello: fallback to GetTopWindow() if GetForegroundWindow() fails.
  * winhello: fallback to hid_win.c if webauthn.dll isn’t available.
  * New API calls:
  - fido_dev_info_set;
  - fido_dev_io_handle;
  - fido_dev_new_with_info;
  - fido_dev_open_with_info.
  * Cygwin and NetBSD build fixes.
  * Documentation and reliability fixes.
  * Support for TPM 2.0 attestation of COSE_ES256 credentials.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1664971200">- Version 1.12.0 (2022-09-22)
  * Support for COSE_ES384.
  * Support for hidraw(4) on FreeBSD; gh#597.
  * Improved support for FIDO 2.1 authenticators.
  * New API calls:
    + es384_pk_free;
    + es384_pk_from_EC_KEY;
    + es384_pk_from_EVP_PKEY;
    + es384_pk_from_ptr;
    + es384_pk_new;
    + es384_pk_to_EVP_PKEY;
    + fido_cbor_info_certs_len;
    + fido_cbor_info_certs_name_ptr;
    + fido_cbor_info_certs_value_ptr;
    + fido_cbor_info_maxrpid_minpinlen;
    + fido_cbor_info_minpinlen;
    + fido_cbor_info_new_pin_required;
    + fido_cbor_info_rk_remaining;
    + fido_cbor_info_uv_attempts;
    + fido_cbor_info_uv_modality.
  * Documentation and reliability fixes.
- Version 1.11.0 (2022-05-03)
  * Experimental PCSC support; enable with -DUSE_PCSC.
  * Improved OpenSSL 3.0 compatibility.
  * Use RFC1951 raw deflate to compress CTAP 2.1 largeBlobs.
  * winhello: advertise "uv" instead of "clientPin".
  * winhello: support hmac-secret in fido_dev_get_assert().
  * New API calls:
    + fido_cbor_info_maxlargeblob.
  * Documentation and reliability fixes.
  * Separate build and regress targets.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1677240000">- Version 1.13.0 (2023-02-20)
  * Support for linking against OpenSSL on Windows; gh#668.
  * New API calls:
    + fido_assert_empty_allow_list;
    + fido_cred_empty_exclude_list.
  * fido2-token: fix issue when listing large blobs.
  * Improved support for different fuzzing engines.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1700308800">- update to 1.14.0:
  * fido2-cred -M, fido2-token -G: support raw client data
    via -w flag.
  * New API calls:
  * * fido_assert_authdata_raw_len;
  * * fido_assert_authdata_raw_ptr;
  * * fido_assert_set_winhello_appid.
- add keyring for gpg validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.15.0:
  * bio, credman: improved CTAP 2.1 support.
  * hid_osx: fix issue where fido_hid_read() may block
    unnecessarily; gh#757.
  * fido2-token -I: print maxcredbloblen.
  * hid_linux: improved support for uhid devices.
  * New API calls:
  - fido_cred_set_attobj;
  - fido_cred_x5c_list_count;
  - fido_cred_x5c_list_len;
  - fido_cred_x5c_list_ptr.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1767355200">- update to 1.16.0:
  * Added support for enterprise attestation.
  * Improved handling of invalid key handles in U2F key
    lookup; gh#819.
  * Fixed issue where storing small CTAP 2.1 largeBlobs
    failed; gh#826.
  * Fixed APDU chaining issues for certain authenticators;
    gh#818, gh#855.
  * Improved documentation and examples.
  * New API calls:
  - fido_cred_entattest;
  - fido_cred_set_entattest.</changelog>
</package>
<package pkgid="ec47e8f59632499ff3b508b67a9b9c2f18ebd8628255c161942909851cd1ffc7eb7ec8f4f9de55001d368c89b5070ab4e0ddbda2be22103b83792352e4c494ab" name="libfido2-1-debuginfo" arch="s390x">
  <version epoch="0" ver="1.16.0" rel="55.7"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1631620800">- Update to version 1.8.0:
  * Dropped 'Requires.private' entry from pkg-config file.
  * Better support for FIDO 2.1 authenticators.
  * Support for Windows's native webauthn API.
  * Support for attestation format 'none'.
  * New API calls:
  - fido_assert_set_clientdata;
  - fido_cbor_info_algorithm_cose;
  - fido_cbor_info_algorithm_count;
  - fido_cbor_info_algorithm_type;
  - fido_cbor_info_transports_len;
  - fido_cbor_info_transports_ptr;
  - fido_cred_set_clientdata;
  - fido_cred_set_id;
  - fido_credman_set_dev_rk;
  - fido_dev_is_winhello.
  * fido2-token: new -Sc option to update a resident credential.
  * Documentation and reliability fixes.
  * HID access serialisation on Linux.
- disable fix-cmake-linking.patch, not needed currently</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1632225600">- Removed fix-cmake-linking.patch because no longer needed</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1635768000">- Version 1.9.0 (2021-10-27)
  * Enabled NFC support on Linux.
  * Added OpenSSL 3.0 compatibility.
  * Removed OpenSSL 1.0 compatibility.
  * Support for FIDO 2.1 "minPinLength" extension.
  * Support for COSE_EDDSA, COSE_ES256, and COSE_RS1 attestation.
  * Support for TPM 2.0 attestation.
  * Support for device timeouts; see fido_dev_set_timeout().
  * New API calls:
  - es256_pk_from_EVP_PKEY;
  - fido_cred_attstmt_len;
  - fido_cred_attstmt_ptr;
  - fido_cred_pin_minlen;
  - fido_cred_set_attstmt;
  - fido_cred_set_pin_minlen;
  - fido_dev_set_pin_minlen_rpid;
  - fido_dev_set_timeout;
  - rs256_pk_from_EVP_PKEY.
  * Reliability and portability fixes.
  * Better handling of HID devices without identification strings; gh#381.
  * Fixed detection of Windows’s native webauthn API; gh#382.</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1641816000">- Use BuildRequires: openssl-devel instead of forcing 1.1 since 3.x
  is now supported.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1648468800">- Version 1.10.0 (2022-01-17)
  * hid_osx: handle devices with paths &gt; 511 bytes; gh#462.
  * bio: fix CTAP2 canonical CBOR encoding in fido_bio_dev_enroll_*(); gh#480.
  * winhello: fallback to GetTopWindow() if GetForegroundWindow() fails.
  * winhello: fallback to hid_win.c if webauthn.dll isn’t available.
  * New API calls:
  - fido_dev_info_set;
  - fido_dev_io_handle;
  - fido_dev_new_with_info;
  - fido_dev_open_with_info.
  * Cygwin and NetBSD build fixes.
  * Documentation and reliability fixes.
  * Support for TPM 2.0 attestation of COSE_ES256 credentials.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1664971200">- Version 1.12.0 (2022-09-22)
  * Support for COSE_ES384.
  * Support for hidraw(4) on FreeBSD; gh#597.
  * Improved support for FIDO 2.1 authenticators.
  * New API calls:
    + es384_pk_free;
    + es384_pk_from_EC_KEY;
    + es384_pk_from_EVP_PKEY;
    + es384_pk_from_ptr;
    + es384_pk_new;
    + es384_pk_to_EVP_PKEY;
    + fido_cbor_info_certs_len;
    + fido_cbor_info_certs_name_ptr;
    + fido_cbor_info_certs_value_ptr;
    + fido_cbor_info_maxrpid_minpinlen;
    + fido_cbor_info_minpinlen;
    + fido_cbor_info_new_pin_required;
    + fido_cbor_info_rk_remaining;
    + fido_cbor_info_uv_attempts;
    + fido_cbor_info_uv_modality.
  * Documentation and reliability fixes.
- Version 1.11.0 (2022-05-03)
  * Experimental PCSC support; enable with -DUSE_PCSC.
  * Improved OpenSSL 3.0 compatibility.
  * Use RFC1951 raw deflate to compress CTAP 2.1 largeBlobs.
  * winhello: advertise "uv" instead of "clientPin".
  * winhello: support hmac-secret in fido_dev_get_assert().
  * New API calls:
    + fido_cbor_info_maxlargeblob.
  * Documentation and reliability fixes.
  * Separate build and regress targets.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1677240000">- Version 1.13.0 (2023-02-20)
  * Support for linking against OpenSSL on Windows; gh#668.
  * New API calls:
    + fido_assert_empty_allow_list;
    + fido_cred_empty_exclude_list.
  * fido2-token: fix issue when listing large blobs.
  * Improved support for different fuzzing engines.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1700308800">- update to 1.14.0:
  * fido2-cred -M, fido2-token -G: support raw client data
    via -w flag.
  * New API calls:
  * * fido_assert_authdata_raw_len;
  * * fido_assert_authdata_raw_ptr;
  * * fido_assert_set_winhello_appid.
- add keyring for gpg validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.15.0:
  * bio, credman: improved CTAP 2.1 support.
  * hid_osx: fix issue where fido_hid_read() may block
    unnecessarily; gh#757.
  * fido2-token -I: print maxcredbloblen.
  * hid_linux: improved support for uhid devices.
  * New API calls:
  - fido_cred_set_attobj;
  - fido_cred_x5c_list_count;
  - fido_cred_x5c_list_len;
  - fido_cred_x5c_list_ptr.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1767355200">- update to 1.16.0:
  * Added support for enterprise attestation.
  * Improved handling of invalid key handles in U2F key
    lookup; gh#819.
  * Fixed issue where storing small CTAP 2.1 largeBlobs
    failed; gh#826.
  * Fixed APDU chaining issues for certain authenticators;
    gh#818, gh#855.
  * Improved documentation and examples.
  * New API calls:
  - fido_cred_entattest;
  - fido_cred_set_entattest.</changelog>
</package>
<package pkgid="bcd45f0cd58a4cfa25a6978e604026db1eb0cd2bc0457dd45b09a5e2e7616c5b68cdb930d11d277f9cba1b5efbf1cadff19499da5183b634ba785b245e17da9d" name="libfido2" arch="src">
  <version epoch="0" ver="1.16.0" rel="55.7"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1583064000">- Version 1.3.1
  - fix zero-ing of le1 and le2 when talking to a U2F device.
  - dropping sk-libfido2 middleware, please find it in the openssh
    tree.</changelog>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1590408000">- Update to version 1.4.0
  * hid_hidapi: hidapi backend; enable with -DUSE_HIDAPI=1.
  * Fall back to U2F if the key claims to, but does not support FIDO2.
  * FIDO2 credential protection (credprot) support.
  * New API calls:
    + fido_cbor_info_fwversion;
    + fido_cred_prot;
    + fido_cred_set_prot;
    + fido_dev_set_transport_functions;
    + fido_set_log_handler.
  * Fixed EdDSA and RSA self-attestation.</changelog>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1593691200">- Don't build with hidapi support to fix issues with Yubikey 5Ci
  https://github.com/Yubico/libfido2/issues/190</changelog>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1593777600">- Create a udev subpackage and ship the udev rule</changelog>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1595592000">- Cleanup udev rules, trying to use the Debian specific plugdev
  group fills up the journal.
- Make the udev rules package noarch, correct Summary</changelog>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1598961600">- Update to version 1.5.0
  * hid_linux: return FIDO_OK if no devices are found.
  * hid_osx:
    + repair communication with U2F tokens, gh#166;
    + reliability fixes.
  * fido2-{assert,cred}: new options to explicitly toggle UP, UV.
  * Support for configurable report lengths.
  * New API calls:
    + fido_cbor_info_maxcredcntlst
    + fido_cbor_info_maxcredidlen
    + fido_cred_aaguid_len
    + fido_cred_aaguid_ptr
    + fido_dev_get_touch_begin
    + fido_dev_get_touch_status
  * Use COSE_ECDH_ES256 with CTAP_CBOR_CLIENT_PIN; gh#154.
  * Allow CTAP messages up to 2048 bytes; gh#171.
  * Ensure we only list USB devices by default.</changelog>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1599652800">- Add 7a17a4e9127fb6df6278f19396760e7d60a5862c.patch from upstream
  to fix 32bit compilation issues.</changelog>
  <changelog author="Hans Petter Jansson &lt;hpj@suse.com&gt;" date="1605614400">- Add Conflicts: to supersede version 1.0.0. This is needed for
  a clean upgrade path on SLE.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1611144000">- Update to version 1.6.0:
  * Fix OpenSSL 1.0 and Cygwin builds.
  * hid_linux: fix build on 32-bit systems.
  * hid_osx: allow reads from spawned threads.
  * Documentation and reliability fixes.
  * New API calls:
    + fido_cred_authdata_raw_len;
    + fido_cred_authdata_raw_ptr;
    + fido_cred_sigcount;
    + fido_dev_get_uv_retry_count;
    + fido_dev_supports_credman.
  * Hardened Windows build.
  * Native FreeBSD and NetBSD support.
  * Use CTAP2 canonical CBOR when combining hmac-secret and credProtect.
- Drop 7a17a4e9127fb6df6278f19396760e7d60a5862c.patch
- Do not build examples as their build fails</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1618660800">- Update to version 1.7.0:
  * hid_win: detect devices with vendor or product IDs &gt; 0x7fff
  * Support for FIDO 2.1 authenticator configuration.
  * Support for FIDO 2.1 UV token permissions.
  * Support for FIDO 2.1 "credBlobs" and "largeBlobs" extensions.
  * New API calls
  * New fido_init flag to disable fido_dev_open’s U2F fallback
  * Experimental NFC support on Linux.
- Enabled hidapi again, issues related to hidapi are fixed upstream
  * Added fix-cmake-linking.patch to fix linking</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1631620800">- Update to version 1.8.0:
  * Dropped 'Requires.private' entry from pkg-config file.
  * Better support for FIDO 2.1 authenticators.
  * Support for Windows's native webauthn API.
  * Support for attestation format 'none'.
  * New API calls:
  - fido_assert_set_clientdata;
  - fido_cbor_info_algorithm_cose;
  - fido_cbor_info_algorithm_count;
  - fido_cbor_info_algorithm_type;
  - fido_cbor_info_transports_len;
  - fido_cbor_info_transports_ptr;
  - fido_cred_set_clientdata;
  - fido_cred_set_id;
  - fido_credman_set_dev_rk;
  - fido_dev_is_winhello.
  * fido2-token: new -Sc option to update a resident credential.
  * Documentation and reliability fixes.
  * HID access serialisation on Linux.
- disable fix-cmake-linking.patch, not needed currently</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1632225600">- Removed fix-cmake-linking.patch because no longer needed</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1635768000">- Version 1.9.0 (2021-10-27)
  * Enabled NFC support on Linux.
  * Added OpenSSL 3.0 compatibility.
  * Removed OpenSSL 1.0 compatibility.
  * Support for FIDO 2.1 "minPinLength" extension.
  * Support for COSE_EDDSA, COSE_ES256, and COSE_RS1 attestation.
  * Support for TPM 2.0 attestation.
  * Support for device timeouts; see fido_dev_set_timeout().
  * New API calls:
  - es256_pk_from_EVP_PKEY;
  - fido_cred_attstmt_len;
  - fido_cred_attstmt_ptr;
  - fido_cred_pin_minlen;
  - fido_cred_set_attstmt;
  - fido_cred_set_pin_minlen;
  - fido_dev_set_pin_minlen_rpid;
  - fido_dev_set_timeout;
  - rs256_pk_from_EVP_PKEY.
  * Reliability and portability fixes.
  * Better handling of HID devices without identification strings; gh#381.
  * Fixed detection of Windows’s native webauthn API; gh#382.</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1641816000">- Use BuildRequires: openssl-devel instead of forcing 1.1 since 3.x
  is now supported.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1648468800">- Version 1.10.0 (2022-01-17)
  * hid_osx: handle devices with paths &gt; 511 bytes; gh#462.
  * bio: fix CTAP2 canonical CBOR encoding in fido_bio_dev_enroll_*(); gh#480.
  * winhello: fallback to GetTopWindow() if GetForegroundWindow() fails.
  * winhello: fallback to hid_win.c if webauthn.dll isn’t available.
  * New API calls:
  - fido_dev_info_set;
  - fido_dev_io_handle;
  - fido_dev_new_with_info;
  - fido_dev_open_with_info.
  * Cygwin and NetBSD build fixes.
  * Documentation and reliability fixes.
  * Support for TPM 2.0 attestation of COSE_ES256 credentials.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1664971200">- Version 1.12.0 (2022-09-22)
  * Support for COSE_ES384.
  * Support for hidraw(4) on FreeBSD; gh#597.
  * Improved support for FIDO 2.1 authenticators.
  * New API calls:
    + es384_pk_free;
    + es384_pk_from_EC_KEY;
    + es384_pk_from_EVP_PKEY;
    + es384_pk_from_ptr;
    + es384_pk_new;
    + es384_pk_to_EVP_PKEY;
    + fido_cbor_info_certs_len;
    + fido_cbor_info_certs_name_ptr;
    + fido_cbor_info_certs_value_ptr;
    + fido_cbor_info_maxrpid_minpinlen;
    + fido_cbor_info_minpinlen;
    + fido_cbor_info_new_pin_required;
    + fido_cbor_info_rk_remaining;
    + fido_cbor_info_uv_attempts;
    + fido_cbor_info_uv_modality.
  * Documentation and reliability fixes.
- Version 1.11.0 (2022-05-03)
  * Experimental PCSC support; enable with -DUSE_PCSC.
  * Improved OpenSSL 3.0 compatibility.
  * Use RFC1951 raw deflate to compress CTAP 2.1 largeBlobs.
  * winhello: advertise "uv" instead of "clientPin".
  * winhello: support hmac-secret in fido_dev_get_assert().
  * New API calls:
    + fido_cbor_info_maxlargeblob.
  * Documentation and reliability fixes.
  * Separate build and regress targets.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1677240000">- Version 1.13.0 (2023-02-20)
  * Support for linking against OpenSSL on Windows; gh#668.
  * New API calls:
    + fido_assert_empty_allow_list;
    + fido_cred_empty_exclude_list.
  * fido2-token: fix issue when listing large blobs.
  * Improved support for different fuzzing engines.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1700308800">- update to 1.14.0:
  * fido2-cred -M, fido2-token -G: support raw client data
    via -w flag.
  * New API calls:
  * * fido_assert_authdata_raw_len;
  * * fido_assert_authdata_raw_ptr;
  * * fido_assert_set_winhello_appid.
- add keyring for gpg validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.15.0:
  * bio, credman: improved CTAP 2.1 support.
  * hid_osx: fix issue where fido_hid_read() may block
    unnecessarily; gh#757.
  * fido2-token -I: print maxcredbloblen.
  * hid_linux: improved support for uhid devices.
  * New API calls:
  - fido_cred_set_attobj;
  - fido_cred_x5c_list_count;
  - fido_cred_x5c_list_len;
  - fido_cred_x5c_list_ptr.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1767355200">- update to 1.16.0:
  * Added support for enterprise attestation.
  * Improved handling of invalid key handles in U2F key
    lookup; gh#819.
  * Fixed issue where storing small CTAP 2.1 largeBlobs
    failed; gh#826.
  * Fixed APDU chaining issues for certain authenticators;
    gh#818, gh#855.
  * Improved documentation and examples.
  * New API calls:
  - fido_cred_entattest;
  - fido_cred_set_entattest.</changelog>
</package>
<package pkgid="54613e229ea5cb5c85f93ca5e204b6d7ac523b90cc240d989052a72dba9bd0cdc372eddc78c6bdf7eeae87cf0c1c500b7665a0a3d7d7eaf618bc0c55d2075229" name="libfido2-debuginfo" arch="s390x">
  <version epoch="0" ver="1.16.0" rel="55.7"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1631620800">- Update to version 1.8.0:
  * Dropped 'Requires.private' entry from pkg-config file.
  * Better support for FIDO 2.1 authenticators.
  * Support for Windows's native webauthn API.
  * Support for attestation format 'none'.
  * New API calls:
  - fido_assert_set_clientdata;
  - fido_cbor_info_algorithm_cose;
  - fido_cbor_info_algorithm_count;
  - fido_cbor_info_algorithm_type;
  - fido_cbor_info_transports_len;
  - fido_cbor_info_transports_ptr;
  - fido_cred_set_clientdata;
  - fido_cred_set_id;
  - fido_credman_set_dev_rk;
  - fido_dev_is_winhello.
  * fido2-token: new -Sc option to update a resident credential.
  * Documentation and reliability fixes.
  * HID access serialisation on Linux.
- disable fix-cmake-linking.patch, not needed currently</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1632225600">- Removed fix-cmake-linking.patch because no longer needed</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1635768000">- Version 1.9.0 (2021-10-27)
  * Enabled NFC support on Linux.
  * Added OpenSSL 3.0 compatibility.
  * Removed OpenSSL 1.0 compatibility.
  * Support for FIDO 2.1 "minPinLength" extension.
  * Support for COSE_EDDSA, COSE_ES256, and COSE_RS1 attestation.
  * Support for TPM 2.0 attestation.
  * Support for device timeouts; see fido_dev_set_timeout().
  * New API calls:
  - es256_pk_from_EVP_PKEY;
  - fido_cred_attstmt_len;
  - fido_cred_attstmt_ptr;
  - fido_cred_pin_minlen;
  - fido_cred_set_attstmt;
  - fido_cred_set_pin_minlen;
  - fido_dev_set_pin_minlen_rpid;
  - fido_dev_set_timeout;
  - rs256_pk_from_EVP_PKEY.
  * Reliability and portability fixes.
  * Better handling of HID devices without identification strings; gh#381.
  * Fixed detection of Windows’s native webauthn API; gh#382.</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1641816000">- Use BuildRequires: openssl-devel instead of forcing 1.1 since 3.x
  is now supported.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1648468800">- Version 1.10.0 (2022-01-17)
  * hid_osx: handle devices with paths &gt; 511 bytes; gh#462.
  * bio: fix CTAP2 canonical CBOR encoding in fido_bio_dev_enroll_*(); gh#480.
  * winhello: fallback to GetTopWindow() if GetForegroundWindow() fails.
  * winhello: fallback to hid_win.c if webauthn.dll isn’t available.
  * New API calls:
  - fido_dev_info_set;
  - fido_dev_io_handle;
  - fido_dev_new_with_info;
  - fido_dev_open_with_info.
  * Cygwin and NetBSD build fixes.
  * Documentation and reliability fixes.
  * Support for TPM 2.0 attestation of COSE_ES256 credentials.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1664971200">- Version 1.12.0 (2022-09-22)
  * Support for COSE_ES384.
  * Support for hidraw(4) on FreeBSD; gh#597.
  * Improved support for FIDO 2.1 authenticators.
  * New API calls:
    + es384_pk_free;
    + es384_pk_from_EC_KEY;
    + es384_pk_from_EVP_PKEY;
    + es384_pk_from_ptr;
    + es384_pk_new;
    + es384_pk_to_EVP_PKEY;
    + fido_cbor_info_certs_len;
    + fido_cbor_info_certs_name_ptr;
    + fido_cbor_info_certs_value_ptr;
    + fido_cbor_info_maxrpid_minpinlen;
    + fido_cbor_info_minpinlen;
    + fido_cbor_info_new_pin_required;
    + fido_cbor_info_rk_remaining;
    + fido_cbor_info_uv_attempts;
    + fido_cbor_info_uv_modality.
  * Documentation and reliability fixes.
- Version 1.11.0 (2022-05-03)
  * Experimental PCSC support; enable with -DUSE_PCSC.
  * Improved OpenSSL 3.0 compatibility.
  * Use RFC1951 raw deflate to compress CTAP 2.1 largeBlobs.
  * winhello: advertise "uv" instead of "clientPin".
  * winhello: support hmac-secret in fido_dev_get_assert().
  * New API calls:
    + fido_cbor_info_maxlargeblob.
  * Documentation and reliability fixes.
  * Separate build and regress targets.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1677240000">- Version 1.13.0 (2023-02-20)
  * Support for linking against OpenSSL on Windows; gh#668.
  * New API calls:
    + fido_assert_empty_allow_list;
    + fido_cred_empty_exclude_list.
  * fido2-token: fix issue when listing large blobs.
  * Improved support for different fuzzing engines.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1700308800">- update to 1.14.0:
  * fido2-cred -M, fido2-token -G: support raw client data
    via -w flag.
  * New API calls:
  * * fido_assert_authdata_raw_len;
  * * fido_assert_authdata_raw_ptr;
  * * fido_assert_set_winhello_appid.
- add keyring for gpg validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.15.0:
  * bio, credman: improved CTAP 2.1 support.
  * hid_osx: fix issue where fido_hid_read() may block
    unnecessarily; gh#757.
  * fido2-token -I: print maxcredbloblen.
  * hid_linux: improved support for uhid devices.
  * New API calls:
  - fido_cred_set_attobj;
  - fido_cred_x5c_list_count;
  - fido_cred_x5c_list_len;
  - fido_cred_x5c_list_ptr.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1767355200">- update to 1.16.0:
  * Added support for enterprise attestation.
  * Improved handling of invalid key handles in U2F key
    lookup; gh#819.
  * Fixed issue where storing small CTAP 2.1 largeBlobs
    failed; gh#826.
  * Fixed APDU chaining issues for certain authenticators;
    gh#818, gh#855.
  * Improved documentation and examples.
  * New API calls:
  - fido_cred_entattest;
  - fido_cred_set_entattest.</changelog>
</package>
<package pkgid="e6f7805f5589bc227cb695211861d4669ce4d7c29778a6ab077bf8656072f6f2f0c577c579df98ea6034891582337123fbfff329c958a91e641c3209cf080f6c" name="libfido2-debugsource" arch="s390x">
  <version epoch="0" ver="1.16.0" rel="55.7"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1631620800">- Update to version 1.8.0:
  * Dropped 'Requires.private' entry from pkg-config file.
  * Better support for FIDO 2.1 authenticators.
  * Support for Windows's native webauthn API.
  * Support for attestation format 'none'.
  * New API calls:
  - fido_assert_set_clientdata;
  - fido_cbor_info_algorithm_cose;
  - fido_cbor_info_algorithm_count;
  - fido_cbor_info_algorithm_type;
  - fido_cbor_info_transports_len;
  - fido_cbor_info_transports_ptr;
  - fido_cred_set_clientdata;
  - fido_cred_set_id;
  - fido_credman_set_dev_rk;
  - fido_dev_is_winhello.
  * fido2-token: new -Sc option to update a resident credential.
  * Documentation and reliability fixes.
  * HID access serialisation on Linux.
- disable fix-cmake-linking.patch, not needed currently</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1632225600">- Removed fix-cmake-linking.patch because no longer needed</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1635768000">- Version 1.9.0 (2021-10-27)
  * Enabled NFC support on Linux.
  * Added OpenSSL 3.0 compatibility.
  * Removed OpenSSL 1.0 compatibility.
  * Support for FIDO 2.1 "minPinLength" extension.
  * Support for COSE_EDDSA, COSE_ES256, and COSE_RS1 attestation.
  * Support for TPM 2.0 attestation.
  * Support for device timeouts; see fido_dev_set_timeout().
  * New API calls:
  - es256_pk_from_EVP_PKEY;
  - fido_cred_attstmt_len;
  - fido_cred_attstmt_ptr;
  - fido_cred_pin_minlen;
  - fido_cred_set_attstmt;
  - fido_cred_set_pin_minlen;
  - fido_dev_set_pin_minlen_rpid;
  - fido_dev_set_timeout;
  - rs256_pk_from_EVP_PKEY.
  * Reliability and portability fixes.
  * Better handling of HID devices without identification strings; gh#381.
  * Fixed detection of Windows’s native webauthn API; gh#382.</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1641816000">- Use BuildRequires: openssl-devel instead of forcing 1.1 since 3.x
  is now supported.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1648468800">- Version 1.10.0 (2022-01-17)
  * hid_osx: handle devices with paths &gt; 511 bytes; gh#462.
  * bio: fix CTAP2 canonical CBOR encoding in fido_bio_dev_enroll_*(); gh#480.
  * winhello: fallback to GetTopWindow() if GetForegroundWindow() fails.
  * winhello: fallback to hid_win.c if webauthn.dll isn’t available.
  * New API calls:
  - fido_dev_info_set;
  - fido_dev_io_handle;
  - fido_dev_new_with_info;
  - fido_dev_open_with_info.
  * Cygwin and NetBSD build fixes.
  * Documentation and reliability fixes.
  * Support for TPM 2.0 attestation of COSE_ES256 credentials.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1664971200">- Version 1.12.0 (2022-09-22)
  * Support for COSE_ES384.
  * Support for hidraw(4) on FreeBSD; gh#597.
  * Improved support for FIDO 2.1 authenticators.
  * New API calls:
    + es384_pk_free;
    + es384_pk_from_EC_KEY;
    + es384_pk_from_EVP_PKEY;
    + es384_pk_from_ptr;
    + es384_pk_new;
    + es384_pk_to_EVP_PKEY;
    + fido_cbor_info_certs_len;
    + fido_cbor_info_certs_name_ptr;
    + fido_cbor_info_certs_value_ptr;
    + fido_cbor_info_maxrpid_minpinlen;
    + fido_cbor_info_minpinlen;
    + fido_cbor_info_new_pin_required;
    + fido_cbor_info_rk_remaining;
    + fido_cbor_info_uv_attempts;
    + fido_cbor_info_uv_modality.
  * Documentation and reliability fixes.
- Version 1.11.0 (2022-05-03)
  * Experimental PCSC support; enable with -DUSE_PCSC.
  * Improved OpenSSL 3.0 compatibility.
  * Use RFC1951 raw deflate to compress CTAP 2.1 largeBlobs.
  * winhello: advertise "uv" instead of "clientPin".
  * winhello: support hmac-secret in fido_dev_get_assert().
  * New API calls:
    + fido_cbor_info_maxlargeblob.
  * Documentation and reliability fixes.
  * Separate build and regress targets.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1677240000">- Version 1.13.0 (2023-02-20)
  * Support for linking against OpenSSL on Windows; gh#668.
  * New API calls:
    + fido_assert_empty_allow_list;
    + fido_cred_empty_exclude_list.
  * fido2-token: fix issue when listing large blobs.
  * Improved support for different fuzzing engines.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1700308800">- update to 1.14.0:
  * fido2-cred -M, fido2-token -G: support raw client data
    via -w flag.
  * New API calls:
  * * fido_assert_authdata_raw_len;
  * * fido_assert_authdata_raw_ptr;
  * * fido_assert_set_winhello_appid.
- add keyring for gpg validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.15.0:
  * bio, credman: improved CTAP 2.1 support.
  * hid_osx: fix issue where fido_hid_read() may block
    unnecessarily; gh#757.
  * fido2-token -I: print maxcredbloblen.
  * hid_linux: improved support for uhid devices.
  * New API calls:
  - fido_cred_set_attobj;
  - fido_cred_x5c_list_count;
  - fido_cred_x5c_list_len;
  - fido_cred_x5c_list_ptr.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1767355200">- update to 1.16.0:
  * Added support for enterprise attestation.
  * Improved handling of invalid key handles in U2F key
    lookup; gh#819.
  * Fixed issue where storing small CTAP 2.1 largeBlobs
    failed; gh#826.
  * Fixed APDU chaining issues for certain authenticators;
    gh#818, gh#855.
  * Improved documentation and examples.
  * New API calls:
  - fido_cred_entattest;
  - fido_cred_set_entattest.</changelog>
</package>
<package pkgid="f158fe7e6564c2b3a77502f8fa8ee4e6547f1f57cfef473b68317c0e57907353b95c1657b337264ed6b910d30af8b0ddbe2dd2a62f2e6b7a8c57344f7a45aeb5" name="libfido2-devel" arch="s390x">
  <version epoch="0" ver="1.16.0" rel="55.7"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1631620800">- Update to version 1.8.0:
  * Dropped 'Requires.private' entry from pkg-config file.
  * Better support for FIDO 2.1 authenticators.
  * Support for Windows's native webauthn API.
  * Support for attestation format 'none'.
  * New API calls:
  - fido_assert_set_clientdata;
  - fido_cbor_info_algorithm_cose;
  - fido_cbor_info_algorithm_count;
  - fido_cbor_info_algorithm_type;
  - fido_cbor_info_transports_len;
  - fido_cbor_info_transports_ptr;
  - fido_cred_set_clientdata;
  - fido_cred_set_id;
  - fido_credman_set_dev_rk;
  - fido_dev_is_winhello.
  * fido2-token: new -Sc option to update a resident credential.
  * Documentation and reliability fixes.
  * HID access serialisation on Linux.
- disable fix-cmake-linking.patch, not needed currently</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1632225600">- Removed fix-cmake-linking.patch because no longer needed</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1635768000">- Version 1.9.0 (2021-10-27)
  * Enabled NFC support on Linux.
  * Added OpenSSL 3.0 compatibility.
  * Removed OpenSSL 1.0 compatibility.
  * Support for FIDO 2.1 "minPinLength" extension.
  * Support for COSE_EDDSA, COSE_ES256, and COSE_RS1 attestation.
  * Support for TPM 2.0 attestation.
  * Support for device timeouts; see fido_dev_set_timeout().
  * New API calls:
  - es256_pk_from_EVP_PKEY;
  - fido_cred_attstmt_len;
  - fido_cred_attstmt_ptr;
  - fido_cred_pin_minlen;
  - fido_cred_set_attstmt;
  - fido_cred_set_pin_minlen;
  - fido_dev_set_pin_minlen_rpid;
  - fido_dev_set_timeout;
  - rs256_pk_from_EVP_PKEY.
  * Reliability and portability fixes.
  * Better handling of HID devices without identification strings; gh#381.
  * Fixed detection of Windows’s native webauthn API; gh#382.</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1641816000">- Use BuildRequires: openssl-devel instead of forcing 1.1 since 3.x
  is now supported.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1648468800">- Version 1.10.0 (2022-01-17)
  * hid_osx: handle devices with paths &gt; 511 bytes; gh#462.
  * bio: fix CTAP2 canonical CBOR encoding in fido_bio_dev_enroll_*(); gh#480.
  * winhello: fallback to GetTopWindow() if GetForegroundWindow() fails.
  * winhello: fallback to hid_win.c if webauthn.dll isn’t available.
  * New API calls:
  - fido_dev_info_set;
  - fido_dev_io_handle;
  - fido_dev_new_with_info;
  - fido_dev_open_with_info.
  * Cygwin and NetBSD build fixes.
  * Documentation and reliability fixes.
  * Support for TPM 2.0 attestation of COSE_ES256 credentials.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1664971200">- Version 1.12.0 (2022-09-22)
  * Support for COSE_ES384.
  * Support for hidraw(4) on FreeBSD; gh#597.
  * Improved support for FIDO 2.1 authenticators.
  * New API calls:
    + es384_pk_free;
    + es384_pk_from_EC_KEY;
    + es384_pk_from_EVP_PKEY;
    + es384_pk_from_ptr;
    + es384_pk_new;
    + es384_pk_to_EVP_PKEY;
    + fido_cbor_info_certs_len;
    + fido_cbor_info_certs_name_ptr;
    + fido_cbor_info_certs_value_ptr;
    + fido_cbor_info_maxrpid_minpinlen;
    + fido_cbor_info_minpinlen;
    + fido_cbor_info_new_pin_required;
    + fido_cbor_info_rk_remaining;
    + fido_cbor_info_uv_attempts;
    + fido_cbor_info_uv_modality.
  * Documentation and reliability fixes.
- Version 1.11.0 (2022-05-03)
  * Experimental PCSC support; enable with -DUSE_PCSC.
  * Improved OpenSSL 3.0 compatibility.
  * Use RFC1951 raw deflate to compress CTAP 2.1 largeBlobs.
  * winhello: advertise "uv" instead of "clientPin".
  * winhello: support hmac-secret in fido_dev_get_assert().
  * New API calls:
    + fido_cbor_info_maxlargeblob.
  * Documentation and reliability fixes.
  * Separate build and regress targets.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1677240000">- Version 1.13.0 (2023-02-20)
  * Support for linking against OpenSSL on Windows; gh#668.
  * New API calls:
    + fido_assert_empty_allow_list;
    + fido_cred_empty_exclude_list.
  * fido2-token: fix issue when listing large blobs.
  * Improved support for different fuzzing engines.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1700308800">- update to 1.14.0:
  * fido2-cred -M, fido2-token -G: support raw client data
    via -w flag.
  * New API calls:
  * * fido_assert_authdata_raw_len;
  * * fido_assert_authdata_raw_ptr;
  * * fido_assert_set_winhello_appid.
- add keyring for gpg validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.15.0:
  * bio, credman: improved CTAP 2.1 support.
  * hid_osx: fix issue where fido_hid_read() may block
    unnecessarily; gh#757.
  * fido2-token -I: print maxcredbloblen.
  * hid_linux: improved support for uhid devices.
  * New API calls:
  - fido_cred_set_attobj;
  - fido_cred_x5c_list_count;
  - fido_cred_x5c_list_len;
  - fido_cred_x5c_list_ptr.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1767355200">- update to 1.16.0:
  * Added support for enterprise attestation.
  * Improved handling of invalid key handles in U2F key
    lookup; gh#819.
  * Fixed issue where storing small CTAP 2.1 largeBlobs
    failed; gh#826.
  * Fixed APDU chaining issues for certain authenticators;
    gh#818, gh#855.
  * Improved documentation and examples.
  * New API calls:
  - fido_cred_entattest;
  - fido_cred_set_entattest.</changelog>
</package>
<package pkgid="b1924a17bd83f1ad75dde84b59150647f89101d9a4b822e72f8759df6352af874aaa96817beb4c6120325904eeedd840d3f6c574a7345233d36f698bb17e5ef3" name="libfido2-udev" arch="noarch">
  <version epoch="0" ver="1.16.0" rel="55.7"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1631620800">- Update to version 1.8.0:
  * Dropped 'Requires.private' entry from pkg-config file.
  * Better support for FIDO 2.1 authenticators.
  * Support for Windows's native webauthn API.
  * Support for attestation format 'none'.
  * New API calls:
  - fido_assert_set_clientdata;
  - fido_cbor_info_algorithm_cose;
  - fido_cbor_info_algorithm_count;
  - fido_cbor_info_algorithm_type;
  - fido_cbor_info_transports_len;
  - fido_cbor_info_transports_ptr;
  - fido_cred_set_clientdata;
  - fido_cred_set_id;
  - fido_credman_set_dev_rk;
  - fido_dev_is_winhello.
  * fido2-token: new -Sc option to update a resident credential.
  * Documentation and reliability fixes.
  * HID access serialisation on Linux.
- disable fix-cmake-linking.patch, not needed currently</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1632225600">- Removed fix-cmake-linking.patch because no longer needed</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1635768000">- Version 1.9.0 (2021-10-27)
  * Enabled NFC support on Linux.
  * Added OpenSSL 3.0 compatibility.
  * Removed OpenSSL 1.0 compatibility.
  * Support for FIDO 2.1 "minPinLength" extension.
  * Support for COSE_EDDSA, COSE_ES256, and COSE_RS1 attestation.
  * Support for TPM 2.0 attestation.
  * Support for device timeouts; see fido_dev_set_timeout().
  * New API calls:
  - es256_pk_from_EVP_PKEY;
  - fido_cred_attstmt_len;
  - fido_cred_attstmt_ptr;
  - fido_cred_pin_minlen;
  - fido_cred_set_attstmt;
  - fido_cred_set_pin_minlen;
  - fido_dev_set_pin_minlen_rpid;
  - fido_dev_set_timeout;
  - rs256_pk_from_EVP_PKEY.
  * Reliability and portability fixes.
  * Better handling of HID devices without identification strings; gh#381.
  * Fixed detection of Windows’s native webauthn API; gh#382.</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1641816000">- Use BuildRequires: openssl-devel instead of forcing 1.1 since 3.x
  is now supported.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1648468800">- Version 1.10.0 (2022-01-17)
  * hid_osx: handle devices with paths &gt; 511 bytes; gh#462.
  * bio: fix CTAP2 canonical CBOR encoding in fido_bio_dev_enroll_*(); gh#480.
  * winhello: fallback to GetTopWindow() if GetForegroundWindow() fails.
  * winhello: fallback to hid_win.c if webauthn.dll isn’t available.
  * New API calls:
  - fido_dev_info_set;
  - fido_dev_io_handle;
  - fido_dev_new_with_info;
  - fido_dev_open_with_info.
  * Cygwin and NetBSD build fixes.
  * Documentation and reliability fixes.
  * Support for TPM 2.0 attestation of COSE_ES256 credentials.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1664971200">- Version 1.12.0 (2022-09-22)
  * Support for COSE_ES384.
  * Support for hidraw(4) on FreeBSD; gh#597.
  * Improved support for FIDO 2.1 authenticators.
  * New API calls:
    + es384_pk_free;
    + es384_pk_from_EC_KEY;
    + es384_pk_from_EVP_PKEY;
    + es384_pk_from_ptr;
    + es384_pk_new;
    + es384_pk_to_EVP_PKEY;
    + fido_cbor_info_certs_len;
    + fido_cbor_info_certs_name_ptr;
    + fido_cbor_info_certs_value_ptr;
    + fido_cbor_info_maxrpid_minpinlen;
    + fido_cbor_info_minpinlen;
    + fido_cbor_info_new_pin_required;
    + fido_cbor_info_rk_remaining;
    + fido_cbor_info_uv_attempts;
    + fido_cbor_info_uv_modality.
  * Documentation and reliability fixes.
- Version 1.11.0 (2022-05-03)
  * Experimental PCSC support; enable with -DUSE_PCSC.
  * Improved OpenSSL 3.0 compatibility.
  * Use RFC1951 raw deflate to compress CTAP 2.1 largeBlobs.
  * winhello: advertise "uv" instead of "clientPin".
  * winhello: support hmac-secret in fido_dev_get_assert().
  * New API calls:
    + fido_cbor_info_maxlargeblob.
  * Documentation and reliability fixes.
  * Separate build and regress targets.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1677240000">- Version 1.13.0 (2023-02-20)
  * Support for linking against OpenSSL on Windows; gh#668.
  * New API calls:
    + fido_assert_empty_allow_list;
    + fido_cred_empty_exclude_list.
  * fido2-token: fix issue when listing large blobs.
  * Improved support for different fuzzing engines.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1700308800">- update to 1.14.0:
  * fido2-cred -M, fido2-token -G: support raw client data
    via -w flag.
  * New API calls:
  * * fido_assert_authdata_raw_len;
  * * fido_assert_authdata_raw_ptr;
  * * fido_assert_set_winhello_appid.
- add keyring for gpg validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.15.0:
  * bio, credman: improved CTAP 2.1 support.
  * hid_osx: fix issue where fido_hid_read() may block
    unnecessarily; gh#757.
  * fido2-token -I: print maxcredbloblen.
  * hid_linux: improved support for uhid devices.
  * New API calls:
  - fido_cred_set_attobj;
  - fido_cred_x5c_list_count;
  - fido_cred_x5c_list_len;
  - fido_cred_x5c_list_ptr.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1767355200">- update to 1.16.0:
  * Added support for enterprise attestation.
  * Improved handling of invalid key handles in U2F key
    lookup; gh#819.
  * Fixed issue where storing small CTAP 2.1 largeBlobs
    failed; gh#826.
  * Fixed APDU chaining issues for certain authenticators;
    gh#818, gh#855.
  * Improved documentation and examples.
  * New API calls:
  - fido_cred_entattest;
  - fido_cred_set_entattest.</changelog>
</package>
<package pkgid="e32c3c5215dad6a185243783993263c6dacef93442d9d1cf163f506363ed00cbc05b5893cd4f5c93c4f7b87134b1edffa843dbe5b1f2fd02c2bab6a79b3cd5f6" name="libfido2-utils" arch="s390x">
  <version epoch="0" ver="1.16.0" rel="55.7"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1631620800">- Update to version 1.8.0:
  * Dropped 'Requires.private' entry from pkg-config file.
  * Better support for FIDO 2.1 authenticators.
  * Support for Windows's native webauthn API.
  * Support for attestation format 'none'.
  * New API calls:
  - fido_assert_set_clientdata;
  - fido_cbor_info_algorithm_cose;
  - fido_cbor_info_algorithm_count;
  - fido_cbor_info_algorithm_type;
  - fido_cbor_info_transports_len;
  - fido_cbor_info_transports_ptr;
  - fido_cred_set_clientdata;
  - fido_cred_set_id;
  - fido_credman_set_dev_rk;
  - fido_dev_is_winhello.
  * fido2-token: new -Sc option to update a resident credential.
  * Documentation and reliability fixes.
  * HID access serialisation on Linux.
- disable fix-cmake-linking.patch, not needed currently</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1632225600">- Removed fix-cmake-linking.patch because no longer needed</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1635768000">- Version 1.9.0 (2021-10-27)
  * Enabled NFC support on Linux.
  * Added OpenSSL 3.0 compatibility.
  * Removed OpenSSL 1.0 compatibility.
  * Support for FIDO 2.1 "minPinLength" extension.
  * Support for COSE_EDDSA, COSE_ES256, and COSE_RS1 attestation.
  * Support for TPM 2.0 attestation.
  * Support for device timeouts; see fido_dev_set_timeout().
  * New API calls:
  - es256_pk_from_EVP_PKEY;
  - fido_cred_attstmt_len;
  - fido_cred_attstmt_ptr;
  - fido_cred_pin_minlen;
  - fido_cred_set_attstmt;
  - fido_cred_set_pin_minlen;
  - fido_dev_set_pin_minlen_rpid;
  - fido_dev_set_timeout;
  - rs256_pk_from_EVP_PKEY.
  * Reliability and portability fixes.
  * Better handling of HID devices without identification strings; gh#381.
  * Fixed detection of Windows’s native webauthn API; gh#382.</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1641816000">- Use BuildRequires: openssl-devel instead of forcing 1.1 since 3.x
  is now supported.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1648468800">- Version 1.10.0 (2022-01-17)
  * hid_osx: handle devices with paths &gt; 511 bytes; gh#462.
  * bio: fix CTAP2 canonical CBOR encoding in fido_bio_dev_enroll_*(); gh#480.
  * winhello: fallback to GetTopWindow() if GetForegroundWindow() fails.
  * winhello: fallback to hid_win.c if webauthn.dll isn’t available.
  * New API calls:
  - fido_dev_info_set;
  - fido_dev_io_handle;
  - fido_dev_new_with_info;
  - fido_dev_open_with_info.
  * Cygwin and NetBSD build fixes.
  * Documentation and reliability fixes.
  * Support for TPM 2.0 attestation of COSE_ES256 credentials.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1664971200">- Version 1.12.0 (2022-09-22)
  * Support for COSE_ES384.
  * Support for hidraw(4) on FreeBSD; gh#597.
  * Improved support for FIDO 2.1 authenticators.
  * New API calls:
    + es384_pk_free;
    + es384_pk_from_EC_KEY;
    + es384_pk_from_EVP_PKEY;
    + es384_pk_from_ptr;
    + es384_pk_new;
    + es384_pk_to_EVP_PKEY;
    + fido_cbor_info_certs_len;
    + fido_cbor_info_certs_name_ptr;
    + fido_cbor_info_certs_value_ptr;
    + fido_cbor_info_maxrpid_minpinlen;
    + fido_cbor_info_minpinlen;
    + fido_cbor_info_new_pin_required;
    + fido_cbor_info_rk_remaining;
    + fido_cbor_info_uv_attempts;
    + fido_cbor_info_uv_modality.
  * Documentation and reliability fixes.
- Version 1.11.0 (2022-05-03)
  * Experimental PCSC support; enable with -DUSE_PCSC.
  * Improved OpenSSL 3.0 compatibility.
  * Use RFC1951 raw deflate to compress CTAP 2.1 largeBlobs.
  * winhello: advertise "uv" instead of "clientPin".
  * winhello: support hmac-secret in fido_dev_get_assert().
  * New API calls:
    + fido_cbor_info_maxlargeblob.
  * Documentation and reliability fixes.
  * Separate build and regress targets.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1677240000">- Version 1.13.0 (2023-02-20)
  * Support for linking against OpenSSL on Windows; gh#668.
  * New API calls:
    + fido_assert_empty_allow_list;
    + fido_cred_empty_exclude_list.
  * fido2-token: fix issue when listing large blobs.
  * Improved support for different fuzzing engines.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1700308800">- update to 1.14.0:
  * fido2-cred -M, fido2-token -G: support raw client data
    via -w flag.
  * New API calls:
  * * fido_assert_authdata_raw_len;
  * * fido_assert_authdata_raw_ptr;
  * * fido_assert_set_winhello_appid.
- add keyring for gpg validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.15.0:
  * bio, credman: improved CTAP 2.1 support.
  * hid_osx: fix issue where fido_hid_read() may block
    unnecessarily; gh#757.
  * fido2-token -I: print maxcredbloblen.
  * hid_linux: improved support for uhid devices.
  * New API calls:
  - fido_cred_set_attobj;
  - fido_cred_x5c_list_count;
  - fido_cred_x5c_list_len;
  - fido_cred_x5c_list_ptr.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1767355200">- update to 1.16.0:
  * Added support for enterprise attestation.
  * Improved handling of invalid key handles in U2F key
    lookup; gh#819.
  * Fixed issue where storing small CTAP 2.1 largeBlobs
    failed; gh#826.
  * Fixed APDU chaining issues for certain authenticators;
    gh#818, gh#855.
  * Improved documentation and examples.
  * New API calls:
  - fido_cred_entattest;
  - fido_cred_set_entattest.</changelog>
</package>
<package pkgid="63c904eda023164c27a1316b6d3688119c15feeeccd282903cae8948ec3d3b2f06a615d3035e5463fb04d788ec0d4037985b4999799c4523855577f2b7c7c8f2" name="libfido2-utils-debuginfo" arch="s390x">
  <version epoch="0" ver="1.16.0" rel="55.7"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1631620800">- Update to version 1.8.0:
  * Dropped 'Requires.private' entry from pkg-config file.
  * Better support for FIDO 2.1 authenticators.
  * Support for Windows's native webauthn API.
  * Support for attestation format 'none'.
  * New API calls:
  - fido_assert_set_clientdata;
  - fido_cbor_info_algorithm_cose;
  - fido_cbor_info_algorithm_count;
  - fido_cbor_info_algorithm_type;
  - fido_cbor_info_transports_len;
  - fido_cbor_info_transports_ptr;
  - fido_cred_set_clientdata;
  - fido_cred_set_id;
  - fido_credman_set_dev_rk;
  - fido_dev_is_winhello.
  * fido2-token: new -Sc option to update a resident credential.
  * Documentation and reliability fixes.
  * HID access serialisation on Linux.
- disable fix-cmake-linking.patch, not needed currently</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1632225600">- Removed fix-cmake-linking.patch because no longer needed</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1635768000">- Version 1.9.0 (2021-10-27)
  * Enabled NFC support on Linux.
  * Added OpenSSL 3.0 compatibility.
  * Removed OpenSSL 1.0 compatibility.
  * Support for FIDO 2.1 "minPinLength" extension.
  * Support for COSE_EDDSA, COSE_ES256, and COSE_RS1 attestation.
  * Support for TPM 2.0 attestation.
  * Support for device timeouts; see fido_dev_set_timeout().
  * New API calls:
  - es256_pk_from_EVP_PKEY;
  - fido_cred_attstmt_len;
  - fido_cred_attstmt_ptr;
  - fido_cred_pin_minlen;
  - fido_cred_set_attstmt;
  - fido_cred_set_pin_minlen;
  - fido_dev_set_pin_minlen_rpid;
  - fido_dev_set_timeout;
  - rs256_pk_from_EVP_PKEY.
  * Reliability and portability fixes.
  * Better handling of HID devices without identification strings; gh#381.
  * Fixed detection of Windows’s native webauthn API; gh#382.</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1641816000">- Use BuildRequires: openssl-devel instead of forcing 1.1 since 3.x
  is now supported.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1648468800">- Version 1.10.0 (2022-01-17)
  * hid_osx: handle devices with paths &gt; 511 bytes; gh#462.
  * bio: fix CTAP2 canonical CBOR encoding in fido_bio_dev_enroll_*(); gh#480.
  * winhello: fallback to GetTopWindow() if GetForegroundWindow() fails.
  * winhello: fallback to hid_win.c if webauthn.dll isn’t available.
  * New API calls:
  - fido_dev_info_set;
  - fido_dev_io_handle;
  - fido_dev_new_with_info;
  - fido_dev_open_with_info.
  * Cygwin and NetBSD build fixes.
  * Documentation and reliability fixes.
  * Support for TPM 2.0 attestation of COSE_ES256 credentials.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1664971200">- Version 1.12.0 (2022-09-22)
  * Support for COSE_ES384.
  * Support for hidraw(4) on FreeBSD; gh#597.
  * Improved support for FIDO 2.1 authenticators.
  * New API calls:
    + es384_pk_free;
    + es384_pk_from_EC_KEY;
    + es384_pk_from_EVP_PKEY;
    + es384_pk_from_ptr;
    + es384_pk_new;
    + es384_pk_to_EVP_PKEY;
    + fido_cbor_info_certs_len;
    + fido_cbor_info_certs_name_ptr;
    + fido_cbor_info_certs_value_ptr;
    + fido_cbor_info_maxrpid_minpinlen;
    + fido_cbor_info_minpinlen;
    + fido_cbor_info_new_pin_required;
    + fido_cbor_info_rk_remaining;
    + fido_cbor_info_uv_attempts;
    + fido_cbor_info_uv_modality.
  * Documentation and reliability fixes.
- Version 1.11.0 (2022-05-03)
  * Experimental PCSC support; enable with -DUSE_PCSC.
  * Improved OpenSSL 3.0 compatibility.
  * Use RFC1951 raw deflate to compress CTAP 2.1 largeBlobs.
  * winhello: advertise "uv" instead of "clientPin".
  * winhello: support hmac-secret in fido_dev_get_assert().
  * New API calls:
    + fido_cbor_info_maxlargeblob.
  * Documentation and reliability fixes.
  * Separate build and regress targets.</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1677240000">- Version 1.13.0 (2023-02-20)
  * Support for linking against OpenSSL on Windows; gh#668.
  * New API calls:
    + fido_assert_empty_allow_list;
    + fido_cred_empty_exclude_list.
  * fido2-token: fix issue when listing large blobs.
  * Improved support for different fuzzing engines.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1700308800">- update to 1.14.0:
  * fido2-cred -M, fido2-token -G: support raw client data
    via -w flag.
  * New API calls:
  * * fido_assert_authdata_raw_len;
  * * fido_assert_authdata_raw_ptr;
  * * fido_assert_set_winhello_appid.
- add keyring for gpg validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.15.0:
  * bio, credman: improved CTAP 2.1 support.
  * hid_osx: fix issue where fido_hid_read() may block
    unnecessarily; gh#757.
  * fido2-token -I: print maxcredbloblen.
  * hid_linux: improved support for uhid devices.
  * New API calls:
  - fido_cred_set_attobj;
  - fido_cred_x5c_list_count;
  - fido_cred_x5c_list_len;
  - fido_cred_x5c_list_ptr.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1767355200">- update to 1.16.0:
  * Added support for enterprise attestation.
  * Improved handling of invalid key handles in U2F key
    lookup; gh#819.
  * Fixed issue where storing small CTAP 2.1 largeBlobs
    failed; gh#826.
  * Fixed APDU chaining issues for certain authenticators;
    gh#818, gh#855.
  * Improved documentation and examples.
  * New API calls:
  - fido_cred_entattest;
  - fido_cred_set_entattest.</changelog>
</package>
<package pkgid="76cae29944a40458787f4c946f1a94ef1d15b90e8163182bef19285c130b85fef1d4f2eb58747494b1548e9cb7246b9706dd960ced7c6805206f9d0bbac93dde" name="libfipscheck1" arch="s390x">
  <version epoch="0" ver="1.7.0" rel="47.44"/>
  <changelog author="meissner@suse.com" date="1401710400">- add baselibs.conf</changelog>
  <changelog author="jengelh@inai.de" date="1428926400">- Set RPM groups anew. Drop implicit cleaning parts.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497268800">- Port to OpenSSL 1.1 (bsc#1042649)
  Adds openssl-1_1-port.patch</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1536667200">- Updated fipscheck to 1.5.0
  * Changed source to local file since latest official release
    is not in the official releases directory.
  * Downgraded libopenssl-devel to libopenssl-1_0_0-devel because
    1.0.2 supports FIPS.</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1537444800">- Changed source back to http now that current release folder
  has current tarball.</changelog>
  <changelog author="V&#xED;t&#x11B;zslav &#x10C;&#xED;&#x17E;ek &lt;vcizek@suse.com&gt;" date="1546516800">- Use the shipped manpages instead of building them with xmlto
  in order to avoid a build cycle (fipscheck, xmlto, libxslt, libgcrypt)
  * add fipscheck-dont_generate_manpages.patch
- fix build on older distributions</changelog>
  <changelog author="V&#xED;t&#x11B;zslav &#x10C;&#xED;&#x17E;ek &lt;vcizek@suse.com&gt;" date="1568635200">- Remove #include of unused fips.h to fix build with OpenSSL 1.1.1
  (bsc#1149792)
  * add fipscheck-fips.h_not_needed.patch
- Drop obsolete openssl-1_1-port.patch (upstream)</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1605873600">- move libs to %_libdir (boo#1029961)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1667390400">- updated to 1.7.0 (from a different supplier)
  - openssl 3 support
- dropped fipscheck-dont_generate_manpages.patch (not needed)
- dropped fipscheck-fips.h_not_needed.patch (not needed)</changelog>
  <changelog author="Martin Jambor &lt;mjambor@suse.com&gt;" date="1720440000">- Backport upstream patches fipscheck-fix_check_openssl_version.patch
  and fipscheck-fix_incorrect_length_type.patch to fix C99 violations
  which are errors by default with GCC 14 [boo#1221714] - although the
  first one looks like it possibly fixes some more substantial error.</changelog>
</package>
<package pkgid="0b56615fe28a3413a2406152df7d8db8ec4fafc87c2d4bb970c84cca400c6edcd62af9c0e91a9a66fe54b48fe31379ce788bec925bd975ab8808473b65b37c0a" name="libfipscheck1-debuginfo" arch="s390x">
  <version epoch="0" ver="1.7.0" rel="47.44"/>
  <changelog author="meissner@suse.com" date="1401710400">- add baselibs.conf</changelog>
  <changelog author="jengelh@inai.de" date="1428926400">- Set RPM groups anew. Drop implicit cleaning parts.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1497268800">- Port to OpenSSL 1.1 (bsc#1042649)
  Adds openssl-1_1-port.patch</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1536667200">- Updated fipscheck to 1.5.0
  * Changed source to local file since latest official release
    is not in the official releases directory.
  * Downgraded libopenssl-devel to libopenssl-1_0_0-devel because
    1.0.2 supports FIPS.</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1537444800">- Changed source back to http now that current release folder
  has current tarball.</changelog>
  <changelog author="V&#xED;t&#x11B;zslav &#x10C;&#xED;&#x17E;ek &lt;vcizek@suse.com&gt;" date="1546516800">- Use the shipped manpages instead of building them with xmlto
  in order to avoid a build cycle (fipscheck, xmlto, libxslt, libgcrypt)
  * add fipscheck-dont_generate_manpages.patch
- fix build on older distributions</changelog>
  <changelog author="V&#xED;t&#x11B;zslav &#x10C;&#xED;&#x17E;ek &lt;vcizek@suse.com&gt;" date="1568635200">- Remove #include of unused fips.h to fix build with OpenSSL 1.1.1
  (bsc#1149792)
  * add fipscheck-fips.h_not_needed.patch
- Drop obsolete openssl-1_1-port.patch (upstream)</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1605873600">- move libs to %_libdir (boo#1029961)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1667390400">- updated to 1.7.0 (from a different supplier)
  - openssl 3 support
- dropped fipscheck-dont_generate_manpages.patch (not needed)
- dropped fipscheck-fips.h_not_needed.patch (not needed)</changelog>
  <changelog author="Martin Jambor &lt;mjambor@suse.com&gt;" date="1720440000">- Backport upstream patches fipscheck-fix_check_openssl_version.patch
  and fipscheck-fix_incorrect_length_type.patch to fix C99 violations
  which are errors by default with GCC 14 [boo#1221714] - although the
  first one looks like it possibly fixes some more substantial error.</changelog>
</package>
<package pkgid="83c61f3706f01e28f3d084e6b6898f39c67b8996cdcebcee71056c2bdcf7a036afeae9dddcb83466562cdba858220801675eb5564d20dbbfa7402524b0fca081" name="libfreshclam2" arch="s390x">
  <version epoch="0" ver="0.103.11" rel="5.5"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612612800">- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612872000">- Don't daemonize freshclam, but use a systemd timer instead to
  trigger updates
  + timer.freshclam
  % service.freshclam
  % clamav-conf.patch
- Remove obsolete patch (replaced by SOURCE_DATE_EPOCH)
  - clamav-disable-timestamps.patch
- Fix unit test
  + clamav-ck_assert_msg.patch
- Cleanup spec
  * use pkgconfig() to resolve BuildRequires where upstream uses it
  * rework creating vscan user (new system-user in Tumbleweed)
  * remove obsolete configure option --disable-zlib-vcheck</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1614254400">- Package clamav-milter in a subpackage
- Remove virus signatures upon uninstall
- Check for database existence before starting clamd
- Restart clamd when it exits</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1617796800">- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
- Update package signing key (from https://www.clamav.net/downloads)
  % clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1617969600">- Use a split-provides for clamav-milter instead of recommending it.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1635940800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1641988800">- Update to 0.103.5
  * CVE-2022-20698: Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https source urls</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1651752000">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1659700800">- Update to 0.103.7
  - Zip parser: tolerate 2-byte overlap in file entries
  - Fix bug with logical signature Intermediates feature
  - Update to UnRAR v6.1.7
  - Patch UnRAR: allow skipping files in solid archives
  - Patch UnRAR: limit dict winsize to 1GB</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1676462400">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.
- Package huge .html documentation in a separate subpackage.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1692187200">- Update to 0.103.9
  * CVE-2023-20197: Fixed a possible denial of service vulnerability in
    the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through
    1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8
    through 0.103.0. (boo#1214342)
  * Fixed compiler warnings that may turn into errors in Clang 16.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1692360000">- Renew clamav.keyring .</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1698235200">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1711368000">- Rename the package to clamav0 to make way for the 1.x package.</changelog>
</package>
<package pkgid="bcf9541834ad77dcd9cdeffe081a684b01459f5b0b74e79fa1e53e51308ccfd530c2097ee1f1333e482b07f00df0a42bc3ddb6660073cfaa474042ae6f974e35" name="libfreshclam2-debuginfo" arch="s390x">
  <version epoch="0" ver="0.103.11" rel="5.5"/>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612612800">- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1612872000">- Don't daemonize freshclam, but use a systemd timer instead to
  trigger updates
  + timer.freshclam
  % service.freshclam
  % clamav-conf.patch
- Remove obsolete patch (replaced by SOURCE_DATE_EPOCH)
  - clamav-disable-timestamps.patch
- Fix unit test
  + clamav-ck_assert_msg.patch
- Cleanup spec
  * use pkgconfig() to resolve BuildRequires where upstream uses it
  * rework creating vscan user (new system-user in Tumbleweed)
  * remove obsolete configure option --disable-zlib-vcheck</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1614254400">- Package clamav-milter in a subpackage
- Remove virus signatures upon uninstall
- Check for database existence before starting clamd
- Restart clamd when it exits</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1617796800">- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
- Update package signing key (from https://www.clamav.net/downloads)
  % clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1617969600">- Use a split-provides for clamav-milter instead of recommending it.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1624276800">- bsc#1188284: Update to 0.103.3
  * Fixed a scan performance issue when ENGINE_OPTIONS_FORCE_TO_DISK is
    enabled. This issue did not impacted most users but for those
    affected it caused every scanned file to be copied to the temp
    directory before the scan.
  * Fix ClamDScan crashes when using the --fdpass --multiscan
    command-line options in combination with the ClamD ExcludePath
    config file options.
  * Fixed an issue where the mirrors.dat file is owned by root when
    starting as root (or with sudo) and using daemon-mode. File
    ownership will be set to the DatabaseOwner just before FreshClam
    switches to run as that user.
  * Renamed the mirrors.dat file to freshclam.dat.
  * Disabled the HTTPUserAgent config option if the DatabaseMirror uses
    clamav.net. This will prevent users from being inadvertently blocked
    and will ensure that we can keep better metrics on which ClamAV
    versions are being used.
  * Moved the detection for Heuristics.PNG.CVE-2010-1205 behind the
    ClamScan --alert-broken-media option (ClamD AlertBrokenMedia yes)
    option. This type of PNG issue appears to be common enough to be an
    annoyance, and the CVE is old enough that no one should be
    vulnerable at this point.
  * Fix ClamSubmit failures after changes to Cloudflare "__cfduid"
    cookies. See: https://blog.cloudflare.com/deprecating-cfduid-cookie/</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1635940800">- bsc#1192346: Update to 0.103.4
  * FreshClam:
  - Add a 24-hour cool-down for FreshClam clients that have received
    an HTTP 403 (Forbidden) response from the CDN. This is to reduce
    the volume of 403-response data served to blocked FreshClam
    clients that are configured with a tight update-loop.
  - Fixed a bug where FreshClam treats an empty CDIFF as an
    incremental update failure instead of as an intentional request
    to download the whole CVD.
  * ClamDScan: Fix a scan error when broken symlinks are encountered on
    macOS with "FollowDirectorySymlinks" and "FollowFileSymlinks"
    options disabled.
  * Overhauled the scan recursion / nested archive extraction logic and
    added new limits on embedded file-type recognition performed during
    the "raw" scan of each file. This limits embedded file-type
    misidentification and prevents detecting embedded file content that
    is found/extracted and scanned at other layers in the scanning
    process.
  * Fix an issue with the FMap module that failed to read from some
    nested files.
  * Fixed an issue where failing to load some rules from a Yara file
    containing multiple rules may cause a crash.
  * Fixed assorted compiler warnings.
  * Fixed assorted Coverity static code analysis issues.
  * Scan limits:
  - Added virus-name suffixes to the alerts that trigger when a scan
    limit has been exceeded. Rather than simply
    Heuristics.Limits.Exceeded, you may now see limit-specific
    virus-names, to include:
    + Heuristics.Limits.Exceeded.MaxFileSize
    + Heuristics.Limits.Exceeded.MaxScanSize
    + Heuristics.Limits.Exceeded.MaxFiles
    + Heuristics.Limits.Exceeded.MaxRecursion
    + Heuristics.Limits.Exceeded.MaxScanTime
  - Renamed the Heuristics.Email.ExceedsMax.* alerts to align with
    the other limit alerts names. These alerts include:
    + Heuristics.Limits.Exceeded.EmailLineFoldcnt
    + Heuristics.Limits.Exceeded.EmailHeaderBytes
    + Heuristics.Limits.Exceeded.EmailHeaders
    + Heuristics.Limits.Exceeded.EmailMIMEPartsPerMessage
    + Heuristics.Limits.Exceeded.EmailMIMEArguments
  - Fixed an issue where the Email-related scan limits would alert
    even when the "AlertExceedsMax" (--alert-exceeds-max) scan option
    is not enabled.
  - Fixes an issue in the Zip parser where exceeding the "MaxFiles"
    limit or the "MaxFileSize" limit would abort the scan but would
    fail to alert. The Zip scan limit issues were independently
    identified and reported by Aaron Leliaert and Max Allan.
  * Fixed a leak in the Email parser when using the --gen-json scan
    option.
  * Fixed an issue where a failure to record metadata in the Email
    parser when using the --gen-json scan option could cause the Email
    parser to abort the scan early and fail to extract and scan
    additional content.
  * Fixed a file name memory leak in the Zip parser.
  * Fixed an issue where certain signature patterns may cause a crash or
    cause unintended matches on some systems when converting characters
    to uppercase if a UTF-8 unicode single-byte grapheme becomes a
    multi-byte grapheme. Patch courtesy of Andrea De Pasquale.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1641988800">- Update to 0.103.5
  * CVE-2022-20698: Fix for invalid pointer read that may cause a crash.
    This issue affects 0.104.1, 0.103.4 and prior when ClamAV is compiled
    with libjson-c and the CL_SCAN_GENERAL_COLLECT_METADATA scan option
    (the clamscan --gen-json option) is enabled.
  * Fixed ability to disable the file size limit with libclamav C API,
    like this:
    cl_engine_set_num(engine, CL_ENGINE_MAX_FILESIZE, 0);
    This issue didn't affect ClamD or ClamScan which also can disable the
    limit by setting it to zero using MaxFileSize 0 in clamd.conf for ClamD,
    or clamscan --max-filesize=0 for ClamScan.
    Note: Internally, the max file size is still set to 2 GiB. Disabling the
    limit for a scan will fall back on the internal 2 GiB limitation.
  * Increased the maximum line length for ClamAV config files from 512 bytes
    to 1,024 bytes to allow for longer config option strings.
  * SigTool: Fix insufficient buffer size for --list-sigs that caused a
    failure when listing a database containing one or more very long
    signatures. This fix was backported from 0.104.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https source urls</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1651752000">- Update to 0.103.6
  * CVE-2022-20770: Fixed a possible infinite loop vulnerability in the CHM
    file parser. Issue affects versions 0.104.0 through 0.104.2 and LTS
    version 0.103.5 and prior versions. (boo#1199242)
  * CVE-2022-20796: Fixed a possible NULL-pointer dereference crash in the
    scan verdict cache check. Issue affects versions 0.103.4, 0.103.5,
    0.104.1, and 0.104.2. (boo#1199246)
  * CVE-2022-20771: Fixed a possible infinite loop vulnerability in the
    TIFF file parser. Issue affects versions 0.104.0 through 0.104.2 and
    LTS version 0.103.5 and prior versions. The issue only occurs if the
    "--alert-broken-media" ClamScan option is enabled. For ClamD, the
    affected option is "AlertBrokenMedia yes", and for libclamav it is the
    "CL_SCAN_HEURISTIC_BROKEN_MEDIA" scan option. (boo#1199244)
  * CVE-2022-20785: Fixed a possible memory leak in the HTML file parser /
    Javascript normalizer. Issue affects versions 0.104.0 through 0.104.2
    and LTS version 0.103.5 and prior versions. (boo#1199245)
  * CVE-2022-20792: Fixed a possible multi-byte heap buffer overflow write
    vulnerability in the signature database load module. The fix was to
    update the vendored regex library to the latest version. Issue affects
    versions 0.104.0 through 0.104.2 and LTS version 0.103.5 and prior
    versions. (boo#1199274)
  * ClamOnAcc: Fixed a number of assorted stability issues and added
    niceties for debugging ClamOnAcc.
  * Fixed an issue causing byte-compare subsignatures to cause an alert
    when they match even if other conditions of the given logical
    signatures were not met.
  * Fix memleak when using multiple byte-compare subsignatures. This fix
    was backported from 0.104.0.
  * Assorted bug fixes and improvements.
- Remove upstreamed clamav-ck_assert_msg.patch</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1659700800">- Update to 0.103.7
  - Zip parser: tolerate 2-byte overlap in file entries
  - Fix bug with logical signature Intermediates feature
  - Update to UnRAR v6.1.7
  - Patch UnRAR: allow skipping files in solid archives
  - Patch UnRAR: limit dict winsize to 1GB</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1676462400">- Update to 0.103.8
  * CVE-2023-20032: Fixed a possible remote code execution vulnerability
    in the HFS+ file parser. Issue affects versions 1.0.0 and earlier,
    0.105.1 and earlier, and 0.103.7 and earlier. (bsc#1208363)
  * CVE-2023-20052: Fixed a possible remote information leak
    vulnerability in the DMG file parser. Issue affects versions 1.0.0
    and earlier, 0.105.1 and earlier, and 0.103.7 and earlier.
    (bsc#1208365)
  * Update vendored libmspack library to version 0.11alpha.
- Package huge .html documentation in a separate subpackage.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1692187200">- Update to 0.103.9
  * CVE-2023-20197: Fixed a possible denial of service vulnerability in
    the HFS+ file parser. This issue affects versions 1.1.0, 1.0.1 through
    1.0.0, 0.105.2 through 0.105.0, 0.104.4 through 0.104.0, and 0.103.8
    through 0.103.0. (boo#1214342)
  * Fixed compiler warnings that may turn into errors in Clang 16.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1692360000">- Renew clamav.keyring .</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1698235200">- Update to 0.103.11
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.12.
  * Windows: libjson-c 0.17 compatibility fix. with ssize_t type definition.
  * Windows: Update build system to use OpenSSL 3 and PThreads-Win32 v3.
- Update to 0.103.10
  * Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10.
    (bsc#1216625, CVE-2023-40477)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1711368000">- Rename the package to clamav0 to make way for the 1.x package.</changelog>
</package>
<package pkgid="b850a3c17b234c3e7b52bba732df80b378a430a5555a3ae32ac11b315ed648f998c5741e6478cb1631bdc6e14548ac1a2b1aa9d11b1cfd0080166eda12924ebc" name="libfreshclam4" arch="s390x">
  <version epoch="0" ver="1.5.4" rel="339.1"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1737633600">- Drop the version dependency on libcurl. Building against versions
  older than 7.45 does not fail anymore, but disables support for
  fdpassing in clamonacc. This only affects SLE-12 up to SP3.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1739188800">- bsc#1236949: Fix location of license files.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1742817600">- bsc#1239957: Build with PIE.
- Eliminate some UTF-8 NBSP characters from the changes file.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1748433600">- bsc#1243565: Add clamav-freshclam_test.patch to fix a race
  condition between the mockup servers started by different test
  cases in freshclam_test.py.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1750334400">- New version 1.4.3:
  ClamAV 1.4.3 is a patch release with the following fixes:
  * CVE-2025-20260, bsc#1245054: Fixed a possible buffer overflow
    write bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition or enable remote code
    execution. This issue only affects configurations where both:
  - The max file-size scan limit is set greater than or equal to 1024MB.
  - The max scan-size scan limit is set greater than or equal to 1025MB.
    The code flaw was present prior to version 1.0.0, but a change in
    version 1.0.0 that enables larger allocations based on untrusted data
    made it possible to trigger this bug.
    This issue affects all currently supported versions.
  * CVE-2025-20234, bsc#1245055: Fixed a possible buffer overflow
    read bug in the UDF file parser that may write to a temp file
    and thus disclose information, or it may crash and cause a
    denial-of-service (DoS) condition.
    This issue was introduced in version 1.2.0.
  * Fixed a possible use-after-free bug in the Xz decompression module in
    the bundled lzma-sdk library.
    This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a
    copy of the lzma-sdk with some performance changes specific to
    libclamav, plus select bug fixes like this one in lieu of a full
    upgrade to newer lzma-sdk.
    This issue affects all ClamAV versions at least as far back as 0.99.4.
  * Windows: Fixed a build install issue when a DLL dependency such as
    libcrypto has the exact same name as one provided by the Windows
    operating system.
- Renew clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1751284800">- bsc#1240363, clamav-disable-administrative-commands.patch: clamd:
  Add an option to toggle SHUTDOWN, RELOAD, STATS and VERSION.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1759924800">- New version 1.5.0:
  * Added checks to determine if an OLE2-based Microsoft Office
    document is encrypted.
  * Added the ability to record URIs found in HTML if the
    generate-JSON-metadata feature is enabled.
  * Added the ability to record URIs found in PDFs if the
    generate-JSON-metadata feature is enabled.
  * Added regex support for the clamd.conf OnAccessExcludePath
    config option.
  * Added CVD signing/verification with external .sign files.
  * Freshclam, ClamD, ClamScan, and Sigtool: Added an option to
    enable FIPS-like limits disabling MD5 and SHA1 from being used
    for verifying digital signatures or for being used to trust a
    file when checking for false positives (bsc#1221954).
  * ClamD: Added an option to disable select administrative
    commands including SHUTDOWN, RELOAD, STATS and VERSION.
  * libclamav: Added extended hashing functions with a "flags"
    parameter that allows the caller to choose if they want to
    bypass FIPS hash algorithm limits.
  * See the release announcement for the full list of changes:
    https://blog.clamav.net/2025/10/clamav-150-released.html
- Obsoleted patches:
  * clamav-freshclam_test.patch
  * clamav-disable-administrative-commands.patch
  * clamav-fips.patch
- Use macros for library versions
- Remove service symlinks: rcclamd, rcfreshclam, rcclamav-milter,
  and clamonacc.
- Use rust 1.86 for SLE-12 and SLE-15-SP2.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760443200">- Add json-c-json-c-0.18-20240915.tar.gz and link it statically
  into libclamav on SLE-12, because version 0.12 is too old.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760616000">- New version: 1.5.1:
  * Fixed a significant performance issue when scanning some PE
    files.
  * Fixed an issue recording file entries from a ZIP archive
    central directory which resulted in
    "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
    ClamScan --alert-exceeds-max command line option or ClamD
    AlertExceedsMax config file option.
  * Improved performance when scanning TNEF email attachments.
  * Fixed an issue with recording metadata for OOXML office
    documents.
  * Fixed an issue with signature matches for VBA in OLE2 office
    documents.
  * Loosened overly restrictive rules for embedded file
    identification and increased the limit for finding PE files
    embedded in other PE files.
  * Fixed an issue with extracting some RAR archives embedded in
    other files.
  * Fixed an issue with calculating fuzzy hashes affecting some
    images by updating the version for several Rust library
    dependencies.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1762257600">- Add clamav-workaround.patch to work around symbol removals in
  version 1.5.0 and 1.5.1.</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1763208000">- Build with older rust 1.87 for reproducible builds (boo#1249404)</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1763726400">- Provide a better fix for boo#1249404 by disabling debug mode.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1764331200">- Fix testsuite error on SLE-15-SP6 by falling back to rust1.86.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770724800">- jsc-PED-14819: Support transactional updates.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770984000">- bsc#1258072: Require main and library packages to be of the same
  version and release. Given that all the core functionality is
  in the libraries it makes little sense to update the main
  package alone.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1772712000">- New version 1.5.2:
  * bsc#1259207, CVE-2026-20031: Fixed an error handling bug in the
    HTML file parser that may crash the program and cause a
    denial-of-service (DoS) condition. This issue was introduced in
    version 1.1.0.
  * Fixed a possible infinite loop when scanning some JPEG files by
    upgrading affected ClamAV dependency, a Rust image library.
  * The CVD verification process will now ignore certificate files
    in the CVD certs directory when the user lacks read permissions.
  * Freshclam: Fix CLD verification bug with PrivateMirror option.
  * Upgraded the Rust bytes dependency to a newer version to
    resolve RUSTSEC-2026-0007 advisory.
  * Fixed a possible crash caused by invalid pointer alignment on
    some platforms.
  * Minimal required Rust version is now 1.87.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1773316800">- Disable build for 32 bit ix86 because of testsuite failures with
  rust &gt;= 1.87 that upstream is not planning to fix.
- Run the test suite on all SUSE releases.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1782907200">- update to 1.5.3
  ClamAV 1.5.3 is a patch release with the following fixes:
  * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
  * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
  * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
  * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
  * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
  * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
  * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
  * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
  * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
  * Metadata preclass scans now run before the final scan verdict.
  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1784894400">- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to
  fix path traversal vulnerability in OneNote parser.
- Add clamav-vendor-cve-2026-46671.tar.gz to provide the
  sanitise-file-name Rust crate required by the security fix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1786881600">- update to 1.5.4
  ClamAV 1.5.4 is a patch release with the following fixes:
  * CVE-2026-20337, bsc#1274597:
    Fixed ZIP catalogue capacity tracking that could write beyond a heap
    allocation while indexing local file headers.
  * CVE-2026-20345, bsc#1274600:
    Fixed an indexing error while converting GPT partition names that could
    read or write beyond a stack-allocated partition entry.
  * CVE-2026-20339, bsc#1274599:
    Fixed an integer overflow in the PESpin unpacker that could allocate an
    undersized buffer and then write beyond it while rebuilding a PE file.
  * CVE-2026-20338, bsc#1274598:
    Fixed ownership handling while merging ZIP catalogue records that could
    cause an invalid free while scanning a malformed archive.
  * CVE-2026-20346, bsc#1274601:
    Fixed an integer underflow in the PDF parser that could cause a crash while
    reading a malformed hex string.
  * CVE-2026-20347, bsc#1274602:
    Fixed undefined behavior and integer overflow in the Mach-O parser that
    could cause a crash while scanning a malformed Mach-O file.
  * CVE-2026-20348, bsc#1274603:
    Fixed XAR parser size handling that could request an excessive allocation
    or exceed scan limits while decompressing a malformed table of contents.
  * CVE-2025-8088:
    Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
    The fix rejects path separators in NTFS alternate data stream names to
    prevent extraction outside ClamAV's temporary scan directory on Windows.
  * Fixed thread-safety issues in the clamd STATS command that could disclose
    process memory or crash the daemon while scans and STATS requests run
    concurrently. Also fixed partial socket-write handling used for large STATS
    responses.
  * FreeBSD: Restored support for safe quarantine move and remove actions while
    preserving protection against source-path replacement races.
  * Fixed an OpenSSL library-context leak in legacy hashing helpers when a
    requested message digest cannot be fetched, such as when the default
    provider is unavailable in a FIPS-enabled environment.
  * Upgraded the Rust crossbeam-epoch dependency to resolve the
    RUSTSEC-2026-0204 advisory.</changelog>
</package>
<package pkgid="8feec042ee014d3199b3f3ef483f1e09fe69ac306f42e1d459e75fe0cfef22f0c01bd590c09d2c8a0751ce5e5abad40ffb376741fa132b3254e3e4311ba02d77" name="libfreshclam4-debuginfo" arch="s390x">
  <version epoch="0" ver="1.5.4" rel="339.1"/>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1737633600">- Drop the version dependency on libcurl. Building against versions
  older than 7.45 does not fail anymore, but disables support for
  fdpassing in clamonacc. This only affects SLE-12 up to SP3.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1739188800">- bsc#1236949: Fix location of license files.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1742817600">- bsc#1239957: Build with PIE.
- Eliminate some UTF-8 NBSP characters from the changes file.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1748433600">- bsc#1243565: Add clamav-freshclam_test.patch to fix a race
  condition between the mockup servers started by different test
  cases in freshclam_test.py.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1750334400">- New version 1.4.3:
  ClamAV 1.4.3 is a patch release with the following fixes:
  * CVE-2025-20260, bsc#1245054: Fixed a possible buffer overflow
    write bug in the PDF file parser that could cause a
    denial-of-service (DoS) condition or enable remote code
    execution. This issue only affects configurations where both:
  - The max file-size scan limit is set greater than or equal to 1024MB.
  - The max scan-size scan limit is set greater than or equal to 1025MB.
    The code flaw was present prior to version 1.0.0, but a change in
    version 1.0.0 that enables larger allocations based on untrusted data
    made it possible to trigger this bug.
    This issue affects all currently supported versions.
  * CVE-2025-20234, bsc#1245055: Fixed a possible buffer overflow
    read bug in the UDF file parser that may write to a temp file
    and thus disclose information, or it may crash and cause a
    denial-of-service (DoS) condition.
    This issue was introduced in version 1.2.0.
  * Fixed a possible use-after-free bug in the Xz decompression module in
    the bundled lzma-sdk library.
    This issue was fixed in the lzma-sdk version 18.03. ClamAV bundles a
    copy of the lzma-sdk with some performance changes specific to
    libclamav, plus select bug fixes like this one in lieu of a full
    upgrade to newer lzma-sdk.
    This issue affects all ClamAV versions at least as far back as 0.99.4.
  * Windows: Fixed a build install issue when a DLL dependency such as
    libcrypto has the exact same name as one provided by the Windows
    operating system.
- Renew clamav.keyring</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1751284800">- bsc#1240363, clamav-disable-administrative-commands.patch: clamd:
  Add an option to toggle SHUTDOWN, RELOAD, STATS and VERSION.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1759924800">- New version 1.5.0:
  * Added checks to determine if an OLE2-based Microsoft Office
    document is encrypted.
  * Added the ability to record URIs found in HTML if the
    generate-JSON-metadata feature is enabled.
  * Added the ability to record URIs found in PDFs if the
    generate-JSON-metadata feature is enabled.
  * Added regex support for the clamd.conf OnAccessExcludePath
    config option.
  * Added CVD signing/verification with external .sign files.
  * Freshclam, ClamD, ClamScan, and Sigtool: Added an option to
    enable FIPS-like limits disabling MD5 and SHA1 from being used
    for verifying digital signatures or for being used to trust a
    file when checking for false positives (bsc#1221954).
  * ClamD: Added an option to disable select administrative
    commands including SHUTDOWN, RELOAD, STATS and VERSION.
  * libclamav: Added extended hashing functions with a "flags"
    parameter that allows the caller to choose if they want to
    bypass FIPS hash algorithm limits.
  * See the release announcement for the full list of changes:
    https://blog.clamav.net/2025/10/clamav-150-released.html
- Obsoleted patches:
  * clamav-freshclam_test.patch
  * clamav-disable-administrative-commands.patch
  * clamav-fips.patch
- Use macros for library versions
- Remove service symlinks: rcclamd, rcfreshclam, rcclamav-milter,
  and clamonacc.
- Use rust 1.86 for SLE-12 and SLE-15-SP2.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760443200">- Add json-c-json-c-0.18-20240915.tar.gz and link it statically
  into libclamav on SLE-12, because version 0.12 is too old.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1760616000">- New version: 1.5.1:
  * Fixed a significant performance issue when scanning some PE
    files.
  * Fixed an issue recording file entries from a ZIP archive
    central directory which resulted in
    "Heuristics.Limits.Exceeded.MaxFiles" alerts when using the
    ClamScan --alert-exceeds-max command line option or ClamD
    AlertExceedsMax config file option.
  * Improved performance when scanning TNEF email attachments.
  * Fixed an issue with recording metadata for OOXML office
    documents.
  * Fixed an issue with signature matches for VBA in OLE2 office
    documents.
  * Loosened overly restrictive rules for embedded file
    identification and increased the limit for finding PE files
    embedded in other PE files.
  * Fixed an issue with extracting some RAR archives embedded in
    other files.
  * Fixed an issue with calculating fuzzy hashes affecting some
    images by updating the version for several Rust library
    dependencies.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1762257600">- Add clamav-workaround.patch to work around symbol removals in
  version 1.5.0 and 1.5.1.</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1763208000">- Build with older rust 1.87 for reproducible builds (boo#1249404)</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1763726400">- Provide a better fix for boo#1249404 by disabling debug mode.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1764331200">- Fix testsuite error on SLE-15-SP6 by falling back to rust1.86.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770724800">- jsc-PED-14819: Support transactional updates.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1770984000">- bsc#1258072: Require main and library packages to be of the same
  version and release. Given that all the core functionality is
  in the libraries it makes little sense to update the main
  package alone.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1772712000">- New version 1.5.2:
  * bsc#1259207, CVE-2026-20031: Fixed an error handling bug in the
    HTML file parser that may crash the program and cause a
    denial-of-service (DoS) condition. This issue was introduced in
    version 1.1.0.
  * Fixed a possible infinite loop when scanning some JPEG files by
    upgrading affected ClamAV dependency, a Rust image library.
  * The CVD verification process will now ignore certificate files
    in the CVD certs directory when the user lacks read permissions.
  * Freshclam: Fix CLD verification bug with PrivateMirror option.
  * Upgraded the Rust bytes dependency to a newer version to
    resolve RUSTSEC-2026-0007 advisory.
  * Fixed a possible crash caused by invalid pointer alignment on
    some platforms.
  * Minimal required Rust version is now 1.87.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1773316800">- Disable build for 32 bit ix86 because of testsuite failures with
  rust &gt;= 1.87 that upstream is not planning to fix.
- Run the test suite on all SUSE releases.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1782907200">- update to 1.5.3
  ClamAV 1.5.3 is a patch release with the following fixes:
  * bsc#1270091, CVE-2026-20217:
    Fixed a bug in the PESpin unpacker cleanup path that could free pointers
    into the scanned file buffer and crash the scanner.
  * bsc#1270107, CVE-2026-20213:
    Fixed an integer overflow in PE rebuild size calculations that could be
    reached through a malformed Aspack-packed PE file and lead to a heap buffer
    overflow write.
  * bsc#1270089, CVE-2026-20216:
    Fixed an InstallShield archive extraction limit bypass that could write far
    more temporary data than intended and exhaust temporary storage.
  * bsc#1270085, CVE-2026-20214:
    Fixed an FSG unpacker loop underflow that could write past the section array
    while scanning a malformed PE file.
  * bsc#1270092, CVE-2026-20243:
    Fixed ALZ parser size handling bugs that could cause malformed ALZ archives
    to panic, abort the scanner, or skip expected scan-limit handling.
  * bsc#1270088, CVE-2026-20215:
    Fixed a 7z parser substream count overflow that could under-allocate parser
    metadata arrays and write past them while reading a malformed archive.
  * bsc#1270106, CVE-2026-20244:
    Fixed 32-bit DMG parser size checks that could let a short mish stripe table
    pass validation and crash 32-bit scanner builds.
  * Hardened clamscan, clamdscan, and clamonacc quarantine actions against
    time-of-check/time-of-use races that could redirect copied, moved, or removed
    files under unsafe quarantine directory configurations.
  * Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
    RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency to
    resolve CVE-2026-41676, bsc#1270138.
  * Raised the minimum required CMake version to 3.17 to fix Linux builds with
    libcurl v8.21.0 when linking static library dependencies.
  * Metadata preclass scans now run before the final scan verdict.
  * ClamOnAcc: Fixed errors when recursively excluded paths are children of an
    included path.
  * ClamOnAcc: Fixed hash bucket list corruption when two watched paths collide
    in the same bucket.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1784894400">- CVE-2026-46671, bsc#1271922: Add clamav-CVE-2026-46671.patch to
  fix path traversal vulnerability in OneNote parser.
- Add clamav-vendor-cve-2026-46671.tar.gz to provide the
  sanitise-file-name Rust crate required by the security fix.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1786881600">- update to 1.5.4
  ClamAV 1.5.4 is a patch release with the following fixes:
  * CVE-2026-20337, bsc#1274597:
    Fixed ZIP catalogue capacity tracking that could write beyond a heap
    allocation while indexing local file headers.
  * CVE-2026-20345, bsc#1274600:
    Fixed an indexing error while converting GPT partition names that could
    read or write beyond a stack-allocated partition entry.
  * CVE-2026-20339, bsc#1274599:
    Fixed an integer overflow in the PESpin unpacker that could allocate an
    undersized buffer and then write beyond it while rebuilding a PE file.
  * CVE-2026-20338, bsc#1274598:
    Fixed ownership handling while merging ZIP catalogue records that could
    cause an invalid free while scanning a malformed archive.
  * CVE-2026-20346, bsc#1274601:
    Fixed an integer underflow in the PDF parser that could cause a crash while
    reading a malformed hex string.
  * CVE-2026-20347, bsc#1274602:
    Fixed undefined behavior and integer overflow in the Mach-O parser that
    could cause a crash while scanning a malformed Mach-O file.
  * CVE-2026-20348, bsc#1274603:
    Fixed XAR parser size handling that could request an excessive allocation
    or exceed scan limits while decompressing a malformed table of contents.
  * CVE-2025-8088:
    Adopted the upstream UnRAR project fix in ClamAV's bundled UnRAR library.
    The fix rejects path separators in NTFS alternate data stream names to
    prevent extraction outside ClamAV's temporary scan directory on Windows.
  * Fixed thread-safety issues in the clamd STATS command that could disclose
    process memory or crash the daemon while scans and STATS requests run
    concurrently. Also fixed partial socket-write handling used for large STATS
    responses.
  * FreeBSD: Restored support for safe quarantine move and remove actions while
    preserving protection against source-path replacement races.
  * Fixed an OpenSSL library-context leak in legacy hashing helpers when a
    requested message digest cannot be fetched, such as when the default
    provider is unavailable in a FIPS-enabled environment.
  * Upgraded the Rust crossbeam-epoch dependency to resolve the
    RUSTSEC-2026-0204 advisory.</changelog>
</package>
<package pkgid="a6a1b9ad253f023047f42f09d142af6f931c522cc09241ed0aee44e9c7826a41a48a2ce38f7295ffd4c255c77924ad00f0f81f8039f610a6353bbde7a9bbefaa" name="libfuzzy-devel" arch="s390x">
  <version epoch="0" ver="2.14.1" rel="21.59"/>
  <changelog author="Greg.Freemyer@gmail.com" date="1328961600">- initial submission
  Recursive computing and matching of Context Triggered Piecewise
  Hashing (aka Fuzzy Hashing). Supports Windows, *nix, BSD, OS X, etc.</changelog>
  <changelog author="aj@suse.de" date="1344513600">- Run through spec-cleaner, remove obsolete comments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1345204800">- Add ssdeep-dynamic.patch: Link ssdeep dynamically to libfuzzy.
  As a side-effect, we can actually now also use configure
  - -disable-static.
- Add libtool BuildRequires and call autoreconf, as above patch
  touches the build system.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1413460800">- ssdeep 2.11.1
  * Made libfuzzy compile as a shared library again.
- includes changes from 2.11:
  * Added fuzzy_clone function to the API.
  * Fixed edge case on signature generaion. Behavior now matches v2.9 again.
- includes changes from 2.10:
  * Fuzzy Hashing engine re-written to be thread safe.
  * Fixed bug on comparing signatures with the same block size.
  * Fixed crash on comparing short signatures.
  * Fixed memory leak
- includes changes from 2.9:
  * Added warning message for when some data on stdin is not hashed.
  * Can now hash up to 512MB of data on stdin.
  * Added clustering mode to group together matching files
  * Fixed incorrect match scores for hashes with long filenames.
- includes changes from 2.8:
  * Converted to C++
  * Fixed support for large files on some platforms.
  * Fixed errors in handling command line argument processing.
- remove ssdeep-dynamic.patch, not required
- remove autoreconf call
- License is GPL-2.0+, but please review [boo#901394]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1414152000">- ssdeep 2.12:
  - Fixed issue when comparing identical hashes but with different
    block sizes.
- Fixes licence problem in edit_dist.c [boo#901394]
  Package licence is GPL-2.0 and GPL-2.0+:</changelog>
  <changelog author="astieger@suse.com" date="1430222400">- ssdeep 2.13:
  * Added fuzzy_set_total_input_length function to the API.
  * Added support for files up to 192GB.
  * Added support for arbitrary length input from the standard input.
  * Fixed issue when comparing hashes from relatively simple files.
  * Fixed portability issues.</changelog>
  <changelog author="astieger@suse.com" date="1510574400">- ssdeep 2.14.1:
  * Optimizations to the fuzzy hashing engine
  * Fixed issue when certain memory allocation is failed</changelog>
</package>
<package pkgid="2bc3b9b42fb9e5495f63d37d844a134a197bff597919f83854cb95be29ed4c8265db5f9a6a832ae3dd904d639f8fe8b80e10622dd57960af35bc8c6c3415d80f" name="libfuzzy2" arch="s390x">
  <version epoch="0" ver="2.14.1" rel="21.59"/>
  <changelog author="Greg.Freemyer@gmail.com" date="1328961600">- initial submission
  Recursive computing and matching of Context Triggered Piecewise
  Hashing (aka Fuzzy Hashing). Supports Windows, *nix, BSD, OS X, etc.</changelog>
  <changelog author="aj@suse.de" date="1344513600">- Run through spec-cleaner, remove obsolete comments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1345204800">- Add ssdeep-dynamic.patch: Link ssdeep dynamically to libfuzzy.
  As a side-effect, we can actually now also use configure
  - -disable-static.
- Add libtool BuildRequires and call autoreconf, as above patch
  touches the build system.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1413460800">- ssdeep 2.11.1
  * Made libfuzzy compile as a shared library again.
- includes changes from 2.11:
  * Added fuzzy_clone function to the API.
  * Fixed edge case on signature generaion. Behavior now matches v2.9 again.
- includes changes from 2.10:
  * Fuzzy Hashing engine re-written to be thread safe.
  * Fixed bug on comparing signatures with the same block size.
  * Fixed crash on comparing short signatures.
  * Fixed memory leak
- includes changes from 2.9:
  * Added warning message for when some data on stdin is not hashed.
  * Can now hash up to 512MB of data on stdin.
  * Added clustering mode to group together matching files
  * Fixed incorrect match scores for hashes with long filenames.
- includes changes from 2.8:
  * Converted to C++
  * Fixed support for large files on some platforms.
  * Fixed errors in handling command line argument processing.
- remove ssdeep-dynamic.patch, not required
- remove autoreconf call
- License is GPL-2.0+, but please review [boo#901394]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1414152000">- ssdeep 2.12:
  - Fixed issue when comparing identical hashes but with different
    block sizes.
- Fixes licence problem in edit_dist.c [boo#901394]
  Package licence is GPL-2.0 and GPL-2.0+:</changelog>
  <changelog author="astieger@suse.com" date="1430222400">- ssdeep 2.13:
  * Added fuzzy_set_total_input_length function to the API.
  * Added support for files up to 192GB.
  * Added support for arbitrary length input from the standard input.
  * Fixed issue when comparing hashes from relatively simple files.
  * Fixed portability issues.</changelog>
  <changelog author="astieger@suse.com" date="1510574400">- ssdeep 2.14.1:
  * Optimizations to the fuzzy hashing engine
  * Fixed issue when certain memory allocation is failed</changelog>
</package>
<package pkgid="da039e05b1cd1ec7d1f2df759dc23c7c0da1b0861e3eb6bdc7da034c00eab04e32b93628f85f61fa14b1b0dba722dbdf8d6ef54e17430acd4b98c16ebb295faa" name="libfuzzy2-debuginfo" arch="s390x">
  <version epoch="0" ver="2.14.1" rel="21.59"/>
  <changelog author="Greg.Freemyer@gmail.com" date="1328961600">- initial submission
  Recursive computing and matching of Context Triggered Piecewise
  Hashing (aka Fuzzy Hashing). Supports Windows, *nix, BSD, OS X, etc.</changelog>
  <changelog author="aj@suse.de" date="1344513600">- Run through spec-cleaner, remove obsolete comments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1345204800">- Add ssdeep-dynamic.patch: Link ssdeep dynamically to libfuzzy.
  As a side-effect, we can actually now also use configure
  - -disable-static.
- Add libtool BuildRequires and call autoreconf, as above patch
  touches the build system.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1413460800">- ssdeep 2.11.1
  * Made libfuzzy compile as a shared library again.
- includes changes from 2.11:
  * Added fuzzy_clone function to the API.
  * Fixed edge case on signature generaion. Behavior now matches v2.9 again.
- includes changes from 2.10:
  * Fuzzy Hashing engine re-written to be thread safe.
  * Fixed bug on comparing signatures with the same block size.
  * Fixed crash on comparing short signatures.
  * Fixed memory leak
- includes changes from 2.9:
  * Added warning message for when some data on stdin is not hashed.
  * Can now hash up to 512MB of data on stdin.
  * Added clustering mode to group together matching files
  * Fixed incorrect match scores for hashes with long filenames.
- includes changes from 2.8:
  * Converted to C++
  * Fixed support for large files on some platforms.
  * Fixed errors in handling command line argument processing.
- remove ssdeep-dynamic.patch, not required
- remove autoreconf call
- License is GPL-2.0+, but please review [boo#901394]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1414152000">- ssdeep 2.12:
  - Fixed issue when comparing identical hashes but with different
    block sizes.
- Fixes licence problem in edit_dist.c [boo#901394]
  Package licence is GPL-2.0 and GPL-2.0+:</changelog>
  <changelog author="astieger@suse.com" date="1430222400">- ssdeep 2.13:
  * Added fuzzy_set_total_input_length function to the API.
  * Added support for files up to 192GB.
  * Added support for arbitrary length input from the standard input.
  * Fixed issue when comparing hashes from relatively simple files.
  * Fixed portability issues.</changelog>
  <changelog author="astieger@suse.com" date="1510574400">- ssdeep 2.14.1:
  * Optimizations to the fuzzy hashing engine
  * Fixed issue when certain memory allocation is failed</changelog>
</package>
<package pkgid="6754da5d2f606e603a4af870cfa81671057bf3d7d27c8e0e96c499859ca70d13bde30ab8c7f81e5d8b811ef298369f1d543f2c458a05cc6413a7e990a0aa5322" name="libhttrack2" arch="s390x">
  <version epoch="0" ver="3.49.2" rel="28.29"/>
  <changelog author="malcolmlewis@opensuse.org" date="1310904000">- Initial build</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346068800">- minor specfile cleanups
- update to v3.46-1
  + New: source license is now GPLv3
  + New: Unicode filenames handling
  + New: added a "K5" feature to handle transparent proxies (Brent Palmer)
  + New: option -y to control ^Z behavior (Julian H. Stacey)
  + New: added --do-not-generate-errors option
  + New: increased maximum cookie name
  + Fixed: fixed bug in handling of update/continue with erased files or renamed files, leading to "Unexpected 412/416 error (Requested Range Not Satisfiable)" and/or "Previous cache file not found" (-1)" errors
  + Fixed: escape characters &gt;= 128 when sending GET/HEAD requests to avoid server errors
  + Fixed: do not use "delayed" extensions when the mirror is aborting
  + Fixed: generate error pages when needed (Brent Palmer)
  + Fixed: parsing issue with js files due to "script" tags (Vasiliy)
  + Fixed: anonymous FTP without password (Luiz)
  + Fixed: Makefile issues regarding parrallel build and examples (Sebastian Pipping)
  + Fixed: removed deprecated and annoying "Accept-Charset" header in requests (Piotr Engelking) (closes:#674053)
  + Fixed: replace // by / when saving rather than _/ (Brent Palmer)
  + Fixed: do not interpret ^C before mirror is finished, or after
  + Fixed: webhttrack: do not use md5sum to produce a temporary filename, but mktemp (Ryan Schmidt)
  + Fixed: document %k for custom structure (full query string)
  + Fixed: spurious "Previous file not found (erased by user ?)" messages leading to retransfer existing files in cache (Alain Desilets)
  + Fixed: --max-time now stops the mirror smoothly (Alain Desilets)
  + Fixed: number of simultaneous connections was often only one (Illyria, William Roeder)
  + Fixed: "Unexpected 412/416 error" leading to have broken files on disk
  + Fixed: interrupting an update/continue mirror session should not delete anymore previously downloaded content (William Roeder, Alain Desilets and many others)
  + Fixed: --continue/--update bug leading to download again already cached data in some cases (especially redirect/error pages)
  + Fixed: crash when using -d with non-fully-qualified hostname (Alain Desilets)
  + Fixed: typo in logs (Pascal Boulerie)
  + Fixed: random crash when interrupting the mirror (spotted by -fstack-protector) in htscoremain.c (closes:#657878)
  + Fixed: malformed format htslib.c (Moritz Muehlenhoff)
  + Fixed: default footer print format</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347278400">- break the shared libraries out into their own sub-package
- run spec-cleaner</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1377345600">- Update to 3.47.24:
  + New: support for IDNA / RFC 3492 (punycode) handling
  + New: openssl is no longer dynamically probed at stratup, but dynamically
    linked
  + Fixed: random closing of files/sockets, leading to
    "zip_zipWriteInFileInZip_failed" assertion, "bogus state" messages, or
    random garbage in downloaded files
  + Fixed: libssl.dylib is now in the search list for libssl on OSX
    (Nils Breunese)
  + Fixed: bogus charset because the meta http-equiv tag is placed too far in
    the html page
  + Fixed: incorrect \\machine\dir structure build on Windows (TomZ)
  + Fixed: do not force a file to have an extension unless it has a known type
    (such as html), or a possibly known type (if delayed checks are disabled)
  + Fixed: HTML 5 addition regarding "poster" attribute for the "video" tag
    (Jason Ronallo)
  + Fixed: memory leaks in proxytrack.c (Eric Searcy)
  + Fixed: correctly set the Z flag in hts-cache/new.txt file (Peter)
  + Fixed: parallel patch, typo regarding ICONV_LIBS (Sebastian Pipping)
  + Fixed: memory leak in hashtable, that may lead to excessive memory
    consumption
  + Fixed: on Windows, fixed possible DLL local injection (CVE-2010-5252)
  + Fixed: UTF-8 conversion bug on Linux that may lead to buggy filenames
  + Fixed: zero-length files not being properly handled (not saved on disk, not
    updated) (lugusto)
  + Fixed: serious bug that may lead to download several times the same file,
    and "Unexpected 412/416 error" errors
  + Fixed: images in CSS were sometimes not correctly detected (Martin)
  + Fixed: links within javascript events were sometimes not correctly detected
    (wquatan)
  + Fixed: webhttrack caused bus error on certain systems, such as Mac OSX, due
    to the stack size (Patrick Gundlach)
  + Fixed: bogus charset for requests when filenames have non-ascii characters
    (Steven Hsiao)
  + Fixed: bogus charset on disk when filenames have non-ascii characters
    (Steven Hsiao)
  + Fixed: fixed 260-characters path limit for Windows (lugusto)
  + Fixed: non-ascii characters encoding issue inside query string (lugusto)
  + Fixed: HTML entities not properly decoded inside URI and query string
  + Fixed: URL-encoding issue within URI
  + Fixed: --timeout alias did not work
  + Fixed: more windows-specific fixes regarding 260-character path limit
  + Fixed: escaping issue in top index
  + Fixed: Linux build cleanup (gentoo patches merge, lintian fixes et al.)
  + Fixed: Fixed div-by-zero when specifying more than 1000 connections per
    seconds (probably not very common)
  + Fixed: Mishandling of '+' in URLs introduced in 3.47-15 (sarclaudio)
  + Fixed: "Wildcard domains in cookies do not match"
    (alexei dot co at gmail dot com )
  + Fixed: buggy referer while parsing: the referer of all links in the page is
    the current page being parsed, NOT the parent page.
    (alexei dot com at gmail dot com)
  + Fixed: Russian translation fixes by Oleg Komarov (komoleg at mail dot ru)
  + New: Added .torrent =&gt; application/x-bittorrent built-in MIME type
    (alexei dot co at gmail dot com)
  + Fixed: unable to download an URL whose filename embeds special characters
    such as # (lugusto)
  + New: Croatian translation by Dominko Aždajić (domazd at mail dot ru)
  + Fixed: url-escaping regression introduced in the previous subrelease
- Added new build requirement libopenssl-devel.
- Require libhttrack2 instead of httrack (not needed) in devel package.
- Require libopenssl-devel in devel package (some httrack headers require
  openssl headers).
- Use desktop-file-utils instead of update-desktop-files for openSUSE &gt; 12.1.
- Remove config.h from htsglobal.h since it is not installed.
- Removed httrack-fix-desktop.patch and added a fix inside the spec file.
- Rebased httrack-fix-strict-aliasing-punning.patch to apply cleanly.</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1382011200">- move the html documentation back to /usr/share/httrack/html
  + See BNC#845885</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1408708800">- Update to 3.48.19:
  + Fixed: assertion failure at htslib.c:3458 (strlen(copyBuff) == qLen) seen
    on Linux
  + Fixed: infamous crashes inside the DNS cache due to a corruption within the
    option structure (E.Kalinowski/karbofos)
  + New: added minimalistic crash reporting on Windows and Linux
  + Fixed: URL list not working anymore (tom swift)
  + Fixed: FTBFS on ARM
  + Fixed: buggy FFFD (replacement character) in place of leading non-ascii
    character such as Chinese ones (aballboy)
  + Fixed: FTBFS when compiling with zlib versions &lt; 1.2.70 (sammyx)
  + Fixed: buggy SVG (Smiling Spectre)
  + Fixed: do not uncompress .tgz advertised as "streamed" (Smiling Spectre)
  + Fixed: NULL pointer dereferencing in back_unserialize (htsback.c:976)
  + Fixed: library development files
  + Fixed: --advanced-maxlinks broken (Localhost)
  + Fixed: -devel package should now be standalone
  + Fixed: assertion failure at htscore.c:244
    (len + liensbuf-&gt;string_buffer_size &lt; liensbuf-&gt;string_buffer_capa)
  + Fixed: injection-proof templates
  + Fixed: htshash.c:330 assertion failure ("error invalidating hash entry")
    (Sergey)
  + Fixed: Windows 2000 regression (fantozzi.usenet)
  + Fixed: code cleanup (aliasing issues, const correctness, safe strings)
  + New: handle --advanced-maxlinks=0 to disable maximum link limits
  + New: updated ZIP routines (zlib 1.2.8)
  + Fixed: broken 32-bit version
  + Fixed: assertion "segOutputSize &lt; segSize assertion fails at
    htscharset.c:993"
  + Fixed: new zlib version fixing CVE-2004-0797 and CVE-2005-2096
  + Fixed: more reliable crash reporting
  + Fixed: fixed infamous "hashtable internal error: cuckoo/stash collision"
    errors
  + Fixed: safety cleanup in many strings operations
  + Fixed: buggy option pannels
  + New: Enforce check against CVE-2014-0160
  + New: improved hashtables to speedup large mirrors
  + New: added unit tests
  + New: Added %a option, allowing to define the "Accept:" header line.
  + New: Added %X option, to define additional request header lines.
  + New: Added option '-%t', preserving the original file type (which may
    produce non-browseable file locally)
  + Fixed: remove scope id (% character) in dotted address resolution
    (especially for catchurl proxy)
  + Fixed: build fixes, including for Android, non-SSL releases
  + Fixed: buggy keep-alive handling, leading to waste connections
  + Fixed: removed chroot and setuid features (this is definitely not our
    business)
  + Fixed: removed MMS (Microsoft Media Server) ripping code (mmsrip) (dead
    protocol, unmaintained code, licensing issues)
  + Fixed: type mishandling when processing a redirect (such as a .PDF
    redirecting to another .PDF, with a text/html type tagged in the redirect
    message)
  + Fixed: infinite loop when attempting to download a file:/// directory on
    Unix (gp)&lt;br/&gt;
  + Fixed: removed background DNS resolution, prone to bugs
  + Fixed: do not choke on Windows 2000 because of missing SetDllDirectory()
    (Andy Hewitt)
  + Fixed: %h custom build structure parameter not taken in account (William
    Clark)
- Removed the fix for build-compare regarding build time references (not needed
  anymore).
- Rebased httrack-fix-strict-aliasing-punning.patch to apply cleanly.</changelog>
  <changelog author="rpm@fthiessen.de" date="1469880000">- Update to 3.48.22
- Spec file cleanup</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1506859200">- Updated to version 3.49.2:
  * Fixed: Buffer overflow in output option commandline argument
    (VL-ID 2068).
  * Minor fixes.
- Changes from version 3.48.23:
  * Fixed: FTBFS with openssl 1.1.0.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- url -&gt; https</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="cbc5259c264760c50098902b522bf592b8b3e9053afa76c10296e4d61b34a783d1a77f95e8d1659bd3ce2f65ab1b2cf31f39d82c7f897787071d1d4da8465e34" name="libhttrack2-debuginfo" arch="s390x">
  <version epoch="0" ver="3.49.2" rel="28.29"/>
  <changelog author="malcolmlewis@opensuse.org" date="1310904000">- Initial build</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346068800">- minor specfile cleanups
- update to v3.46-1
  + New: source license is now GPLv3
  + New: Unicode filenames handling
  + New: added a "K5" feature to handle transparent proxies (Brent Palmer)
  + New: option -y to control ^Z behavior (Julian H. Stacey)
  + New: added --do-not-generate-errors option
  + New: increased maximum cookie name
  + Fixed: fixed bug in handling of update/continue with erased files or renamed files, leading to "Unexpected 412/416 error (Requested Range Not Satisfiable)" and/or "Previous cache file not found" (-1)" errors
  + Fixed: escape characters &gt;= 128 when sending GET/HEAD requests to avoid server errors
  + Fixed: do not use "delayed" extensions when the mirror is aborting
  + Fixed: generate error pages when needed (Brent Palmer)
  + Fixed: parsing issue with js files due to "script" tags (Vasiliy)
  + Fixed: anonymous FTP without password (Luiz)
  + Fixed: Makefile issues regarding parrallel build and examples (Sebastian Pipping)
  + Fixed: removed deprecated and annoying "Accept-Charset" header in requests (Piotr Engelking) (closes:#674053)
  + Fixed: replace // by / when saving rather than _/ (Brent Palmer)
  + Fixed: do not interpret ^C before mirror is finished, or after
  + Fixed: webhttrack: do not use md5sum to produce a temporary filename, but mktemp (Ryan Schmidt)
  + Fixed: document %k for custom structure (full query string)
  + Fixed: spurious "Previous file not found (erased by user ?)" messages leading to retransfer existing files in cache (Alain Desilets)
  + Fixed: --max-time now stops the mirror smoothly (Alain Desilets)
  + Fixed: number of simultaneous connections was often only one (Illyria, William Roeder)
  + Fixed: "Unexpected 412/416 error" leading to have broken files on disk
  + Fixed: interrupting an update/continue mirror session should not delete anymore previously downloaded content (William Roeder, Alain Desilets and many others)
  + Fixed: --continue/--update bug leading to download again already cached data in some cases (especially redirect/error pages)
  + Fixed: crash when using -d with non-fully-qualified hostname (Alain Desilets)
  + Fixed: typo in logs (Pascal Boulerie)
  + Fixed: random crash when interrupting the mirror (spotted by -fstack-protector) in htscoremain.c (closes:#657878)
  + Fixed: malformed format htslib.c (Moritz Muehlenhoff)
  + Fixed: default footer print format</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347278400">- break the shared libraries out into their own sub-package
- run spec-cleaner</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1377345600">- Update to 3.47.24:
  + New: support for IDNA / RFC 3492 (punycode) handling
  + New: openssl is no longer dynamically probed at stratup, but dynamically
    linked
  + Fixed: random closing of files/sockets, leading to
    "zip_zipWriteInFileInZip_failed" assertion, "bogus state" messages, or
    random garbage in downloaded files
  + Fixed: libssl.dylib is now in the search list for libssl on OSX
    (Nils Breunese)
  + Fixed: bogus charset because the meta http-equiv tag is placed too far in
    the html page
  + Fixed: incorrect \\machine\dir structure build on Windows (TomZ)
  + Fixed: do not force a file to have an extension unless it has a known type
    (such as html), or a possibly known type (if delayed checks are disabled)
  + Fixed: HTML 5 addition regarding "poster" attribute for the "video" tag
    (Jason Ronallo)
  + Fixed: memory leaks in proxytrack.c (Eric Searcy)
  + Fixed: correctly set the Z flag in hts-cache/new.txt file (Peter)
  + Fixed: parallel patch, typo regarding ICONV_LIBS (Sebastian Pipping)
  + Fixed: memory leak in hashtable, that may lead to excessive memory
    consumption
  + Fixed: on Windows, fixed possible DLL local injection (CVE-2010-5252)
  + Fixed: UTF-8 conversion bug on Linux that may lead to buggy filenames
  + Fixed: zero-length files not being properly handled (not saved on disk, not
    updated) (lugusto)
  + Fixed: serious bug that may lead to download several times the same file,
    and "Unexpected 412/416 error" errors
  + Fixed: images in CSS were sometimes not correctly detected (Martin)
  + Fixed: links within javascript events were sometimes not correctly detected
    (wquatan)
  + Fixed: webhttrack caused bus error on certain systems, such as Mac OSX, due
    to the stack size (Patrick Gundlach)
  + Fixed: bogus charset for requests when filenames have non-ascii characters
    (Steven Hsiao)
  + Fixed: bogus charset on disk when filenames have non-ascii characters
    (Steven Hsiao)
  + Fixed: fixed 260-characters path limit for Windows (lugusto)
  + Fixed: non-ascii characters encoding issue inside query string (lugusto)
  + Fixed: HTML entities not properly decoded inside URI and query string
  + Fixed: URL-encoding issue within URI
  + Fixed: --timeout alias did not work
  + Fixed: more windows-specific fixes regarding 260-character path limit
  + Fixed: escaping issue in top index
  + Fixed: Linux build cleanup (gentoo patches merge, lintian fixes et al.)
  + Fixed: Fixed div-by-zero when specifying more than 1000 connections per
    seconds (probably not very common)
  + Fixed: Mishandling of '+' in URLs introduced in 3.47-15 (sarclaudio)
  + Fixed: "Wildcard domains in cookies do not match"
    (alexei dot co at gmail dot com )
  + Fixed: buggy referer while parsing: the referer of all links in the page is
    the current page being parsed, NOT the parent page.
    (alexei dot com at gmail dot com)
  + Fixed: Russian translation fixes by Oleg Komarov (komoleg at mail dot ru)
  + New: Added .torrent =&gt; application/x-bittorrent built-in MIME type
    (alexei dot co at gmail dot com)
  + Fixed: unable to download an URL whose filename embeds special characters
    such as # (lugusto)
  + New: Croatian translation by Dominko Aždajić (domazd at mail dot ru)
  + Fixed: url-escaping regression introduced in the previous subrelease
- Added new build requirement libopenssl-devel.
- Require libhttrack2 instead of httrack (not needed) in devel package.
- Require libopenssl-devel in devel package (some httrack headers require
  openssl headers).
- Use desktop-file-utils instead of update-desktop-files for openSUSE &gt; 12.1.
- Remove config.h from htsglobal.h since it is not installed.
- Removed httrack-fix-desktop.patch and added a fix inside the spec file.
- Rebased httrack-fix-strict-aliasing-punning.patch to apply cleanly.</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1382011200">- move the html documentation back to /usr/share/httrack/html
  + See BNC#845885</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1408708800">- Update to 3.48.19:
  + Fixed: assertion failure at htslib.c:3458 (strlen(copyBuff) == qLen) seen
    on Linux
  + Fixed: infamous crashes inside the DNS cache due to a corruption within the
    option structure (E.Kalinowski/karbofos)
  + New: added minimalistic crash reporting on Windows and Linux
  + Fixed: URL list not working anymore (tom swift)
  + Fixed: FTBFS on ARM
  + Fixed: buggy FFFD (replacement character) in place of leading non-ascii
    character such as Chinese ones (aballboy)
  + Fixed: FTBFS when compiling with zlib versions &lt; 1.2.70 (sammyx)
  + Fixed: buggy SVG (Smiling Spectre)
  + Fixed: do not uncompress .tgz advertised as "streamed" (Smiling Spectre)
  + Fixed: NULL pointer dereferencing in back_unserialize (htsback.c:976)
  + Fixed: library development files
  + Fixed: --advanced-maxlinks broken (Localhost)
  + Fixed: -devel package should now be standalone
  + Fixed: assertion failure at htscore.c:244
    (len + liensbuf-&gt;string_buffer_size &lt; liensbuf-&gt;string_buffer_capa)
  + Fixed: injection-proof templates
  + Fixed: htshash.c:330 assertion failure ("error invalidating hash entry")
    (Sergey)
  + Fixed: Windows 2000 regression (fantozzi.usenet)
  + Fixed: code cleanup (aliasing issues, const correctness, safe strings)
  + New: handle --advanced-maxlinks=0 to disable maximum link limits
  + New: updated ZIP routines (zlib 1.2.8)
  + Fixed: broken 32-bit version
  + Fixed: assertion "segOutputSize &lt; segSize assertion fails at
    htscharset.c:993"
  + Fixed: new zlib version fixing CVE-2004-0797 and CVE-2005-2096
  + Fixed: more reliable crash reporting
  + Fixed: fixed infamous "hashtable internal error: cuckoo/stash collision"
    errors
  + Fixed: safety cleanup in many strings operations
  + Fixed: buggy option pannels
  + New: Enforce check against CVE-2014-0160
  + New: improved hashtables to speedup large mirrors
  + New: added unit tests
  + New: Added %a option, allowing to define the "Accept:" header line.
  + New: Added %X option, to define additional request header lines.
  + New: Added option '-%t', preserving the original file type (which may
    produce non-browseable file locally)
  + Fixed: remove scope id (% character) in dotted address resolution
    (especially for catchurl proxy)
  + Fixed: build fixes, including for Android, non-SSL releases
  + Fixed: buggy keep-alive handling, leading to waste connections
  + Fixed: removed chroot and setuid features (this is definitely not our
    business)
  + Fixed: removed MMS (Microsoft Media Server) ripping code (mmsrip) (dead
    protocol, unmaintained code, licensing issues)
  + Fixed: type mishandling when processing a redirect (such as a .PDF
    redirecting to another .PDF, with a text/html type tagged in the redirect
    message)
  + Fixed: infinite loop when attempting to download a file:/// directory on
    Unix (gp)&lt;br/&gt;
  + Fixed: removed background DNS resolution, prone to bugs
  + Fixed: do not choke on Windows 2000 because of missing SetDllDirectory()
    (Andy Hewitt)
  + Fixed: %h custom build structure parameter not taken in account (William
    Clark)
- Removed the fix for build-compare regarding build time references (not needed
  anymore).
- Rebased httrack-fix-strict-aliasing-punning.patch to apply cleanly.</changelog>
  <changelog author="rpm@fthiessen.de" date="1469880000">- Update to 3.48.22
- Spec file cleanup</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1506859200">- Updated to version 3.49.2:
  * Fixed: Buffer overflow in output option commandline argument
    (VL-ID 2068).
  * Minor fixes.
- Changes from version 3.48.23:
  * Fixed: FTBFS with openssl 1.1.0.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- url -&gt; https</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="7986c9e4af2490113d96c0e6bcbcc8e62dcaec90f452c8dc71fb9b7708690b46e2c54de99475106ed7ff72bc016725f1775a5f74a0f974c615d66b142ddc5f83" name="libibmtss2" arch="s390x">
  <version epoch="0" ver="2.4.1" rel="63.8"/>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1597665600">- Update to upstream version 1.5.0 (jsc#SLE-13828).
- Fix build warning due to -O0
  + ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- Fix uninitialized variable warning
  + ibmtss-certifyx509-Fix-uninitialized-variable.patch</changelog>
  <changelog author="Pedro Monreal Gonzalez &lt;pmonreal@suse.com&gt;" date="1601553600">- Regression fix:
  * utils: fix ABI break caused by additional argument to -rsa
  * https://sourceforge.net/p/ibmtpm20tss/mailman/message/37119441/
- Add ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1611662400">- Update to upstream version 1.6.0 (jsc#SLE-18268).
- Drop patches from this release
  - ibmtss-certifyx509-Fix-uninitialized-variable.patch
  - ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1637841600">- Fix certificate list, run all tests.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1667995200">- Build with OpenSSL 3.0 deprecated functions until fixed upstream
  in the next version update [bsc#1205042]
  * ibmtss-openssl3-deprecation.patch
- Add upstream patches to fix build with OpenSSL 3.0
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1701345600">- Update to 2.1.1:
  * Add man page for tpmproxy.
- Update to 2.1.0:
  * Parse new IMA event log template data fields.
  * Add option to verify IMA template data
  * Correct minor regression test script typos.
- Update to 2.0.0
  * Expand TPMU_SENSITIVE_COMPOSITE to handle HW TPMs that return 5
    RSA primes.  This is an ABI (not API) break.
  * Add support for TPM2_ECC_Encrypt and TPM2_ECC_Decrypt
  * Add more EFI event log handlers and event tracing.
  * SW TPM test CA now uses SHA-256, not the deprecated SHA-1.
  * Port tpmproxy for TPM 2.0 to Linux and Windows.
  * Add many new EK root certificates.
  * Remove OpenSSL functions deprecated in 3.x.
  * Fix TSS bug when using encrypt and decrypt in a PWAP session.
  * Add build flag to suppress SHA-1.
- Remove patches fixed upstream:
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch
  * ibmtss-openssl3-deprecation.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1729512000">- Update to 2.4.0:
  * Add support for EK intermediate certificates
  * Support different IMA log digest algorithms
  * add regtest
  * html documentation
- Refresh ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- tss-Commit-changelog-and-autotools-version-update.patch
- utils-Update-.so-version-to-2.4.patch</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1733227200">- Add ibmtss-2.4.0-fix-FTBFS-2026.patch to fix tests after 2026 (boo#1102840)</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1740484800">- Update to 2.4.1:
  * Issue new test EK CA root certificates with a longer validity period.
  * Remove patches upstream:
  - tss-Commit-changelog-and-autotools-version-update.patch
  - utils-Update-.so-version-to-2.4.patch
  - ibmtss-2.4.0-fix-FTBFS-2026.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1754481600">- Do not ship test data (bsc#1239985)</changelog>
</package>
<package pkgid="260b226b071d26991f3878c0fdbd570e31ef3f9f6bc8cc3539c96e5178bf47f9c449d45220e8e1da9998bbebd690c2606d56205deeb0c93cb5b9ff89ea3ae570" name="libibmtss2-debuginfo" arch="s390x">
  <version epoch="0" ver="2.4.1" rel="63.8"/>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1597665600">- Update to upstream version 1.5.0 (jsc#SLE-13828).
- Fix build warning due to -O0
  + ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- Fix uninitialized variable warning
  + ibmtss-certifyx509-Fix-uninitialized-variable.patch</changelog>
  <changelog author="Pedro Monreal Gonzalez &lt;pmonreal@suse.com&gt;" date="1601553600">- Regression fix:
  * utils: fix ABI break caused by additional argument to -rsa
  * https://sourceforge.net/p/ibmtpm20tss/mailman/message/37119441/
- Add ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1611662400">- Update to upstream version 1.6.0 (jsc#SLE-18268).
- Drop patches from this release
  - ibmtss-certifyx509-Fix-uninitialized-variable.patch
  - ibmtss-fix-dsa-regression.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1637841600">- Fix certificate list, run all tests.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1667995200">- Build with OpenSSL 3.0 deprecated functions until fixed upstream
  in the next version update [bsc#1205042]
  * ibmtss-openssl3-deprecation.patch
- Add upstream patches to fix build with OpenSSL 3.0
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1701345600">- Update to 2.1.1:
  * Add man page for tpmproxy.
- Update to 2.1.0:
  * Parse new IMA event log template data fields.
  * Add option to verify IMA template data
  * Correct minor regression test script typos.
- Update to 2.0.0
  * Expand TPMU_SENSITIVE_COMPOSITE to handle HW TPMs that return 5
    RSA primes.  This is an ABI (not API) break.
  * Add support for TPM2_ECC_Encrypt and TPM2_ECC_Decrypt
  * Add more EFI event log handlers and event tracing.
  * SW TPM test CA now uses SHA-256, not the deprecated SHA-1.
  * Port tpmproxy for TPM 2.0 to Linux and Windows.
  * Add many new EK root certificates.
  * Remove OpenSSL functions deprecated in 3.x.
  * Fix TSS bug when using encrypt and decrypt in a PWAP session.
  * Add build flag to suppress SHA-1.
- Remove patches fixed upstream:
  * ibmtss-regtests-Update-openssl-key-generation-for-3.0.0.patch
  * ibmtss-utils-Update-certifyx509-for-Openssl-3.0.0.patch
  * ibmtss-utils-Remove-unused-variables-from-certifyx509.patch
  * ibmtss-tss-Port-HMAC-operations-to-openssl-3.0.patch
  * ibmtss-utils-Port-to-openssl-3.0.0-replaces-RSA-with-EVP_PK.patch
  * ibmtss-openssl3-deprecation.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1729512000">- Update to 2.4.0:
  * Add support for EK intermediate certificates
  * Support different IMA log digest algorithms
  * add regtest
  * html documentation
- Refresh ibmtss-configure.ac-Do-not-disable-optimization-for-debug-b.patch
- tss-Commit-changelog-and-autotools-version-update.patch
- utils-Update-.so-version-to-2.4.patch</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1733227200">- Add ibmtss-2.4.0-fix-FTBFS-2026.patch to fix tests after 2026 (boo#1102840)</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1740484800">- Update to 2.4.1:
  * Issue new test EK CA root certificates with a longer validity period.
  * Remove patches upstream:
  - tss-Commit-changelog-and-autotools-version-update.patch
  - utils-Update-.so-version-to-2.4.patch
  - ibmtss-2.4.0-fix-FTBFS-2026.patch</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.de&gt;" date="1754481600">- Do not ship test data (bsc#1239985)</changelog>
</package>
<package pkgid="731714bb4edb1ff8ae59faa8b86afc68e3856ec2877c146fcaa83cfb7753db9dde653c337ede927cd2e0dbc26046ef09beb15390f8958c61bf9087a7f1e2a560" name="libimaevm5" arch="s390x">
  <version epoch="0" ver="1.6.2" rel="75.18"/>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1601553600">- Fix missing new line in help
  (0001-help-Add-missing-new-line-for-ignore-violations.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1603972800">- Update to version 1.3.2
  * Bugfixes: importing keys
  * NEW: Docker based travis distro testing
  * Travis bugfixes, code cleanup, software version update,
  and script removal
  * Initial travis testing
- Remove 0001-help-Add-missing-new-line-for-ignore-violations.patch
  (patch from this release)
- Add make check + dependencies (getfattr =&gt; attr, xxd =&gt; vim)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1636113600">- Update to version 1.4
  * Elliptic curve support and tests
  * PKCS11 support and tests
  * Ability to manually specify the keyid included in the IMA xattr
  * Improve IMA measurement list per TPM bank verification
  * Linking with IBM TSS
  * Set default hash algorithm in package configuration
  * (Minimal) support and test EVM portable signatures
  * CI testing:
  * Refresh and include new distros
  * Podman support
  * GitHub Actions
  * Limit "sudo" usage
  * Misc bug fixes and code cleanup
  * Fix static analysis bug reports, memory leaks
  * Remove experimental code that was never upstreamed in the kernel
  * Use unsigned variable, remove unused variables, etc
- Upstream bumped soname to 3.0.0</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- switch to use https urls</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1678449600">- Update to version 1.5
  * CI changes:
  * New: UML kernel testing environment
  * Support for running specific test(s)
  * Update distros
  * Update software release versions
  * New features:
  * Signing fs-verity signatures
  * Reading TPM 2.0 PCRs via sysfs interface
  * New tests:
  * Missing IMA mmapped file measurements
  * Overlapping IMA policy rules
  * EVM portable signatures
  * fs-verity file measurements in the IMA measurement list
  * Build and library changes:
  * OpenSSL 3.0 version related changes
  * New configuration options: --disable-engine, --enable-sigv1
  * Deprecate IMA signature v1 format
  * Misc bug fixes and code cleanup:
  * memory leaks, bounds checking, use after free
  * Fix and update test output
  * Add missing sanity checks
  * Documentation:
  * Store the sourceforge ima-evm-utils wiki for historical
  purposes.
- Upstream bumped soname to 4.0.0
- Add BuildRequires: e2fsprogs util-linux (required by tests, which are mandatory)
- /usr/sbin to PATH (0001-fsverity.test-Add-usr-sbin-into-PATH.patch, sent to upstream ML)</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1702641600">- Update download url.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720440000">- Update to version 1.6
  https://lore.kernel.org/linux-integrity/20240703164454.61614-1-zohar@linux.ibm.com/
- Upstream bumped soname to 5.0.0
- Upstream changed license to GPL-2.0-or-later (evmctl), LGPL-2.0-or-later
  (libimaevm + devel package), and GPL-2.0-or-later WITH Linux-syscall-note
  exception (both)
  https://github.com/linux-integrity/ima-evm-utils/issues/4
  (mention both GPL and LGPL and add specific license to subpackages)
- Remove patch from upstream (0001-fsverity.test-Add-usr-sbin-into-PATH.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720699200">- Add LicenseRef-GPL-2.0-with-openssl-exception to License: (upstream has not
  yet created appropriate exception in SPDX).</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720785600">- Update project source URL.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1725278400">- Update to version 1.6.2
  https://github.com/linux-integrity/ima-evm-utils/blob/v1.6.2/NEWS
- Remove LicenseRef-GPL-2.0-with-openssl-exception (no need due relicensing of
  OpenSSL 3 or later to the Apache 2 license
  https://github.com/linux-integrity/ima-evm-utils/commit/4a4c762c8e3cbbff5f41c682deb026d22440454d )
- Upstream added COPYING (again) and COPYING.LGPL (new), add them to %license.</changelog>
</package>
<package pkgid="28df50ba11d5a598f1c337edc97b7d7a20af339efbadbd6e6a977d71b684c6fc580e28199ddca73c88071f2ef6ac6b995f81bdb544d3ace1fdb00fa9446abd7d" name="libimaevm5-debuginfo" arch="s390x">
  <version epoch="0" ver="1.6.2" rel="75.18"/>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1601553600">- Fix missing new line in help
  (0001-help-Add-missing-new-line-for-ignore-violations.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1603972800">- Update to version 1.3.2
  * Bugfixes: importing keys
  * NEW: Docker based travis distro testing
  * Travis bugfixes, code cleanup, software version update,
  and script removal
  * Initial travis testing
- Remove 0001-help-Add-missing-new-line-for-ignore-violations.patch
  (patch from this release)
- Add make check + dependencies (getfattr =&gt; attr, xxd =&gt; vim)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1636113600">- Update to version 1.4
  * Elliptic curve support and tests
  * PKCS11 support and tests
  * Ability to manually specify the keyid included in the IMA xattr
  * Improve IMA measurement list per TPM bank verification
  * Linking with IBM TSS
  * Set default hash algorithm in package configuration
  * (Minimal) support and test EVM portable signatures
  * CI testing:
  * Refresh and include new distros
  * Podman support
  * GitHub Actions
  * Limit "sudo" usage
  * Misc bug fixes and code cleanup
  * Fix static analysis bug reports, memory leaks
  * Remove experimental code that was never upstreamed in the kernel
  * Use unsigned variable, remove unused variables, etc
- Upstream bumped soname to 3.0.0</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- switch to use https urls</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1678449600">- Update to version 1.5
  * CI changes:
  * New: UML kernel testing environment
  * Support for running specific test(s)
  * Update distros
  * Update software release versions
  * New features:
  * Signing fs-verity signatures
  * Reading TPM 2.0 PCRs via sysfs interface
  * New tests:
  * Missing IMA mmapped file measurements
  * Overlapping IMA policy rules
  * EVM portable signatures
  * fs-verity file measurements in the IMA measurement list
  * Build and library changes:
  * OpenSSL 3.0 version related changes
  * New configuration options: --disable-engine, --enable-sigv1
  * Deprecate IMA signature v1 format
  * Misc bug fixes and code cleanup:
  * memory leaks, bounds checking, use after free
  * Fix and update test output
  * Add missing sanity checks
  * Documentation:
  * Store the sourceforge ima-evm-utils wiki for historical
  purposes.
- Upstream bumped soname to 4.0.0
- Add BuildRequires: e2fsprogs util-linux (required by tests, which are mandatory)
- /usr/sbin to PATH (0001-fsverity.test-Add-usr-sbin-into-PATH.patch, sent to upstream ML)</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1702641600">- Update download url.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720440000">- Update to version 1.6
  https://lore.kernel.org/linux-integrity/20240703164454.61614-1-zohar@linux.ibm.com/
- Upstream bumped soname to 5.0.0
- Upstream changed license to GPL-2.0-or-later (evmctl), LGPL-2.0-or-later
  (libimaevm + devel package), and GPL-2.0-or-later WITH Linux-syscall-note
  exception (both)
  https://github.com/linux-integrity/ima-evm-utils/issues/4
  (mention both GPL and LGPL and add specific license to subpackages)
- Remove patch from upstream (0001-fsverity.test-Add-usr-sbin-into-PATH.patch)</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720699200">- Add LicenseRef-GPL-2.0-with-openssl-exception to License: (upstream has not
  yet created appropriate exception in SPDX).</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1720785600">- Update project source URL.</changelog>
  <changelog author="Petr Vorel &lt;pvorel@suse.cz&gt;" date="1725278400">- Update to version 1.6.2
  https://github.com/linux-integrity/ima-evm-utils/blob/v1.6.2/NEWS
- Remove LicenseRef-GPL-2.0-with-openssl-exception (no need due relicensing of
  OpenSSL 3 or later to the Apache 2 license
  https://github.com/linux-integrity/ima-evm-utils/commit/4a4c762c8e3cbbff5f41c682deb026d22440454d )
- Upstream added COPYING (again) and COPYING.LGPL (new), add them to %license.</changelog>
</package>
<package pkgid="729429d2569bc2c2f8b3e8f51fc77e528e9f87b62562007f3613579d9eb78de53d8c83ace37b8cc96f634c2a5693e51c7aa63f02899229a70dd18c43fc9dc750" name="libjose-devel" arch="s390x">
  <version epoch="0" ver="14" rel="9.4"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- initial import of C-language implementation of Javascript Object
  Signing and Encryption, for use by clevis</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1709899200">- Update to version 12
  * Clean up some FreeBSD conditions (#98)
  * Add ES256K support (#90)
  * Meson changes (#135)
  * Update CI (#8) (#129)
  * lib/openssl/rsaes.c: Fix issue where jose_hook_alg_find
    failed to find the … …existance of RSA_OAEP algorithm
  * Increase test program/scripts timeout values (#131)
  * Fix test compilation warnings (#127)
  * Adapt alg_comp test to different zlib (#142)
  * Use checkout v3 Github action to avoid warnings (#137)
  * Alternative fix for fedora:rawide (#138)
  * lib/openssl/hmac.c: rename hmac function to jhmac (#130)
  * jose: build library only as shared (#119)
  * meson: add option to disable building manpages (#118)
  * Add a more descriptive error when jwk gen fails (#105)
  * Use "command -v" instead of "which" (deprecated) (#125)
  * Test for jq existing (used in jose-jwe-enc test) (#124)
  * Correct jose_jws.3 man page example (#122)
  * lib/hsh.c: rename hsh local variable (#111)
  * Avoid master word when possible (#120)
  * Fix github action CI by setting appropriate centos
  * Fix format of jose-jwe-enc man page
  * Meson Fixes
  * ci: make ubuntu:devel and fedora:rawhide not to fail the
    pipeline
  * ci: retry when installing the deps in debian/ubuntu
  * ci: remove travis-ci</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1713268800">- Update to version 13:
  * Fix potential DoS issue with p2c header (4ee7708)
  * Build updates (#148) (dae5654)
  * Display pkg_config in test logs (#134) (5e45732)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773748800">- update to 14:
  * openssl/oct: improve bound check for len
  * jwe: fix the case when we have "zip" in the protected header
  * Avoid potential DoS with high decompression chunks</changelog>
</package>
<package pkgid="3ce0aedad44925be17026ed8b7dac3d420b5871c7a3b3885279bfe2f8d6017b0b5af0c667f549eb8abbaf073a59f749863997e918d2d115ba2b732b646b297de" name="libjose0" arch="s390x">
  <version epoch="0" ver="14" rel="9.4"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- initial import of C-language implementation of Javascript Object
  Signing and Encryption, for use by clevis</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1709899200">- Update to version 12
  * Clean up some FreeBSD conditions (#98)
  * Add ES256K support (#90)
  * Meson changes (#135)
  * Update CI (#8) (#129)
  * lib/openssl/rsaes.c: Fix issue where jose_hook_alg_find
    failed to find the … …existance of RSA_OAEP algorithm
  * Increase test program/scripts timeout values (#131)
  * Fix test compilation warnings (#127)
  * Adapt alg_comp test to different zlib (#142)
  * Use checkout v3 Github action to avoid warnings (#137)
  * Alternative fix for fedora:rawide (#138)
  * lib/openssl/hmac.c: rename hmac function to jhmac (#130)
  * jose: build library only as shared (#119)
  * meson: add option to disable building manpages (#118)
  * Add a more descriptive error when jwk gen fails (#105)
  * Use "command -v" instead of "which" (deprecated) (#125)
  * Test for jq existing (used in jose-jwe-enc test) (#124)
  * Correct jose_jws.3 man page example (#122)
  * lib/hsh.c: rename hsh local variable (#111)
  * Avoid master word when possible (#120)
  * Fix github action CI by setting appropriate centos
  * Fix format of jose-jwe-enc man page
  * Meson Fixes
  * ci: make ubuntu:devel and fedora:rawhide not to fail the
    pipeline
  * ci: retry when installing the deps in debian/ubuntu
  * ci: remove travis-ci</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1713268800">- Update to version 13:
  * Fix potential DoS issue with p2c header (4ee7708)
  * Build updates (#148) (dae5654)
  * Display pkg_config in test logs (#134) (5e45732)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773748800">- update to 14:
  * openssl/oct: improve bound check for len
  * jwe: fix the case when we have "zip" in the protected header
  * Avoid potential DoS with high decompression chunks</changelog>
</package>
<package pkgid="9b4fb8ab327f42a5d46c4f8d82f22d57c813a00c6b859a05385dc0b38b90c99822b5fd8fd1cbfcad64c7fe12f2f48c6c4ecd9cf6d52682b9d582531adce8aec3" name="libjose0-debuginfo" arch="s390x">
  <version epoch="0" ver="14" rel="9.4"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- initial import of C-language implementation of Javascript Object
  Signing and Encryption, for use by clevis</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1709899200">- Update to version 12
  * Clean up some FreeBSD conditions (#98)
  * Add ES256K support (#90)
  * Meson changes (#135)
  * Update CI (#8) (#129)
  * lib/openssl/rsaes.c: Fix issue where jose_hook_alg_find
    failed to find the … …existance of RSA_OAEP algorithm
  * Increase test program/scripts timeout values (#131)
  * Fix test compilation warnings (#127)
  * Adapt alg_comp test to different zlib (#142)
  * Use checkout v3 Github action to avoid warnings (#137)
  * Alternative fix for fedora:rawide (#138)
  * lib/openssl/hmac.c: rename hmac function to jhmac (#130)
  * jose: build library only as shared (#119)
  * meson: add option to disable building manpages (#118)
  * Add a more descriptive error when jwk gen fails (#105)
  * Use "command -v" instead of "which" (deprecated) (#125)
  * Test for jq existing (used in jose-jwe-enc test) (#124)
  * Correct jose_jws.3 man page example (#122)
  * lib/hsh.c: rename hsh local variable (#111)
  * Avoid master word when possible (#120)
  * Fix github action CI by setting appropriate centos
  * Fix format of jose-jwe-enc man page
  * Meson Fixes
  * ci: make ubuntu:devel and fedora:rawhide not to fail the
    pipeline
  * ci: retry when installing the deps in debian/ubuntu
  * ci: remove travis-ci</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1713268800">- Update to version 13:
  * Fix potential DoS issue with p2c header (4ee7708)
  * Build updates (#148) (dae5654)
  * Display pkg_config in test logs (#134) (5e45732)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773748800">- update to 14:
  * openssl/oct: improve bound check for len
  * jwe: fix the case when we have "zip" in the protected header
  * Avoid potential DoS with high decompression chunks</changelog>
</package>
<package pkgid="1aa37bf4e132ac0f21fd90030bdffd52dc8653daf9636c0073b2f8576d6651afb872b4448b4d9257960c2121617b9bfb84b55731a0d637da49ed0fda2e11ac40" name="libkcapi" arch="src">
  <version epoch="0" ver="1.5.0" rel="49.141"/>
  <changelog author="abergmann@suse.com" date="1482408000">- Initial release 0.13.0.
  A library and tools to access the kernel crypto api.
  FATE#323554 bsc#1045948</changelog>
  <changelog author="jengelh@inai.de" date="1498651200">- Compact descriptions a bit
- Remove libkcapi provide/requires
- Use %_libdir throughout and avoid /lib</changelog>
  <changelog author="meissner@suse.com" date="1498737600">- libkcapi-use-external-fipshmac.patch: use external fipshmac,
  our chroots / vm builds do not necessarily have the right kernel.</changelog>
  <changelog author="bwiedemann@suse.com" date="1499515200">- Add reproduciblesort.patch to always link .o files in the same order and
- Add reproducibledate.patch to not add current time to man-pages to fix build-compare</changelog>
  <changelog author="meissner@suse.com" date="1499860800">- Change the signing to use openssl sha256/sha512 directly, to
  avoid fipscheck / hmaccalc.</changelog>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1569585600">- Remove docbook-utils BuildRequires, xmlto is sufficient
- Spec file cleanup, use license macro, drop defattr, drop BuildRoot</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1575547200">- Use %make_build and respect %optflags.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1578484800">- updated to 1.1.5:
  - Fix invocation of ansi_cprng in FIPS mode during testing
  - Fix testing on kernels &gt;= 5.0
  - Add virtualization test for kernel 5.1
  - Fix the limit between vmsplice() and sendmsg() by Christophe Leroy
  - Fix remove code duplication by Ondrej MosnÃ¡Äek
  - Fix potential memleak in speed-test
- updated to 1.1.4:
  - Fix: use sendmsg when processing more than 1&lt;&lt;16 bytes input data which improves performance on some architectures
- updated to 1.1.3:
  - Fix: default location of FIPS 140-2 HMAC control file is .&lt;orig file&gt;.hmac (was accidentally moved to &lt;orig file&gt;.hmac with 1.1.0)
- updated to 1.1.2:
  - Fix: Bug fixes for GCC 8.1.0 regarding string length checks by Krzysztof Kozlowski
  - Enhancement: ensure that tests execute on architectures other than X86 by Ondrej MosnÃ¡Äek
  - Fix: Bug fix to initialize FDs at the correct time in kcapi-kernel-if.c by Ondrej MosnÃ¡Äek
  - Test fix: Support test execution outside build environment by Ondrej MosnÃ¡Äek
- updated to 1.1.1:
  - Fix: Bug fixes for kcapi_hasher by Ondrej MosnÃ¡Äek
- updated to 1.1.0:
  - API Enhancement: Addition of kcapi_handle_reinit
  - Fix: simplify code by removing the internal *_fd functions from kcapi-kernel-if.c
  - Test enhancement: add IIV speed testing
  - Fix: add a loop around the read system call to always obtain all generated data
  - Fix: use host compiler for compiling docproc (reported by Christophe LEROY, fixed by BjÃ¶rn Esser)
  - Fix: make error handling of hashing applications consistent with coreutils applications (reported by Christophe LEROY)
  - Fix: support for zero length files (patched by Ondrej MosnÃ¡Äek)
  - Fix: support for zero message hashes on kernels &lt;= 4.9 (patched by Ondrej MosnÃ¡Äek)
  - Fix: Add Travis CI test system provided by Ondrej MosnÃ¡Äek
  - Fix: Add several fixes to kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Add additional tests for kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Apply unpadding only to last block of data by Ondrej MosnÃ¡Äek
  - Fix: Fix resource leaks in error code paths suggested by Ondrej MosnÃ¡Äek
  - Enhancement: achieve hmaccalc CLI equivalence by Ondrej MosnÃ¡Äek
- updated to 1.0.3:
  - Fix: support STDIN and --tag of sha*sum applications
  - Enhancement: Add small enhancements to support integration with distros -- reported by BjÃ¶rn Esser
- updated to 1.0.2:
  - Fix: hasher-test.sh on 32-bit systems
  - Fix: AIO return code handling on large number of requests -- reported by Jonathan Cameron
  - Enhancement: disable coredumps of library
  - Fix: remove unchecked -fstack-protector-strong from Makefile -- reported by Mathieu Malaterre
  - Fix: document that kcapi_cipher_stream_op must be called in a loop to collect all data in a multhreaded environment.
  - Test Fix: Update symmetric multithreaded stream test to invoke kcapi_cipher_stream_op in a loop to collect all data.
  - Fix: Initialize the cipher handle on stack with zeros as the library expects a zero-initialized cipher handle. This fixes a possible segfault where free() is called on a non-initialized memory location.
  - Fix: port algif_kpp and algif_akcipher to 4.15-rc3
- updated to 1.0.1:
  - Fix: constify AEAD cipher input data
  - Fix: use GCC byte swapping acceleration if present
  - Fix: KDF counter handling on little endian systems when generating more than 255 blocks
  - Use LD_PRELOAD for execution of test cases to force using of the freshly compiled binaries
  - Fix: return code handling of _kcapi_common_vmsplice_chunk_fd as reported by Christophe Leroy
  - Fix: return code handling in _kcapi_md_update
  - Fix: kcapi-hasher now supports files larger than 2GB
  - Fix: kcapi-dgst now supports files larger than 2GB
  - Fix: use stack protector
  - Fix: rename header guards to remove leading underscore as pointed out by Markus Elfring
  - Test Fix: Allow compiing the test code without asymmetric and KPP support
- updated to 1.0.0:
  - Fix: Small compile fixes for new checks of GCC 7
  - API Change: Rename all LOG_* enums to KCAPI_LOG_* to prevent namespace poisoning
  - Fix: soname and file name of library now compiles with conventions (thanks to Marcus Meissner)
  - Fix: kcapi-rng.c: unify FD/syscall read code and fix __NR_getrandom resolution
  - Enhancement: add kcapi-enc application to access symmetric encryption on command line
  - Fix: consolidate duplicate code in kcapi-hasher
  - Enhancement: add kcapi-dgst application to access hashes on command line
  - Enhancement: add kcapi-rng man page
  - Enhancement: add kcapi-rng --hex command line option
  - Fix: enable full symmetric AIO support
  - Fix: consolidate all test code into test/ and invoke all tests with test-invocation.sh
  - Fix: fix memleaks in error code paths as reported by clang
  - Fix: reduce memory footprint by rearranging data structures
  - Fix: kcapi-hasher is now fully FIPS 140-2 compliant as it now includes the integrity test for libkcapi.so
  - Enhancement: Add speed tests for MV-CESA accelerated ciphers and hash algorithms (thanks to Bastian Stender)
  - Test Enhancement: add kcapi-enc-test-large.c test testing edge conditions of AF_ALG
  - Test Enhancement: add virttest.sh - use of test system based on eudyptula-boot to test on linux-4.3.6, linux-4.4.86, linux-4.5, linux-4.7, linux-4.10, linux-4.12
  - Test Enhancement: add kcapi-fuzz-test.sh to support fuzzing the AF_ALG interfaces
  - Enhancement: add RPM SPEC file (tested with Fedora 26)
  - API Change: replace --disable-lib-asym with --enable-lib-asym as the algif_akcipher.c kernel interface is not likely to be added to the kernel anytime soon
  - API Enhancement: add KPP API which is not compiled by default, use --enable-lib-kpp (the algif_kpp.c kernel interface is not likely to be added to the Linux kernel any time soon)
  - Test Enhancement: Add KPP tests
  - Enhancement: Re-enable AIO support for symmetric and AEAD ciphers down to Linux kernels 4.1 and 4.7, respectively. This is due to integrating a fix against a kernel crash when using AIO.
  - Fix: simply KDF code base
  - API Enhancement: add message digest convenience functions kcapi_md_*sha*
  - API Enhancement: add cipher convenience functions kcapi_cipher_*_aes_*
  - API Enhancement: add rng convenience function kcapi_rng_get_bytes
  - API Change: remove kcapi_aead_getdata, use kcapi_aead_getdata_input and kcapi_aead_getdata_output instead
  - API Change: remove kcapi_aead_outbuflen, use kcapi_aead_outbuflen_enc and kcapi_aead_outbuflen_dec instead
- updated to 0.14.0:
  - AIO: fix tracking of completed IOCBs
  - speed-test: fix AEAD handling
  - speed-test: fix time calculation
  - compiler now warns a user of deprecated API calls
  - AIO: handle kernel errors for algif_skcipher gracefully
  - AIO: using multiple IOCB if algif_aead interface supports it
  - ASYM: add PKCS1 tests
  - AIO: add ASYM AIO support
  - AIO: fix AEAD AIO fallback
  - AIO: add AIO fallback testing
  - replace enforcement of symmetric cipher limits with a log message only (the underlying kernel implementations should catch any errors)
  - add fuzzing tests
  - use autotools build system as provided by Georges Savoundararadj with additional considerations from Marcin Nowakowski (thanks a lot)
  - ALG_MAX_PAGES restriction is gone with current AF_ALG interface
  - add HKDF (RFC5869)
  - add apps/kcapi-rng
  - add support for multiple accepts where the caller maintains the opfd
  - fix memleak in error case in PBKDF
  - add multithreaded symmetric cipher tests
  - enable full AIO support for kernels 4.13 and higher (fallback AIO implementation using synchronous support for earlier kernels) -- this is due to the broken AIO support for earlier kernels
  - Add tests for the AAD copy operation to be supported for kernel 4.13
- dropped libkcapi-use-external-fipshmac.patch (done differently in upstream)
- dropped reproduciblesort.patch (done differently upstream)
- dropped reproducibledate.patch: merged upstream
- libkcapi.keyring imported</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1598875200">- update to 1.2.0:
  * enhancement: kcapi-hasher: add madvise and 64 bit support by Brandur Simonsen
  * fix: fix clang warnding in KDF implementation by Khem Raj
  * fix: fix inverted logic in kcapi-main test logic reported by Ondrej Mosnáček
  * fix: return error when iteration count is zero for PBKDF as reported by
  Guido Vranken
  * enhancement: add function kcapi_cipher_stream_update_last to indicate the
  last block of a symmetric cipher stream operation
  * disable XTS multithreaded tests as it triggers a race discussed in
  https://github.com/smuellerDD/libkcapi/issues/92. The conclusion is
  the following: xts(aes) doesn't support chaining requests like for other
  ciphers such as CBC (at least as implemented in the kernel Crypto API).
  That can be seen in `crypto/testmgr.h` - the ciphers that are expected to
  return IVs usable for chaining have the `.iv_out` entries filled in in their
  test vectors (and those that don't support it do not). One can see that only
  CTR and CBC test vectors have them, not XTS.
  Looking again at how XTS is defined, it seems one could implement
  transparent chaining by simply decrypting the final tweak using the tweak
  key and return it as the output IV... but I believe this has never been
  mandated nor implemented in the Crypto API (likely because of the overhead
  of the final tweak decryption, which would be pointless if you're not going
  to use the output IV - and there is currently no way to signal to the driver
  that you are going to need it).
  * disable AIO parallel tests due to undefined behavior</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1627387200">- Update to version 1.3.1
  * fix: fix -Wconversion warnings (by Ondrej Mosnacek)
  * fix: fix bad data types in _kcapi_common_send_meta (by Ondrej Mosnacek)
  * fix: Version symbols to maintain ABI compatibility (by Simo Sorce)
  * fix: disable io_getevents on systems that do not support it (by Khem Raj)
  * fix: remove prctl PR_SET_DUMPABLE to allow library to be debugged - as the
    library does not store any sensitive data in data structures it owns, such
    security precautions may not be necessary considering the benefit of
    allowing regular debugging
  * fix: ensure that sendmsg is always used as fallback when vmsplice cannot be
    used
  * enhancement: add kcapi_set_maxsplicesize and kcapi_get_maxsplicesize
  * enhancement: the variable types are changed from int32_t to ssize_t and
    from uint32_t to size_t to match common POSIX and Linux APIs
- Added libkcapi-fix-lto.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- use https url</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974401">- Update to version 1.4.0
  * fix: ensure that LTO is supported (by Simo Sorce)
  * fix: add LTO regression testing (by Ondrej Mosnacek)
  * enhancement: add sm3sum, sm3hmac tools, add APIs kcapi_md_sm3, kcapi_md_hmac_sm3
  * enhancement: add SM4 convenience functions
  * fix: support AEAD encryption of arbitrary size with kcapi-enc
- removed libkcapi-fix-lto.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1678104000">- libkcapi was actually signed by the wrong key (bsc#1207892)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742126400">- update to 1.5.0:
  * kcapi-hasher is a new multi-call binary with a single hmac
  * move all sha* applications to the libexec directory to allow
    them to coexist with other packages sha* applications - the
    caller is expected to make a symlink to them
  * add sha3sum
  * add kcapi_md_sha3_* wrapper APIs
  * kcapi-enc: allow larger keysizes
  * kcapi-enc: PBKDF limits key size to 32 bytes
  * kcapi-enc: Add option --key-len to kcapi-enc to specify the
    length of key
  * library: set default log level to NONE
  * performance improvements
- HMACs are now all sha512hmac, and in (libdir)/hmaccalc
- code is dual-licended GPL-2.0-only / BSD-3-Clause
- package license texts</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1743768000">- fixed sumprefix to be "." as before, also stores sums in the binary
  directoris. changed back packaging to be same as before.</changelog>
</package>
<package pkgid="883731ae52f91dba2afc8151c5f49cb7f93b3aebefdabf47511635f8130cded23ed706e6c3a9a93f210edda8119e0c2fea096b16ad087c5761ca719ada20d30a" name="libkcapi-debuginfo" arch="s390x">
  <version epoch="0" ver="1.5.0" rel="49.141"/>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1569585600">- Remove docbook-utils BuildRequires, xmlto is sufficient
- Spec file cleanup, use license macro, drop defattr, drop BuildRoot</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1575547200">- Use %make_build and respect %optflags.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1578484800">- updated to 1.1.5:
  - Fix invocation of ansi_cprng in FIPS mode during testing
  - Fix testing on kernels &gt;= 5.0
  - Add virtualization test for kernel 5.1
  - Fix the limit between vmsplice() and sendmsg() by Christophe Leroy
  - Fix remove code duplication by Ondrej MosnÃ¡Äek
  - Fix potential memleak in speed-test
- updated to 1.1.4:
  - Fix: use sendmsg when processing more than 1&lt;&lt;16 bytes input data which improves performance on some architectures
- updated to 1.1.3:
  - Fix: default location of FIPS 140-2 HMAC control file is .&lt;orig file&gt;.hmac (was accidentally moved to &lt;orig file&gt;.hmac with 1.1.0)
- updated to 1.1.2:
  - Fix: Bug fixes for GCC 8.1.0 regarding string length checks by Krzysztof Kozlowski
  - Enhancement: ensure that tests execute on architectures other than X86 by Ondrej MosnÃ¡Äek
  - Fix: Bug fix to initialize FDs at the correct time in kcapi-kernel-if.c by Ondrej MosnÃ¡Äek
  - Test fix: Support test execution outside build environment by Ondrej MosnÃ¡Äek
- updated to 1.1.1:
  - Fix: Bug fixes for kcapi_hasher by Ondrej MosnÃ¡Äek
- updated to 1.1.0:
  - API Enhancement: Addition of kcapi_handle_reinit
  - Fix: simplify code by removing the internal *_fd functions from kcapi-kernel-if.c
  - Test enhancement: add IIV speed testing
  - Fix: add a loop around the read system call to always obtain all generated data
  - Fix: use host compiler for compiling docproc (reported by Christophe LEROY, fixed by BjÃ¶rn Esser)
  - Fix: make error handling of hashing applications consistent with coreutils applications (reported by Christophe LEROY)
  - Fix: support for zero length files (patched by Ondrej MosnÃ¡Äek)
  - Fix: support for zero message hashes on kernels &lt;= 4.9 (patched by Ondrej MosnÃ¡Äek)
  - Fix: Add Travis CI test system provided by Ondrej MosnÃ¡Äek
  - Fix: Add several fixes to kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Add additional tests for kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Apply unpadding only to last block of data by Ondrej MosnÃ¡Äek
  - Fix: Fix resource leaks in error code paths suggested by Ondrej MosnÃ¡Äek
  - Enhancement: achieve hmaccalc CLI equivalence by Ondrej MosnÃ¡Äek
- updated to 1.0.3:
  - Fix: support STDIN and --tag of sha*sum applications
  - Enhancement: Add small enhancements to support integration with distros -- reported by BjÃ¶rn Esser
- updated to 1.0.2:
  - Fix: hasher-test.sh on 32-bit systems
  - Fix: AIO return code handling on large number of requests -- reported by Jonathan Cameron
  - Enhancement: disable coredumps of library
  - Fix: remove unchecked -fstack-protector-strong from Makefile -- reported by Mathieu Malaterre
  - Fix: document that kcapi_cipher_stream_op must be called in a loop to collect all data in a multhreaded environment.
  - Test Fix: Update symmetric multithreaded stream test to invoke kcapi_cipher_stream_op in a loop to collect all data.
  - Fix: Initialize the cipher handle on stack with zeros as the library expects a zero-initialized cipher handle. This fixes a possible segfault where free() is called on a non-initialized memory location.
  - Fix: port algif_kpp and algif_akcipher to 4.15-rc3
- updated to 1.0.1:
  - Fix: constify AEAD cipher input data
  - Fix: use GCC byte swapping acceleration if present
  - Fix: KDF counter handling on little endian systems when generating more than 255 blocks
  - Use LD_PRELOAD for execution of test cases to force using of the freshly compiled binaries
  - Fix: return code handling of _kcapi_common_vmsplice_chunk_fd as reported by Christophe Leroy
  - Fix: return code handling in _kcapi_md_update
  - Fix: kcapi-hasher now supports files larger than 2GB
  - Fix: kcapi-dgst now supports files larger than 2GB
  - Fix: use stack protector
  - Fix: rename header guards to remove leading underscore as pointed out by Markus Elfring
  - Test Fix: Allow compiing the test code without asymmetric and KPP support
- updated to 1.0.0:
  - Fix: Small compile fixes for new checks of GCC 7
  - API Change: Rename all LOG_* enums to KCAPI_LOG_* to prevent namespace poisoning
  - Fix: soname and file name of library now compiles with conventions (thanks to Marcus Meissner)
  - Fix: kcapi-rng.c: unify FD/syscall read code and fix __NR_getrandom resolution
  - Enhancement: add kcapi-enc application to access symmetric encryption on command line
  - Fix: consolidate duplicate code in kcapi-hasher
  - Enhancement: add kcapi-dgst application to access hashes on command line
  - Enhancement: add kcapi-rng man page
  - Enhancement: add kcapi-rng --hex command line option
  - Fix: enable full symmetric AIO support
  - Fix: consolidate all test code into test/ and invoke all tests with test-invocation.sh
  - Fix: fix memleaks in error code paths as reported by clang
  - Fix: reduce memory footprint by rearranging data structures
  - Fix: kcapi-hasher is now fully FIPS 140-2 compliant as it now includes the integrity test for libkcapi.so
  - Enhancement: Add speed tests for MV-CESA accelerated ciphers and hash algorithms (thanks to Bastian Stender)
  - Test Enhancement: add kcapi-enc-test-large.c test testing edge conditions of AF_ALG
  - Test Enhancement: add virttest.sh - use of test system based on eudyptula-boot to test on linux-4.3.6, linux-4.4.86, linux-4.5, linux-4.7, linux-4.10, linux-4.12
  - Test Enhancement: add kcapi-fuzz-test.sh to support fuzzing the AF_ALG interfaces
  - Enhancement: add RPM SPEC file (tested with Fedora 26)
  - API Change: replace --disable-lib-asym with --enable-lib-asym as the algif_akcipher.c kernel interface is not likely to be added to the kernel anytime soon
  - API Enhancement: add KPP API which is not compiled by default, use --enable-lib-kpp (the algif_kpp.c kernel interface is not likely to be added to the Linux kernel any time soon)
  - Test Enhancement: Add KPP tests
  - Enhancement: Re-enable AIO support for symmetric and AEAD ciphers down to Linux kernels 4.1 and 4.7, respectively. This is due to integrating a fix against a kernel crash when using AIO.
  - Fix: simply KDF code base
  - API Enhancement: add message digest convenience functions kcapi_md_*sha*
  - API Enhancement: add cipher convenience functions kcapi_cipher_*_aes_*
  - API Enhancement: add rng convenience function kcapi_rng_get_bytes
  - API Change: remove kcapi_aead_getdata, use kcapi_aead_getdata_input and kcapi_aead_getdata_output instead
  - API Change: remove kcapi_aead_outbuflen, use kcapi_aead_outbuflen_enc and kcapi_aead_outbuflen_dec instead
- updated to 0.14.0:
  - AIO: fix tracking of completed IOCBs
  - speed-test: fix AEAD handling
  - speed-test: fix time calculation
  - compiler now warns a user of deprecated API calls
  - AIO: handle kernel errors for algif_skcipher gracefully
  - AIO: using multiple IOCB if algif_aead interface supports it
  - ASYM: add PKCS1 tests
  - AIO: add ASYM AIO support
  - AIO: fix AEAD AIO fallback
  - AIO: add AIO fallback testing
  - replace enforcement of symmetric cipher limits with a log message only (the underlying kernel implementations should catch any errors)
  - add fuzzing tests
  - use autotools build system as provided by Georges Savoundararadj with additional considerations from Marcin Nowakowski (thanks a lot)
  - ALG_MAX_PAGES restriction is gone with current AF_ALG interface
  - add HKDF (RFC5869)
  - add apps/kcapi-rng
  - add support for multiple accepts where the caller maintains the opfd
  - fix memleak in error case in PBKDF
  - add multithreaded symmetric cipher tests
  - enable full AIO support for kernels 4.13 and higher (fallback AIO implementation using synchronous support for earlier kernels) -- this is due to the broken AIO support for earlier kernels
  - Add tests for the AAD copy operation to be supported for kernel 4.13
- dropped libkcapi-use-external-fipshmac.patch (done differently in upstream)
- dropped reproduciblesort.patch (done differently upstream)
- dropped reproducibledate.patch: merged upstream
- libkcapi.keyring imported</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1598875200">- update to 1.2.0:
  * enhancement: kcapi-hasher: add madvise and 64 bit support by Brandur Simonsen
  * fix: fix clang warnding in KDF implementation by Khem Raj
  * fix: fix inverted logic in kcapi-main test logic reported by Ondrej Mosnáček
  * fix: return error when iteration count is zero for PBKDF as reported by
  Guido Vranken
  * enhancement: add function kcapi_cipher_stream_update_last to indicate the
  last block of a symmetric cipher stream operation
  * disable XTS multithreaded tests as it triggers a race discussed in
  https://github.com/smuellerDD/libkcapi/issues/92. The conclusion is
  the following: xts(aes) doesn't support chaining requests like for other
  ciphers such as CBC (at least as implemented in the kernel Crypto API).
  That can be seen in `crypto/testmgr.h` - the ciphers that are expected to
  return IVs usable for chaining have the `.iv_out` entries filled in in their
  test vectors (and those that don't support it do not). One can see that only
  CTR and CBC test vectors have them, not XTS.
  Looking again at how XTS is defined, it seems one could implement
  transparent chaining by simply decrypting the final tweak using the tweak
  key and return it as the output IV... but I believe this has never been
  mandated nor implemented in the Crypto API (likely because of the overhead
  of the final tweak decryption, which would be pointless if you're not going
  to use the output IV - and there is currently no way to signal to the driver
  that you are going to need it).
  * disable AIO parallel tests due to undefined behavior</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1627387200">- Update to version 1.3.1
  * fix: fix -Wconversion warnings (by Ondrej Mosnacek)
  * fix: fix bad data types in _kcapi_common_send_meta (by Ondrej Mosnacek)
  * fix: Version symbols to maintain ABI compatibility (by Simo Sorce)
  * fix: disable io_getevents on systems that do not support it (by Khem Raj)
  * fix: remove prctl PR_SET_DUMPABLE to allow library to be debugged - as the
    library does not store any sensitive data in data structures it owns, such
    security precautions may not be necessary considering the benefit of
    allowing regular debugging
  * fix: ensure that sendmsg is always used as fallback when vmsplice cannot be
    used
  * enhancement: add kcapi_set_maxsplicesize and kcapi_get_maxsplicesize
  * enhancement: the variable types are changed from int32_t to ssize_t and
    from uint32_t to size_t to match common POSIX and Linux APIs
- Added libkcapi-fix-lto.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- use https url</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974401">- Update to version 1.4.0
  * fix: ensure that LTO is supported (by Simo Sorce)
  * fix: add LTO regression testing (by Ondrej Mosnacek)
  * enhancement: add sm3sum, sm3hmac tools, add APIs kcapi_md_sm3, kcapi_md_hmac_sm3
  * enhancement: add SM4 convenience functions
  * fix: support AEAD encryption of arbitrary size with kcapi-enc
- removed libkcapi-fix-lto.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1678104000">- libkcapi was actually signed by the wrong key (bsc#1207892)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742126400">- update to 1.5.0:
  * kcapi-hasher is a new multi-call binary with a single hmac
  * move all sha* applications to the libexec directory to allow
    them to coexist with other packages sha* applications - the
    caller is expected to make a symlink to them
  * add sha3sum
  * add kcapi_md_sha3_* wrapper APIs
  * kcapi-enc: allow larger keysizes
  * kcapi-enc: PBKDF limits key size to 32 bytes
  * kcapi-enc: Add option --key-len to kcapi-enc to specify the
    length of key
  * library: set default log level to NONE
  * performance improvements
- HMACs are now all sha512hmac, and in (libdir)/hmaccalc
- code is dual-licended GPL-2.0-only / BSD-3-Clause
- package license texts</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1743768000">- fixed sumprefix to be "." as before, also stores sums in the binary
  directoris. changed back packaging to be same as before.</changelog>
</package>
<package pkgid="8ed2a678251eab927c1c8e50ade57e8a129047f801311ea5e3c73532ea4aea8650674cb451300cc9f7a83eeef71538ba5367101b19a064b16f9b557329ee2c60" name="libkcapi-debugsource" arch="s390x">
  <version epoch="0" ver="1.5.0" rel="49.141"/>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1569585600">- Remove docbook-utils BuildRequires, xmlto is sufficient
- Spec file cleanup, use license macro, drop defattr, drop BuildRoot</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1575547200">- Use %make_build and respect %optflags.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1578484800">- updated to 1.1.5:
  - Fix invocation of ansi_cprng in FIPS mode during testing
  - Fix testing on kernels &gt;= 5.0
  - Add virtualization test for kernel 5.1
  - Fix the limit between vmsplice() and sendmsg() by Christophe Leroy
  - Fix remove code duplication by Ondrej MosnÃ¡Äek
  - Fix potential memleak in speed-test
- updated to 1.1.4:
  - Fix: use sendmsg when processing more than 1&lt;&lt;16 bytes input data which improves performance on some architectures
- updated to 1.1.3:
  - Fix: default location of FIPS 140-2 HMAC control file is .&lt;orig file&gt;.hmac (was accidentally moved to &lt;orig file&gt;.hmac with 1.1.0)
- updated to 1.1.2:
  - Fix: Bug fixes for GCC 8.1.0 regarding string length checks by Krzysztof Kozlowski
  - Enhancement: ensure that tests execute on architectures other than X86 by Ondrej MosnÃ¡Äek
  - Fix: Bug fix to initialize FDs at the correct time in kcapi-kernel-if.c by Ondrej MosnÃ¡Äek
  - Test fix: Support test execution outside build environment by Ondrej MosnÃ¡Äek
- updated to 1.1.1:
  - Fix: Bug fixes for kcapi_hasher by Ondrej MosnÃ¡Äek
- updated to 1.1.0:
  - API Enhancement: Addition of kcapi_handle_reinit
  - Fix: simplify code by removing the internal *_fd functions from kcapi-kernel-if.c
  - Test enhancement: add IIV speed testing
  - Fix: add a loop around the read system call to always obtain all generated data
  - Fix: use host compiler for compiling docproc (reported by Christophe LEROY, fixed by BjÃ¶rn Esser)
  - Fix: make error handling of hashing applications consistent with coreutils applications (reported by Christophe LEROY)
  - Fix: support for zero length files (patched by Ondrej MosnÃ¡Äek)
  - Fix: support for zero message hashes on kernels &lt;= 4.9 (patched by Ondrej MosnÃ¡Äek)
  - Fix: Add Travis CI test system provided by Ondrej MosnÃ¡Äek
  - Fix: Add several fixes to kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Add additional tests for kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Apply unpadding only to last block of data by Ondrej MosnÃ¡Äek
  - Fix: Fix resource leaks in error code paths suggested by Ondrej MosnÃ¡Äek
  - Enhancement: achieve hmaccalc CLI equivalence by Ondrej MosnÃ¡Äek
- updated to 1.0.3:
  - Fix: support STDIN and --tag of sha*sum applications
  - Enhancement: Add small enhancements to support integration with distros -- reported by BjÃ¶rn Esser
- updated to 1.0.2:
  - Fix: hasher-test.sh on 32-bit systems
  - Fix: AIO return code handling on large number of requests -- reported by Jonathan Cameron
  - Enhancement: disable coredumps of library
  - Fix: remove unchecked -fstack-protector-strong from Makefile -- reported by Mathieu Malaterre
  - Fix: document that kcapi_cipher_stream_op must be called in a loop to collect all data in a multhreaded environment.
  - Test Fix: Update symmetric multithreaded stream test to invoke kcapi_cipher_stream_op in a loop to collect all data.
  - Fix: Initialize the cipher handle on stack with zeros as the library expects a zero-initialized cipher handle. This fixes a possible segfault where free() is called on a non-initialized memory location.
  - Fix: port algif_kpp and algif_akcipher to 4.15-rc3
- updated to 1.0.1:
  - Fix: constify AEAD cipher input data
  - Fix: use GCC byte swapping acceleration if present
  - Fix: KDF counter handling on little endian systems when generating more than 255 blocks
  - Use LD_PRELOAD for execution of test cases to force using of the freshly compiled binaries
  - Fix: return code handling of _kcapi_common_vmsplice_chunk_fd as reported by Christophe Leroy
  - Fix: return code handling in _kcapi_md_update
  - Fix: kcapi-hasher now supports files larger than 2GB
  - Fix: kcapi-dgst now supports files larger than 2GB
  - Fix: use stack protector
  - Fix: rename header guards to remove leading underscore as pointed out by Markus Elfring
  - Test Fix: Allow compiing the test code without asymmetric and KPP support
- updated to 1.0.0:
  - Fix: Small compile fixes for new checks of GCC 7
  - API Change: Rename all LOG_* enums to KCAPI_LOG_* to prevent namespace poisoning
  - Fix: soname and file name of library now compiles with conventions (thanks to Marcus Meissner)
  - Fix: kcapi-rng.c: unify FD/syscall read code and fix __NR_getrandom resolution
  - Enhancement: add kcapi-enc application to access symmetric encryption on command line
  - Fix: consolidate duplicate code in kcapi-hasher
  - Enhancement: add kcapi-dgst application to access hashes on command line
  - Enhancement: add kcapi-rng man page
  - Enhancement: add kcapi-rng --hex command line option
  - Fix: enable full symmetric AIO support
  - Fix: consolidate all test code into test/ and invoke all tests with test-invocation.sh
  - Fix: fix memleaks in error code paths as reported by clang
  - Fix: reduce memory footprint by rearranging data structures
  - Fix: kcapi-hasher is now fully FIPS 140-2 compliant as it now includes the integrity test for libkcapi.so
  - Enhancement: Add speed tests for MV-CESA accelerated ciphers and hash algorithms (thanks to Bastian Stender)
  - Test Enhancement: add kcapi-enc-test-large.c test testing edge conditions of AF_ALG
  - Test Enhancement: add virttest.sh - use of test system based on eudyptula-boot to test on linux-4.3.6, linux-4.4.86, linux-4.5, linux-4.7, linux-4.10, linux-4.12
  - Test Enhancement: add kcapi-fuzz-test.sh to support fuzzing the AF_ALG interfaces
  - Enhancement: add RPM SPEC file (tested with Fedora 26)
  - API Change: replace --disable-lib-asym with --enable-lib-asym as the algif_akcipher.c kernel interface is not likely to be added to the kernel anytime soon
  - API Enhancement: add KPP API which is not compiled by default, use --enable-lib-kpp (the algif_kpp.c kernel interface is not likely to be added to the Linux kernel any time soon)
  - Test Enhancement: Add KPP tests
  - Enhancement: Re-enable AIO support for symmetric and AEAD ciphers down to Linux kernels 4.1 and 4.7, respectively. This is due to integrating a fix against a kernel crash when using AIO.
  - Fix: simply KDF code base
  - API Enhancement: add message digest convenience functions kcapi_md_*sha*
  - API Enhancement: add cipher convenience functions kcapi_cipher_*_aes_*
  - API Enhancement: add rng convenience function kcapi_rng_get_bytes
  - API Change: remove kcapi_aead_getdata, use kcapi_aead_getdata_input and kcapi_aead_getdata_output instead
  - API Change: remove kcapi_aead_outbuflen, use kcapi_aead_outbuflen_enc and kcapi_aead_outbuflen_dec instead
- updated to 0.14.0:
  - AIO: fix tracking of completed IOCBs
  - speed-test: fix AEAD handling
  - speed-test: fix time calculation
  - compiler now warns a user of deprecated API calls
  - AIO: handle kernel errors for algif_skcipher gracefully
  - AIO: using multiple IOCB if algif_aead interface supports it
  - ASYM: add PKCS1 tests
  - AIO: add ASYM AIO support
  - AIO: fix AEAD AIO fallback
  - AIO: add AIO fallback testing
  - replace enforcement of symmetric cipher limits with a log message only (the underlying kernel implementations should catch any errors)
  - add fuzzing tests
  - use autotools build system as provided by Georges Savoundararadj with additional considerations from Marcin Nowakowski (thanks a lot)
  - ALG_MAX_PAGES restriction is gone with current AF_ALG interface
  - add HKDF (RFC5869)
  - add apps/kcapi-rng
  - add support for multiple accepts where the caller maintains the opfd
  - fix memleak in error case in PBKDF
  - add multithreaded symmetric cipher tests
  - enable full AIO support for kernels 4.13 and higher (fallback AIO implementation using synchronous support for earlier kernels) -- this is due to the broken AIO support for earlier kernels
  - Add tests for the AAD copy operation to be supported for kernel 4.13
- dropped libkcapi-use-external-fipshmac.patch (done differently in upstream)
- dropped reproduciblesort.patch (done differently upstream)
- dropped reproducibledate.patch: merged upstream
- libkcapi.keyring imported</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1598875200">- update to 1.2.0:
  * enhancement: kcapi-hasher: add madvise and 64 bit support by Brandur Simonsen
  * fix: fix clang warnding in KDF implementation by Khem Raj
  * fix: fix inverted logic in kcapi-main test logic reported by Ondrej Mosnáček
  * fix: return error when iteration count is zero for PBKDF as reported by
  Guido Vranken
  * enhancement: add function kcapi_cipher_stream_update_last to indicate the
  last block of a symmetric cipher stream operation
  * disable XTS multithreaded tests as it triggers a race discussed in
  https://github.com/smuellerDD/libkcapi/issues/92. The conclusion is
  the following: xts(aes) doesn't support chaining requests like for other
  ciphers such as CBC (at least as implemented in the kernel Crypto API).
  That can be seen in `crypto/testmgr.h` - the ciphers that are expected to
  return IVs usable for chaining have the `.iv_out` entries filled in in their
  test vectors (and those that don't support it do not). One can see that only
  CTR and CBC test vectors have them, not XTS.
  Looking again at how XTS is defined, it seems one could implement
  transparent chaining by simply decrypting the final tweak using the tweak
  key and return it as the output IV... but I believe this has never been
  mandated nor implemented in the Crypto API (likely because of the overhead
  of the final tweak decryption, which would be pointless if you're not going
  to use the output IV - and there is currently no way to signal to the driver
  that you are going to need it).
  * disable AIO parallel tests due to undefined behavior</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1627387200">- Update to version 1.3.1
  * fix: fix -Wconversion warnings (by Ondrej Mosnacek)
  * fix: fix bad data types in _kcapi_common_send_meta (by Ondrej Mosnacek)
  * fix: Version symbols to maintain ABI compatibility (by Simo Sorce)
  * fix: disable io_getevents on systems that do not support it (by Khem Raj)
  * fix: remove prctl PR_SET_DUMPABLE to allow library to be debugged - as the
    library does not store any sensitive data in data structures it owns, such
    security precautions may not be necessary considering the benefit of
    allowing regular debugging
  * fix: ensure that sendmsg is always used as fallback when vmsplice cannot be
    used
  * enhancement: add kcapi_set_maxsplicesize and kcapi_get_maxsplicesize
  * enhancement: the variable types are changed from int32_t to ssize_t and
    from uint32_t to size_t to match common POSIX and Linux APIs
- Added libkcapi-fix-lto.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- use https url</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974401">- Update to version 1.4.0
  * fix: ensure that LTO is supported (by Simo Sorce)
  * fix: add LTO regression testing (by Ondrej Mosnacek)
  * enhancement: add sm3sum, sm3hmac tools, add APIs kcapi_md_sm3, kcapi_md_hmac_sm3
  * enhancement: add SM4 convenience functions
  * fix: support AEAD encryption of arbitrary size with kcapi-enc
- removed libkcapi-fix-lto.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1678104000">- libkcapi was actually signed by the wrong key (bsc#1207892)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742126400">- update to 1.5.0:
  * kcapi-hasher is a new multi-call binary with a single hmac
  * move all sha* applications to the libexec directory to allow
    them to coexist with other packages sha* applications - the
    caller is expected to make a symlink to them
  * add sha3sum
  * add kcapi_md_sha3_* wrapper APIs
  * kcapi-enc: allow larger keysizes
  * kcapi-enc: PBKDF limits key size to 32 bytes
  * kcapi-enc: Add option --key-len to kcapi-enc to specify the
    length of key
  * library: set default log level to NONE
  * performance improvements
- HMACs are now all sha512hmac, and in (libdir)/hmaccalc
- code is dual-licended GPL-2.0-only / BSD-3-Clause
- package license texts</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1743768000">- fixed sumprefix to be "." as before, also stores sums in the binary
  directoris. changed back packaging to be same as before.</changelog>
</package>
<package pkgid="936242a3786f4896d45d6708c51ff3ce051d98fca1c044ca5bf27ac1402f199b83fe662c39684583d5bcac61d61b1485c731788ba6ce5bb018c868fb4d544187" name="libkcapi-devel" arch="s390x">
  <version epoch="0" ver="1.5.0" rel="49.141"/>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1569585600">- Remove docbook-utils BuildRequires, xmlto is sufficient
- Spec file cleanup, use license macro, drop defattr, drop BuildRoot</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1575547200">- Use %make_build and respect %optflags.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1578484800">- updated to 1.1.5:
  - Fix invocation of ansi_cprng in FIPS mode during testing
  - Fix testing on kernels &gt;= 5.0
  - Add virtualization test for kernel 5.1
  - Fix the limit between vmsplice() and sendmsg() by Christophe Leroy
  - Fix remove code duplication by Ondrej MosnÃ¡Äek
  - Fix potential memleak in speed-test
- updated to 1.1.4:
  - Fix: use sendmsg when processing more than 1&lt;&lt;16 bytes input data which improves performance on some architectures
- updated to 1.1.3:
  - Fix: default location of FIPS 140-2 HMAC control file is .&lt;orig file&gt;.hmac (was accidentally moved to &lt;orig file&gt;.hmac with 1.1.0)
- updated to 1.1.2:
  - Fix: Bug fixes for GCC 8.1.0 regarding string length checks by Krzysztof Kozlowski
  - Enhancement: ensure that tests execute on architectures other than X86 by Ondrej MosnÃ¡Äek
  - Fix: Bug fix to initialize FDs at the correct time in kcapi-kernel-if.c by Ondrej MosnÃ¡Äek
  - Test fix: Support test execution outside build environment by Ondrej MosnÃ¡Äek
- updated to 1.1.1:
  - Fix: Bug fixes for kcapi_hasher by Ondrej MosnÃ¡Äek
- updated to 1.1.0:
  - API Enhancement: Addition of kcapi_handle_reinit
  - Fix: simplify code by removing the internal *_fd functions from kcapi-kernel-if.c
  - Test enhancement: add IIV speed testing
  - Fix: add a loop around the read system call to always obtain all generated data
  - Fix: use host compiler for compiling docproc (reported by Christophe LEROY, fixed by BjÃ¶rn Esser)
  - Fix: make error handling of hashing applications consistent with coreutils applications (reported by Christophe LEROY)
  - Fix: support for zero length files (patched by Ondrej MosnÃ¡Äek)
  - Fix: support for zero message hashes on kernels &lt;= 4.9 (patched by Ondrej MosnÃ¡Äek)
  - Fix: Add Travis CI test system provided by Ondrej MosnÃ¡Äek
  - Fix: Add several fixes to kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Add additional tests for kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Apply unpadding only to last block of data by Ondrej MosnÃ¡Äek
  - Fix: Fix resource leaks in error code paths suggested by Ondrej MosnÃ¡Äek
  - Enhancement: achieve hmaccalc CLI equivalence by Ondrej MosnÃ¡Äek
- updated to 1.0.3:
  - Fix: support STDIN and --tag of sha*sum applications
  - Enhancement: Add small enhancements to support integration with distros -- reported by BjÃ¶rn Esser
- updated to 1.0.2:
  - Fix: hasher-test.sh on 32-bit systems
  - Fix: AIO return code handling on large number of requests -- reported by Jonathan Cameron
  - Enhancement: disable coredumps of library
  - Fix: remove unchecked -fstack-protector-strong from Makefile -- reported by Mathieu Malaterre
  - Fix: document that kcapi_cipher_stream_op must be called in a loop to collect all data in a multhreaded environment.
  - Test Fix: Update symmetric multithreaded stream test to invoke kcapi_cipher_stream_op in a loop to collect all data.
  - Fix: Initialize the cipher handle on stack with zeros as the library expects a zero-initialized cipher handle. This fixes a possible segfault where free() is called on a non-initialized memory location.
  - Fix: port algif_kpp and algif_akcipher to 4.15-rc3
- updated to 1.0.1:
  - Fix: constify AEAD cipher input data
  - Fix: use GCC byte swapping acceleration if present
  - Fix: KDF counter handling on little endian systems when generating more than 255 blocks
  - Use LD_PRELOAD for execution of test cases to force using of the freshly compiled binaries
  - Fix: return code handling of _kcapi_common_vmsplice_chunk_fd as reported by Christophe Leroy
  - Fix: return code handling in _kcapi_md_update
  - Fix: kcapi-hasher now supports files larger than 2GB
  - Fix: kcapi-dgst now supports files larger than 2GB
  - Fix: use stack protector
  - Fix: rename header guards to remove leading underscore as pointed out by Markus Elfring
  - Test Fix: Allow compiing the test code without asymmetric and KPP support
- updated to 1.0.0:
  - Fix: Small compile fixes for new checks of GCC 7
  - API Change: Rename all LOG_* enums to KCAPI_LOG_* to prevent namespace poisoning
  - Fix: soname and file name of library now compiles with conventions (thanks to Marcus Meissner)
  - Fix: kcapi-rng.c: unify FD/syscall read code and fix __NR_getrandom resolution
  - Enhancement: add kcapi-enc application to access symmetric encryption on command line
  - Fix: consolidate duplicate code in kcapi-hasher
  - Enhancement: add kcapi-dgst application to access hashes on command line
  - Enhancement: add kcapi-rng man page
  - Enhancement: add kcapi-rng --hex command line option
  - Fix: enable full symmetric AIO support
  - Fix: consolidate all test code into test/ and invoke all tests with test-invocation.sh
  - Fix: fix memleaks in error code paths as reported by clang
  - Fix: reduce memory footprint by rearranging data structures
  - Fix: kcapi-hasher is now fully FIPS 140-2 compliant as it now includes the integrity test for libkcapi.so
  - Enhancement: Add speed tests for MV-CESA accelerated ciphers and hash algorithms (thanks to Bastian Stender)
  - Test Enhancement: add kcapi-enc-test-large.c test testing edge conditions of AF_ALG
  - Test Enhancement: add virttest.sh - use of test system based on eudyptula-boot to test on linux-4.3.6, linux-4.4.86, linux-4.5, linux-4.7, linux-4.10, linux-4.12
  - Test Enhancement: add kcapi-fuzz-test.sh to support fuzzing the AF_ALG interfaces
  - Enhancement: add RPM SPEC file (tested with Fedora 26)
  - API Change: replace --disable-lib-asym with --enable-lib-asym as the algif_akcipher.c kernel interface is not likely to be added to the kernel anytime soon
  - API Enhancement: add KPP API which is not compiled by default, use --enable-lib-kpp (the algif_kpp.c kernel interface is not likely to be added to the Linux kernel any time soon)
  - Test Enhancement: Add KPP tests
  - Enhancement: Re-enable AIO support for symmetric and AEAD ciphers down to Linux kernels 4.1 and 4.7, respectively. This is due to integrating a fix against a kernel crash when using AIO.
  - Fix: simply KDF code base
  - API Enhancement: add message digest convenience functions kcapi_md_*sha*
  - API Enhancement: add cipher convenience functions kcapi_cipher_*_aes_*
  - API Enhancement: add rng convenience function kcapi_rng_get_bytes
  - API Change: remove kcapi_aead_getdata, use kcapi_aead_getdata_input and kcapi_aead_getdata_output instead
  - API Change: remove kcapi_aead_outbuflen, use kcapi_aead_outbuflen_enc and kcapi_aead_outbuflen_dec instead
- updated to 0.14.0:
  - AIO: fix tracking of completed IOCBs
  - speed-test: fix AEAD handling
  - speed-test: fix time calculation
  - compiler now warns a user of deprecated API calls
  - AIO: handle kernel errors for algif_skcipher gracefully
  - AIO: using multiple IOCB if algif_aead interface supports it
  - ASYM: add PKCS1 tests
  - AIO: add ASYM AIO support
  - AIO: fix AEAD AIO fallback
  - AIO: add AIO fallback testing
  - replace enforcement of symmetric cipher limits with a log message only (the underlying kernel implementations should catch any errors)
  - add fuzzing tests
  - use autotools build system as provided by Georges Savoundararadj with additional considerations from Marcin Nowakowski (thanks a lot)
  - ALG_MAX_PAGES restriction is gone with current AF_ALG interface
  - add HKDF (RFC5869)
  - add apps/kcapi-rng
  - add support for multiple accepts where the caller maintains the opfd
  - fix memleak in error case in PBKDF
  - add multithreaded symmetric cipher tests
  - enable full AIO support for kernels 4.13 and higher (fallback AIO implementation using synchronous support for earlier kernels) -- this is due to the broken AIO support for earlier kernels
  - Add tests for the AAD copy operation to be supported for kernel 4.13
- dropped libkcapi-use-external-fipshmac.patch (done differently in upstream)
- dropped reproduciblesort.patch (done differently upstream)
- dropped reproducibledate.patch: merged upstream
- libkcapi.keyring imported</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1598875200">- update to 1.2.0:
  * enhancement: kcapi-hasher: add madvise and 64 bit support by Brandur Simonsen
  * fix: fix clang warnding in KDF implementation by Khem Raj
  * fix: fix inverted logic in kcapi-main test logic reported by Ondrej Mosnáček
  * fix: return error when iteration count is zero for PBKDF as reported by
  Guido Vranken
  * enhancement: add function kcapi_cipher_stream_update_last to indicate the
  last block of a symmetric cipher stream operation
  * disable XTS multithreaded tests as it triggers a race discussed in
  https://github.com/smuellerDD/libkcapi/issues/92. The conclusion is
  the following: xts(aes) doesn't support chaining requests like for other
  ciphers such as CBC (at least as implemented in the kernel Crypto API).
  That can be seen in `crypto/testmgr.h` - the ciphers that are expected to
  return IVs usable for chaining have the `.iv_out` entries filled in in their
  test vectors (and those that don't support it do not). One can see that only
  CTR and CBC test vectors have them, not XTS.
  Looking again at how XTS is defined, it seems one could implement
  transparent chaining by simply decrypting the final tweak using the tweak
  key and return it as the output IV... but I believe this has never been
  mandated nor implemented in the Crypto API (likely because of the overhead
  of the final tweak decryption, which would be pointless if you're not going
  to use the output IV - and there is currently no way to signal to the driver
  that you are going to need it).
  * disable AIO parallel tests due to undefined behavior</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1627387200">- Update to version 1.3.1
  * fix: fix -Wconversion warnings (by Ondrej Mosnacek)
  * fix: fix bad data types in _kcapi_common_send_meta (by Ondrej Mosnacek)
  * fix: Version symbols to maintain ABI compatibility (by Simo Sorce)
  * fix: disable io_getevents on systems that do not support it (by Khem Raj)
  * fix: remove prctl PR_SET_DUMPABLE to allow library to be debugged - as the
    library does not store any sensitive data in data structures it owns, such
    security precautions may not be necessary considering the benefit of
    allowing regular debugging
  * fix: ensure that sendmsg is always used as fallback when vmsplice cannot be
    used
  * enhancement: add kcapi_set_maxsplicesize and kcapi_get_maxsplicesize
  * enhancement: the variable types are changed from int32_t to ssize_t and
    from uint32_t to size_t to match common POSIX and Linux APIs
- Added libkcapi-fix-lto.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- use https url</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974401">- Update to version 1.4.0
  * fix: ensure that LTO is supported (by Simo Sorce)
  * fix: add LTO regression testing (by Ondrej Mosnacek)
  * enhancement: add sm3sum, sm3hmac tools, add APIs kcapi_md_sm3, kcapi_md_hmac_sm3
  * enhancement: add SM4 convenience functions
  * fix: support AEAD encryption of arbitrary size with kcapi-enc
- removed libkcapi-fix-lto.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1678104000">- libkcapi was actually signed by the wrong key (bsc#1207892)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742126400">- update to 1.5.0:
  * kcapi-hasher is a new multi-call binary with a single hmac
  * move all sha* applications to the libexec directory to allow
    them to coexist with other packages sha* applications - the
    caller is expected to make a symlink to them
  * add sha3sum
  * add kcapi_md_sha3_* wrapper APIs
  * kcapi-enc: allow larger keysizes
  * kcapi-enc: PBKDF limits key size to 32 bytes
  * kcapi-enc: Add option --key-len to kcapi-enc to specify the
    length of key
  * library: set default log level to NONE
  * performance improvements
- HMACs are now all sha512hmac, and in (libdir)/hmaccalc
- code is dual-licended GPL-2.0-only / BSD-3-Clause
- package license texts</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1743768000">- fixed sumprefix to be "." as before, also stores sums in the binary
  directoris. changed back packaging to be same as before.</changelog>
</package>
<package pkgid="e58b11a77d1435034bc57c69bee407fa465bfdb89a531bb1abb9b70c30ba90fbadc56c7a08963d6b4d58ca5ddfc5f4076d7499d8f5df47c2f694c0e27203dc46" name="libkcapi-tools" arch="s390x">
  <version epoch="0" ver="1.5.0" rel="49.141"/>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1569585600">- Remove docbook-utils BuildRequires, xmlto is sufficient
- Spec file cleanup, use license macro, drop defattr, drop BuildRoot</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1575547200">- Use %make_build and respect %optflags.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1578484800">- updated to 1.1.5:
  - Fix invocation of ansi_cprng in FIPS mode during testing
  - Fix testing on kernels &gt;= 5.0
  - Add virtualization test for kernel 5.1
  - Fix the limit between vmsplice() and sendmsg() by Christophe Leroy
  - Fix remove code duplication by Ondrej MosnÃ¡Äek
  - Fix potential memleak in speed-test
- updated to 1.1.4:
  - Fix: use sendmsg when processing more than 1&lt;&lt;16 bytes input data which improves performance on some architectures
- updated to 1.1.3:
  - Fix: default location of FIPS 140-2 HMAC control file is .&lt;orig file&gt;.hmac (was accidentally moved to &lt;orig file&gt;.hmac with 1.1.0)
- updated to 1.1.2:
  - Fix: Bug fixes for GCC 8.1.0 regarding string length checks by Krzysztof Kozlowski
  - Enhancement: ensure that tests execute on architectures other than X86 by Ondrej MosnÃ¡Äek
  - Fix: Bug fix to initialize FDs at the correct time in kcapi-kernel-if.c by Ondrej MosnÃ¡Äek
  - Test fix: Support test execution outside build environment by Ondrej MosnÃ¡Äek
- updated to 1.1.1:
  - Fix: Bug fixes for kcapi_hasher by Ondrej MosnÃ¡Äek
- updated to 1.1.0:
  - API Enhancement: Addition of kcapi_handle_reinit
  - Fix: simplify code by removing the internal *_fd functions from kcapi-kernel-if.c
  - Test enhancement: add IIV speed testing
  - Fix: add a loop around the read system call to always obtain all generated data
  - Fix: use host compiler for compiling docproc (reported by Christophe LEROY, fixed by BjÃ¶rn Esser)
  - Fix: make error handling of hashing applications consistent with coreutils applications (reported by Christophe LEROY)
  - Fix: support for zero length files (patched by Ondrej MosnÃ¡Äek)
  - Fix: support for zero message hashes on kernels &lt;= 4.9 (patched by Ondrej MosnÃ¡Äek)
  - Fix: Add Travis CI test system provided by Ondrej MosnÃ¡Äek
  - Fix: Add several fixes to kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Add additional tests for kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Apply unpadding only to last block of data by Ondrej MosnÃ¡Äek
  - Fix: Fix resource leaks in error code paths suggested by Ondrej MosnÃ¡Äek
  - Enhancement: achieve hmaccalc CLI equivalence by Ondrej MosnÃ¡Äek
- updated to 1.0.3:
  - Fix: support STDIN and --tag of sha*sum applications
  - Enhancement: Add small enhancements to support integration with distros -- reported by BjÃ¶rn Esser
- updated to 1.0.2:
  - Fix: hasher-test.sh on 32-bit systems
  - Fix: AIO return code handling on large number of requests -- reported by Jonathan Cameron
  - Enhancement: disable coredumps of library
  - Fix: remove unchecked -fstack-protector-strong from Makefile -- reported by Mathieu Malaterre
  - Fix: document that kcapi_cipher_stream_op must be called in a loop to collect all data in a multhreaded environment.
  - Test Fix: Update symmetric multithreaded stream test to invoke kcapi_cipher_stream_op in a loop to collect all data.
  - Fix: Initialize the cipher handle on stack with zeros as the library expects a zero-initialized cipher handle. This fixes a possible segfault where free() is called on a non-initialized memory location.
  - Fix: port algif_kpp and algif_akcipher to 4.15-rc3
- updated to 1.0.1:
  - Fix: constify AEAD cipher input data
  - Fix: use GCC byte swapping acceleration if present
  - Fix: KDF counter handling on little endian systems when generating more than 255 blocks
  - Use LD_PRELOAD for execution of test cases to force using of the freshly compiled binaries
  - Fix: return code handling of _kcapi_common_vmsplice_chunk_fd as reported by Christophe Leroy
  - Fix: return code handling in _kcapi_md_update
  - Fix: kcapi-hasher now supports files larger than 2GB
  - Fix: kcapi-dgst now supports files larger than 2GB
  - Fix: use stack protector
  - Fix: rename header guards to remove leading underscore as pointed out by Markus Elfring
  - Test Fix: Allow compiing the test code without asymmetric and KPP support
- updated to 1.0.0:
  - Fix: Small compile fixes for new checks of GCC 7
  - API Change: Rename all LOG_* enums to KCAPI_LOG_* to prevent namespace poisoning
  - Fix: soname and file name of library now compiles with conventions (thanks to Marcus Meissner)
  - Fix: kcapi-rng.c: unify FD/syscall read code and fix __NR_getrandom resolution
  - Enhancement: add kcapi-enc application to access symmetric encryption on command line
  - Fix: consolidate duplicate code in kcapi-hasher
  - Enhancement: add kcapi-dgst application to access hashes on command line
  - Enhancement: add kcapi-rng man page
  - Enhancement: add kcapi-rng --hex command line option
  - Fix: enable full symmetric AIO support
  - Fix: consolidate all test code into test/ and invoke all tests with test-invocation.sh
  - Fix: fix memleaks in error code paths as reported by clang
  - Fix: reduce memory footprint by rearranging data structures
  - Fix: kcapi-hasher is now fully FIPS 140-2 compliant as it now includes the integrity test for libkcapi.so
  - Enhancement: Add speed tests for MV-CESA accelerated ciphers and hash algorithms (thanks to Bastian Stender)
  - Test Enhancement: add kcapi-enc-test-large.c test testing edge conditions of AF_ALG
  - Test Enhancement: add virttest.sh - use of test system based on eudyptula-boot to test on linux-4.3.6, linux-4.4.86, linux-4.5, linux-4.7, linux-4.10, linux-4.12
  - Test Enhancement: add kcapi-fuzz-test.sh to support fuzzing the AF_ALG interfaces
  - Enhancement: add RPM SPEC file (tested with Fedora 26)
  - API Change: replace --disable-lib-asym with --enable-lib-asym as the algif_akcipher.c kernel interface is not likely to be added to the kernel anytime soon
  - API Enhancement: add KPP API which is not compiled by default, use --enable-lib-kpp (the algif_kpp.c kernel interface is not likely to be added to the Linux kernel any time soon)
  - Test Enhancement: Add KPP tests
  - Enhancement: Re-enable AIO support for symmetric and AEAD ciphers down to Linux kernels 4.1 and 4.7, respectively. This is due to integrating a fix against a kernel crash when using AIO.
  - Fix: simply KDF code base
  - API Enhancement: add message digest convenience functions kcapi_md_*sha*
  - API Enhancement: add cipher convenience functions kcapi_cipher_*_aes_*
  - API Enhancement: add rng convenience function kcapi_rng_get_bytes
  - API Change: remove kcapi_aead_getdata, use kcapi_aead_getdata_input and kcapi_aead_getdata_output instead
  - API Change: remove kcapi_aead_outbuflen, use kcapi_aead_outbuflen_enc and kcapi_aead_outbuflen_dec instead
- updated to 0.14.0:
  - AIO: fix tracking of completed IOCBs
  - speed-test: fix AEAD handling
  - speed-test: fix time calculation
  - compiler now warns a user of deprecated API calls
  - AIO: handle kernel errors for algif_skcipher gracefully
  - AIO: using multiple IOCB if algif_aead interface supports it
  - ASYM: add PKCS1 tests
  - AIO: add ASYM AIO support
  - AIO: fix AEAD AIO fallback
  - AIO: add AIO fallback testing
  - replace enforcement of symmetric cipher limits with a log message only (the underlying kernel implementations should catch any errors)
  - add fuzzing tests
  - use autotools build system as provided by Georges Savoundararadj with additional considerations from Marcin Nowakowski (thanks a lot)
  - ALG_MAX_PAGES restriction is gone with current AF_ALG interface
  - add HKDF (RFC5869)
  - add apps/kcapi-rng
  - add support for multiple accepts where the caller maintains the opfd
  - fix memleak in error case in PBKDF
  - add multithreaded symmetric cipher tests
  - enable full AIO support for kernels 4.13 and higher (fallback AIO implementation using synchronous support for earlier kernels) -- this is due to the broken AIO support for earlier kernels
  - Add tests for the AAD copy operation to be supported for kernel 4.13
- dropped libkcapi-use-external-fipshmac.patch (done differently in upstream)
- dropped reproduciblesort.patch (done differently upstream)
- dropped reproducibledate.patch: merged upstream
- libkcapi.keyring imported</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1598875200">- update to 1.2.0:
  * enhancement: kcapi-hasher: add madvise and 64 bit support by Brandur Simonsen
  * fix: fix clang warnding in KDF implementation by Khem Raj
  * fix: fix inverted logic in kcapi-main test logic reported by Ondrej Mosnáček
  * fix: return error when iteration count is zero for PBKDF as reported by
  Guido Vranken
  * enhancement: add function kcapi_cipher_stream_update_last to indicate the
  last block of a symmetric cipher stream operation
  * disable XTS multithreaded tests as it triggers a race discussed in
  https://github.com/smuellerDD/libkcapi/issues/92. The conclusion is
  the following: xts(aes) doesn't support chaining requests like for other
  ciphers such as CBC (at least as implemented in the kernel Crypto API).
  That can be seen in `crypto/testmgr.h` - the ciphers that are expected to
  return IVs usable for chaining have the `.iv_out` entries filled in in their
  test vectors (and those that don't support it do not). One can see that only
  CTR and CBC test vectors have them, not XTS.
  Looking again at how XTS is defined, it seems one could implement
  transparent chaining by simply decrypting the final tweak using the tweak
  key and return it as the output IV... but I believe this has never been
  mandated nor implemented in the Crypto API (likely because of the overhead
  of the final tweak decryption, which would be pointless if you're not going
  to use the output IV - and there is currently no way to signal to the driver
  that you are going to need it).
  * disable AIO parallel tests due to undefined behavior</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1627387200">- Update to version 1.3.1
  * fix: fix -Wconversion warnings (by Ondrej Mosnacek)
  * fix: fix bad data types in _kcapi_common_send_meta (by Ondrej Mosnacek)
  * fix: Version symbols to maintain ABI compatibility (by Simo Sorce)
  * fix: disable io_getevents on systems that do not support it (by Khem Raj)
  * fix: remove prctl PR_SET_DUMPABLE to allow library to be debugged - as the
    library does not store any sensitive data in data structures it owns, such
    security precautions may not be necessary considering the benefit of
    allowing regular debugging
  * fix: ensure that sendmsg is always used as fallback when vmsplice cannot be
    used
  * enhancement: add kcapi_set_maxsplicesize and kcapi_get_maxsplicesize
  * enhancement: the variable types are changed from int32_t to ssize_t and
    from uint32_t to size_t to match common POSIX and Linux APIs
- Added libkcapi-fix-lto.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- use https url</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974401">- Update to version 1.4.0
  * fix: ensure that LTO is supported (by Simo Sorce)
  * fix: add LTO regression testing (by Ondrej Mosnacek)
  * enhancement: add sm3sum, sm3hmac tools, add APIs kcapi_md_sm3, kcapi_md_hmac_sm3
  * enhancement: add SM4 convenience functions
  * fix: support AEAD encryption of arbitrary size with kcapi-enc
- removed libkcapi-fix-lto.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1678104000">- libkcapi was actually signed by the wrong key (bsc#1207892)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742126400">- update to 1.5.0:
  * kcapi-hasher is a new multi-call binary with a single hmac
  * move all sha* applications to the libexec directory to allow
    them to coexist with other packages sha* applications - the
    caller is expected to make a symlink to them
  * add sha3sum
  * add kcapi_md_sha3_* wrapper APIs
  * kcapi-enc: allow larger keysizes
  * kcapi-enc: PBKDF limits key size to 32 bytes
  * kcapi-enc: Add option --key-len to kcapi-enc to specify the
    length of key
  * library: set default log level to NONE
  * performance improvements
- HMACs are now all sha512hmac, and in (libdir)/hmaccalc
- code is dual-licended GPL-2.0-only / BSD-3-Clause
- package license texts</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1743768000">- fixed sumprefix to be "." as before, also stores sums in the binary
  directoris. changed back packaging to be same as before.</changelog>
</package>
<package pkgid="9495abebd6900fb00af25d7e882f116b487a02b12fece3bcbccc901d191d61bcf333e061ab4fe4f958949bba25c44fe2405df678d246eb7505df5621f8f8d827" name="libkcapi-tools-debuginfo" arch="s390x">
  <version epoch="0" ver="1.5.0" rel="49.141"/>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1569585600">- Remove docbook-utils BuildRequires, xmlto is sufficient
- Spec file cleanup, use license macro, drop defattr, drop BuildRoot</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1575547200">- Use %make_build and respect %optflags.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1578484800">- updated to 1.1.5:
  - Fix invocation of ansi_cprng in FIPS mode during testing
  - Fix testing on kernels &gt;= 5.0
  - Add virtualization test for kernel 5.1
  - Fix the limit between vmsplice() and sendmsg() by Christophe Leroy
  - Fix remove code duplication by Ondrej MosnÃ¡Äek
  - Fix potential memleak in speed-test
- updated to 1.1.4:
  - Fix: use sendmsg when processing more than 1&lt;&lt;16 bytes input data which improves performance on some architectures
- updated to 1.1.3:
  - Fix: default location of FIPS 140-2 HMAC control file is .&lt;orig file&gt;.hmac (was accidentally moved to &lt;orig file&gt;.hmac with 1.1.0)
- updated to 1.1.2:
  - Fix: Bug fixes for GCC 8.1.0 regarding string length checks by Krzysztof Kozlowski
  - Enhancement: ensure that tests execute on architectures other than X86 by Ondrej MosnÃ¡Äek
  - Fix: Bug fix to initialize FDs at the correct time in kcapi-kernel-if.c by Ondrej MosnÃ¡Äek
  - Test fix: Support test execution outside build environment by Ondrej MosnÃ¡Äek
- updated to 1.1.1:
  - Fix: Bug fixes for kcapi_hasher by Ondrej MosnÃ¡Äek
- updated to 1.1.0:
  - API Enhancement: Addition of kcapi_handle_reinit
  - Fix: simplify code by removing the internal *_fd functions from kcapi-kernel-if.c
  - Test enhancement: add IIV speed testing
  - Fix: add a loop around the read system call to always obtain all generated data
  - Fix: use host compiler for compiling docproc (reported by Christophe LEROY, fixed by BjÃ¶rn Esser)
  - Fix: make error handling of hashing applications consistent with coreutils applications (reported by Christophe LEROY)
  - Fix: support for zero length files (patched by Ondrej MosnÃ¡Äek)
  - Fix: support for zero message hashes on kernels &lt;= 4.9 (patched by Ondrej MosnÃ¡Äek)
  - Fix: Add Travis CI test system provided by Ondrej MosnÃ¡Äek
  - Fix: Add several fixes to kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Add additional tests for kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Apply unpadding only to last block of data by Ondrej MosnÃ¡Äek
  - Fix: Fix resource leaks in error code paths suggested by Ondrej MosnÃ¡Äek
  - Enhancement: achieve hmaccalc CLI equivalence by Ondrej MosnÃ¡Äek
- updated to 1.0.3:
  - Fix: support STDIN and --tag of sha*sum applications
  - Enhancement: Add small enhancements to support integration with distros -- reported by BjÃ¶rn Esser
- updated to 1.0.2:
  - Fix: hasher-test.sh on 32-bit systems
  - Fix: AIO return code handling on large number of requests -- reported by Jonathan Cameron
  - Enhancement: disable coredumps of library
  - Fix: remove unchecked -fstack-protector-strong from Makefile -- reported by Mathieu Malaterre
  - Fix: document that kcapi_cipher_stream_op must be called in a loop to collect all data in a multhreaded environment.
  - Test Fix: Update symmetric multithreaded stream test to invoke kcapi_cipher_stream_op in a loop to collect all data.
  - Fix: Initialize the cipher handle on stack with zeros as the library expects a zero-initialized cipher handle. This fixes a possible segfault where free() is called on a non-initialized memory location.
  - Fix: port algif_kpp and algif_akcipher to 4.15-rc3
- updated to 1.0.1:
  - Fix: constify AEAD cipher input data
  - Fix: use GCC byte swapping acceleration if present
  - Fix: KDF counter handling on little endian systems when generating more than 255 blocks
  - Use LD_PRELOAD for execution of test cases to force using of the freshly compiled binaries
  - Fix: return code handling of _kcapi_common_vmsplice_chunk_fd as reported by Christophe Leroy
  - Fix: return code handling in _kcapi_md_update
  - Fix: kcapi-hasher now supports files larger than 2GB
  - Fix: kcapi-dgst now supports files larger than 2GB
  - Fix: use stack protector
  - Fix: rename header guards to remove leading underscore as pointed out by Markus Elfring
  - Test Fix: Allow compiing the test code without asymmetric and KPP support
- updated to 1.0.0:
  - Fix: Small compile fixes for new checks of GCC 7
  - API Change: Rename all LOG_* enums to KCAPI_LOG_* to prevent namespace poisoning
  - Fix: soname and file name of library now compiles with conventions (thanks to Marcus Meissner)
  - Fix: kcapi-rng.c: unify FD/syscall read code and fix __NR_getrandom resolution
  - Enhancement: add kcapi-enc application to access symmetric encryption on command line
  - Fix: consolidate duplicate code in kcapi-hasher
  - Enhancement: add kcapi-dgst application to access hashes on command line
  - Enhancement: add kcapi-rng man page
  - Enhancement: add kcapi-rng --hex command line option
  - Fix: enable full symmetric AIO support
  - Fix: consolidate all test code into test/ and invoke all tests with test-invocation.sh
  - Fix: fix memleaks in error code paths as reported by clang
  - Fix: reduce memory footprint by rearranging data structures
  - Fix: kcapi-hasher is now fully FIPS 140-2 compliant as it now includes the integrity test for libkcapi.so
  - Enhancement: Add speed tests for MV-CESA accelerated ciphers and hash algorithms (thanks to Bastian Stender)
  - Test Enhancement: add kcapi-enc-test-large.c test testing edge conditions of AF_ALG
  - Test Enhancement: add virttest.sh - use of test system based on eudyptula-boot to test on linux-4.3.6, linux-4.4.86, linux-4.5, linux-4.7, linux-4.10, linux-4.12
  - Test Enhancement: add kcapi-fuzz-test.sh to support fuzzing the AF_ALG interfaces
  - Enhancement: add RPM SPEC file (tested with Fedora 26)
  - API Change: replace --disable-lib-asym with --enable-lib-asym as the algif_akcipher.c kernel interface is not likely to be added to the kernel anytime soon
  - API Enhancement: add KPP API which is not compiled by default, use --enable-lib-kpp (the algif_kpp.c kernel interface is not likely to be added to the Linux kernel any time soon)
  - Test Enhancement: Add KPP tests
  - Enhancement: Re-enable AIO support for symmetric and AEAD ciphers down to Linux kernels 4.1 and 4.7, respectively. This is due to integrating a fix against a kernel crash when using AIO.
  - Fix: simply KDF code base
  - API Enhancement: add message digest convenience functions kcapi_md_*sha*
  - API Enhancement: add cipher convenience functions kcapi_cipher_*_aes_*
  - API Enhancement: add rng convenience function kcapi_rng_get_bytes
  - API Change: remove kcapi_aead_getdata, use kcapi_aead_getdata_input and kcapi_aead_getdata_output instead
  - API Change: remove kcapi_aead_outbuflen, use kcapi_aead_outbuflen_enc and kcapi_aead_outbuflen_dec instead
- updated to 0.14.0:
  - AIO: fix tracking of completed IOCBs
  - speed-test: fix AEAD handling
  - speed-test: fix time calculation
  - compiler now warns a user of deprecated API calls
  - AIO: handle kernel errors for algif_skcipher gracefully
  - AIO: using multiple IOCB if algif_aead interface supports it
  - ASYM: add PKCS1 tests
  - AIO: add ASYM AIO support
  - AIO: fix AEAD AIO fallback
  - AIO: add AIO fallback testing
  - replace enforcement of symmetric cipher limits with a log message only (the underlying kernel implementations should catch any errors)
  - add fuzzing tests
  - use autotools build system as provided by Georges Savoundararadj with additional considerations from Marcin Nowakowski (thanks a lot)
  - ALG_MAX_PAGES restriction is gone with current AF_ALG interface
  - add HKDF (RFC5869)
  - add apps/kcapi-rng
  - add support for multiple accepts where the caller maintains the opfd
  - fix memleak in error case in PBKDF
  - add multithreaded symmetric cipher tests
  - enable full AIO support for kernels 4.13 and higher (fallback AIO implementation using synchronous support for earlier kernels) -- this is due to the broken AIO support for earlier kernels
  - Add tests for the AAD copy operation to be supported for kernel 4.13
- dropped libkcapi-use-external-fipshmac.patch (done differently in upstream)
- dropped reproduciblesort.patch (done differently upstream)
- dropped reproducibledate.patch: merged upstream
- libkcapi.keyring imported</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1598875200">- update to 1.2.0:
  * enhancement: kcapi-hasher: add madvise and 64 bit support by Brandur Simonsen
  * fix: fix clang warnding in KDF implementation by Khem Raj
  * fix: fix inverted logic in kcapi-main test logic reported by Ondrej Mosnáček
  * fix: return error when iteration count is zero for PBKDF as reported by
  Guido Vranken
  * enhancement: add function kcapi_cipher_stream_update_last to indicate the
  last block of a symmetric cipher stream operation
  * disable XTS multithreaded tests as it triggers a race discussed in
  https://github.com/smuellerDD/libkcapi/issues/92. The conclusion is
  the following: xts(aes) doesn't support chaining requests like for other
  ciphers such as CBC (at least as implemented in the kernel Crypto API).
  That can be seen in `crypto/testmgr.h` - the ciphers that are expected to
  return IVs usable for chaining have the `.iv_out` entries filled in in their
  test vectors (and those that don't support it do not). One can see that only
  CTR and CBC test vectors have them, not XTS.
  Looking again at how XTS is defined, it seems one could implement
  transparent chaining by simply decrypting the final tweak using the tweak
  key and return it as the output IV... but I believe this has never been
  mandated nor implemented in the Crypto API (likely because of the overhead
  of the final tweak decryption, which would be pointless if you're not going
  to use the output IV - and there is currently no way to signal to the driver
  that you are going to need it).
  * disable AIO parallel tests due to undefined behavior</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1627387200">- Update to version 1.3.1
  * fix: fix -Wconversion warnings (by Ondrej Mosnacek)
  * fix: fix bad data types in _kcapi_common_send_meta (by Ondrej Mosnacek)
  * fix: Version symbols to maintain ABI compatibility (by Simo Sorce)
  * fix: disable io_getevents on systems that do not support it (by Khem Raj)
  * fix: remove prctl PR_SET_DUMPABLE to allow library to be debugged - as the
    library does not store any sensitive data in data structures it owns, such
    security precautions may not be necessary considering the benefit of
    allowing regular debugging
  * fix: ensure that sendmsg is always used as fallback when vmsplice cannot be
    used
  * enhancement: add kcapi_set_maxsplicesize and kcapi_get_maxsplicesize
  * enhancement: the variable types are changed from int32_t to ssize_t and
    from uint32_t to size_t to match common POSIX and Linux APIs
- Added libkcapi-fix-lto.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- use https url</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974401">- Update to version 1.4.0
  * fix: ensure that LTO is supported (by Simo Sorce)
  * fix: add LTO regression testing (by Ondrej Mosnacek)
  * enhancement: add sm3sum, sm3hmac tools, add APIs kcapi_md_sm3, kcapi_md_hmac_sm3
  * enhancement: add SM4 convenience functions
  * fix: support AEAD encryption of arbitrary size with kcapi-enc
- removed libkcapi-fix-lto.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1678104000">- libkcapi was actually signed by the wrong key (bsc#1207892)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742126400">- update to 1.5.0:
  * kcapi-hasher is a new multi-call binary with a single hmac
  * move all sha* applications to the libexec directory to allow
    them to coexist with other packages sha* applications - the
    caller is expected to make a symlink to them
  * add sha3sum
  * add kcapi_md_sha3_* wrapper APIs
  * kcapi-enc: allow larger keysizes
  * kcapi-enc: PBKDF limits key size to 32 bytes
  * kcapi-enc: Add option --key-len to kcapi-enc to specify the
    length of key
  * library: set default log level to NONE
  * performance improvements
- HMACs are now all sha512hmac, and in (libdir)/hmaccalc
- code is dual-licended GPL-2.0-only / BSD-3-Clause
- package license texts</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1743768000">- fixed sumprefix to be "." as before, also stores sums in the binary
  directoris. changed back packaging to be same as before.</changelog>
</package>
<package pkgid="bb067884efedae48f394ddeea5542307a07c95e95894b5db32838fc780e59213eef631b3ea570fd57b7d1a55cc3d1a1ae6473fbbbb9cd0ade75f523e4ca0fbc0" name="libkcapi1" arch="s390x">
  <version epoch="0" ver="1.5.0" rel="49.141"/>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1569585600">- Remove docbook-utils BuildRequires, xmlto is sufficient
- Spec file cleanup, use license macro, drop defattr, drop BuildRoot</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1575547200">- Use %make_build and respect %optflags.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1578484800">- updated to 1.1.5:
  - Fix invocation of ansi_cprng in FIPS mode during testing
  - Fix testing on kernels &gt;= 5.0
  - Add virtualization test for kernel 5.1
  - Fix the limit between vmsplice() and sendmsg() by Christophe Leroy
  - Fix remove code duplication by Ondrej MosnÃ¡Äek
  - Fix potential memleak in speed-test
- updated to 1.1.4:
  - Fix: use sendmsg when processing more than 1&lt;&lt;16 bytes input data which improves performance on some architectures
- updated to 1.1.3:
  - Fix: default location of FIPS 140-2 HMAC control file is .&lt;orig file&gt;.hmac (was accidentally moved to &lt;orig file&gt;.hmac with 1.1.0)
- updated to 1.1.2:
  - Fix: Bug fixes for GCC 8.1.0 regarding string length checks by Krzysztof Kozlowski
  - Enhancement: ensure that tests execute on architectures other than X86 by Ondrej MosnÃ¡Äek
  - Fix: Bug fix to initialize FDs at the correct time in kcapi-kernel-if.c by Ondrej MosnÃ¡Äek
  - Test fix: Support test execution outside build environment by Ondrej MosnÃ¡Äek
- updated to 1.1.1:
  - Fix: Bug fixes for kcapi_hasher by Ondrej MosnÃ¡Äek
- updated to 1.1.0:
  - API Enhancement: Addition of kcapi_handle_reinit
  - Fix: simplify code by removing the internal *_fd functions from kcapi-kernel-if.c
  - Test enhancement: add IIV speed testing
  - Fix: add a loop around the read system call to always obtain all generated data
  - Fix: use host compiler for compiling docproc (reported by Christophe LEROY, fixed by BjÃ¶rn Esser)
  - Fix: make error handling of hashing applications consistent with coreutils applications (reported by Christophe LEROY)
  - Fix: support for zero length files (patched by Ondrej MosnÃ¡Äek)
  - Fix: support for zero message hashes on kernels &lt;= 4.9 (patched by Ondrej MosnÃ¡Äek)
  - Fix: Add Travis CI test system provided by Ondrej MosnÃ¡Äek
  - Fix: Add several fixes to kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Add additional tests for kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Apply unpadding only to last block of data by Ondrej MosnÃ¡Äek
  - Fix: Fix resource leaks in error code paths suggested by Ondrej MosnÃ¡Äek
  - Enhancement: achieve hmaccalc CLI equivalence by Ondrej MosnÃ¡Äek
- updated to 1.0.3:
  - Fix: support STDIN and --tag of sha*sum applications
  - Enhancement: Add small enhancements to support integration with distros -- reported by BjÃ¶rn Esser
- updated to 1.0.2:
  - Fix: hasher-test.sh on 32-bit systems
  - Fix: AIO return code handling on large number of requests -- reported by Jonathan Cameron
  - Enhancement: disable coredumps of library
  - Fix: remove unchecked -fstack-protector-strong from Makefile -- reported by Mathieu Malaterre
  - Fix: document that kcapi_cipher_stream_op must be called in a loop to collect all data in a multhreaded environment.
  - Test Fix: Update symmetric multithreaded stream test to invoke kcapi_cipher_stream_op in a loop to collect all data.
  - Fix: Initialize the cipher handle on stack with zeros as the library expects a zero-initialized cipher handle. This fixes a possible segfault where free() is called on a non-initialized memory location.
  - Fix: port algif_kpp and algif_akcipher to 4.15-rc3
- updated to 1.0.1:
  - Fix: constify AEAD cipher input data
  - Fix: use GCC byte swapping acceleration if present
  - Fix: KDF counter handling on little endian systems when generating more than 255 blocks
  - Use LD_PRELOAD for execution of test cases to force using of the freshly compiled binaries
  - Fix: return code handling of _kcapi_common_vmsplice_chunk_fd as reported by Christophe Leroy
  - Fix: return code handling in _kcapi_md_update
  - Fix: kcapi-hasher now supports files larger than 2GB
  - Fix: kcapi-dgst now supports files larger than 2GB
  - Fix: use stack protector
  - Fix: rename header guards to remove leading underscore as pointed out by Markus Elfring
  - Test Fix: Allow compiing the test code without asymmetric and KPP support
- updated to 1.0.0:
  - Fix: Small compile fixes for new checks of GCC 7
  - API Change: Rename all LOG_* enums to KCAPI_LOG_* to prevent namespace poisoning
  - Fix: soname and file name of library now compiles with conventions (thanks to Marcus Meissner)
  - Fix: kcapi-rng.c: unify FD/syscall read code and fix __NR_getrandom resolution
  - Enhancement: add kcapi-enc application to access symmetric encryption on command line
  - Fix: consolidate duplicate code in kcapi-hasher
  - Enhancement: add kcapi-dgst application to access hashes on command line
  - Enhancement: add kcapi-rng man page
  - Enhancement: add kcapi-rng --hex command line option
  - Fix: enable full symmetric AIO support
  - Fix: consolidate all test code into test/ and invoke all tests with test-invocation.sh
  - Fix: fix memleaks in error code paths as reported by clang
  - Fix: reduce memory footprint by rearranging data structures
  - Fix: kcapi-hasher is now fully FIPS 140-2 compliant as it now includes the integrity test for libkcapi.so
  - Enhancement: Add speed tests for MV-CESA accelerated ciphers and hash algorithms (thanks to Bastian Stender)
  - Test Enhancement: add kcapi-enc-test-large.c test testing edge conditions of AF_ALG
  - Test Enhancement: add virttest.sh - use of test system based on eudyptula-boot to test on linux-4.3.6, linux-4.4.86, linux-4.5, linux-4.7, linux-4.10, linux-4.12
  - Test Enhancement: add kcapi-fuzz-test.sh to support fuzzing the AF_ALG interfaces
  - Enhancement: add RPM SPEC file (tested with Fedora 26)
  - API Change: replace --disable-lib-asym with --enable-lib-asym as the algif_akcipher.c kernel interface is not likely to be added to the kernel anytime soon
  - API Enhancement: add KPP API which is not compiled by default, use --enable-lib-kpp (the algif_kpp.c kernel interface is not likely to be added to the Linux kernel any time soon)
  - Test Enhancement: Add KPP tests
  - Enhancement: Re-enable AIO support for symmetric and AEAD ciphers down to Linux kernels 4.1 and 4.7, respectively. This is due to integrating a fix against a kernel crash when using AIO.
  - Fix: simply KDF code base
  - API Enhancement: add message digest convenience functions kcapi_md_*sha*
  - API Enhancement: add cipher convenience functions kcapi_cipher_*_aes_*
  - API Enhancement: add rng convenience function kcapi_rng_get_bytes
  - API Change: remove kcapi_aead_getdata, use kcapi_aead_getdata_input and kcapi_aead_getdata_output instead
  - API Change: remove kcapi_aead_outbuflen, use kcapi_aead_outbuflen_enc and kcapi_aead_outbuflen_dec instead
- updated to 0.14.0:
  - AIO: fix tracking of completed IOCBs
  - speed-test: fix AEAD handling
  - speed-test: fix time calculation
  - compiler now warns a user of deprecated API calls
  - AIO: handle kernel errors for algif_skcipher gracefully
  - AIO: using multiple IOCB if algif_aead interface supports it
  - ASYM: add PKCS1 tests
  - AIO: add ASYM AIO support
  - AIO: fix AEAD AIO fallback
  - AIO: add AIO fallback testing
  - replace enforcement of symmetric cipher limits with a log message only (the underlying kernel implementations should catch any errors)
  - add fuzzing tests
  - use autotools build system as provided by Georges Savoundararadj with additional considerations from Marcin Nowakowski (thanks a lot)
  - ALG_MAX_PAGES restriction is gone with current AF_ALG interface
  - add HKDF (RFC5869)
  - add apps/kcapi-rng
  - add support for multiple accepts where the caller maintains the opfd
  - fix memleak in error case in PBKDF
  - add multithreaded symmetric cipher tests
  - enable full AIO support for kernels 4.13 and higher (fallback AIO implementation using synchronous support for earlier kernels) -- this is due to the broken AIO support for earlier kernels
  - Add tests for the AAD copy operation to be supported for kernel 4.13
- dropped libkcapi-use-external-fipshmac.patch (done differently in upstream)
- dropped reproduciblesort.patch (done differently upstream)
- dropped reproducibledate.patch: merged upstream
- libkcapi.keyring imported</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1598875200">- update to 1.2.0:
  * enhancement: kcapi-hasher: add madvise and 64 bit support by Brandur Simonsen
  * fix: fix clang warnding in KDF implementation by Khem Raj
  * fix: fix inverted logic in kcapi-main test logic reported by Ondrej Mosnáček
  * fix: return error when iteration count is zero for PBKDF as reported by
  Guido Vranken
  * enhancement: add function kcapi_cipher_stream_update_last to indicate the
  last block of a symmetric cipher stream operation
  * disable XTS multithreaded tests as it triggers a race discussed in
  https://github.com/smuellerDD/libkcapi/issues/92. The conclusion is
  the following: xts(aes) doesn't support chaining requests like for other
  ciphers such as CBC (at least as implemented in the kernel Crypto API).
  That can be seen in `crypto/testmgr.h` - the ciphers that are expected to
  return IVs usable for chaining have the `.iv_out` entries filled in in their
  test vectors (and those that don't support it do not). One can see that only
  CTR and CBC test vectors have them, not XTS.
  Looking again at how XTS is defined, it seems one could implement
  transparent chaining by simply decrypting the final tweak using the tweak
  key and return it as the output IV... but I believe this has never been
  mandated nor implemented in the Crypto API (likely because of the overhead
  of the final tweak decryption, which would be pointless if you're not going
  to use the output IV - and there is currently no way to signal to the driver
  that you are going to need it).
  * disable AIO parallel tests due to undefined behavior</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1627387200">- Update to version 1.3.1
  * fix: fix -Wconversion warnings (by Ondrej Mosnacek)
  * fix: fix bad data types in _kcapi_common_send_meta (by Ondrej Mosnacek)
  * fix: Version symbols to maintain ABI compatibility (by Simo Sorce)
  * fix: disable io_getevents on systems that do not support it (by Khem Raj)
  * fix: remove prctl PR_SET_DUMPABLE to allow library to be debugged - as the
    library does not store any sensitive data in data structures it owns, such
    security precautions may not be necessary considering the benefit of
    allowing regular debugging
  * fix: ensure that sendmsg is always used as fallback when vmsplice cannot be
    used
  * enhancement: add kcapi_set_maxsplicesize and kcapi_get_maxsplicesize
  * enhancement: the variable types are changed from int32_t to ssize_t and
    from uint32_t to size_t to match common POSIX and Linux APIs
- Added libkcapi-fix-lto.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- use https url</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974401">- Update to version 1.4.0
  * fix: ensure that LTO is supported (by Simo Sorce)
  * fix: add LTO regression testing (by Ondrej Mosnacek)
  * enhancement: add sm3sum, sm3hmac tools, add APIs kcapi_md_sm3, kcapi_md_hmac_sm3
  * enhancement: add SM4 convenience functions
  * fix: support AEAD encryption of arbitrary size with kcapi-enc
- removed libkcapi-fix-lto.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1678104000">- libkcapi was actually signed by the wrong key (bsc#1207892)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742126400">- update to 1.5.0:
  * kcapi-hasher is a new multi-call binary with a single hmac
  * move all sha* applications to the libexec directory to allow
    them to coexist with other packages sha* applications - the
    caller is expected to make a symlink to them
  * add sha3sum
  * add kcapi_md_sha3_* wrapper APIs
  * kcapi-enc: allow larger keysizes
  * kcapi-enc: PBKDF limits key size to 32 bytes
  * kcapi-enc: Add option --key-len to kcapi-enc to specify the
    length of key
  * library: set default log level to NONE
  * performance improvements
- HMACs are now all sha512hmac, and in (libdir)/hmaccalc
- code is dual-licended GPL-2.0-only / BSD-3-Clause
- package license texts</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1743768000">- fixed sumprefix to be "." as before, also stores sums in the binary
  directoris. changed back packaging to be same as before.</changelog>
</package>
<package pkgid="3e93793bee43180d891380e27166daf7f2d45095d36401e39a3c8a8ff6a927dfe7577608dd21984ec566c0e201f0d2f89526504417ed2ec706f076a7e13eebd9" name="libkcapi1-debuginfo" arch="s390x">
  <version epoch="0" ver="1.5.0" rel="49.141"/>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1569585600">- Remove docbook-utils BuildRequires, xmlto is sufficient
- Spec file cleanup, use license macro, drop defattr, drop BuildRoot</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1575547200">- Use %make_build and respect %optflags.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1578484800">- updated to 1.1.5:
  - Fix invocation of ansi_cprng in FIPS mode during testing
  - Fix testing on kernels &gt;= 5.0
  - Add virtualization test for kernel 5.1
  - Fix the limit between vmsplice() and sendmsg() by Christophe Leroy
  - Fix remove code duplication by Ondrej MosnÃ¡Äek
  - Fix potential memleak in speed-test
- updated to 1.1.4:
  - Fix: use sendmsg when processing more than 1&lt;&lt;16 bytes input data which improves performance on some architectures
- updated to 1.1.3:
  - Fix: default location of FIPS 140-2 HMAC control file is .&lt;orig file&gt;.hmac (was accidentally moved to &lt;orig file&gt;.hmac with 1.1.0)
- updated to 1.1.2:
  - Fix: Bug fixes for GCC 8.1.0 regarding string length checks by Krzysztof Kozlowski
  - Enhancement: ensure that tests execute on architectures other than X86 by Ondrej MosnÃ¡Äek
  - Fix: Bug fix to initialize FDs at the correct time in kcapi-kernel-if.c by Ondrej MosnÃ¡Äek
  - Test fix: Support test execution outside build environment by Ondrej MosnÃ¡Äek
- updated to 1.1.1:
  - Fix: Bug fixes for kcapi_hasher by Ondrej MosnÃ¡Äek
- updated to 1.1.0:
  - API Enhancement: Addition of kcapi_handle_reinit
  - Fix: simplify code by removing the internal *_fd functions from kcapi-kernel-if.c
  - Test enhancement: add IIV speed testing
  - Fix: add a loop around the read system call to always obtain all generated data
  - Fix: use host compiler for compiling docproc (reported by Christophe LEROY, fixed by BjÃ¶rn Esser)
  - Fix: make error handling of hashing applications consistent with coreutils applications (reported by Christophe LEROY)
  - Fix: support for zero length files (patched by Ondrej MosnÃ¡Äek)
  - Fix: support for zero message hashes on kernels &lt;= 4.9 (patched by Ondrej MosnÃ¡Äek)
  - Fix: Add Travis CI test system provided by Ondrej MosnÃ¡Äek
  - Fix: Add several fixes to kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Add additional tests for kcapi-hasher by Ondrej MosnÃ¡Äek
  - Fix: Apply unpadding only to last block of data by Ondrej MosnÃ¡Äek
  - Fix: Fix resource leaks in error code paths suggested by Ondrej MosnÃ¡Äek
  - Enhancement: achieve hmaccalc CLI equivalence by Ondrej MosnÃ¡Äek
- updated to 1.0.3:
  - Fix: support STDIN and --tag of sha*sum applications
  - Enhancement: Add small enhancements to support integration with distros -- reported by BjÃ¶rn Esser
- updated to 1.0.2:
  - Fix: hasher-test.sh on 32-bit systems
  - Fix: AIO return code handling on large number of requests -- reported by Jonathan Cameron
  - Enhancement: disable coredumps of library
  - Fix: remove unchecked -fstack-protector-strong from Makefile -- reported by Mathieu Malaterre
  - Fix: document that kcapi_cipher_stream_op must be called in a loop to collect all data in a multhreaded environment.
  - Test Fix: Update symmetric multithreaded stream test to invoke kcapi_cipher_stream_op in a loop to collect all data.
  - Fix: Initialize the cipher handle on stack with zeros as the library expects a zero-initialized cipher handle. This fixes a possible segfault where free() is called on a non-initialized memory location.
  - Fix: port algif_kpp and algif_akcipher to 4.15-rc3
- updated to 1.0.1:
  - Fix: constify AEAD cipher input data
  - Fix: use GCC byte swapping acceleration if present
  - Fix: KDF counter handling on little endian systems when generating more than 255 blocks
  - Use LD_PRELOAD for execution of test cases to force using of the freshly compiled binaries
  - Fix: return code handling of _kcapi_common_vmsplice_chunk_fd as reported by Christophe Leroy
  - Fix: return code handling in _kcapi_md_update
  - Fix: kcapi-hasher now supports files larger than 2GB
  - Fix: kcapi-dgst now supports files larger than 2GB
  - Fix: use stack protector
  - Fix: rename header guards to remove leading underscore as pointed out by Markus Elfring
  - Test Fix: Allow compiing the test code without asymmetric and KPP support
- updated to 1.0.0:
  - Fix: Small compile fixes for new checks of GCC 7
  - API Change: Rename all LOG_* enums to KCAPI_LOG_* to prevent namespace poisoning
  - Fix: soname and file name of library now compiles with conventions (thanks to Marcus Meissner)
  - Fix: kcapi-rng.c: unify FD/syscall read code and fix __NR_getrandom resolution
  - Enhancement: add kcapi-enc application to access symmetric encryption on command line
  - Fix: consolidate duplicate code in kcapi-hasher
  - Enhancement: add kcapi-dgst application to access hashes on command line
  - Enhancement: add kcapi-rng man page
  - Enhancement: add kcapi-rng --hex command line option
  - Fix: enable full symmetric AIO support
  - Fix: consolidate all test code into test/ and invoke all tests with test-invocation.sh
  - Fix: fix memleaks in error code paths as reported by clang
  - Fix: reduce memory footprint by rearranging data structures
  - Fix: kcapi-hasher is now fully FIPS 140-2 compliant as it now includes the integrity test for libkcapi.so
  - Enhancement: Add speed tests for MV-CESA accelerated ciphers and hash algorithms (thanks to Bastian Stender)
  - Test Enhancement: add kcapi-enc-test-large.c test testing edge conditions of AF_ALG
  - Test Enhancement: add virttest.sh - use of test system based on eudyptula-boot to test on linux-4.3.6, linux-4.4.86, linux-4.5, linux-4.7, linux-4.10, linux-4.12
  - Test Enhancement: add kcapi-fuzz-test.sh to support fuzzing the AF_ALG interfaces
  - Enhancement: add RPM SPEC file (tested with Fedora 26)
  - API Change: replace --disable-lib-asym with --enable-lib-asym as the algif_akcipher.c kernel interface is not likely to be added to the kernel anytime soon
  - API Enhancement: add KPP API which is not compiled by default, use --enable-lib-kpp (the algif_kpp.c kernel interface is not likely to be added to the Linux kernel any time soon)
  - Test Enhancement: Add KPP tests
  - Enhancement: Re-enable AIO support for symmetric and AEAD ciphers down to Linux kernels 4.1 and 4.7, respectively. This is due to integrating a fix against a kernel crash when using AIO.
  - Fix: simply KDF code base
  - API Enhancement: add message digest convenience functions kcapi_md_*sha*
  - API Enhancement: add cipher convenience functions kcapi_cipher_*_aes_*
  - API Enhancement: add rng convenience function kcapi_rng_get_bytes
  - API Change: remove kcapi_aead_getdata, use kcapi_aead_getdata_input and kcapi_aead_getdata_output instead
  - API Change: remove kcapi_aead_outbuflen, use kcapi_aead_outbuflen_enc and kcapi_aead_outbuflen_dec instead
- updated to 0.14.0:
  - AIO: fix tracking of completed IOCBs
  - speed-test: fix AEAD handling
  - speed-test: fix time calculation
  - compiler now warns a user of deprecated API calls
  - AIO: handle kernel errors for algif_skcipher gracefully
  - AIO: using multiple IOCB if algif_aead interface supports it
  - ASYM: add PKCS1 tests
  - AIO: add ASYM AIO support
  - AIO: fix AEAD AIO fallback
  - AIO: add AIO fallback testing
  - replace enforcement of symmetric cipher limits with a log message only (the underlying kernel implementations should catch any errors)
  - add fuzzing tests
  - use autotools build system as provided by Georges Savoundararadj with additional considerations from Marcin Nowakowski (thanks a lot)
  - ALG_MAX_PAGES restriction is gone with current AF_ALG interface
  - add HKDF (RFC5869)
  - add apps/kcapi-rng
  - add support for multiple accepts where the caller maintains the opfd
  - fix memleak in error case in PBKDF
  - add multithreaded symmetric cipher tests
  - enable full AIO support for kernels 4.13 and higher (fallback AIO implementation using synchronous support for earlier kernels) -- this is due to the broken AIO support for earlier kernels
  - Add tests for the AAD copy operation to be supported for kernel 4.13
- dropped libkcapi-use-external-fipshmac.patch (done differently in upstream)
- dropped reproduciblesort.patch (done differently upstream)
- dropped reproducibledate.patch: merged upstream
- libkcapi.keyring imported</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1598875200">- update to 1.2.0:
  * enhancement: kcapi-hasher: add madvise and 64 bit support by Brandur Simonsen
  * fix: fix clang warnding in KDF implementation by Khem Raj
  * fix: fix inverted logic in kcapi-main test logic reported by Ondrej Mosnáček
  * fix: return error when iteration count is zero for PBKDF as reported by
  Guido Vranken
  * enhancement: add function kcapi_cipher_stream_update_last to indicate the
  last block of a symmetric cipher stream operation
  * disable XTS multithreaded tests as it triggers a race discussed in
  https://github.com/smuellerDD/libkcapi/issues/92. The conclusion is
  the following: xts(aes) doesn't support chaining requests like for other
  ciphers such as CBC (at least as implemented in the kernel Crypto API).
  That can be seen in `crypto/testmgr.h` - the ciphers that are expected to
  return IVs usable for chaining have the `.iv_out` entries filled in in their
  test vectors (and those that don't support it do not). One can see that only
  CTR and CBC test vectors have them, not XTS.
  Looking again at how XTS is defined, it seems one could implement
  transparent chaining by simply decrypting the final tweak using the tweak
  key and return it as the output IV... but I believe this has never been
  mandated nor implemented in the Crypto API (likely because of the overhead
  of the final tweak decryption, which would be pointless if you're not going
  to use the output IV - and there is currently no way to signal to the driver
  that you are going to need it).
  * disable AIO parallel tests due to undefined behavior</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1627387200">- Update to version 1.3.1
  * fix: fix -Wconversion warnings (by Ondrej Mosnacek)
  * fix: fix bad data types in _kcapi_common_send_meta (by Ondrej Mosnacek)
  * fix: Version symbols to maintain ABI compatibility (by Simo Sorce)
  * fix: disable io_getevents on systems that do not support it (by Khem Raj)
  * fix: remove prctl PR_SET_DUMPABLE to allow library to be debugged - as the
    library does not store any sensitive data in data structures it owns, such
    security precautions may not be necessary considering the benefit of
    allowing regular debugging
  * fix: ensure that sendmsg is always used as fallback when vmsplice cannot be
    used
  * enhancement: add kcapi_set_maxsplicesize and kcapi_get_maxsplicesize
  * enhancement: the variable types are changed from int32_t to ssize_t and
    from uint32_t to size_t to match common POSIX and Linux APIs
- Added libkcapi-fix-lto.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974400">- use https url</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650974401">- Update to version 1.4.0
  * fix: ensure that LTO is supported (by Simo Sorce)
  * fix: add LTO regression testing (by Ondrej Mosnacek)
  * enhancement: add sm3sum, sm3hmac tools, add APIs kcapi_md_sm3, kcapi_md_hmac_sm3
  * enhancement: add SM4 convenience functions
  * fix: support AEAD encryption of arbitrary size with kcapi-enc
- removed libkcapi-fix-lto.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1678104000">- libkcapi was actually signed by the wrong key (bsc#1207892)</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1742126400">- update to 1.5.0:
  * kcapi-hasher is a new multi-call binary with a single hmac
  * move all sha* applications to the libexec directory to allow
    them to coexist with other packages sha* applications - the
    caller is expected to make a symlink to them
  * add sha3sum
  * add kcapi_md_sha3_* wrapper APIs
  * kcapi-enc: allow larger keysizes
  * kcapi-enc: PBKDF limits key size to 32 bytes
  * kcapi-enc: Add option --key-len to kcapi-enc to specify the
    length of key
  * library: set default log level to NONE
  * performance improvements
- HMACs are now all sha512hmac, and in (libdir)/hmaccalc
- code is dual-licended GPL-2.0-only / BSD-3-Clause
- package license texts</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1743768000">- fixed sumprefix to be "." as before, also stores sums in the binary
  directoris. changed back packaging to be same as before.</changelog>
</package>
<package pkgid="cbbfd1104dc554e8fa2e95f779e5df5cbcfd94ec16272251f84609fe1011afe64c7620ae77b3341f18ab83ac9a1ac2b99a16f4105055552cf32a927a944b9c04" name="libkeyutils1" arch="s390x">
  <version epoch="0" ver="1.6.3" rel="87.23"/>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1551700800">- Replace krb5-devel BuildRequires with pkgconfig(krb5): Allow OBS
  to shortcut the ring0 bootstrap cycle by also using krb5-mini.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1561982400">- updated to 1.6
  - Apply various specfile cleanups from Fedora.
  - request-key: Provide a command line option to suppress helper execution.
  - request-key: Find least-wildcard match rather than first match.
  - Remove the dependency on MIT Kerberos.
  - Fix some error messages
  - keyctl_dh_compute.3: Suggest /proc/crypto for list of available hashes.
  - Fix doc and comment typos.
  - Add public key ops for encrypt, decrypt, sign and verify (needs linux-4.20).
  - Add pkg-config support for finding libkeyutils.
- upstream isn't offering PGP signatures for the source tarballs anymore</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1609761600">- update to 1.6.3:
  * Revert the change notifications that were using /dev/watch_queue.
  * Apply the change notifications that use pipe2(O_NOTIFICATION_PIPE).
  * Allow "keyctl supports" to retrieve raw capability data.
  * Allow "keyctl id" to turn a symbolic key ID into a numeric ID.
  * Allow "keyctl new_session" to name the keyring.
  * Allow "keyctl add/padd/etc." to take hex-encoded data.
  * Add "keyctl watch*" to expose kernel change notifications on keys.
  * Add caps for namespacing and notifications.
  * Set a default TTL on keys that upcall for name resolution.
  * Explicitly clear memory after it's held sensitive information.
  * Various manual page fixes.
  * Fix C++-related errors.
  * Add support for keyctl_move().
  * Add support for keyctl_capabilities().
  * Make key=val list optional for various public-key ops.
  * Fix system call signature for KEYCTL_PKEY_QUERY.
  * Fix 'keyctl pkey_query' argument passing.
  * Use keyctl_read_alloc() in dump_key_tree_aux().
  * Various manual page fixes.
- spec-cleaner run (fixup failing homepage url)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609934400">- adjust the library license to be LPGL-2.1+ only (the tools are GPL2+,
  the library is just LGPL-2.1+) (bsc#1180603)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1624536000">- Add /etc/keys/ and /usr/etc/keys/ directory (bsc#1187654)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1655812800">- Add /etc/keys/evn and /usr/etc/keys/evm together with the IMA ones</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1679572800">- Drop pkgconfig(krb5) BuildRequires: this dependency was dropped
  upstream in commit f9c7b4e4 (2018-11-02).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="4f6ce04cfed88e6ce8cfef524ead5d4a79999a5dde2e8f96bf43400a36cd87a3512c332deb19ebb330dba4b8b7c18194b18c1698bfd32256d77a06731bbac201" name="libkeyutils1-debuginfo" arch="s390x">
  <version epoch="0" ver="1.6.3" rel="87.23"/>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1551700800">- Replace krb5-devel BuildRequires with pkgconfig(krb5): Allow OBS
  to shortcut the ring0 bootstrap cycle by also using krb5-mini.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1561982400">- updated to 1.6
  - Apply various specfile cleanups from Fedora.
  - request-key: Provide a command line option to suppress helper execution.
  - request-key: Find least-wildcard match rather than first match.
  - Remove the dependency on MIT Kerberos.
  - Fix some error messages
  - keyctl_dh_compute.3: Suggest /proc/crypto for list of available hashes.
  - Fix doc and comment typos.
  - Add public key ops for encrypt, decrypt, sign and verify (needs linux-4.20).
  - Add pkg-config support for finding libkeyutils.
- upstream isn't offering PGP signatures for the source tarballs anymore</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.de&gt;" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1609761600">- update to 1.6.3:
  * Revert the change notifications that were using /dev/watch_queue.
  * Apply the change notifications that use pipe2(O_NOTIFICATION_PIPE).
  * Allow "keyctl supports" to retrieve raw capability data.
  * Allow "keyctl id" to turn a symbolic key ID into a numeric ID.
  * Allow "keyctl new_session" to name the keyring.
  * Allow "keyctl add/padd/etc." to take hex-encoded data.
  * Add "keyctl watch*" to expose kernel change notifications on keys.
  * Add caps for namespacing and notifications.
  * Set a default TTL on keys that upcall for name resolution.
  * Explicitly clear memory after it's held sensitive information.
  * Various manual page fixes.
  * Fix C++-related errors.
  * Add support for keyctl_move().
  * Add support for keyctl_capabilities().
  * Make key=val list optional for various public-key ops.
  * Fix system call signature for KEYCTL_PKEY_QUERY.
  * Fix 'keyctl pkey_query' argument passing.
  * Use keyctl_read_alloc() in dump_key_tree_aux().
  * Various manual page fixes.
- spec-cleaner run (fixup failing homepage url)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609934400">- adjust the library license to be LPGL-2.1+ only (the tools are GPL2+,
  the library is just LGPL-2.1+) (bsc#1180603)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1624536000">- Add /etc/keys/ and /usr/etc/keys/ directory (bsc#1187654)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1655812800">- Add /etc/keys/evn and /usr/etc/keys/evm together with the IMA ones</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1672142400">- Replace transitional %usrmerged macro with regular version check (boo#1206798)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1679572800">- Drop pkgconfig(krb5) BuildRequires: this dependency was dropped
  upstream in commit f9c7b4e4 (2018-11-02).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708603200">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="ffe462b0e54148473000dc19060e30b4b74a2d029f0dd615b19545ea798f49d445e314afc0757a9fc5b17979dd50928f35ab753546891ddb8f8804f9b0d29f85" name="libkmip" arch="src">
  <version epoch="0" ver="0.2.0" rel="11.43"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1624449600">- add a libkmip package, with KMIP key management library and tools.
  (jsc#SLE-18267)</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1624449601">- Trim old specfile constructs; use new macros.
- Wrap and trim description.</changelog>
</package>
<package pkgid="1b5da2a867f08ee2b5ff531db36f74e2d533ecd9e49756f555b43fa598bc6026959d48f5b47d6d516f188813cea677ca801e6148c470e02b85d3a445d8b44eee" name="libkmip-debuginfo" arch="s390x">
  <version epoch="0" ver="0.2.0" rel="11.43"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1624449600">- add a libkmip package, with KMIP key management library and tools.
  (jsc#SLE-18267)</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1624449601">- Trim old specfile constructs; use new macros.
- Wrap and trim description.</changelog>
</package>
<package pkgid="39ed4420cb1c05baf6bafb6b6ceead84b6d22118c5df63630449763d3e959cf303ba2e65da5a0006d5edb9587c4a3cec4a0ebc90e5e0438f902ec784862d4974" name="libkmip-debugsource" arch="s390x">
  <version epoch="0" ver="0.2.0" rel="11.43"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1624449600">- add a libkmip package, with KMIP key management library and tools.
  (jsc#SLE-18267)</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1624449601">- Trim old specfile constructs; use new macros.
- Wrap and trim description.</changelog>
</package>
<package pkgid="0e72ba630d643be36c453eb79851f0e3c5c5183ab243cd86c500beff4fbd07eb79dfb8696739f113e135e77524ef7624e7c2b7a3bc8a85e923104891261fd2d2" name="libkmip-devel" arch="s390x">
  <version epoch="0" ver="0.2.0" rel="11.43"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1624449600">- add a libkmip package, with KMIP key management library and tools.
  (jsc#SLE-18267)</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1624449601">- Trim old specfile constructs; use new macros.
- Wrap and trim description.</changelog>
</package>
<package pkgid="c3effe464d9c84c3eb962fb3484fca5f3023b2be177930163d1102de5ed586ffc9831c9677cc87ddd83f4288a1c710e05d382336069d9938a2b558af8cfd1602" name="libkmip-tools" arch="s390x">
  <version epoch="0" ver="0.2.0" rel="11.43"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1624449600">- add a libkmip package, with KMIP key management library and tools.
  (jsc#SLE-18267)</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1624449601">- Trim old specfile constructs; use new macros.
- Wrap and trim description.</changelog>
</package>
<package pkgid="33c3e57e48d078d65f0168be6310134666520934982a5dad97f30d36ea91fe7bc43e00fd82b546f48d0e7c6837bafff1a3d7b440ba5c881a200266c73ae37c14" name="libkmip-tools-debuginfo" arch="s390x">
  <version epoch="0" ver="0.2.0" rel="11.43"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1624449600">- add a libkmip package, with KMIP key management library and tools.
  (jsc#SLE-18267)</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1624449601">- Trim old specfile constructs; use new macros.
- Wrap and trim description.</changelog>
</package>
<package pkgid="029d37f49600b4327d4b683f0fb55a9dc54b4d5da9a15856ad320ca26c2e4cd1a652bf8691042d703f6b7cd42c9b7f95ea69e230bb9cf42278b892f391a59da9" name="libkmip0" arch="s390x">
  <version epoch="0" ver="0.2.0" rel="11.43"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1624449600">- add a libkmip package, with KMIP key management library and tools.
  (jsc#SLE-18267)</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1624449601">- Trim old specfile constructs; use new macros.
- Wrap and trim description.</changelog>
</package>
<package pkgid="4a3504a82c4883840502512e8bc882a308fa8f758d5cc1a624bbe99904fe544e5b5d59c565c21eef8d4e571bb6b81223b8f3bce0e051777ad1a558f0672ed81b" name="libkmip0-debuginfo" arch="s390x">
  <version epoch="0" ver="0.2.0" rel="11.43"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1624449600">- add a libkmip package, with KMIP key management library and tools.
  (jsc#SLE-18267)</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1624449601">- Trim old specfile constructs; use new macros.
- Wrap and trim description.</changelog>
</package>
<package pkgid="28505996c8c2cdecf4e61711cf880c7cef32084cc713a145ab03234805a502fdc2f663fc6786a7b3122cb85da2bae4edfba1b260e7ef111a0e357a60561b5182" name="libluksmeta-devel" arch="s390x">
  <version epoch="0" ver="9" rel="3.24"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- added luks meta data storage helper library for clevis</changelog>
</package>
<package pkgid="087b9a16252afd14d39ffc7019cb4a762bb7034a65404a702c74cd6b8c96742be762f80b020119517bc3fb6f2f89225854166b8cbb66209a97ffd93b3fd11ba2" name="libluksmeta0" arch="s390x">
  <version epoch="0" ver="9" rel="3.24"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- added luks meta data storage helper library for clevis</changelog>
</package>
<package pkgid="fc406470ee43d68e2dffb7d77bb26853bc7d644268cb49e73c0396b64cd64804f3177aea68e3a064324557710ececc3333da7c8cb3347aa5544530cec6b75570" name="libluksmeta0-debuginfo" arch="s390x">
  <version epoch="0" ver="9" rel="3.24"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- added luks meta data storage helper library for clevis</changelog>
</package>
<package pkgid="98ca7e9259e921b37172ddbf2dfa63f22365dbd36911b68074062eb6bd796915e8c4929eee2c437d37ab7e23c51d212bd2a51b445db76985f748cec3ac11cdaf" name="libnitrokey" arch="src">
  <version epoch="0" ver="3.8" rel="9.40"/>
  <changelog author="mrueckert@suse.de" date="1523361600">- initial package (v3.3)</changelog>
  <changelog author="mrueckert@suse.de" date="1523361601">- added BR for pkgconfig(libusb-1.0)</changelog>
  <changelog author="mrueckert@suse.de" date="1523361602">- force gcc 7 on leap 42.x</changelog>
  <changelog author="mrueckert@suse.de" date="1523448000">- require the udev rules with &gt;= to get rid of the rpmlint warning</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1544529600">- update to 3.4.1
  - Version bump to 3.4 (not done in previous release).
  - Build from tarball (git describe was failing).
  - Handle version getting, when building with Qt (return constants
    for now).
  - API: deprecate NK_totp_get_time.
  - Add get_library_version().
  - Fix strdup issue, which causes memory leak in C API.
  - Corrected documentation and updated tests.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1582977600">- update to 3.5
  - Storage v0.54 support. Tests and documentation update.</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1594728000">- UDEV-rule-for-FIDO2.patch
  add rule for Nitrokey FIDO2 device (20a0:42b1)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1606305600">- update to 3.6
  - LibremKey and FreeBSD support. Extended API.
- drop UDEV-rule-for-FIDO2.patch:
  includes in update</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1650888000">- udev-rules-add-nitrokey3.patch
  Add rule for Nitrokey 3</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888001">- switch buildrequires udev to pkgconfig(udev).</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1651579200">- Update to 3.7
  * Nitrokey Pro v0.14 support;
  * Udev rules update;
  * Stability fixes.
- drop udev-rules-add-nitrokey3.patch which is now upstream</changelog>
  <changelog author="Martin Sirringhaus &lt;mark_nefedov@runbox.com&gt;" date="1669032000">- Update to 3.8
  * Udev rules update;
  * Build warnings fixes.</changelog>
</package>
<package pkgid="51171cdc5f0cbea584e79c7144e7e1167d31f44e4ad4fae2245f03cfc4590e0f8192760cb2bb5ff2bf5690c0c8ba487af85c1e3754ee68883a401a16906e9dfb" name="libnitrokey-debugsource" arch="s390x">
  <version epoch="0" ver="3.8" rel="9.40"/>
  <changelog author="mrueckert@suse.de" date="1523361600">- force gcc 7 on leap 42.x</changelog>
  <changelog author="mrueckert@suse.de" date="1523448000">- require the udev rules with &gt;= to get rid of the rpmlint warning</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1544529600">- update to 3.4.1
  - Version bump to 3.4 (not done in previous release).
  - Build from tarball (git describe was failing).
  - Handle version getting, when building with Qt (return constants
    for now).
  - API: deprecate NK_totp_get_time.
  - Add get_library_version().
  - Fix strdup issue, which causes memory leak in C API.
  - Corrected documentation and updated tests.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1582977600">- update to 3.5
  - Storage v0.54 support. Tests and documentation update.</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1594728000">- UDEV-rule-for-FIDO2.patch
  add rule for Nitrokey FIDO2 device (20a0:42b1)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1606305600">- update to 3.6
  - LibremKey and FreeBSD support. Extended API.
- drop UDEV-rule-for-FIDO2.patch:
  includes in update</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1650888000">- udev-rules-add-nitrokey3.patch
  Add rule for Nitrokey 3</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888001">- switch buildrequires udev to pkgconfig(udev).</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1651579200">- Update to 3.7
  * Nitrokey Pro v0.14 support;
  * Udev rules update;
  * Stability fixes.
- drop udev-rules-add-nitrokey3.patch which is now upstream</changelog>
  <changelog author="Martin Sirringhaus &lt;mark_nefedov@runbox.com&gt;" date="1669032000">- Update to 3.8
  * Udev rules update;
  * Build warnings fixes.</changelog>
</package>
<package pkgid="e928e335146fda79567c49d5cf44728b9ab1b5f6c1b3b8b2d124e683b5d7cb1a21fb7b580a37d2631e23fd6be1b26a0b858c0804b2244aef783f019d2cc31a5b" name="libnitrokey-devel" arch="s390x">
  <version epoch="0" ver="3.8" rel="9.40"/>
  <changelog author="mrueckert@suse.de" date="1523361600">- force gcc 7 on leap 42.x</changelog>
  <changelog author="mrueckert@suse.de" date="1523448000">- require the udev rules with &gt;= to get rid of the rpmlint warning</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1544529600">- update to 3.4.1
  - Version bump to 3.4 (not done in previous release).
  - Build from tarball (git describe was failing).
  - Handle version getting, when building with Qt (return constants
    for now).
  - API: deprecate NK_totp_get_time.
  - Add get_library_version().
  - Fix strdup issue, which causes memory leak in C API.
  - Corrected documentation and updated tests.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1582977600">- update to 3.5
  - Storage v0.54 support. Tests and documentation update.</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1594728000">- UDEV-rule-for-FIDO2.patch
  add rule for Nitrokey FIDO2 device (20a0:42b1)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1606305600">- update to 3.6
  - LibremKey and FreeBSD support. Extended API.
- drop UDEV-rule-for-FIDO2.patch:
  includes in update</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1650888000">- udev-rules-add-nitrokey3.patch
  Add rule for Nitrokey 3</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888001">- switch buildrequires udev to pkgconfig(udev).</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1651579200">- Update to 3.7
  * Nitrokey Pro v0.14 support;
  * Udev rules update;
  * Stability fixes.
- drop udev-rules-add-nitrokey3.patch which is now upstream</changelog>
  <changelog author="Martin Sirringhaus &lt;mark_nefedov@runbox.com&gt;" date="1669032000">- Update to 3.8
  * Udev rules update;
  * Build warnings fixes.</changelog>
</package>
<package pkgid="7ada376f0f4978bc33b70c23705c74cb603226437f4af387c9018128430dc336e2a72056867d216747ddbea70d1700ff9ea9c33c96a507a6fd75dde781e0bcd1" name="libnitrokey-udev" arch="noarch">
  <version epoch="0" ver="3.8" rel="9.40"/>
  <changelog author="mrueckert@suse.de" date="1523361600">- force gcc 7 on leap 42.x</changelog>
  <changelog author="mrueckert@suse.de" date="1523448000">- require the udev rules with &gt;= to get rid of the rpmlint warning</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1544529600">- update to 3.4.1
  - Version bump to 3.4 (not done in previous release).
  - Build from tarball (git describe was failing).
  - Handle version getting, when building with Qt (return constants
    for now).
  - API: deprecate NK_totp_get_time.
  - Add get_library_version().
  - Fix strdup issue, which causes memory leak in C API.
  - Corrected documentation and updated tests.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1582977600">- update to 3.5
  - Storage v0.54 support. Tests and documentation update.</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1594728000">- UDEV-rule-for-FIDO2.patch
  add rule for Nitrokey FIDO2 device (20a0:42b1)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1606305600">- update to 3.6
  - LibremKey and FreeBSD support. Extended API.
- drop UDEV-rule-for-FIDO2.patch:
  includes in update</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1650888000">- udev-rules-add-nitrokey3.patch
  Add rule for Nitrokey 3</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888001">- switch buildrequires udev to pkgconfig(udev).</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1651579200">- Update to 3.7
  * Nitrokey Pro v0.14 support;
  * Udev rules update;
  * Stability fixes.
- drop udev-rules-add-nitrokey3.patch which is now upstream</changelog>
  <changelog author="Martin Sirringhaus &lt;mark_nefedov@runbox.com&gt;" date="1669032000">- Update to 3.8
  * Udev rules update;
  * Build warnings fixes.</changelog>
</package>
<package pkgid="ab1a57260260a0801b48d348be8c8d562e73cfdfa06832f4e049e4648eb9cf2e891b51a05ac1f5a6a394374967d79f326f7338ca3e3614d8da37ac9510dafa46" name="libnitrokey3" arch="s390x">
  <version epoch="0" ver="3.8" rel="9.40"/>
  <changelog author="mrueckert@suse.de" date="1523361600">- force gcc 7 on leap 42.x</changelog>
  <changelog author="mrueckert@suse.de" date="1523448000">- require the udev rules with &gt;= to get rid of the rpmlint warning</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1544529600">- update to 3.4.1
  - Version bump to 3.4 (not done in previous release).
  - Build from tarball (git describe was failing).
  - Handle version getting, when building with Qt (return constants
    for now).
  - API: deprecate NK_totp_get_time.
  - Add get_library_version().
  - Fix strdup issue, which causes memory leak in C API.
  - Corrected documentation and updated tests.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1582977600">- update to 3.5
  - Storage v0.54 support. Tests and documentation update.</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1594728000">- UDEV-rule-for-FIDO2.patch
  add rule for Nitrokey FIDO2 device (20a0:42b1)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1606305600">- update to 3.6
  - LibremKey and FreeBSD support. Extended API.
- drop UDEV-rule-for-FIDO2.patch:
  includes in update</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1650888000">- udev-rules-add-nitrokey3.patch
  Add rule for Nitrokey 3</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888001">- switch buildrequires udev to pkgconfig(udev).</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1651579200">- Update to 3.7
  * Nitrokey Pro v0.14 support;
  * Udev rules update;
  * Stability fixes.
- drop udev-rules-add-nitrokey3.patch which is now upstream</changelog>
  <changelog author="Martin Sirringhaus &lt;mark_nefedov@runbox.com&gt;" date="1669032000">- Update to 3.8
  * Udev rules update;
  * Build warnings fixes.</changelog>
</package>
<package pkgid="19d1ce989d08f19efb5c6b1d4a110090c47ad0a2477441dd604e49eb348400d34fc2908a6524652c7f41557a6dd860c015dcb1f32e3a622199126235bb406ad7" name="libnitrokey3-debuginfo" arch="s390x">
  <version epoch="0" ver="3.8" rel="9.40"/>
  <changelog author="mrueckert@suse.de" date="1523361600">- force gcc 7 on leap 42.x</changelog>
  <changelog author="mrueckert@suse.de" date="1523448000">- require the udev rules with &gt;= to get rid of the rpmlint warning</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1544529600">- update to 3.4.1
  - Version bump to 3.4 (not done in previous release).
  - Build from tarball (git describe was failing).
  - Handle version getting, when building with Qt (return constants
    for now).
  - API: deprecate NK_totp_get_time.
  - Add get_library_version().
  - Fix strdup issue, which causes memory leak in C API.
  - Corrected documentation and updated tests.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1582977600">- update to 3.5
  - Storage v0.54 support. Tests and documentation update.</changelog>
  <changelog author="Michal Kubecek &lt;mkubecek@suse.cz&gt;" date="1594728000">- UDEV-rule-for-FIDO2.patch
  add rule for Nitrokey FIDO2 device (20a0:42b1)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1606305600">- update to 3.6
  - LibremKey and FreeBSD support. Extended API.
- drop UDEV-rule-for-FIDO2.patch:
  includes in update</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1650888000">- udev-rules-add-nitrokey3.patch
  Add rule for Nitrokey 3</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888001">- switch buildrequires udev to pkgconfig(udev).</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1651579200">- Update to 3.7
  * Nitrokey Pro v0.14 support;
  * Udev rules update;
  * Stability fixes.
- drop udev-rules-add-nitrokey3.patch which is now upstream</changelog>
  <changelog author="Martin Sirringhaus &lt;mark_nefedov@runbox.com&gt;" date="1669032000">- Update to 3.8
  * Udev rules update;
  * Build warnings fixes.</changelog>
</package>
<package pkgid="bf97b2b670914690d6376a663f82bb0dd9eb27f74421f7c0699058589a8045f72605e43369a72c21438d17eb51f42318dd6dc88fd3ada53ec8d12339356d1199" name="liboath-devel" arch="s390x">
  <version epoch="0" ver="2.6.14" rel="41.9"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1609243200">- Update to version 2.6.5
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.
    KEY and OTP may now be given as '-' to mean stdin, or @FILE to
    read from a particular file.  This is recommended on multi-user
    systems, since secrets as command line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.
  * Doc fixes.
- Update to version 2.6.4
  * libpskc: New --with-xmlsec-crypto-engine to hard-code crypto
    engine.  Use it like --with-xmlsec-crypto-engine=gnutls or
  - -with-xmlsec-crypto-engine=openssl if the default dynamic
    loading fails because of runtime linker search path issues.
  * oathtool --totp --verbose now prints TOTP hash mode.
  * oathtool: Hash names (e.g., SHA256) for --totp are now upper
    case.  Lower/mixed case hash names are supported for
    compatibility.
  * pam_oath: Fail gracefully for missing users.
    This allows you to incrementally add support for OATH
    authentication instead of forcing it on all users.
  * Fix libpskc memory corruption bug.
  * Fix man pages.
  * Build fixes.
- Update to version 2.6.3
  * pam_oath: Fix self-tests.
- Drop not longer needed patches:
  * 0001-Fix-no-return-in-nonvoid-function-errors-reported-by.patch
  * 0003-pam_oath-assign-safe-default-to-alwaysok-config-memb.patch
  * 0002-update_gnulibs_files.patch
  * gnulib-libio.patch
- Use source verification
- Use proper source URLs</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1611144000">- Update to version 2.6.6
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.  KEY and OTP may now be given as '-' to mean
    stdin, or @FILE to read from a particular file.  This is
    recommended on multi-user systems, since secrets as command
    line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1619956800">- Update to version 2.6.7
  * pam_oath: Support variables in usersfile string parameter.
    These changes introduce the ${USER} and ${HOME} placeholder
    values for the usersfile string in the pam_oath configuration
    file. The placeholder values allow the user credentials file
    to be stored in a file path that is relative to the user, and
    mimics similar behavior found in google-authenticator-libpam.
    The motivation for these changes is to allow for
    non-privileged processes to use pam_oath (e.g., for 2FA with
    xscreensaver). Non-privileged and non-suid programs are
    unable to use pam_oath. These changes are a proposed
    alternative to a suid helper binary as well.
  * doc: Fix project URL in man pages.
  * build: Drop use of libxml's AM_PATH_XML2 in favor of pkg-config.
  * build: Modernize autotools usage.
    Most importantly, no longer use -Werror with AM_INIT_AUTOMAKE
    to make rebuilding from source more safe with future automake
    versions.
  * Updated gnulib files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url -&gt; https</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1659441600">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1688904000">- Update to version 2.6.8
  * libpskc: Fixes for recent libxmlsec releases.
  * pam_oath: Provide fallback pam_modutil_getpwnam implementation.
  * pam_oath: Don't fail authentication when pam_modutil_getpwnam
  doesn't ** know the user when usersfile don't include ${USER}
  or ${HOME}.
  * pam_oath: Self-test improvements.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.11
  * liboath: Handle invalid base32 encoded secrets.  Fixes: #41.
  * Various build fixes including updated gnulib files.
  * Improve compatibility with recent libxmlsec.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1726228800">- Fix security issue CVE-2024-47191 by adding
  0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch .
- Add patch to implement new null_usersfile_okay argument
  42-null_usersfile_okay.patch .
- Makes this version 2.6.11.12 to be able to depend on it.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1729080000">- Update 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  with bsc#1231699 improvements for security fix CVE-2024-47191</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1770120000">- Update to version 2.6.14
  * pam_oath: Support null_usersfile_okay parameter. The argument
    no_usersfile_okay forces the module to act as if the user is
    not present in the config, if the config file does not exist.
    This has security implications only use if you know what you
    are doing. E.g. if the file is in a mount like home and that
    fails to be mounted, then this will succeed even if the OTP if
    configured for that user. Patch by Luna, Jan Zerebecki, and
    Miika Alikirri; see
    https://codeberg.org/oath-toolkit/oath-toolkit/pulls/94.
  * pam_oath README: Suggest KbdInteractiveAuthentication. Instead
    of deprecated ChallengeResponseAuthentication.
    see https://codeberg.org/oath-toolkit/oath-toolkit/pulls/112.
  * Various build fixes including updated gnulib files. Fixes
    building with glibc 2.43.
- Update to version 2.6.13
  * liboath/libpskc: Fix _FORTIFY_SOURCE build problem and allow
    configuration.
  * liboath: Fix --with-openssl builds
  * Git hosting moved from gitlab.com to codeberg.org. The new URL
    is https://codeberg.org/oath-toolkit/oath-toolkit although the
    old GitLab project will continue to be used for pipelines.
    https://gitlab.com/oath-toolkit/oath-toolkit/-/pipelines
  * Various build fixes including updated gnulib files. Gnulib
    files are no longer stored in git version control. As a
    consequence, gnulib is a required build dependency when
    building from git, see CONTRIBUTING.md.
- Update to version 2.6.12
  * Reported by Fabian Vogt (SUSE), and associated with
    CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings,
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    Quoting a writeup in an alternate patch by Matthias Gerstner
    (SUSE): With the addition of the possibility to place a
    usersfile also into a the usersfile= path specification,
    security issues sneaked in. The PAM process usually runs with
    root privileges. The file operations in an unprivileged user’s
    home directory follow symlinks both when reading and creating
    files, allowing for a potential local root exploit, because of
    the fchown() performed on the newly created usersfile.
  * We drop privileges to the user that is being logged into,
    assuming it has the necessary permissions for the usersfile
    belonging in their home directory. This restricts the ability
    for non-root users to affect files beyond their control via
    liboath.
  * liboath: Don’t follow symbolic links for usersfile updates.
    Reported by Fabian Vogt (SUSE), and associated with CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings, see
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    The fix is to open files for writing in exclusive mode (i.e., fail
    if the file exists including if it is a symbolic link).
  * oathtool: Fix test suite on 32-bit big-endian platforms.
  * libpskc: Don’t call deprecated xmlMemoryDump.
  * Various build fixes including updated gnulib files.
- Drop not longer needed patches (fixed upstream):
  * 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  * 42-null_usersfile_okay.patch
- Use %ldconfig_scriptlets macro.</changelog>
</package>
<package pkgid="f620f7c83b0f5ea4f89b30f10e55ed41b9b4df2897adff13e8f4de22f5a1cf40d19e81aa112a3c448dd10492281a302b9f6f8ec452f5348e5a85d0090fa30398" name="liboath0" arch="s390x">
  <version epoch="0" ver="2.6.14" rel="41.9"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1609243200">- Update to version 2.6.5
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.
    KEY and OTP may now be given as '-' to mean stdin, or @FILE to
    read from a particular file.  This is recommended on multi-user
    systems, since secrets as command line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.
  * Doc fixes.
- Update to version 2.6.4
  * libpskc: New --with-xmlsec-crypto-engine to hard-code crypto
    engine.  Use it like --with-xmlsec-crypto-engine=gnutls or
  - -with-xmlsec-crypto-engine=openssl if the default dynamic
    loading fails because of runtime linker search path issues.
  * oathtool --totp --verbose now prints TOTP hash mode.
  * oathtool: Hash names (e.g., SHA256) for --totp are now upper
    case.  Lower/mixed case hash names are supported for
    compatibility.
  * pam_oath: Fail gracefully for missing users.
    This allows you to incrementally add support for OATH
    authentication instead of forcing it on all users.
  * Fix libpskc memory corruption bug.
  * Fix man pages.
  * Build fixes.
- Update to version 2.6.3
  * pam_oath: Fix self-tests.
- Drop not longer needed patches:
  * 0001-Fix-no-return-in-nonvoid-function-errors-reported-by.patch
  * 0003-pam_oath-assign-safe-default-to-alwaysok-config-memb.patch
  * 0002-update_gnulibs_files.patch
  * gnulib-libio.patch
- Use source verification
- Use proper source URLs</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1611144000">- Update to version 2.6.6
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.  KEY and OTP may now be given as '-' to mean
    stdin, or @FILE to read from a particular file.  This is
    recommended on multi-user systems, since secrets as command
    line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1619956800">- Update to version 2.6.7
  * pam_oath: Support variables in usersfile string parameter.
    These changes introduce the ${USER} and ${HOME} placeholder
    values for the usersfile string in the pam_oath configuration
    file. The placeholder values allow the user credentials file
    to be stored in a file path that is relative to the user, and
    mimics similar behavior found in google-authenticator-libpam.
    The motivation for these changes is to allow for
    non-privileged processes to use pam_oath (e.g., for 2FA with
    xscreensaver). Non-privileged and non-suid programs are
    unable to use pam_oath. These changes are a proposed
    alternative to a suid helper binary as well.
  * doc: Fix project URL in man pages.
  * build: Drop use of libxml's AM_PATH_XML2 in favor of pkg-config.
  * build: Modernize autotools usage.
    Most importantly, no longer use -Werror with AM_INIT_AUTOMAKE
    to make rebuilding from source more safe with future automake
    versions.
  * Updated gnulib files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url -&gt; https</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1659441600">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1688904000">- Update to version 2.6.8
  * libpskc: Fixes for recent libxmlsec releases.
  * pam_oath: Provide fallback pam_modutil_getpwnam implementation.
  * pam_oath: Don't fail authentication when pam_modutil_getpwnam
  doesn't ** know the user when usersfile don't include ${USER}
  or ${HOME}.
  * pam_oath: Self-test improvements.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.11
  * liboath: Handle invalid base32 encoded secrets.  Fixes: #41.
  * Various build fixes including updated gnulib files.
  * Improve compatibility with recent libxmlsec.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1726228800">- Fix security issue CVE-2024-47191 by adding
  0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch .
- Add patch to implement new null_usersfile_okay argument
  42-null_usersfile_okay.patch .
- Makes this version 2.6.11.12 to be able to depend on it.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1729080000">- Update 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  with bsc#1231699 improvements for security fix CVE-2024-47191</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1770120000">- Update to version 2.6.14
  * pam_oath: Support null_usersfile_okay parameter. The argument
    no_usersfile_okay forces the module to act as if the user is
    not present in the config, if the config file does not exist.
    This has security implications only use if you know what you
    are doing. E.g. if the file is in a mount like home and that
    fails to be mounted, then this will succeed even if the OTP if
    configured for that user. Patch by Luna, Jan Zerebecki, and
    Miika Alikirri; see
    https://codeberg.org/oath-toolkit/oath-toolkit/pulls/94.
  * pam_oath README: Suggest KbdInteractiveAuthentication. Instead
    of deprecated ChallengeResponseAuthentication.
    see https://codeberg.org/oath-toolkit/oath-toolkit/pulls/112.
  * Various build fixes including updated gnulib files. Fixes
    building with glibc 2.43.
- Update to version 2.6.13
  * liboath/libpskc: Fix _FORTIFY_SOURCE build problem and allow
    configuration.
  * liboath: Fix --with-openssl builds
  * Git hosting moved from gitlab.com to codeberg.org. The new URL
    is https://codeberg.org/oath-toolkit/oath-toolkit although the
    old GitLab project will continue to be used for pipelines.
    https://gitlab.com/oath-toolkit/oath-toolkit/-/pipelines
  * Various build fixes including updated gnulib files. Gnulib
    files are no longer stored in git version control. As a
    consequence, gnulib is a required build dependency when
    building from git, see CONTRIBUTING.md.
- Update to version 2.6.12
  * Reported by Fabian Vogt (SUSE), and associated with
    CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings,
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    Quoting a writeup in an alternate patch by Matthias Gerstner
    (SUSE): With the addition of the possibility to place a
    usersfile also into a the usersfile= path specification,
    security issues sneaked in. The PAM process usually runs with
    root privileges. The file operations in an unprivileged user’s
    home directory follow symlinks both when reading and creating
    files, allowing for a potential local root exploit, because of
    the fchown() performed on the newly created usersfile.
  * We drop privileges to the user that is being logged into,
    assuming it has the necessary permissions for the usersfile
    belonging in their home directory. This restricts the ability
    for non-root users to affect files beyond their control via
    liboath.
  * liboath: Don’t follow symbolic links for usersfile updates.
    Reported by Fabian Vogt (SUSE), and associated with CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings, see
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    The fix is to open files for writing in exclusive mode (i.e., fail
    if the file exists including if it is a symbolic link).
  * oathtool: Fix test suite on 32-bit big-endian platforms.
  * libpskc: Don’t call deprecated xmlMemoryDump.
  * Various build fixes including updated gnulib files.
- Drop not longer needed patches (fixed upstream):
  * 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  * 42-null_usersfile_okay.patch
- Use %ldconfig_scriptlets macro.</changelog>
</package>
<package pkgid="9a175add202cad3ec17bb8740834e7e6f8662b9d9a239c335449149217205bf8ae0d019f6853039e96be688bdfa62a08931510325e696bba85e66503ae58a149" name="liboath0-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.14" rel="41.9"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1609243200">- Update to version 2.6.5
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.
    KEY and OTP may now be given as '-' to mean stdin, or @FILE to
    read from a particular file.  This is recommended on multi-user
    systems, since secrets as command line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.
  * Doc fixes.
- Update to version 2.6.4
  * libpskc: New --with-xmlsec-crypto-engine to hard-code crypto
    engine.  Use it like --with-xmlsec-crypto-engine=gnutls or
  - -with-xmlsec-crypto-engine=openssl if the default dynamic
    loading fails because of runtime linker search path issues.
  * oathtool --totp --verbose now prints TOTP hash mode.
  * oathtool: Hash names (e.g., SHA256) for --totp are now upper
    case.  Lower/mixed case hash names are supported for
    compatibility.
  * pam_oath: Fail gracefully for missing users.
    This allows you to incrementally add support for OATH
    authentication instead of forcing it on all users.
  * Fix libpskc memory corruption bug.
  * Fix man pages.
  * Build fixes.
- Update to version 2.6.3
  * pam_oath: Fix self-tests.
- Drop not longer needed patches:
  * 0001-Fix-no-return-in-nonvoid-function-errors-reported-by.patch
  * 0003-pam_oath-assign-safe-default-to-alwaysok-config-memb.patch
  * 0002-update_gnulibs_files.patch
  * gnulib-libio.patch
- Use source verification
- Use proper source URLs</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1611144000">- Update to version 2.6.6
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.  KEY and OTP may now be given as '-' to mean
    stdin, or @FILE to read from a particular file.  This is
    recommended on multi-user systems, since secrets as command
    line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1619956800">- Update to version 2.6.7
  * pam_oath: Support variables in usersfile string parameter.
    These changes introduce the ${USER} and ${HOME} placeholder
    values for the usersfile string in the pam_oath configuration
    file. The placeholder values allow the user credentials file
    to be stored in a file path that is relative to the user, and
    mimics similar behavior found in google-authenticator-libpam.
    The motivation for these changes is to allow for
    non-privileged processes to use pam_oath (e.g., for 2FA with
    xscreensaver). Non-privileged and non-suid programs are
    unable to use pam_oath. These changes are a proposed
    alternative to a suid helper binary as well.
  * doc: Fix project URL in man pages.
  * build: Drop use of libxml's AM_PATH_XML2 in favor of pkg-config.
  * build: Modernize autotools usage.
    Most importantly, no longer use -Werror with AM_INIT_AUTOMAKE
    to make rebuilding from source more safe with future automake
    versions.
  * Updated gnulib files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url -&gt; https</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1659441600">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1688904000">- Update to version 2.6.8
  * libpskc: Fixes for recent libxmlsec releases.
  * pam_oath: Provide fallback pam_modutil_getpwnam implementation.
  * pam_oath: Don't fail authentication when pam_modutil_getpwnam
  doesn't ** know the user when usersfile don't include ${USER}
  or ${HOME}.
  * pam_oath: Self-test improvements.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.11
  * liboath: Handle invalid base32 encoded secrets.  Fixes: #41.
  * Various build fixes including updated gnulib files.
  * Improve compatibility with recent libxmlsec.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1726228800">- Fix security issue CVE-2024-47191 by adding
  0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch .
- Add patch to implement new null_usersfile_okay argument
  42-null_usersfile_okay.patch .
- Makes this version 2.6.11.12 to be able to depend on it.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1729080000">- Update 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  with bsc#1231699 improvements for security fix CVE-2024-47191</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1770120000">- Update to version 2.6.14
  * pam_oath: Support null_usersfile_okay parameter. The argument
    no_usersfile_okay forces the module to act as if the user is
    not present in the config, if the config file does not exist.
    This has security implications only use if you know what you
    are doing. E.g. if the file is in a mount like home and that
    fails to be mounted, then this will succeed even if the OTP if
    configured for that user. Patch by Luna, Jan Zerebecki, and
    Miika Alikirri; see
    https://codeberg.org/oath-toolkit/oath-toolkit/pulls/94.
  * pam_oath README: Suggest KbdInteractiveAuthentication. Instead
    of deprecated ChallengeResponseAuthentication.
    see https://codeberg.org/oath-toolkit/oath-toolkit/pulls/112.
  * Various build fixes including updated gnulib files. Fixes
    building with glibc 2.43.
- Update to version 2.6.13
  * liboath/libpskc: Fix _FORTIFY_SOURCE build problem and allow
    configuration.
  * liboath: Fix --with-openssl builds
  * Git hosting moved from gitlab.com to codeberg.org. The new URL
    is https://codeberg.org/oath-toolkit/oath-toolkit although the
    old GitLab project will continue to be used for pipelines.
    https://gitlab.com/oath-toolkit/oath-toolkit/-/pipelines
  * Various build fixes including updated gnulib files. Gnulib
    files are no longer stored in git version control. As a
    consequence, gnulib is a required build dependency when
    building from git, see CONTRIBUTING.md.
- Update to version 2.6.12
  * Reported by Fabian Vogt (SUSE), and associated with
    CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings,
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    Quoting a writeup in an alternate patch by Matthias Gerstner
    (SUSE): With the addition of the possibility to place a
    usersfile also into a the usersfile= path specification,
    security issues sneaked in. The PAM process usually runs with
    root privileges. The file operations in an unprivileged user’s
    home directory follow symlinks both when reading and creating
    files, allowing for a potential local root exploit, because of
    the fchown() performed on the newly created usersfile.
  * We drop privileges to the user that is being logged into,
    assuming it has the necessary permissions for the usersfile
    belonging in their home directory. This restricts the ability
    for non-root users to affect files beyond their control via
    liboath.
  * liboath: Don’t follow symbolic links for usersfile updates.
    Reported by Fabian Vogt (SUSE), and associated with CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings, see
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    The fix is to open files for writing in exclusive mode (i.e., fail
    if the file exists including if it is a symbolic link).
  * oathtool: Fix test suite on 32-bit big-endian platforms.
  * libpskc: Don’t call deprecated xmlMemoryDump.
  * Various build fixes including updated gnulib files.
- Drop not longer needed patches (fixed upstream):
  * 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  * 42-null_usersfile_okay.patch
- Use %ldconfig_scriptlets macro.</changelog>
</package>
<package pkgid="0772da369815a51c5a990bfdd6da2d16acefa891aa6c58465a51d74171878a04443f31e8c63ed7bd5b845840442dea4d72038c2f6ef9fe06e2d45087fb4e4665" name="liboauth" arch="src">
  <version epoch="0" ver="1.0.3" rel="6.20"/>
  <changelog author="gregkh@suse.de" date="1280232000">- initial creation of the package</changelog>
  <changelog author="mrueckert@suse.de" date="1280318400">- fix warning about shared library packaging policy</changelog>
  <changelog author="gregkh@suse.de" date="1285588800">- bump to 0.9.1 release
- add libopenssl-devel install dependancy to liboauth-devel</changelog>
  <changelog author="gregkh@suse.de" date="1300104000">- bump to 0.9.4 release</changelog>
  <changelog author="coolo@novell.com" date="1310385600">- add baselibs.conf to allow libgdata13 to link against it</changelog>
  <changelog author="coolo@suse.com" date="1321704000">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1353585600">- Remove dependency bloat on curl/openssl on main and devel
  packages.</changelog>
  <changelog author="p.drouand@gmail.com" date="1423742400">- Update to version 1.0.3
  * clarify documentation of oauth_curl
  * fix possible memleak in oauth_curl (only relevant if an error occurs)
  * fix TOCTOU in oauth_curl_post_file: the file may change between
    stat() and fopen()</changelog>
  <changelog author="vcizek@suse.com" date="1503489600">- Add openssl 1.1 compatibility (bsc#1055285)
  * add liboauth-openssl_1.1_compatibility.patch from
    https://github.com/x42/liboauth/issues/9</changelog>
  <changelog author="jengelh@inai.de" date="1503662400">- RPM group fixes. Remove redundant %clean section. Replace
  %__-type macro indirections.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- urls switched to https</changelog>
  <changelog author="pgajdos@suse.com" date="1709208000">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="0c360128f31cbf988e6b307138c5f13a33adb71724f609c7406bc63f8b1c8150628b59dec0be8bc44b04f09b5ed9c24ba448c416acef0114b83d5661c8f63bc7" name="liboauth-debugsource" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="6.20"/>
  <changelog author="gregkh@suse.de" date="1285588800">- bump to 0.9.1 release
- add libopenssl-devel install dependancy to liboauth-devel</changelog>
  <changelog author="gregkh@suse.de" date="1300104000">- bump to 0.9.4 release</changelog>
  <changelog author="coolo@novell.com" date="1310385600">- add baselibs.conf to allow libgdata13 to link against it</changelog>
  <changelog author="coolo@suse.com" date="1321704000">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1353585600">- Remove dependency bloat on curl/openssl on main and devel
  packages.</changelog>
  <changelog author="p.drouand@gmail.com" date="1423742400">- Update to version 1.0.3
  * clarify documentation of oauth_curl
  * fix possible memleak in oauth_curl (only relevant if an error occurs)
  * fix TOCTOU in oauth_curl_post_file: the file may change between
    stat() and fopen()</changelog>
  <changelog author="vcizek@suse.com" date="1503489600">- Add openssl 1.1 compatibility (bsc#1055285)
  * add liboauth-openssl_1.1_compatibility.patch from
    https://github.com/x42/liboauth/issues/9</changelog>
  <changelog author="jengelh@inai.de" date="1503662400">- RPM group fixes. Remove redundant %clean section. Replace
  %__-type macro indirections.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- urls switched to https</changelog>
  <changelog author="pgajdos@suse.com" date="1709208000">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="de0cd2364995ca626f17aa6fd597711853ecfa4568967cf389342265860567e27b6fcc04ae6b15b3bfa7147af8b3b8d1c7dae57d2857d8e60b807ee1c6c5500e" name="liboauth-devel" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="6.20"/>
  <changelog author="gregkh@suse.de" date="1285588800">- bump to 0.9.1 release
- add libopenssl-devel install dependancy to liboauth-devel</changelog>
  <changelog author="gregkh@suse.de" date="1300104000">- bump to 0.9.4 release</changelog>
  <changelog author="coolo@novell.com" date="1310385600">- add baselibs.conf to allow libgdata13 to link against it</changelog>
  <changelog author="coolo@suse.com" date="1321704000">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1353585600">- Remove dependency bloat on curl/openssl on main and devel
  packages.</changelog>
  <changelog author="p.drouand@gmail.com" date="1423742400">- Update to version 1.0.3
  * clarify documentation of oauth_curl
  * fix possible memleak in oauth_curl (only relevant if an error occurs)
  * fix TOCTOU in oauth_curl_post_file: the file may change between
    stat() and fopen()</changelog>
  <changelog author="vcizek@suse.com" date="1503489600">- Add openssl 1.1 compatibility (bsc#1055285)
  * add liboauth-openssl_1.1_compatibility.patch from
    https://github.com/x42/liboauth/issues/9</changelog>
  <changelog author="jengelh@inai.de" date="1503662400">- RPM group fixes. Remove redundant %clean section. Replace
  %__-type macro indirections.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- urls switched to https</changelog>
  <changelog author="pgajdos@suse.com" date="1709208000">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="5bb98d96c7f7997e16c2aae59da7bf90080c0cfef846677884230432194248a571384764052166e2ece5102aa180817734a3c17f072f57cc60dfa60ba9477534" name="liboauth0" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="6.20"/>
  <changelog author="gregkh@suse.de" date="1285588800">- bump to 0.9.1 release
- add libopenssl-devel install dependancy to liboauth-devel</changelog>
  <changelog author="gregkh@suse.de" date="1300104000">- bump to 0.9.4 release</changelog>
  <changelog author="coolo@novell.com" date="1310385600">- add baselibs.conf to allow libgdata13 to link against it</changelog>
  <changelog author="coolo@suse.com" date="1321704000">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1353585600">- Remove dependency bloat on curl/openssl on main and devel
  packages.</changelog>
  <changelog author="p.drouand@gmail.com" date="1423742400">- Update to version 1.0.3
  * clarify documentation of oauth_curl
  * fix possible memleak in oauth_curl (only relevant if an error occurs)
  * fix TOCTOU in oauth_curl_post_file: the file may change between
    stat() and fopen()</changelog>
  <changelog author="vcizek@suse.com" date="1503489600">- Add openssl 1.1 compatibility (bsc#1055285)
  * add liboauth-openssl_1.1_compatibility.patch from
    https://github.com/x42/liboauth/issues/9</changelog>
  <changelog author="jengelh@inai.de" date="1503662400">- RPM group fixes. Remove redundant %clean section. Replace
  %__-type macro indirections.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- urls switched to https</changelog>
  <changelog author="pgajdos@suse.com" date="1709208000">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="6fe9fab4840a92aebd313e967149f91ae20463c81f0e97222945bb97994766968962df159ded671b900fb91271de55fa9e01e84dfcb8e0bd8e833dd96bdd971f" name="liboauth0-debuginfo" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="6.20"/>
  <changelog author="gregkh@suse.de" date="1285588800">- bump to 0.9.1 release
- add libopenssl-devel install dependancy to liboauth-devel</changelog>
  <changelog author="gregkh@suse.de" date="1300104000">- bump to 0.9.4 release</changelog>
  <changelog author="coolo@novell.com" date="1310385600">- add baselibs.conf to allow libgdata13 to link against it</changelog>
  <changelog author="coolo@suse.com" date="1321704000">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1353585600">- Remove dependency bloat on curl/openssl on main and devel
  packages.</changelog>
  <changelog author="p.drouand@gmail.com" date="1423742400">- Update to version 1.0.3
  * clarify documentation of oauth_curl
  * fix possible memleak in oauth_curl (only relevant if an error occurs)
  * fix TOCTOU in oauth_curl_post_file: the file may change between
    stat() and fopen()</changelog>
  <changelog author="vcizek@suse.com" date="1503489600">- Add openssl 1.1 compatibility (bsc#1055285)
  * add liboauth-openssl_1.1_compatibility.patch from
    https://github.com/x42/liboauth/issues/9</changelog>
  <changelog author="jengelh@inai.de" date="1503662400">- RPM group fixes. Remove redundant %clean section. Replace
  %__-type macro indirections.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- urls switched to https</changelog>
  <changelog author="pgajdos@suse.com" date="1709208000">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="19f0abe10fee33b10194da93a37b272b696d03268b4652dcca4aeccd2fd0c6d30858492a94023025bb6c1b0597332d31836c9b1e7b2dca0ced4891969e64cc17" name="libopenscap33" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="295.8"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1674129600">- 0001-Use-correct-includes.patch: fixed build with rpm 4.18</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1674475200">- Require systemd for building, was pulled in before by indirect
  dependencies which don't exist anymore</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.3.7:
  * openscap-1.3.7
  * Bump soname from 25.5.0 to 25.5.1
  * Bump version to openscap-1.3.7
  * Fix typos in docs
  * Remove a check for suspicious files
  * Add debian_evr_string tests to CMakeLists
  * Add a few unittests for debian_evr_string
  * Remove To be done
  * Move release guide to upstream
- add 0005-rename-requires-reqs-for-C-20-compatibility.patch
- rename patches
  openscap-opensuse-cpe.patch to 0001-Add-openSUSE-cpe-links.patch
  openscap-suse-cpe.patch to 0002-Add-SUSE-cpe-links.patch
  openscap-docker-add-suse.patch to 0003-Use-openSUSE-SUSE-cpe-links.patch
  oscap-remediate.service.in.patch to 0004-oscap-remediate-is-located-in-bindir.patch
- drop 0001-Use-correct-includes.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680091200">- remove _service confusion, we use final tarballs.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1687348800">- openscap 1.3.8
  * New features
  - The boot-time remediation service for systemd's Offline Update mode is now disabled by default
  - Add offline capabilities to the shadow OVAL probe
  - Add offline capabilities to the sysctl OVAL probe
  - Add 'auristorfs' to list of network fileystems
  - Add new experimental linux-bound fwupdsecattr probe for system firmware security attributes (fwupd-based)
  * Maintenance, bug fix
  - Use ListUnitFiles D-Bus method to fetch all units in systemd OVAL probe
  - Fix minor resource leaks</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 1.3.9:
  * use PCRE2 library
  * Fix offline mode (OVAL/sysctl)
  * Fix leak of dpkg cache when dpkginfo_init is called multiple times
  * Fix un-expanded variable in xccdf report output
  * Fix issues when parsing profiles
  * Fix minor problems and resource leaks</changelog>
  <changelog author="Jaime Marqu&#xED;nez Ferr&#xE1;ndiz &lt;jaime.marquinez.ferrandiz@fastmail.net&gt;" date="1709035200">- Use the correct documentation's path.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710936000">- update to 1.3.10:
  * New features
  - Dump all env. variables that affects the behaviour on INFO log level
  - Support Blueprint services customization for masking
  - Fix Blueprint template to be self-contained
  - Add a refine-rule tailoring ability to autotailor
  - Introduce JSON tailoring import option for autotailor
  - Select rules based on reference
  - Skip certain paths from scanning (controlled via env. variable)
  - Introduce a limit of collected items (controlled via env. variable)
  * Maintenance, bug fix
  - Fix partition probe for PCRE2
  - Fix NSS crypto backend
  - Wrap Bash snippets in a subshell when generating a fix script
  - Improve references in HTML guides and reports
  - Update html report with OVAL details
  - Rewrite dpkginfo probe without using APT
  - Fix incorrect openscap-cpe-oval result filename
  - Implement xccdf_session_get_rule_results function in XCCDF session API
  - Implement xccdf_session_result_reset function in XCCDF session API
- drop 0005-rename-requires-reqs-for-C-20-compatibility.patch: fixed upstream</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1710936001">- Rename oscap-docker to oscap-containers and provide oscap-podman as well
  (Relates to jsc#SLE-12852)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1714824000">- 0001-Add-openSUSE-cpe-links.patch: added Leap 15.6</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1726488000">- disable sendmail buildrequires (seems unused)
- only use distribution-release to make work everywhere</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1736337600">- update to 1.4.1:
  * New features
  - Introduce "oscap-im" - script that can be used in Containerfiles to build
  - hardened bootable container images to run as Image Mode Operating System
    Maintenance, bug fix
  - Add support for containers with no entrypoint/cmd in "oscap-docker"
  - Stop printing useless component reference information in "oscap info"
  - Fix missing declaration of PATH_MAX on Solaris
  - Fix RPM database path in RPM probes (RHEL-55251, #2151)
  - Fix issues reported by OpenScanHub after 1.4.0 release
  - Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x
  - architecture
  - Ensure xlink namespace exists (RHEL-34104)
  - Minor fixes in test suite and CI
- update to 1.4.0:
  * New features
  - Introduce ability to generate Kickstarts for unattended OS installation using the oscap xccdf generate fix --fix-type kickstart command
  - Add ability to process multi-profile JSON tailorings by the autotailor tool
  * Removed features
  - Removed cve, cvss, cvrf modules
  - Removed ds submodules sds-compose, sds-add, sds-split, rds-create, rds-split
  - Removed --template, --oval-template and --sce-template options from the xccdf generate submodule
  - Remove the --skip-valid option (replaced by --skip-validation)
  * Maintenance, bug fix
  - Advertise path to SSG in remediation scripts
  - Remove the option to build with PCRE
  - Process CPE AL platforms if CPE dictionary isn't part of data stream
  - Disable GConf probe by default (and remove dependencies from docs)
  - Disable MD5 and SHA-1 by default
  - Remove CPE dictionary
  - Fix compiler warnings
  - Update User Manual
- Remove SUSE/openSUSE CPE dictionary patches.
  * drop 0001-Add-openSUSE-cpe-links.patch
  * drop 0002-Add-SUSE-cpe-links.patch
- Set .so version to 33.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1779105600">- update to 1.4.4:
  * New features
  - List rules and variables in a profile by "oscap info"
  * Maintenance, bug fix
  - Add null check for ns_uri in cpe_dict_detect_version_priv
  - Fix autotailor json bugs
  - Use stable _init_completion API in bash completion
  - Add PanFS to the list of remote filesystems
  - Move to localtime_r
  - Fix Non-constant format string issues
  - Fix schema ordering when adding tailoring to ARF files
  - Fix null ptr deref in xccdf_benchmark_parse
  - Fix name space nulls in OVAL
  - Fix segfault in error handling for cpe_item_parse
  - Always check the current lists before inserting on blueprints
- update to 1.4.3:
  * New features
  - Show rule details in output
  * Maintenance, bug fix
  - Fix inverted fields in HTML report
  - Add new STIG URL - 1.4
  - Bump OVAL_SUPPORTED to 5.11.3
  - Handle virtual packages in dpkginfo probe
  - Inherit environment for scanning and remediating in oscap-im wrapper
  - Fix the way we check rpm library version in CMake
  - Explicitly allow xmlsec1 to load key data from KeyValue
  - Fix double-free in xccdf_policy_remediate.c
  - Fix unterminated-string-initialization errors
  - Inherit OpenSCAP environment when executing Bash remediations with --remediate option
  - Fix verbose command line option
- update to 1.4.2:
  * Maintenance, bug fix
  - Fix thread synchronization bugs
  - Fix textfilecontent54_probe behaviour for negative instance numbers
  - Fix signature obtaining in rpm_info probe</changelog>
</package>
<package pkgid="c15e3b25a785f4f36691a1acf6232b961c2f48c9a4b4087b3f9c1eca85198122f93d0aa4831cd6e8a00d0676b5c3ef89e5c91e5d6abf768010a49df3a4c399a9" name="libopenscap33-debuginfo" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="295.8"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1674129600">- 0001-Use-correct-includes.patch: fixed build with rpm 4.18</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1674475200">- Require systemd for building, was pulled in before by indirect
  dependencies which don't exist anymore</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.3.7:
  * openscap-1.3.7
  * Bump soname from 25.5.0 to 25.5.1
  * Bump version to openscap-1.3.7
  * Fix typos in docs
  * Remove a check for suspicious files
  * Add debian_evr_string tests to CMakeLists
  * Add a few unittests for debian_evr_string
  * Remove To be done
  * Move release guide to upstream
- add 0005-rename-requires-reqs-for-C-20-compatibility.patch
- rename patches
  openscap-opensuse-cpe.patch to 0001-Add-openSUSE-cpe-links.patch
  openscap-suse-cpe.patch to 0002-Add-SUSE-cpe-links.patch
  openscap-docker-add-suse.patch to 0003-Use-openSUSE-SUSE-cpe-links.patch
  oscap-remediate.service.in.patch to 0004-oscap-remediate-is-located-in-bindir.patch
- drop 0001-Use-correct-includes.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680091200">- remove _service confusion, we use final tarballs.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1687348800">- openscap 1.3.8
  * New features
  - The boot-time remediation service for systemd's Offline Update mode is now disabled by default
  - Add offline capabilities to the shadow OVAL probe
  - Add offline capabilities to the sysctl OVAL probe
  - Add 'auristorfs' to list of network fileystems
  - Add new experimental linux-bound fwupdsecattr probe for system firmware security attributes (fwupd-based)
  * Maintenance, bug fix
  - Use ListUnitFiles D-Bus method to fetch all units in systemd OVAL probe
  - Fix minor resource leaks</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 1.3.9:
  * use PCRE2 library
  * Fix offline mode (OVAL/sysctl)
  * Fix leak of dpkg cache when dpkginfo_init is called multiple times
  * Fix un-expanded variable in xccdf report output
  * Fix issues when parsing profiles
  * Fix minor problems and resource leaks</changelog>
  <changelog author="Jaime Marqu&#xED;nez Ferr&#xE1;ndiz &lt;jaime.marquinez.ferrandiz@fastmail.net&gt;" date="1709035200">- Use the correct documentation's path.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710936000">- update to 1.3.10:
  * New features
  - Dump all env. variables that affects the behaviour on INFO log level
  - Support Blueprint services customization for masking
  - Fix Blueprint template to be self-contained
  - Add a refine-rule tailoring ability to autotailor
  - Introduce JSON tailoring import option for autotailor
  - Select rules based on reference
  - Skip certain paths from scanning (controlled via env. variable)
  - Introduce a limit of collected items (controlled via env. variable)
  * Maintenance, bug fix
  - Fix partition probe for PCRE2
  - Fix NSS crypto backend
  - Wrap Bash snippets in a subshell when generating a fix script
  - Improve references in HTML guides and reports
  - Update html report with OVAL details
  - Rewrite dpkginfo probe without using APT
  - Fix incorrect openscap-cpe-oval result filename
  - Implement xccdf_session_get_rule_results function in XCCDF session API
  - Implement xccdf_session_result_reset function in XCCDF session API
- drop 0005-rename-requires-reqs-for-C-20-compatibility.patch: fixed upstream</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1710936001">- Rename oscap-docker to oscap-containers and provide oscap-podman as well
  (Relates to jsc#SLE-12852)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1714824000">- 0001-Add-openSUSE-cpe-links.patch: added Leap 15.6</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1726488000">- disable sendmail buildrequires (seems unused)
- only use distribution-release to make work everywhere</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1736337600">- update to 1.4.1:
  * New features
  - Introduce "oscap-im" - script that can be used in Containerfiles to build
  - hardened bootable container images to run as Image Mode Operating System
    Maintenance, bug fix
  - Add support for containers with no entrypoint/cmd in "oscap-docker"
  - Stop printing useless component reference information in "oscap info"
  - Fix missing declaration of PATH_MAX on Solaris
  - Fix RPM database path in RPM probes (RHEL-55251, #2151)
  - Fix issues reported by OpenScanHub after 1.4.0 release
  - Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x
  - architecture
  - Ensure xlink namespace exists (RHEL-34104)
  - Minor fixes in test suite and CI
- update to 1.4.0:
  * New features
  - Introduce ability to generate Kickstarts for unattended OS installation using the oscap xccdf generate fix --fix-type kickstart command
  - Add ability to process multi-profile JSON tailorings by the autotailor tool
  * Removed features
  - Removed cve, cvss, cvrf modules
  - Removed ds submodules sds-compose, sds-add, sds-split, rds-create, rds-split
  - Removed --template, --oval-template and --sce-template options from the xccdf generate submodule
  - Remove the --skip-valid option (replaced by --skip-validation)
  * Maintenance, bug fix
  - Advertise path to SSG in remediation scripts
  - Remove the option to build with PCRE
  - Process CPE AL platforms if CPE dictionary isn't part of data stream
  - Disable GConf probe by default (and remove dependencies from docs)
  - Disable MD5 and SHA-1 by default
  - Remove CPE dictionary
  - Fix compiler warnings
  - Update User Manual
- Remove SUSE/openSUSE CPE dictionary patches.
  * drop 0001-Add-openSUSE-cpe-links.patch
  * drop 0002-Add-SUSE-cpe-links.patch
- Set .so version to 33.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1779105600">- update to 1.4.4:
  * New features
  - List rules and variables in a profile by "oscap info"
  * Maintenance, bug fix
  - Add null check for ns_uri in cpe_dict_detect_version_priv
  - Fix autotailor json bugs
  - Use stable _init_completion API in bash completion
  - Add PanFS to the list of remote filesystems
  - Move to localtime_r
  - Fix Non-constant format string issues
  - Fix schema ordering when adding tailoring to ARF files
  - Fix null ptr deref in xccdf_benchmark_parse
  - Fix name space nulls in OVAL
  - Fix segfault in error handling for cpe_item_parse
  - Always check the current lists before inserting on blueprints
- update to 1.4.3:
  * New features
  - Show rule details in output
  * Maintenance, bug fix
  - Fix inverted fields in HTML report
  - Add new STIG URL - 1.4
  - Bump OVAL_SUPPORTED to 5.11.3
  - Handle virtual packages in dpkginfo probe
  - Inherit environment for scanning and remediating in oscap-im wrapper
  - Fix the way we check rpm library version in CMake
  - Explicitly allow xmlsec1 to load key data from KeyValue
  - Fix double-free in xccdf_policy_remediate.c
  - Fix unterminated-string-initialization errors
  - Inherit OpenSCAP environment when executing Bash remediations with --remediate option
  - Fix verbose command line option
- update to 1.4.2:
  * Maintenance, bug fix
  - Fix thread synchronization bugs
  - Fix textfilecontent54_probe behaviour for negative instance numbers
  - Fix signature obtaining in rpm_info probe</changelog>
</package>
<package pkgid="8afb46a21373c41b3aecb704908328260d5eeb4ea4018640b92ef5ec8196c43e8ad39c51f3c8ea671413e64d3192819f71be72341914d6711828b42832ad2501" name="libopenscap_sce33" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="295.8"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1674129600">- 0001-Use-correct-includes.patch: fixed build with rpm 4.18</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1674475200">- Require systemd for building, was pulled in before by indirect
  dependencies which don't exist anymore</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.3.7:
  * openscap-1.3.7
  * Bump soname from 25.5.0 to 25.5.1
  * Bump version to openscap-1.3.7
  * Fix typos in docs
  * Remove a check for suspicious files
  * Add debian_evr_string tests to CMakeLists
  * Add a few unittests for debian_evr_string
  * Remove To be done
  * Move release guide to upstream
- add 0005-rename-requires-reqs-for-C-20-compatibility.patch
- rename patches
  openscap-opensuse-cpe.patch to 0001-Add-openSUSE-cpe-links.patch
  openscap-suse-cpe.patch to 0002-Add-SUSE-cpe-links.patch
  openscap-docker-add-suse.patch to 0003-Use-openSUSE-SUSE-cpe-links.patch
  oscap-remediate.service.in.patch to 0004-oscap-remediate-is-located-in-bindir.patch
- drop 0001-Use-correct-includes.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680091200">- remove _service confusion, we use final tarballs.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1687348800">- openscap 1.3.8
  * New features
  - The boot-time remediation service for systemd's Offline Update mode is now disabled by default
  - Add offline capabilities to the shadow OVAL probe
  - Add offline capabilities to the sysctl OVAL probe
  - Add 'auristorfs' to list of network fileystems
  - Add new experimental linux-bound fwupdsecattr probe for system firmware security attributes (fwupd-based)
  * Maintenance, bug fix
  - Use ListUnitFiles D-Bus method to fetch all units in systemd OVAL probe
  - Fix minor resource leaks</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 1.3.9:
  * use PCRE2 library
  * Fix offline mode (OVAL/sysctl)
  * Fix leak of dpkg cache when dpkginfo_init is called multiple times
  * Fix un-expanded variable in xccdf report output
  * Fix issues when parsing profiles
  * Fix minor problems and resource leaks</changelog>
  <changelog author="Jaime Marqu&#xED;nez Ferr&#xE1;ndiz &lt;jaime.marquinez.ferrandiz@fastmail.net&gt;" date="1709035200">- Use the correct documentation's path.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710936000">- update to 1.3.10:
  * New features
  - Dump all env. variables that affects the behaviour on INFO log level
  - Support Blueprint services customization for masking
  - Fix Blueprint template to be self-contained
  - Add a refine-rule tailoring ability to autotailor
  - Introduce JSON tailoring import option for autotailor
  - Select rules based on reference
  - Skip certain paths from scanning (controlled via env. variable)
  - Introduce a limit of collected items (controlled via env. variable)
  * Maintenance, bug fix
  - Fix partition probe for PCRE2
  - Fix NSS crypto backend
  - Wrap Bash snippets in a subshell when generating a fix script
  - Improve references in HTML guides and reports
  - Update html report with OVAL details
  - Rewrite dpkginfo probe without using APT
  - Fix incorrect openscap-cpe-oval result filename
  - Implement xccdf_session_get_rule_results function in XCCDF session API
  - Implement xccdf_session_result_reset function in XCCDF session API
- drop 0005-rename-requires-reqs-for-C-20-compatibility.patch: fixed upstream</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1710936001">- Rename oscap-docker to oscap-containers and provide oscap-podman as well
  (Relates to jsc#SLE-12852)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1714824000">- 0001-Add-openSUSE-cpe-links.patch: added Leap 15.6</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1726488000">- disable sendmail buildrequires (seems unused)
- only use distribution-release to make work everywhere</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1736337600">- update to 1.4.1:
  * New features
  - Introduce "oscap-im" - script that can be used in Containerfiles to build
  - hardened bootable container images to run as Image Mode Operating System
    Maintenance, bug fix
  - Add support for containers with no entrypoint/cmd in "oscap-docker"
  - Stop printing useless component reference information in "oscap info"
  - Fix missing declaration of PATH_MAX on Solaris
  - Fix RPM database path in RPM probes (RHEL-55251, #2151)
  - Fix issues reported by OpenScanHub after 1.4.0 release
  - Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x
  - architecture
  - Ensure xlink namespace exists (RHEL-34104)
  - Minor fixes in test suite and CI
- update to 1.4.0:
  * New features
  - Introduce ability to generate Kickstarts for unattended OS installation using the oscap xccdf generate fix --fix-type kickstart command
  - Add ability to process multi-profile JSON tailorings by the autotailor tool
  * Removed features
  - Removed cve, cvss, cvrf modules
  - Removed ds submodules sds-compose, sds-add, sds-split, rds-create, rds-split
  - Removed --template, --oval-template and --sce-template options from the xccdf generate submodule
  - Remove the --skip-valid option (replaced by --skip-validation)
  * Maintenance, bug fix
  - Advertise path to SSG in remediation scripts
  - Remove the option to build with PCRE
  - Process CPE AL platforms if CPE dictionary isn't part of data stream
  - Disable GConf probe by default (and remove dependencies from docs)
  - Disable MD5 and SHA-1 by default
  - Remove CPE dictionary
  - Fix compiler warnings
  - Update User Manual
- Remove SUSE/openSUSE CPE dictionary patches.
  * drop 0001-Add-openSUSE-cpe-links.patch
  * drop 0002-Add-SUSE-cpe-links.patch
- Set .so version to 33.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1779105600">- update to 1.4.4:
  * New features
  - List rules and variables in a profile by "oscap info"
  * Maintenance, bug fix
  - Add null check for ns_uri in cpe_dict_detect_version_priv
  - Fix autotailor json bugs
  - Use stable _init_completion API in bash completion
  - Add PanFS to the list of remote filesystems
  - Move to localtime_r
  - Fix Non-constant format string issues
  - Fix schema ordering when adding tailoring to ARF files
  - Fix null ptr deref in xccdf_benchmark_parse
  - Fix name space nulls in OVAL
  - Fix segfault in error handling for cpe_item_parse
  - Always check the current lists before inserting on blueprints
- update to 1.4.3:
  * New features
  - Show rule details in output
  * Maintenance, bug fix
  - Fix inverted fields in HTML report
  - Add new STIG URL - 1.4
  - Bump OVAL_SUPPORTED to 5.11.3
  - Handle virtual packages in dpkginfo probe
  - Inherit environment for scanning and remediating in oscap-im wrapper
  - Fix the way we check rpm library version in CMake
  - Explicitly allow xmlsec1 to load key data from KeyValue
  - Fix double-free in xccdf_policy_remediate.c
  - Fix unterminated-string-initialization errors
  - Inherit OpenSCAP environment when executing Bash remediations with --remediate option
  - Fix verbose command line option
- update to 1.4.2:
  * Maintenance, bug fix
  - Fix thread synchronization bugs
  - Fix textfilecontent54_probe behaviour for negative instance numbers
  - Fix signature obtaining in rpm_info probe</changelog>
</package>
<package pkgid="628abb8d2225b8a4800e46d4ee1477374566a00232ca188ae7d246e8c38ba6c02df5fd2801f39715f47eb000f1854ae1903e893f7e9dfc23f6985caf4f159ded" name="libopenscap_sce33-debuginfo" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="295.8"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1674129600">- 0001-Use-correct-includes.patch: fixed build with rpm 4.18</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1674475200">- Require systemd for building, was pulled in before by indirect
  dependencies which don't exist anymore</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.3.7:
  * openscap-1.3.7
  * Bump soname from 25.5.0 to 25.5.1
  * Bump version to openscap-1.3.7
  * Fix typos in docs
  * Remove a check for suspicious files
  * Add debian_evr_string tests to CMakeLists
  * Add a few unittests for debian_evr_string
  * Remove To be done
  * Move release guide to upstream
- add 0005-rename-requires-reqs-for-C-20-compatibility.patch
- rename patches
  openscap-opensuse-cpe.patch to 0001-Add-openSUSE-cpe-links.patch
  openscap-suse-cpe.patch to 0002-Add-SUSE-cpe-links.patch
  openscap-docker-add-suse.patch to 0003-Use-openSUSE-SUSE-cpe-links.patch
  oscap-remediate.service.in.patch to 0004-oscap-remediate-is-located-in-bindir.patch
- drop 0001-Use-correct-includes.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680091200">- remove _service confusion, we use final tarballs.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1687348800">- openscap 1.3.8
  * New features
  - The boot-time remediation service for systemd's Offline Update mode is now disabled by default
  - Add offline capabilities to the shadow OVAL probe
  - Add offline capabilities to the sysctl OVAL probe
  - Add 'auristorfs' to list of network fileystems
  - Add new experimental linux-bound fwupdsecattr probe for system firmware security attributes (fwupd-based)
  * Maintenance, bug fix
  - Use ListUnitFiles D-Bus method to fetch all units in systemd OVAL probe
  - Fix minor resource leaks</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 1.3.9:
  * use PCRE2 library
  * Fix offline mode (OVAL/sysctl)
  * Fix leak of dpkg cache when dpkginfo_init is called multiple times
  * Fix un-expanded variable in xccdf report output
  * Fix issues when parsing profiles
  * Fix minor problems and resource leaks</changelog>
  <changelog author="Jaime Marqu&#xED;nez Ferr&#xE1;ndiz &lt;jaime.marquinez.ferrandiz@fastmail.net&gt;" date="1709035200">- Use the correct documentation's path.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710936000">- update to 1.3.10:
  * New features
  - Dump all env. variables that affects the behaviour on INFO log level
  - Support Blueprint services customization for masking
  - Fix Blueprint template to be self-contained
  - Add a refine-rule tailoring ability to autotailor
  - Introduce JSON tailoring import option for autotailor
  - Select rules based on reference
  - Skip certain paths from scanning (controlled via env. variable)
  - Introduce a limit of collected items (controlled via env. variable)
  * Maintenance, bug fix
  - Fix partition probe for PCRE2
  - Fix NSS crypto backend
  - Wrap Bash snippets in a subshell when generating a fix script
  - Improve references in HTML guides and reports
  - Update html report with OVAL details
  - Rewrite dpkginfo probe without using APT
  - Fix incorrect openscap-cpe-oval result filename
  - Implement xccdf_session_get_rule_results function in XCCDF session API
  - Implement xccdf_session_result_reset function in XCCDF session API
- drop 0005-rename-requires-reqs-for-C-20-compatibility.patch: fixed upstream</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1710936001">- Rename oscap-docker to oscap-containers and provide oscap-podman as well
  (Relates to jsc#SLE-12852)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1714824000">- 0001-Add-openSUSE-cpe-links.patch: added Leap 15.6</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1726488000">- disable sendmail buildrequires (seems unused)
- only use distribution-release to make work everywhere</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1736337600">- update to 1.4.1:
  * New features
  - Introduce "oscap-im" - script that can be used in Containerfiles to build
  - hardened bootable container images to run as Image Mode Operating System
    Maintenance, bug fix
  - Add support for containers with no entrypoint/cmd in "oscap-docker"
  - Stop printing useless component reference information in "oscap info"
  - Fix missing declaration of PATH_MAX on Solaris
  - Fix RPM database path in RPM probes (RHEL-55251, #2151)
  - Fix issues reported by OpenScanHub after 1.4.0 release
  - Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x
  - architecture
  - Ensure xlink namespace exists (RHEL-34104)
  - Minor fixes in test suite and CI
- update to 1.4.0:
  * New features
  - Introduce ability to generate Kickstarts for unattended OS installation using the oscap xccdf generate fix --fix-type kickstart command
  - Add ability to process multi-profile JSON tailorings by the autotailor tool
  * Removed features
  - Removed cve, cvss, cvrf modules
  - Removed ds submodules sds-compose, sds-add, sds-split, rds-create, rds-split
  - Removed --template, --oval-template and --sce-template options from the xccdf generate submodule
  - Remove the --skip-valid option (replaced by --skip-validation)
  * Maintenance, bug fix
  - Advertise path to SSG in remediation scripts
  - Remove the option to build with PCRE
  - Process CPE AL platforms if CPE dictionary isn't part of data stream
  - Disable GConf probe by default (and remove dependencies from docs)
  - Disable MD5 and SHA-1 by default
  - Remove CPE dictionary
  - Fix compiler warnings
  - Update User Manual
- Remove SUSE/openSUSE CPE dictionary patches.
  * drop 0001-Add-openSUSE-cpe-links.patch
  * drop 0002-Add-SUSE-cpe-links.patch
- Set .so version to 33.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1779105600">- update to 1.4.4:
  * New features
  - List rules and variables in a profile by "oscap info"
  * Maintenance, bug fix
  - Add null check for ns_uri in cpe_dict_detect_version_priv
  - Fix autotailor json bugs
  - Use stable _init_completion API in bash completion
  - Add PanFS to the list of remote filesystems
  - Move to localtime_r
  - Fix Non-constant format string issues
  - Fix schema ordering when adding tailoring to ARF files
  - Fix null ptr deref in xccdf_benchmark_parse
  - Fix name space nulls in OVAL
  - Fix segfault in error handling for cpe_item_parse
  - Always check the current lists before inserting on blueprints
- update to 1.4.3:
  * New features
  - Show rule details in output
  * Maintenance, bug fix
  - Fix inverted fields in HTML report
  - Add new STIG URL - 1.4
  - Bump OVAL_SUPPORTED to 5.11.3
  - Handle virtual packages in dpkginfo probe
  - Inherit environment for scanning and remediating in oscap-im wrapper
  - Fix the way we check rpm library version in CMake
  - Explicitly allow xmlsec1 to load key data from KeyValue
  - Fix double-free in xccdf_policy_remediate.c
  - Fix unterminated-string-initialization errors
  - Inherit OpenSCAP environment when executing Bash remediations with --remediate option
  - Fix verbose command line option
- update to 1.4.2:
  * Maintenance, bug fix
  - Fix thread synchronization bugs
  - Fix textfilecontent54_probe behaviour for negative instance numbers
  - Fix signature obtaining in rpm_info probe</changelog>
</package>
<package pkgid="0399ebe95bf1d0c0d654666f6deec6479ca22f9dd6d286c7b38a9579b15f1fa97172f2c1148824e47ca0f9b0f3f45f95ebba5413de117578227cfb32fdfe307c" name="libpskc-devel" arch="s390x">
  <version epoch="0" ver="2.6.14" rel="41.9"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1609243200">- Update to version 2.6.5
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.
    KEY and OTP may now be given as '-' to mean stdin, or @FILE to
    read from a particular file.  This is recommended on multi-user
    systems, since secrets as command line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.
  * Doc fixes.
- Update to version 2.6.4
  * libpskc: New --with-xmlsec-crypto-engine to hard-code crypto
    engine.  Use it like --with-xmlsec-crypto-engine=gnutls or
  - -with-xmlsec-crypto-engine=openssl if the default dynamic
    loading fails because of runtime linker search path issues.
  * oathtool --totp --verbose now prints TOTP hash mode.
  * oathtool: Hash names (e.g., SHA256) for --totp are now upper
    case.  Lower/mixed case hash names are supported for
    compatibility.
  * pam_oath: Fail gracefully for missing users.
    This allows you to incrementally add support for OATH
    authentication instead of forcing it on all users.
  * Fix libpskc memory corruption bug.
  * Fix man pages.
  * Build fixes.
- Update to version 2.6.3
  * pam_oath: Fix self-tests.
- Drop not longer needed patches:
  * 0001-Fix-no-return-in-nonvoid-function-errors-reported-by.patch
  * 0003-pam_oath-assign-safe-default-to-alwaysok-config-memb.patch
  * 0002-update_gnulibs_files.patch
  * gnulib-libio.patch
- Use source verification
- Use proper source URLs</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1611144000">- Update to version 2.6.6
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.  KEY and OTP may now be given as '-' to mean
    stdin, or @FILE to read from a particular file.  This is
    recommended on multi-user systems, since secrets as command
    line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1619956800">- Update to version 2.6.7
  * pam_oath: Support variables in usersfile string parameter.
    These changes introduce the ${USER} and ${HOME} placeholder
    values for the usersfile string in the pam_oath configuration
    file. The placeholder values allow the user credentials file
    to be stored in a file path that is relative to the user, and
    mimics similar behavior found in google-authenticator-libpam.
    The motivation for these changes is to allow for
    non-privileged processes to use pam_oath (e.g., for 2FA with
    xscreensaver). Non-privileged and non-suid programs are
    unable to use pam_oath. These changes are a proposed
    alternative to a suid helper binary as well.
  * doc: Fix project URL in man pages.
  * build: Drop use of libxml's AM_PATH_XML2 in favor of pkg-config.
  * build: Modernize autotools usage.
    Most importantly, no longer use -Werror with AM_INIT_AUTOMAKE
    to make rebuilding from source more safe with future automake
    versions.
  * Updated gnulib files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url -&gt; https</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1659441600">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1688904000">- Update to version 2.6.8
  * libpskc: Fixes for recent libxmlsec releases.
  * pam_oath: Provide fallback pam_modutil_getpwnam implementation.
  * pam_oath: Don't fail authentication when pam_modutil_getpwnam
  doesn't ** know the user when usersfile don't include ${USER}
  or ${HOME}.
  * pam_oath: Self-test improvements.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.11
  * liboath: Handle invalid base32 encoded secrets.  Fixes: #41.
  * Various build fixes including updated gnulib files.
  * Improve compatibility with recent libxmlsec.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1726228800">- Fix security issue CVE-2024-47191 by adding
  0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch .
- Add patch to implement new null_usersfile_okay argument
  42-null_usersfile_okay.patch .
- Makes this version 2.6.11.12 to be able to depend on it.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1729080000">- Update 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  with bsc#1231699 improvements for security fix CVE-2024-47191</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1770120000">- Update to version 2.6.14
  * pam_oath: Support null_usersfile_okay parameter. The argument
    no_usersfile_okay forces the module to act as if the user is
    not present in the config, if the config file does not exist.
    This has security implications only use if you know what you
    are doing. E.g. if the file is in a mount like home and that
    fails to be mounted, then this will succeed even if the OTP if
    configured for that user. Patch by Luna, Jan Zerebecki, and
    Miika Alikirri; see
    https://codeberg.org/oath-toolkit/oath-toolkit/pulls/94.
  * pam_oath README: Suggest KbdInteractiveAuthentication. Instead
    of deprecated ChallengeResponseAuthentication.
    see https://codeberg.org/oath-toolkit/oath-toolkit/pulls/112.
  * Various build fixes including updated gnulib files. Fixes
    building with glibc 2.43.
- Update to version 2.6.13
  * liboath/libpskc: Fix _FORTIFY_SOURCE build problem and allow
    configuration.
  * liboath: Fix --with-openssl builds
  * Git hosting moved from gitlab.com to codeberg.org. The new URL
    is https://codeberg.org/oath-toolkit/oath-toolkit although the
    old GitLab project will continue to be used for pipelines.
    https://gitlab.com/oath-toolkit/oath-toolkit/-/pipelines
  * Various build fixes including updated gnulib files. Gnulib
    files are no longer stored in git version control. As a
    consequence, gnulib is a required build dependency when
    building from git, see CONTRIBUTING.md.
- Update to version 2.6.12
  * Reported by Fabian Vogt (SUSE), and associated with
    CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings,
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    Quoting a writeup in an alternate patch by Matthias Gerstner
    (SUSE): With the addition of the possibility to place a
    usersfile also into a the usersfile= path specification,
    security issues sneaked in. The PAM process usually runs with
    root privileges. The file operations in an unprivileged user’s
    home directory follow symlinks both when reading and creating
    files, allowing for a potential local root exploit, because of
    the fchown() performed on the newly created usersfile.
  * We drop privileges to the user that is being logged into,
    assuming it has the necessary permissions for the usersfile
    belonging in their home directory. This restricts the ability
    for non-root users to affect files beyond their control via
    liboath.
  * liboath: Don’t follow symbolic links for usersfile updates.
    Reported by Fabian Vogt (SUSE), and associated with CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings, see
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    The fix is to open files for writing in exclusive mode (i.e., fail
    if the file exists including if it is a symbolic link).
  * oathtool: Fix test suite on 32-bit big-endian platforms.
  * libpskc: Don’t call deprecated xmlMemoryDump.
  * Various build fixes including updated gnulib files.
- Drop not longer needed patches (fixed upstream):
  * 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  * 42-null_usersfile_okay.patch
- Use %ldconfig_scriptlets macro.</changelog>
</package>
<package pkgid="08e9cd7cb1b34bc8e8b4c3d8a66f5e65a646c4e8647f786c479a0ccd17528e747968671c1dc73282a845cb294610f93f7809f0486e14c357f4a9673ab6ebca35" name="libpskc0" arch="s390x">
  <version epoch="0" ver="2.6.14" rel="41.9"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1609243200">- Update to version 2.6.5
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.
    KEY and OTP may now be given as '-' to mean stdin, or @FILE to
    read from a particular file.  This is recommended on multi-user
    systems, since secrets as command line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.
  * Doc fixes.
- Update to version 2.6.4
  * libpskc: New --with-xmlsec-crypto-engine to hard-code crypto
    engine.  Use it like --with-xmlsec-crypto-engine=gnutls or
  - -with-xmlsec-crypto-engine=openssl if the default dynamic
    loading fails because of runtime linker search path issues.
  * oathtool --totp --verbose now prints TOTP hash mode.
  * oathtool: Hash names (e.g., SHA256) for --totp are now upper
    case.  Lower/mixed case hash names are supported for
    compatibility.
  * pam_oath: Fail gracefully for missing users.
    This allows you to incrementally add support for OATH
    authentication instead of forcing it on all users.
  * Fix libpskc memory corruption bug.
  * Fix man pages.
  * Build fixes.
- Update to version 2.6.3
  * pam_oath: Fix self-tests.
- Drop not longer needed patches:
  * 0001-Fix-no-return-in-nonvoid-function-errors-reported-by.patch
  * 0003-pam_oath-assign-safe-default-to-alwaysok-config-memb.patch
  * 0002-update_gnulibs_files.patch
  * gnulib-libio.patch
- Use source verification
- Use proper source URLs</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1611144000">- Update to version 2.6.6
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.  KEY and OTP may now be given as '-' to mean
    stdin, or @FILE to read from a particular file.  This is
    recommended on multi-user systems, since secrets as command
    line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1619956800">- Update to version 2.6.7
  * pam_oath: Support variables in usersfile string parameter.
    These changes introduce the ${USER} and ${HOME} placeholder
    values for the usersfile string in the pam_oath configuration
    file. The placeholder values allow the user credentials file
    to be stored in a file path that is relative to the user, and
    mimics similar behavior found in google-authenticator-libpam.
    The motivation for these changes is to allow for
    non-privileged processes to use pam_oath (e.g., for 2FA with
    xscreensaver). Non-privileged and non-suid programs are
    unable to use pam_oath. These changes are a proposed
    alternative to a suid helper binary as well.
  * doc: Fix project URL in man pages.
  * build: Drop use of libxml's AM_PATH_XML2 in favor of pkg-config.
  * build: Modernize autotools usage.
    Most importantly, no longer use -Werror with AM_INIT_AUTOMAKE
    to make rebuilding from source more safe with future automake
    versions.
  * Updated gnulib files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url -&gt; https</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1659441600">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1688904000">- Update to version 2.6.8
  * libpskc: Fixes for recent libxmlsec releases.
  * pam_oath: Provide fallback pam_modutil_getpwnam implementation.
  * pam_oath: Don't fail authentication when pam_modutil_getpwnam
  doesn't ** know the user when usersfile don't include ${USER}
  or ${HOME}.
  * pam_oath: Self-test improvements.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.11
  * liboath: Handle invalid base32 encoded secrets.  Fixes: #41.
  * Various build fixes including updated gnulib files.
  * Improve compatibility with recent libxmlsec.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1726228800">- Fix security issue CVE-2024-47191 by adding
  0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch .
- Add patch to implement new null_usersfile_okay argument
  42-null_usersfile_okay.patch .
- Makes this version 2.6.11.12 to be able to depend on it.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1729080000">- Update 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  with bsc#1231699 improvements for security fix CVE-2024-47191</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1770120000">- Update to version 2.6.14
  * pam_oath: Support null_usersfile_okay parameter. The argument
    no_usersfile_okay forces the module to act as if the user is
    not present in the config, if the config file does not exist.
    This has security implications only use if you know what you
    are doing. E.g. if the file is in a mount like home and that
    fails to be mounted, then this will succeed even if the OTP if
    configured for that user. Patch by Luna, Jan Zerebecki, and
    Miika Alikirri; see
    https://codeberg.org/oath-toolkit/oath-toolkit/pulls/94.
  * pam_oath README: Suggest KbdInteractiveAuthentication. Instead
    of deprecated ChallengeResponseAuthentication.
    see https://codeberg.org/oath-toolkit/oath-toolkit/pulls/112.
  * Various build fixes including updated gnulib files. Fixes
    building with glibc 2.43.
- Update to version 2.6.13
  * liboath/libpskc: Fix _FORTIFY_SOURCE build problem and allow
    configuration.
  * liboath: Fix --with-openssl builds
  * Git hosting moved from gitlab.com to codeberg.org. The new URL
    is https://codeberg.org/oath-toolkit/oath-toolkit although the
    old GitLab project will continue to be used for pipelines.
    https://gitlab.com/oath-toolkit/oath-toolkit/-/pipelines
  * Various build fixes including updated gnulib files. Gnulib
    files are no longer stored in git version control. As a
    consequence, gnulib is a required build dependency when
    building from git, see CONTRIBUTING.md.
- Update to version 2.6.12
  * Reported by Fabian Vogt (SUSE), and associated with
    CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings,
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    Quoting a writeup in an alternate patch by Matthias Gerstner
    (SUSE): With the addition of the possibility to place a
    usersfile also into a the usersfile= path specification,
    security issues sneaked in. The PAM process usually runs with
    root privileges. The file operations in an unprivileged user’s
    home directory follow symlinks both when reading and creating
    files, allowing for a potential local root exploit, because of
    the fchown() performed on the newly created usersfile.
  * We drop privileges to the user that is being logged into,
    assuming it has the necessary permissions for the usersfile
    belonging in their home directory. This restricts the ability
    for non-root users to affect files beyond their control via
    liboath.
  * liboath: Don’t follow symbolic links for usersfile updates.
    Reported by Fabian Vogt (SUSE), and associated with CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings, see
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    The fix is to open files for writing in exclusive mode (i.e., fail
    if the file exists including if it is a symbolic link).
  * oathtool: Fix test suite on 32-bit big-endian platforms.
  * libpskc: Don’t call deprecated xmlMemoryDump.
  * Various build fixes including updated gnulib files.
- Drop not longer needed patches (fixed upstream):
  * 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  * 42-null_usersfile_okay.patch
- Use %ldconfig_scriptlets macro.</changelog>
</package>
<package pkgid="841a395e61fa068889c12ac798f81481ee11721093a5082f32f005d8201f0e496fcd676b8fcddba936b0bfea344a79c3db67245724ed41943869922dec5caefe" name="libpskc0-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.14" rel="41.9"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1609243200">- Update to version 2.6.5
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.
    KEY and OTP may now be given as '-' to mean stdin, or @FILE to
    read from a particular file.  This is recommended on multi-user
    systems, since secrets as command line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.
  * Doc fixes.
- Update to version 2.6.4
  * libpskc: New --with-xmlsec-crypto-engine to hard-code crypto
    engine.  Use it like --with-xmlsec-crypto-engine=gnutls or
  - -with-xmlsec-crypto-engine=openssl if the default dynamic
    loading fails because of runtime linker search path issues.
  * oathtool --totp --verbose now prints TOTP hash mode.
  * oathtool: Hash names (e.g., SHA256) for --totp are now upper
    case.  Lower/mixed case hash names are supported for
    compatibility.
  * pam_oath: Fail gracefully for missing users.
    This allows you to incrementally add support for OATH
    authentication instead of forcing it on all users.
  * Fix libpskc memory corruption bug.
  * Fix man pages.
  * Build fixes.
- Update to version 2.6.3
  * pam_oath: Fix self-tests.
- Drop not longer needed patches:
  * 0001-Fix-no-return-in-nonvoid-function-errors-reported-by.patch
  * 0003-pam_oath-assign-safe-default-to-alwaysok-config-memb.patch
  * 0002-update_gnulibs_files.patch
  * gnulib-libio.patch
- Use source verification
- Use proper source URLs</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1611144000">- Update to version 2.6.6
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.  KEY and OTP may now be given as '-' to mean
    stdin, or @FILE to read from a particular file.  This is
    recommended on multi-user systems, since secrets as command
    line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1619956800">- Update to version 2.6.7
  * pam_oath: Support variables in usersfile string parameter.
    These changes introduce the ${USER} and ${HOME} placeholder
    values for the usersfile string in the pam_oath configuration
    file. The placeholder values allow the user credentials file
    to be stored in a file path that is relative to the user, and
    mimics similar behavior found in google-authenticator-libpam.
    The motivation for these changes is to allow for
    non-privileged processes to use pam_oath (e.g., for 2FA with
    xscreensaver). Non-privileged and non-suid programs are
    unable to use pam_oath. These changes are a proposed
    alternative to a suid helper binary as well.
  * doc: Fix project URL in man pages.
  * build: Drop use of libxml's AM_PATH_XML2 in favor of pkg-config.
  * build: Modernize autotools usage.
    Most importantly, no longer use -Werror with AM_INIT_AUTOMAKE
    to make rebuilding from source more safe with future automake
    versions.
  * Updated gnulib files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url -&gt; https</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1659441600">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1688904000">- Update to version 2.6.8
  * libpskc: Fixes for recent libxmlsec releases.
  * pam_oath: Provide fallback pam_modutil_getpwnam implementation.
  * pam_oath: Don't fail authentication when pam_modutil_getpwnam
  doesn't ** know the user when usersfile don't include ${USER}
  or ${HOME}.
  * pam_oath: Self-test improvements.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.11
  * liboath: Handle invalid base32 encoded secrets.  Fixes: #41.
  * Various build fixes including updated gnulib files.
  * Improve compatibility with recent libxmlsec.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1726228800">- Fix security issue CVE-2024-47191 by adding
  0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch .
- Add patch to implement new null_usersfile_okay argument
  42-null_usersfile_okay.patch .
- Makes this version 2.6.11.12 to be able to depend on it.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1729080000">- Update 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  with bsc#1231699 improvements for security fix CVE-2024-47191</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1770120000">- Update to version 2.6.14
  * pam_oath: Support null_usersfile_okay parameter. The argument
    no_usersfile_okay forces the module to act as if the user is
    not present in the config, if the config file does not exist.
    This has security implications only use if you know what you
    are doing. E.g. if the file is in a mount like home and that
    fails to be mounted, then this will succeed even if the OTP if
    configured for that user. Patch by Luna, Jan Zerebecki, and
    Miika Alikirri; see
    https://codeberg.org/oath-toolkit/oath-toolkit/pulls/94.
  * pam_oath README: Suggest KbdInteractiveAuthentication. Instead
    of deprecated ChallengeResponseAuthentication.
    see https://codeberg.org/oath-toolkit/oath-toolkit/pulls/112.
  * Various build fixes including updated gnulib files. Fixes
    building with glibc 2.43.
- Update to version 2.6.13
  * liboath/libpskc: Fix _FORTIFY_SOURCE build problem and allow
    configuration.
  * liboath: Fix --with-openssl builds
  * Git hosting moved from gitlab.com to codeberg.org. The new URL
    is https://codeberg.org/oath-toolkit/oath-toolkit although the
    old GitLab project will continue to be used for pipelines.
    https://gitlab.com/oath-toolkit/oath-toolkit/-/pipelines
  * Various build fixes including updated gnulib files. Gnulib
    files are no longer stored in git version control. As a
    consequence, gnulib is a required build dependency when
    building from git, see CONTRIBUTING.md.
- Update to version 2.6.12
  * Reported by Fabian Vogt (SUSE), and associated with
    CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings,
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    Quoting a writeup in an alternate patch by Matthias Gerstner
    (SUSE): With the addition of the possibility to place a
    usersfile also into a the usersfile= path specification,
    security issues sneaked in. The PAM process usually runs with
    root privileges. The file operations in an unprivileged user’s
    home directory follow symlinks both when reading and creating
    files, allowing for a potential local root exploit, because of
    the fchown() performed on the newly created usersfile.
  * We drop privileges to the user that is being logged into,
    assuming it has the necessary permissions for the usersfile
    belonging in their home directory. This restricts the ability
    for non-root users to affect files beyond their control via
    liboath.
  * liboath: Don’t follow symbolic links for usersfile updates.
    Reported by Fabian Vogt (SUSE), and associated with CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings, see
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    The fix is to open files for writing in exclusive mode (i.e., fail
    if the file exists including if it is a symbolic link).
  * oathtool: Fix test suite on 32-bit big-endian platforms.
  * libpskc: Don’t call deprecated xmlMemoryDump.
  * Various build fixes including updated gnulib files.
- Drop not longer needed patches (fixed upstream):
  * 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  * 42-null_usersfile_okay.patch
- Use %ldconfig_scriptlets macro.</changelog>
</package>
<package pkgid="66f6cfb54e8d3ef19fcaba9f175a25ce9ac98f2693c1b1fe93eee0b4bb68ece846eb648e0483935a9ff91a57a0bcde0a441cef4c7d76038acfe4bdcbf270bc41" name="libsha1detectcoll-devel" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="20.21"/>
  <changelog author="astieger@suse.com" date="1488283200">- CLI to check for SHA-1 collisions bsc#1026646 - CVE-2005-4900
- initial package (cli only)</changelog>
  <changelog author="astieger@suse.com" date="1491825600">- update to 1.0.3:
  * SIMD code removed
  * performance improvements
- package library
- conflicts with libmd-devel</changelog>
  <changelog author="astieger@suse.com" date="1495454400">- better printing of errors, and allow hashing stdin
  add sha1collisiondetection-1.0.3-io-fixes.patch</changelog>
  <changelog author="tiwai@suse.de" date="1501848000">- Fix include header path to /usr/include/sha1dc/sha1.h as supposed
  by upstream installation
- Remove conflicts with libmd-devel, as we changed the header path</changelog>
  <changelog author="ro@suse.de" date="1517400000">- add sha1collisiondetection-endian_detection.patch
  fix detection of endianness at compile time</changelog>
  <changelog author="ro@suse.de" date="1517400001">- cleaner solution for the endian detection issue:
  include the proper header file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="38a7ccc9280ec3c7639ca135e9b83a4247c258a14492a6e35460f7e0222b3fe92816fccc77c2bd614949b0f75cf1f0ffd5e2bf9716dfec964953da3075cdef5f" name="libsha1detectcoll1" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="20.21"/>
  <changelog author="astieger@suse.com" date="1488283200">- CLI to check for SHA-1 collisions bsc#1026646 - CVE-2005-4900
- initial package (cli only)</changelog>
  <changelog author="astieger@suse.com" date="1491825600">- update to 1.0.3:
  * SIMD code removed
  * performance improvements
- package library
- conflicts with libmd-devel</changelog>
  <changelog author="astieger@suse.com" date="1495454400">- better printing of errors, and allow hashing stdin
  add sha1collisiondetection-1.0.3-io-fixes.patch</changelog>
  <changelog author="tiwai@suse.de" date="1501848000">- Fix include header path to /usr/include/sha1dc/sha1.h as supposed
  by upstream installation
- Remove conflicts with libmd-devel, as we changed the header path</changelog>
  <changelog author="ro@suse.de" date="1517400000">- add sha1collisiondetection-endian_detection.patch
  fix detection of endianness at compile time</changelog>
  <changelog author="ro@suse.de" date="1517400001">- cleaner solution for the endian detection issue:
  include the proper header file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="48200bd9c208b36dc4a04f51df1b0795afa377bee7516afcb761e282e187fb41644ae5e2e5dd86527c10199a043b771f6445694641f342f61cac55fce691c310" name="libsha1detectcoll1-debuginfo" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="20.21"/>
  <changelog author="astieger@suse.com" date="1488283200">- CLI to check for SHA-1 collisions bsc#1026646 - CVE-2005-4900
- initial package (cli only)</changelog>
  <changelog author="astieger@suse.com" date="1491825600">- update to 1.0.3:
  * SIMD code removed
  * performance improvements
- package library
- conflicts with libmd-devel</changelog>
  <changelog author="astieger@suse.com" date="1495454400">- better printing of errors, and allow hashing stdin
  add sha1collisiondetection-1.0.3-io-fixes.patch</changelog>
  <changelog author="tiwai@suse.de" date="1501848000">- Fix include header path to /usr/include/sha1dc/sha1.h as supposed
  by upstream installation
- Remove conflicts with libmd-devel, as we changed the header path</changelog>
  <changelog author="ro@suse.de" date="1517400000">- add sha1collisiondetection-endian_detection.patch
  fix detection of endianness at compile time</changelog>
  <changelog author="ro@suse.de" date="1517400001">- cleaner solution for the endian detection issue:
  include the proper header file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="74299df5ccabc9f6e36976edaf75fd3587d58dee394d0a85cd5064fefa622faa135cbf06b860ccd26c96e16e9b0aa357d516aed99d0439fd86cd71d93cfffef0" name="libstoken1" arch="s390x">
  <version epoch="0" ver="0.93" rel="18.29"/>
  <changelog author="rel-eng@lists.fedoraproject.org" date="1402228800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild</changelog>
  <changelog author="negativo17@gmail.com" date="1403524800">- Update to 0.6.</changelog>
  <changelog author="darin@darins.net" date="1403784000">- Initial inclusion in openSUSE
  * Ported .spec from Fedora</changelog>
  <changelog author="darin@darins.net" date="1403784001">- fix requires</changelog>
  <changelog author="darin@darins.net" date="1404388800">- set deps to libtomcrypt0 which is the correct package name</changelog>
  <changelog author="darin@darins.net" date="1404388801">- fix libtomcrypt dep due to rename</changelog>
  <changelog author="darin@darins.net" date="1405425600">- define BuildRoot
- add Group for all packages
- add --disable-static to %configure</changelog>
  <changelog author="p.drouand@gmail.com" date="1427371200">- Update to version 0.81
  * Fix "make check" failures in GMT+xx timezones (xx &gt;= 1)
- Changes from version 0.8
  * Update GUI from GTK+2 to GTK+3; use glade to define the layouts
  * Add next tokencode and other information to the full GUI (stoken-gui).
    The "stoken-gui --small" layout is unchanged.
  * Add a list of known GUIDs used to bind tokens to specific device classes
    (i.e. tokens can be bound to "any BlackBerry 10").  stoken will now try
    each one of these IDs when importing a new bound token.
  * Add new --qr and --show-qr export options to make it easy to pass tokens
    to a mobile device
  * Add "stoken --next" option to show the next tokencode
  * Support using nettle+gmp as an alternative to libtomcrypt
  * Generate valid TKNTrailer BatchSignature sections in .sdtid output files,
    allowing use with RSA's official TokenConverter utility
  * Fix parsing of RSA-supplied hard token seed files
  * Add "make check" and several test cases
  * Fix build errors on Mac OSX, enable OSX Travis builds, and submit a
    Homebrew formula
  * Fix build errors when using uClibc instead of glibc
  * Add experimental Windows build using MinGW (see README for instructions)
  * Relicense the JNI wrapper (BSD-3-clause) so that it is easier to incorporate
    into non-free Android apps
  * Various fixes for minor bugs, memory leaks, etc.
- Replace pkgconfig(gtk+-2.0) require with pkgconfig(gtk+-3.0);
  follow upstream changes
- Fix license to LGPL-2.0+ and BSD-3-Clause; upstream has relicensed
  the JNI wrapper
- Add pkgconfig(nettle) require; new upstream dependency
- Add CHANGES and TODO to copied documentation list</changelog>
  <changelog author="tchvatal@suse.com" date="1533729600">- Version update to 0.92:
  * Fix build with new libtomcrypt
  * support nette 3.x series
  * See CHANGES for details</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1695643200">- Version update to 0.93:
  * upstream moved to github
  * Drop support for versions of nettle older than 2014
  * Further v4 token work
  * fixes in README
  * Add --both option to print current and next token
  * Support for v4 token decode
  * Remove bashisms (Alon Bar-Lev)</changelog>
</package>
<package pkgid="113d33ef92d2453400e1b691fd181e8963d9fb6cb6c0a1268177d01aacc58ce29ece46938db0a0757b727e9b8ac9709235c0103431c5e00f0d773dcc2d6013f6" name="libstoken1-debuginfo" arch="s390x">
  <version epoch="0" ver="0.93" rel="18.29"/>
  <changelog author="rel-eng@lists.fedoraproject.org" date="1402228800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild</changelog>
  <changelog author="negativo17@gmail.com" date="1403524800">- Update to 0.6.</changelog>
  <changelog author="darin@darins.net" date="1403784000">- Initial inclusion in openSUSE
  * Ported .spec from Fedora</changelog>
  <changelog author="darin@darins.net" date="1403784001">- fix requires</changelog>
  <changelog author="darin@darins.net" date="1404388800">- set deps to libtomcrypt0 which is the correct package name</changelog>
  <changelog author="darin@darins.net" date="1404388801">- fix libtomcrypt dep due to rename</changelog>
  <changelog author="darin@darins.net" date="1405425600">- define BuildRoot
- add Group for all packages
- add --disable-static to %configure</changelog>
  <changelog author="p.drouand@gmail.com" date="1427371200">- Update to version 0.81
  * Fix "make check" failures in GMT+xx timezones (xx &gt;= 1)
- Changes from version 0.8
  * Update GUI from GTK+2 to GTK+3; use glade to define the layouts
  * Add next tokencode and other information to the full GUI (stoken-gui).
    The "stoken-gui --small" layout is unchanged.
  * Add a list of known GUIDs used to bind tokens to specific device classes
    (i.e. tokens can be bound to "any BlackBerry 10").  stoken will now try
    each one of these IDs when importing a new bound token.
  * Add new --qr and --show-qr export options to make it easy to pass tokens
    to a mobile device
  * Add "stoken --next" option to show the next tokencode
  * Support using nettle+gmp as an alternative to libtomcrypt
  * Generate valid TKNTrailer BatchSignature sections in .sdtid output files,
    allowing use with RSA's official TokenConverter utility
  * Fix parsing of RSA-supplied hard token seed files
  * Add "make check" and several test cases
  * Fix build errors on Mac OSX, enable OSX Travis builds, and submit a
    Homebrew formula
  * Fix build errors when using uClibc instead of glibc
  * Add experimental Windows build using MinGW (see README for instructions)
  * Relicense the JNI wrapper (BSD-3-clause) so that it is easier to incorporate
    into non-free Android apps
  * Various fixes for minor bugs, memory leaks, etc.
- Replace pkgconfig(gtk+-2.0) require with pkgconfig(gtk+-3.0);
  follow upstream changes
- Fix license to LGPL-2.0+ and BSD-3-Clause; upstream has relicensed
  the JNI wrapper
- Add pkgconfig(nettle) require; new upstream dependency
- Add CHANGES and TODO to copied documentation list</changelog>
  <changelog author="tchvatal@suse.com" date="1533729600">- Version update to 0.92:
  * Fix build with new libtomcrypt
  * support nette 3.x series
  * See CHANGES for details</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1695643200">- Version update to 0.93:
  * upstream moved to github
  * Drop support for versions of nettle older than 2014
  * Further v4 token work
  * fixes in README
  * Add --both option to print current and next token
  * Support for v4 token decode
  * Remove bashisms (Alon Bar-Lev)</changelog>
</package>
<package pkgid="c50e53c83a293051843b6df87ffa85e63c6b53a3e8456e844c1cfd74b9675b07f88a1cea36973c066f3886f3aee00148162fcb01bea1eeba8c8e19db4ff24ee8" name="libtomcrypt" arch="src">
  <version epoch="0" ver="1.18.2" rel="27.49"/>
  <changelog author="alexandre@exatati.com.br" date="1281614400">- Spec file cleaned with spec-cleaner.</changelog>
  <changelog author="jengelh@medozas.de" date="1328011200">- Remove redundant tags/sections per specfile guideline suggestions
- Parallel building using %_smp_mflags
- Add libtool as BuildRequires for factory/12.2</changelog>
  <changelog author="darin@darins.net" date="1404388800">- rename to libtomcrypt.{spec,changes} and the patch,
  there's not osc move|copy so I just cp'd them.
- update packaging for share-lib policy
- fix license</changelog>
  <changelog author="darin@darins.net" date="1404388801">- add group to libtomcrypt0 package</changelog>
  <changelog author="darin@darins.net" date="1404388802">- fix requires due to rename</changelog>
  <changelog author="darin@darins.net" date="1405080000">- do not package libtool archives</changelog>
  <changelog author="darin@darins.net" date="1405425600">- cleaned up with spec-cleaner
- examples now require the devel package</changelog>
  <changelog author="mpluskal@suse.com" date="1455278400">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner
- Do not include build date/time</changelog>
  <changelog author="bwiedemann@suse.com" date="1496059200">- Add reproducible.patch to sort input files to make build reproducible
  (boo#1041090)</changelog>
  <changelog author="darin@darins.net" date="1499860800">- udpate to version 1.18.0
- removed up upstream patches</changelog>
  <changelog author="darin@darins.net" date="1529668800">- v1.18.1
  - Fix wrong SHA3 blocksizes, thanks to Claus Fischer for reporting this via Mail (PR #329)
  - Fix NULL-pointer dereference in `ccm_memory()` with LTC_CLEAN_STACK enabled (PR #327)
  - Fix `ccm_process()` being unable to process input buffers longer than 256 bytes (PR #326)
  - Fix the `register_all_{ciphers,hashes,prngs}()` return values (PR #316)
  - Fix some typos, warnings and duplicate prototypes in code &amp; doc (PR's #310 #320 #321 #335)
  - Fix possible undefined behavior with LTC_PTHREAD (PR #337)
  - Fix some DER bugs (PR #339)
  - Fix CTR-mode when accelerator is used (OP-TEE/optee_os #2086)
  - Fix installation procedure (Issue #340)</changelog>
  <changelog author="darin@darins.net" date="1530532800">- v1.18.2
  - Fix Side Channel Based ECDSA Key Extraction (CVE-2018-12437) (PR #408)
  - Fix potential stack overflow when DER flexi-decoding (CVE-2018-0739) (PR #373)
  - Fix two-key 3DES (PR #390)
  - Fix accelerated CTR mode (PR #359)
  - Fix Fortuna PRNG (PR #363)
  - Fix compilation on platforms where cc doesn't point to gcc (PR #382)
  - Fix using the wrong environment variable LT instead of LIBTOOL (PR #392)
  - Fix build on platforms where the compiler provides __WCHAR_MAX__ but wchar.h is not available (PR #390)
  - Fix &amp; re-factor crypt_list_all_sizes() and crypt_list_all_constants() (PR #414)
  - Minor fixes (PR's #350 #351 #375 #377 #378 #379)
  `
- Added libtommath-devl build requirement
- Added baselibs.conf</changelog>
  <changelog author="meissner@suse.com" date="1531396800">- libtomcrypt.keyring: added key of new release manager 0xAF0CB17621EDAD72
- libtomcrypt-makefile.shared.patch: dropped
- reproducible.patch: dropped</changelog>
  <changelog author="jengelh@inai.de" date="1532606400">- Fix RPM groups.
- Don't pipe find, use the safer -exec.</changelog>
  <changelog author="jengelh@inai.de" date="1533729600">- Expand summary of libtomcrypt1.
- Use %make_install.</changelog>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1569240000">- Remove texlive BuildRequires, as the documentation is not built
- Drop manual __DATE__/__TIME__ mangling, SOURCE_DATE_EPOCH is
  respected by GCC for more than 3 years.
- Use license macro</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1679140800">- Modernise spec file
- Run tests during build</changelog>
</package>
<package pkgid="6730b2906326a387d380d51a8d21126cbfd93d1a813911838c6d583558e9824cfcb9af273b8917c8200e6a80bb296db9374f0bd6d3dbf1decd708ff2e61c21dd" name="libtomcrypt-debugsource" arch="s390x">
  <version epoch="0" ver="1.18.2" rel="27.49"/>
  <changelog author="mpluskal@suse.com" date="1455278400">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner
- Do not include build date/time</changelog>
  <changelog author="bwiedemann@suse.com" date="1496059200">- Add reproducible.patch to sort input files to make build reproducible
  (boo#1041090)</changelog>
  <changelog author="darin@darins.net" date="1499860800">- udpate to version 1.18.0
- removed up upstream patches</changelog>
  <changelog author="darin@darins.net" date="1529668800">- v1.18.1
  - Fix wrong SHA3 blocksizes, thanks to Claus Fischer for reporting this via Mail (PR #329)
  - Fix NULL-pointer dereference in `ccm_memory()` with LTC_CLEAN_STACK enabled (PR #327)
  - Fix `ccm_process()` being unable to process input buffers longer than 256 bytes (PR #326)
  - Fix the `register_all_{ciphers,hashes,prngs}()` return values (PR #316)
  - Fix some typos, warnings and duplicate prototypes in code &amp; doc (PR's #310 #320 #321 #335)
  - Fix possible undefined behavior with LTC_PTHREAD (PR #337)
  - Fix some DER bugs (PR #339)
  - Fix CTR-mode when accelerator is used (OP-TEE/optee_os #2086)
  - Fix installation procedure (Issue #340)</changelog>
  <changelog author="darin@darins.net" date="1530532800">- v1.18.2
  - Fix Side Channel Based ECDSA Key Extraction (CVE-2018-12437) (PR #408)
  - Fix potential stack overflow when DER flexi-decoding (CVE-2018-0739) (PR #373)
  - Fix two-key 3DES (PR #390)
  - Fix accelerated CTR mode (PR #359)
  - Fix Fortuna PRNG (PR #363)
  - Fix compilation on platforms where cc doesn't point to gcc (PR #382)
  - Fix using the wrong environment variable LT instead of LIBTOOL (PR #392)
  - Fix build on platforms where the compiler provides __WCHAR_MAX__ but wchar.h is not available (PR #390)
  - Fix &amp; re-factor crypt_list_all_sizes() and crypt_list_all_constants() (PR #414)
  - Minor fixes (PR's #350 #351 #375 #377 #378 #379)
  `
- Added libtommath-devl build requirement
- Added baselibs.conf</changelog>
  <changelog author="meissner@suse.com" date="1531396800">- libtomcrypt.keyring: added key of new release manager 0xAF0CB17621EDAD72
- libtomcrypt-makefile.shared.patch: dropped
- reproducible.patch: dropped</changelog>
  <changelog author="jengelh@inai.de" date="1532606400">- Fix RPM groups.
- Don't pipe find, use the safer -exec.</changelog>
  <changelog author="jengelh@inai.de" date="1533729600">- Expand summary of libtomcrypt1.
- Use %make_install.</changelog>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1569240000">- Remove texlive BuildRequires, as the documentation is not built
- Drop manual __DATE__/__TIME__ mangling, SOURCE_DATE_EPOCH is
  respected by GCC for more than 3 years.
- Use license macro</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1679140800">- Modernise spec file
- Run tests during build</changelog>
</package>
<package pkgid="f8e330ae4046f6280fa9ffe8a46bdf56e4c950ae2894bb12c9e47b770001d2c5dca529457492ee01da5f7d0788724f3227aa2391999a62fb7d0d3ea1d99e84c8" name="libtomcrypt-devel" arch="s390x">
  <version epoch="0" ver="1.18.2" rel="27.49"/>
  <changelog author="mpluskal@suse.com" date="1455278400">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner
- Do not include build date/time</changelog>
  <changelog author="bwiedemann@suse.com" date="1496059200">- Add reproducible.patch to sort input files to make build reproducible
  (boo#1041090)</changelog>
  <changelog author="darin@darins.net" date="1499860800">- udpate to version 1.18.0
- removed up upstream patches</changelog>
  <changelog author="darin@darins.net" date="1529668800">- v1.18.1
  - Fix wrong SHA3 blocksizes, thanks to Claus Fischer for reporting this via Mail (PR #329)
  - Fix NULL-pointer dereference in `ccm_memory()` with LTC_CLEAN_STACK enabled (PR #327)
  - Fix `ccm_process()` being unable to process input buffers longer than 256 bytes (PR #326)
  - Fix the `register_all_{ciphers,hashes,prngs}()` return values (PR #316)
  - Fix some typos, warnings and duplicate prototypes in code &amp; doc (PR's #310 #320 #321 #335)
  - Fix possible undefined behavior with LTC_PTHREAD (PR #337)
  - Fix some DER bugs (PR #339)
  - Fix CTR-mode when accelerator is used (OP-TEE/optee_os #2086)
  - Fix installation procedure (Issue #340)</changelog>
  <changelog author="darin@darins.net" date="1530532800">- v1.18.2
  - Fix Side Channel Based ECDSA Key Extraction (CVE-2018-12437) (PR #408)
  - Fix potential stack overflow when DER flexi-decoding (CVE-2018-0739) (PR #373)
  - Fix two-key 3DES (PR #390)
  - Fix accelerated CTR mode (PR #359)
  - Fix Fortuna PRNG (PR #363)
  - Fix compilation on platforms where cc doesn't point to gcc (PR #382)
  - Fix using the wrong environment variable LT instead of LIBTOOL (PR #392)
  - Fix build on platforms where the compiler provides __WCHAR_MAX__ but wchar.h is not available (PR #390)
  - Fix &amp; re-factor crypt_list_all_sizes() and crypt_list_all_constants() (PR #414)
  - Minor fixes (PR's #350 #351 #375 #377 #378 #379)
  `
- Added libtommath-devl build requirement
- Added baselibs.conf</changelog>
  <changelog author="meissner@suse.com" date="1531396800">- libtomcrypt.keyring: added key of new release manager 0xAF0CB17621EDAD72
- libtomcrypt-makefile.shared.patch: dropped
- reproducible.patch: dropped</changelog>
  <changelog author="jengelh@inai.de" date="1532606400">- Fix RPM groups.
- Don't pipe find, use the safer -exec.</changelog>
  <changelog author="jengelh@inai.de" date="1533729600">- Expand summary of libtomcrypt1.
- Use %make_install.</changelog>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1569240000">- Remove texlive BuildRequires, as the documentation is not built
- Drop manual __DATE__/__TIME__ mangling, SOURCE_DATE_EPOCH is
  respected by GCC for more than 3 years.
- Use license macro</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1679140800">- Modernise spec file
- Run tests during build</changelog>
</package>
<package pkgid="9cfef52f93cbaf658ba1ec0f35ec701379e78242ed331669148b90ee8422ab243bd4e567b29f0b1470527ccf596e339b6b2ac5e20095c31da295c3bc836a3f44" name="libtomcrypt-examples" arch="s390x">
  <version epoch="0" ver="1.18.2" rel="27.49"/>
  <changelog author="mpluskal@suse.com" date="1455278400">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner
- Do not include build date/time</changelog>
  <changelog author="bwiedemann@suse.com" date="1496059200">- Add reproducible.patch to sort input files to make build reproducible
  (boo#1041090)</changelog>
  <changelog author="darin@darins.net" date="1499860800">- udpate to version 1.18.0
- removed up upstream patches</changelog>
  <changelog author="darin@darins.net" date="1529668800">- v1.18.1
  - Fix wrong SHA3 blocksizes, thanks to Claus Fischer for reporting this via Mail (PR #329)
  - Fix NULL-pointer dereference in `ccm_memory()` with LTC_CLEAN_STACK enabled (PR #327)
  - Fix `ccm_process()` being unable to process input buffers longer than 256 bytes (PR #326)
  - Fix the `register_all_{ciphers,hashes,prngs}()` return values (PR #316)
  - Fix some typos, warnings and duplicate prototypes in code &amp; doc (PR's #310 #320 #321 #335)
  - Fix possible undefined behavior with LTC_PTHREAD (PR #337)
  - Fix some DER bugs (PR #339)
  - Fix CTR-mode when accelerator is used (OP-TEE/optee_os #2086)
  - Fix installation procedure (Issue #340)</changelog>
  <changelog author="darin@darins.net" date="1530532800">- v1.18.2
  - Fix Side Channel Based ECDSA Key Extraction (CVE-2018-12437) (PR #408)
  - Fix potential stack overflow when DER flexi-decoding (CVE-2018-0739) (PR #373)
  - Fix two-key 3DES (PR #390)
  - Fix accelerated CTR mode (PR #359)
  - Fix Fortuna PRNG (PR #363)
  - Fix compilation on platforms where cc doesn't point to gcc (PR #382)
  - Fix using the wrong environment variable LT instead of LIBTOOL (PR #392)
  - Fix build on platforms where the compiler provides __WCHAR_MAX__ but wchar.h is not available (PR #390)
  - Fix &amp; re-factor crypt_list_all_sizes() and crypt_list_all_constants() (PR #414)
  - Minor fixes (PR's #350 #351 #375 #377 #378 #379)
  `
- Added libtommath-devl build requirement
- Added baselibs.conf</changelog>
  <changelog author="meissner@suse.com" date="1531396800">- libtomcrypt.keyring: added key of new release manager 0xAF0CB17621EDAD72
- libtomcrypt-makefile.shared.patch: dropped
- reproducible.patch: dropped</changelog>
  <changelog author="jengelh@inai.de" date="1532606400">- Fix RPM groups.
- Don't pipe find, use the safer -exec.</changelog>
  <changelog author="jengelh@inai.de" date="1533729600">- Expand summary of libtomcrypt1.
- Use %make_install.</changelog>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1569240000">- Remove texlive BuildRequires, as the documentation is not built
- Drop manual __DATE__/__TIME__ mangling, SOURCE_DATE_EPOCH is
  respected by GCC for more than 3 years.
- Use license macro</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1679140800">- Modernise spec file
- Run tests during build</changelog>
</package>
<package pkgid="469d02d41330b5ff8f70d022364a28a6cde4a8f79f151c20ad693e9217a41bfde0782f4f132f1793f6631e525edafb6a4befc0c912f7480ea20acb1a419d2d6e" name="libtomcrypt1" arch="s390x">
  <version epoch="0" ver="1.18.2" rel="27.49"/>
  <changelog author="mpluskal@suse.com" date="1455278400">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner
- Do not include build date/time</changelog>
  <changelog author="bwiedemann@suse.com" date="1496059200">- Add reproducible.patch to sort input files to make build reproducible
  (boo#1041090)</changelog>
  <changelog author="darin@darins.net" date="1499860800">- udpate to version 1.18.0
- removed up upstream patches</changelog>
  <changelog author="darin@darins.net" date="1529668800">- v1.18.1
  - Fix wrong SHA3 blocksizes, thanks to Claus Fischer for reporting this via Mail (PR #329)
  - Fix NULL-pointer dereference in `ccm_memory()` with LTC_CLEAN_STACK enabled (PR #327)
  - Fix `ccm_process()` being unable to process input buffers longer than 256 bytes (PR #326)
  - Fix the `register_all_{ciphers,hashes,prngs}()` return values (PR #316)
  - Fix some typos, warnings and duplicate prototypes in code &amp; doc (PR's #310 #320 #321 #335)
  - Fix possible undefined behavior with LTC_PTHREAD (PR #337)
  - Fix some DER bugs (PR #339)
  - Fix CTR-mode when accelerator is used (OP-TEE/optee_os #2086)
  - Fix installation procedure (Issue #340)</changelog>
  <changelog author="darin@darins.net" date="1530532800">- v1.18.2
  - Fix Side Channel Based ECDSA Key Extraction (CVE-2018-12437) (PR #408)
  - Fix potential stack overflow when DER flexi-decoding (CVE-2018-0739) (PR #373)
  - Fix two-key 3DES (PR #390)
  - Fix accelerated CTR mode (PR #359)
  - Fix Fortuna PRNG (PR #363)
  - Fix compilation on platforms where cc doesn't point to gcc (PR #382)
  - Fix using the wrong environment variable LT instead of LIBTOOL (PR #392)
  - Fix build on platforms where the compiler provides __WCHAR_MAX__ but wchar.h is not available (PR #390)
  - Fix &amp; re-factor crypt_list_all_sizes() and crypt_list_all_constants() (PR #414)
  - Minor fixes (PR's #350 #351 #375 #377 #378 #379)
  `
- Added libtommath-devl build requirement
- Added baselibs.conf</changelog>
  <changelog author="meissner@suse.com" date="1531396800">- libtomcrypt.keyring: added key of new release manager 0xAF0CB17621EDAD72
- libtomcrypt-makefile.shared.patch: dropped
- reproducible.patch: dropped</changelog>
  <changelog author="jengelh@inai.de" date="1532606400">- Fix RPM groups.
- Don't pipe find, use the safer -exec.</changelog>
  <changelog author="jengelh@inai.de" date="1533729600">- Expand summary of libtomcrypt1.
- Use %make_install.</changelog>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1569240000">- Remove texlive BuildRequires, as the documentation is not built
- Drop manual __DATE__/__TIME__ mangling, SOURCE_DATE_EPOCH is
  respected by GCC for more than 3 years.
- Use license macro</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1679140800">- Modernise spec file
- Run tests during build</changelog>
</package>
<package pkgid="c190ce3e38ea8346bd7a89e4620f8ca1394394799d8795cb6e91e4271055cb21ade195b5d7781585a9397e9905a715e7f3ea64fa97a464768ecb819b9239102c" name="libtomcrypt1-debuginfo" arch="s390x">
  <version epoch="0" ver="1.18.2" rel="27.49"/>
  <changelog author="mpluskal@suse.com" date="1455278400">- Use url for source
- Add gpg signature
- Cleanup spec file with spec-cleaner
- Do not include build date/time</changelog>
  <changelog author="bwiedemann@suse.com" date="1496059200">- Add reproducible.patch to sort input files to make build reproducible
  (boo#1041090)</changelog>
  <changelog author="darin@darins.net" date="1499860800">- udpate to version 1.18.0
- removed up upstream patches</changelog>
  <changelog author="darin@darins.net" date="1529668800">- v1.18.1
  - Fix wrong SHA3 blocksizes, thanks to Claus Fischer for reporting this via Mail (PR #329)
  - Fix NULL-pointer dereference in `ccm_memory()` with LTC_CLEAN_STACK enabled (PR #327)
  - Fix `ccm_process()` being unable to process input buffers longer than 256 bytes (PR #326)
  - Fix the `register_all_{ciphers,hashes,prngs}()` return values (PR #316)
  - Fix some typos, warnings and duplicate prototypes in code &amp; doc (PR's #310 #320 #321 #335)
  - Fix possible undefined behavior with LTC_PTHREAD (PR #337)
  - Fix some DER bugs (PR #339)
  - Fix CTR-mode when accelerator is used (OP-TEE/optee_os #2086)
  - Fix installation procedure (Issue #340)</changelog>
  <changelog author="darin@darins.net" date="1530532800">- v1.18.2
  - Fix Side Channel Based ECDSA Key Extraction (CVE-2018-12437) (PR #408)
  - Fix potential stack overflow when DER flexi-decoding (CVE-2018-0739) (PR #373)
  - Fix two-key 3DES (PR #390)
  - Fix accelerated CTR mode (PR #359)
  - Fix Fortuna PRNG (PR #363)
  - Fix compilation on platforms where cc doesn't point to gcc (PR #382)
  - Fix using the wrong environment variable LT instead of LIBTOOL (PR #392)
  - Fix build on platforms where the compiler provides __WCHAR_MAX__ but wchar.h is not available (PR #390)
  - Fix &amp; re-factor crypt_list_all_sizes() and crypt_list_all_constants() (PR #414)
  - Minor fixes (PR's #350 #351 #375 #377 #378 #379)
  `
- Added libtommath-devl build requirement
- Added baselibs.conf</changelog>
  <changelog author="meissner@suse.com" date="1531396800">- libtomcrypt.keyring: added key of new release manager 0xAF0CB17621EDAD72
- libtomcrypt-makefile.shared.patch: dropped
- reproducible.patch: dropped</changelog>
  <changelog author="jengelh@inai.de" date="1532606400">- Fix RPM groups.
- Don't pipe find, use the safer -exec.</changelog>
  <changelog author="jengelh@inai.de" date="1533729600">- Expand summary of libtomcrypt1.
- Use %make_install.</changelog>
  <changelog author="Stefan Br&#xFC;ns &lt;stefan.bruens@rwth-aachen.de&gt;" date="1569240000">- Remove texlive BuildRequires, as the documentation is not built
- Drop manual __DATE__/__TIME__ mangling, SOURCE_DATE_EPOCH is
  respected by GCC for more than 3 years.
- Use license macro</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1679140800">- Modernise spec file
- Run tests during build</changelog>
</package>
<package pkgid="6ad9b6729059f3533c62d036a5b7b9a94334b808d7ca6d42647d4dcf9936dfba6a2c271d74e6cbbc5dd594eac40b5d2d663fd6edf8e5934f14a1c302f4e639e4" name="libtpm2-totp0" arch="s390x">
  <version epoch="0" ver="20240326.33e1986" rel="13.1"/>
  <changelog author="Dominik Heidler &lt;dheidler@suse.de&gt;" date="1749211200">- Initial checkin</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1749816000">- Do not (ever) use Epoch; it has devestating effects on version
  comparisons. As Epoch was set to 1, removing indicates a
  downgrade for installations, but better bite the bullet than keep
  it.</changelog>
</package>
<package pkgid="ce0b81ef8d5ea28f0bc09f0e268c8443d6e53ec508e2c6bf9b1617c1b246d253db81f7c430350447f70b268490a637ceba293ba27250820943880457785d0605" name="libtpm2-totp0-debuginfo" arch="s390x">
  <version epoch="0" ver="20240326.33e1986" rel="13.1"/>
  <changelog author="Dominik Heidler &lt;dheidler@suse.de&gt;" date="1749211200">- Initial checkin</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1749816000">- Do not (ever) use Epoch; it has devestating effects on version
  comparisons. As Epoch was set to 1, removing indicates a
  downgrade for installations, but better bite the bullet than keep
  it.</changelog>
</package>
<package pkgid="572e0bef3920f0cd3187ff1961be641ba922dd23519903862f38acb1c65e5531a466cf031d13557b815ee7e5143a6799d13b3e785e871431cbe4219e703ee9a7" name="libtpm2-totp0-devel" arch="s390x">
  <version epoch="0" ver="20240326.33e1986" rel="13.1"/>
  <changelog author="Dominik Heidler &lt;dheidler@suse.de&gt;" date="1749211200">- Initial checkin</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1749816000">- Do not (ever) use Epoch; it has devestating effects on version
  comparisons. As Epoch was set to 1, removing indicates a
  downgrade for installations, but better bite the bullet than keep
  it.</changelog>
</package>
<package pkgid="29f6da8768978516524c99688594c99d6b9d959556e48cb1ae2b8e6449a4c0246e083a3e8826f67eb96fd93c73c1218e6e70be7cef8d439d25d5aa94d660eede" name="libtpm_unseal1" arch="s390x">
  <version epoch="0" ver="1.3.9.2" rel="54.42"/>
  <changelog author="meissner@suse.com" date="1339502400">- Updated to 1.3.8
  - bugfixes
  - pcr/nvram sealing options</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1412251200">- Remove a number of unused build requires, probably copy/paste
  error, never used.</changelog>
  <changelog author="mpluskal@suse.com" date="1427976000">- Cleanup spec file with spec-cleaner
- Remove tpm-tools-rpmlintrc
- Use automake and autoconf as recomended by upstream
- Split library, devel adn pkcs11 package</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1434715200">- Do not use -Werror.</changelog>
  <changelog author="mailaender@opensuse.org" date="1483272000">- Update to version 1.3.9</changelog>
  <changelog author="meissner@suse.com" date="1488369600">- updated to 1.3.9.1 (FATE#321450)
  - bugfixes after openssl 1.1 porting</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1510228800">- 0001-Fix-build-against-OpenSSL-1.1.0.patch: fix openssl 1.1.0 build in the
  P11 code. Upstream has not reacted to a pull request to fix this for some
  months now. This is my own patch (that doesn't violate C89 declaration rules
  and is backward compatible to openssl. 1.0.x)).
  For comparison see: https://sourceforge.net/p/trousers/tpm-tools/merge-requests/2/</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- upgrade to minor version 1.3.9.2:
  - upstream now provide openssl 1.1 compatibility on their own
- dropped 0001-Fix-build-against-OpenSSL-1.1.0.patch since the tarbal is now
  compatible.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- fix undefined and binary data being output in the tpm_version command
  (bsc#1114793)
  - add 0001-tpm_version-avoid-outputting-NULL-bytes-from-tpmVend.patch
  - add 0001-tpm_version-avoid-outputting-undefined-data-on-stder.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed source url to https</changelog>
</package>
<package pkgid="889218f8b05a375f171850f942b10d9f82229590a3e2675283c9f01a4d68fca3d683bad170ee1a476aa424206cd836de4041dbbb49046b6b5a164ff06977d4c5" name="libtpm_unseal1-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3.9.2" rel="54.42"/>
  <changelog author="meissner@suse.com" date="1339502400">- Updated to 1.3.8
  - bugfixes
  - pcr/nvram sealing options</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1412251200">- Remove a number of unused build requires, probably copy/paste
  error, never used.</changelog>
  <changelog author="mpluskal@suse.com" date="1427976000">- Cleanup spec file with spec-cleaner
- Remove tpm-tools-rpmlintrc
- Use automake and autoconf as recomended by upstream
- Split library, devel adn pkcs11 package</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1434715200">- Do not use -Werror.</changelog>
  <changelog author="mailaender@opensuse.org" date="1483272000">- Update to version 1.3.9</changelog>
  <changelog author="meissner@suse.com" date="1488369600">- updated to 1.3.9.1 (FATE#321450)
  - bugfixes after openssl 1.1 porting</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1510228800">- 0001-Fix-build-against-OpenSSL-1.1.0.patch: fix openssl 1.1.0 build in the
  P11 code. Upstream has not reacted to a pull request to fix this for some
  months now. This is my own patch (that doesn't violate C89 declaration rules
  and is backward compatible to openssl. 1.0.x)).
  For comparison see: https://sourceforge.net/p/trousers/tpm-tools/merge-requests/2/</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- upgrade to minor version 1.3.9.2:
  - upstream now provide openssl 1.1 compatibility on their own
- dropped 0001-Fix-build-against-OpenSSL-1.1.0.patch since the tarbal is now
  compatible.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- fix undefined and binary data being output in the tpm_version command
  (bsc#1114793)
  - add 0001-tpm_version-avoid-outputting-NULL-bytes-from-tpmVend.patch
  - add 0001-tpm_version-avoid-outputting-undefined-data-on-stder.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed source url to https</changelog>
</package>
<package pkgid="817335089e856a50fc78975ef32976ec297b2dadc6d0f46c8be7ad50ffaaafbea954dde1d02eaf540fe7c1e5a280ae0ad7041757fc7fd25233223419bcc3dd2f" name="libtpms" arch="src">
  <version epoch="0" ver="0.10.2" rel="59.8"/>
  <changelog author="p.drouand@gmail.com" date="1426939200">- Update to version 0.5.2
  * No entry for this release
- Update project home and download Urls
- Add autoconf, automake and libtool build require; the tarball
  comes from git and configure script has to be generated</changelog>
  <changelog author="vcizek@suse.com" date="1516190400">- Update to version 0.6.0-dev1
  * no upstream changelog
  * fix build with openssl 1.1 (bsc#1074801)
- fix rpm group</changelog>
  <changelog author="Gary Ching-Pang Lin &lt;glin@suse.com&gt;" date="1548676800">- Update to version 0.6.0
  * Introduce TPM2 support
- Use %license tag for LICENSE</changelog>
  <changelog author="Gary Ching-Pang Lin &lt;glin@suse.com&gt;" date="1567684800">- Update to version 0.7.0
  * fixes for TPM2
- Add gcc-c++ to BuildRequires</changelog>
  <changelog author="Kai Liu &lt;kai.liu@suse.com&gt;" date="1595505600">- Update to version 0.7.3
  * Fixed the set of PCRs belonging to the TCB group. This affects
    the pcrUpdateCounter in TPM2_Pcrread() responses, thus needs
    latest `swtpm` (master, stable branches) for test cases to
    succeed there.
- Changes since version 0.7.2
  * Fix output buffer parameter and size for RSA decryption that
    could cause stack corruption under certain circumstances
  * Set the RSA PSS salt length to the digest length rathern than
    max. possible
  * Fixes to symmetric decrytion related to input size check, defer
    padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)] and to
    always use a temporary malloc'ed buffer for decryption
- Changes since version 0.7.1
  * tpm2: Fix TDES key creation by adding missing un-/marshalling
    functions
  * tpm2: Fix a bug in CheckAuthSession
  * compilation fixes for TPM 1.2 &amp; TPM 2 and various architectures
    and gcc versions
  * Fix support for NIST curves P{192,224,521} and SM2 P256 and
    BNP648 that would not work;
  * Runtime filter elliptic curves (that OpenSSL does not support)
    and do not advertise those curves as capabilities
  * Removed unnecessary space in MANUFACTURER "IBM " -&gt; "IBM"</changelog>
  <changelog author="Gary Ching-Pang Lin &lt;glin@suse.com&gt;" date="1606132800">- Update to version 0.7.4
  * Addressed potential constant-time related issues in TPM 1.2 and
    TPM 2 code
    TPM 1.2: RSA decryption
    TPM 2: EcSchnorr and EcSM2 signatures; Ecsda is handled by OpenSSL
  * Fixed some compilation issues</changelog>
  <changelog author="Gary Ching-Pang Lin &lt;glin@suse.com&gt;" date="1616155200">- Update to version 0.7.7
  * CryptSym: fix AES output IV (bsc#1183729, CVE-2021-3446)
  * tpm2: Fix public key context save due to ANY_OBJECT_Marshal usage
  * tpm2: Address some Coverity issues (false positives)
  * tpm1.2: Backported ASAN/UBSAN related fixes
  * tpm2: Return properly sized array for b parameter for NIST P521
    (HLK)
  * tpm2: Addressed issues detected by UBSAN
  * tpm2: Addressed issues detected by cppcheck (false positives)</changelog>
  <changelog author="Gary Ching-Pang Lin &lt;glin@suse.com&gt;" date="1618833600">- Update to version 0.8.2
  * NOTE: Downgrade to 0.7.x or below is not possible.
    Due to fixes in the TPM 2 prime number generation code in
    rev155 it is not possible to downgrade from libtpms version
    0.8.0 to some previous version. The seeds are now associated
    with an age so that older seeds use the old TPM 2 prime number
    generation code while newer seed use the newer code.
  * tpm2: rev155: Add new RsaAdjustPrimeCandidate code but do
    not use (bsc#1184939 CVE-2021-3505)
  * tpm2: Activate SEED_COMPAT_LEVEL_RSA_PRIME_ADJUST_FIX
    (bsc#1184939 CVE-2021-3505)
  * Update to TPM 2 code release 159
  - X509 support is enabled
    + SM2 signing of ceritificates is NOT supported
  - Authenticated timers are disabled
  * Update to TPM 2 code relase 162
  - ECC encryption / decryption is disabled
  * Fix support for elliptic curve due to missing unmarshalling
    code
  * Runtime filter supported elliptic curves supported by OpenSSL
  * Fix output buffer parameter and size for RSA decryption that
    could cause stack corruption under certain circumstances
  * Set the RSA PSS salt length to the digest length rather than
    max
  * Fixes to symmetric decryption related to input size check,
    defer padding to the user [EVP_CIPHER_CTX_set_padding(ctx, 0)]
    and to always use a temporary malloc'ed buffer for decryption
  * Fixed the set of PCRs belonging to the TCB group. This affects
    the pcrUpdateCounter in TPM2_Pcrread() responses, thus needs
    latest swtpm for test cases to succeed there.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1628337600">- Update to version 0.8.4:
  * Reset too large size indicators in TPM2B to avoid access
    beyond buffer
  * Restore original value in buffer if unmarshalled one was
    illegal</changelog>
  <changelog author="pgajdos@suse.com" date="1630411200">- security update
- added patches
  fix CVE-2021-3746 [bsc#1189935], out-of-bounds access via specially crafted TPM 2 command packets
  + libtpms-CVE-2021-3746.patch</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to version 0.9.1
  * Downgrade to previous versions is not possible, as the size of
    the context gap has been adjusted to 0xffff from 0xff.
  * Enabled Camellia symmetric key encryption algorithm
  * tpm2: Update to TPM 2 spec rev 164
  * tpm2: Added a cache for private exponent D and prime Q
  * tpm2: bug fixes
- Drop upstream fixed libtpms-CVE-2021-3746.patch
- Fixed CVE-2021-3623 (bsc#1187767)
- Used in SLE:
  0001-tpm2-Reset-TPM2B-buffer-sizes-after-test-fails-for-v.patch
  0002-tpm2-Add-maxSize-parameter-to-TPM2B_Marshal-for-sani.patch
  0003-tpm2-Restore-original-value-if-unmarsalled-value-was.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1649592000">- update to 0.9.3:
  * build-sys: Add probing for -fstack-protector
  * tpm2: Do not call EVP_PKEY_CTX_set0_rsa_oaep_label() for label of size
  * (OSSL 3)
  * tpm2: When writing state initialize s_ContextSlotMask if not set</changelog>
  <changelog author="pgajdos@suse.com" date="1669377600">- fix build for ppc64le: use -Wl,--no-as-needed in check-local
  [bsc#1204556]</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670068800">- update to 0.9.5:
  * tpm2: Do not set RSA_FLAG_NO_BLINDING on RSA keys anymore
  * tpm2: Fix a potential overflow expression (coverity)
  * tpm2: Fix size check in CryptSecretDecrypt
  * tpm: #undef printf in case it is #define'd (OSS-Fuzz)
  * tpm2: Check return code of BN_div()
  * tpm2: Initialize variables due to gcc complaint (s390x, false positive)
  * tpm12: Initialize variables due to gcc complaint (s390x, false positive)
  * build-sys: Fix configure script to support _FORTIFY_SOURCE=3</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104000">- Update to 0.9.6:
  * CVE-2023-1018: tpm2: Fixed out of bounds read in CryptParameterDecryption (bsc#1206023)
  * CVE-2023-1017: tpm2: Fixed out of bounds write in CryptParameterDecryption (bsc#1206022)
- 0001-tpm2-Check-size-of-buffer-before-accessing-it-CVE-20.patch: upstreamed</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1733313600">- Add tpm2-Add-padding-to-OBJECT-for-32bit-targets.patch
- Update to 0.10.0:
  * tpm2: Support for profiles: default-v1 &amp; custom
  * tpm2: Add new API call TPMLIB_SetProfile to enable user to set a
    profile
  * tpm2: Extende TPMLIB_GetInfo to return profiles-related info
  * tpm2: Implemented crypto tests and restrictions on crypto related
    to FIPS-140-3; can be enabled with profiles
  * tpm2: Enable Camellia-192 and AES-192
  * tpm2: Implement TPMLIB_WasManufactured API call
  * tpm2: Fixes for issues detected by static analyzers
  * tpm2: Use OpenSSL-based KDFe implementation if possible
  * tpm2: Update to TPM 2 spec rev 183 (many changes)
  * tpm2: Better support for OpenSSL 3.x
  * tpm2: Use Carmichael function for RSA priv. exponent D (&gt;= 2048
    bits)
  * tpm2: Fixes for CVE-2023-1017 and CVE-2023-1018
  * tpm2: Fix of SignedCompareB().
- NOTE: This fix may result in backwards compatibility issues with PCR
  policies used by TPM2_PolicyCounterTimer and TPM2_PolicyNV when
  upgrading from v0.9 to v0.10.</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1733486400">- Use gcc/g++-13 on Leap to fix the following failure:
  "tpm2_setprofile.c:49:24: error: initializer element is not constant"</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1750075200">- Update to version 0.10.1:
  * tpm2: Fix potential out-of-bound access &amp; abort due to HMAC
    signing issue (CVE-2025-49133).
  * tpm2: fix build for LibreSSL 4.1.0.
  * tpm2: In CheckLockedOut replace TPM_RC_RETRY with
    TPM_RC_SUCCESS.
  * tpm2: Fix bugs in RuntimeProfileDedupStrItems.
  * tpm2 + test: Make it compilable on Debian GNU Hurd.
  * tpm2: Add asserts to silence compiler warning due to
  - Wstringop-overflow=.
  * tpm2: Add padding to OBJECT for 32bit targets.
- Drop tpm2-Add-padding-to-OBJECT-for-32bit-targets.patch: fixed
  upstream.</changelog>
  <changelog author="Giacomo Leidi &lt;giacomo.leidi@suse.com&gt;" date="1755864000">- Allow for %is_opensuse to be unset, following up to
  https://src.suse.de/products/SLFO/pulls/204 (bsc#1248486).</changelog>
  <changelog author="Richard Biener &lt;rguenther@suse.com&gt;" date="1773835200">- Update to version 0.10.2:
  * tpm2: Fix memory leak by freeing KDF context
  * tpm2: Fix retrieval of updated IV when using OpenSSL &gt;= 3.0 (CVE-2026-21444 bsc#1260439)
- Add libtpms-fix-const-correctness.patch to fix build with new glibc (bsc#1257311)</changelog>
</package>
<package pkgid="b7cc97c986162424c6c82b5f1750a8a5cb4805561e475ccd8e92e116a861b2b4c2b04b148d64a4246147995bdf023271f2740f0ee22ac9c0c30c0b95db7c6723" name="libtpms-debugsource" arch="s390x">
  <version epoch="0" ver="0.10.2" rel="59.8"/>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to version 0.9.1
  * Downgrade to previous versions is not possible, as the size of
    the context gap has been adjusted to 0xffff from 0xff.
  * Enabled Camellia symmetric key encryption algorithm
  * tpm2: Update to TPM 2 spec rev 164
  * tpm2: Added a cache for private exponent D and prime Q
  * tpm2: bug fixes
- Drop upstream fixed libtpms-CVE-2021-3746.patch
- Fixed CVE-2021-3623 (bsc#1187767)
- Used in SLE:
  0001-tpm2-Reset-TPM2B-buffer-sizes-after-test-fails-for-v.patch
  0002-tpm2-Add-maxSize-parameter-to-TPM2B_Marshal-for-sani.patch
  0003-tpm2-Restore-original-value-if-unmarsalled-value-was.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1649592000">- update to 0.9.3:
  * build-sys: Add probing for -fstack-protector
  * tpm2: Do not call EVP_PKEY_CTX_set0_rsa_oaep_label() for label of size
  * (OSSL 3)
  * tpm2: When writing state initialize s_ContextSlotMask if not set</changelog>
  <changelog author="pgajdos@suse.com" date="1669377600">- fix build for ppc64le: use -Wl,--no-as-needed in check-local
  [bsc#1204556]</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670068800">- update to 0.9.5:
  * tpm2: Do not set RSA_FLAG_NO_BLINDING on RSA keys anymore
  * tpm2: Fix a potential overflow expression (coverity)
  * tpm2: Fix size check in CryptSecretDecrypt
  * tpm: #undef printf in case it is #define'd (OSS-Fuzz)
  * tpm2: Check return code of BN_div()
  * tpm2: Initialize variables due to gcc complaint (s390x, false positive)
  * tpm12: Initialize variables due to gcc complaint (s390x, false positive)
  * build-sys: Fix configure script to support _FORTIFY_SOURCE=3</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104000">- Update to 0.9.6:
  * CVE-2023-1018: tpm2: Fixed out of bounds read in CryptParameterDecryption (bsc#1206023)
  * CVE-2023-1017: tpm2: Fixed out of bounds write in CryptParameterDecryption (bsc#1206022)
- 0001-tpm2-Check-size-of-buffer-before-accessing-it-CVE-20.patch: upstreamed</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1733313600">- Add tpm2-Add-padding-to-OBJECT-for-32bit-targets.patch
- Update to 0.10.0:
  * tpm2: Support for profiles: default-v1 &amp; custom
  * tpm2: Add new API call TPMLIB_SetProfile to enable user to set a
    profile
  * tpm2: Extende TPMLIB_GetInfo to return profiles-related info
  * tpm2: Implemented crypto tests and restrictions on crypto related
    to FIPS-140-3; can be enabled with profiles
  * tpm2: Enable Camellia-192 and AES-192
  * tpm2: Implement TPMLIB_WasManufactured API call
  * tpm2: Fixes for issues detected by static analyzers
  * tpm2: Use OpenSSL-based KDFe implementation if possible
  * tpm2: Update to TPM 2 spec rev 183 (many changes)
  * tpm2: Better support for OpenSSL 3.x
  * tpm2: Use Carmichael function for RSA priv. exponent D (&gt;= 2048
    bits)
  * tpm2: Fixes for CVE-2023-1017 and CVE-2023-1018
  * tpm2: Fix of SignedCompareB().
- NOTE: This fix may result in backwards compatibility issues with PCR
  policies used by TPM2_PolicyCounterTimer and TPM2_PolicyNV when
  upgrading from v0.9 to v0.10.</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1733486400">- Use gcc/g++-13 on Leap to fix the following failure:
  "tpm2_setprofile.c:49:24: error: initializer element is not constant"</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1750075200">- Update to version 0.10.1:
  * tpm2: Fix potential out-of-bound access &amp; abort due to HMAC
    signing issue (CVE-2025-49133).
  * tpm2: fix build for LibreSSL 4.1.0.
  * tpm2: In CheckLockedOut replace TPM_RC_RETRY with
    TPM_RC_SUCCESS.
  * tpm2: Fix bugs in RuntimeProfileDedupStrItems.
  * tpm2 + test: Make it compilable on Debian GNU Hurd.
  * tpm2: Add asserts to silence compiler warning due to
  - Wstringop-overflow=.
  * tpm2: Add padding to OBJECT for 32bit targets.
- Drop tpm2-Add-padding-to-OBJECT-for-32bit-targets.patch: fixed
  upstream.</changelog>
  <changelog author="Giacomo Leidi &lt;giacomo.leidi@suse.com&gt;" date="1755864000">- Allow for %is_opensuse to be unset, following up to
  https://src.suse.de/products/SLFO/pulls/204 (bsc#1248486).</changelog>
  <changelog author="Richard Biener &lt;rguenther@suse.com&gt;" date="1773835200">- Update to version 0.10.2:
  * tpm2: Fix memory leak by freeing KDF context
  * tpm2: Fix retrieval of updated IV when using OpenSSL &gt;= 3.0 (CVE-2026-21444 bsc#1260439)
- Add libtpms-fix-const-correctness.patch to fix build with new glibc (bsc#1257311)</changelog>
</package>
<package pkgid="68e5eb28ee4021834d370d984f7f6e2a70c01d27417afadb281bc47542bad5ba72ff388c0e8020a8f546d081a0e7e5300ea12e842423421937951c7ec72678b9" name="libtpms-devel" arch="s390x">
  <version epoch="0" ver="0.10.2" rel="59.8"/>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to version 0.9.1
  * Downgrade to previous versions is not possible, as the size of
    the context gap has been adjusted to 0xffff from 0xff.
  * Enabled Camellia symmetric key encryption algorithm
  * tpm2: Update to TPM 2 spec rev 164
  * tpm2: Added a cache for private exponent D and prime Q
  * tpm2: bug fixes
- Drop upstream fixed libtpms-CVE-2021-3746.patch
- Fixed CVE-2021-3623 (bsc#1187767)
- Used in SLE:
  0001-tpm2-Reset-TPM2B-buffer-sizes-after-test-fails-for-v.patch
  0002-tpm2-Add-maxSize-parameter-to-TPM2B_Marshal-for-sani.patch
  0003-tpm2-Restore-original-value-if-unmarsalled-value-was.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1649592000">- update to 0.9.3:
  * build-sys: Add probing for -fstack-protector
  * tpm2: Do not call EVP_PKEY_CTX_set0_rsa_oaep_label() for label of size
  * (OSSL 3)
  * tpm2: When writing state initialize s_ContextSlotMask if not set</changelog>
  <changelog author="pgajdos@suse.com" date="1669377600">- fix build for ppc64le: use -Wl,--no-as-needed in check-local
  [bsc#1204556]</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670068800">- update to 0.9.5:
  * tpm2: Do not set RSA_FLAG_NO_BLINDING on RSA keys anymore
  * tpm2: Fix a potential overflow expression (coverity)
  * tpm2: Fix size check in CryptSecretDecrypt
  * tpm: #undef printf in case it is #define'd (OSS-Fuzz)
  * tpm2: Check return code of BN_div()
  * tpm2: Initialize variables due to gcc complaint (s390x, false positive)
  * tpm12: Initialize variables due to gcc complaint (s390x, false positive)
  * build-sys: Fix configure script to support _FORTIFY_SOURCE=3</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104000">- Update to 0.9.6:
  * CVE-2023-1018: tpm2: Fixed out of bounds read in CryptParameterDecryption (bsc#1206023)
  * CVE-2023-1017: tpm2: Fixed out of bounds write in CryptParameterDecryption (bsc#1206022)
- 0001-tpm2-Check-size-of-buffer-before-accessing-it-CVE-20.patch: upstreamed</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1733313600">- Add tpm2-Add-padding-to-OBJECT-for-32bit-targets.patch
- Update to 0.10.0:
  * tpm2: Support for profiles: default-v1 &amp; custom
  * tpm2: Add new API call TPMLIB_SetProfile to enable user to set a
    profile
  * tpm2: Extende TPMLIB_GetInfo to return profiles-related info
  * tpm2: Implemented crypto tests and restrictions on crypto related
    to FIPS-140-3; can be enabled with profiles
  * tpm2: Enable Camellia-192 and AES-192
  * tpm2: Implement TPMLIB_WasManufactured API call
  * tpm2: Fixes for issues detected by static analyzers
  * tpm2: Use OpenSSL-based KDFe implementation if possible
  * tpm2: Update to TPM 2 spec rev 183 (many changes)
  * tpm2: Better support for OpenSSL 3.x
  * tpm2: Use Carmichael function for RSA priv. exponent D (&gt;= 2048
    bits)
  * tpm2: Fixes for CVE-2023-1017 and CVE-2023-1018
  * tpm2: Fix of SignedCompareB().
- NOTE: This fix may result in backwards compatibility issues with PCR
  policies used by TPM2_PolicyCounterTimer and TPM2_PolicyNV when
  upgrading from v0.9 to v0.10.</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1733486400">- Use gcc/g++-13 on Leap to fix the following failure:
  "tpm2_setprofile.c:49:24: error: initializer element is not constant"</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1750075200">- Update to version 0.10.1:
  * tpm2: Fix potential out-of-bound access &amp; abort due to HMAC
    signing issue (CVE-2025-49133).
  * tpm2: fix build for LibreSSL 4.1.0.
  * tpm2: In CheckLockedOut replace TPM_RC_RETRY with
    TPM_RC_SUCCESS.
  * tpm2: Fix bugs in RuntimeProfileDedupStrItems.
  * tpm2 + test: Make it compilable on Debian GNU Hurd.
  * tpm2: Add asserts to silence compiler warning due to
  - Wstringop-overflow=.
  * tpm2: Add padding to OBJECT for 32bit targets.
- Drop tpm2-Add-padding-to-OBJECT-for-32bit-targets.patch: fixed
  upstream.</changelog>
  <changelog author="Giacomo Leidi &lt;giacomo.leidi@suse.com&gt;" date="1755864000">- Allow for %is_opensuse to be unset, following up to
  https://src.suse.de/products/SLFO/pulls/204 (bsc#1248486).</changelog>
  <changelog author="Richard Biener &lt;rguenther@suse.com&gt;" date="1773835200">- Update to version 0.10.2:
  * tpm2: Fix memory leak by freeing KDF context
  * tpm2: Fix retrieval of updated IV when using OpenSSL &gt;= 3.0 (CVE-2026-21444 bsc#1260439)
- Add libtpms-fix-const-correctness.patch to fix build with new glibc (bsc#1257311)</changelog>
</package>
<package pkgid="c4d32ed893a0380ca7177cac77e9296e5231bee9d8116fa4f2f12ce37678b3ca05a86d03b583b1609a4955beec75a6ced4040a488d3971902861409e796a86d7" name="libtpms0" arch="s390x">
  <version epoch="0" ver="0.10.2" rel="59.8"/>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to version 0.9.1
  * Downgrade to previous versions is not possible, as the size of
    the context gap has been adjusted to 0xffff from 0xff.
  * Enabled Camellia symmetric key encryption algorithm
  * tpm2: Update to TPM 2 spec rev 164
  * tpm2: Added a cache for private exponent D and prime Q
  * tpm2: bug fixes
- Drop upstream fixed libtpms-CVE-2021-3746.patch
- Fixed CVE-2021-3623 (bsc#1187767)
- Used in SLE:
  0001-tpm2-Reset-TPM2B-buffer-sizes-after-test-fails-for-v.patch
  0002-tpm2-Add-maxSize-parameter-to-TPM2B_Marshal-for-sani.patch
  0003-tpm2-Restore-original-value-if-unmarsalled-value-was.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1649592000">- update to 0.9.3:
  * build-sys: Add probing for -fstack-protector
  * tpm2: Do not call EVP_PKEY_CTX_set0_rsa_oaep_label() for label of size
  * (OSSL 3)
  * tpm2: When writing state initialize s_ContextSlotMask if not set</changelog>
  <changelog author="pgajdos@suse.com" date="1669377600">- fix build for ppc64le: use -Wl,--no-as-needed in check-local
  [bsc#1204556]</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670068800">- update to 0.9.5:
  * tpm2: Do not set RSA_FLAG_NO_BLINDING on RSA keys anymore
  * tpm2: Fix a potential overflow expression (coverity)
  * tpm2: Fix size check in CryptSecretDecrypt
  * tpm: #undef printf in case it is #define'd (OSS-Fuzz)
  * tpm2: Check return code of BN_div()
  * tpm2: Initialize variables due to gcc complaint (s390x, false positive)
  * tpm12: Initialize variables due to gcc complaint (s390x, false positive)
  * build-sys: Fix configure script to support _FORTIFY_SOURCE=3</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104000">- Update to 0.9.6:
  * CVE-2023-1018: tpm2: Fixed out of bounds read in CryptParameterDecryption (bsc#1206023)
  * CVE-2023-1017: tpm2: Fixed out of bounds write in CryptParameterDecryption (bsc#1206022)
- 0001-tpm2-Check-size-of-buffer-before-accessing-it-CVE-20.patch: upstreamed</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1733313600">- Add tpm2-Add-padding-to-OBJECT-for-32bit-targets.patch
- Update to 0.10.0:
  * tpm2: Support for profiles: default-v1 &amp; custom
  * tpm2: Add new API call TPMLIB_SetProfile to enable user to set a
    profile
  * tpm2: Extende TPMLIB_GetInfo to return profiles-related info
  * tpm2: Implemented crypto tests and restrictions on crypto related
    to FIPS-140-3; can be enabled with profiles
  * tpm2: Enable Camellia-192 and AES-192
  * tpm2: Implement TPMLIB_WasManufactured API call
  * tpm2: Fixes for issues detected by static analyzers
  * tpm2: Use OpenSSL-based KDFe implementation if possible
  * tpm2: Update to TPM 2 spec rev 183 (many changes)
  * tpm2: Better support for OpenSSL 3.x
  * tpm2: Use Carmichael function for RSA priv. exponent D (&gt;= 2048
    bits)
  * tpm2: Fixes for CVE-2023-1017 and CVE-2023-1018
  * tpm2: Fix of SignedCompareB().
- NOTE: This fix may result in backwards compatibility issues with PCR
  policies used by TPM2_PolicyCounterTimer and TPM2_PolicyNV when
  upgrading from v0.9 to v0.10.</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1733486400">- Use gcc/g++-13 on Leap to fix the following failure:
  "tpm2_setprofile.c:49:24: error: initializer element is not constant"</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1750075200">- Update to version 0.10.1:
  * tpm2: Fix potential out-of-bound access &amp; abort due to HMAC
    signing issue (CVE-2025-49133).
  * tpm2: fix build for LibreSSL 4.1.0.
  * tpm2: In CheckLockedOut replace TPM_RC_RETRY with
    TPM_RC_SUCCESS.
  * tpm2: Fix bugs in RuntimeProfileDedupStrItems.
  * tpm2 + test: Make it compilable on Debian GNU Hurd.
  * tpm2: Add asserts to silence compiler warning due to
  - Wstringop-overflow=.
  * tpm2: Add padding to OBJECT for 32bit targets.
- Drop tpm2-Add-padding-to-OBJECT-for-32bit-targets.patch: fixed
  upstream.</changelog>
  <changelog author="Giacomo Leidi &lt;giacomo.leidi@suse.com&gt;" date="1755864000">- Allow for %is_opensuse to be unset, following up to
  https://src.suse.de/products/SLFO/pulls/204 (bsc#1248486).</changelog>
  <changelog author="Richard Biener &lt;rguenther@suse.com&gt;" date="1773835200">- Update to version 0.10.2:
  * tpm2: Fix memory leak by freeing KDF context
  * tpm2: Fix retrieval of updated IV when using OpenSSL &gt;= 3.0 (CVE-2026-21444 bsc#1260439)
- Add libtpms-fix-const-correctness.patch to fix build with new glibc (bsc#1257311)</changelog>
</package>
<package pkgid="664d038bf8ea925d8da27ca17b4ac8d143137dc585de4a858a14da6535e892ad57b05901387382948d49149cd8d130997c8388e3a2d513070ff3d467a24e2b58" name="libtpms0-debuginfo" arch="s390x">
  <version epoch="0" ver="0.10.2" rel="59.8"/>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to version 0.9.1
  * Downgrade to previous versions is not possible, as the size of
    the context gap has been adjusted to 0xffff from 0xff.
  * Enabled Camellia symmetric key encryption algorithm
  * tpm2: Update to TPM 2 spec rev 164
  * tpm2: Added a cache for private exponent D and prime Q
  * tpm2: bug fixes
- Drop upstream fixed libtpms-CVE-2021-3746.patch
- Fixed CVE-2021-3623 (bsc#1187767)
- Used in SLE:
  0001-tpm2-Reset-TPM2B-buffer-sizes-after-test-fails-for-v.patch
  0002-tpm2-Add-maxSize-parameter-to-TPM2B_Marshal-for-sani.patch
  0003-tpm2-Restore-original-value-if-unmarsalled-value-was.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1649592000">- update to 0.9.3:
  * build-sys: Add probing for -fstack-protector
  * tpm2: Do not call EVP_PKEY_CTX_set0_rsa_oaep_label() for label of size
  * (OSSL 3)
  * tpm2: When writing state initialize s_ContextSlotMask if not set</changelog>
  <changelog author="pgajdos@suse.com" date="1669377600">- fix build for ppc64le: use -Wl,--no-as-needed in check-local
  [bsc#1204556]</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670068800">- update to 0.9.5:
  * tpm2: Do not set RSA_FLAG_NO_BLINDING on RSA keys anymore
  * tpm2: Fix a potential overflow expression (coverity)
  * tpm2: Fix size check in CryptSecretDecrypt
  * tpm: #undef printf in case it is #define'd (OSS-Fuzz)
  * tpm2: Check return code of BN_div()
  * tpm2: Initialize variables due to gcc complaint (s390x, false positive)
  * tpm12: Initialize variables due to gcc complaint (s390x, false positive)
  * build-sys: Fix configure script to support _FORTIFY_SOURCE=3</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104000">- Update to 0.9.6:
  * CVE-2023-1018: tpm2: Fixed out of bounds read in CryptParameterDecryption (bsc#1206023)
  * CVE-2023-1017: tpm2: Fixed out of bounds write in CryptParameterDecryption (bsc#1206022)
- 0001-tpm2-Check-size-of-buffer-before-accessing-it-CVE-20.patch: upstreamed</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1733313600">- Add tpm2-Add-padding-to-OBJECT-for-32bit-targets.patch
- Update to 0.10.0:
  * tpm2: Support for profiles: default-v1 &amp; custom
  * tpm2: Add new API call TPMLIB_SetProfile to enable user to set a
    profile
  * tpm2: Extende TPMLIB_GetInfo to return profiles-related info
  * tpm2: Implemented crypto tests and restrictions on crypto related
    to FIPS-140-3; can be enabled with profiles
  * tpm2: Enable Camellia-192 and AES-192
  * tpm2: Implement TPMLIB_WasManufactured API call
  * tpm2: Fixes for issues detected by static analyzers
  * tpm2: Use OpenSSL-based KDFe implementation if possible
  * tpm2: Update to TPM 2 spec rev 183 (many changes)
  * tpm2: Better support for OpenSSL 3.x
  * tpm2: Use Carmichael function for RSA priv. exponent D (&gt;= 2048
    bits)
  * tpm2: Fixes for CVE-2023-1017 and CVE-2023-1018
  * tpm2: Fix of SignedCompareB().
- NOTE: This fix may result in backwards compatibility issues with PCR
  policies used by TPM2_PolicyCounterTimer and TPM2_PolicyNV when
  upgrading from v0.9 to v0.10.</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1733486400">- Use gcc/g++-13 on Leap to fix the following failure:
  "tpm2_setprofile.c:49:24: error: initializer element is not constant"</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1750075200">- Update to version 0.10.1:
  * tpm2: Fix potential out-of-bound access &amp; abort due to HMAC
    signing issue (CVE-2025-49133).
  * tpm2: fix build for LibreSSL 4.1.0.
  * tpm2: In CheckLockedOut replace TPM_RC_RETRY with
    TPM_RC_SUCCESS.
  * tpm2: Fix bugs in RuntimeProfileDedupStrItems.
  * tpm2 + test: Make it compilable on Debian GNU Hurd.
  * tpm2: Add asserts to silence compiler warning due to
  - Wstringop-overflow=.
  * tpm2: Add padding to OBJECT for 32bit targets.
- Drop tpm2-Add-padding-to-OBJECT-for-32bit-targets.patch: fixed
  upstream.</changelog>
  <changelog author="Giacomo Leidi &lt;giacomo.leidi@suse.com&gt;" date="1755864000">- Allow for %is_opensuse to be unset, following up to
  https://src.suse.de/products/SLFO/pulls/204 (bsc#1248486).</changelog>
  <changelog author="Richard Biener &lt;rguenther@suse.com&gt;" date="1773835200">- Update to version 0.10.2:
  * tpm2: Fix memory leak by freeing KDF context
  * tpm2: Fix retrieval of updated IV when using OpenSSL &gt;= 3.0 (CVE-2026-21444 bsc#1260439)
- Add libtpms-fix-const-correctness.patch to fix build with new glibc (bsc#1257311)</changelog>
</package>
<package pkgid="1faf97d4dfd16a23f723db43206163a59faa0c28571d941ecb9bad9d731f6dbba18a2e8268163fa290fb1d0c40fd06991be79432f2ab267ddf15079923af4aa0" name="libtspi1" arch="s390x">
  <version epoch="0" ver="0.3.15" rel="124.10"/>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1591099200">- add gcc-10.patch: fixes the build on gcc 10 by removing unused global
  variables. This patch was posted on the TrouSerS mailing list [1].
  [1]: https://sourceforge.net/p/trousers/mailman/message/36951419/</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1595851200">- In a previous commit the Requires line for the tss user got accidentally
  dropped. This change reintroduces it.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1604577600">- update to new upstream version 0.3.15:
  - Corrected mutliple security issues that existed if the tcsd is started by
    root instead of the tss user. CVE-2020-24332, CVE-2020-24330, CVE-2020-24331
  - Replaced use of _no_optimize with asm memory barrier
  - Fixed multiple potential instances of use after free memory handling
  - Removed unused global variables which caused build issue on some distros
- drop gcc-10.patch: now contained in upstream tarball
- drop bsc1164472.patch: now contained in upstream tarball
- adjusted %setup macro invocation which seemed to be wrong</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- move libraries to /usr/lib (bsc#1191102)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1637841600">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * tcsd.service</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed urls to https (except main URL which has no https)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1661169600">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1703937600">- add Requires(post): udev, Requires(post): coreutils
  * the post scriptlet uses udevamd and chown</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1776686400">- add setid-hardening.patch (bsc#1262318): detect privilege drop errors, also
  drop supplementary group membership.</changelog>
</package>
<package pkgid="3bd42c8fd5b1b487c57d2f8498e765109fbe71e6d605c23a5ed0f031a16daee094f64fded790d5fd48d3762d5e595c16632689a485e4a005e124af115c1c8a2f" name="libtspi1-debuginfo" arch="s390x">
  <version epoch="0" ver="0.3.15" rel="124.10"/>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1591099200">- add gcc-10.patch: fixes the build on gcc 10 by removing unused global
  variables. This patch was posted on the TrouSerS mailing list [1].
  [1]: https://sourceforge.net/p/trousers/mailman/message/36951419/</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1595851200">- In a previous commit the Requires line for the tss user got accidentally
  dropped. This change reintroduces it.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1604577600">- update to new upstream version 0.3.15:
  - Corrected mutliple security issues that existed if the tcsd is started by
    root instead of the tss user. CVE-2020-24332, CVE-2020-24330, CVE-2020-24331
  - Replaced use of _no_optimize with asm memory barrier
  - Fixed multiple potential instances of use after free memory handling
  - Removed unused global variables which caused build issue on some distros
- drop gcc-10.patch: now contained in upstream tarball
- drop bsc1164472.patch: now contained in upstream tarball
- adjusted %setup macro invocation which seemed to be wrong</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- move libraries to /usr/lib (bsc#1191102)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1637841600">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * tcsd.service</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed urls to https (except main URL which has no https)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1661169600">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1703937600">- add Requires(post): udev, Requires(post): coreutils
  * the post scriptlet uses udevamd and chown</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1776686400">- add setid-hardening.patch (bsc#1262318): detect privilege drop errors, also
  drop supplementary group membership.</changelog>
</package>
<package pkgid="a79a4ccbdd3c1de02d8c5281ecd06e2ece363b65573cc10bbb4c72312f7c027f0c8a745e5e29b1d9b2938b8e5160753e37aa1205023b92f031df5c7f2ac3e31f" name="libtss2-esys0" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="63a30a91171f00b1a17f6c341b73d41629f897a73e996c06d3b1fd0785a048c8054bf422666d1581a081a6ade4a83325ed4f9f1f37dea5a5f4e9c41032afd154" name="libtss2-esys0-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="19d3ef3a6d98b952e1880ad4337ca958b1ca411f99ee793730d626089bd85c47c3e799d948da41f18f852ca25d469dc544921ceb68535133af7ba8976786cfe9" name="libtss2-fapi-common" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="50302797b7a7bc8d78e64706caab740619de7e91567eb8391d337054fb232e3c3a84052fd6672d175fd99dbabba9ce5fa5c7a657debc829eac221e3676697ce1" name="libtss2-fapi1" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="dac260b63f14f05257885e68cde00869d26d8689f0535812330db276587fa5bf1b5bdc8d1429d14d07e330ae88e76a9214c58b2fb5e7231330acd1a308686389" name="libtss2-fapi1-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="f6c389d2d030325bf7649b823c4991ce9c16ee1836814cb31e997518e663ad49790cb5ad84e86e450bfbd7ce328538cb65e87119b53af28242fa84311bb72a29" name="libtss2-mu0" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="1c9d50cc1e77e125d28a60d1fc013db76df7e1f97dab2f8789b2abb982e20bbc01fb2390f409d6735c2b32a07ac4fd831e44391795527fb61003d82631d55a9f" name="libtss2-mu0-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="59d0ee47edf6b0fb0ee3ed935d42d933999508aa188d43e2d165d97beede12fd2d34b8e0816ced17ffb257d382b083315ff3b83c3f4435ca17ccb57029747bdf" name="libtss2-policy0" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="c1610e33d18a062d5a0634e1f95e7e199fc2217b7c566c1b44e764c3c41c1e9781bfcde5b3a99e7f32983f969195bd32e4387ee0c7fe90177d99b12bd74d6833" name="libtss2-policy0-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="9c139ef7a1c0c3e99ff29c53c36545c9d254356ef648e048447f901ea3757ef6e3cb00eba21fa2c2d047b6d2d42bb87c2d0c68a3d0f16e87bfbea86a360896e6" name="libtss2-rc0" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="8a3676be02ed7138f9d60108c721836d2b2b6903052e57a57102bff7590071b3396e1835e567287457933691de5bd4174ff0b23a7e52f1548e74a7ee0008536d" name="libtss2-rc0-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="841a4fcb7f8eed276a53d6794efdea937a58f6163e877ac47e841000804d4a6c57f8d8db9fc3854bd5da1081f5fc63b84db29f568822039860adf6602a5dd460" name="libtss2-sys1" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="53b5eb3dfbfc66710bdf54b67fdc1e7c53783cd7c68cd6a1d4f9323c1b525d4d2070294e8dcb5c19e8d5ba42ddb046605bd1514375b370b43e3e1452dabefda4" name="libtss2-sys1-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="acab6456a2b94e390f019873324c6fc05aefb42d21e2fc005ab2eccad1e0a18ad798454b2cd1f9a6377fafd64af3e5cbcc22234e89175803080d33b761755fce" name="libtss2-tcti-cmd0" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="0620a65cba5610e668f062d173d3c0fc8937083f517b20b1e8f411f9c5bbeaa3f664464b95fea180cef14b6ef76c73e904873ddd975c59f80ae4d7800a367f1b" name="libtss2-tcti-cmd0-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="51a2b89e6e38914d465b9a0c49a10ce1a6f610feb35507362f081ea494baf7f98f1e7fdfff9c6a468802d9768f6f7f3ecadc2ab27f4dd598facd84c0d3d2a643" name="libtss2-tcti-device0" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="bc7094050d90752016d5ed1e4849ffe772c5497c5ef41adfed23457ddcac4baaa7a5bb7f6f9ac2140cb86665a109474b13518e2de061c78f183a7979ea9592c6" name="libtss2-tcti-device0-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="d752baa013ed200390237a4fe22e520c34e5a590a6d44f2eb0e7513935c4d78d8e981d265d24abd5dcd9d53952133c51e1c4c7edef93a356d627ccb915d0f5f0" name="libtss2-tcti-i2c-helper0" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="85e2dabeefed4bddd32ecc1556e2a6ffc5f0cf5d6926ad48d94b0d1ead670263dab801998c0a94b6f506683164f309bf756d19e023ebc59b6e0f682ddab9f957" name="libtss2-tcti-i2c-helper0-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="3c9f5786ef46e6892036c55aa11d1ffb8b0eba9ff99501f66313f4aa84e2c01087190ae6b5c578742d33577a876621990c355c98761f0b885c1101fbd2c9efcc" name="libtss2-tcti-mssim0" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="c230b7becdd16a12040880a25d9c37f5186083d413bb36dd0bb0e8287d4395c930ffd1f8712d2c41e0a1e7c722e06a6e082134583ea60807cba0baa68e64436c" name="libtss2-tcti-mssim0-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="ed98339624a9261f1ae3111ad164da1f87165ea978fe377a65a79d193c4e3507ea246657a928f112f84e64d20aade51e0c75da7728c17c8082b6664941b40d3a" name="libtss2-tcti-pcap0" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="15a3e4ce51d378dd296b7052d6dff84f048ac8c05ac782fe3bf01aac2d41981ae933e45f162376e0d27a8b45c838979a437856ea9e5e6b16eae96482b14b9277" name="libtss2-tcti-pcap0-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="8fde915a9febb715d055adbcd58e05339203fd911dae2dab3f270ed8f78969d38b96e8ef3d5a4e061586381527652f09eff0967c058005c481456b44957c3b0c" name="libtss2-tcti-spi-helper0" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="8b2327936f5afbd84173d978fe22dbac6d7acd4a5bbebc51b6bf1e59202ceadfc9cdddcec840d2a4fcb9fb0677202b4bbf67e5defd7079af8f57e2bf208ece41" name="libtss2-tcti-spi-helper0-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="a497461f3645b093bfbc9a260d5315c8317a7721d8c2c02132eb06ce4536016ac66179a98590dd57d206c810295b8fb0698917ad3657cb4576148719295e5709" name="libtss2-tcti-spidev0" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="443a52a9fb7454aa68dfaf7b6b71f47d4ecf1171cd6073c2e8e420af34015e4358c674d96be3c19824a75e986e9b12587fa256478b06ae41eebe7e96663567af" name="libtss2-tcti-spidev0-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="5f3fccc4582fb042afa3a1226d4a8a3fb91b229f9f18568b1a03b627c82189eb83f0c381a5148fc74f8c045bce2113d0cab86be96c1306980ebc2bc85bdb2b1d" name="libtss2-tcti-swtpm0" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="a4d26da06d756216595ead6e02f2faf4e2613c740614760448eff4ae80c7aa67520d2de1a5dcbd3d3c9cddcd18cda66c876aa5c08cbcb6641f53e105e8701947" name="libtss2-tcti-swtpm0-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="e8ec011f752dea65659c4d326ee0207210c381d2087f79179d10bf09c27e3f04d61d1c54a3c72d1fa3618ef1759b65537aaeb4ae91fdd70ad7ea605815e026c6" name="libtss2-tcti-tabrmd0" arch="s390x">
  <version epoch="0" ver="3.0.0" rel="101.36"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="cc17d8dd541830b053e10429c45024c44be4ca6066aeba9d7bc868f72aa9cbba71f3071ce175678f2dd4e1c7bfe65ea21c9e5fbb736623d6d6fe866060fcec3e" name="libtss2-tcti-tabrmd0-debuginfo" arch="s390x">
  <version epoch="0" ver="3.0.0" rel="101.36"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="9e5438bd3257dd6ad8e063b2a122573417e1520a316d79586954b3723340d8757f17afa55b05349c8c506f868ad6552eebf16aef39de665a252b30b48c5104f4" name="libtss2-tctildr0" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="d2f0bd04a71f69f0b2671662bbdef103292a43df3bdecb57926f15e59c917876448beb2b7143c88196b67eaa1689720acc9690da03245da0a45c6fd1a5b659d1" name="libtss2-tctildr0-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="deb78686410ab8166345109a07820172634595514343e98fba37926f06b4a6c332e43ba9f8fe87a89a725929c77e2a4fd974f23abcc6aeb6e91adffdb388407d" name="libusbauth-configparser" arch="src">
  <version epoch="0" ver="1.0.5" rel="19.24"/>
  <changelog author="meissner@suse.com" date="1507809600">- initial package, used for parsing usbauth global config files.</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM groups.</changelog>
  <changelog author="Stefan Koch &lt;stefan.koch10@gmail.com&gt;" date="1548158400">- update to 1.0.1:
  * Support string quoting</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1550664000">- Use a full Source URL and original tarball.
- Avoid double-shipping documentation.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580731200">- BuildRequire pkgconfig(libdev) instead of libudev-devel: allow
  OBS to shortcut thhrough the -mini flavors.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674216000">- update to 1.0.5:
  * Add default value types</changelog>
</package>
<package pkgid="83400ba7a5d07e63d0bfa7a5969ccf0fd0c36918093572f25306e94ba2fb134ac348ffa84b73ef6adde077870e1140f9405be8ffaf4ee69127ae02121dd00b39" name="libusbauth-configparser-debugsource" arch="s390x">
  <version epoch="0" ver="1.0.5" rel="19.24"/>
  <changelog author="meissner@suse.com" date="1507809600">- initial package, used for parsing usbauth global config files.</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM groups.</changelog>
  <changelog author="Stefan Koch &lt;stefan.koch10@gmail.com&gt;" date="1548158400">- update to 1.0.1:
  * Support string quoting</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1550664000">- Use a full Source URL and original tarball.
- Avoid double-shipping documentation.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580731200">- BuildRequire pkgconfig(libdev) instead of libudev-devel: allow
  OBS to shortcut thhrough the -mini flavors.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674216000">- update to 1.0.5:
  * Add default value types</changelog>
</package>
<package pkgid="02c5941c7324752c874151abe46ede93c621315bc9c83a8d33920dd8ce23986bfe552559f1d241c654425bfa99cc6c767a382002553788cf6066c0c82f28750d" name="libusbauth-configparser-devel" arch="s390x">
  <version epoch="0" ver="1.0.5" rel="19.24"/>
  <changelog author="meissner@suse.com" date="1507809600">- initial package, used for parsing usbauth global config files.</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM groups.</changelog>
  <changelog author="Stefan Koch &lt;stefan.koch10@gmail.com&gt;" date="1548158400">- update to 1.0.1:
  * Support string quoting</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1550664000">- Use a full Source URL and original tarball.
- Avoid double-shipping documentation.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580731200">- BuildRequire pkgconfig(libdev) instead of libudev-devel: allow
  OBS to shortcut thhrough the -mini flavors.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674216000">- update to 1.0.5:
  * Add default value types</changelog>
</package>
<package pkgid="ad6f64a4200739830435c15baf34c0a6a6468c1d2436cf669aed13b85ffe19fa1fdbf6b89db7dfa3e8a92740ed1fd09118f01abdc61666150f14e1da2092d1b4" name="libusbauth-configparser1" arch="s390x">
  <version epoch="0" ver="1.0.5" rel="19.24"/>
  <changelog author="meissner@suse.com" date="1507809600">- initial package, used for parsing usbauth global config files.</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM groups.</changelog>
  <changelog author="Stefan Koch &lt;stefan.koch10@gmail.com&gt;" date="1548158400">- update to 1.0.1:
  * Support string quoting</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1550664000">- Use a full Source URL and original tarball.
- Avoid double-shipping documentation.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580731200">- BuildRequire pkgconfig(libdev) instead of libudev-devel: allow
  OBS to shortcut thhrough the -mini flavors.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674216000">- update to 1.0.5:
  * Add default value types</changelog>
</package>
<package pkgid="aeb89e0a24349408137040f47c9dab7b5644834229acb66a6bafb6ed48dbf72018bd1302a1c99f16b99e9a8657a81054dd8bb6da5d096c76d9c22c843cca73bd" name="libusbauth-configparser1-debuginfo" arch="s390x">
  <version epoch="0" ver="1.0.5" rel="19.24"/>
  <changelog author="meissner@suse.com" date="1507809600">- initial package, used for parsing usbauth global config files.</changelog>
  <changelog author="jengelh@inai.de" date="1517486400">- Fix RPM groups.</changelog>
  <changelog author="Stefan Koch &lt;stefan.koch10@gmail.com&gt;" date="1548158400">- update to 1.0.1:
  * Support string quoting</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1550664000">- Use a full Source URL and original tarball.
- Avoid double-shipping documentation.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580731200">- BuildRequire pkgconfig(libdev) instead of libudev-devel: allow
  OBS to shortcut thhrough the -mini flavors.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674216000">- update to 1.0.5:
  * Add default value types</changelog>
</package>
<package pkgid="f7b4b6bc667ef5f82457cff31c7b2a23cca35b8f62904cd535f3d8346e8989e46ce6f220b1b9d813a291060bece5b15a7769b275495168409caa697ff22e6e59" name="libykclient-devel" arch="s390x">
  <version epoch="0" ver="2.15" rel="9.52"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial version</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1299153600">- Version 2.4</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1419336000">- update to v2.13
  * Required by current pam_yubico
- update license to BSD-2-Clause
- remove _service file
- add explicit tarball
- update Url and Source fields to valid URLs
- add BuildRequires for pkgconfig and help2man
- add man page to %files section
- add files to devel package
  * ykclient_errors.h
  * ykclient_server_response.h
  * ykclient_version.h</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 2.14 (released 2015-03-05)
  - Switch default templates to https.
  - Fixup call to curl_easy_escape() to use a easy handle.</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- change the group for the -devel project as requested.</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: remove redundant %clean section, remove implicit
  - -with-pic (only relevant for static libs).</changelog>
  <changelog author="t.gruner@katodev.de" date="1447329600">- Version 2.15 (released 2015-11-12)
  - Add ykclient_get_server_response() to the library.
  - Show more information from the commandline on debug.
  - Add proxy support via Curl.</changelog>
  <changelog author="t.gruner@katodev.de" date="1463486400">- Add .sig file to ykclient.spec</changelog>
</package>
<package pkgid="b34d66e6626de12e98ef8e05376b4da377b6829a1eed271e5ac0884dadca4b0960fc58c953b71ad4facf433051c986756d8ec2c9016df272a6704c75da75f0ee" name="libykclient3" arch="s390x">
  <version epoch="0" ver="2.15" rel="9.52"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial version</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1299153600">- Version 2.4</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1419336000">- update to v2.13
  * Required by current pam_yubico
- update license to BSD-2-Clause
- remove _service file
- add explicit tarball
- update Url and Source fields to valid URLs
- add BuildRequires for pkgconfig and help2man
- add man page to %files section
- add files to devel package
  * ykclient_errors.h
  * ykclient_server_response.h
  * ykclient_version.h</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 2.14 (released 2015-03-05)
  - Switch default templates to https.
  - Fixup call to curl_easy_escape() to use a easy handle.</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- change the group for the -devel project as requested.</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: remove redundant %clean section, remove implicit
  - -with-pic (only relevant for static libs).</changelog>
  <changelog author="t.gruner@katodev.de" date="1447329600">- Version 2.15 (released 2015-11-12)
  - Add ykclient_get_server_response() to the library.
  - Show more information from the commandline on debug.
  - Add proxy support via Curl.</changelog>
  <changelog author="t.gruner@katodev.de" date="1463486400">- Add .sig file to ykclient.spec</changelog>
</package>
<package pkgid="81f9273db29d98647556bcf6a309d170021f6027f56012f6bcedddd9e2c290c6d18f43d8e07b9a6782d6b6ff4be8c687b4e369042755c78dfbd6be28e3ab7d94" name="libykclient3-debuginfo" arch="s390x">
  <version epoch="0" ver="2.15" rel="9.52"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial version</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1299153600">- Version 2.4</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1419336000">- update to v2.13
  * Required by current pam_yubico
- update license to BSD-2-Clause
- remove _service file
- add explicit tarball
- update Url and Source fields to valid URLs
- add BuildRequires for pkgconfig and help2man
- add man page to %files section
- add files to devel package
  * ykclient_errors.h
  * ykclient_server_response.h
  * ykclient_version.h</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 2.14 (released 2015-03-05)
  - Switch default templates to https.
  - Fixup call to curl_easy_escape() to use a easy handle.</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- change the group for the -devel project as requested.</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: remove redundant %clean section, remove implicit
  - -with-pic (only relevant for static libs).</changelog>
  <changelog author="t.gruner@katodev.de" date="1447329600">- Version 2.15 (released 2015-11-12)
  - Add ykclient_get_server_response() to the library.
  - Show more information from the commandline on debug.
  - Add proxy support via Curl.</changelog>
  <changelog author="t.gruner@katodev.de" date="1463486400">- Add .sig file to ykclient.spec</changelog>
</package>
<package pkgid="30addf98274721a5d903b6df216b37b6a6c1bff8e4c9c91a80914092b6f0bf2540c0277dc91116bc2f936d7e56fb05c70d8730cb65de81d16143f658991d07f8" name="libykcs11-2" arch="s390x">
  <version epoch="0" ver="2.7.3" rel="57.4"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1677844800">- update to 2.3.1:
  * ykpiv: Add support for T=0 smartcards
  * ykpiv: ykcs11: Minor code optimization
  * ykpiv: ykcs11: Improve logging
  * ykpiv: ykcs11: Improve error handling
  * ykpiv: ykcs11: Fix minor bugs
  * ykcs11: Add support for several PKCS11 Attributes
  * ykcs11: Add support for CKM_ECDSA_SHA512 mechanism
  * ykcs11: Fix incorrect value for public key attributes
    CKA_PRIVATE, CKA_SENSITIVE, CKA_ALWAYS_SENSITIVE,
    CKA_EXTRACTABLE and CKA_NEVER_EXTRACTABLE
  * doc: Minor documentation improvement</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1702814400">- update to 2.4.2:
  * ykpiv: Fix potential type casting bug.
  * ykpiv: ykcs11: Fix building on certain architectures.
  * ykpiv: cmd: Add support for compressing certificate upon
    import
  * ykcs11: Increase maximum number of slots to handle
    overflow
  * ykcs11: Add support for CKA_COPYABLE and CKA_DESTROYABLE
    attributes</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707307200">- update to 2.5.0:
  * ykpiv: cmd: ykcs11: Add support for RSA3072 and RSA4096 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for ED25519 and X25519 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for deleting keys.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for moving keys between slots.
    Available in firmware 5.7.0 and newer
- add temporary-cmake-flags-fix.patch
  The included cmake modules are buggy. This patch should be removed once the
  root cause is fixed in upstream.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707912000">- update to 2.5.1:
  * ykpiv: cmd: ykcs11: Fix buffer size for key import.
- add cmake-flags-upstream-issue-474.patch:
  proper fix for the cmake flags issue
- remove temporary-cmake-flags-fix.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1715083200">- update to 2.5.2:
  * cmd: Fix signing selfsigned certificate for ED25519 key.
- update cmake-flags-upstream-issue-474.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1724673600">- update to 2.6.0:
  * cmd: Add support for biometric verification and match policy
  * ykcs11: Add support for PKCS11 3.0
  * ykpiv: cmd: ykcs11: Improve error traceability
  * ykpiv: cmd: ykcs11: Fix minor bugs
  * build: Make building with zlib optional</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1726142400">- update to 2.6.1:
  * cmd: Fix performing bio verification
  * ykcs11: Fix handling ED25519 and X25519 keys</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1734609600">- update to 2.7.0:
  * ykpiv: cmd: Add support for communication over a secure channel according
    to SCP11b specifications
  * ykpiv: cmd: Add support for device global reset</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1739102400">- update to 2.7.1:
  * ykpiv: Fix type casting issues affecting systems using
    Big-endian architecture</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1754568000">- update to 2.7.2:
  * ykcs11: Handle a silent verification failure when opening a PKCS11 session.
    No impact on authentication enforcement for the usage of credentials on the
    YubiKey
  * ykcs11: Use "VERIFY_NONE" as PIN to skip verification when using keys with
    PIN policy "never"
  * ykcs11: Use "VERIFY_BIO" as PIN to trigger bio verification on the YubiKey
  * cmd: Get public key of an existing private key
  * cmd: Improve output of the status command to include slots with only a
    private key stored
  * cmd: Fix OID for attestation cross-signature extensions
  * cmd: Deprecate the --scp11 flag and rename it to --enc</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773835200">- update to 2.7.3:
  * ykcs11: Add support for ECDH derivation with X25519 key
  * lib: Improve usability with Windows
  * lib: Improve integration with minidriver
  * lib: Fix length calculation when importing RSA keys
  * lib: Improve error handling when no readers are available
  * build: Upgrade CMake minimum required version to 3.15
- cmake-flags-upstream-issue-474.patch: refresh</changelog>
</package>
<package pkgid="43a53dcd5bf8b86f82776513b4554ce733568214798e160112bb6d29e2192dac3233bdf7910f9b1a563eb0722d1fec598739af05e7f6b36c54aa84d4a00ad8cd" name="libykcs11-2-debuginfo" arch="s390x">
  <version epoch="0" ver="2.7.3" rel="57.4"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1677844800">- update to 2.3.1:
  * ykpiv: Add support for T=0 smartcards
  * ykpiv: ykcs11: Minor code optimization
  * ykpiv: ykcs11: Improve logging
  * ykpiv: ykcs11: Improve error handling
  * ykpiv: ykcs11: Fix minor bugs
  * ykcs11: Add support for several PKCS11 Attributes
  * ykcs11: Add support for CKM_ECDSA_SHA512 mechanism
  * ykcs11: Fix incorrect value for public key attributes
    CKA_PRIVATE, CKA_SENSITIVE, CKA_ALWAYS_SENSITIVE,
    CKA_EXTRACTABLE and CKA_NEVER_EXTRACTABLE
  * doc: Minor documentation improvement</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1702814400">- update to 2.4.2:
  * ykpiv: Fix potential type casting bug.
  * ykpiv: ykcs11: Fix building on certain architectures.
  * ykpiv: cmd: Add support for compressing certificate upon
    import
  * ykcs11: Increase maximum number of slots to handle
    overflow
  * ykcs11: Add support for CKA_COPYABLE and CKA_DESTROYABLE
    attributes</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707307200">- update to 2.5.0:
  * ykpiv: cmd: ykcs11: Add support for RSA3072 and RSA4096 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for ED25519 and X25519 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for deleting keys.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for moving keys between slots.
    Available in firmware 5.7.0 and newer
- add temporary-cmake-flags-fix.patch
  The included cmake modules are buggy. This patch should be removed once the
  root cause is fixed in upstream.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707912000">- update to 2.5.1:
  * ykpiv: cmd: ykcs11: Fix buffer size for key import.
- add cmake-flags-upstream-issue-474.patch:
  proper fix for the cmake flags issue
- remove temporary-cmake-flags-fix.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1715083200">- update to 2.5.2:
  * cmd: Fix signing selfsigned certificate for ED25519 key.
- update cmake-flags-upstream-issue-474.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1724673600">- update to 2.6.0:
  * cmd: Add support for biometric verification and match policy
  * ykcs11: Add support for PKCS11 3.0
  * ykpiv: cmd: ykcs11: Improve error traceability
  * ykpiv: cmd: ykcs11: Fix minor bugs
  * build: Make building with zlib optional</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1726142400">- update to 2.6.1:
  * cmd: Fix performing bio verification
  * ykcs11: Fix handling ED25519 and X25519 keys</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1734609600">- update to 2.7.0:
  * ykpiv: cmd: Add support for communication over a secure channel according
    to SCP11b specifications
  * ykpiv: cmd: Add support for device global reset</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1739102400">- update to 2.7.1:
  * ykpiv: Fix type casting issues affecting systems using
    Big-endian architecture</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1754568000">- update to 2.7.2:
  * ykcs11: Handle a silent verification failure when opening a PKCS11 session.
    No impact on authentication enforcement for the usage of credentials on the
    YubiKey
  * ykcs11: Use "VERIFY_NONE" as PIN to skip verification when using keys with
    PIN policy "never"
  * ykcs11: Use "VERIFY_BIO" as PIN to trigger bio verification on the YubiKey
  * cmd: Get public key of an existing private key
  * cmd: Improve output of the status command to include slots with only a
    private key stored
  * cmd: Fix OID for attestation cross-signature extensions
  * cmd: Deprecate the --scp11 flag and rename it to --enc</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773835200">- update to 2.7.3:
  * ykcs11: Add support for ECDH derivation with X25519 key
  * lib: Improve usability with Windows
  * lib: Improve integration with minidriver
  * lib: Fix length calculation when importing RSA keys
  * lib: Improve error handling when no readers are available
  * build: Upgrade CMake minimum required version to 3.15
- cmake-flags-upstream-issue-474.patch: refresh</changelog>
</package>
<package pkgid="2d14be5271aafa8d03ef768161cc55f5ec45d68c468ee3a7d06949a8112710b0a8307b7029abbe23e030b11ecfd553df4e55fcb27655212235eb92e6a65c1a28" name="libykcs11-devel" arch="s390x">
  <version epoch="0" ver="2.7.3" rel="57.4"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1677844800">- update to 2.3.1:
  * ykpiv: Add support for T=0 smartcards
  * ykpiv: ykcs11: Minor code optimization
  * ykpiv: ykcs11: Improve logging
  * ykpiv: ykcs11: Improve error handling
  * ykpiv: ykcs11: Fix minor bugs
  * ykcs11: Add support for several PKCS11 Attributes
  * ykcs11: Add support for CKM_ECDSA_SHA512 mechanism
  * ykcs11: Fix incorrect value for public key attributes
    CKA_PRIVATE, CKA_SENSITIVE, CKA_ALWAYS_SENSITIVE,
    CKA_EXTRACTABLE and CKA_NEVER_EXTRACTABLE
  * doc: Minor documentation improvement</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1702814400">- update to 2.4.2:
  * ykpiv: Fix potential type casting bug.
  * ykpiv: ykcs11: Fix building on certain architectures.
  * ykpiv: cmd: Add support for compressing certificate upon
    import
  * ykcs11: Increase maximum number of slots to handle
    overflow
  * ykcs11: Add support for CKA_COPYABLE and CKA_DESTROYABLE
    attributes</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707307200">- update to 2.5.0:
  * ykpiv: cmd: ykcs11: Add support for RSA3072 and RSA4096 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for ED25519 and X25519 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for deleting keys.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for moving keys between slots.
    Available in firmware 5.7.0 and newer
- add temporary-cmake-flags-fix.patch
  The included cmake modules are buggy. This patch should be removed once the
  root cause is fixed in upstream.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707912000">- update to 2.5.1:
  * ykpiv: cmd: ykcs11: Fix buffer size for key import.
- add cmake-flags-upstream-issue-474.patch:
  proper fix for the cmake flags issue
- remove temporary-cmake-flags-fix.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1715083200">- update to 2.5.2:
  * cmd: Fix signing selfsigned certificate for ED25519 key.
- update cmake-flags-upstream-issue-474.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1724673600">- update to 2.6.0:
  * cmd: Add support for biometric verification and match policy
  * ykcs11: Add support for PKCS11 3.0
  * ykpiv: cmd: ykcs11: Improve error traceability
  * ykpiv: cmd: ykcs11: Fix minor bugs
  * build: Make building with zlib optional</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1726142400">- update to 2.6.1:
  * cmd: Fix performing bio verification
  * ykcs11: Fix handling ED25519 and X25519 keys</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1734609600">- update to 2.7.0:
  * ykpiv: cmd: Add support for communication over a secure channel according
    to SCP11b specifications
  * ykpiv: cmd: Add support for device global reset</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1739102400">- update to 2.7.1:
  * ykpiv: Fix type casting issues affecting systems using
    Big-endian architecture</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1754568000">- update to 2.7.2:
  * ykcs11: Handle a silent verification failure when opening a PKCS11 session.
    No impact on authentication enforcement for the usage of credentials on the
    YubiKey
  * ykcs11: Use "VERIFY_NONE" as PIN to skip verification when using keys with
    PIN policy "never"
  * ykcs11: Use "VERIFY_BIO" as PIN to trigger bio verification on the YubiKey
  * cmd: Get public key of an existing private key
  * cmd: Improve output of the status command to include slots with only a
    private key stored
  * cmd: Fix OID for attestation cross-signature extensions
  * cmd: Deprecate the --scp11 flag and rename it to --enc</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773835200">- update to 2.7.3:
  * ykcs11: Add support for ECDH derivation with X25519 key
  * lib: Improve usability with Windows
  * lib: Improve integration with minidriver
  * lib: Fix length calculation when importing RSA keys
  * lib: Improve error handling when no readers are available
  * build: Upgrade CMake minimum required version to 3.15
- cmake-flags-upstream-issue-474.patch: refresh</changelog>
</package>
<package pkgid="e6c193665231eff6026b8a130bae9126bc38b5b12a93bc69b7fd1ccb055cb70eada5cf52aefea7ebe642992f4f8832ce9c9f4139da0a2f40eea091fc6b78f2de" name="libykhsmauth2" arch="s390x">
  <version epoch="0" ver="2.6.0" rel="3.8"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="3f87f46577af4f8c6c4c56753fa0462ddfa956fdd8a861dbf042a1ee1c4d108bf8ce81ef62ade3debba496c94d906c0be263104b0f949c9b3c929f9583ee3ff9" name="libykhsmauth2-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.0" rel="3.8"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="35b972a01d34fc0cd785f7bd05b25c16f5c7a9ac35cf1d982e861d5dffb95e75c67cc639a7e0efb2801dcf0c62c08a79c77bed376498c10dfce047beefe46a54" name="libykpers-1-1" arch="s390x">
  <version epoch="0" ver="1.20.0" rel="32.58"/>
  <changelog author="meissner@suse.com" date="1492603200">- updated to 1.18.0 (released 2017-01-27)
  - Let ykchalresp read challenge from a file.
  - Add support of working with a numbered key when many connected Thanks to Thomas Habets &lt;habets@google.com&gt;
  - Documentation clarifications.
  - Fixup argument parsing of flags with optional arguments on BSD platforms.
  - Fix a file descriptor leak on windows.</changelog>
  <changelog author="wr@rosenauer.org" date="1523188800">- updated to 1.18.1 (released 2018-01-16)
  - Support reading accesscode and private ID from stdin.
  - Parse optional arguments correctly.
  - Documentation fixes.
  - Fix for ykinfo modhex serial output when it ends with c.
  - Treat all firmware versions as supported.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1538049600">- Version 1.19.0 (released 2018-04-24)
  - Add yk_write_device_info().
  - Add ykpersonalize cli switch -D for device info.
  - Add code for handling personalization interface of major version 5.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1538136000">- Fix RPM groups.
- Use noun phrase in summary.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550577600">- Version 1.19.1 (released 2019-02-19)
  - Error out on json output with randomSeed.
  - Validate more length fields.
  - Use correct FormatMessage function on windows.
  - Overflow, bounds and error condition checks.
  - Try to zero sensitive memory better.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550577601">- Version 1.19.2 (released 2019-02-19)
  - Fix test on mac.
  - Fix serial read and challenge response.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550836800">- Version 1.19.3 (released 2019-02-22)
  - Fix capability read.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1563105600">- Version 1.20.0 (released 2019-07-03d)
  - Add yk_open_key_vid_pid() allowing vid and pid to be specified.
  - Documentation fixes.
  - Clear potentially sensitive material from buffers.
  - Fix potential buffer overwrite.
- Applied spec-cleaner</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1591617600">- Fix build with gcc 10 [gh#Yubico/yubikey-personalization#155]
- Fix boolean value with json-c 0.14 [gh#Yubico/yubikey-personalization#159]
  adds ykpers-json.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1623067200">- Drop --with-pic (no effect with --disable-static)</changelog>
</package>
<package pkgid="5c90836f27d020c4f8c6ce265ee3fad34d0157f6971c1afeaa61b46af19b32a452e54a7b65121ac8237fe500b954cdd9e13bfd04fea3f750d6fd772822303b70" name="libykpers-1-1-debuginfo" arch="s390x">
  <version epoch="0" ver="1.20.0" rel="32.58"/>
  <changelog author="meissner@suse.com" date="1492603200">- updated to 1.18.0 (released 2017-01-27)
  - Let ykchalresp read challenge from a file.
  - Add support of working with a numbered key when many connected Thanks to Thomas Habets &lt;habets@google.com&gt;
  - Documentation clarifications.
  - Fixup argument parsing of flags with optional arguments on BSD platforms.
  - Fix a file descriptor leak on windows.</changelog>
  <changelog author="wr@rosenauer.org" date="1523188800">- updated to 1.18.1 (released 2018-01-16)
  - Support reading accesscode and private ID from stdin.
  - Parse optional arguments correctly.
  - Documentation fixes.
  - Fix for ykinfo modhex serial output when it ends with c.
  - Treat all firmware versions as supported.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1538049600">- Version 1.19.0 (released 2018-04-24)
  - Add yk_write_device_info().
  - Add ykpersonalize cli switch -D for device info.
  - Add code for handling personalization interface of major version 5.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1538136000">- Fix RPM groups.
- Use noun phrase in summary.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550577600">- Version 1.19.1 (released 2019-02-19)
  - Error out on json output with randomSeed.
  - Validate more length fields.
  - Use correct FormatMessage function on windows.
  - Overflow, bounds and error condition checks.
  - Try to zero sensitive memory better.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550577601">- Version 1.19.2 (released 2019-02-19)
  - Fix test on mac.
  - Fix serial read and challenge response.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550836800">- Version 1.19.3 (released 2019-02-22)
  - Fix capability read.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1563105600">- Version 1.20.0 (released 2019-07-03d)
  - Add yk_open_key_vid_pid() allowing vid and pid to be specified.
  - Documentation fixes.
  - Clear potentially sensitive material from buffers.
  - Fix potential buffer overwrite.
- Applied spec-cleaner</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1591617600">- Fix build with gcc 10 [gh#Yubico/yubikey-personalization#155]
- Fix boolean value with json-c 0.14 [gh#Yubico/yubikey-personalization#159]
  adds ykpers-json.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1623067200">- Drop --with-pic (no effect with --disable-static)</changelog>
</package>
<package pkgid="2a171a785ba287c2aefaf47e089e44de0bf6ddfa786f015c871787e910109e2a9b9d0e057b00d9303a9f7ce65b33db73638af64f670f68d888f2c1a1af144443" name="libykpers-devel" arch="s390x">
  <version epoch="0" ver="1.20.0" rel="32.58"/>
  <changelog author="meissner@suse.com" date="1492603200">- updated to 1.18.0 (released 2017-01-27)
  - Let ykchalresp read challenge from a file.
  - Add support of working with a numbered key when many connected Thanks to Thomas Habets &lt;habets@google.com&gt;
  - Documentation clarifications.
  - Fixup argument parsing of flags with optional arguments on BSD platforms.
  - Fix a file descriptor leak on windows.</changelog>
  <changelog author="wr@rosenauer.org" date="1523188800">- updated to 1.18.1 (released 2018-01-16)
  - Support reading accesscode and private ID from stdin.
  - Parse optional arguments correctly.
  - Documentation fixes.
  - Fix for ykinfo modhex serial output when it ends with c.
  - Treat all firmware versions as supported.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1538049600">- Version 1.19.0 (released 2018-04-24)
  - Add yk_write_device_info().
  - Add ykpersonalize cli switch -D for device info.
  - Add code for handling personalization interface of major version 5.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1538136000">- Fix RPM groups.
- Use noun phrase in summary.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550577600">- Version 1.19.1 (released 2019-02-19)
  - Error out on json output with randomSeed.
  - Validate more length fields.
  - Use correct FormatMessage function on windows.
  - Overflow, bounds and error condition checks.
  - Try to zero sensitive memory better.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550577601">- Version 1.19.2 (released 2019-02-19)
  - Fix test on mac.
  - Fix serial read and challenge response.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550836800">- Version 1.19.3 (released 2019-02-22)
  - Fix capability read.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1563105600">- Version 1.20.0 (released 2019-07-03d)
  - Add yk_open_key_vid_pid() allowing vid and pid to be specified.
  - Documentation fixes.
  - Clear potentially sensitive material from buffers.
  - Fix potential buffer overwrite.
- Applied spec-cleaner</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1591617600">- Fix build with gcc 10 [gh#Yubico/yubikey-personalization#155]
- Fix boolean value with json-c 0.14 [gh#Yubico/yubikey-personalization#159]
  adds ykpers-json.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1623067200">- Drop --with-pic (no effect with --disable-static)</changelog>
</package>
<package pkgid="bff8eae0a6584e8dc6967e2ce18ea6dd2ae9f46aefee91b15c66469570ed28ed9b32fc93b5c234e4750e0455ca7e34930a4e17f360708970079bccb77c822de6" name="libykpiv-devel" arch="s390x">
  <version epoch="0" ver="2.7.3" rel="57.4"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1677844800">- update to 2.3.1:
  * ykpiv: Add support for T=0 smartcards
  * ykpiv: ykcs11: Minor code optimization
  * ykpiv: ykcs11: Improve logging
  * ykpiv: ykcs11: Improve error handling
  * ykpiv: ykcs11: Fix minor bugs
  * ykcs11: Add support for several PKCS11 Attributes
  * ykcs11: Add support for CKM_ECDSA_SHA512 mechanism
  * ykcs11: Fix incorrect value for public key attributes
    CKA_PRIVATE, CKA_SENSITIVE, CKA_ALWAYS_SENSITIVE,
    CKA_EXTRACTABLE and CKA_NEVER_EXTRACTABLE
  * doc: Minor documentation improvement</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1702814400">- update to 2.4.2:
  * ykpiv: Fix potential type casting bug.
  * ykpiv: ykcs11: Fix building on certain architectures.
  * ykpiv: cmd: Add support for compressing certificate upon
    import
  * ykcs11: Increase maximum number of slots to handle
    overflow
  * ykcs11: Add support for CKA_COPYABLE and CKA_DESTROYABLE
    attributes</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707307200">- update to 2.5.0:
  * ykpiv: cmd: ykcs11: Add support for RSA3072 and RSA4096 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for ED25519 and X25519 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for deleting keys.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for moving keys between slots.
    Available in firmware 5.7.0 and newer
- add temporary-cmake-flags-fix.patch
  The included cmake modules are buggy. This patch should be removed once the
  root cause is fixed in upstream.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707912000">- update to 2.5.1:
  * ykpiv: cmd: ykcs11: Fix buffer size for key import.
- add cmake-flags-upstream-issue-474.patch:
  proper fix for the cmake flags issue
- remove temporary-cmake-flags-fix.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1715083200">- update to 2.5.2:
  * cmd: Fix signing selfsigned certificate for ED25519 key.
- update cmake-flags-upstream-issue-474.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1724673600">- update to 2.6.0:
  * cmd: Add support for biometric verification and match policy
  * ykcs11: Add support for PKCS11 3.0
  * ykpiv: cmd: ykcs11: Improve error traceability
  * ykpiv: cmd: ykcs11: Fix minor bugs
  * build: Make building with zlib optional</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1726142400">- update to 2.6.1:
  * cmd: Fix performing bio verification
  * ykcs11: Fix handling ED25519 and X25519 keys</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1734609600">- update to 2.7.0:
  * ykpiv: cmd: Add support for communication over a secure channel according
    to SCP11b specifications
  * ykpiv: cmd: Add support for device global reset</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1739102400">- update to 2.7.1:
  * ykpiv: Fix type casting issues affecting systems using
    Big-endian architecture</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1754568000">- update to 2.7.2:
  * ykcs11: Handle a silent verification failure when opening a PKCS11 session.
    No impact on authentication enforcement for the usage of credentials on the
    YubiKey
  * ykcs11: Use "VERIFY_NONE" as PIN to skip verification when using keys with
    PIN policy "never"
  * ykcs11: Use "VERIFY_BIO" as PIN to trigger bio verification on the YubiKey
  * cmd: Get public key of an existing private key
  * cmd: Improve output of the status command to include slots with only a
    private key stored
  * cmd: Fix OID for attestation cross-signature extensions
  * cmd: Deprecate the --scp11 flag and rename it to --enc</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773835200">- update to 2.7.3:
  * ykcs11: Add support for ECDH derivation with X25519 key
  * lib: Improve usability with Windows
  * lib: Improve integration with minidriver
  * lib: Fix length calculation when importing RSA keys
  * lib: Improve error handling when no readers are available
  * build: Upgrade CMake minimum required version to 3.15
- cmake-flags-upstream-issue-474.patch: refresh</changelog>
</package>
<package pkgid="3556bb8342ff8a7892a6e7cdd4939fec75fbfd32fe33d6f0b038f1e41334ee48541dd95761b2037ef9c938bb1145743e474969f7bb1bc20c9b04eba44dd62feb" name="libykpiv2" arch="s390x">
  <version epoch="0" ver="2.7.3" rel="57.4"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1677844800">- update to 2.3.1:
  * ykpiv: Add support for T=0 smartcards
  * ykpiv: ykcs11: Minor code optimization
  * ykpiv: ykcs11: Improve logging
  * ykpiv: ykcs11: Improve error handling
  * ykpiv: ykcs11: Fix minor bugs
  * ykcs11: Add support for several PKCS11 Attributes
  * ykcs11: Add support for CKM_ECDSA_SHA512 mechanism
  * ykcs11: Fix incorrect value for public key attributes
    CKA_PRIVATE, CKA_SENSITIVE, CKA_ALWAYS_SENSITIVE,
    CKA_EXTRACTABLE and CKA_NEVER_EXTRACTABLE
  * doc: Minor documentation improvement</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1702814400">- update to 2.4.2:
  * ykpiv: Fix potential type casting bug.
  * ykpiv: ykcs11: Fix building on certain architectures.
  * ykpiv: cmd: Add support for compressing certificate upon
    import
  * ykcs11: Increase maximum number of slots to handle
    overflow
  * ykcs11: Add support for CKA_COPYABLE and CKA_DESTROYABLE
    attributes</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707307200">- update to 2.5.0:
  * ykpiv: cmd: ykcs11: Add support for RSA3072 and RSA4096 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for ED25519 and X25519 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for deleting keys.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for moving keys between slots.
    Available in firmware 5.7.0 and newer
- add temporary-cmake-flags-fix.patch
  The included cmake modules are buggy. This patch should be removed once the
  root cause is fixed in upstream.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707912000">- update to 2.5.1:
  * ykpiv: cmd: ykcs11: Fix buffer size for key import.
- add cmake-flags-upstream-issue-474.patch:
  proper fix for the cmake flags issue
- remove temporary-cmake-flags-fix.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1715083200">- update to 2.5.2:
  * cmd: Fix signing selfsigned certificate for ED25519 key.
- update cmake-flags-upstream-issue-474.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1724673600">- update to 2.6.0:
  * cmd: Add support for biometric verification and match policy
  * ykcs11: Add support for PKCS11 3.0
  * ykpiv: cmd: ykcs11: Improve error traceability
  * ykpiv: cmd: ykcs11: Fix minor bugs
  * build: Make building with zlib optional</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1726142400">- update to 2.6.1:
  * cmd: Fix performing bio verification
  * ykcs11: Fix handling ED25519 and X25519 keys</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1734609600">- update to 2.7.0:
  * ykpiv: cmd: Add support for communication over a secure channel according
    to SCP11b specifications
  * ykpiv: cmd: Add support for device global reset</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1739102400">- update to 2.7.1:
  * ykpiv: Fix type casting issues affecting systems using
    Big-endian architecture</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1754568000">- update to 2.7.2:
  * ykcs11: Handle a silent verification failure when opening a PKCS11 session.
    No impact on authentication enforcement for the usage of credentials on the
    YubiKey
  * ykcs11: Use "VERIFY_NONE" as PIN to skip verification when using keys with
    PIN policy "never"
  * ykcs11: Use "VERIFY_BIO" as PIN to trigger bio verification on the YubiKey
  * cmd: Get public key of an existing private key
  * cmd: Improve output of the status command to include slots with only a
    private key stored
  * cmd: Fix OID for attestation cross-signature extensions
  * cmd: Deprecate the --scp11 flag and rename it to --enc</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773835200">- update to 2.7.3:
  * ykcs11: Add support for ECDH derivation with X25519 key
  * lib: Improve usability with Windows
  * lib: Improve integration with minidriver
  * lib: Fix length calculation when importing RSA keys
  * lib: Improve error handling when no readers are available
  * build: Upgrade CMake minimum required version to 3.15
- cmake-flags-upstream-issue-474.patch: refresh</changelog>
</package>
<package pkgid="414ef47c08d15588332e6b0bbb984306e2822fd38d7dab6955070b07f13b169e5ea4b635ac6c6f42a87f3b1682a13c46026421df015a8814d1226d1ef8498935" name="libykpiv2-debuginfo" arch="s390x">
  <version epoch="0" ver="2.7.3" rel="57.4"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1677844800">- update to 2.3.1:
  * ykpiv: Add support for T=0 smartcards
  * ykpiv: ykcs11: Minor code optimization
  * ykpiv: ykcs11: Improve logging
  * ykpiv: ykcs11: Improve error handling
  * ykpiv: ykcs11: Fix minor bugs
  * ykcs11: Add support for several PKCS11 Attributes
  * ykcs11: Add support for CKM_ECDSA_SHA512 mechanism
  * ykcs11: Fix incorrect value for public key attributes
    CKA_PRIVATE, CKA_SENSITIVE, CKA_ALWAYS_SENSITIVE,
    CKA_EXTRACTABLE and CKA_NEVER_EXTRACTABLE
  * doc: Minor documentation improvement</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1702814400">- update to 2.4.2:
  * ykpiv: Fix potential type casting bug.
  * ykpiv: ykcs11: Fix building on certain architectures.
  * ykpiv: cmd: Add support for compressing certificate upon
    import
  * ykcs11: Increase maximum number of slots to handle
    overflow
  * ykcs11: Add support for CKA_COPYABLE and CKA_DESTROYABLE
    attributes</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707307200">- update to 2.5.0:
  * ykpiv: cmd: ykcs11: Add support for RSA3072 and RSA4096 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for ED25519 and X25519 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for deleting keys.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for moving keys between slots.
    Available in firmware 5.7.0 and newer
- add temporary-cmake-flags-fix.patch
  The included cmake modules are buggy. This patch should be removed once the
  root cause is fixed in upstream.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707912000">- update to 2.5.1:
  * ykpiv: cmd: ykcs11: Fix buffer size for key import.
- add cmake-flags-upstream-issue-474.patch:
  proper fix for the cmake flags issue
- remove temporary-cmake-flags-fix.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1715083200">- update to 2.5.2:
  * cmd: Fix signing selfsigned certificate for ED25519 key.
- update cmake-flags-upstream-issue-474.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1724673600">- update to 2.6.0:
  * cmd: Add support for biometric verification and match policy
  * ykcs11: Add support for PKCS11 3.0
  * ykpiv: cmd: ykcs11: Improve error traceability
  * ykpiv: cmd: ykcs11: Fix minor bugs
  * build: Make building with zlib optional</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1726142400">- update to 2.6.1:
  * cmd: Fix performing bio verification
  * ykcs11: Fix handling ED25519 and X25519 keys</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1734609600">- update to 2.7.0:
  * ykpiv: cmd: Add support for communication over a secure channel according
    to SCP11b specifications
  * ykpiv: cmd: Add support for device global reset</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1739102400">- update to 2.7.1:
  * ykpiv: Fix type casting issues affecting systems using
    Big-endian architecture</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1754568000">- update to 2.7.2:
  * ykcs11: Handle a silent verification failure when opening a PKCS11 session.
    No impact on authentication enforcement for the usage of credentials on the
    YubiKey
  * ykcs11: Use "VERIFY_NONE" as PIN to skip verification when using keys with
    PIN policy "never"
  * ykcs11: Use "VERIFY_BIO" as PIN to trigger bio verification on the YubiKey
  * cmd: Get public key of an existing private key
  * cmd: Improve output of the status command to include slots with only a
    private key stored
  * cmd: Fix OID for attestation cross-signature extensions
  * cmd: Deprecate the --scp11 flag and rename it to --enc</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773835200">- update to 2.7.3:
  * ykcs11: Add support for ECDH derivation with X25519 key
  * lib: Improve usability with Windows
  * lib: Improve integration with minidriver
  * lib: Fix length calculation when importing RSA keys
  * lib: Improve error handling when no readers are available
  * build: Upgrade CMake minimum required version to 3.15
- cmake-flags-upstream-issue-474.patch: refresh</changelog>
</package>
<package pkgid="9f2e116c324e1d5ced562a4f9f467126da5e23995c21bb1608f1eee54e37cd4aaa4f222fc71ebbc450800a91be7e1af53fae274d8bf9904c6b9787076de86d55" name="libyubihsm2" arch="s390x">
  <version epoch="0" ver="2.6.0" rel="3.8"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="32d437b06d564bd803f4a6cfdb20d1ee95b3c74e37e082621d9185eae7269c8e95e3d4bd961985b359e05c911a2dad52a12cd7764afd7232b11359ffa6fe2cfa" name="libyubihsm2-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.0" rel="3.8"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="4de2490f0d6b442ab62bbbfcae12b1ae6f54fc1c07db701a2276eb1689f8ebdbf87c53cbc83c2f2868f17dccb6edba8818582d070673a2284f9fbe3507412025" name="libyubikey" arch="src">
  <version epoch="0" ver="1.13" rel="10.47"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial package, version 1.7</changelog>
  <changelog author="mmarek@suse.cz" date="1412337600">- Updated to version 1.12
  - minor bug and warning fixes, added manpages
- Dropped patch: libyubikey-1.7-rpath-and-auto.patch
- Fix package license</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1420891200">- spec file clean up
  - change URL: to point to developers.yubico.com
  - change Source: to point to new developers.yubico.com download
  - ran spec-cleaner
- create a new sub-package (-tools) for binary executables
  - contains modhex, ykgenerate, ykparse, %{_mandir}/man1/*</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 1.13 (released 2015-03-05)
  - Correct hex decode with uneven characters, for example "abc".</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- add COPYING AUTHORS NEWS to shipped packages (COPYING as legal req)</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: --with-pic is useless because no static libs are built.
  Remove stray leading newline in description.</changelog>
  <changelog author="mpluskal@suse.com" date="1498478400">- Add gpg signature
- Make building more verbose
- Enable internal testsuite</changelog>
</package>
<package pkgid="98b00091d462053b8584274fcd796ade4acac6701953c7ac748dcad4fb2ffc894c1cc2738b57e83a52454cbf84dbb8e675913710b064407a52b3d510d0099892" name="libyubikey-debuginfo" arch="s390x">
  <version epoch="0" ver="1.13" rel="10.47"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial package, version 1.7</changelog>
  <changelog author="mmarek@suse.cz" date="1412337600">- Updated to version 1.12
  - minor bug and warning fixes, added manpages
- Dropped patch: libyubikey-1.7-rpath-and-auto.patch
- Fix package license</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1420891200">- spec file clean up
  - change URL: to point to developers.yubico.com
  - change Source: to point to new developers.yubico.com download
  - ran spec-cleaner
- create a new sub-package (-tools) for binary executables
  - contains modhex, ykgenerate, ykparse, %{_mandir}/man1/*</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 1.13 (released 2015-03-05)
  - Correct hex decode with uneven characters, for example "abc".</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- add COPYING AUTHORS NEWS to shipped packages (COPYING as legal req)</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: --with-pic is useless because no static libs are built.
  Remove stray leading newline in description.</changelog>
  <changelog author="mpluskal@suse.com" date="1498478400">- Add gpg signature
- Make building more verbose
- Enable internal testsuite</changelog>
</package>
<package pkgid="c3baf25e525dc331738e6796acb64a611551bf612a84f8eb3c34f90fef1eb2ac449ebf052520b812d2109b078f871f7e03a1bb87a434388f4e3bc448eb80d22a" name="libyubikey-debugsource" arch="s390x">
  <version epoch="0" ver="1.13" rel="10.47"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial package, version 1.7</changelog>
  <changelog author="mmarek@suse.cz" date="1412337600">- Updated to version 1.12
  - minor bug and warning fixes, added manpages
- Dropped patch: libyubikey-1.7-rpath-and-auto.patch
- Fix package license</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1420891200">- spec file clean up
  - change URL: to point to developers.yubico.com
  - change Source: to point to new developers.yubico.com download
  - ran spec-cleaner
- create a new sub-package (-tools) for binary executables
  - contains modhex, ykgenerate, ykparse, %{_mandir}/man1/*</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 1.13 (released 2015-03-05)
  - Correct hex decode with uneven characters, for example "abc".</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- add COPYING AUTHORS NEWS to shipped packages (COPYING as legal req)</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: --with-pic is useless because no static libs are built.
  Remove stray leading newline in description.</changelog>
  <changelog author="mpluskal@suse.com" date="1498478400">- Add gpg signature
- Make building more verbose
- Enable internal testsuite</changelog>
</package>
<package pkgid="0ab8bf936e4c8cd137bfc6ee7f9b56fab60cd261e8c4fb4673faba09294356b1ada2be2e8a2ac21c17ab873a11d437170595889b6f4feb28353a1c029bbe9604" name="libyubikey-devel" arch="s390x">
  <version epoch="0" ver="1.13" rel="10.47"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial package, version 1.7</changelog>
  <changelog author="mmarek@suse.cz" date="1412337600">- Updated to version 1.12
  - minor bug and warning fixes, added manpages
- Dropped patch: libyubikey-1.7-rpath-and-auto.patch
- Fix package license</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1420891200">- spec file clean up
  - change URL: to point to developers.yubico.com
  - change Source: to point to new developers.yubico.com download
  - ran spec-cleaner
- create a new sub-package (-tools) for binary executables
  - contains modhex, ykgenerate, ykparse, %{_mandir}/man1/*</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 1.13 (released 2015-03-05)
  - Correct hex decode with uneven characters, for example "abc".</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- add COPYING AUTHORS NEWS to shipped packages (COPYING as legal req)</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: --with-pic is useless because no static libs are built.
  Remove stray leading newline in description.</changelog>
  <changelog author="mpluskal@suse.com" date="1498478400">- Add gpg signature
- Make building more verbose
- Enable internal testsuite</changelog>
</package>
<package pkgid="e1f2957b6faad346fa5b75b03bbebd66fc223dd1a9a390f9ff9e475f014221044c87c62f41ac0760025bb95b66df1707b69f00cdad2f2e4bd284c46505b8a8fe" name="libyubikey-tools" arch="s390x">
  <version epoch="0" ver="1.13" rel="10.47"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial package, version 1.7</changelog>
  <changelog author="mmarek@suse.cz" date="1412337600">- Updated to version 1.12
  - minor bug and warning fixes, added manpages
- Dropped patch: libyubikey-1.7-rpath-and-auto.patch
- Fix package license</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1420891200">- spec file clean up
  - change URL: to point to developers.yubico.com
  - change Source: to point to new developers.yubico.com download
  - ran spec-cleaner
- create a new sub-package (-tools) for binary executables
  - contains modhex, ykgenerate, ykparse, %{_mandir}/man1/*</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 1.13 (released 2015-03-05)
  - Correct hex decode with uneven characters, for example "abc".</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- add COPYING AUTHORS NEWS to shipped packages (COPYING as legal req)</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: --with-pic is useless because no static libs are built.
  Remove stray leading newline in description.</changelog>
  <changelog author="mpluskal@suse.com" date="1498478400">- Add gpg signature
- Make building more verbose
- Enable internal testsuite</changelog>
</package>
<package pkgid="fac9f91a8e23e65dd0e8cda4020c34d28acc5578c7207ed08deeb48c53685d3ff72d0d4586a5f0e7dde5ca83a6139c256b508b3d3d4802335368c50ece5b14a2" name="libyubikey-tools-debuginfo" arch="s390x">
  <version epoch="0" ver="1.13" rel="10.47"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial package, version 1.7</changelog>
  <changelog author="mmarek@suse.cz" date="1412337600">- Updated to version 1.12
  - minor bug and warning fixes, added manpages
- Dropped patch: libyubikey-1.7-rpath-and-auto.patch
- Fix package license</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1420891200">- spec file clean up
  - change URL: to point to developers.yubico.com
  - change Source: to point to new developers.yubico.com download
  - ran spec-cleaner
- create a new sub-package (-tools) for binary executables
  - contains modhex, ykgenerate, ykparse, %{_mandir}/man1/*</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 1.13 (released 2015-03-05)
  - Correct hex decode with uneven characters, for example "abc".</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- add COPYING AUTHORS NEWS to shipped packages (COPYING as legal req)</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: --with-pic is useless because no static libs are built.
  Remove stray leading newline in description.</changelog>
  <changelog author="mpluskal@suse.com" date="1498478400">- Add gpg signature
- Make building more verbose
- Enable internal testsuite</changelog>
</package>
<package pkgid="d51eaa1f0ecdb3c072d63bb279eb774eb1a37ea931388a1c4d300917162bab22d7cbd76b10a800ea9193838f57498a83c5a6a7e400fe35c0bf9c238c4ab19e53" name="libyubikey0" arch="s390x">
  <version epoch="0" ver="1.13" rel="10.47"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial package, version 1.7</changelog>
  <changelog author="mmarek@suse.cz" date="1412337600">- Updated to version 1.12
  - minor bug and warning fixes, added manpages
- Dropped patch: libyubikey-1.7-rpath-and-auto.patch
- Fix package license</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1420891200">- spec file clean up
  - change URL: to point to developers.yubico.com
  - change Source: to point to new developers.yubico.com download
  - ran spec-cleaner
- create a new sub-package (-tools) for binary executables
  - contains modhex, ykgenerate, ykparse, %{_mandir}/man1/*</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 1.13 (released 2015-03-05)
  - Correct hex decode with uneven characters, for example "abc".</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- add COPYING AUTHORS NEWS to shipped packages (COPYING as legal req)</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: --with-pic is useless because no static libs are built.
  Remove stray leading newline in description.</changelog>
  <changelog author="mpluskal@suse.com" date="1498478400">- Add gpg signature
- Make building more verbose
- Enable internal testsuite</changelog>
</package>
<package pkgid="b48b096da655c29677a831cb2b0e6aafc57f7eff88d8e1200371a6d09462181b774fb322e9c66ddb63dd792779f2885c47c71c34fe59d95351c48cc49b934693" name="libyubikey0-debuginfo" arch="s390x">
  <version epoch="0" ver="1.13" rel="10.47"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial package, version 1.7</changelog>
  <changelog author="mmarek@suse.cz" date="1412337600">- Updated to version 1.12
  - minor bug and warning fixes, added manpages
- Dropped patch: libyubikey-1.7-rpath-and-auto.patch
- Fix package license</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1420891200">- spec file clean up
  - change URL: to point to developers.yubico.com
  - change Source: to point to new developers.yubico.com download
  - ran spec-cleaner
- create a new sub-package (-tools) for binary executables
  - contains modhex, ykgenerate, ykparse, %{_mandir}/man1/*</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 1.13 (released 2015-03-05)
  - Correct hex decode with uneven characters, for example "abc".</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- add COPYING AUTHORS NEWS to shipped packages (COPYING as legal req)</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: --with-pic is useless because no static libs are built.
  Remove stray leading newline in description.</changelog>
  <changelog author="mpluskal@suse.com" date="1498478400">- Add gpg signature
- Make building more verbose
- Enable internal testsuite</changelog>
</package>
<package pkgid="7f5872a486fb813e54988cccb1f719f9cf33102138c73204b9815764d5ef3bc0c0cf45a1676aea761b2699e049e442815882cb3ea3e112cafd661fc91ca31e5f" name="libzpc" arch="s390x">
  <version epoch="0" ver="2.0.1" rel="36.2"/>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1675857600">- Upgrade to version 1.1.0 (jsc#PED-582)
  * Implements an ECC-KEY API : `zpc/ecc_key.h`.
  * Implements an ECDSA-CTX API : `zpc/ecdsa_ctx.h`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1695211200">- Version 1.1.1 (jsc#PED-5214)
  * Exploit PKEY_KBLOB2PROTK2 for AES EP11 version 6 keys</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1705320000">- Upgrade libzpc to version 1.2.0 (jsc#PED-3335)
  * Support for get/set intermediate iv for CBC and XTS
  * Support for internal iv for GCM
  * Exploit KBLOB2PROTK3 ioctl for clear AES and EC keys
  * Fix AES EP11 version 6 key support for generate and import_clear</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739448000">- Upgrade libzpc to version 1.3.0 (jsc#PED-11163, jsc#PED-10294)
  - [FEATURE] Support for Ultravisor retrievable secrets
  - [PATCH] Handle CCA cipher key token with Encrypted V0 payload
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739880000">- License update to MIT</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1744027200">- Upgrade libzpc to 1.3.1
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade libzpc to version 1.4.0 (jsc#PED-11163)
  - [FEATURE] Support for MSA 10 (XTS-FULL) and MSA 11 (HMAC)
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767787200">- Upgrade libzpc to 1.4.1
  (jsc#PED-14603, jsc#PED-15051, jsc#PED-15049, jsc#PED-15023)
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1770379200">- Upgrade libzpc to version 1.5.0 (jsc#PED-14603, jsc#PED-14275, jsc#PED-15049)
  * [FEATURE] Support live guest relocation</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1781697600">- Update to version 2.0.0:
  * Switch from a standalone shared library to an OpenSSL Provider layout.
  * Add the new `zpckey` key management utility tool.
  * Remove the old shared library API.
- Update the spec file configuration for the new package structure:
  * Remove the old `libzpc1` and `libzpc-devel` sub-packages.
  * Remove `ldconfig` calls because there is no longer a public shared library.
  * Add `Source1` to use a pre-generated tarball for man pages.
  * Turn off dynamic document building inside the compiler flags.
  * Clean up `BuildRequires` by adding `clang`, `libcrypto`, and `libssl`.
  * Remove unnecessary build tools like `doxygen` and `texlive-bibtex-bin`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782734400">- Upgrade libzpc to version 2.0.1 (jsc#PED-16483)
  * [FIX] Fix compile warnings and errors on i386/i686
  * spec: Remove the pandoc dependency
  * cmake: Change man-page related build target
  * cmake: Install pre-built man-pages
  * man: Update pre-built man-pages
  * Fix detection of PCC instruction availability
- Add new sub-packages
  * libzpc-provider*
  * libzpc-tools*
- Add libzpc-rpmlintrc file as Source1
- Obsoletes the libzpc-man-*.tar.gz file</changelog>
</package>
<package pkgid="62d46cc5cade736454be22acde1c116b50e4a2beb8126286f86afc1f488c78d1518986ec7bdd11a45788e4300a77ae4d69104515229eae09a153064b264e5bf8" name="libzpc" arch="src">
  <version epoch="0" ver="2.0.1" rel="36.2"/>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1634644800">- Initial version 1.0.0 (jsc#SLE-18746)</changelog>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1635768000">- Cleaned up the wording in the description. Updated the
  summaries to actually reflect the contents of the packages.
- Changed the %setup macro to use $autosetup instead.
- Added a BuildRequires for texlive-bibtex-bin</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1635854400">- libzpc-sles15p4-mark-stack-nonexec.patch: note the asssembler as
  non execstack
- libzpc-rpmlintrc removed</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651060800">- use source url</changelog>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1663070400">- Upgrade to version 1.0.1 (jsc#PED-582)
  * Updated spec file for rpm build
- Removed obsolete libzpc-sles15p4-mark-stack-nonexec.patch
- Updated spec file to use %{name} and %{version} variables in
  more places.</changelog>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1675857600">- Upgrade to version 1.1.0 (jsc#PED-582)
  * Implements an ECC-KEY API : `zpc/ecc_key.h`.
  * Implements an ECDSA-CTX API : `zpc/ecdsa_ctx.h`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1695211200">- Version 1.1.1 (jsc#PED-5214)
  * Exploit PKEY_KBLOB2PROTK2 for AES EP11 version 6 keys</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1705320000">- Upgrade libzpc to version 1.2.0 (jsc#PED-3335)
  * Support for get/set intermediate iv for CBC and XTS
  * Support for internal iv for GCM
  * Exploit KBLOB2PROTK3 ioctl for clear AES and EC keys
  * Fix AES EP11 version 6 key support for generate and import_clear</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739448000">- Upgrade libzpc to version 1.3.0 (jsc#PED-11163, jsc#PED-10294)
  - [FEATURE] Support for Ultravisor retrievable secrets
  - [PATCH] Handle CCA cipher key token with Encrypted V0 payload
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739880000">- License update to MIT</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1744027200">- Upgrade libzpc to 1.3.1
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade libzpc to version 1.4.0 (jsc#PED-11163)
  - [FEATURE] Support for MSA 10 (XTS-FULL) and MSA 11 (HMAC)
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767787200">- Upgrade libzpc to 1.4.1
  (jsc#PED-14603, jsc#PED-15051, jsc#PED-15049, jsc#PED-15023)
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1770379200">- Upgrade libzpc to version 1.5.0 (jsc#PED-14603, jsc#PED-14275, jsc#PED-15049)
  * [FEATURE] Support live guest relocation</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1781697600">- Update to version 2.0.0:
  * Switch from a standalone shared library to an OpenSSL Provider layout.
  * Add the new `zpckey` key management utility tool.
  * Remove the old shared library API.
- Update the spec file configuration for the new package structure:
  * Remove the old `libzpc1` and `libzpc-devel` sub-packages.
  * Remove `ldconfig` calls because there is no longer a public shared library.
  * Add `Source1` to use a pre-generated tarball for man pages.
  * Turn off dynamic document building inside the compiler flags.
  * Clean up `BuildRequires` by adding `clang`, `libcrypto`, and `libssl`.
  * Remove unnecessary build tools like `doxygen` and `texlive-bibtex-bin`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782734400">- Upgrade libzpc to version 2.0.1 (jsc#PED-16483)
  * [FIX] Fix compile warnings and errors on i386/i686
  * spec: Remove the pandoc dependency
  * cmake: Change man-page related build target
  * cmake: Install pre-built man-pages
  * man: Update pre-built man-pages
  * Fix detection of PCC instruction availability
- Add new sub-packages
  * libzpc-provider*
  * libzpc-tools*
- Add libzpc-rpmlintrc file as Source1
- Obsoletes the libzpc-man-*.tar.gz file</changelog>
</package>
<package pkgid="66ff1c903d313702c9b2258366c5790cb8480667295750b7cc679cd601ccaa3014f5800443e788083d0e759a14cfb303a9c1719a6ff1d7aef5a631647ea4bc7d" name="libzpc-debuginfo" arch="s390x">
  <version epoch="0" ver="2.0.1" rel="36.2"/>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1675857600">- Upgrade to version 1.1.0 (jsc#PED-582)
  * Implements an ECC-KEY API : `zpc/ecc_key.h`.
  * Implements an ECDSA-CTX API : `zpc/ecdsa_ctx.h`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1695211200">- Version 1.1.1 (jsc#PED-5214)
  * Exploit PKEY_KBLOB2PROTK2 for AES EP11 version 6 keys</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1705320000">- Upgrade libzpc to version 1.2.0 (jsc#PED-3335)
  * Support for get/set intermediate iv for CBC and XTS
  * Support for internal iv for GCM
  * Exploit KBLOB2PROTK3 ioctl for clear AES and EC keys
  * Fix AES EP11 version 6 key support for generate and import_clear</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739448000">- Upgrade libzpc to version 1.3.0 (jsc#PED-11163, jsc#PED-10294)
  - [FEATURE] Support for Ultravisor retrievable secrets
  - [PATCH] Handle CCA cipher key token with Encrypted V0 payload
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739880000">- License update to MIT</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1744027200">- Upgrade libzpc to 1.3.1
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade libzpc to version 1.4.0 (jsc#PED-11163)
  - [FEATURE] Support for MSA 10 (XTS-FULL) and MSA 11 (HMAC)
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767787200">- Upgrade libzpc to 1.4.1
  (jsc#PED-14603, jsc#PED-15051, jsc#PED-15049, jsc#PED-15023)
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1770379200">- Upgrade libzpc to version 1.5.0 (jsc#PED-14603, jsc#PED-14275, jsc#PED-15049)
  * [FEATURE] Support live guest relocation</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1781697600">- Update to version 2.0.0:
  * Switch from a standalone shared library to an OpenSSL Provider layout.
  * Add the new `zpckey` key management utility tool.
  * Remove the old shared library API.
- Update the spec file configuration for the new package structure:
  * Remove the old `libzpc1` and `libzpc-devel` sub-packages.
  * Remove `ldconfig` calls because there is no longer a public shared library.
  * Add `Source1` to use a pre-generated tarball for man pages.
  * Turn off dynamic document building inside the compiler flags.
  * Clean up `BuildRequires` by adding `clang`, `libcrypto`, and `libssl`.
  * Remove unnecessary build tools like `doxygen` and `texlive-bibtex-bin`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782734400">- Upgrade libzpc to version 2.0.1 (jsc#PED-16483)
  * [FIX] Fix compile warnings and errors on i386/i686
  * spec: Remove the pandoc dependency
  * cmake: Change man-page related build target
  * cmake: Install pre-built man-pages
  * man: Update pre-built man-pages
  * Fix detection of PCC instruction availability
- Add new sub-packages
  * libzpc-provider*
  * libzpc-tools*
- Add libzpc-rpmlintrc file as Source1
- Obsoletes the libzpc-man-*.tar.gz file</changelog>
</package>
<package pkgid="9a62fec02649f6c21673e0becc63c38e5d5002545abd07cc908aecb85f3193e9b294d35fab5031d91f10d9e693784c8c4d8e2bd366e725271ee0c912547a4043" name="libzpc-debugsource" arch="s390x">
  <version epoch="0" ver="2.0.1" rel="36.2"/>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1675857600">- Upgrade to version 1.1.0 (jsc#PED-582)
  * Implements an ECC-KEY API : `zpc/ecc_key.h`.
  * Implements an ECDSA-CTX API : `zpc/ecdsa_ctx.h`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1695211200">- Version 1.1.1 (jsc#PED-5214)
  * Exploit PKEY_KBLOB2PROTK2 for AES EP11 version 6 keys</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1705320000">- Upgrade libzpc to version 1.2.0 (jsc#PED-3335)
  * Support for get/set intermediate iv for CBC and XTS
  * Support for internal iv for GCM
  * Exploit KBLOB2PROTK3 ioctl for clear AES and EC keys
  * Fix AES EP11 version 6 key support for generate and import_clear</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739448000">- Upgrade libzpc to version 1.3.0 (jsc#PED-11163, jsc#PED-10294)
  - [FEATURE] Support for Ultravisor retrievable secrets
  - [PATCH] Handle CCA cipher key token with Encrypted V0 payload
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739880000">- License update to MIT</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1744027200">- Upgrade libzpc to 1.3.1
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade libzpc to version 1.4.0 (jsc#PED-11163)
  - [FEATURE] Support for MSA 10 (XTS-FULL) and MSA 11 (HMAC)
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767787200">- Upgrade libzpc to 1.4.1
  (jsc#PED-14603, jsc#PED-15051, jsc#PED-15049, jsc#PED-15023)
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1770379200">- Upgrade libzpc to version 1.5.0 (jsc#PED-14603, jsc#PED-14275, jsc#PED-15049)
  * [FEATURE] Support live guest relocation</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1781697600">- Update to version 2.0.0:
  * Switch from a standalone shared library to an OpenSSL Provider layout.
  * Add the new `zpckey` key management utility tool.
  * Remove the old shared library API.
- Update the spec file configuration for the new package structure:
  * Remove the old `libzpc1` and `libzpc-devel` sub-packages.
  * Remove `ldconfig` calls because there is no longer a public shared library.
  * Add `Source1` to use a pre-generated tarball for man pages.
  * Turn off dynamic document building inside the compiler flags.
  * Clean up `BuildRequires` by adding `clang`, `libcrypto`, and `libssl`.
  * Remove unnecessary build tools like `doxygen` and `texlive-bibtex-bin`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782734400">- Upgrade libzpc to version 2.0.1 (jsc#PED-16483)
  * [FIX] Fix compile warnings and errors on i386/i686
  * spec: Remove the pandoc dependency
  * cmake: Change man-page related build target
  * cmake: Install pre-built man-pages
  * man: Update pre-built man-pages
  * Fix detection of PCC instruction availability
- Add new sub-packages
  * libzpc-provider*
  * libzpc-tools*
- Add libzpc-rpmlintrc file as Source1
- Obsoletes the libzpc-man-*.tar.gz file</changelog>
</package>
<package pkgid="f7f3eac50ba202ab855171536b055b93e4a915260f96693c1155b3977743c22ad31a2d35398a55a17f4196c99c5d459572b764e155005c93b4c7bf0778ea9837" name="libzpc-legacy" arch="src">
  <version epoch="0" ver="1.5.0" rel="1.2"/>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1634644800">- Initial version 1.0.0 (jsc#SLE-18746)</changelog>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1635768000">- Cleaned up the wording in the description. Updated the
  summaries to actually reflect the contents of the packages.
- Changed the %setup macro to use $autosetup instead.
- Added a BuildRequires for texlive-bibtex-bin</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1635854400">- libzpc-sles15p4-mark-stack-nonexec.patch: note the asssembler as
  non execstack
- libzpc-rpmlintrc removed</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651060800">- use source url</changelog>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1663070400">- Upgrade to version 1.0.1 (jsc#PED-582)
  * Updated spec file for rpm build
- Removed obsolete libzpc-sles15p4-mark-stack-nonexec.patch
- Updated spec file to use %{name} and %{version} variables in
  more places.</changelog>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1675857600">- Upgrade to version 1.1.0 (jsc#PED-582)
  * Implements an ECC-KEY API : `zpc/ecc_key.h`.
  * Implements an ECDSA-CTX API : `zpc/ecdsa_ctx.h`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1695211200">- Version 1.1.1 (jsc#PED-5214)
  * Exploit PKEY_KBLOB2PROTK2 for AES EP11 version 6 keys</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1705320000">- Upgrade libzpc to version 1.2.0 (jsc#PED-3335)
  * Support for get/set intermediate iv for CBC and XTS
  * Support for internal iv for GCM
  * Exploit KBLOB2PROTK3 ioctl for clear AES and EC keys
  * Fix AES EP11 version 6 key support for generate and import_clear</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739448000">- Upgrade libzpc to version 1.3.0 (jsc#PED-11163, jsc#PED-10294)
  - [FEATURE] Support for Ultravisor retrievable secrets
  - [PATCH] Handle CCA cipher key token with Encrypted V0 payload
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739880000">- License update to MIT</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1744027200">- Upgrade libzpc to 1.3.1
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade libzpc to version 1.4.0 (jsc#PED-11163)
  - [FEATURE] Support for MSA 10 (XTS-FULL) and MSA 11 (HMAC)
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767787200">- Upgrade libzpc to 1.4.1
  (jsc#PED-14603, jsc#PED-15051, jsc#PED-15049, jsc#PED-15023)
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1770379200">- Upgrade libzpc to version 1.5.0 (jsc#PED-14603, jsc#PED-14275, jsc#PED-15049)
  * [FEATURE] Support live guest relocation</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1784116800">- Introduce libzpc-legacy package for the 1.x branch (jsc#PED-16483)
  * Retain the 1.5.0 codebase to provide libzpc1 and libzpc-devel
    compatibility during the transition to libzpc 2.x</changelog>
</package>
<package pkgid="e2bd44c326f0660923eb5e8039269666cc18d008f26a013f25b5106f009d17caf0342e49fbd8126311e955cccf64c71511fe2001eeae8f09f475f88640035d1f" name="libzpc-legacy-debugsource" arch="s390x">
  <version epoch="0" ver="1.5.0" rel="1.2"/>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1675857600">- Upgrade to version 1.1.0 (jsc#PED-582)
  * Implements an ECC-KEY API : `zpc/ecc_key.h`.
  * Implements an ECDSA-CTX API : `zpc/ecdsa_ctx.h`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1695211200">- Version 1.1.1 (jsc#PED-5214)
  * Exploit PKEY_KBLOB2PROTK2 for AES EP11 version 6 keys</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1705320000">- Upgrade libzpc to version 1.2.0 (jsc#PED-3335)
  * Support for get/set intermediate iv for CBC and XTS
  * Support for internal iv for GCM
  * Exploit KBLOB2PROTK3 ioctl for clear AES and EC keys
  * Fix AES EP11 version 6 key support for generate and import_clear</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739448000">- Upgrade libzpc to version 1.3.0 (jsc#PED-11163, jsc#PED-10294)
  - [FEATURE] Support for Ultravisor retrievable secrets
  - [PATCH] Handle CCA cipher key token with Encrypted V0 payload
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739880000">- License update to MIT</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1744027200">- Upgrade libzpc to 1.3.1
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade libzpc to version 1.4.0 (jsc#PED-11163)
  - [FEATURE] Support for MSA 10 (XTS-FULL) and MSA 11 (HMAC)
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767787200">- Upgrade libzpc to 1.4.1
  (jsc#PED-14603, jsc#PED-15051, jsc#PED-15049, jsc#PED-15023)
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1770379200">- Upgrade libzpc to version 1.5.0 (jsc#PED-14603, jsc#PED-14275, jsc#PED-15049)
  * [FEATURE] Support live guest relocation</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1784116800">- Introduce libzpc-legacy package for the 1.x branch (jsc#PED-16483)
  * Retain the 1.5.0 codebase to provide libzpc1 and libzpc-devel
    compatibility during the transition to libzpc 2.x</changelog>
</package>
<package pkgid="e11936ad3faa2bcf89d22bee2684349d4ff206835179117dcf1b87cb2c80f57e789d5b5a3c152450569e81a1e14e1a2141096472294e1e2ea6ee47199e7fb81a" name="libzpc-legacy-devel" arch="s390x">
  <version epoch="0" ver="1.5.0" rel="1.2"/>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1675857600">- Upgrade to version 1.1.0 (jsc#PED-582)
  * Implements an ECC-KEY API : `zpc/ecc_key.h`.
  * Implements an ECDSA-CTX API : `zpc/ecdsa_ctx.h`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1695211200">- Version 1.1.1 (jsc#PED-5214)
  * Exploit PKEY_KBLOB2PROTK2 for AES EP11 version 6 keys</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1705320000">- Upgrade libzpc to version 1.2.0 (jsc#PED-3335)
  * Support for get/set intermediate iv for CBC and XTS
  * Support for internal iv for GCM
  * Exploit KBLOB2PROTK3 ioctl for clear AES and EC keys
  * Fix AES EP11 version 6 key support for generate and import_clear</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739448000">- Upgrade libzpc to version 1.3.0 (jsc#PED-11163, jsc#PED-10294)
  - [FEATURE] Support for Ultravisor retrievable secrets
  - [PATCH] Handle CCA cipher key token with Encrypted V0 payload
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739880000">- License update to MIT</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1744027200">- Upgrade libzpc to 1.3.1
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade libzpc to version 1.4.0 (jsc#PED-11163)
  - [FEATURE] Support for MSA 10 (XTS-FULL) and MSA 11 (HMAC)
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767787200">- Upgrade libzpc to 1.4.1
  (jsc#PED-14603, jsc#PED-15051, jsc#PED-15049, jsc#PED-15023)
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1770379200">- Upgrade libzpc to version 1.5.0 (jsc#PED-14603, jsc#PED-14275, jsc#PED-15049)
  * [FEATURE] Support live guest relocation</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1784116800">- Introduce libzpc-legacy package for the 1.x branch (jsc#PED-16483)
  * Retain the 1.5.0 codebase to provide libzpc1 and libzpc-devel
    compatibility during the transition to libzpc 2.x</changelog>
</package>
<package pkgid="0b08be81506f29f52d904a4b55281e7b2bab2ea04bf7acb14ad4919d55c1307ab68515325123ba4057ba147b8bcd2643408154ee91dd5633cff706d999220e3a" name="libzpc-provider" arch="s390x">
  <version epoch="0" ver="2.0.1" rel="36.2"/>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1675857600">- Upgrade to version 1.1.0 (jsc#PED-582)
  * Implements an ECC-KEY API : `zpc/ecc_key.h`.
  * Implements an ECDSA-CTX API : `zpc/ecdsa_ctx.h`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1695211200">- Version 1.1.1 (jsc#PED-5214)
  * Exploit PKEY_KBLOB2PROTK2 for AES EP11 version 6 keys</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1705320000">- Upgrade libzpc to version 1.2.0 (jsc#PED-3335)
  * Support for get/set intermediate iv for CBC and XTS
  * Support for internal iv for GCM
  * Exploit KBLOB2PROTK3 ioctl for clear AES and EC keys
  * Fix AES EP11 version 6 key support for generate and import_clear</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739448000">- Upgrade libzpc to version 1.3.0 (jsc#PED-11163, jsc#PED-10294)
  - [FEATURE] Support for Ultravisor retrievable secrets
  - [PATCH] Handle CCA cipher key token with Encrypted V0 payload
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739880000">- License update to MIT</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1744027200">- Upgrade libzpc to 1.3.1
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade libzpc to version 1.4.0 (jsc#PED-11163)
  - [FEATURE] Support for MSA 10 (XTS-FULL) and MSA 11 (HMAC)
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767787200">- Upgrade libzpc to 1.4.1
  (jsc#PED-14603, jsc#PED-15051, jsc#PED-15049, jsc#PED-15023)
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1770379200">- Upgrade libzpc to version 1.5.0 (jsc#PED-14603, jsc#PED-14275, jsc#PED-15049)
  * [FEATURE] Support live guest relocation</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1781697600">- Update to version 2.0.0:
  * Switch from a standalone shared library to an OpenSSL Provider layout.
  * Add the new `zpckey` key management utility tool.
  * Remove the old shared library API.
- Update the spec file configuration for the new package structure:
  * Remove the old `libzpc1` and `libzpc-devel` sub-packages.
  * Remove `ldconfig` calls because there is no longer a public shared library.
  * Add `Source1` to use a pre-generated tarball for man pages.
  * Turn off dynamic document building inside the compiler flags.
  * Clean up `BuildRequires` by adding `clang`, `libcrypto`, and `libssl`.
  * Remove unnecessary build tools like `doxygen` and `texlive-bibtex-bin`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782734400">- Upgrade libzpc to version 2.0.1 (jsc#PED-16483)
  * [FIX] Fix compile warnings and errors on i386/i686
  * spec: Remove the pandoc dependency
  * cmake: Change man-page related build target
  * cmake: Install pre-built man-pages
  * man: Update pre-built man-pages
  * Fix detection of PCC instruction availability
- Add new sub-packages
  * libzpc-provider*
  * libzpc-tools*
- Add libzpc-rpmlintrc file as Source1
- Obsoletes the libzpc-man-*.tar.gz file</changelog>
</package>
<package pkgid="014886f375b4176be12701c15cd5a458c7376e4b22d88a4ff995d8cfd89ac119784357daac3fada0caf53bb7b55117133c93d7a7a3e0eaff5555d5ba10336cfa" name="libzpc-provider-debuginfo" arch="s390x">
  <version epoch="0" ver="2.0.1" rel="36.2"/>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1675857600">- Upgrade to version 1.1.0 (jsc#PED-582)
  * Implements an ECC-KEY API : `zpc/ecc_key.h`.
  * Implements an ECDSA-CTX API : `zpc/ecdsa_ctx.h`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1695211200">- Version 1.1.1 (jsc#PED-5214)
  * Exploit PKEY_KBLOB2PROTK2 for AES EP11 version 6 keys</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1705320000">- Upgrade libzpc to version 1.2.0 (jsc#PED-3335)
  * Support for get/set intermediate iv for CBC and XTS
  * Support for internal iv for GCM
  * Exploit KBLOB2PROTK3 ioctl for clear AES and EC keys
  * Fix AES EP11 version 6 key support for generate and import_clear</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739448000">- Upgrade libzpc to version 1.3.0 (jsc#PED-11163, jsc#PED-10294)
  - [FEATURE] Support for Ultravisor retrievable secrets
  - [PATCH] Handle CCA cipher key token with Encrypted V0 payload
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739880000">- License update to MIT</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1744027200">- Upgrade libzpc to 1.3.1
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade libzpc to version 1.4.0 (jsc#PED-11163)
  - [FEATURE] Support for MSA 10 (XTS-FULL) and MSA 11 (HMAC)
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767787200">- Upgrade libzpc to 1.4.1
  (jsc#PED-14603, jsc#PED-15051, jsc#PED-15049, jsc#PED-15023)
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1770379200">- Upgrade libzpc to version 1.5.0 (jsc#PED-14603, jsc#PED-14275, jsc#PED-15049)
  * [FEATURE] Support live guest relocation</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1781697600">- Update to version 2.0.0:
  * Switch from a standalone shared library to an OpenSSL Provider layout.
  * Add the new `zpckey` key management utility tool.
  * Remove the old shared library API.
- Update the spec file configuration for the new package structure:
  * Remove the old `libzpc1` and `libzpc-devel` sub-packages.
  * Remove `ldconfig` calls because there is no longer a public shared library.
  * Add `Source1` to use a pre-generated tarball for man pages.
  * Turn off dynamic document building inside the compiler flags.
  * Clean up `BuildRequires` by adding `clang`, `libcrypto`, and `libssl`.
  * Remove unnecessary build tools like `doxygen` and `texlive-bibtex-bin`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782734400">- Upgrade libzpc to version 2.0.1 (jsc#PED-16483)
  * [FIX] Fix compile warnings and errors on i386/i686
  * spec: Remove the pandoc dependency
  * cmake: Change man-page related build target
  * cmake: Install pre-built man-pages
  * man: Update pre-built man-pages
  * Fix detection of PCC instruction availability
- Add new sub-packages
  * libzpc-provider*
  * libzpc-tools*
- Add libzpc-rpmlintrc file as Source1
- Obsoletes the libzpc-man-*.tar.gz file</changelog>
</package>
<package pkgid="31b8fbc72a14e7a9126c7bcf3a84a4903e18ce4edce185510205e1a74ef889815f89bb9aa69b37f25ba83df1e8a53e5b4942e833ffc42c2b7ef0c63565a28ea9" name="libzpc-tools" arch="s390x">
  <version epoch="0" ver="2.0.1" rel="36.2"/>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1675857600">- Upgrade to version 1.1.0 (jsc#PED-582)
  * Implements an ECC-KEY API : `zpc/ecc_key.h`.
  * Implements an ECDSA-CTX API : `zpc/ecdsa_ctx.h`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1695211200">- Version 1.1.1 (jsc#PED-5214)
  * Exploit PKEY_KBLOB2PROTK2 for AES EP11 version 6 keys</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1705320000">- Upgrade libzpc to version 1.2.0 (jsc#PED-3335)
  * Support for get/set intermediate iv for CBC and XTS
  * Support for internal iv for GCM
  * Exploit KBLOB2PROTK3 ioctl for clear AES and EC keys
  * Fix AES EP11 version 6 key support for generate and import_clear</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739448000">- Upgrade libzpc to version 1.3.0 (jsc#PED-11163, jsc#PED-10294)
  - [FEATURE] Support for Ultravisor retrievable secrets
  - [PATCH] Handle CCA cipher key token with Encrypted V0 payload
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739880000">- License update to MIT</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1744027200">- Upgrade libzpc to 1.3.1
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade libzpc to version 1.4.0 (jsc#PED-11163)
  - [FEATURE] Support for MSA 10 (XTS-FULL) and MSA 11 (HMAC)
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767787200">- Upgrade libzpc to 1.4.1
  (jsc#PED-14603, jsc#PED-15051, jsc#PED-15049, jsc#PED-15023)
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1770379200">- Upgrade libzpc to version 1.5.0 (jsc#PED-14603, jsc#PED-14275, jsc#PED-15049)
  * [FEATURE] Support live guest relocation</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1781697600">- Update to version 2.0.0:
  * Switch from a standalone shared library to an OpenSSL Provider layout.
  * Add the new `zpckey` key management utility tool.
  * Remove the old shared library API.
- Update the spec file configuration for the new package structure:
  * Remove the old `libzpc1` and `libzpc-devel` sub-packages.
  * Remove `ldconfig` calls because there is no longer a public shared library.
  * Add `Source1` to use a pre-generated tarball for man pages.
  * Turn off dynamic document building inside the compiler flags.
  * Clean up `BuildRequires` by adding `clang`, `libcrypto`, and `libssl`.
  * Remove unnecessary build tools like `doxygen` and `texlive-bibtex-bin`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782734400">- Upgrade libzpc to version 2.0.1 (jsc#PED-16483)
  * [FIX] Fix compile warnings and errors on i386/i686
  * spec: Remove the pandoc dependency
  * cmake: Change man-page related build target
  * cmake: Install pre-built man-pages
  * man: Update pre-built man-pages
  * Fix detection of PCC instruction availability
- Add new sub-packages
  * libzpc-provider*
  * libzpc-tools*
- Add libzpc-rpmlintrc file as Source1
- Obsoletes the libzpc-man-*.tar.gz file</changelog>
</package>
<package pkgid="ddcfad820e25b40adb71cba65b2a0b3dee548d2faa9ea10c29074a201cc9c7721d1375aa52f1ebd220edcd09350d97290745d018a8cb70fb5099935b13bb7529" name="libzpc-tools-debuginfo" arch="s390x">
  <version epoch="0" ver="2.0.1" rel="36.2"/>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1675857600">- Upgrade to version 1.1.0 (jsc#PED-582)
  * Implements an ECC-KEY API : `zpc/ecc_key.h`.
  * Implements an ECDSA-CTX API : `zpc/ecdsa_ctx.h`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1695211200">- Version 1.1.1 (jsc#PED-5214)
  * Exploit PKEY_KBLOB2PROTK2 for AES EP11 version 6 keys</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1705320000">- Upgrade libzpc to version 1.2.0 (jsc#PED-3335)
  * Support for get/set intermediate iv for CBC and XTS
  * Support for internal iv for GCM
  * Exploit KBLOB2PROTK3 ioctl for clear AES and EC keys
  * Fix AES EP11 version 6 key support for generate and import_clear</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739448000">- Upgrade libzpc to version 1.3.0 (jsc#PED-11163, jsc#PED-10294)
  - [FEATURE] Support for Ultravisor retrievable secrets
  - [PATCH] Handle CCA cipher key token with Encrypted V0 payload
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739880000">- License update to MIT</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1744027200">- Upgrade libzpc to 1.3.1
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade libzpc to version 1.4.0 (jsc#PED-11163)
  - [FEATURE] Support for MSA 10 (XTS-FULL) and MSA 11 (HMAC)
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767787200">- Upgrade libzpc to 1.4.1
  (jsc#PED-14603, jsc#PED-15051, jsc#PED-15049, jsc#PED-15023)
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1770379200">- Upgrade libzpc to version 1.5.0 (jsc#PED-14603, jsc#PED-14275, jsc#PED-15049)
  * [FEATURE] Support live guest relocation</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1781697600">- Update to version 2.0.0:
  * Switch from a standalone shared library to an OpenSSL Provider layout.
  * Add the new `zpckey` key management utility tool.
  * Remove the old shared library API.
- Update the spec file configuration for the new package structure:
  * Remove the old `libzpc1` and `libzpc-devel` sub-packages.
  * Remove `ldconfig` calls because there is no longer a public shared library.
  * Add `Source1` to use a pre-generated tarball for man pages.
  * Turn off dynamic document building inside the compiler flags.
  * Clean up `BuildRequires` by adding `clang`, `libcrypto`, and `libssl`.
  * Remove unnecessary build tools like `doxygen` and `texlive-bibtex-bin`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782734400">- Upgrade libzpc to version 2.0.1 (jsc#PED-16483)
  * [FIX] Fix compile warnings and errors on i386/i686
  * spec: Remove the pandoc dependency
  * cmake: Change man-page related build target
  * cmake: Install pre-built man-pages
  * man: Update pre-built man-pages
  * Fix detection of PCC instruction availability
- Add new sub-packages
  * libzpc-provider*
  * libzpc-tools*
- Add libzpc-rpmlintrc file as Source1
- Obsoletes the libzpc-man-*.tar.gz file</changelog>
</package>
<package pkgid="ad742d149a15b24dd4b1ebc336ed7106e8b719b40e3d77b3839bcbb537ff964c8111957f806f20283348999f96271d521375c8df5b9ff20008e2abe3a0c44f86" name="libzpc1" arch="s390x">
  <version epoch="0" ver="1.5.0" rel="1.2"/>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1675857600">- Upgrade to version 1.1.0 (jsc#PED-582)
  * Implements an ECC-KEY API : `zpc/ecc_key.h`.
  * Implements an ECDSA-CTX API : `zpc/ecdsa_ctx.h`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1695211200">- Version 1.1.1 (jsc#PED-5214)
  * Exploit PKEY_KBLOB2PROTK2 for AES EP11 version 6 keys</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1705320000">- Upgrade libzpc to version 1.2.0 (jsc#PED-3335)
  * Support for get/set intermediate iv for CBC and XTS
  * Support for internal iv for GCM
  * Exploit KBLOB2PROTK3 ioctl for clear AES and EC keys
  * Fix AES EP11 version 6 key support for generate and import_clear</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739448000">- Upgrade libzpc to version 1.3.0 (jsc#PED-11163, jsc#PED-10294)
  - [FEATURE] Support for Ultravisor retrievable secrets
  - [PATCH] Handle CCA cipher key token with Encrypted V0 payload
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739880000">- License update to MIT</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1744027200">- Upgrade libzpc to 1.3.1
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade libzpc to version 1.4.0 (jsc#PED-11163)
  - [FEATURE] Support for MSA 10 (XTS-FULL) and MSA 11 (HMAC)
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767787200">- Upgrade libzpc to 1.4.1
  (jsc#PED-14603, jsc#PED-15051, jsc#PED-15049, jsc#PED-15023)
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1770379200">- Upgrade libzpc to version 1.5.0 (jsc#PED-14603, jsc#PED-14275, jsc#PED-15049)
  * [FEATURE] Support live guest relocation</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1784116800">- Introduce libzpc-legacy package for the 1.x branch (jsc#PED-16483)
  * Retain the 1.5.0 codebase to provide libzpc1 and libzpc-devel
    compatibility during the transition to libzpc 2.x</changelog>
</package>
<package pkgid="337722f6362a9b20b0931c285bb2a8da22eeef7ae524a8083062665dd4d337fb92e050d47126ee1cfcdad810f6eb3c1693f6df7b1c77b21983445217dcdf10bf" name="libzpc1-debuginfo" arch="s390x">
  <version epoch="0" ver="1.5.0" rel="1.2"/>
  <changelog author="Mark Post &lt;mpost@suse.com&gt;" date="1675857600">- Upgrade to version 1.1.0 (jsc#PED-582)
  * Implements an ECC-KEY API : `zpc/ecc_key.h`.
  * Implements an ECDSA-CTX API : `zpc/ecdsa_ctx.h`.</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1695211200">- Version 1.1.1 (jsc#PED-5214)
  * Exploit PKEY_KBLOB2PROTK2 for AES EP11 version 6 keys</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1705320000">- Upgrade libzpc to version 1.2.0 (jsc#PED-3335)
  * Support for get/set intermediate iv for CBC and XTS
  * Support for internal iv for GCM
  * Exploit KBLOB2PROTK3 ioctl for clear AES and EC keys
  * Fix AES EP11 version 6 key support for generate and import_clear</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739448000">- Upgrade libzpc to version 1.3.0 (jsc#PED-11163, jsc#PED-10294)
  - [FEATURE] Support for Ultravisor retrievable secrets
  - [PATCH] Handle CCA cipher key token with Encrypted V0 payload
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1739880000">- License update to MIT</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1744027200">- Upgrade libzpc to 1.3.1
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade libzpc to version 1.4.0 (jsc#PED-11163)
  - [FEATURE] Support for MSA 10 (XTS-FULL) and MSA 11 (HMAC)
  - [PATCH] bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767787200">- Upgrade libzpc to 1.4.1
  (jsc#PED-14603, jsc#PED-15051, jsc#PED-15049, jsc#PED-15023)
  - Bug fixes</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1770379200">- Upgrade libzpc to version 1.5.0 (jsc#PED-14603, jsc#PED-14275, jsc#PED-15049)
  * [FEATURE] Support live guest relocation</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1784116800">- Introduce libzpc-legacy package for the 1.x branch (jsc#PED-16483)
  * Retain the 1.5.0 codebase to provide libzpc1 and libzpc-devel
    compatibility during the transition to libzpc 2.x</changelog>
</package>
<package pkgid="882d18c13bb882fd8b8f9aca361b229c7f6fe2e5651d1d6e8738a98a824ccd9ab947af9e67b954af2df05ba9fda71c66c5b27a373593f655b7a54584549eeaf2" name="libzupt" arch="src">
  <version epoch="0" ver="1.0.8" rel="1.10"/>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1776600000">- First version v1.0.6</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1776772800">- Update to 1.0.8
- Security &amp; Correctness Fixes
- Typo by @cabelo
- Add java examples
- Downgrade cmake.
- Change C++ standard from C++17 to C++11</changelog>
</package>
<package pkgid="d864fd0f2fb4f63873a88d0073e096e26d92ec97fcd383630893cc7df767caff5d54175a61686903ab86a68bdf3cecdc27bc2c9a59c307e9ff092ce71cb6c1c2" name="libzupt-debugsource" arch="s390x">
  <version epoch="0" ver="1.0.8" rel="1.10"/>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1776600000">- First version v1.0.6</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1776772800">- Update to 1.0.8
- Security &amp; Correctness Fixes
- Typo by @cabelo
- Add java examples
- Downgrade cmake.
- Change C++ standard from C++17 to C++11</changelog>
</package>
<package pkgid="7d7f3744dd59950263acfd6859b80e228e63d5cc9e32656b6797a6d97879c4b91b41a534fe9879d9cab8b37baa5e0449b2869d2846e7b18a0e4d7c07064e4518" name="libzupt-devel" arch="s390x">
  <version epoch="0" ver="1.0.8" rel="1.10"/>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1776600000">- First version v1.0.6</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1776772800">- Update to 1.0.8
- Security &amp; Correctness Fixes
- Typo by @cabelo
- Add java examples
- Downgrade cmake.
- Change C++ standard from C++17 to C++11</changelog>
</package>
<package pkgid="750c008e3861e6e5ec0a531aebd6cb0a837d02ed4f1c667948bfe727444f10d53a1143eda8bc13f4358ba467b21c28b498fcbce4ebe27fa0ad7f07797547ce55" name="libzupt1" arch="s390x">
  <version epoch="0" ver="1.0.8" rel="1.10"/>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1776600000">- First version v1.0.6</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1776772800">- Update to 1.0.8
- Security &amp; Correctness Fixes
- Typo by @cabelo
- Add java examples
- Downgrade cmake.
- Change C++ standard from C++17 to C++11</changelog>
</package>
<package pkgid="e1651059deaff90afbc56fd9387efc4c9eb8aa752fa29adab2027fe5d2cb500e5a7deb0e01d3805f275ea977d9493006e12c06748d43b9557fa10dafec812b52" name="libzupt1-debuginfo" arch="s390x">
  <version epoch="0" ver="1.0.8" rel="1.10"/>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1776600000">- First version v1.0.6</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1776772800">- Update to 1.0.8
- Security &amp; Correctness Fixes
- Typo by @cabelo
- Add java examples
- Downgrade cmake.
- Change C++ standard from C++17 to C++11</changelog>
</package>
<package pkgid="1413c740f25e6f59631a292914b5d5801bb09071d2a96713046664bfb2442dc328daa005134cce77a7b5e2a3c47d4a2b1fe6732847bf876ec08071d0fd3b72d0" name="listps" arch="s390x">
  <version epoch="0" ver="0.9.0" rel="2.19"/>
  <changelog author="pascal.bleser@opensuse.org" date="1318075200">- initial version (0.9.0)</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1708516800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="c8d7c5ac361ae830a43c8e4521941cbcf7da9d7c6478701754deb664562d42f17815aeb81f764958ff6a867236ee80c77e4c33db9725e54cd6600e6869d2ade2" name="listps" arch="src">
  <version epoch="0" ver="0.9.0" rel="2.19"/>
  <changelog author="pascal.bleser@opensuse.org" date="1318075200">- initial version (0.9.0)</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1708516800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="923e1527879fd5bb041e80396a6b15a0722e8c44d06f29e65b695b4307a499a48b1dcbb982db330b5a112d4cbc542de0e5e826ef6569428810b57bc12877521d" name="listps-debuginfo" arch="s390x">
  <version epoch="0" ver="0.9.0" rel="2.19"/>
  <changelog author="pascal.bleser@opensuse.org" date="1318075200">- initial version (0.9.0)</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1708516800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="ff4ec08dc3d81dc439a792aef590b635974490644c668b8ca2527d68e7bed1ddc422d90a435d617eb9f2ab7e012f7df1724b872e301b21b8d222f04718220aa8" name="listps-debugsource" arch="s390x">
  <version epoch="0" ver="0.9.0" rel="2.19"/>
  <changelog author="pascal.bleser@opensuse.org" date="1318075200">- initial version (0.9.0)</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1708516800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN.</changelog>
</package>
<package pkgid="36e2776254d2a10b8f71306e813a350a24521b872cb2ca46214a5f23e70d9a65574eb1672da84be19005ab33a1bb0c5b13bcd9cb9b78ef7ae72f1271f0ee3e39" name="logsurfer" arch="s390x">
  <version epoch="0" ver="1.8" rel="8.6"/>
  <changelog author="cihlar@suse.cz" date="983966400">- update to version 1.5a</changelog>
  <changelog author="cihlar@suse.cz" date="990100800">- fixed cast warnings on ia64</changelog>
  <changelog author="draht@suse.de" date="1034251200">- logsurfer-ob1-heap_plus_initialization.diff solves an off by one
  overflow and a bug caused by uninitialized memory (security).</changelog>
  <changelog author="draht@suse.de" date="1267185600">- logsurfer+-1.7.</changelog>
  <changelog author="draht@suse.de" date="1267185601">- rigorous cleanup of BuildRequires:</changelog>
  <changelog author="draht@suse.de" date="1318852800">- logsurfer-double-free-fix.diff: fix for a double free
  vulnerability in sec/exec.c</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1345636800">- logsurfer-double-free-fix.diff - dropped patch - now in upstream
- upgrade to v1.8
    Now just Logsurfer, not Logsurfer+ any more
    A bug fix and a couple of extra command-line options:
  - D command line option for daemon mode. Warning: closes stdin, stdout, &amp; stderr, therefore no error messages
  - F command line option to auto re-open log file</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346846400">- run spec-cleaner
- add SLES support back in</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347278400">- change names of patches per opensuse guidelines</changelog>
  <changelog author="Manfred Schwarb &lt;manfred99@gmx.ch&gt;" date="1778500800">- spec cleanup
- fix "error: %patchN is obsolete" build error
- add patch sighandler.patch to fix -Wincompatible-pointer-types error
- add patch check_context_linelimit.patch to fix -Wimplicit-function-declaration error
- use "-std=gnu89" to placate errors related to old-style function declarations
- declare logsurfer-doc as "noarch" package</changelog>
</package>
<package pkgid="1936025269323a30b4c94b68f14be16d4cfdbb1dbe9a8de66a660f70a14aec428a68e180f70d28c3a369a036d49eb50e76d8f06b249f9034c4ce8f8b160f5a27" name="logsurfer" arch="src">
  <version epoch="0" ver="1.8" rel="8.6"/>
  <changelog author="choeger@suse.de" date="899121600">- new package, v1.41</changelog>
  <changelog author="bs@suse.de" date="937224000">- ran old prepare_spec on spec file to switch to new prepare_spec.</changelog>
  <changelog author="choeger@suse.de" date="951998400">- new version 1.5 and mandir macro</changelog>
  <changelog author="cihlar@suse.cz" date="966427200">- added BuildRoot</changelog>
  <changelog author="cihlar@suse.cz" date="973684800">- renamed to long name
- bzipped sources
- clean up spec file</changelog>
  <changelog author="cihlar@suse.cz" date="983966400">- update to version 1.5a</changelog>
  <changelog author="cihlar@suse.cz" date="990100800">- fixed cast warnings on ia64</changelog>
  <changelog author="draht@suse.de" date="1034251200">- logsurfer-ob1-heap_plus_initialization.diff solves an off by one
  overflow and a bug caused by uninitialized memory (security).</changelog>
  <changelog author="draht@suse.de" date="1267185600">- logsurfer+-1.7.</changelog>
  <changelog author="draht@suse.de" date="1267185601">- rigorous cleanup of BuildRequires:</changelog>
  <changelog author="draht@suse.de" date="1318852800">- logsurfer-double-free-fix.diff: fix for a double free
  vulnerability in sec/exec.c</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1345636800">- logsurfer-double-free-fix.diff - dropped patch - now in upstream
- upgrade to v1.8
    Now just Logsurfer, not Logsurfer+ any more
    A bug fix and a couple of extra command-line options:
  - D command line option for daemon mode. Warning: closes stdin, stdout, &amp; stderr, therefore no error messages
  - F command line option to auto re-open log file</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346846400">- run spec-cleaner
- add SLES support back in</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347278400">- change names of patches per opensuse guidelines</changelog>
  <changelog author="Manfred Schwarb &lt;manfred99@gmx.ch&gt;" date="1778500800">- spec cleanup
- fix "error: %patchN is obsolete" build error
- add patch sighandler.patch to fix -Wincompatible-pointer-types error
- add patch check_context_linelimit.patch to fix -Wimplicit-function-declaration error
- use "-std=gnu89" to placate errors related to old-style function declarations
- declare logsurfer-doc as "noarch" package</changelog>
</package>
<package pkgid="ddebca76bced8f4a94adff19ccbf89234c3aa4e317ade1d61e247031039ea51a82fc09e7a6c2bfc92aa7393ae8f4c79f0c4bb21f1af1517412f1d5b3ed9efd7e" name="logsurfer-debuginfo" arch="s390x">
  <version epoch="0" ver="1.8" rel="8.6"/>
  <changelog author="cihlar@suse.cz" date="983966400">- update to version 1.5a</changelog>
  <changelog author="cihlar@suse.cz" date="990100800">- fixed cast warnings on ia64</changelog>
  <changelog author="draht@suse.de" date="1034251200">- logsurfer-ob1-heap_plus_initialization.diff solves an off by one
  overflow and a bug caused by uninitialized memory (security).</changelog>
  <changelog author="draht@suse.de" date="1267185600">- logsurfer+-1.7.</changelog>
  <changelog author="draht@suse.de" date="1267185601">- rigorous cleanup of BuildRequires:</changelog>
  <changelog author="draht@suse.de" date="1318852800">- logsurfer-double-free-fix.diff: fix for a double free
  vulnerability in sec/exec.c</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1345636800">- logsurfer-double-free-fix.diff - dropped patch - now in upstream
- upgrade to v1.8
    Now just Logsurfer, not Logsurfer+ any more
    A bug fix and a couple of extra command-line options:
  - D command line option for daemon mode. Warning: closes stdin, stdout, &amp; stderr, therefore no error messages
  - F command line option to auto re-open log file</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346846400">- run spec-cleaner
- add SLES support back in</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347278400">- change names of patches per opensuse guidelines</changelog>
  <changelog author="Manfred Schwarb &lt;manfred99@gmx.ch&gt;" date="1778500800">- spec cleanup
- fix "error: %patchN is obsolete" build error
- add patch sighandler.patch to fix -Wincompatible-pointer-types error
- add patch check_context_linelimit.patch to fix -Wimplicit-function-declaration error
- use "-std=gnu89" to placate errors related to old-style function declarations
- declare logsurfer-doc as "noarch" package</changelog>
</package>
<package pkgid="570c932e0728fd29bf0b8e0476a0886012bfa6107942e49fcb776360459f5be4c9ba6964f4e8af425c2ef2dc278a7f11302d617319f4760396dc483d51534406" name="logsurfer-debugsource" arch="s390x">
  <version epoch="0" ver="1.8" rel="8.6"/>
  <changelog author="cihlar@suse.cz" date="983966400">- update to version 1.5a</changelog>
  <changelog author="cihlar@suse.cz" date="990100800">- fixed cast warnings on ia64</changelog>
  <changelog author="draht@suse.de" date="1034251200">- logsurfer-ob1-heap_plus_initialization.diff solves an off by one
  overflow and a bug caused by uninitialized memory (security).</changelog>
  <changelog author="draht@suse.de" date="1267185600">- logsurfer+-1.7.</changelog>
  <changelog author="draht@suse.de" date="1267185601">- rigorous cleanup of BuildRequires:</changelog>
  <changelog author="draht@suse.de" date="1318852800">- logsurfer-double-free-fix.diff: fix for a double free
  vulnerability in sec/exec.c</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1345636800">- logsurfer-double-free-fix.diff - dropped patch - now in upstream
- upgrade to v1.8
    Now just Logsurfer, not Logsurfer+ any more
    A bug fix and a couple of extra command-line options:
  - D command line option for daemon mode. Warning: closes stdin, stdout, &amp; stderr, therefore no error messages
  - F command line option to auto re-open log file</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346846400">- run spec-cleaner
- add SLES support back in</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347278400">- change names of patches per opensuse guidelines</changelog>
  <changelog author="Manfred Schwarb &lt;manfred99@gmx.ch&gt;" date="1778500800">- spec cleanup
- fix "error: %patchN is obsolete" build error
- add patch sighandler.patch to fix -Wincompatible-pointer-types error
- add patch check_context_linelimit.patch to fix -Wimplicit-function-declaration error
- use "-std=gnu89" to placate errors related to old-style function declarations
- declare logsurfer-doc as "noarch" package</changelog>
</package>
<package pkgid="8331cf0b93328db13e4bc5d794a2d6d37c03e8f5b11d33d15c29305d00773e3d055aa7b539646cfcd19804b7612b9f261b819c249136c9244f80b4dd5fc14519" name="logsurfer-doc" arch="noarch">
  <version epoch="0" ver="1.8" rel="8.6"/>
  <changelog author="cihlar@suse.cz" date="983966400">- update to version 1.5a</changelog>
  <changelog author="cihlar@suse.cz" date="990100800">- fixed cast warnings on ia64</changelog>
  <changelog author="draht@suse.de" date="1034251200">- logsurfer-ob1-heap_plus_initialization.diff solves an off by one
  overflow and a bug caused by uninitialized memory (security).</changelog>
  <changelog author="draht@suse.de" date="1267185600">- logsurfer+-1.7.</changelog>
  <changelog author="draht@suse.de" date="1267185601">- rigorous cleanup of BuildRequires:</changelog>
  <changelog author="draht@suse.de" date="1318852800">- logsurfer-double-free-fix.diff: fix for a double free
  vulnerability in sec/exec.c</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1345636800">- logsurfer-double-free-fix.diff - dropped patch - now in upstream
- upgrade to v1.8
    Now just Logsurfer, not Logsurfer+ any more
    A bug fix and a couple of extra command-line options:
  - D command line option for daemon mode. Warning: closes stdin, stdout, &amp; stderr, therefore no error messages
  - F command line option to auto re-open log file</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346846400">- run spec-cleaner
- add SLES support back in</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347278400">- change names of patches per opensuse guidelines</changelog>
  <changelog author="Manfred Schwarb &lt;manfred99@gmx.ch&gt;" date="1778500800">- spec cleanup
- fix "error: %patchN is obsolete" build error
- add patch sighandler.patch to fix -Wincompatible-pointer-types error
- add patch check_context_linelimit.patch to fix -Wimplicit-function-declaration error
- use "-std=gnu89" to placate errors related to old-style function declarations
- declare logsurfer-doc as "noarch" package</changelog>
</package>
<package pkgid="1f3b47e1e8781cc6177c6fa5fe0f27211f69c49c399f9fb2d6907dda33490833506dd2ddb816055f781b3fd30e411cfc510d9751e10d5f098a10a667393bda3b" name="ltp-ima-standalone" arch="s390x">
  <version epoch="0" ver="2" rel="1.32"/>
  <changelog author="wnereiz@member.fsf.org" date="1518091200">- Initialize the package ima-tests (ltp-ima-standalone)</changelog>
  <changelog author="wnereiz@fsf.member.org" date="1548936000">- Rename the package to ltp-ima-standalone which is more reasonable
- Add GPLv2 license file</changelog>
</package>
<package pkgid="f3cfd5a0ceec67b98be0c902fb29f1a3b9214ede651b1fe858a9ba22fb056c71f825105a09db9150b01e4c201d5829ab5522efd00bb6efaeed5a744ede9e052b" name="ltp-ima-standalone" arch="src">
  <version epoch="0" ver="2" rel="1.32"/>
  <changelog author="wnereiz@member.fsf.org" date="1518091200">- Initialize the package ima-tests (ltp-ima-standalone)</changelog>
  <changelog author="wnereiz@fsf.member.org" date="1548936000">- Rename the package to ltp-ima-standalone which is more reasonable
- Add GPLv2 license file</changelog>
</package>
<package pkgid="5746e45f2e56abacfea2a285d6da6d91315fa8a0bfb845b4d3702dbaab620279b2dfe1b6a7c60879899274155ebfd095aea845651188c7e830bc04b8ea877205" name="ltp-ima-standalone-debuginfo" arch="s390x">
  <version epoch="0" ver="2" rel="1.32"/>
  <changelog author="wnereiz@member.fsf.org" date="1518091200">- Initialize the package ima-tests (ltp-ima-standalone)</changelog>
  <changelog author="wnereiz@fsf.member.org" date="1548936000">- Rename the package to ltp-ima-standalone which is more reasonable
- Add GPLv2 license file</changelog>
</package>
<package pkgid="d9b7f0f4ad1467d145f1871b173443fc557ceca0f60d3b0da68459b85bc41d175566d38b1e17e4e19e491a4297307ab59bbbfe90143ca67c14b35d9812fda743" name="ltp-ima-standalone-debugsource" arch="s390x">
  <version epoch="0" ver="2" rel="1.32"/>
  <changelog author="wnereiz@member.fsf.org" date="1518091200">- Initialize the package ima-tests (ltp-ima-standalone)</changelog>
  <changelog author="wnereiz@fsf.member.org" date="1548936000">- Rename the package to ltp-ima-standalone which is more reasonable
- Add GPLv2 license file</changelog>
</package>
<package pkgid="0ff04295d9d7aa0d4ec3311484cf5f5857c2fee3fc49a22e5a23134416352bb0b68d367765612d6797b61c70a03f337a1784f0b6ab307ee3bcf81771109f9a92" name="luksipc" arch="s390x">
  <version epoch="0" ver="0.04" rel="3.38"/>
  <changelog author="uli@suse.com" date="1343390400">* Initial package
  * Fixed "already open" sanity check
  * Added "--sync" option that allows to survive forced termination
  without data loss</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376000">* Update to version 0.02:
  - Fixed interpretation of return code of "cryptsetup status" which
    had changed with more recent cryptsetup versions to reflect the
    correct error if no such LUKS name was known.
    Thanks to Eric Murray and Christian Pulvermacher for reporting this issue.
  - Forced chunk size to be 10 MiB instead of the default of 3 MiB.
    Thanks to John Morrissey for the bug report (under some weird circumstances,
    the LUKS header apparently can become a lot larger).
  - Fixed a couple of warnings and used stricter compiler flags.
  - Switched to -stc=c11 to be able to use static assertions.
  - Improved error handling for wrong command line parameters
    (log level integer parsing).
  - Improved error handling at cleanup (unsynced luksClose may fail at
    the first try because the device is still busy, sync() filesystems
    and try up to three times now)
  - Display estimated remaining time until finish.
  - Assert resume file can be written to disk by writing it at very start
    once and then seeking to its start.
  - Added README file with detailed instructions.
  - More helpful help page</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376001">* Update to version 0.03:
  - Allow reLUKSification of devices (i.e. converting LUKS to LUKS)
  - Checking of mount status of file systems
  - Resume files now have additional sanity checks
  - Fast CRC64-based PRNG generator for filling volumes with check data
  - Major code cleanups and refactoring
  - Major regression testing facilities
    (auto-aborting and resuming on large volumes and on loop devices)
  - Help page of luksipc now looks more professional
  - Partition backup file (128 MiB) is always generated at the start
    of a LUKSification process
  - Option to deactivate safety checks via command line parameter
    (--no-seatbelt)</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376002">* Update to version 0.04:
  - Greatly improved handling of disk I/O errors
    (graceful shutdown in more situation instead of simply bailing out)
  - Separated resume file specification and actual request for
    resuming an aborted luksipc process (--resume vs. --resume-file)
  - Unified exit code handling
  - Possibilities to do fault injection in order to
    efficiently develop and test code to increase robustness
  - Included whole test framework in release
  * Delete files:
  - 0001-fix-already-open-sanity-check.patch
  - 0002-add-sync-option.patch</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1515672000">* SPEC file changes:
  - URL link to online tarball
    (allows OBS to verify the tarball is unmodified)
  - 'Release' is set to '0'</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650715200">- URL -&gt; https</changelog>
</package>
<package pkgid="a7fca196127ff8e9e8c5d69d6006901d91e50ba4c828913bb0e59471dd717d546dfe17c134a88ce1067f71e66468b4ddd583a263c53476f717d07fbcb0b79577" name="luksipc" arch="src">
  <version epoch="0" ver="0.04" rel="3.38"/>
  <changelog author="uli@suse.com" date="1343390400">* Initial package
  * Fixed "already open" sanity check
  * Added "--sync" option that allows to survive forced termination
  without data loss</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376000">* Update to version 0.02:
  - Fixed interpretation of return code of "cryptsetup status" which
    had changed with more recent cryptsetup versions to reflect the
    correct error if no such LUKS name was known.
    Thanks to Eric Murray and Christian Pulvermacher for reporting this issue.
  - Forced chunk size to be 10 MiB instead of the default of 3 MiB.
    Thanks to John Morrissey for the bug report (under some weird circumstances,
    the LUKS header apparently can become a lot larger).
  - Fixed a couple of warnings and used stricter compiler flags.
  - Switched to -stc=c11 to be able to use static assertions.
  - Improved error handling for wrong command line parameters
    (log level integer parsing).
  - Improved error handling at cleanup (unsynced luksClose may fail at
    the first try because the device is still busy, sync() filesystems
    and try up to three times now)
  - Display estimated remaining time until finish.
  - Assert resume file can be written to disk by writing it at very start
    once and then seeking to its start.
  - Added README file with detailed instructions.
  - More helpful help page</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376001">* Update to version 0.03:
  - Allow reLUKSification of devices (i.e. converting LUKS to LUKS)
  - Checking of mount status of file systems
  - Resume files now have additional sanity checks
  - Fast CRC64-based PRNG generator for filling volumes with check data
  - Major code cleanups and refactoring
  - Major regression testing facilities
    (auto-aborting and resuming on large volumes and on loop devices)
  - Help page of luksipc now looks more professional
  - Partition backup file (128 MiB) is always generated at the start
    of a LUKSification process
  - Option to deactivate safety checks via command line parameter
    (--no-seatbelt)</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376002">* Update to version 0.04:
  - Greatly improved handling of disk I/O errors
    (graceful shutdown in more situation instead of simply bailing out)
  - Separated resume file specification and actual request for
    resuming an aborted luksipc process (--resume vs. --resume-file)
  - Unified exit code handling
  - Possibilities to do fault injection in order to
    efficiently develop and test code to increase robustness
  - Included whole test framework in release
  * Delete files:
  - 0001-fix-already-open-sanity-check.patch
  - 0002-add-sync-option.patch</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1515672000">* SPEC file changes:
  - URL link to online tarball
    (allows OBS to verify the tarball is unmodified)
  - 'Release' is set to '0'</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650715200">- URL -&gt; https</changelog>
</package>
<package pkgid="12e8c1296cfcdaa797c6f3ff68d142f313091c8fd4b3a9d6e8988019d87c8ca812e28812e3a53b2892c742769a70e6c036e2dc4cc96c6ddc480869de938aa64d" name="luksipc-debuginfo" arch="s390x">
  <version epoch="0" ver="0.04" rel="3.38"/>
  <changelog author="uli@suse.com" date="1343390400">* Initial package
  * Fixed "already open" sanity check
  * Added "--sync" option that allows to survive forced termination
  without data loss</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376000">* Update to version 0.02:
  - Fixed interpretation of return code of "cryptsetup status" which
    had changed with more recent cryptsetup versions to reflect the
    correct error if no such LUKS name was known.
    Thanks to Eric Murray and Christian Pulvermacher for reporting this issue.
  - Forced chunk size to be 10 MiB instead of the default of 3 MiB.
    Thanks to John Morrissey for the bug report (under some weird circumstances,
    the LUKS header apparently can become a lot larger).
  - Fixed a couple of warnings and used stricter compiler flags.
  - Switched to -stc=c11 to be able to use static assertions.
  - Improved error handling for wrong command line parameters
    (log level integer parsing).
  - Improved error handling at cleanup (unsynced luksClose may fail at
    the first try because the device is still busy, sync() filesystems
    and try up to three times now)
  - Display estimated remaining time until finish.
  - Assert resume file can be written to disk by writing it at very start
    once and then seeking to its start.
  - Added README file with detailed instructions.
  - More helpful help page</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376001">* Update to version 0.03:
  - Allow reLUKSification of devices (i.e. converting LUKS to LUKS)
  - Checking of mount status of file systems
  - Resume files now have additional sanity checks
  - Fast CRC64-based PRNG generator for filling volumes with check data
  - Major code cleanups and refactoring
  - Major regression testing facilities
    (auto-aborting and resuming on large volumes and on loop devices)
  - Help page of luksipc now looks more professional
  - Partition backup file (128 MiB) is always generated at the start
    of a LUKSification process
  - Option to deactivate safety checks via command line parameter
    (--no-seatbelt)</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376002">* Update to version 0.04:
  - Greatly improved handling of disk I/O errors
    (graceful shutdown in more situation instead of simply bailing out)
  - Separated resume file specification and actual request for
    resuming an aborted luksipc process (--resume vs. --resume-file)
  - Unified exit code handling
  - Possibilities to do fault injection in order to
    efficiently develop and test code to increase robustness
  - Included whole test framework in release
  * Delete files:
  - 0001-fix-already-open-sanity-check.patch
  - 0002-add-sync-option.patch</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1515672000">* SPEC file changes:
  - URL link to online tarball
    (allows OBS to verify the tarball is unmodified)
  - 'Release' is set to '0'</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650715200">- URL -&gt; https</changelog>
</package>
<package pkgid="0c5974eb24a6010a25df161007f9e5d397d7bb22b1156e235b3d8b0efdd86bc4b90978c2040a654f4c3d0bef069a50ff6de67f5a2e182dd71872afdf605c3bcc" name="luksipc-debugsource" arch="s390x">
  <version epoch="0" ver="0.04" rel="3.38"/>
  <changelog author="uli@suse.com" date="1343390400">* Initial package
  * Fixed "already open" sanity check
  * Added "--sync" option that allows to survive forced termination
  without data loss</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376000">* Update to version 0.02:
  - Fixed interpretation of return code of "cryptsetup status" which
    had changed with more recent cryptsetup versions to reflect the
    correct error if no such LUKS name was known.
    Thanks to Eric Murray and Christian Pulvermacher for reporting this issue.
  - Forced chunk size to be 10 MiB instead of the default of 3 MiB.
    Thanks to John Morrissey for the bug report (under some weird circumstances,
    the LUKS header apparently can become a lot larger).
  - Fixed a couple of warnings and used stricter compiler flags.
  - Switched to -stc=c11 to be able to use static assertions.
  - Improved error handling for wrong command line parameters
    (log level integer parsing).
  - Improved error handling at cleanup (unsynced luksClose may fail at
    the first try because the device is still busy, sync() filesystems
    and try up to three times now)
  - Display estimated remaining time until finish.
  - Assert resume file can be written to disk by writing it at very start
    once and then seeking to its start.
  - Added README file with detailed instructions.
  - More helpful help page</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376001">* Update to version 0.03:
  - Allow reLUKSification of devices (i.e. converting LUKS to LUKS)
  - Checking of mount status of file systems
  - Resume files now have additional sanity checks
  - Fast CRC64-based PRNG generator for filling volumes with check data
  - Major code cleanups and refactoring
  - Major regression testing facilities
    (auto-aborting and resuming on large volumes and on loop devices)
  - Help page of luksipc now looks more professional
  - Partition backup file (128 MiB) is always generated at the start
    of a LUKSification process
  - Option to deactivate safety checks via command line parameter
    (--no-seatbelt)</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376002">* Update to version 0.04:
  - Greatly improved handling of disk I/O errors
    (graceful shutdown in more situation instead of simply bailing out)
  - Separated resume file specification and actual request for
    resuming an aborted luksipc process (--resume vs. --resume-file)
  - Unified exit code handling
  - Possibilities to do fault injection in order to
    efficiently develop and test code to increase robustness
  - Included whole test framework in release
  * Delete files:
  - 0001-fix-already-open-sanity-check.patch
  - 0002-add-sync-option.patch</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1515672000">* SPEC file changes:
  - URL link to online tarball
    (allows OBS to verify the tarball is unmodified)
  - 'Release' is set to '0'</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650715200">- URL -&gt; https</changelog>
</package>
<package pkgid="f3865974393d4a4bcfd8991a8db5ff15828a0d5162eda91e9662107033cec8d83d949fc75980d1ae0ad6e85c86147b2555a8d1ed3ff95ec0dad8bc146e53337b" name="luksmeta" arch="s390x">
  <version epoch="0" ver="9" rel="3.24"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- added luks meta data storage helper library for clevis</changelog>
</package>
<package pkgid="d752b08d618d48fd168f8573af462f0dee5016e9797d12d7daf455291c0ff62fb30378df7f5cef4518c2418d388e1b03688731968671a83d3face74f68b088c7" name="luksmeta" arch="src">
  <version epoch="0" ver="9" rel="3.24"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- added luks meta data storage helper library for clevis</changelog>
</package>
<package pkgid="e2d792ca6cddeecef93d07f4151b8e167ea3ba5c98466d0f964a758cda2ebd1d85c87592785ffc5bb490c0d2caa3dafa30fea16060c52b6ae87221cbe037d894" name="luksmeta-debuginfo" arch="s390x">
  <version epoch="0" ver="9" rel="3.24"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- added luks meta data storage helper library for clevis</changelog>
</package>
<package pkgid="1e3a268081c84839b3d90197c35202bd4ab21b098d88e4c94ef8ace4678cbb22fa632985a16a4d98f6246d88ce07a8745a4836fa681b25aca02c8a2c55f2eaf8" name="luksmeta-debugsource" arch="s390x">
  <version epoch="0" ver="9" rel="3.24"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- added luks meta data storage helper library for clevis</changelog>
</package>
<package pkgid="bd6a4e01884a7f7b77588afdfc26f2ce20619a0a1e6d0885e143cdbb135222c41df22e0dbbbffb905e82d08ba7d6b49c12b8c9c7eed11dcc60a6fb67b7c24f3b" name="lynis" arch="noarch">
  <version epoch="0" ver="3.1.7" rel="130.3"/>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1691064000">- Update to 3.0.9:
  * Changed
  - DBS-1820 - Added newer style format for Mongo authorization setting
  - FILE-6410 - Locations added for plocate
  - SSH-7408 - Only test Compression if sshd version &lt; 7.4
  - Improved fetching timestamp
  - Minor changes such as typos</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1699790400">- add missing gawk dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1709294400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710158400">- Update to 3.1.0:
  * Added
  - Translation: Indonesian
  * Changed
  - MALW-3280 - Correction to detect com.avast.daemon
  - OS detection added for Guix System, macOS Ventura (13.x)/Sonoma (14.x), NXP
    LSDK, OpenEmbedded "nodistro", and The Yocto Projects distro "Poky"
  - Updated Amazon Linux EOL dates and addition of Amazon Linux 2023
  - STATUS_NOT_ACTIVE variable added to translation files
  - End-of-life dates updated
  - Fixing missing or erroneous test number comments
  - Detection of SentinelOne corrected
  - Wazuh for file integrity and tooling
  - Updated parsing output of arch-audit
  - Added support for SentinelOne detection
  - Replacing deprecated option -i for xargs
  - Path detection for PostgreSQL improved
- Updated additional_module_blacklist_locations.patch</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710676800">- Update to 3.1.1:
  * Added
  - Detection of ArcoLinux
  * Changed
  - DBS-1882 - Redis configuration file path added for FreeBSD (/usr/local/etc/redis.conf)
  - DBS-1882 - Check /snap directory location for Redis configuration file</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1727352000">- Update to 3.1.2:
  * Added
  - Detection of ALT Linux
  - Detection of Athena OS
  - Detection of Container-Optimized OS from Google
  - Detection of Koozali SME Server
  - Detection of Nobara Linux
  - Detection of Open Source Media Center (OSMC)
  - Detection of PostmarketOS
  - CRYP-7932 - macOS FileVault encryption test
  - FILE-6398 - Check if JBD (Journal Block Device) driver is loaded
  - FINT-4344 - Wazuh system running state
  - PKGS-7305 - Query macOS Apps in /Applications and CoreServices
  - File added: .editorconfig, which is used by editors to standardize formatting
  * Changed
  - Correction of software EOL database and inclusion of AIX entries
  - Support sysctl value perf_event_paranoid -&gt; 2|3
  - Update of translations: German, Portuguest, Turkish
  - Grammar and spell improvements
  - Improved package detection on Alpine Linux
  - Slackware support to check installed packges (functionPackageIsInstalled())
  - Added words prosecute/report to LEGAL_BANNER_STRINGS
  - Busybox support: Replace newer tr command syntax with older ascii specific operations
  - Added Wazuh as a malware scanner/antivirus and rootkit detection tool
  - Updated PHP versions and removed PHP 5 (deprecated)
  - AUTH-9262 - Corrected message with advised PAM libary (libpam-passwdqc)
  - CONT-8104 - Checking for errors, not only warning in docker info output
  - DBS-1826 - PostgreSQL detection improved for AlmaLinux, Rocky Linux, and FreeBSD
  - FILE-6344 - Test kernel version (major/minor)
  - INSE-8000 - Added inetd package and service name used in ubuntu 24.04
  - KRNL-5622 - Use systemctl get-default instead of following link
  - KRNL-5820 - Accept ulimit with -H parameter also
  - LOGG-2144 - Check for wazuh-agent presence on Linux systems
  - MACF-6234 - Test if semanage binary is available
  - MALW-3200 - ESET Endpoint Antivirus added
  - MALW-3280 - McAfee Antivirus for Linux deprecated
  - MALW-3291 - Check if Microsoft Defender Antivirus is installe
  - NETW-3200 - Added regex to allow both /bin/true as /bin/false
  - PKGS-7303 - Added version numbers to brew packages
  - PKGS-7370 - Cron job check for debsums improved
  - PKGS-7392 - Improved filtering of apt-check output (Ubuntu 24.04 may give an error)
  - PKGS-7410 - Added kernel name for Hardkernel odroid XU4
- update additional_module_blacklist_locations.patch</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1734350400">- Update to 3.1.3:
  * Added
  - Detection of Buildroot, Fedora Linux Asahi Remix, Garden Linux, Peppermint OS
  - Support for blog posts and articles to enhance suggestions
  * Changed
  - BOOT-5264 - Changed output of systemd-analyze test and added link
  - FILE-6398 - Test temporarily disabled as on modern kernels JDB support is built-in
  - FIRE-4508 - Several changes to expand the test, make it more generic, resolve minor issues
  - KRNL-5622 - Test if systemctl binary is set
  - Several improvements for busybox
  - Update of translations: Italian, Russian, Spanish</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1738065600">- Update to 3.1.4:
  * Changed
  - Update of translations: Portuguese
  - Add macOS Sequoia
  - Update of EOL database
  - Bugfix for using slashes in parameters (SafeInput function)
  - Simplified copyright line and meta data in files
  - Support for powerpc64le in authentication section
  - Don't show error "kadmin.local: unable to get default realm"</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1753790400">- Update to 3.1.5
  * Added
  - Support for OpenWrt
  - Bitdefender detection on Linux
  - Detection of openSUSE Tumbleweed-Slowroll
  * Changed
  - Corrected detection of service manager SMF
  - Extended GetHostID function to allow HostID and HostID2 creation on OpenWrt
  - Check modules also under /usr/lib/modules.d
- Drop additional_module_blacklist_locations.patch: accepted upstream</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1759579200">- tests_binary_rpath: remove usage of egrep boo#1250997</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1761220800">- Update to 3.1.6
  * Added
  - Add notice to screen output if end-of-life state is unclear
  - Support for CachyOS, macOS Tahoe, and OpenMandriva Lx
  * Changed
  - Releases are now considered to be old if they are 6 months or older
  - Removed generic suggestion for outdated/old Lynis release, instead show to screen output
  - Generic clarifications on variable usage for operating system and its version
  - Updated end-of-life database
  - Updated Japanese translation
  - For Debian and similar systems ignore kernel packages with 'rc' state
  - ACCT-9634 - Define default auditd log file location
  - FIRE-4586 - Also accept NFLOG as a logging target for iptables
  - MALW-3280 - Adjusted detection of Wazuh agent
- Updated lynis.keyring, adding a new subkey for 0xFEBB7D1812576482: 0x7A9A1D9D5B27C6D3</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1763294400">- Add Patch:
  * 1682.patch
  - Add openSUSE Leap to EOL DB</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1782388800">- Update to 3.1.7
  * Changed
  - Add Debian 13 EOL
  - Add Fedora 43 EOL date
  - Add AlmaLinux to EOL DB
  - Add EOL date for Alpine 3.22
  - Add openSUSE Leap to EOL DB
  - Fix OS detection for CachyOS (ID=cachyos)
  - Add CachyOS to OS end-of-life database
  - Update software-eol.db
  - Update RHEL 8 EOL and add RHEL 9 and 10 dates to software-eol.db
  - add Ubuntu 25.10 EOL date
  - Add publiccode.yml check as a GitHub workflow
  - Add end-of-life date for Ubuntu 26.04
  - Added EoL for Ubuntu 26.04.
  - Add NixOS EOL data
  - Update HAPPY_USERS.md
  - Add Alpine 3.23 EOL date
  - add and fix fedora dates
- Drop 1682.patch, included upstream</changelog>
</package>
<package pkgid="09e408bab03e77ea12e75078363e092538f39bef0663521aed86da21d7fb62a9b42f0ee9d454ddfebbb2abd494e1c0c9b613a5a1b6470ca1a0679edfcacc74f0" name="lynis" arch="src">
  <version epoch="0" ver="3.1.7" rel="130.3"/>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1625313600">- fix SLE 12 build</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1631793600">- Changed tests_binary_rpath to subtract points for files found with RPATH set,
  not add points for files that are configured correctly. This resulted in a
  huge number of points that skewed the overal result</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1633953600">- Update to 3.0.6:
  * Added
  - OS detection: Artix Linux, macOS Monterey, NethServer, openSUSE MicroOS
  - Check for outdated translation files
  * Changed
  - DBS-1826 - Check if PostgreSQL is being used
  - DBS-1828 - Test multiple PostgreSQL configuration file(s)
  - KRNL-5830 - Sort kernels by version instead of modification date
  - PKGS-7410 - Don't show exception for systems using LXC
  - GetHostID function: fallback options added for Linux systems
  - Fix: show correct text when egrep is missing
  - Fix: variable name for PostgreSQL</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1634126400">- Add additional_module_blacklist_locations.patch to check fo blacklisted
  modules under /usr/lib/modules.d</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1642507200">- Update to 3.0.7:
  * Added
  - MALW-3290 - Show status of malware components
  - OS detection for RHEL 6 and Funtoo Linux
  - Added service manager openrc
  * Changed
  - DBS-1804 - Added alias for MariaDB
  - FINT-4316 - Support for newer Ubuntu versions
  - MALW-3280 - Added Trend Micro malware agent
  - NETW-3200 - Allow unknown number of spaces in modprobe blacklists
  - PKGS-7320 - Support for Garuda Linux and arch-audit
  - Several improvements for busybox shell
  - Russian translation of Lynis extended
- replace 0x429A566FD5B79251 with 0x9DE922F1C2FDE6C4 in lynis.keyring
  according to https://packages.cisofy.com/
- update additional_module_blacklist_locations.patch</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1643976000">- cover /usr/etc/security/limits.conf too (boo#1194446)
  added additional_paths_security-limits.patch</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1652788800">- Update to 3.0.8:
  * Added
  - MALW-3274 - Detect McAfee VirusScan Command Line Scanner
  - PKGS-7346 Check Alpine Package Keeper (apk)
  - PKGS-7395 Check Alpine upgradeable packages
  - EOL for Alpine Linux 3.14 and 3.15
  * Changed
  - AUTH-9408 - Check for pam_faillock as well (replacement for pam_tally2)
  - FILE-7524 - Test enhanced to support symlinks
  - HTTP-6643 - Support ModSecurity version 2 and 3
  - KRNL-5788 - Only run relevant tests and improved logging
  - KRNL-5820 - Additional path for security/limits.conf
  - KRNL-5830 - Check for /var/run/needs_restarting (Slackware)
  - KRNL-5830 - Add a presence check for /boot/vmlinuz
  - PRNT-2308 - Bugfix that prevented test from storing values correctly
  - Extended location of PAM files for AARCH64
  - Some messages in log improved
- accepted upstream, removed additional_paths_security-limits.patch</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1691064000">- Update to 3.0.9:
  * Changed
  - DBS-1820 - Added newer style format for Mongo authorization setting
  - FILE-6410 - Locations added for plocate
  - SSH-7408 - Only test Compression if sshd version &lt; 7.4
  - Improved fetching timestamp
  - Minor changes such as typos</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1699790400">- add missing gawk dependency</changelog>
  <changelog author="pgajdos@suse.com" date="1709294400">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710158400">- Update to 3.1.0:
  * Added
  - Translation: Indonesian
  * Changed
  - MALW-3280 - Correction to detect com.avast.daemon
  - OS detection added for Guix System, macOS Ventura (13.x)/Sonoma (14.x), NXP
    LSDK, OpenEmbedded "nodistro", and The Yocto Projects distro "Poky"
  - Updated Amazon Linux EOL dates and addition of Amazon Linux 2023
  - STATUS_NOT_ACTIVE variable added to translation files
  - End-of-life dates updated
  - Fixing missing or erroneous test number comments
  - Detection of SentinelOne corrected
  - Wazuh for file integrity and tooling
  - Updated parsing output of arch-audit
  - Added support for SentinelOne detection
  - Replacing deprecated option -i for xargs
  - Path detection for PostgreSQL improved
- Updated additional_module_blacklist_locations.patch</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710676800">- Update to 3.1.1:
  * Added
  - Detection of ArcoLinux
  * Changed
  - DBS-1882 - Redis configuration file path added for FreeBSD (/usr/local/etc/redis.conf)
  - DBS-1882 - Check /snap directory location for Redis configuration file</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1727352000">- Update to 3.1.2:
  * Added
  - Detection of ALT Linux
  - Detection of Athena OS
  - Detection of Container-Optimized OS from Google
  - Detection of Koozali SME Server
  - Detection of Nobara Linux
  - Detection of Open Source Media Center (OSMC)
  - Detection of PostmarketOS
  - CRYP-7932 - macOS FileVault encryption test
  - FILE-6398 - Check if JBD (Journal Block Device) driver is loaded
  - FINT-4344 - Wazuh system running state
  - PKGS-7305 - Query macOS Apps in /Applications and CoreServices
  - File added: .editorconfig, which is used by editors to standardize formatting
  * Changed
  - Correction of software EOL database and inclusion of AIX entries
  - Support sysctl value perf_event_paranoid -&gt; 2|3
  - Update of translations: German, Portuguest, Turkish
  - Grammar and spell improvements
  - Improved package detection on Alpine Linux
  - Slackware support to check installed packges (functionPackageIsInstalled())
  - Added words prosecute/report to LEGAL_BANNER_STRINGS
  - Busybox support: Replace newer tr command syntax with older ascii specific operations
  - Added Wazuh as a malware scanner/antivirus and rootkit detection tool
  - Updated PHP versions and removed PHP 5 (deprecated)
  - AUTH-9262 - Corrected message with advised PAM libary (libpam-passwdqc)
  - CONT-8104 - Checking for errors, not only warning in docker info output
  - DBS-1826 - PostgreSQL detection improved for AlmaLinux, Rocky Linux, and FreeBSD
  - FILE-6344 - Test kernel version (major/minor)
  - INSE-8000 - Added inetd package and service name used in ubuntu 24.04
  - KRNL-5622 - Use systemctl get-default instead of following link
  - KRNL-5820 - Accept ulimit with -H parameter also
  - LOGG-2144 - Check for wazuh-agent presence on Linux systems
  - MACF-6234 - Test if semanage binary is available
  - MALW-3200 - ESET Endpoint Antivirus added
  - MALW-3280 - McAfee Antivirus for Linux deprecated
  - MALW-3291 - Check if Microsoft Defender Antivirus is installe
  - NETW-3200 - Added regex to allow both /bin/true as /bin/false
  - PKGS-7303 - Added version numbers to brew packages
  - PKGS-7370 - Cron job check for debsums improved
  - PKGS-7392 - Improved filtering of apt-check output (Ubuntu 24.04 may give an error)
  - PKGS-7410 - Added kernel name for Hardkernel odroid XU4
- update additional_module_blacklist_locations.patch</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1734350400">- Update to 3.1.3:
  * Added
  - Detection of Buildroot, Fedora Linux Asahi Remix, Garden Linux, Peppermint OS
  - Support for blog posts and articles to enhance suggestions
  * Changed
  - BOOT-5264 - Changed output of systemd-analyze test and added link
  - FILE-6398 - Test temporarily disabled as on modern kernels JDB support is built-in
  - FIRE-4508 - Several changes to expand the test, make it more generic, resolve minor issues
  - KRNL-5622 - Test if systemctl binary is set
  - Several improvements for busybox
  - Update of translations: Italian, Russian, Spanish</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1738065600">- Update to 3.1.4:
  * Changed
  - Update of translations: Portuguese
  - Add macOS Sequoia
  - Update of EOL database
  - Bugfix for using slashes in parameters (SafeInput function)
  - Simplified copyright line and meta data in files
  - Support for powerpc64le in authentication section
  - Don't show error "kadmin.local: unable to get default realm"</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1753790400">- Update to 3.1.5
  * Added
  - Support for OpenWrt
  - Bitdefender detection on Linux
  - Detection of openSUSE Tumbleweed-Slowroll
  * Changed
  - Corrected detection of service manager SMF
  - Extended GetHostID function to allow HostID and HostID2 creation on OpenWrt
  - Check modules also under /usr/lib/modules.d
- Drop additional_module_blacklist_locations.patch: accepted upstream</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1759579200">- tests_binary_rpath: remove usage of egrep boo#1250997</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1761220800">- Update to 3.1.6
  * Added
  - Add notice to screen output if end-of-life state is unclear
  - Support for CachyOS, macOS Tahoe, and OpenMandriva Lx
  * Changed
  - Releases are now considered to be old if they are 6 months or older
  - Removed generic suggestion for outdated/old Lynis release, instead show to screen output
  - Generic clarifications on variable usage for operating system and its version
  - Updated end-of-life database
  - Updated Japanese translation
  - For Debian and similar systems ignore kernel packages with 'rc' state
  - ACCT-9634 - Define default auditd log file location
  - FIRE-4586 - Also accept NFLOG as a logging target for iptables
  - MALW-3280 - Adjusted detection of Wazuh agent
- Updated lynis.keyring, adding a new subkey for 0xFEBB7D1812576482: 0x7A9A1D9D5B27C6D3</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1763294400">- Add Patch:
  * 1682.patch
  - Add openSUSE Leap to EOL DB</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1782388800">- Update to 3.1.7
  * Changed
  - Add Debian 13 EOL
  - Add Fedora 43 EOL date
  - Add AlmaLinux to EOL DB
  - Add EOL date for Alpine 3.22
  - Add openSUSE Leap to EOL DB
  - Fix OS detection for CachyOS (ID=cachyos)
  - Add CachyOS to OS end-of-life database
  - Update software-eol.db
  - Update RHEL 8 EOL and add RHEL 9 and 10 dates to software-eol.db
  - add Ubuntu 25.10 EOL date
  - Add publiccode.yml check as a GitHub workflow
  - Add end-of-life date for Ubuntu 26.04
  - Added EoL for Ubuntu 26.04.
  - Add NixOS EOL data
  - Update HAPPY_USERS.md
  - Add Alpine 3.23 EOL date
  - add and fix fedora dates
- Drop 1682.patch, included upstream</changelog>
</package>
<package pkgid="ef4a2921517f97d54877ffff42e39e24cd190e36c3d44ff59399b83c8740870b3ff3f50009bafd6d191fa885d40c8fdca119d5f5c2f1ac2d84fecaa096ee9f4f" name="lynis-report-converter" arch="noarch">
  <version epoch="0" ver="20181214" rel="1.30"/>
  <changelog author="jsegitz@suse.com" date="1550577600">- Initial import. PDF export doesn't work</changelog>
</package>
<package pkgid="7f641179679c8195ad4e0dabc3e4ab0cb22c03cb9b273f01b59d64924e336a38a0126dbb232b6db15c871b4a3725f3d4f1758e6f14a13906b4f50afbd4dea98e" name="lynis-report-converter" arch="src">
  <version epoch="0" ver="20181214" rel="1.30"/>
  <changelog author="jsegitz@suse.com" date="1550577600">- Initial import. PDF export doesn't work</changelog>
</package>
<package pkgid="5e94839e7e33acd5f82786bd3c30615a13cb61144dd89df5ef2ba7881d4ed9b64a33429f194bf3416de18810a1e6d67d57e10b1604627c7f3b0b1d16bb12aee6" name="makepasswd" arch="s390x">
  <version epoch="0" ver="0.5.1" rel="3.38"/>
  <changelog author="pascal.bleser@opensuse.org" date="1299585600">- initial version (0.5.0)</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1335182400">- update to 0.5.1:
  * documentation update for makepasswd, including a manual page
  * introduces a new operation mode, enumerating all the passwords likely for a
    given character set and length</changelog>
  <changelog author="Thomas.Worm@DATEV.de" date="1346932800">- Spec file modification for SLES-</changelog>
  <changelog author="jengelh@inai.de" date="1361880000">- Make package build successfully on Fedora 18
- Remove redundant %clean section</changelog>
</package>
<package pkgid="d7ff3a0a96687334c0474c5fea06d8c680d0049cdc63702be5db9db36a2d4081f39bd78bbc56d9e2d2a0c042d825932969f3d33a0d82b067ce96355334dca2e6" name="makepasswd" arch="src">
  <version epoch="0" ver="0.5.1" rel="3.38"/>
  <changelog author="pascal.bleser@opensuse.org" date="1299585600">- initial version (0.5.0)</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1335182400">- update to 0.5.1:
  * documentation update for makepasswd, including a manual page
  * introduces a new operation mode, enumerating all the passwords likely for a
    given character set and length</changelog>
  <changelog author="Thomas.Worm@DATEV.de" date="1346932800">- Spec file modification for SLES-</changelog>
  <changelog author="jengelh@inai.de" date="1361880000">- Make package build successfully on Fedora 18
- Remove redundant %clean section</changelog>
</package>
<package pkgid="6f1dfe6d44d945e6412c4456a6fcd0d705effe878ac535cbefc54423f4cb6b9f40e40745d32aecf91f96141f7d0c07efdfaa911f74e57fa704a2d709688e6e36" name="makepasswd-debuginfo" arch="s390x">
  <version epoch="0" ver="0.5.1" rel="3.38"/>
  <changelog author="pascal.bleser@opensuse.org" date="1299585600">- initial version (0.5.0)</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1335182400">- update to 0.5.1:
  * documentation update for makepasswd, including a manual page
  * introduces a new operation mode, enumerating all the passwords likely for a
    given character set and length</changelog>
  <changelog author="Thomas.Worm@DATEV.de" date="1346932800">- Spec file modification for SLES-</changelog>
  <changelog author="jengelh@inai.de" date="1361880000">- Make package build successfully on Fedora 18
- Remove redundant %clean section</changelog>
</package>
<package pkgid="d5ddea4aba8f1876e05e7fda9d86b09b7309e23f8a4ce4764ebcbfc2f96c9366bdb5b3b8dcbadb86082897f79b6431955684390a297a8f09662ac7f924c2f5b1" name="makepasswd-debugsource" arch="s390x">
  <version epoch="0" ver="0.5.1" rel="3.38"/>
  <changelog author="pascal.bleser@opensuse.org" date="1299585600">- initial version (0.5.0)</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1335182400">- update to 0.5.1:
  * documentation update for makepasswd, including a manual page
  * introduces a new operation mode, enumerating all the passwords likely for a
    given character set and length</changelog>
  <changelog author="Thomas.Worm@DATEV.de" date="1346932800">- Spec file modification for SLES-</changelog>
  <changelog author="jengelh@inai.de" date="1361880000">- Make package build successfully on Fedora 18
- Remove redundant %clean section</changelog>
</package>
<package pkgid="340297a5150222a6ec47919be141453e346443f5607cf510763bd168ecbd7cf6cedbc01caf08cc0aaa6c84d1d1c1e33fffff49d3263e5d3379c5456a77db4858" name="masscan" arch="s390x">
  <version epoch="0" ver="1.3.2" rel="1.14"/>
  <changelog author="jsegitz@suse.com" date="1511524800">- Initial package import, based on commit 51da058</changelog>
  <changelog author="jsegitz@suse.com" date="1554897600">- Update to current git version. Notable changes
  * fixed TPACKET3 problem on linux libpcap
  * tcp service names in greppable output
  * refactored TCP/IP stack
  * new --top-ports option
- Added pcap_names.patch to fix libpcap not being found
  (bsc#1131751)</changelog>
  <changelog author="mark_nefedov@runbox.com" date="1653048000">- Update to current git version. Notable changes
  * support for some VPNs
  * fixes
  * IPv6 support</changelog>
  <changelog author="Georg Pfuetzenreuter &lt;mail+rpm@georg-pfuetzenreuter.net&gt;" date="1753272000">- Update to release 1.3.2
- Refactor to source services
- Remove pcap_names.patch
- Modernize and tidy-up spec file, use common macros</changelog>
  <changelog author="Georg Pfuetzenreuter &lt;mail+rpm@georg-pfuetzenreuter.net&gt;" date="1753272001">- Ship man page
- Run tests</changelog>
</package>
<package pkgid="a1bf3e725788276febd0716a3e9d45d663ccf9f42ed62aba0eb70a07c94fe17fd2042de4381c76093ba0940a324a9f96963455cc88631fc748c0c7d2396aaa0a" name="masscan" arch="src">
  <version epoch="0" ver="1.3.2" rel="1.14"/>
  <changelog author="jsegitz@suse.com" date="1511524800">- Initial package import, based on commit 51da058</changelog>
  <changelog author="jsegitz@suse.com" date="1554897600">- Update to current git version. Notable changes
  * fixed TPACKET3 problem on linux libpcap
  * tcp service names in greppable output
  * refactored TCP/IP stack
  * new --top-ports option
- Added pcap_names.patch to fix libpcap not being found
  (bsc#1131751)</changelog>
  <changelog author="mark_nefedov@runbox.com" date="1653048000">- Update to current git version. Notable changes
  * support for some VPNs
  * fixes
  * IPv6 support</changelog>
  <changelog author="Georg Pfuetzenreuter &lt;mail+rpm@georg-pfuetzenreuter.net&gt;" date="1753272000">- Update to release 1.3.2
- Refactor to source services
- Remove pcap_names.patch
- Modernize and tidy-up spec file, use common macros</changelog>
  <changelog author="Georg Pfuetzenreuter &lt;mail+rpm@georg-pfuetzenreuter.net&gt;" date="1753272001">- Ship man page
- Run tests</changelog>
</package>
<package pkgid="a11a930ceadbb49333105aeab95e98a71cf0827a38d14f8da2d1f1593d998c2d1b253824251389e78db4ce67a88cb1aabab882f80b6d36dd4f346124b2c09495" name="masscan-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3.2" rel="1.14"/>
  <changelog author="jsegitz@suse.com" date="1511524800">- Initial package import, based on commit 51da058</changelog>
  <changelog author="jsegitz@suse.com" date="1554897600">- Update to current git version. Notable changes
  * fixed TPACKET3 problem on linux libpcap
  * tcp service names in greppable output
  * refactored TCP/IP stack
  * new --top-ports option
- Added pcap_names.patch to fix libpcap not being found
  (bsc#1131751)</changelog>
  <changelog author="mark_nefedov@runbox.com" date="1653048000">- Update to current git version. Notable changes
  * support for some VPNs
  * fixes
  * IPv6 support</changelog>
  <changelog author="Georg Pfuetzenreuter &lt;mail+rpm@georg-pfuetzenreuter.net&gt;" date="1753272000">- Update to release 1.3.2
- Refactor to source services
- Remove pcap_names.patch
- Modernize and tidy-up spec file, use common macros</changelog>
  <changelog author="Georg Pfuetzenreuter &lt;mail+rpm@georg-pfuetzenreuter.net&gt;" date="1753272001">- Ship man page
- Run tests</changelog>
</package>
<package pkgid="780238a1e856b424e0c6f29e65a2b3df91ce10486022cd00b4eec63363c4e5c43e1368f8df90e2838dbe87c5c1ad562922012661a77641fc47eaec70ce5a1a9f" name="masscan-debugsource" arch="s390x">
  <version epoch="0" ver="1.3.2" rel="1.14"/>
  <changelog author="jsegitz@suse.com" date="1511524800">- Initial package import, based on commit 51da058</changelog>
  <changelog author="jsegitz@suse.com" date="1554897600">- Update to current git version. Notable changes
  * fixed TPACKET3 problem on linux libpcap
  * tcp service names in greppable output
  * refactored TCP/IP stack
  * new --top-ports option
- Added pcap_names.patch to fix libpcap not being found
  (bsc#1131751)</changelog>
  <changelog author="mark_nefedov@runbox.com" date="1653048000">- Update to current git version. Notable changes
  * support for some VPNs
  * fixes
  * IPv6 support</changelog>
  <changelog author="Georg Pfuetzenreuter &lt;mail+rpm@georg-pfuetzenreuter.net&gt;" date="1753272000">- Update to release 1.3.2
- Refactor to source services
- Remove pcap_names.patch
- Modernize and tidy-up spec file, use common macros</changelog>
  <changelog author="Georg Pfuetzenreuter &lt;mail+rpm@georg-pfuetzenreuter.net&gt;" date="1753272001">- Ship man page
- Run tests</changelog>
</package>
<package pkgid="cec78e239c97643f9a203e85056f5e4453c16210a1e70291f6dee8e02425ffee88d74aef9ac1a01bb9ae8136722fe166ae58bc855bc4dee9ab84526cfdd0e9b3" name="microfw" arch="noarch">
  <version epoch="0" ver="2.0.1" rel="5.8"/>
  <changelog author="neutrino8@gmail.com" date="1446120000">- New and rewritten version</changelog>
  <changelog author="neutrino8@gmail.com" date="1476792000">- Add a reload to the init.d script
- Don't filter multicast/broadcast messages
- Add Conflicts=ufw.service to the systemd service file</changelog>
  <changelog author="neutrino8@gmail.com" date="1477051200">- Update the README file</changelog>
  <changelog author="neutrino8@gmail.com" date="1482148800">- Remove SuSEfirewall2 conflicts in spec file</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1495022400">- Does not use %insserv_cleanup for systems with systemd
  (build package bugfix for Tumbleweed and Factory)</changelog>
  <changelog author="neutrino8@gmail.com" date="1521201600">- Don't own /var/adm/fillup-templates</changelog>
  <changelog author="neutrino8@gmail.com" date="1658836800">- Add more ICMPv6 types to be allowed</changelog>
  <changelog author="neutrino8@gmail.com" date="1658923200">- Add Conflicts: nfw to spec file</changelog>
  <changelog author="neutrino8@gmail.com" date="1659700800">- Fix sysconfig file</changelog>
  <changelog author="neutrino8@gmail.com" date="1659787200">- Change shebang from /bin/bash to /usr/bin/bash</changelog>
</package>
<package pkgid="be20d6995a467112311a7d556ce10af5f03b863dfdd7352ab83b04cecf189a86a0969f5f493e448d52695c9667cf27de6bc86bd3b32b0aeb369e11d36520c9a7" name="microfw" arch="src">
  <version epoch="0" ver="2.0.1" rel="5.8"/>
  <changelog author="neutrino8@gmail.com" date="1392638400">- Initial package release</changelog>
  <changelog author="neutrino8@gmail.com" date="1392724800">- Instead of exiting, create missing rules files if they
  don't exist</changelog>
  <changelog author="neutrino8@gmail.com" date="1392811200">- Check base dir and create it if it's missing
- Added LICENSE, ChangeLog and AUTHORS files
- Support SLES/SLED and add init script</changelog>
  <changelog author="neutrino8@gmail.com" date="1416916800">- Improved the systemd unit file</changelog>
  <changelog author="neutrino8@gmail.com" date="1424174400">- Add a few default rules</changelog>
  <changelog author="neutrino8@gmail.com" date="1429272000">- Open port for DHCPv6 client</changelog>
  <changelog author="neutrino8@gmail.com" date="1430913600">- Add Conflicts=SuSEfirewall2.service to the systemd service file</changelog>
  <changelog author="neutrino8@gmail.com" date="1446120000">- New and rewritten version</changelog>
  <changelog author="neutrino8@gmail.com" date="1476792000">- Add a reload to the init.d script
- Don't filter multicast/broadcast messages
- Add Conflicts=ufw.service to the systemd service file</changelog>
  <changelog author="neutrino8@gmail.com" date="1477051200">- Update the README file</changelog>
  <changelog author="neutrino8@gmail.com" date="1482148800">- Remove SuSEfirewall2 conflicts in spec file</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1495022400">- Does not use %insserv_cleanup for systems with systemd
  (build package bugfix for Tumbleweed and Factory)</changelog>
  <changelog author="neutrino8@gmail.com" date="1521201600">- Don't own /var/adm/fillup-templates</changelog>
  <changelog author="neutrino8@gmail.com" date="1658836800">- Add more ICMPv6 types to be allowed</changelog>
  <changelog author="neutrino8@gmail.com" date="1658923200">- Add Conflicts: nfw to spec file</changelog>
  <changelog author="neutrino8@gmail.com" date="1659700800">- Fix sysconfig file</changelog>
  <changelog author="neutrino8@gmail.com" date="1659787200">- Change shebang from /bin/bash to /usr/bin/bash</changelog>
</package>
<package pkgid="1e6f2592d020a956e0210f393f9a35b8ed113d7d6e5c31dbcf45630143ebc82124160d4e945a6d3a5f556c8d40fbd930782c8b59e06ed7ba7caced5dd4b5db7a" name="minisign" arch="s390x">
  <version epoch="0" ver="0.12" rel="9.6"/>
  <changelog author="AxelKoellhofer@web.de - 0.8" date="1517659200">- updated to 0.8
  * Multiple files can now be signed at once
  * Support for HaikuOS was added
  * The command-line switch to use custom file names when generating
    key pairs didn't work properly; this has been fixed</changelog>
  <changelog author="AxelKoellhofer@web.de - 0.8" date="1559390400">- added upstream.patch
  * Add the "-R" option (re-create pubkey from secret key)</changelog>
  <changelog author="Jonathan Brielmaier &lt;jbrielmaier@suse.de&gt;" date="1563537600">- clean up spec file</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1600689600">- Fix debuginfo generation (set CMAKE_STRIP to false)
- Update to version 0.9
  * New option: -R to recover the public key from a secret key.
  * Error messages have been improved.
  * Key derivation is now possible on devices with limited memory.</changelog>
  <changelog author="Joshua Smith &lt;smolsheep@opensuse.org&gt;" date="1721476800">- Switch from deprecated %setup to %autosetup
- Use %cmake_build
- Update to version 0.11
  * For non-interactive usage (CI/CD, etc), encryption of private
    keys can be disabled with the -W switch.
  * A new command, -C was added to change passwords, or remove them
    (when combined with -W).
- Updates from version 0.10
  * Prehashing is now enabled by default, regardless of the input
    size. Support for non-prehashed signatures will eventually be
    removed
  * Legacy signatures can be rejected with the addition of the -H
    flag</changelog>
  <changelog author="Joshua Smith &lt;smolsheep@opensuse.org&gt;" date="1721649600">- Cleanup spec file
  * Add missing %license to packaging
  * Remove %debug_package</changelog>
  <changelog author="Joshua Smith &lt;smolsheep@opensuse.org&gt;" date="1738411200">- Update to version 0.12
  * Libsodium is now an optional dependency. When using the Zig
    toolchain to compile Minisign, you can specify the
  - Dwithout-libsodium flag to build and run without libsodium.
  * Key identifiers are now zero-padded when printed.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1768219200">- Security fix: [gpg.fail/minisign]
  * Trusted comment injection (minisign) [a10dc92]
  * Bail out if the signature file contains unprintable characters
  * Add minisign-gpg.fail-minisign.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1768219201">- Security fix: [gpg.fail/trustcomment]
  * Trusted comment injection (minisign) [6c59875]
  * trim(): only trim trailing \r\n, reject straight \r characters
  * Add minisign-gpg.fail-trustcomment.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1768219202">- Bugfix:
  * bugfix: duplicate command-line arguments [7dfdb3c]
  * Add minisign-dup-command-line-args.patch</changelog>
</package>
<package pkgid="37570f7ef59c4a1652bfbd9f8673d61ad05e33bf74a8fcc3f86dd2aa495694ef0fe4251c79117d8144b09ce327d593a8f11ad4db3c92df35d69c94eaeda2fb92" name="minisign" arch="src">
  <version epoch="0" ver="0.12" rel="9.6"/>
  <changelog author="AxelKoellhofer@web.de - 0.7" date="1491048000">- initial package, version 0.7</changelog>
  <changelog author="AxelKoellhofer@web.de - 0.8" date="1517659200">- updated to 0.8
  * Multiple files can now be signed at once
  * Support for HaikuOS was added
  * The command-line switch to use custom file names when generating
    key pairs didn't work properly; this has been fixed</changelog>
  <changelog author="AxelKoellhofer@web.de - 0.8" date="1559390400">- added upstream.patch
  * Add the "-R" option (re-create pubkey from secret key)</changelog>
  <changelog author="Jonathan Brielmaier &lt;jbrielmaier@suse.de&gt;" date="1563537600">- clean up spec file</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1600689600">- Fix debuginfo generation (set CMAKE_STRIP to false)
- Update to version 0.9
  * New option: -R to recover the public key from a secret key.
  * Error messages have been improved.
  * Key derivation is now possible on devices with limited memory.</changelog>
  <changelog author="Joshua Smith &lt;smolsheep@opensuse.org&gt;" date="1721476800">- Switch from deprecated %setup to %autosetup
- Use %cmake_build
- Update to version 0.11
  * For non-interactive usage (CI/CD, etc), encryption of private
    keys can be disabled with the -W switch.
  * A new command, -C was added to change passwords, or remove them
    (when combined with -W).
- Updates from version 0.10
  * Prehashing is now enabled by default, regardless of the input
    size. Support for non-prehashed signatures will eventually be
    removed
  * Legacy signatures can be rejected with the addition of the -H
    flag</changelog>
  <changelog author="Joshua Smith &lt;smolsheep@opensuse.org&gt;" date="1721649600">- Cleanup spec file
  * Add missing %license to packaging
  * Remove %debug_package</changelog>
  <changelog author="Joshua Smith &lt;smolsheep@opensuse.org&gt;" date="1738411200">- Update to version 0.12
  * Libsodium is now an optional dependency. When using the Zig
    toolchain to compile Minisign, you can specify the
  - Dwithout-libsodium flag to build and run without libsodium.
  * Key identifiers are now zero-padded when printed.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1768219200">- Security fix: [gpg.fail/minisign]
  * Trusted comment injection (minisign) [a10dc92]
  * Bail out if the signature file contains unprintable characters
  * Add minisign-gpg.fail-minisign.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1768219201">- Security fix: [gpg.fail/trustcomment]
  * Trusted comment injection (minisign) [6c59875]
  * trim(): only trim trailing \r\n, reject straight \r characters
  * Add minisign-gpg.fail-trustcomment.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1768219202">- Bugfix:
  * bugfix: duplicate command-line arguments [7dfdb3c]
  * Add minisign-dup-command-line-args.patch</changelog>
</package>
<package pkgid="a8993731f379083104513be52e11a848da1ed66f6345b94b778c3e441739e6bb3e923483a17bb727425af6a9a8082be721f880207dba206018c447ba62ac0747" name="minisign-debuginfo" arch="s390x">
  <version epoch="0" ver="0.12" rel="9.6"/>
  <changelog author="AxelKoellhofer@web.de - 0.8" date="1517659200">- updated to 0.8
  * Multiple files can now be signed at once
  * Support for HaikuOS was added
  * The command-line switch to use custom file names when generating
    key pairs didn't work properly; this has been fixed</changelog>
  <changelog author="AxelKoellhofer@web.de - 0.8" date="1559390400">- added upstream.patch
  * Add the "-R" option (re-create pubkey from secret key)</changelog>
  <changelog author="Jonathan Brielmaier &lt;jbrielmaier@suse.de&gt;" date="1563537600">- clean up spec file</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1600689600">- Fix debuginfo generation (set CMAKE_STRIP to false)
- Update to version 0.9
  * New option: -R to recover the public key from a secret key.
  * Error messages have been improved.
  * Key derivation is now possible on devices with limited memory.</changelog>
  <changelog author="Joshua Smith &lt;smolsheep@opensuse.org&gt;" date="1721476800">- Switch from deprecated %setup to %autosetup
- Use %cmake_build
- Update to version 0.11
  * For non-interactive usage (CI/CD, etc), encryption of private
    keys can be disabled with the -W switch.
  * A new command, -C was added to change passwords, or remove them
    (when combined with -W).
- Updates from version 0.10
  * Prehashing is now enabled by default, regardless of the input
    size. Support for non-prehashed signatures will eventually be
    removed
  * Legacy signatures can be rejected with the addition of the -H
    flag</changelog>
  <changelog author="Joshua Smith &lt;smolsheep@opensuse.org&gt;" date="1721649600">- Cleanup spec file
  * Add missing %license to packaging
  * Remove %debug_package</changelog>
  <changelog author="Joshua Smith &lt;smolsheep@opensuse.org&gt;" date="1738411200">- Update to version 0.12
  * Libsodium is now an optional dependency. When using the Zig
    toolchain to compile Minisign, you can specify the
  - Dwithout-libsodium flag to build and run without libsodium.
  * Key identifiers are now zero-padded when printed.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1768219200">- Security fix: [gpg.fail/minisign]
  * Trusted comment injection (minisign) [a10dc92]
  * Bail out if the signature file contains unprintable characters
  * Add minisign-gpg.fail-minisign.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1768219201">- Security fix: [gpg.fail/trustcomment]
  * Trusted comment injection (minisign) [6c59875]
  * trim(): only trim trailing \r\n, reject straight \r characters
  * Add minisign-gpg.fail-trustcomment.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1768219202">- Bugfix:
  * bugfix: duplicate command-line arguments [7dfdb3c]
  * Add minisign-dup-command-line-args.patch</changelog>
</package>
<package pkgid="ce0d490c342e742b00e19960ec361d08f5a8f131842f16060d8f4b05d2149e85e52d87b27e67b599722a3076766216872db669f92c3e7e87cf13093653a27dfc" name="minisign-debugsource" arch="s390x">
  <version epoch="0" ver="0.12" rel="9.6"/>
  <changelog author="AxelKoellhofer@web.de - 0.8" date="1517659200">- updated to 0.8
  * Multiple files can now be signed at once
  * Support for HaikuOS was added
  * The command-line switch to use custom file names when generating
    key pairs didn't work properly; this has been fixed</changelog>
  <changelog author="AxelKoellhofer@web.de - 0.8" date="1559390400">- added upstream.patch
  * Add the "-R" option (re-create pubkey from secret key)</changelog>
  <changelog author="Jonathan Brielmaier &lt;jbrielmaier@suse.de&gt;" date="1563537600">- clean up spec file</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1600689600">- Fix debuginfo generation (set CMAKE_STRIP to false)
- Update to version 0.9
  * New option: -R to recover the public key from a secret key.
  * Error messages have been improved.
  * Key derivation is now possible on devices with limited memory.</changelog>
  <changelog author="Joshua Smith &lt;smolsheep@opensuse.org&gt;" date="1721476800">- Switch from deprecated %setup to %autosetup
- Use %cmake_build
- Update to version 0.11
  * For non-interactive usage (CI/CD, etc), encryption of private
    keys can be disabled with the -W switch.
  * A new command, -C was added to change passwords, or remove them
    (when combined with -W).
- Updates from version 0.10
  * Prehashing is now enabled by default, regardless of the input
    size. Support for non-prehashed signatures will eventually be
    removed
  * Legacy signatures can be rejected with the addition of the -H
    flag</changelog>
  <changelog author="Joshua Smith &lt;smolsheep@opensuse.org&gt;" date="1721649600">- Cleanup spec file
  * Add missing %license to packaging
  * Remove %debug_package</changelog>
  <changelog author="Joshua Smith &lt;smolsheep@opensuse.org&gt;" date="1738411200">- Update to version 0.12
  * Libsodium is now an optional dependency. When using the Zig
    toolchain to compile Minisign, you can specify the
  - Dwithout-libsodium flag to build and run without libsodium.
  * Key identifiers are now zero-padded when printed.</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1768219200">- Security fix: [gpg.fail/minisign]
  * Trusted comment injection (minisign) [a10dc92]
  * Bail out if the signature file contains unprintable characters
  * Add minisign-gpg.fail-minisign.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1768219201">- Security fix: [gpg.fail/trustcomment]
  * Trusted comment injection (minisign) [6c59875]
  * trim(): only trim trailing \r\n, reject straight \r characters
  * Add minisign-gpg.fail-trustcomment.patch</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1768219202">- Bugfix:
  * bugfix: duplicate command-line arguments [7dfdb3c]
  * Add minisign-dup-command-line-args.patch</changelog>
</package>
<package pkgid="48704e051c535dd58a531430fe3c3a7a789daf7940056e121369a4b3e5a244ca7e81622cef6a289a446a48463b6897f7dbd4026ba42077b19f94bae5da36e9b9" name="monitoring-plugins-fail2ban" arch="noarch">
  <version epoch="0" ver="1.1.1" rel="168.1"/>
  <changelog author="Lars Vogdt &lt;lars@linux-schulserver.de&gt;" date="1685966400">- use nagios-rpm-macros to define the libexecdir for SUSE distributions
  correctly (defaut here is /usr/lib/nagios/plugins)
- move conditional for %%pre scripts, to avoid any dependency or other
  stuff getting in the way on old distributions</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1725451200">- fail2ban-fix-openssh98.patch: fix to work with openssh 9.8 (bsc#1230101)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729684800">- update to 1.1.0:
  * circumvent SEGFAULT in a python's socket module by
    getaddrinfo with disabled IPv6 (gh-3438)
  * avoid sporadic error in pyinotify backend if pending file
    deleted in other thread, e. g. by flushing logs (gh-3635)
  * `action.d/cloudflare-token.conf` - fixes gh-3479, url-encode
    args by unban
  * `action.d/*ipset*`: make `maxelem` ipset option configurable
    through banaction arguments (gh-3564)
  * `filter.d/apache-common.conf` - accepts remote besides client
    (gh-3622)
  * `filter.d/mysqld-auth.conf` - matches also if no suffix in
    message (mariadb 10.3 log format, gh-3603)
  * `filter.d/nginx-*.conf` - nginx error-log filters extended
    with support of journal format (gh-3646)
  * `filter.d/postfix.conf`:
  - "rejected" rule extended to match "Access denied" too
  - avoid double counting ('lost connection after AUTH'
    together with message 'disconnect ...', gh-3505)
  - add Sender address rejected: Malformed DNS server reply
  - add to postfix syslog daemon format (gh-3690)
  - change journalmatch postfix, allow sub-units with
    postfix@-.service (gh-3692)
  * `filter.d/recidive.conf`: support for systemd-journal,
    conditional RE depending on logtype (for file or journal,
    gh-3693)
  * `filter.d/slapd.conf` - filter rewritten for single-line
    processing, matches errored result without `text=...`
    (gh-3604)
  * supports python 3.12 and 3.13 (gh-3487)
  * bundling async modules removed in python 3.12+ (fallback to
    local libraries pyasyncore/pyasynchat if import would miss
    them, gh-3487)
  * `fail2ban-client` extended (gh-2975):
  - `fail2ban-client status --all [flavor]` - returns status
    of fail2ban and all jails in usual form
  - `fail2ban-client stats` - returns statistic in form of
    table (jail, backend, found and banned counts)
  - `fail2ban-client statistic` or `fail2ban-client
    statistics` - same as `fail2ban-client stats` (aliases for
    stats)
  - `fail2ban-client status --all stats` - (undocumented,
    flavor "stats") returns statistic of all jails in form of
    python dict
  * `fail2ban-regex` extended to load settings from jail (by
    simple name it'd prefer jail to the filter now, gh-2655);
- drop fail2ban-disable-iptables-w-option.patch: only needed for
  sle10 and older, which is no longer supported (is now python &gt;=
  3.5)</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1741608000">- Add BuildRequires on setuptools, required for Python 3.12+.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1743249600">- distutils (provided by python3-setuptools) is also needed during
  time, or f2b cannot launch the systemd log analyzer backend.
- Delete all pre-SUSE-15.x build instructions.
- Delete fail2ban-opensuse-service-sfw.patch,
  fail2ban-opensuse-service.patch, sfw-fail2ban.conf,
  since this mostly part of the pristine fail2ban.service.in
  already. (Unit modified in %install for SFW.)</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1749211200">- Add %python3_fix_shebang macro</changelog>
  <changelog author="Nathan Cutler &lt;ncutler@suse.com&gt;" date="1749556800">- spec:
  * Use pyproject macros to build and install (including
    implementing manual install for files under /etc and /usr from
    the wheel)
  * some BuildRequires cleanup</changelog>
  <changelog author="Nathan Cutler &lt;ncutler@suse.com&gt;" date="1749643200">- spec:
  * simplify manual installation of files under /etc and /usr from
    the wheel</changelog>
  <changelog author="Nathan Cutler &lt;ncutler@suse.com&gt;" date="1749816000">- Add setup-py-install-dir.patch:
  * fix unit file population broken by switch to %pyproject_wheel</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1750075200">- spec:
  * Drop noarch due to /usr/bin/fail2ban-python ELF
  * noarch for monitoring subpackage</changelog>
  <changelog author="chris@computersalat.de" date="1750334400">- fix build
  * service file install
- some rpmlint fixes
- Add fail2ban_service.patch
- rebase patches
  * fail2ban-0.10.4-env-script-interpreter.patch
  * fail2ban-fix-openssh98.patch
  * fail2ban-opensuse-locations.patch
  * harden_fail2ban.service.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1781870400">- Modernize specfile constructs
- Make build recipe compatible with POSIX sh</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1787054400">- Update to 1.1.1
  * For details, see
    &lt;https://github.com/fail2ban/fail2ban/blob/1.1.1/ChangeLog&gt;.
  * The iptables filter was rewritten for supporting multiple
    chains. User-level derivations may become incompatible. Tags
    like e.g. `&lt;chain&gt;` and `&lt;_ipt_for_proto-iter&gt;` may need to be
    replaced.
  * Several rules in the Exim filter w.r.t. mode "normal" moved to
    a new mode "more", because of too risky handling. To use the
    config as before, set `mode = more` for the exim jail.
  * Fixed catastrophic backtracking explosion for REs in
    domino-smtp and dovecot filters.
  * Fixed systemd causing "too many open files" error for a lot of
    journal files and large amount of systemd jails.
  * Passing of arguments from jails to action or filter will affect
    conditional section too, e.g. setting blocktype="DROP" via jail
    for action would now apply for IPv4 and IPv6 chains.
  * jail.conf:
  * Default `banactions` need to be specified in paths-*.conf
    (maintainer level) now.
  * Since the stock fail2ban includes paths-debian.conf by default,
    banactions are nftables (can be overwritten in jail.local by
    user).
  * action.d/firewallcmd-ipset.conf: Renamed `ipsettype` to
    `ipsetbackend`. The parameter ipsettype will be used now to the
    real set type.
  * The Apache filter now recognizes AH02811 and AH10244 log messages.
  * The sshd filter was adapted to support OpenSSH 9.8's new
    "sshd-session" process and log messages.
  * sshd filter: DDoS and aggressive modes had their regex extended
    for timeout before authentication.
  * New Features and Enhancements
  * The systemd backend was extended with a new parameter called "rotated"
    that allows monitoring only actual journals and ignore a lot of rotated files by
    default.
  * The new jail option `skip_if_nologs` was added to ignore a jail
    if no logpath matches were found.
- Drop fail2ban-fix-openssh98.patch, bacause now in upstream.</changelog>
</package>
<package pkgid="2ab38dac214c01f313725907b743cbacb11cfad6080cd8facb9a0e741ecced5959c56174a84ddff1bd1ecd6429eff1cab138edf7f0d4a1f122c966091c5f6f73" name="ndpmon" arch="s390x">
  <version epoch="0" ver="2.1.0" rel="5.31"/>
  <changelog author="jfunk@funktronics.ca" date="1338984000">- Initial release</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346760000">- ran spec-cleaner
- add Buildrequires automake needed by autoreconf in openSUSE 12.2</changelog>
  <changelog author="jfunk@funktronics.ca" date="1424520000">- Update to 2.1.0:
  * multiple interfaces support
  * whole new architecture:
  - multithreading
  - event driven
  - watchers list with custom scheduler
  * code lifting and improvements
  * new alerts and compatibility with updated RFCs
  * and much more...
- Replace init script with unit file
- Added ndpmon-2.1.0-install.patch to fix install locations
- Added ndpmon-no-date-time.patch to remove embedded build date and time
- Removed ndpmon-1.4.0-snprintf.patch
- Removed ndpmon-1.4.0-makefile.patch
- Removed ndpmon-1.4.0-makefile.patch
- Removed config.patch
- Removed default.paths.manpage.patch
- Removed manuf.path.patch
- Removed spell.manpage.patch
- Removed spell.ndpmon.patch
- Removed spell.neighbors.patch</changelog>
  <changelog author="jfunk@funktronics.ca" date="1426161600">- Add ndpmon-config.patch to fix examples in default config</changelog>
  <changelog author="mardnh@gmx.de" date="1544961600">- Run spec-cleaner
- Use manuf file from wireshark git master</changelog>
</package>
<package pkgid="bb401e5f27eabf72eb4145c1d73685d28fc997d8a74a7ce4ab216bc4ab72506aacbb3ca7e8b1bde49532bef88189acfd4ede0226335245f82b085fd0aa10d978" name="ndpmon" arch="src">
  <version epoch="0" ver="2.1.0" rel="5.31"/>
  <changelog author="jfunk@funktronics.ca" date="1338984000">- Initial release</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346760000">- ran spec-cleaner
- add Buildrequires automake needed by autoreconf in openSUSE 12.2</changelog>
  <changelog author="jfunk@funktronics.ca" date="1424520000">- Update to 2.1.0:
  * multiple interfaces support
  * whole new architecture:
  - multithreading
  - event driven
  - watchers list with custom scheduler
  * code lifting and improvements
  * new alerts and compatibility with updated RFCs
  * and much more...
- Replace init script with unit file
- Added ndpmon-2.1.0-install.patch to fix install locations
- Added ndpmon-no-date-time.patch to remove embedded build date and time
- Removed ndpmon-1.4.0-snprintf.patch
- Removed ndpmon-1.4.0-makefile.patch
- Removed ndpmon-1.4.0-makefile.patch
- Removed config.patch
- Removed default.paths.manpage.patch
- Removed manuf.path.patch
- Removed spell.manpage.patch
- Removed spell.ndpmon.patch
- Removed spell.neighbors.patch</changelog>
  <changelog author="jfunk@funktronics.ca" date="1426161600">- Add ndpmon-config.patch to fix examples in default config</changelog>
  <changelog author="mardnh@gmx.de" date="1544961600">- Run spec-cleaner
- Use manuf file from wireshark git master</changelog>
</package>
<package pkgid="9c6e6cb377f86f3c91b7901264529f821e0757562867b1d83d21af08e78784e8a2a64bdf5057032f1987c70115599ba1d26a85fbd3317048014e386364f1be26" name="ndpmon-debuginfo" arch="s390x">
  <version epoch="0" ver="2.1.0" rel="5.31"/>
  <changelog author="jfunk@funktronics.ca" date="1338984000">- Initial release</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346760000">- ran spec-cleaner
- add Buildrequires automake needed by autoreconf in openSUSE 12.2</changelog>
  <changelog author="jfunk@funktronics.ca" date="1424520000">- Update to 2.1.0:
  * multiple interfaces support
  * whole new architecture:
  - multithreading
  - event driven
  - watchers list with custom scheduler
  * code lifting and improvements
  * new alerts and compatibility with updated RFCs
  * and much more...
- Replace init script with unit file
- Added ndpmon-2.1.0-install.patch to fix install locations
- Added ndpmon-no-date-time.patch to remove embedded build date and time
- Removed ndpmon-1.4.0-snprintf.patch
- Removed ndpmon-1.4.0-makefile.patch
- Removed ndpmon-1.4.0-makefile.patch
- Removed config.patch
- Removed default.paths.manpage.patch
- Removed manuf.path.patch
- Removed spell.manpage.patch
- Removed spell.ndpmon.patch
- Removed spell.neighbors.patch</changelog>
  <changelog author="jfunk@funktronics.ca" date="1426161600">- Add ndpmon-config.patch to fix examples in default config</changelog>
  <changelog author="mardnh@gmx.de" date="1544961600">- Run spec-cleaner
- Use manuf file from wireshark git master</changelog>
</package>
<package pkgid="06ea6c0ba43509bc2085df08b0e23d0562a1e83ec7bd0e093535a3e0166c8c53deb953f74ea3d4d220120e2b75e9eb135bff7d9fa75f0d994dee4fe1c59fec9c" name="ndpmon-debugsource" arch="s390x">
  <version epoch="0" ver="2.1.0" rel="5.31"/>
  <changelog author="jfunk@funktronics.ca" date="1338984000">- Initial release</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346760000">- ran spec-cleaner
- add Buildrequires automake needed by autoreconf in openSUSE 12.2</changelog>
  <changelog author="jfunk@funktronics.ca" date="1424520000">- Update to 2.1.0:
  * multiple interfaces support
  * whole new architecture:
  - multithreading
  - event driven
  - watchers list with custom scheduler
  * code lifting and improvements
  * new alerts and compatibility with updated RFCs
  * and much more...
- Replace init script with unit file
- Added ndpmon-2.1.0-install.patch to fix install locations
- Added ndpmon-no-date-time.patch to remove embedded build date and time
- Removed ndpmon-1.4.0-snprintf.patch
- Removed ndpmon-1.4.0-makefile.patch
- Removed ndpmon-1.4.0-makefile.patch
- Removed config.patch
- Removed default.paths.manpage.patch
- Removed manuf.path.patch
- Removed spell.manpage.patch
- Removed spell.ndpmon.patch
- Removed spell.neighbors.patch</changelog>
  <changelog author="jfunk@funktronics.ca" date="1426161600">- Add ndpmon-config.patch to fix examples in default config</changelog>
  <changelog author="mardnh@gmx.de" date="1544961600">- Run spec-cleaner
- Use manuf file from wireshark git master</changelog>
</package>
<package pkgid="a7f64c31f4d319db6ab20bb9db8ba09d6c7470c15017aaa719229c775c40d0baa88c205a93f77b2afa9b52df0e88d1beb26660e877fed6ec1c21e473db8b6c93" name="nfw" arch="noarch">
  <version epoch="0" ver="1.3.1" rel="1.8"/>
  <changelog author="neutrino8@opensuse.org" date="1649246400">- Version 1.0
  * Initial release</changelog>
  <changelog author="neutrino8@opensuse.org" date="1649332800">- Version 1.1
  * Update README file
  * Add nftables requirement to spec file</changelog>
  <changelog author="neutrino8@opensuse.org" date="1649332801">- Version 1.2
  * Update README file
  * Correct previous ChangeLog entry</changelog>
  <changelog author="neutrino8@opensuse.org" date="1649419200">- Version 1.3
  * Update default nftables rules</changelog>
  <changelog author="neutrino8@opensuse.org" date="1658923200">* Add more ICMPv6 entries to the allow rule</changelog>
</package>
<package pkgid="37abfada3f700f3975d5d4e1b1cc527fa2202e050968055a9a50dfa9fd1732b638b2c248ed0325f29e9b5986b120a94721151d3eab88feb67b5da3699f4ed0b8" name="nfw" arch="src">
  <version epoch="0" ver="1.3.1" rel="1.8"/>
  <changelog author="neutrino8@opensuse.org" date="1649246400">- Version 1.0
  * Initial release</changelog>
  <changelog author="neutrino8@opensuse.org" date="1649332800">- Version 1.1
  * Update README file
  * Add nftables requirement to spec file</changelog>
  <changelog author="neutrino8@opensuse.org" date="1649332801">- Version 1.2
  * Update README file
  * Correct previous ChangeLog entry</changelog>
  <changelog author="neutrino8@opensuse.org" date="1649419200">- Version 1.3
  * Update default nftables rules</changelog>
  <changelog author="neutrino8@opensuse.org" date="1658923200">* Add more ICMPv6 entries to the allow rule</changelog>
</package>
<package pkgid="380bbbb92a02b4e148f6f536be3555df189469ffb1517d98e451c1ead9aacabac5635190ab6dc9e90c56041432f2dbe5b7bd28aa05788e133f045d8497a4fac7" name="nikto" arch="noarch">
  <version epoch="0" ver="2.5.0" rel="1.7"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1237550400">- Initial RPM</changelog>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1256126400">- Updated to 2.1.0</changelog>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1267012800">- Updated to 2.1.1</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1329739200">- For newer openSUSE releases change perl-Net_SSLeay to perl-Net-SSLeay</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1343995200">- Updated to 2.1.4
- linked docs directory to improve update
- fixed fsf-address</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1347883200">- Updated to version 2.1.5
  * updated fsf-address-patch
  * moved templates, plugins and database to /var/lib/nikto
  * updated configuration to match file-structure
- New Features
  * Save full response on positive, plaintext &amp; JSON
  * 'maxtime' maximum execution time per host (seconds)
  * 'until' run until specified time or duration
  * 'IgnoreCode' option to allow db_404_strings @CODE from the command line
  * Replay saved JSON requests with replay.pl
  * Client SSL certificate support
  * Output file name now takes '.' which will auto-generate name
  * Content parsing to add items to db_variables values for enhanced testing
  * robots.txt lines are now added to db_variables values for enhanced testing
- New Checks
  * Check for wildcards in crossdomain.xml and clientaccesspolicy.xml
  * Find IPs in HTTP headers
  * Checked for sites parked at hosting providers or advertising pages
  * Parsed robots.txt now checks for listed files (for content search, etc.)
  * nikto_favicon.plugin checks for icons in &lt;link&gt; tags
- Enhancements
  * Fix bugs/minor enhancements in: XML reports, robots.txt parsing, wildcard
    certificate matching, banner parsing, tons more!
  * Default to use Net::SSL instead of Net::SSLeay as a result of too many
    memory issues in SSLeay
  * CSV reports include the same info as other reports
  * HTML reports include more meta information</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1439899200">- Update to 2.1.6.
- Install databases directory contents.
- Rebase nikto-config.patch.
- Remove nikto-fsf-address.patch.
- Minor spec cleanup.</changelog>
  <changelog author="kbabioch@suse.com" date="1528113600">- Added CVE-2018-11652.patch: Fixed a CSV injection vulnerability, which
  allowed remote attackers to inject arbitrary OS commands via the Server
  field in an HTTP response header (bnc#1095721 CVE-2018-11652).</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1675252800">- Update to commit 90ff645 in nikto-2.5.0 branch that fixes 5 years of bug
  fixes
- Removed CVE-2018-11652.patch since upstream is already patched.
- Rebase nikto-config.patch to match upstream changes
- Changed shebang to reflect rpmlint suggestion</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1701691200">- Update to 2.5.0. Please see the documentation for all the changes.</changelog>
</package>
<package pkgid="7150acbfa44b39c34170056a99bb163de648ccc3ac22b8943d76296f56a5451ec907fbe18088cff5f70cc2438cfc781631cc1a922116325fa4b077ee1d65d717" name="nikto" arch="src">
  <version epoch="0" ver="2.5.0" rel="1.7"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1237550400">- Initial RPM</changelog>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1256126400">- Updated to 2.1.0</changelog>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1267012800">- Updated to 2.1.1</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1329739200">- For newer openSUSE releases change perl-Net_SSLeay to perl-Net-SSLeay</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1343995200">- Updated to 2.1.4
- linked docs directory to improve update
- fixed fsf-address</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1347883200">- Updated to version 2.1.5
  * updated fsf-address-patch
  * moved templates, plugins and database to /var/lib/nikto
  * updated configuration to match file-structure
- New Features
  * Save full response on positive, plaintext &amp; JSON
  * 'maxtime' maximum execution time per host (seconds)
  * 'until' run until specified time or duration
  * 'IgnoreCode' option to allow db_404_strings @CODE from the command line
  * Replay saved JSON requests with replay.pl
  * Client SSL certificate support
  * Output file name now takes '.' which will auto-generate name
  * Content parsing to add items to db_variables values for enhanced testing
  * robots.txt lines are now added to db_variables values for enhanced testing
- New Checks
  * Check for wildcards in crossdomain.xml and clientaccesspolicy.xml
  * Find IPs in HTTP headers
  * Checked for sites parked at hosting providers or advertising pages
  * Parsed robots.txt now checks for listed files (for content search, etc.)
  * nikto_favicon.plugin checks for icons in &lt;link&gt; tags
- Enhancements
  * Fix bugs/minor enhancements in: XML reports, robots.txt parsing, wildcard
    certificate matching, banner parsing, tons more!
  * Default to use Net::SSL instead of Net::SSLeay as a result of too many
    memory issues in SSLeay
  * CSV reports include the same info as other reports
  * HTML reports include more meta information</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1439899200">- Update to 2.1.6.
- Install databases directory contents.
- Rebase nikto-config.patch.
- Remove nikto-fsf-address.patch.
- Minor spec cleanup.</changelog>
  <changelog author="kbabioch@suse.com" date="1528113600">- Added CVE-2018-11652.patch: Fixed a CSV injection vulnerability, which
  allowed remote attackers to inject arbitrary OS commands via the Server
  field in an HTTP response header (bnc#1095721 CVE-2018-11652).</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1675252800">- Update to commit 90ff645 in nikto-2.5.0 branch that fixes 5 years of bug
  fixes
- Removed CVE-2018-11652.patch since upstream is already patched.
- Rebase nikto-config.patch to match upstream changes
- Changed shebang to reflect rpmlint suggestion</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1701691200">- Update to 2.5.0. Please see the documentation for all the changes.</changelog>
</package>
<package pkgid="71f064ad29248e622250bdcc90388cc2e5709c9010d5aaa987fa0c761cb710f818c60d3539ffd9b99ad7656ce509507457551ace627edf49d05bae17331bf705" name="nitrokey-app" arch="s390x">
  <version epoch="0" ver="1.4.2" rel="2.36"/>
  <changelog author="mrueckert@suse.de" date="1523361600">- update to 1.3
  https://github.com/Nitrokey/nitrokey-app/releases/tag/v1.3</changelog>
  <changelog author="mrueckert@suse.de" date="1523361601">- apply same gcc restrictions as in libnitrokey</changelog>
  <changelog author="mrueckert@suse.de" date="1523361602">- always run with the system_ubuntu-mono-icon-theme mode</changelog>
  <changelog author="meissner@suse.com" date="1528718400">- nitrokey-app-fix-qt.patch: fix build with new qt (missing includes)</changelog>
  <changelog author="mrueckert@suse.de" date="1530878400">- update to 1.3.1
  - Fixed Unencrypted Volume handling on Storage v0.52.
  - Updated translations. Also added Italian language file.
  - Now builds correctly on Qt 5.11.</changelog>
  <changelog author="mrueckert@suse.de" date="1530878401">- drop patch nitrokey-app-fix-qt.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1544529600">- update to 1.3.2
  - Add Polish translation.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1582977600">- update to 1.4
  This release is focused on providing support for the Storage
  v0.54. Additionally it contains a couple of improvements, and
  translation updates.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1606305600">- update to 1.4.2
  - Decrease main window height for small screens
  - installation of bash-completion</changelog>
  <changelog author="Jan Ritzerfeld &lt;suse@bugs.jan.ritzerfeld.org&gt;" date="1672747200">- Fixed build conflict (provider libudev-mini1 is in conflict with udev)</changelog>
</package>
<package pkgid="5c4cd55067b012f628894d53ee97f63846c5e6c6bb24cb4925e6875701441cb20454341aa4509bc0c5cfa1458aa1e7e1733c1fed241482ca68156d7c6cf968b5" name="nitrokey-app" arch="src">
  <version epoch="0" ver="1.4.2" rel="2.36"/>
  <changelog author="mrueckert@suse.de" date="1444651200">- initial package of version 0.2
- first set of patches:
  - nitrokey-app-0.2_drop_url_from_desktop_file.patch
    rpmlint complains about URL in desktop file with type
    application. URL should only be used for Type=Link.
  - nitrokey-app-0.2_udev_path.patch
    use system udev path instead of the user path</changelog>
  <changelog author="mrueckert@suse.de" date="1444651201">- fix buildrequires to make it work on more distros</changelog>
  <changelog author="heiko.jansen.de@gmail.com" date="1476878400">- Update to v0.5.1
- Removed obsolete patches
- Apply two patches for compilation and package building only
- Does not use libappindicator anymore</changelog>
  <changelog author="mrueckert@suse.de" date="1481544000">- Update to v0.6.1
  Use native settings handler #206 (szszszsz)
  Add Arabic translation to resource file #204 (szszszsz)
- changes from v0.6.0
  - Implemented enhancements:
  - Support for Pro stick version 0.8 #190
  - Closed issues:
  - Add command line parameter to force language #199
  - OTP secret field's max length changes only with text inside
    [#195]
  - Fedora 23 RPM has conflicts #193
  - RPM package installs in wrong directory #178
  - Invisible tray icon on openSUSE Tumbleweed unless run as root
    [#176]
  - Mac OS X version and missing QT libraries #163
  - Merged pull requests:
  - Update README.md #202 (szszszsz)
  - Add language CLI param #200 (szszszsz)
  - Bump version to 0.6 #198 (szszszsz)
  - Support for Nitrokey Pro 0.8 #196 (szszszsz)
  - Resolve conflict with udev rules (for Fedora 23) #194
    (vladimir-lu)
  - build: set CMAKE_BUILD_TYPE only if not set #188
    (ignatenkobrain)
  - Translations: initial support for Arabic (ar) language #183
    (szszszsz)
  - Change RPM package installation dir #180 (szszszsz)
  - Update README.md #179 (szszszsz)
  - Update changelog #174 (szszszsz)
- drop nitrokey-app-0.5.1_installdir_strip_prefix.patch: included
  upstream</changelog>
  <changelog author="mrueckert@suse.de" date="1488283200">- update to v0.6.3
  - Do not enable new HID protocol for Storage yet
    [#218](https://github.com/Nitrokey/nitrokey-app/issues/218)
  - nitrokey-app keeps asking for admin PIN when trying to
    configure TOTP or HOTP slot
    [#211](https://github.com/Nitrokey/nitrokey-app/issues/211)
  - Disable support of new HID protocol for Storage
    [#219](https://github.com/Nitrokey/nitrokey-app/pull/219)
    ([szszszsz](https://github.com/szszszsz))
  - Debian packaging rules changes
    [#217](https://github.com/Nitrokey/nitrokey-app/pull/217)
    ([szszszsz](https://github.com/szszszsz))
- changes from v0.6.2
  - OTP not working on Windows
    [#214](https://github.com/Nitrokey/nitrokey-app/issues/214)
  - Bump version to 0.6.2
    [#216](https://github.com/Nitrokey/nitrokey-app/pull/216)
    ([szszszsz](https://github.com/szszszsz))
  - Pack union for writing OTP slot data
    [#215](https://github.com/Nitrokey/nitrokey-app/pull/215)
    ([szszszsz](https://github.com/szszszsz))
  - Do not block on waiting for symlink to storage being available
    [#213](https://github.com/Nitrokey/nitrokey-app/pull/213)
    ([szszszsz](https://github.com/szszszsz))
  - Break asking PIN loop when user cancels it
    [#212](https://github.com/Nitrokey/nitrokey-app/pull/212)
    ([szszszsz](https://github.com/szszszsz))
  - Fix compilation warnings
    [#208](https://github.com/Nitrokey/nitrokey-app/pull/208)
    ([szszszsz](https://github.com/szszszsz))
- refresh nitrokey-app-0.5.1_cmakepolicy.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1488283201">- bump cmake to 3.1.0 to match what thd cmake file says
- drop nitrokey-app-0.5.1_cmakepolicy.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1523361600">- update to 1.3
  https://github.com/Nitrokey/nitrokey-app/releases/tag/v1.3</changelog>
  <changelog author="mrueckert@suse.de" date="1523361601">- apply same gcc restrictions as in libnitrokey</changelog>
  <changelog author="mrueckert@suse.de" date="1523361602">- always run with the system_ubuntu-mono-icon-theme mode</changelog>
  <changelog author="meissner@suse.com" date="1528718400">- nitrokey-app-fix-qt.patch: fix build with new qt (missing includes)</changelog>
  <changelog author="mrueckert@suse.de" date="1530878400">- update to 1.3.1
  - Fixed Unencrypted Volume handling on Storage v0.52.
  - Updated translations. Also added Italian language file.
  - Now builds correctly on Qt 5.11.</changelog>
  <changelog author="mrueckert@suse.de" date="1530878401">- drop patch nitrokey-app-fix-qt.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1544529600">- update to 1.3.2
  - Add Polish translation.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1582977600">- update to 1.4
  This release is focused on providing support for the Storage
  v0.54. Additionally it contains a couple of improvements, and
  translation updates.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1606305600">- update to 1.4.2
  - Decrease main window height for small screens
  - installation of bash-completion</changelog>
  <changelog author="Jan Ritzerfeld &lt;suse@bugs.jan.ritzerfeld.org&gt;" date="1672747200">- Fixed build conflict (provider libudev-mini1 is in conflict with udev)</changelog>
</package>
<package pkgid="8572dbdc43f4f170e06ab2481a711619769a428e2764686fd856bb26f925467a9a3938eb6d28880626e658d7307c89dc0fa490b0f2b2f2ebd5dcf4a1743b1042" name="nitrokey-app-debuginfo" arch="s390x">
  <version epoch="0" ver="1.4.2" rel="2.36"/>
  <changelog author="mrueckert@suse.de" date="1523361600">- update to 1.3
  https://github.com/Nitrokey/nitrokey-app/releases/tag/v1.3</changelog>
  <changelog author="mrueckert@suse.de" date="1523361601">- apply same gcc restrictions as in libnitrokey</changelog>
  <changelog author="mrueckert@suse.de" date="1523361602">- always run with the system_ubuntu-mono-icon-theme mode</changelog>
  <changelog author="meissner@suse.com" date="1528718400">- nitrokey-app-fix-qt.patch: fix build with new qt (missing includes)</changelog>
  <changelog author="mrueckert@suse.de" date="1530878400">- update to 1.3.1
  - Fixed Unencrypted Volume handling on Storage v0.52.
  - Updated translations. Also added Italian language file.
  - Now builds correctly on Qt 5.11.</changelog>
  <changelog author="mrueckert@suse.de" date="1530878401">- drop patch nitrokey-app-fix-qt.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1544529600">- update to 1.3.2
  - Add Polish translation.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1582977600">- update to 1.4
  This release is focused on providing support for the Storage
  v0.54. Additionally it contains a couple of improvements, and
  translation updates.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1606305600">- update to 1.4.2
  - Decrease main window height for small screens
  - installation of bash-completion</changelog>
  <changelog author="Jan Ritzerfeld &lt;suse@bugs.jan.ritzerfeld.org&gt;" date="1672747200">- Fixed build conflict (provider libudev-mini1 is in conflict with udev)</changelog>
</package>
<package pkgid="bd5471e5153cd3a58e6731b7462e3f629b5411df4128e934595856819c112efb42e428c5c0a0c05309c514dd90fc2d2eac893b19adc74d5457ab03f61726df4f" name="nitrokey-app-debugsource" arch="s390x">
  <version epoch="0" ver="1.4.2" rel="2.36"/>
  <changelog author="mrueckert@suse.de" date="1523361600">- update to 1.3
  https://github.com/Nitrokey/nitrokey-app/releases/tag/v1.3</changelog>
  <changelog author="mrueckert@suse.de" date="1523361601">- apply same gcc restrictions as in libnitrokey</changelog>
  <changelog author="mrueckert@suse.de" date="1523361602">- always run with the system_ubuntu-mono-icon-theme mode</changelog>
  <changelog author="meissner@suse.com" date="1528718400">- nitrokey-app-fix-qt.patch: fix build with new qt (missing includes)</changelog>
  <changelog author="mrueckert@suse.de" date="1530878400">- update to 1.3.1
  - Fixed Unencrypted Volume handling on Storage v0.52.
  - Updated translations. Also added Italian language file.
  - Now builds correctly on Qt 5.11.</changelog>
  <changelog author="mrueckert@suse.de" date="1530878401">- drop patch nitrokey-app-fix-qt.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1544529600">- update to 1.3.2
  - Add Polish translation.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1582977600">- update to 1.4
  This release is focused on providing support for the Storage
  v0.54. Additionally it contains a couple of improvements, and
  translation updates.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1606305600">- update to 1.4.2
  - Decrease main window height for small screens
  - installation of bash-completion</changelog>
  <changelog author="Jan Ritzerfeld &lt;suse@bugs.jan.ritzerfeld.org&gt;" date="1672747200">- Fixed build conflict (provider libudev-mini1 is in conflict with udev)</changelog>
</package>
<package pkgid="703b138cf71030b6ea2a402a32d115d63231bede3fb691a2bdb31d174d16b3ec517bc308cf66aa13a540f0baf68ad48f52ea491a7a71ec37c14ce918e52dc879" name="nitrokey-app2" arch="s390x">
  <version epoch="0" ver="2.1.2" rel="1.3"/>
  <changelog author="Lars Vogdt &lt;lars@linux-schulserver.de&gt;" date="1695816000">- initial version</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1695902400">- got it build</changelog>
</package>
<package pkgid="8718521a054a7dc4478fb16ee9b03be9f183935b8fa924362bfe8757117dbdb70b07fe86eb53ed1f965601e2041200a8e4aeb53a8d3ee9eac2d26ba919e09b91" name="nitrokey-app2" arch="src">
  <version epoch="0" ver="2.1.2" rel="1.3"/>
  <changelog author="Lars Vogdt &lt;lars@linux-schulserver.de&gt;" date="1695816000">- initial version</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1695902400">- got it build</changelog>
</package>
<package pkgid="a85948f6f65751d3610428d36258abf39f1126de5015ef466d608a367d7a199cd553a88393372035d11900d2fcec3a9d776053b9be76a9964e476367b1ab94c5" name="nkmkpasswd" arch="noarch">
  <version epoch="0" ver="0.0.2" rel="3.25"/>
  <changelog author="guru@unixtech.be" date="1215518400">- new package</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376000">- SPEC file update:
  - add SUSE copyright header
  - delete 'clean' part
  - rename license to 'GPL-2.0'</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- urls as https</changelog>
</package>
<package pkgid="b69b4d4e4070b7ca575135c185b777e3fe0d462219f22d5e62530e24706fb72227614f7fce12d8e54cb05058c0f1bc93e41d300692d37c63fafbd86a17009906" name="nkmkpasswd" arch="src">
  <version epoch="0" ver="0.0.2" rel="3.25"/>
  <changelog author="guru@unixtech.be" date="1215518400">- new package</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376000">- SPEC file update:
  - add SUSE copyright header
  - delete 'clean' part
  - rename license to 'GPL-2.0'</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- urls as https</changelog>
</package>
<package pkgid="2de14944a9147bbf54d4fd6864b6ba105b9a830babfb88ebf195af642bbe96c98c7921529fe340a3c8872b973a2f9fc2aea14a24904739fff7c8e397290de25d" name="nwipe" arch="s390x">
  <version epoch="0" ver="0.41" rel="1.6"/>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1571227200">- Update to release 0.26
  * New release
  * Add exclude drive option(Thanks PartialVolume)
  * Log hardware (Thanks PartialVolume)</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1602417600">- v0.28
  * Fix premature exit when terminal resized on completion of wipes (Thanks PartialVolume)
  * Fix GUI when terminal is resized, currently not handled correctly causing missing
    or incorrectly sized ncurses windows/panels (Thanks PartialVolume)
  * Fix GUI screen flicker under various situations. #200 Fixes #115 (Thanks PartialVolume)
  * Fix responsivness of screen during wipe when resized.
    Info is updated every 10th/sec. Key presses are more responsive. (Thanks PartialVolume)
  * Fix compiler warning regarding buffer overflow. Fixes #202 (Thanks PartialVolume)
  * Fix Man page (Thanks martijnvanbrummelen)
  * Fix individual device throughput. On completion of a wipe instead
    of the throughput calculation stopping for a completed wipe, it would
    continue to calculate resulting in a particular drives throughtput
    slowly dropping until eventually it reached zero. The overall
    throughput was not affected. (Thanks PartialVolume)
- v0.27
  * Add verify method to verify a disk is zero filled #128 (Thanks Legogizmo)
  * Add new HMG IS5 enhanced wipe method #168 (Thanks infrastation)
  * Fix percentage progress and show on completion of wipe (Thanks PartialVolume)
  * Implement clang-format support (Thanks louib)
  * Implement more frequent disk sync support (Thanks Legogizmo)
  * Format command line help to 80 character line length #114 (Thanks PartialVolume)
  * Fix nwipe message log and missing messages that was causing
    segfaults under certain conditions (Thanks PartialVolume)
  * Add the Github build CI service and update Readme with build status labels (Thanks louib)
  * Miscellaneous smaller fixes</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1640174400">- v0.32
  IMPORTANT ! #322 Non functional Isaac prng
  is a security update. Of specific importance
  for anybody that might use --prng=isaac as one
  of nwipe's command line options. Significantly less
  important if you select Isaac from the GUI although
  still relevant, as mersenne is used not issac,
  despite what the GUI says. Putting --prng=isaac on
  the command line causes at best zeros to be written
  instead of a random stream, at worst the contents
  of a uninitialized buffer.
  See my comments in #322. Note, this bug existed
  in all previous versions of nwipe and also still
  exists in DBAN 2.3.0 within dwipe.
  Now fixed in nwipe, but as DBAN is no longer
  actively maintained, another reason to upgrade
  from DBAN to nwipe 0.32.
  includes the following changes:
  * Add ones (0xFF) wipe to the methods. Renamed Zero
    Fill to Fill with Zeros and the new ones wipe,
    is called Fill with Ones.
  * Add ones verication to the methods. Renamed Verify
    Blank to Verify Zeros (0x00) and the new verification
    is called Verify Ones (0xFF).
  * Move method information from below the list of methods
    to the right of the method list. This allows better use
    of the screen space by allowing more methods to be
    added to the list, especially relevant to nwipe running
    as a standalone application on small distros such as
    shredos 2020 in frame buffer mode.
  * Removed the old DBAN syslinux.cfg configuration
    hints as not relevant to nwipe. See nwipe --help
    or man nwipe for command line options.
  * Add fdatasync errors to the error summary table.
  * During a wipe, you can now toggle between dark screen,
    blank screen and default blue screen by repeatedly
    pressing the b key. Dark screen, which is grey text
    on black background has been introduced to prevent
    TFT/LCD image persistence on monitors that are
    sensitive to that issue. However, according to
    this article grey text on a white background may
    be preferable. I will probably add that option
    in the next release along with possibly powering
    off the display as an additional option.
  * Blanking disabled in GUI for OPS2
    (mandatory requirement of standard). #326
  * Total bytes written/read for ALL passes or
    verifications are now logged. #326
  * Final blanking being enabled is no longer
    required for verification passes. GUI Fix. #326
  * Add a summary table to the log that shows totals
    for pass &amp; verification errors. #325
  * Fix the missing 'Verifying' message on final blanking. #324
  * Fix prng selection always using mersenne irrespective
    of whatever prng the user selected. #323
  * Fix a non functional Isaac prng.
    (May have never worked even in DBAN/dwipe 2.3.0). #322
  * Log whether the prng produces a stream,
    if not log failure message. #321
  * Log the specific prng that is initialised. #320
  * Log selection details to the log. #319
  * Improve log messaging. #317
  * Fix auto shutdown option for some distros. #315
  * Fix build for musl. #301
  * Fixes to summary table &amp; fix final status message. 311
  * Updates to --help options #309
  * Updates to manpage. #300
  * Add auto power off option on completion of
    wipe ( --autopoweroff ) (Thanks PartialVolume)
  * Fixed --nowait option that wasn't working.
    (Thanks PartialVolume)
  * Add verbose option. -v, --verbose.
  * Add a spinner to the GUI for each drive being wiped.
    When nwipe is syncing the percentage completion pauses,
    having a spinner gives a clear indication that the wipe
    is still running. Each devices spinner disappears on
    completion of a given devices wipe. (Thanks PartialVolume)
  * Make log messages, especially the ones with the tag 'notice'
    succinct and less than 80 characters including the timestamp.
    This is of more importance when nwipe is used on a 80x30
    terminal (ALT-F2, Shredos etc) but generally makes
    the logs more readable. While doing this all information
    was still retained. (Thanks PartialVolume)
  * Add a summary table to the log that shows each
    drives status, i.e. erased or failed, throughput,
    duration of wipe, model, serial no etc.
    In particular it benefits those that wipe many
    drives simultaneously in rack servers.
    At a glance any failed drives can be seen without
    having to browse back through the log. (Thanks PartialVolume)
  * Add ETA to --nogui wipes status when SIGUSR1
    (kill -s USR1 (nwipes PID) is issued on the command line.
  * Fixed misleading throughput calculation. Throughput now
    shows average throughput calculated from start of wipe.
  * Fixed system info not being displayed in Debian Sid.
    [#229] (Thanks PartialVolume)
  * Add serial number display for USB to IDE/SATA adapters.
    This only works if the USB to IDE/SATA adapter supports
    ATA pass through. See #149 for further details (Thanks PartialVolume)
  * Fixed disk capacity nomenclature, width and padding on drive
    selection screen. See #237 (Thanks PartialVolume)
  * Add bus type, ATA or USB, amongst others to drive selection
    and wipe windows. (Thanks PartialVolume)
  * Add --nousb option. If you use the option --nousb,
    all USB devices will be ignored.
    They won't show up in the GUI and they won't be wiped
    if you use the --nogui --autonuke command.
    They will even be ignored if you specifically
    name them on the command line.
  * Miscellaneous GUI fixes, throughput display format,
    percentage display format to improve column alignment
    when wiping multiple discs. (Thanks PartialVolume)
  * Improve visibility of failure messages with red text
    on white background. (Thanks PartialVolume)
  * Add NVME and VIRT (loop etc) devices to device type
    table for display in GUI and logs. NVME devices now
    show up as NVME devices rather than UNK (Thanks PartialVolume)
  * Fixed very obscure segmentation fault going back to at least 0.24
    in drive selection window when resizing terminal vertical
    axis while drive focus symbol '&gt;' is pointing to the last drive
    of a multi drive selection window.
    See #248 for further details (Thanks PartialVolume)
  * Warn the user if they are incorrectly typing a lower case
    s to start a wipe, when they should be typing a capital S #262
    (Thanks PartialVolume)
  * Warn the user if they are typing capital S in order
    to start a wipe but haven't yet selected any drives
    for wiping #261 (Thanks PartialVolume)
  * Add ctrl A that toggles drive selection,
    all drives selected for wipe or all drives deselected. #266
  * Fixed compilation issue with NixOS with broken
    musl libc error due to missing header #275
  * Fixed status bar message showing incorrect information #287
  * Right Justify log labels to maintain column alignment #280
  * Added nwipe version &amp; OS info to log #297</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1687176000">- Update to version v0.34
  * Fix a compiler warning -Wformat-zero-length string
  * Fixes a slight screen corruption on 80 column display. When highlighting the verify ones option the first two digits of DoD 5220.20-M disappear. This patch fixes that issue.@PartialVolume #348
  * For some controllers/drivers the readlink method of obtaining the bus type for GUI display does not work. If we haven't already resolved the bus type, we then also check smartctl for the transport protocol for SAS. @PartialVolume #350
  * Check smartctl for unresolved bus types SATA @PartialVolume #358
  * Changed message from (No ATA pass-thru) to (S/N: unknown) as the reason the serial number is unknown is because there is no ATA pass through for the chipset being used by the USB to SATA adapter, basically we are making the message more meaningful for the end user rather than for the engineer/programmer that may understand the previous terminology used. @PartialVolume @Firminator #356
  * Add drive temperature monitoring and display temperature in degrees Celsius in the GUI. Requires the kernel drivetemp module and makes use of the hwmon sub system in the kernel to extract drive temperatures. Nwipe will automatically load the drivetemp module if it's available. @PartialVolume #360 #361 #364
  * Remove /dev/ from gui for long device names. This fixes column alignment issues in the gui with nvme drives i.e. nvme0n1 etc. If the drive name including path exceeds 8 characters the /dev/ is removed and prefixed with spaces to a total max length of 8 characters. @PartialVolume #365
  * Add -q --quiet option - anonymize serial numbers and SMBIOS-DMI data. This anonymizes serial numbers and related identifiable information for drives and hardware but does not remove model information in both the GUI and the log displayed by stdout at the end of a wipe and also in the log file if enabled in options. This feature is useful for uploading logs when submitting bug reports. @PartialVolume #366 #367 #371 #379 #383
  * Fixes a intermittent FAILED message that is displayed in the summary table when the message should have been UABORTED. The incorrect FAILED message only occurred when using control-C to abort a wipe. @PartialVolume #373
  * When many verification or pass errors are detected the status line can wrap on a 80 column display. This patch makes the error message more succinct which will free up about 10 characters &amp; prevents the line wrapping. @PartialVolume #374
  * Fixes a problem that occurs with a unresponsive drive that causes the ETA to grow to an enormous value. We now do not calculate an individual drives ETA when the throughput of the drive is zero so avoiding the overall ETA being incorrect for drives that are working correctly when multiple drives are being simultaneously wiped. While a individual drives ETA is calculated it is not displayed but only used to determine the overall ETA when all drives have completed. @PartialVolume #375
  * Add temperature monitoring and display with NVMe drives. @PartialVolume #377 #380 #381
  * When one of the two verify only methods are selected change the drive selected text from WIPE to VRFY to indicate the drive is not being wiped, but is only being verified. @PartialVolume #378
  * Fixes a incorrect sector, block and device sizes in 32 bit builds only as displayed in the nwipe log. This problem had no affect on the wipe as the issue was caused by a incorrect format specifier that affected the log text only. @PartialVolume #387 #388
  * Fixes a issue where temperatures may not have been available on Debian systems due to the location of modprobe. Particularly relevant to Debian which when logged in as root doesn't put /sbin in the $PATH environment setting. This issue was not necessarily relevant for Linux distros based on Debian, for instance, Ubuntu where nwipe would have found the modprobe command. @PartialVolume #390 #391
  * Improve wipe thread cancellation error checking. @PartialVolume #392
  * Improve GUI thread messaging if a pthread_join fails. @PartialVolume #393
  * Fixed a missing serial number on SAS drive.@PartialVolume #394
  * Added ISAAC-64 for 64 bit systems. Thanks @chkboom #398 #401
  * Fixes a problem with the Gutmann wipe where the random passes at the beginning and end were being re-arranged when only the inner passes should be rearranged. Thanks @chkboom #399
  * Fixes a obscure incorrect summary table status, while the log text correctly reports the failure. If the drive becomes non responsive during the wipe, the MB/s throughput will slowly drop towards 0MB/s and will display a FAILURE -1 error. The logs will correctly display errors and nwipe's return status will be non zero, however the summary table may display erased rather than FAILURE, this is because the wipe thread exited prematurely without setting the pass error. This fixes the error by checking the context's result status, i.e non zero on failure and if pass equals zero it makes pass equal to one. This is then picked up by the summary table log code which then marks the status correctly as FAILURE in the summary table. @PartialVolume #400
  * Fixes a spurious message on abort before wipe.This patch fixes a minor display issue that occurs when a user aborts a wipe before a wipe has started. It only occurs if the user had selected one or more drives for wipe and then aborted before starting the wipe. The spurious message only occurs in a virtual terminal, i.e. /dev/tty1, /dev/tty2, /dev/console It does not occur in terminal applications such as konsole, xterm, terminator etc. The spurious message that appears in the main window, states that "/dev/sdxyz 100% complete" along with garbage values in the statistics window. The message appears for a fraction of a second before being replaced with the textual log information that correctly states that the user aborted and no wipe was started. Basically the gui status information update function tries to update the data when the wipe hasn't even started. The fix is to only update the statistics information only if a wipe has started by checking the 'global_wipe_status' value which indicates whether any wipe started. '1' indicates that a wipe has started, else '0' if no wipe has started. @PartialVolume #406
  * Fixes temperature update in drive selection window. This fixes a problem where the drive temperature is not updated automatically in only the drive selection window. The temperature is however updated correctly every 60 seconds during a wipe in the wipe status window. This bug would probably never be noticed by most people as usually the drive temperature changes slowly and only rises once a wipe has started. The only time I imagine it would have been noticed would have been if the drive temperature was already high and you were trying to reduce the temperature by cooling before starting a wipe. This has now been corrected so that the temperature in the drive selection window is updated every 60 seconds. @PartialVolume #407
  * Fixes a zombie nwipe process running at 100% CPU on one core but only on a Konsole based terminal. This only occurred when the Konsole terminal is exited while nwipe is sitting at the drive selection screen but nwipe did not exit when the konsole terminal was closed. If nwipe is exited normally on completion of a wipe or aborted by using control C then this problem would not be seen. Also occurs during a wipe if the konsole terminal is closed without exiting nwipe first, again only on Konsole based terminals. @PartialVolume #408 #409
  * Fixes a obscure segfault when --logfile option used with a non writable directory. @PartialVolume #410</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt; - 0.37" date="1722168000">- Update to version v0.37
  * Added the XORoshiro-256 pseudo random number generator (PRNG). Thanks to Fabian Druschke @knogle #555
  * Added  the Lagged Fibonacci PRNG generator. Thanks again to Fabian Druschke @knogle #556
  * Added missing help for HMG IS5 enhanced. Thanks to @AndCycle #569
  * Changed the default method from "DOD Short" to "prng stream", using the XORoshiro-256 prng
  * Fixed an issue in configure.ac which was producing an error while running `./configure`,  mentioning libconfig, however the presence of libconfig had already been checked for, earlier in configure.ac. Although this error did not cause `./configure` to abort prematurely and therefore make would build the source correctly, it did cause a issue for inclusion into Debian Sid. Thanks to @Polynomial-C #574
  * Minor change to nwipe's man page filename, nwipe.1 to nwipe.8 to fix a Debian warning. #577
- Dropping old patches which are no longer applicable.</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722945600">- Adding dependency to hdparm, smartmontools and dmidecode, which are needed to correctly operate nwipe.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1752494400">- Update to version v0.38
  * Fixes type error, relevant to i686 (32 bit) only. Fixes a compile error on some distros.
  * Added feature relevant to ShredOS only, the f key will toggle the font size, standard size to double size, has no action for other  xorg/wayland distributions. The f key is available in the drive selection and progress screens only. Note that in earlier commits in this release the d key was programmed however this is now the f key to toggle font size.
  * Fixes a issue where SAS drives always respond with hidden sectors = ???, i.e warning. This patch fixes the problem so that a SAS drive responds with hidden sectors = not applicable. A SATA drive connected to a SAS interface should still respond with yes or no subject to the interface passing HPA and DCO-identify commands.
  * On some distros, nwipe may not be able to find hdparm or smartctl even when they are installed. This is due to a symbolic link issue with the distro. The patch fixes this issue by adding a new search location when looking for hdparm and smartctl. The new search location is /usr/sbin/. Previously we searched /sbin/ and /usr/bin/ but /sbin is symbolically linked to /usr/sbin/ so just in case there was some issue with the symbolic link we also now search /usr/sbin/
  * The hidden sector check for SAS drives has been disabled as it is believed that SAS drives do not support the SCSI commands to adjust the drives size as reported to the O.S.
  * Some USB adapters report the model name and serial number with the incorrect endian, so adjacent characters in the model name are swapped with each other. This patch detects and fixes model names for Hitachi, Toshiba, WDC Western Digital Corporation and Seagate/ST drives. Mainly some older adapters and drive interfaces might have this issue.
  * Fixes the s shift s bug as reported here PartialVolume/shredos.x86_64#301 To summarize, if no drives are selected and then the user presses s (lower case) a warning appears indicating that the user should press S (upper case) to start the wipe. This warning appears for about 3 seconds but during this time if the user presses S (upper case) nwipe would immediately complete, having wiped no drives and requesting the user to press the spacebar to exit. The is incorrect behaviour.
  * The bug doesn't appear if the user pressed S after the 3 seconds elapsed and the warning message disappeared. This patch fixes this so that it does not exit but displays the warning for 3 seconds and then waits for input.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1757678400">- Update to version v0.39
  * Fix model name Endian for Sandisk-SunDisk drives
  * Implement Bruce Schneier 7-Pass wiping method
  * Some cleanup in options.c, added missing xoroshiro256_prng argument
  * fix: some declaration changes to satisfy gcc 15
  * Removed EXPERIMENTAL! comments for ALFG and Xoroshiro</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771416000">- Update to version v0.40
  * Upon initialization, nwipe identifies and sets the most efficient Pseudo-Random Number Generator (PRNG) as the default, based on a real-time hardware performance test.
  * AES-256-CTR PRNG that utilizes native AES-NI instructions to significantly boost data-wiping throughput on compatible CPUs.
  * Implemented a new wipe method, the BMB21-2019 Chinese State Secrets Bureau standard Technical Requirement for Data Sanitization.
  * Implemented Direct I/O with large buffers as the default wipe method, reducing write instructions and boosting throughput. This change cut wipe completion times by 5–10% in tests and significantly lowered CPU load—especially on high-density servers wiping 10+ drives simultaneously. Kernel cached I/O remains available via command-line switches.
  * Added support for host UUID, serial number, and custom tags in PDF report headers. These options can be configured and toggled in the nwipe config menu ('c'), accessible from the nwipe drive selection screen and are saved to nwipe's config file, /etc/nwipe/nwipe.conf for persistent configuration between restarts."
  * Added a new GUI “device topology” view, opened with the 't' key from the device selection screen. Useful if you want to check which device controller, which HBA, etc. your drive is attached. This improves safety and usability on systems with multiple controllers by clearly showing the physical attachment path of each drive without changing wipe behaviour.
  * Enhanced the --exclude option to match devices by their underlying block device ID (major/minor), allowing persistent identifiers in /dev/disk/by-id/ and /dev/disk/by-path/ to be used safely. Legacy string-based matching is preserved.
  * The internal PRNGs are now seeded via getrandom(2) rather than through a long-lived file descriptor to /dev/urandom, to improve reliability.
  * fixed: To resolve issues with partition wipes, as opposed to whole disc wipes, nwipe now includes the device name in the PDF report filename. Previously, when wiping specific partitions (e.g., sudo nwipe /dev/sdc3 /dev/sd4 /dev/sd5) via the CLI, the absence of a disk model or serial number caused PDF filenames to conflict and overwrite each other. This update ensures unique filenames and prevents data loss when processing multiple partitions.
  * Add static linking libraries that are required by parted 3.6
  * fixed: some declaration changes to satisfy gcc 15
  * Optimised that header code that generates the PDF reports.
  * fixed: respect no-blanking methods in --nogui mode. This fixes an issue where a default blanking pass was added to methods which do not support it when in --nogui mode. Existing GUI code overriding the option is never called in --nogui mode
  * fixed: sanitize device serial numbers and fix uninitialized/fallback handling.
  * fixed: Automatically create PDF report directory if missing and improve permission model
  * optimise: Validate autonuke and nogui for valid values and harden logic by not using assumptions in if statements for binary values and switching to case statements for value specific checks.
  * fixed: Improve str_truncate to fix memory error detected in valgrind
  * fixed: Require strict input of long form options, i.e no abbreviations allowed!. Command line option syntax as specifically described in nwipe --help and nwipe man page are only allowed. Corrects a 'feature' in GNU getopt_long().</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1780488000">- Update to version v0.41
  * Restructure PDF source files. We now have a separate source file for each type of PDF created.
  * Major bugfixes &amp; bad block/error handling
  * Add optional non-fatal handling of block write errors in forward passes
  * Merge pull request #717 from PartialVolume/restructure_PDF_source_files
  * Initial work on system multi disc PDF, work in progress
  * Update installation instructions in README.md
  * Reverse wiping, verification skip bad blocks &amp; minor fixes
  * PRNGs: Two new PRNGs + GUI Selection Screen
  * CI unit testing for nwipe
  * Tidy up display_help function
  * Add the .clang-format-ignore file
  * Bump minor version as a test of .clang-format-ignore
  * Minor formatting fixes
  * Some additional help info for display_help()
  * Fix v0.40 regression (failing -std=c99, Fedora packaging)
  * ci: add workflows for -std=c99/c11/c17
  * Added contribution guidelines, especially regarding the use of AI agents
  * CI: Test --directio and --cachedio I/O modes
  * I/O direction selection (--reverse)
  * feat: introduce --force for in use devices
  * Device geometry, scattered I/O, verification error paths
  * fix(gui): do not select disabled devices
  * System pdf
  * Add system host UUID and serial number
  * Add smbios dmi page to system pdf</changelog>
</package>
<package pkgid="e39936d7176e89e280faa44c4c380219217bae7b09f20de2e5cc8fa6dc2df5412c6ce68afb4458dcd087f552924da370e344c83aca3dcc3a1d192bb1044586c0" name="nwipe" arch="src">
  <version epoch="0" ver="0.41" rel="1.6"/>
  <changelog author="emendonca@suse.com" date="1426507200">- Initial version based on latest source.</changelog>
  <changelog author="erico.mendonca@suse.com" date="1460980800">- panel_library_check.patch: there is no need to check for panel.h, as it is part of the ncurses library already.
- autoconf_version_required.patch: lowering the required autoconf version so it can be compiled on as much distros as possible.
- fix_function_returns.patch: fix missing function returns.
- nwipe-fix-uninitialized.patch: c2 was random sized as the variable is only set later.</changelog>
  <changelog author="erico.mendonca@suse.com" date="1512475200">- 0.22: updating to latest version.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1512475201">- Update to version 0.22:
  * include version.h
  * fix 32bit issues
  * add gitignore file
  * add friendly disk size
  * remove testfile
  * update version in manpage
  * change spelling fixes github bug #31
  * change version year to 2017
  * add test file
  * place files in normal location</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1552564800">- Update to version 0.25 and start using Github tar files not
  fetched version.
  * Correct J=Up K=Down in footer(Thanks PartialVolume)
  * Fix segfault initialize nwipe_gui_thread (Thanks PartialVolume)
  * Fix memory leaks (Thanks PartialVolume)
  * Check right pointer (Thanks PartialVolume)
  * Fix casting problem (Thanks PartialVolume)
  * Fix serial number
  * Fixes uninitialized variable warning ( Thanks PartialVolume)</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1571227200">- Update to release 0.26
  * New release
  * Add exclude drive option(Thanks PartialVolume)
  * Log hardware (Thanks PartialVolume)</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1602417600">- v0.28
  * Fix premature exit when terminal resized on completion of wipes (Thanks PartialVolume)
  * Fix GUI when terminal is resized, currently not handled correctly causing missing
    or incorrectly sized ncurses windows/panels (Thanks PartialVolume)
  * Fix GUI screen flicker under various situations. #200 Fixes #115 (Thanks PartialVolume)
  * Fix responsivness of screen during wipe when resized.
    Info is updated every 10th/sec. Key presses are more responsive. (Thanks PartialVolume)
  * Fix compiler warning regarding buffer overflow. Fixes #202 (Thanks PartialVolume)
  * Fix Man page (Thanks martijnvanbrummelen)
  * Fix individual device throughput. On completion of a wipe instead
    of the throughput calculation stopping for a completed wipe, it would
    continue to calculate resulting in a particular drives throughtput
    slowly dropping until eventually it reached zero. The overall
    throughput was not affected. (Thanks PartialVolume)
- v0.27
  * Add verify method to verify a disk is zero filled #128 (Thanks Legogizmo)
  * Add new HMG IS5 enhanced wipe method #168 (Thanks infrastation)
  * Fix percentage progress and show on completion of wipe (Thanks PartialVolume)
  * Implement clang-format support (Thanks louib)
  * Implement more frequent disk sync support (Thanks Legogizmo)
  * Format command line help to 80 character line length #114 (Thanks PartialVolume)
  * Fix nwipe message log and missing messages that was causing
    segfaults under certain conditions (Thanks PartialVolume)
  * Add the Github build CI service and update Readme with build status labels (Thanks louib)
  * Miscellaneous smaller fixes</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1640174400">- v0.32
  IMPORTANT ! #322 Non functional Isaac prng
  is a security update. Of specific importance
  for anybody that might use --prng=isaac as one
  of nwipe's command line options. Significantly less
  important if you select Isaac from the GUI although
  still relevant, as mersenne is used not issac,
  despite what the GUI says. Putting --prng=isaac on
  the command line causes at best zeros to be written
  instead of a random stream, at worst the contents
  of a uninitialized buffer.
  See my comments in #322. Note, this bug existed
  in all previous versions of nwipe and also still
  exists in DBAN 2.3.0 within dwipe.
  Now fixed in nwipe, but as DBAN is no longer
  actively maintained, another reason to upgrade
  from DBAN to nwipe 0.32.
  includes the following changes:
  * Add ones (0xFF) wipe to the methods. Renamed Zero
    Fill to Fill with Zeros and the new ones wipe,
    is called Fill with Ones.
  * Add ones verication to the methods. Renamed Verify
    Blank to Verify Zeros (0x00) and the new verification
    is called Verify Ones (0xFF).
  * Move method information from below the list of methods
    to the right of the method list. This allows better use
    of the screen space by allowing more methods to be
    added to the list, especially relevant to nwipe running
    as a standalone application on small distros such as
    shredos 2020 in frame buffer mode.
  * Removed the old DBAN syslinux.cfg configuration
    hints as not relevant to nwipe. See nwipe --help
    or man nwipe for command line options.
  * Add fdatasync errors to the error summary table.
  * During a wipe, you can now toggle between dark screen,
    blank screen and default blue screen by repeatedly
    pressing the b key. Dark screen, which is grey text
    on black background has been introduced to prevent
    TFT/LCD image persistence on monitors that are
    sensitive to that issue. However, according to
    this article grey text on a white background may
    be preferable. I will probably add that option
    in the next release along with possibly powering
    off the display as an additional option.
  * Blanking disabled in GUI for OPS2
    (mandatory requirement of standard). #326
  * Total bytes written/read for ALL passes or
    verifications are now logged. #326
  * Final blanking being enabled is no longer
    required for verification passes. GUI Fix. #326
  * Add a summary table to the log that shows totals
    for pass &amp; verification errors. #325
  * Fix the missing 'Verifying' message on final blanking. #324
  * Fix prng selection always using mersenne irrespective
    of whatever prng the user selected. #323
  * Fix a non functional Isaac prng.
    (May have never worked even in DBAN/dwipe 2.3.0). #322
  * Log whether the prng produces a stream,
    if not log failure message. #321
  * Log the specific prng that is initialised. #320
  * Log selection details to the log. #319
  * Improve log messaging. #317
  * Fix auto shutdown option for some distros. #315
  * Fix build for musl. #301
  * Fixes to summary table &amp; fix final status message. 311
  * Updates to --help options #309
  * Updates to manpage. #300
  * Add auto power off option on completion of
    wipe ( --autopoweroff ) (Thanks PartialVolume)
  * Fixed --nowait option that wasn't working.
    (Thanks PartialVolume)
  * Add verbose option. -v, --verbose.
  * Add a spinner to the GUI for each drive being wiped.
    When nwipe is syncing the percentage completion pauses,
    having a spinner gives a clear indication that the wipe
    is still running. Each devices spinner disappears on
    completion of a given devices wipe. (Thanks PartialVolume)
  * Make log messages, especially the ones with the tag 'notice'
    succinct and less than 80 characters including the timestamp.
    This is of more importance when nwipe is used on a 80x30
    terminal (ALT-F2, Shredos etc) but generally makes
    the logs more readable. While doing this all information
    was still retained. (Thanks PartialVolume)
  * Add a summary table to the log that shows each
    drives status, i.e. erased or failed, throughput,
    duration of wipe, model, serial no etc.
    In particular it benefits those that wipe many
    drives simultaneously in rack servers.
    At a glance any failed drives can be seen without
    having to browse back through the log. (Thanks PartialVolume)
  * Add ETA to --nogui wipes status when SIGUSR1
    (kill -s USR1 (nwipes PID) is issued on the command line.
  * Fixed misleading throughput calculation. Throughput now
    shows average throughput calculated from start of wipe.
  * Fixed system info not being displayed in Debian Sid.
    [#229] (Thanks PartialVolume)
  * Add serial number display for USB to IDE/SATA adapters.
    This only works if the USB to IDE/SATA adapter supports
    ATA pass through. See #149 for further details (Thanks PartialVolume)
  * Fixed disk capacity nomenclature, width and padding on drive
    selection screen. See #237 (Thanks PartialVolume)
  * Add bus type, ATA or USB, amongst others to drive selection
    and wipe windows. (Thanks PartialVolume)
  * Add --nousb option. If you use the option --nousb,
    all USB devices will be ignored.
    They won't show up in the GUI and they won't be wiped
    if you use the --nogui --autonuke command.
    They will even be ignored if you specifically
    name them on the command line.
  * Miscellaneous GUI fixes, throughput display format,
    percentage display format to improve column alignment
    when wiping multiple discs. (Thanks PartialVolume)
  * Improve visibility of failure messages with red text
    on white background. (Thanks PartialVolume)
  * Add NVME and VIRT (loop etc) devices to device type
    table for display in GUI and logs. NVME devices now
    show up as NVME devices rather than UNK (Thanks PartialVolume)
  * Fixed very obscure segmentation fault going back to at least 0.24
    in drive selection window when resizing terminal vertical
    axis while drive focus symbol '&gt;' is pointing to the last drive
    of a multi drive selection window.
    See #248 for further details (Thanks PartialVolume)
  * Warn the user if they are incorrectly typing a lower case
    s to start a wipe, when they should be typing a capital S #262
    (Thanks PartialVolume)
  * Warn the user if they are typing capital S in order
    to start a wipe but haven't yet selected any drives
    for wiping #261 (Thanks PartialVolume)
  * Add ctrl A that toggles drive selection,
    all drives selected for wipe or all drives deselected. #266
  * Fixed compilation issue with NixOS with broken
    musl libc error due to missing header #275
  * Fixed status bar message showing incorrect information #287
  * Right Justify log labels to maintain column alignment #280
  * Added nwipe version &amp; OS info to log #297</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1687176000">- Update to version v0.34
  * Fix a compiler warning -Wformat-zero-length string
  * Fixes a slight screen corruption on 80 column display. When highlighting the verify ones option the first two digits of DoD 5220.20-M disappear. This patch fixes that issue.@PartialVolume #348
  * For some controllers/drivers the readlink method of obtaining the bus type for GUI display does not work. If we haven't already resolved the bus type, we then also check smartctl for the transport protocol for SAS. @PartialVolume #350
  * Check smartctl for unresolved bus types SATA @PartialVolume #358
  * Changed message from (No ATA pass-thru) to (S/N: unknown) as the reason the serial number is unknown is because there is no ATA pass through for the chipset being used by the USB to SATA adapter, basically we are making the message more meaningful for the end user rather than for the engineer/programmer that may understand the previous terminology used. @PartialVolume @Firminator #356
  * Add drive temperature monitoring and display temperature in degrees Celsius in the GUI. Requires the kernel drivetemp module and makes use of the hwmon sub system in the kernel to extract drive temperatures. Nwipe will automatically load the drivetemp module if it's available. @PartialVolume #360 #361 #364
  * Remove /dev/ from gui for long device names. This fixes column alignment issues in the gui with nvme drives i.e. nvme0n1 etc. If the drive name including path exceeds 8 characters the /dev/ is removed and prefixed with spaces to a total max length of 8 characters. @PartialVolume #365
  * Add -q --quiet option - anonymize serial numbers and SMBIOS-DMI data. This anonymizes serial numbers and related identifiable information for drives and hardware but does not remove model information in both the GUI and the log displayed by stdout at the end of a wipe and also in the log file if enabled in options. This feature is useful for uploading logs when submitting bug reports. @PartialVolume #366 #367 #371 #379 #383
  * Fixes a intermittent FAILED message that is displayed in the summary table when the message should have been UABORTED. The incorrect FAILED message only occurred when using control-C to abort a wipe. @PartialVolume #373
  * When many verification or pass errors are detected the status line can wrap on a 80 column display. This patch makes the error message more succinct which will free up about 10 characters &amp; prevents the line wrapping. @PartialVolume #374
  * Fixes a problem that occurs with a unresponsive drive that causes the ETA to grow to an enormous value. We now do not calculate an individual drives ETA when the throughput of the drive is zero so avoiding the overall ETA being incorrect for drives that are working correctly when multiple drives are being simultaneously wiped. While a individual drives ETA is calculated it is not displayed but only used to determine the overall ETA when all drives have completed. @PartialVolume #375
  * Add temperature monitoring and display with NVMe drives. @PartialVolume #377 #380 #381
  * When one of the two verify only methods are selected change the drive selected text from WIPE to VRFY to indicate the drive is not being wiped, but is only being verified. @PartialVolume #378
  * Fixes a incorrect sector, block and device sizes in 32 bit builds only as displayed in the nwipe log. This problem had no affect on the wipe as the issue was caused by a incorrect format specifier that affected the log text only. @PartialVolume #387 #388
  * Fixes a issue where temperatures may not have been available on Debian systems due to the location of modprobe. Particularly relevant to Debian which when logged in as root doesn't put /sbin in the $PATH environment setting. This issue was not necessarily relevant for Linux distros based on Debian, for instance, Ubuntu where nwipe would have found the modprobe command. @PartialVolume #390 #391
  * Improve wipe thread cancellation error checking. @PartialVolume #392
  * Improve GUI thread messaging if a pthread_join fails. @PartialVolume #393
  * Fixed a missing serial number on SAS drive.@PartialVolume #394
  * Added ISAAC-64 for 64 bit systems. Thanks @chkboom #398 #401
  * Fixes a problem with the Gutmann wipe where the random passes at the beginning and end were being re-arranged when only the inner passes should be rearranged. Thanks @chkboom #399
  * Fixes a obscure incorrect summary table status, while the log text correctly reports the failure. If the drive becomes non responsive during the wipe, the MB/s throughput will slowly drop towards 0MB/s and will display a FAILURE -1 error. The logs will correctly display errors and nwipe's return status will be non zero, however the summary table may display erased rather than FAILURE, this is because the wipe thread exited prematurely without setting the pass error. This fixes the error by checking the context's result status, i.e non zero on failure and if pass equals zero it makes pass equal to one. This is then picked up by the summary table log code which then marks the status correctly as FAILURE in the summary table. @PartialVolume #400
  * Fixes a spurious message on abort before wipe.This patch fixes a minor display issue that occurs when a user aborts a wipe before a wipe has started. It only occurs if the user had selected one or more drives for wipe and then aborted before starting the wipe. The spurious message only occurs in a virtual terminal, i.e. /dev/tty1, /dev/tty2, /dev/console It does not occur in terminal applications such as konsole, xterm, terminator etc. The spurious message that appears in the main window, states that "/dev/sdxyz 100% complete" along with garbage values in the statistics window. The message appears for a fraction of a second before being replaced with the textual log information that correctly states that the user aborted and no wipe was started. Basically the gui status information update function tries to update the data when the wipe hasn't even started. The fix is to only update the statistics information only if a wipe has started by checking the 'global_wipe_status' value which indicates whether any wipe started. '1' indicates that a wipe has started, else '0' if no wipe has started. @PartialVolume #406
  * Fixes temperature update in drive selection window. This fixes a problem where the drive temperature is not updated automatically in only the drive selection window. The temperature is however updated correctly every 60 seconds during a wipe in the wipe status window. This bug would probably never be noticed by most people as usually the drive temperature changes slowly and only rises once a wipe has started. The only time I imagine it would have been noticed would have been if the drive temperature was already high and you were trying to reduce the temperature by cooling before starting a wipe. This has now been corrected so that the temperature in the drive selection window is updated every 60 seconds. @PartialVolume #407
  * Fixes a zombie nwipe process running at 100% CPU on one core but only on a Konsole based terminal. This only occurred when the Konsole terminal is exited while nwipe is sitting at the drive selection screen but nwipe did not exit when the konsole terminal was closed. If nwipe is exited normally on completion of a wipe or aborted by using control C then this problem would not be seen. Also occurs during a wipe if the konsole terminal is closed without exiting nwipe first, again only on Konsole based terminals. @PartialVolume #408 #409
  * Fixes a obscure segfault when --logfile option used with a non writable directory. @PartialVolume #410</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt; - 0.37" date="1722168000">- Update to version v0.37
  * Added the XORoshiro-256 pseudo random number generator (PRNG). Thanks to Fabian Druschke @knogle #555
  * Added  the Lagged Fibonacci PRNG generator. Thanks again to Fabian Druschke @knogle #556
  * Added missing help for HMG IS5 enhanced. Thanks to @AndCycle #569
  * Changed the default method from "DOD Short" to "prng stream", using the XORoshiro-256 prng
  * Fixed an issue in configure.ac which was producing an error while running `./configure`,  mentioning libconfig, however the presence of libconfig had already been checked for, earlier in configure.ac. Although this error did not cause `./configure` to abort prematurely and therefore make would build the source correctly, it did cause a issue for inclusion into Debian Sid. Thanks to @Polynomial-C #574
  * Minor change to nwipe's man page filename, nwipe.1 to nwipe.8 to fix a Debian warning. #577
- Dropping old patches which are no longer applicable.</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722945600">- Adding dependency to hdparm, smartmontools and dmidecode, which are needed to correctly operate nwipe.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1752494400">- Update to version v0.38
  * Fixes type error, relevant to i686 (32 bit) only. Fixes a compile error on some distros.
  * Added feature relevant to ShredOS only, the f key will toggle the font size, standard size to double size, has no action for other  xorg/wayland distributions. The f key is available in the drive selection and progress screens only. Note that in earlier commits in this release the d key was programmed however this is now the f key to toggle font size.
  * Fixes a issue where SAS drives always respond with hidden sectors = ???, i.e warning. This patch fixes the problem so that a SAS drive responds with hidden sectors = not applicable. A SATA drive connected to a SAS interface should still respond with yes or no subject to the interface passing HPA and DCO-identify commands.
  * On some distros, nwipe may not be able to find hdparm or smartctl even when they are installed. This is due to a symbolic link issue with the distro. The patch fixes this issue by adding a new search location when looking for hdparm and smartctl. The new search location is /usr/sbin/. Previously we searched /sbin/ and /usr/bin/ but /sbin is symbolically linked to /usr/sbin/ so just in case there was some issue with the symbolic link we also now search /usr/sbin/
  * The hidden sector check for SAS drives has been disabled as it is believed that SAS drives do not support the SCSI commands to adjust the drives size as reported to the O.S.
  * Some USB adapters report the model name and serial number with the incorrect endian, so adjacent characters in the model name are swapped with each other. This patch detects and fixes model names for Hitachi, Toshiba, WDC Western Digital Corporation and Seagate/ST drives. Mainly some older adapters and drive interfaces might have this issue.
  * Fixes the s shift s bug as reported here PartialVolume/shredos.x86_64#301 To summarize, if no drives are selected and then the user presses s (lower case) a warning appears indicating that the user should press S (upper case) to start the wipe. This warning appears for about 3 seconds but during this time if the user presses S (upper case) nwipe would immediately complete, having wiped no drives and requesting the user to press the spacebar to exit. The is incorrect behaviour.
  * The bug doesn't appear if the user pressed S after the 3 seconds elapsed and the warning message disappeared. This patch fixes this so that it does not exit but displays the warning for 3 seconds and then waits for input.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1757678400">- Update to version v0.39
  * Fix model name Endian for Sandisk-SunDisk drives
  * Implement Bruce Schneier 7-Pass wiping method
  * Some cleanup in options.c, added missing xoroshiro256_prng argument
  * fix: some declaration changes to satisfy gcc 15
  * Removed EXPERIMENTAL! comments for ALFG and Xoroshiro</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771416000">- Update to version v0.40
  * Upon initialization, nwipe identifies and sets the most efficient Pseudo-Random Number Generator (PRNG) as the default, based on a real-time hardware performance test.
  * AES-256-CTR PRNG that utilizes native AES-NI instructions to significantly boost data-wiping throughput on compatible CPUs.
  * Implemented a new wipe method, the BMB21-2019 Chinese State Secrets Bureau standard Technical Requirement for Data Sanitization.
  * Implemented Direct I/O with large buffers as the default wipe method, reducing write instructions and boosting throughput. This change cut wipe completion times by 5–10% in tests and significantly lowered CPU load—especially on high-density servers wiping 10+ drives simultaneously. Kernel cached I/O remains available via command-line switches.
  * Added support for host UUID, serial number, and custom tags in PDF report headers. These options can be configured and toggled in the nwipe config menu ('c'), accessible from the nwipe drive selection screen and are saved to nwipe's config file, /etc/nwipe/nwipe.conf for persistent configuration between restarts."
  * Added a new GUI “device topology” view, opened with the 't' key from the device selection screen. Useful if you want to check which device controller, which HBA, etc. your drive is attached. This improves safety and usability on systems with multiple controllers by clearly showing the physical attachment path of each drive without changing wipe behaviour.
  * Enhanced the --exclude option to match devices by their underlying block device ID (major/minor), allowing persistent identifiers in /dev/disk/by-id/ and /dev/disk/by-path/ to be used safely. Legacy string-based matching is preserved.
  * The internal PRNGs are now seeded via getrandom(2) rather than through a long-lived file descriptor to /dev/urandom, to improve reliability.
  * fixed: To resolve issues with partition wipes, as opposed to whole disc wipes, nwipe now includes the device name in the PDF report filename. Previously, when wiping specific partitions (e.g., sudo nwipe /dev/sdc3 /dev/sd4 /dev/sd5) via the CLI, the absence of a disk model or serial number caused PDF filenames to conflict and overwrite each other. This update ensures unique filenames and prevents data loss when processing multiple partitions.
  * Add static linking libraries that are required by parted 3.6
  * fixed: some declaration changes to satisfy gcc 15
  * Optimised that header code that generates the PDF reports.
  * fixed: respect no-blanking methods in --nogui mode. This fixes an issue where a default blanking pass was added to methods which do not support it when in --nogui mode. Existing GUI code overriding the option is never called in --nogui mode
  * fixed: sanitize device serial numbers and fix uninitialized/fallback handling.
  * fixed: Automatically create PDF report directory if missing and improve permission model
  * optimise: Validate autonuke and nogui for valid values and harden logic by not using assumptions in if statements for binary values and switching to case statements for value specific checks.
  * fixed: Improve str_truncate to fix memory error detected in valgrind
  * fixed: Require strict input of long form options, i.e no abbreviations allowed!. Command line option syntax as specifically described in nwipe --help and nwipe man page are only allowed. Corrects a 'feature' in GNU getopt_long().</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1780488000">- Update to version v0.41
  * Restructure PDF source files. We now have a separate source file for each type of PDF created.
  * Major bugfixes &amp; bad block/error handling
  * Add optional non-fatal handling of block write errors in forward passes
  * Merge pull request #717 from PartialVolume/restructure_PDF_source_files
  * Initial work on system multi disc PDF, work in progress
  * Update installation instructions in README.md
  * Reverse wiping, verification skip bad blocks &amp; minor fixes
  * PRNGs: Two new PRNGs + GUI Selection Screen
  * CI unit testing for nwipe
  * Tidy up display_help function
  * Add the .clang-format-ignore file
  * Bump minor version as a test of .clang-format-ignore
  * Minor formatting fixes
  * Some additional help info for display_help()
  * Fix v0.40 regression (failing -std=c99, Fedora packaging)
  * ci: add workflows for -std=c99/c11/c17
  * Added contribution guidelines, especially regarding the use of AI agents
  * CI: Test --directio and --cachedio I/O modes
  * I/O direction selection (--reverse)
  * feat: introduce --force for in use devices
  * Device geometry, scattered I/O, verification error paths
  * fix(gui): do not select disabled devices
  * System pdf
  * Add system host UUID and serial number
  * Add smbios dmi page to system pdf</changelog>
</package>
<package pkgid="985f7f57ea1df02935e16b36b5dad88423fe305a741e72f7724ce0f4b5c3f5196fa2341bb0bfaf9f94b132e79ba9cf1f057e09c90a13a341296616f8b02d303a" name="nwipe-debuginfo" arch="s390x">
  <version epoch="0" ver="0.41" rel="1.6"/>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1571227200">- Update to release 0.26
  * New release
  * Add exclude drive option(Thanks PartialVolume)
  * Log hardware (Thanks PartialVolume)</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1602417600">- v0.28
  * Fix premature exit when terminal resized on completion of wipes (Thanks PartialVolume)
  * Fix GUI when terminal is resized, currently not handled correctly causing missing
    or incorrectly sized ncurses windows/panels (Thanks PartialVolume)
  * Fix GUI screen flicker under various situations. #200 Fixes #115 (Thanks PartialVolume)
  * Fix responsivness of screen during wipe when resized.
    Info is updated every 10th/sec. Key presses are more responsive. (Thanks PartialVolume)
  * Fix compiler warning regarding buffer overflow. Fixes #202 (Thanks PartialVolume)
  * Fix Man page (Thanks martijnvanbrummelen)
  * Fix individual device throughput. On completion of a wipe instead
    of the throughput calculation stopping for a completed wipe, it would
    continue to calculate resulting in a particular drives throughtput
    slowly dropping until eventually it reached zero. The overall
    throughput was not affected. (Thanks PartialVolume)
- v0.27
  * Add verify method to verify a disk is zero filled #128 (Thanks Legogizmo)
  * Add new HMG IS5 enhanced wipe method #168 (Thanks infrastation)
  * Fix percentage progress and show on completion of wipe (Thanks PartialVolume)
  * Implement clang-format support (Thanks louib)
  * Implement more frequent disk sync support (Thanks Legogizmo)
  * Format command line help to 80 character line length #114 (Thanks PartialVolume)
  * Fix nwipe message log and missing messages that was causing
    segfaults under certain conditions (Thanks PartialVolume)
  * Add the Github build CI service and update Readme with build status labels (Thanks louib)
  * Miscellaneous smaller fixes</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1640174400">- v0.32
  IMPORTANT ! #322 Non functional Isaac prng
  is a security update. Of specific importance
  for anybody that might use --prng=isaac as one
  of nwipe's command line options. Significantly less
  important if you select Isaac from the GUI although
  still relevant, as mersenne is used not issac,
  despite what the GUI says. Putting --prng=isaac on
  the command line causes at best zeros to be written
  instead of a random stream, at worst the contents
  of a uninitialized buffer.
  See my comments in #322. Note, this bug existed
  in all previous versions of nwipe and also still
  exists in DBAN 2.3.0 within dwipe.
  Now fixed in nwipe, but as DBAN is no longer
  actively maintained, another reason to upgrade
  from DBAN to nwipe 0.32.
  includes the following changes:
  * Add ones (0xFF) wipe to the methods. Renamed Zero
    Fill to Fill with Zeros and the new ones wipe,
    is called Fill with Ones.
  * Add ones verication to the methods. Renamed Verify
    Blank to Verify Zeros (0x00) and the new verification
    is called Verify Ones (0xFF).
  * Move method information from below the list of methods
    to the right of the method list. This allows better use
    of the screen space by allowing more methods to be
    added to the list, especially relevant to nwipe running
    as a standalone application on small distros such as
    shredos 2020 in frame buffer mode.
  * Removed the old DBAN syslinux.cfg configuration
    hints as not relevant to nwipe. See nwipe --help
    or man nwipe for command line options.
  * Add fdatasync errors to the error summary table.
  * During a wipe, you can now toggle between dark screen,
    blank screen and default blue screen by repeatedly
    pressing the b key. Dark screen, which is grey text
    on black background has been introduced to prevent
    TFT/LCD image persistence on monitors that are
    sensitive to that issue. However, according to
    this article grey text on a white background may
    be preferable. I will probably add that option
    in the next release along with possibly powering
    off the display as an additional option.
  * Blanking disabled in GUI for OPS2
    (mandatory requirement of standard). #326
  * Total bytes written/read for ALL passes or
    verifications are now logged. #326
  * Final blanking being enabled is no longer
    required for verification passes. GUI Fix. #326
  * Add a summary table to the log that shows totals
    for pass &amp; verification errors. #325
  * Fix the missing 'Verifying' message on final blanking. #324
  * Fix prng selection always using mersenne irrespective
    of whatever prng the user selected. #323
  * Fix a non functional Isaac prng.
    (May have never worked even in DBAN/dwipe 2.3.0). #322
  * Log whether the prng produces a stream,
    if not log failure message. #321
  * Log the specific prng that is initialised. #320
  * Log selection details to the log. #319
  * Improve log messaging. #317
  * Fix auto shutdown option for some distros. #315
  * Fix build for musl. #301
  * Fixes to summary table &amp; fix final status message. 311
  * Updates to --help options #309
  * Updates to manpage. #300
  * Add auto power off option on completion of
    wipe ( --autopoweroff ) (Thanks PartialVolume)
  * Fixed --nowait option that wasn't working.
    (Thanks PartialVolume)
  * Add verbose option. -v, --verbose.
  * Add a spinner to the GUI for each drive being wiped.
    When nwipe is syncing the percentage completion pauses,
    having a spinner gives a clear indication that the wipe
    is still running. Each devices spinner disappears on
    completion of a given devices wipe. (Thanks PartialVolume)
  * Make log messages, especially the ones with the tag 'notice'
    succinct and less than 80 characters including the timestamp.
    This is of more importance when nwipe is used on a 80x30
    terminal (ALT-F2, Shredos etc) but generally makes
    the logs more readable. While doing this all information
    was still retained. (Thanks PartialVolume)
  * Add a summary table to the log that shows each
    drives status, i.e. erased or failed, throughput,
    duration of wipe, model, serial no etc.
    In particular it benefits those that wipe many
    drives simultaneously in rack servers.
    At a glance any failed drives can be seen without
    having to browse back through the log. (Thanks PartialVolume)
  * Add ETA to --nogui wipes status when SIGUSR1
    (kill -s USR1 (nwipes PID) is issued on the command line.
  * Fixed misleading throughput calculation. Throughput now
    shows average throughput calculated from start of wipe.
  * Fixed system info not being displayed in Debian Sid.
    [#229] (Thanks PartialVolume)
  * Add serial number display for USB to IDE/SATA adapters.
    This only works if the USB to IDE/SATA adapter supports
    ATA pass through. See #149 for further details (Thanks PartialVolume)
  * Fixed disk capacity nomenclature, width and padding on drive
    selection screen. See #237 (Thanks PartialVolume)
  * Add bus type, ATA or USB, amongst others to drive selection
    and wipe windows. (Thanks PartialVolume)
  * Add --nousb option. If you use the option --nousb,
    all USB devices will be ignored.
    They won't show up in the GUI and they won't be wiped
    if you use the --nogui --autonuke command.
    They will even be ignored if you specifically
    name them on the command line.
  * Miscellaneous GUI fixes, throughput display format,
    percentage display format to improve column alignment
    when wiping multiple discs. (Thanks PartialVolume)
  * Improve visibility of failure messages with red text
    on white background. (Thanks PartialVolume)
  * Add NVME and VIRT (loop etc) devices to device type
    table for display in GUI and logs. NVME devices now
    show up as NVME devices rather than UNK (Thanks PartialVolume)
  * Fixed very obscure segmentation fault going back to at least 0.24
    in drive selection window when resizing terminal vertical
    axis while drive focus symbol '&gt;' is pointing to the last drive
    of a multi drive selection window.
    See #248 for further details (Thanks PartialVolume)
  * Warn the user if they are incorrectly typing a lower case
    s to start a wipe, when they should be typing a capital S #262
    (Thanks PartialVolume)
  * Warn the user if they are typing capital S in order
    to start a wipe but haven't yet selected any drives
    for wiping #261 (Thanks PartialVolume)
  * Add ctrl A that toggles drive selection,
    all drives selected for wipe or all drives deselected. #266
  * Fixed compilation issue with NixOS with broken
    musl libc error due to missing header #275
  * Fixed status bar message showing incorrect information #287
  * Right Justify log labels to maintain column alignment #280
  * Added nwipe version &amp; OS info to log #297</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1687176000">- Update to version v0.34
  * Fix a compiler warning -Wformat-zero-length string
  * Fixes a slight screen corruption on 80 column display. When highlighting the verify ones option the first two digits of DoD 5220.20-M disappear. This patch fixes that issue.@PartialVolume #348
  * For some controllers/drivers the readlink method of obtaining the bus type for GUI display does not work. If we haven't already resolved the bus type, we then also check smartctl for the transport protocol for SAS. @PartialVolume #350
  * Check smartctl for unresolved bus types SATA @PartialVolume #358
  * Changed message from (No ATA pass-thru) to (S/N: unknown) as the reason the serial number is unknown is because there is no ATA pass through for the chipset being used by the USB to SATA adapter, basically we are making the message more meaningful for the end user rather than for the engineer/programmer that may understand the previous terminology used. @PartialVolume @Firminator #356
  * Add drive temperature monitoring and display temperature in degrees Celsius in the GUI. Requires the kernel drivetemp module and makes use of the hwmon sub system in the kernel to extract drive temperatures. Nwipe will automatically load the drivetemp module if it's available. @PartialVolume #360 #361 #364
  * Remove /dev/ from gui for long device names. This fixes column alignment issues in the gui with nvme drives i.e. nvme0n1 etc. If the drive name including path exceeds 8 characters the /dev/ is removed and prefixed with spaces to a total max length of 8 characters. @PartialVolume #365
  * Add -q --quiet option - anonymize serial numbers and SMBIOS-DMI data. This anonymizes serial numbers and related identifiable information for drives and hardware but does not remove model information in both the GUI and the log displayed by stdout at the end of a wipe and also in the log file if enabled in options. This feature is useful for uploading logs when submitting bug reports. @PartialVolume #366 #367 #371 #379 #383
  * Fixes a intermittent FAILED message that is displayed in the summary table when the message should have been UABORTED. The incorrect FAILED message only occurred when using control-C to abort a wipe. @PartialVolume #373
  * When many verification or pass errors are detected the status line can wrap on a 80 column display. This patch makes the error message more succinct which will free up about 10 characters &amp; prevents the line wrapping. @PartialVolume #374
  * Fixes a problem that occurs with a unresponsive drive that causes the ETA to grow to an enormous value. We now do not calculate an individual drives ETA when the throughput of the drive is zero so avoiding the overall ETA being incorrect for drives that are working correctly when multiple drives are being simultaneously wiped. While a individual drives ETA is calculated it is not displayed but only used to determine the overall ETA when all drives have completed. @PartialVolume #375
  * Add temperature monitoring and display with NVMe drives. @PartialVolume #377 #380 #381
  * When one of the two verify only methods are selected change the drive selected text from WIPE to VRFY to indicate the drive is not being wiped, but is only being verified. @PartialVolume #378
  * Fixes a incorrect sector, block and device sizes in 32 bit builds only as displayed in the nwipe log. This problem had no affect on the wipe as the issue was caused by a incorrect format specifier that affected the log text only. @PartialVolume #387 #388
  * Fixes a issue where temperatures may not have been available on Debian systems due to the location of modprobe. Particularly relevant to Debian which when logged in as root doesn't put /sbin in the $PATH environment setting. This issue was not necessarily relevant for Linux distros based on Debian, for instance, Ubuntu where nwipe would have found the modprobe command. @PartialVolume #390 #391
  * Improve wipe thread cancellation error checking. @PartialVolume #392
  * Improve GUI thread messaging if a pthread_join fails. @PartialVolume #393
  * Fixed a missing serial number on SAS drive.@PartialVolume #394
  * Added ISAAC-64 for 64 bit systems. Thanks @chkboom #398 #401
  * Fixes a problem with the Gutmann wipe where the random passes at the beginning and end were being re-arranged when only the inner passes should be rearranged. Thanks @chkboom #399
  * Fixes a obscure incorrect summary table status, while the log text correctly reports the failure. If the drive becomes non responsive during the wipe, the MB/s throughput will slowly drop towards 0MB/s and will display a FAILURE -1 error. The logs will correctly display errors and nwipe's return status will be non zero, however the summary table may display erased rather than FAILURE, this is because the wipe thread exited prematurely without setting the pass error. This fixes the error by checking the context's result status, i.e non zero on failure and if pass equals zero it makes pass equal to one. This is then picked up by the summary table log code which then marks the status correctly as FAILURE in the summary table. @PartialVolume #400
  * Fixes a spurious message on abort before wipe.This patch fixes a minor display issue that occurs when a user aborts a wipe before a wipe has started. It only occurs if the user had selected one or more drives for wipe and then aborted before starting the wipe. The spurious message only occurs in a virtual terminal, i.e. /dev/tty1, /dev/tty2, /dev/console It does not occur in terminal applications such as konsole, xterm, terminator etc. The spurious message that appears in the main window, states that "/dev/sdxyz 100% complete" along with garbage values in the statistics window. The message appears for a fraction of a second before being replaced with the textual log information that correctly states that the user aborted and no wipe was started. Basically the gui status information update function tries to update the data when the wipe hasn't even started. The fix is to only update the statistics information only if a wipe has started by checking the 'global_wipe_status' value which indicates whether any wipe started. '1' indicates that a wipe has started, else '0' if no wipe has started. @PartialVolume #406
  * Fixes temperature update in drive selection window. This fixes a problem where the drive temperature is not updated automatically in only the drive selection window. The temperature is however updated correctly every 60 seconds during a wipe in the wipe status window. This bug would probably never be noticed by most people as usually the drive temperature changes slowly and only rises once a wipe has started. The only time I imagine it would have been noticed would have been if the drive temperature was already high and you were trying to reduce the temperature by cooling before starting a wipe. This has now been corrected so that the temperature in the drive selection window is updated every 60 seconds. @PartialVolume #407
  * Fixes a zombie nwipe process running at 100% CPU on one core but only on a Konsole based terminal. This only occurred when the Konsole terminal is exited while nwipe is sitting at the drive selection screen but nwipe did not exit when the konsole terminal was closed. If nwipe is exited normally on completion of a wipe or aborted by using control C then this problem would not be seen. Also occurs during a wipe if the konsole terminal is closed without exiting nwipe first, again only on Konsole based terminals. @PartialVolume #408 #409
  * Fixes a obscure segfault when --logfile option used with a non writable directory. @PartialVolume #410</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt; - 0.37" date="1722168000">- Update to version v0.37
  * Added the XORoshiro-256 pseudo random number generator (PRNG). Thanks to Fabian Druschke @knogle #555
  * Added  the Lagged Fibonacci PRNG generator. Thanks again to Fabian Druschke @knogle #556
  * Added missing help for HMG IS5 enhanced. Thanks to @AndCycle #569
  * Changed the default method from "DOD Short" to "prng stream", using the XORoshiro-256 prng
  * Fixed an issue in configure.ac which was producing an error while running `./configure`,  mentioning libconfig, however the presence of libconfig had already been checked for, earlier in configure.ac. Although this error did not cause `./configure` to abort prematurely and therefore make would build the source correctly, it did cause a issue for inclusion into Debian Sid. Thanks to @Polynomial-C #574
  * Minor change to nwipe's man page filename, nwipe.1 to nwipe.8 to fix a Debian warning. #577
- Dropping old patches which are no longer applicable.</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722945600">- Adding dependency to hdparm, smartmontools and dmidecode, which are needed to correctly operate nwipe.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1752494400">- Update to version v0.38
  * Fixes type error, relevant to i686 (32 bit) only. Fixes a compile error on some distros.
  * Added feature relevant to ShredOS only, the f key will toggle the font size, standard size to double size, has no action for other  xorg/wayland distributions. The f key is available in the drive selection and progress screens only. Note that in earlier commits in this release the d key was programmed however this is now the f key to toggle font size.
  * Fixes a issue where SAS drives always respond with hidden sectors = ???, i.e warning. This patch fixes the problem so that a SAS drive responds with hidden sectors = not applicable. A SATA drive connected to a SAS interface should still respond with yes or no subject to the interface passing HPA and DCO-identify commands.
  * On some distros, nwipe may not be able to find hdparm or smartctl even when they are installed. This is due to a symbolic link issue with the distro. The patch fixes this issue by adding a new search location when looking for hdparm and smartctl. The new search location is /usr/sbin/. Previously we searched /sbin/ and /usr/bin/ but /sbin is symbolically linked to /usr/sbin/ so just in case there was some issue with the symbolic link we also now search /usr/sbin/
  * The hidden sector check for SAS drives has been disabled as it is believed that SAS drives do not support the SCSI commands to adjust the drives size as reported to the O.S.
  * Some USB adapters report the model name and serial number with the incorrect endian, so adjacent characters in the model name are swapped with each other. This patch detects and fixes model names for Hitachi, Toshiba, WDC Western Digital Corporation and Seagate/ST drives. Mainly some older adapters and drive interfaces might have this issue.
  * Fixes the s shift s bug as reported here PartialVolume/shredos.x86_64#301 To summarize, if no drives are selected and then the user presses s (lower case) a warning appears indicating that the user should press S (upper case) to start the wipe. This warning appears for about 3 seconds but during this time if the user presses S (upper case) nwipe would immediately complete, having wiped no drives and requesting the user to press the spacebar to exit. The is incorrect behaviour.
  * The bug doesn't appear if the user pressed S after the 3 seconds elapsed and the warning message disappeared. This patch fixes this so that it does not exit but displays the warning for 3 seconds and then waits for input.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1757678400">- Update to version v0.39
  * Fix model name Endian for Sandisk-SunDisk drives
  * Implement Bruce Schneier 7-Pass wiping method
  * Some cleanup in options.c, added missing xoroshiro256_prng argument
  * fix: some declaration changes to satisfy gcc 15
  * Removed EXPERIMENTAL! comments for ALFG and Xoroshiro</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771416000">- Update to version v0.40
  * Upon initialization, nwipe identifies and sets the most efficient Pseudo-Random Number Generator (PRNG) as the default, based on a real-time hardware performance test.
  * AES-256-CTR PRNG that utilizes native AES-NI instructions to significantly boost data-wiping throughput on compatible CPUs.
  * Implemented a new wipe method, the BMB21-2019 Chinese State Secrets Bureau standard Technical Requirement for Data Sanitization.
  * Implemented Direct I/O with large buffers as the default wipe method, reducing write instructions and boosting throughput. This change cut wipe completion times by 5–10% in tests and significantly lowered CPU load—especially on high-density servers wiping 10+ drives simultaneously. Kernel cached I/O remains available via command-line switches.
  * Added support for host UUID, serial number, and custom tags in PDF report headers. These options can be configured and toggled in the nwipe config menu ('c'), accessible from the nwipe drive selection screen and are saved to nwipe's config file, /etc/nwipe/nwipe.conf for persistent configuration between restarts."
  * Added a new GUI “device topology” view, opened with the 't' key from the device selection screen. Useful if you want to check which device controller, which HBA, etc. your drive is attached. This improves safety and usability on systems with multiple controllers by clearly showing the physical attachment path of each drive without changing wipe behaviour.
  * Enhanced the --exclude option to match devices by their underlying block device ID (major/minor), allowing persistent identifiers in /dev/disk/by-id/ and /dev/disk/by-path/ to be used safely. Legacy string-based matching is preserved.
  * The internal PRNGs are now seeded via getrandom(2) rather than through a long-lived file descriptor to /dev/urandom, to improve reliability.
  * fixed: To resolve issues with partition wipes, as opposed to whole disc wipes, nwipe now includes the device name in the PDF report filename. Previously, when wiping specific partitions (e.g., sudo nwipe /dev/sdc3 /dev/sd4 /dev/sd5) via the CLI, the absence of a disk model or serial number caused PDF filenames to conflict and overwrite each other. This update ensures unique filenames and prevents data loss when processing multiple partitions.
  * Add static linking libraries that are required by parted 3.6
  * fixed: some declaration changes to satisfy gcc 15
  * Optimised that header code that generates the PDF reports.
  * fixed: respect no-blanking methods in --nogui mode. This fixes an issue where a default blanking pass was added to methods which do not support it when in --nogui mode. Existing GUI code overriding the option is never called in --nogui mode
  * fixed: sanitize device serial numbers and fix uninitialized/fallback handling.
  * fixed: Automatically create PDF report directory if missing and improve permission model
  * optimise: Validate autonuke and nogui for valid values and harden logic by not using assumptions in if statements for binary values and switching to case statements for value specific checks.
  * fixed: Improve str_truncate to fix memory error detected in valgrind
  * fixed: Require strict input of long form options, i.e no abbreviations allowed!. Command line option syntax as specifically described in nwipe --help and nwipe man page are only allowed. Corrects a 'feature' in GNU getopt_long().</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1780488000">- Update to version v0.41
  * Restructure PDF source files. We now have a separate source file for each type of PDF created.
  * Major bugfixes &amp; bad block/error handling
  * Add optional non-fatal handling of block write errors in forward passes
  * Merge pull request #717 from PartialVolume/restructure_PDF_source_files
  * Initial work on system multi disc PDF, work in progress
  * Update installation instructions in README.md
  * Reverse wiping, verification skip bad blocks &amp; minor fixes
  * PRNGs: Two new PRNGs + GUI Selection Screen
  * CI unit testing for nwipe
  * Tidy up display_help function
  * Add the .clang-format-ignore file
  * Bump minor version as a test of .clang-format-ignore
  * Minor formatting fixes
  * Some additional help info for display_help()
  * Fix v0.40 regression (failing -std=c99, Fedora packaging)
  * ci: add workflows for -std=c99/c11/c17
  * Added contribution guidelines, especially regarding the use of AI agents
  * CI: Test --directio and --cachedio I/O modes
  * I/O direction selection (--reverse)
  * feat: introduce --force for in use devices
  * Device geometry, scattered I/O, verification error paths
  * fix(gui): do not select disabled devices
  * System pdf
  * Add system host UUID and serial number
  * Add smbios dmi page to system pdf</changelog>
</package>
<package pkgid="2886cb30e42eb9c5d0a881a95986f68d4e2c3b9773ddc895979f0b99025a2811160d0a2748c2189423e8b12866a65f01383feff6d2520a01e73ea2d470984cff" name="nwipe-debugsource" arch="s390x">
  <version epoch="0" ver="0.41" rel="1.6"/>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1571227200">- Update to release 0.26
  * New release
  * Add exclude drive option(Thanks PartialVolume)
  * Log hardware (Thanks PartialVolume)</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1602417600">- v0.28
  * Fix premature exit when terminal resized on completion of wipes (Thanks PartialVolume)
  * Fix GUI when terminal is resized, currently not handled correctly causing missing
    or incorrectly sized ncurses windows/panels (Thanks PartialVolume)
  * Fix GUI screen flicker under various situations. #200 Fixes #115 (Thanks PartialVolume)
  * Fix responsivness of screen during wipe when resized.
    Info is updated every 10th/sec. Key presses are more responsive. (Thanks PartialVolume)
  * Fix compiler warning regarding buffer overflow. Fixes #202 (Thanks PartialVolume)
  * Fix Man page (Thanks martijnvanbrummelen)
  * Fix individual device throughput. On completion of a wipe instead
    of the throughput calculation stopping for a completed wipe, it would
    continue to calculate resulting in a particular drives throughtput
    slowly dropping until eventually it reached zero. The overall
    throughput was not affected. (Thanks PartialVolume)
- v0.27
  * Add verify method to verify a disk is zero filled #128 (Thanks Legogizmo)
  * Add new HMG IS5 enhanced wipe method #168 (Thanks infrastation)
  * Fix percentage progress and show on completion of wipe (Thanks PartialVolume)
  * Implement clang-format support (Thanks louib)
  * Implement more frequent disk sync support (Thanks Legogizmo)
  * Format command line help to 80 character line length #114 (Thanks PartialVolume)
  * Fix nwipe message log and missing messages that was causing
    segfaults under certain conditions (Thanks PartialVolume)
  * Add the Github build CI service and update Readme with build status labels (Thanks louib)
  * Miscellaneous smaller fixes</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1640174400">- v0.32
  IMPORTANT ! #322 Non functional Isaac prng
  is a security update. Of specific importance
  for anybody that might use --prng=isaac as one
  of nwipe's command line options. Significantly less
  important if you select Isaac from the GUI although
  still relevant, as mersenne is used not issac,
  despite what the GUI says. Putting --prng=isaac on
  the command line causes at best zeros to be written
  instead of a random stream, at worst the contents
  of a uninitialized buffer.
  See my comments in #322. Note, this bug existed
  in all previous versions of nwipe and also still
  exists in DBAN 2.3.0 within dwipe.
  Now fixed in nwipe, but as DBAN is no longer
  actively maintained, another reason to upgrade
  from DBAN to nwipe 0.32.
  includes the following changes:
  * Add ones (0xFF) wipe to the methods. Renamed Zero
    Fill to Fill with Zeros and the new ones wipe,
    is called Fill with Ones.
  * Add ones verication to the methods. Renamed Verify
    Blank to Verify Zeros (0x00) and the new verification
    is called Verify Ones (0xFF).
  * Move method information from below the list of methods
    to the right of the method list. This allows better use
    of the screen space by allowing more methods to be
    added to the list, especially relevant to nwipe running
    as a standalone application on small distros such as
    shredos 2020 in frame buffer mode.
  * Removed the old DBAN syslinux.cfg configuration
    hints as not relevant to nwipe. See nwipe --help
    or man nwipe for command line options.
  * Add fdatasync errors to the error summary table.
  * During a wipe, you can now toggle between dark screen,
    blank screen and default blue screen by repeatedly
    pressing the b key. Dark screen, which is grey text
    on black background has been introduced to prevent
    TFT/LCD image persistence on monitors that are
    sensitive to that issue. However, according to
    this article grey text on a white background may
    be preferable. I will probably add that option
    in the next release along with possibly powering
    off the display as an additional option.
  * Blanking disabled in GUI for OPS2
    (mandatory requirement of standard). #326
  * Total bytes written/read for ALL passes or
    verifications are now logged. #326
  * Final blanking being enabled is no longer
    required for verification passes. GUI Fix. #326
  * Add a summary table to the log that shows totals
    for pass &amp; verification errors. #325
  * Fix the missing 'Verifying' message on final blanking. #324
  * Fix prng selection always using mersenne irrespective
    of whatever prng the user selected. #323
  * Fix a non functional Isaac prng.
    (May have never worked even in DBAN/dwipe 2.3.0). #322
  * Log whether the prng produces a stream,
    if not log failure message. #321
  * Log the specific prng that is initialised. #320
  * Log selection details to the log. #319
  * Improve log messaging. #317
  * Fix auto shutdown option for some distros. #315
  * Fix build for musl. #301
  * Fixes to summary table &amp; fix final status message. 311
  * Updates to --help options #309
  * Updates to manpage. #300
  * Add auto power off option on completion of
    wipe ( --autopoweroff ) (Thanks PartialVolume)
  * Fixed --nowait option that wasn't working.
    (Thanks PartialVolume)
  * Add verbose option. -v, --verbose.
  * Add a spinner to the GUI for each drive being wiped.
    When nwipe is syncing the percentage completion pauses,
    having a spinner gives a clear indication that the wipe
    is still running. Each devices spinner disappears on
    completion of a given devices wipe. (Thanks PartialVolume)
  * Make log messages, especially the ones with the tag 'notice'
    succinct and less than 80 characters including the timestamp.
    This is of more importance when nwipe is used on a 80x30
    terminal (ALT-F2, Shredos etc) but generally makes
    the logs more readable. While doing this all information
    was still retained. (Thanks PartialVolume)
  * Add a summary table to the log that shows each
    drives status, i.e. erased or failed, throughput,
    duration of wipe, model, serial no etc.
    In particular it benefits those that wipe many
    drives simultaneously in rack servers.
    At a glance any failed drives can be seen without
    having to browse back through the log. (Thanks PartialVolume)
  * Add ETA to --nogui wipes status when SIGUSR1
    (kill -s USR1 (nwipes PID) is issued on the command line.
  * Fixed misleading throughput calculation. Throughput now
    shows average throughput calculated from start of wipe.
  * Fixed system info not being displayed in Debian Sid.
    [#229] (Thanks PartialVolume)
  * Add serial number display for USB to IDE/SATA adapters.
    This only works if the USB to IDE/SATA adapter supports
    ATA pass through. See #149 for further details (Thanks PartialVolume)
  * Fixed disk capacity nomenclature, width and padding on drive
    selection screen. See #237 (Thanks PartialVolume)
  * Add bus type, ATA or USB, amongst others to drive selection
    and wipe windows. (Thanks PartialVolume)
  * Add --nousb option. If you use the option --nousb,
    all USB devices will be ignored.
    They won't show up in the GUI and they won't be wiped
    if you use the --nogui --autonuke command.
    They will even be ignored if you specifically
    name them on the command line.
  * Miscellaneous GUI fixes, throughput display format,
    percentage display format to improve column alignment
    when wiping multiple discs. (Thanks PartialVolume)
  * Improve visibility of failure messages with red text
    on white background. (Thanks PartialVolume)
  * Add NVME and VIRT (loop etc) devices to device type
    table for display in GUI and logs. NVME devices now
    show up as NVME devices rather than UNK (Thanks PartialVolume)
  * Fixed very obscure segmentation fault going back to at least 0.24
    in drive selection window when resizing terminal vertical
    axis while drive focus symbol '&gt;' is pointing to the last drive
    of a multi drive selection window.
    See #248 for further details (Thanks PartialVolume)
  * Warn the user if they are incorrectly typing a lower case
    s to start a wipe, when they should be typing a capital S #262
    (Thanks PartialVolume)
  * Warn the user if they are typing capital S in order
    to start a wipe but haven't yet selected any drives
    for wiping #261 (Thanks PartialVolume)
  * Add ctrl A that toggles drive selection,
    all drives selected for wipe or all drives deselected. #266
  * Fixed compilation issue with NixOS with broken
    musl libc error due to missing header #275
  * Fixed status bar message showing incorrect information #287
  * Right Justify log labels to maintain column alignment #280
  * Added nwipe version &amp; OS info to log #297</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1687176000">- Update to version v0.34
  * Fix a compiler warning -Wformat-zero-length string
  * Fixes a slight screen corruption on 80 column display. When highlighting the verify ones option the first two digits of DoD 5220.20-M disappear. This patch fixes that issue.@PartialVolume #348
  * For some controllers/drivers the readlink method of obtaining the bus type for GUI display does not work. If we haven't already resolved the bus type, we then also check smartctl for the transport protocol for SAS. @PartialVolume #350
  * Check smartctl for unresolved bus types SATA @PartialVolume #358
  * Changed message from (No ATA pass-thru) to (S/N: unknown) as the reason the serial number is unknown is because there is no ATA pass through for the chipset being used by the USB to SATA adapter, basically we are making the message more meaningful for the end user rather than for the engineer/programmer that may understand the previous terminology used. @PartialVolume @Firminator #356
  * Add drive temperature monitoring and display temperature in degrees Celsius in the GUI. Requires the kernel drivetemp module and makes use of the hwmon sub system in the kernel to extract drive temperatures. Nwipe will automatically load the drivetemp module if it's available. @PartialVolume #360 #361 #364
  * Remove /dev/ from gui for long device names. This fixes column alignment issues in the gui with nvme drives i.e. nvme0n1 etc. If the drive name including path exceeds 8 characters the /dev/ is removed and prefixed with spaces to a total max length of 8 characters. @PartialVolume #365
  * Add -q --quiet option - anonymize serial numbers and SMBIOS-DMI data. This anonymizes serial numbers and related identifiable information for drives and hardware but does not remove model information in both the GUI and the log displayed by stdout at the end of a wipe and also in the log file if enabled in options. This feature is useful for uploading logs when submitting bug reports. @PartialVolume #366 #367 #371 #379 #383
  * Fixes a intermittent FAILED message that is displayed in the summary table when the message should have been UABORTED. The incorrect FAILED message only occurred when using control-C to abort a wipe. @PartialVolume #373
  * When many verification or pass errors are detected the status line can wrap on a 80 column display. This patch makes the error message more succinct which will free up about 10 characters &amp; prevents the line wrapping. @PartialVolume #374
  * Fixes a problem that occurs with a unresponsive drive that causes the ETA to grow to an enormous value. We now do not calculate an individual drives ETA when the throughput of the drive is zero so avoiding the overall ETA being incorrect for drives that are working correctly when multiple drives are being simultaneously wiped. While a individual drives ETA is calculated it is not displayed but only used to determine the overall ETA when all drives have completed. @PartialVolume #375
  * Add temperature monitoring and display with NVMe drives. @PartialVolume #377 #380 #381
  * When one of the two verify only methods are selected change the drive selected text from WIPE to VRFY to indicate the drive is not being wiped, but is only being verified. @PartialVolume #378
  * Fixes a incorrect sector, block and device sizes in 32 bit builds only as displayed in the nwipe log. This problem had no affect on the wipe as the issue was caused by a incorrect format specifier that affected the log text only. @PartialVolume #387 #388
  * Fixes a issue where temperatures may not have been available on Debian systems due to the location of modprobe. Particularly relevant to Debian which when logged in as root doesn't put /sbin in the $PATH environment setting. This issue was not necessarily relevant for Linux distros based on Debian, for instance, Ubuntu where nwipe would have found the modprobe command. @PartialVolume #390 #391
  * Improve wipe thread cancellation error checking. @PartialVolume #392
  * Improve GUI thread messaging if a pthread_join fails. @PartialVolume #393
  * Fixed a missing serial number on SAS drive.@PartialVolume #394
  * Added ISAAC-64 for 64 bit systems. Thanks @chkboom #398 #401
  * Fixes a problem with the Gutmann wipe where the random passes at the beginning and end were being re-arranged when only the inner passes should be rearranged. Thanks @chkboom #399
  * Fixes a obscure incorrect summary table status, while the log text correctly reports the failure. If the drive becomes non responsive during the wipe, the MB/s throughput will slowly drop towards 0MB/s and will display a FAILURE -1 error. The logs will correctly display errors and nwipe's return status will be non zero, however the summary table may display erased rather than FAILURE, this is because the wipe thread exited prematurely without setting the pass error. This fixes the error by checking the context's result status, i.e non zero on failure and if pass equals zero it makes pass equal to one. This is then picked up by the summary table log code which then marks the status correctly as FAILURE in the summary table. @PartialVolume #400
  * Fixes a spurious message on abort before wipe.This patch fixes a minor display issue that occurs when a user aborts a wipe before a wipe has started. It only occurs if the user had selected one or more drives for wipe and then aborted before starting the wipe. The spurious message only occurs in a virtual terminal, i.e. /dev/tty1, /dev/tty2, /dev/console It does not occur in terminal applications such as konsole, xterm, terminator etc. The spurious message that appears in the main window, states that "/dev/sdxyz 100% complete" along with garbage values in the statistics window. The message appears for a fraction of a second before being replaced with the textual log information that correctly states that the user aborted and no wipe was started. Basically the gui status information update function tries to update the data when the wipe hasn't even started. The fix is to only update the statistics information only if a wipe has started by checking the 'global_wipe_status' value which indicates whether any wipe started. '1' indicates that a wipe has started, else '0' if no wipe has started. @PartialVolume #406
  * Fixes temperature update in drive selection window. This fixes a problem where the drive temperature is not updated automatically in only the drive selection window. The temperature is however updated correctly every 60 seconds during a wipe in the wipe status window. This bug would probably never be noticed by most people as usually the drive temperature changes slowly and only rises once a wipe has started. The only time I imagine it would have been noticed would have been if the drive temperature was already high and you were trying to reduce the temperature by cooling before starting a wipe. This has now been corrected so that the temperature in the drive selection window is updated every 60 seconds. @PartialVolume #407
  * Fixes a zombie nwipe process running at 100% CPU on one core but only on a Konsole based terminal. This only occurred when the Konsole terminal is exited while nwipe is sitting at the drive selection screen but nwipe did not exit when the konsole terminal was closed. If nwipe is exited normally on completion of a wipe or aborted by using control C then this problem would not be seen. Also occurs during a wipe if the konsole terminal is closed without exiting nwipe first, again only on Konsole based terminals. @PartialVolume #408 #409
  * Fixes a obscure segfault when --logfile option used with a non writable directory. @PartialVolume #410</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt; - 0.37" date="1722168000">- Update to version v0.37
  * Added the XORoshiro-256 pseudo random number generator (PRNG). Thanks to Fabian Druschke @knogle #555
  * Added  the Lagged Fibonacci PRNG generator. Thanks again to Fabian Druschke @knogle #556
  * Added missing help for HMG IS5 enhanced. Thanks to @AndCycle #569
  * Changed the default method from "DOD Short" to "prng stream", using the XORoshiro-256 prng
  * Fixed an issue in configure.ac which was producing an error while running `./configure`,  mentioning libconfig, however the presence of libconfig had already been checked for, earlier in configure.ac. Although this error did not cause `./configure` to abort prematurely and therefore make would build the source correctly, it did cause a issue for inclusion into Debian Sid. Thanks to @Polynomial-C #574
  * Minor change to nwipe's man page filename, nwipe.1 to nwipe.8 to fix a Debian warning. #577
- Dropping old patches which are no longer applicable.</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1722945600">- Adding dependency to hdparm, smartmontools and dmidecode, which are needed to correctly operate nwipe.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1752494400">- Update to version v0.38
  * Fixes type error, relevant to i686 (32 bit) only. Fixes a compile error on some distros.
  * Added feature relevant to ShredOS only, the f key will toggle the font size, standard size to double size, has no action for other  xorg/wayland distributions. The f key is available in the drive selection and progress screens only. Note that in earlier commits in this release the d key was programmed however this is now the f key to toggle font size.
  * Fixes a issue where SAS drives always respond with hidden sectors = ???, i.e warning. This patch fixes the problem so that a SAS drive responds with hidden sectors = not applicable. A SATA drive connected to a SAS interface should still respond with yes or no subject to the interface passing HPA and DCO-identify commands.
  * On some distros, nwipe may not be able to find hdparm or smartctl even when they are installed. This is due to a symbolic link issue with the distro. The patch fixes this issue by adding a new search location when looking for hdparm and smartctl. The new search location is /usr/sbin/. Previously we searched /sbin/ and /usr/bin/ but /sbin is symbolically linked to /usr/sbin/ so just in case there was some issue with the symbolic link we also now search /usr/sbin/
  * The hidden sector check for SAS drives has been disabled as it is believed that SAS drives do not support the SCSI commands to adjust the drives size as reported to the O.S.
  * Some USB adapters report the model name and serial number with the incorrect endian, so adjacent characters in the model name are swapped with each other. This patch detects and fixes model names for Hitachi, Toshiba, WDC Western Digital Corporation and Seagate/ST drives. Mainly some older adapters and drive interfaces might have this issue.
  * Fixes the s shift s bug as reported here PartialVolume/shredos.x86_64#301 To summarize, if no drives are selected and then the user presses s (lower case) a warning appears indicating that the user should press S (upper case) to start the wipe. This warning appears for about 3 seconds but during this time if the user presses S (upper case) nwipe would immediately complete, having wiped no drives and requesting the user to press the spacebar to exit. The is incorrect behaviour.
  * The bug doesn't appear if the user pressed S after the 3 seconds elapsed and the warning message disappeared. This patch fixes this so that it does not exit but displays the warning for 3 seconds and then waits for input.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1757678400">- Update to version v0.39
  * Fix model name Endian for Sandisk-SunDisk drives
  * Implement Bruce Schneier 7-Pass wiping method
  * Some cleanup in options.c, added missing xoroshiro256_prng argument
  * fix: some declaration changes to satisfy gcc 15
  * Removed EXPERIMENTAL! comments for ALFG and Xoroshiro</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1771416000">- Update to version v0.40
  * Upon initialization, nwipe identifies and sets the most efficient Pseudo-Random Number Generator (PRNG) as the default, based on a real-time hardware performance test.
  * AES-256-CTR PRNG that utilizes native AES-NI instructions to significantly boost data-wiping throughput on compatible CPUs.
  * Implemented a new wipe method, the BMB21-2019 Chinese State Secrets Bureau standard Technical Requirement for Data Sanitization.
  * Implemented Direct I/O with large buffers as the default wipe method, reducing write instructions and boosting throughput. This change cut wipe completion times by 5–10% in tests and significantly lowered CPU load—especially on high-density servers wiping 10+ drives simultaneously. Kernel cached I/O remains available via command-line switches.
  * Added support for host UUID, serial number, and custom tags in PDF report headers. These options can be configured and toggled in the nwipe config menu ('c'), accessible from the nwipe drive selection screen and are saved to nwipe's config file, /etc/nwipe/nwipe.conf for persistent configuration between restarts."
  * Added a new GUI “device topology” view, opened with the 't' key from the device selection screen. Useful if you want to check which device controller, which HBA, etc. your drive is attached. This improves safety and usability on systems with multiple controllers by clearly showing the physical attachment path of each drive without changing wipe behaviour.
  * Enhanced the --exclude option to match devices by their underlying block device ID (major/minor), allowing persistent identifiers in /dev/disk/by-id/ and /dev/disk/by-path/ to be used safely. Legacy string-based matching is preserved.
  * The internal PRNGs are now seeded via getrandom(2) rather than through a long-lived file descriptor to /dev/urandom, to improve reliability.
  * fixed: To resolve issues with partition wipes, as opposed to whole disc wipes, nwipe now includes the device name in the PDF report filename. Previously, when wiping specific partitions (e.g., sudo nwipe /dev/sdc3 /dev/sd4 /dev/sd5) via the CLI, the absence of a disk model or serial number caused PDF filenames to conflict and overwrite each other. This update ensures unique filenames and prevents data loss when processing multiple partitions.
  * Add static linking libraries that are required by parted 3.6
  * fixed: some declaration changes to satisfy gcc 15
  * Optimised that header code that generates the PDF reports.
  * fixed: respect no-blanking methods in --nogui mode. This fixes an issue where a default blanking pass was added to methods which do not support it when in --nogui mode. Existing GUI code overriding the option is never called in --nogui mode
  * fixed: sanitize device serial numbers and fix uninitialized/fallback handling.
  * fixed: Automatically create PDF report directory if missing and improve permission model
  * optimise: Validate autonuke and nogui for valid values and harden logic by not using assumptions in if statements for binary values and switching to case statements for value specific checks.
  * fixed: Improve str_truncate to fix memory error detected in valgrind
  * fixed: Require strict input of long form options, i.e no abbreviations allowed!. Command line option syntax as specifically described in nwipe --help and nwipe man page are only allowed. Corrects a 'feature' in GNU getopt_long().</changelog>
  <changelog author="Erico Mendonca &lt;erico.mendonca@suse.com&gt;" date="1780488000">- Update to version v0.41
  * Restructure PDF source files. We now have a separate source file for each type of PDF created.
  * Major bugfixes &amp; bad block/error handling
  * Add optional non-fatal handling of block write errors in forward passes
  * Merge pull request #717 from PartialVolume/restructure_PDF_source_files
  * Initial work on system multi disc PDF, work in progress
  * Update installation instructions in README.md
  * Reverse wiping, verification skip bad blocks &amp; minor fixes
  * PRNGs: Two new PRNGs + GUI Selection Screen
  * CI unit testing for nwipe
  * Tidy up display_help function
  * Add the .clang-format-ignore file
  * Bump minor version as a test of .clang-format-ignore
  * Minor formatting fixes
  * Some additional help info for display_help()
  * Fix v0.40 regression (failing -std=c99, Fedora packaging)
  * ci: add workflows for -std=c99/c11/c17
  * Added contribution guidelines, especially regarding the use of AI agents
  * CI: Test --directio and --cachedio I/O modes
  * I/O direction selection (--reverse)
  * feat: introduce --force for in use devices
  * Device geometry, scattered I/O, verification error paths
  * fix(gui): do not select disabled devices
  * System pdf
  * Add system host UUID and serial number
  * Add smbios dmi page to system pdf</changelog>
</package>
<package pkgid="b9f0f7d344b8cfbd67b90e95fd6063057d795e9c6fdec15f2b64d27f5fe2640e5feaac53344aa759563fb994b9ad7205c759da00b120cb1ac7c23a27afc41dc9" name="oath-toolkit" arch="s390x">
  <version epoch="0" ver="2.6.14" rel="41.9"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1609243200">- Update to version 2.6.5
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.
    KEY and OTP may now be given as '-' to mean stdin, or @FILE to
    read from a particular file.  This is recommended on multi-user
    systems, since secrets as command line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.
  * Doc fixes.
- Update to version 2.6.4
  * libpskc: New --with-xmlsec-crypto-engine to hard-code crypto
    engine.  Use it like --with-xmlsec-crypto-engine=gnutls or
  - -with-xmlsec-crypto-engine=openssl if the default dynamic
    loading fails because of runtime linker search path issues.
  * oathtool --totp --verbose now prints TOTP hash mode.
  * oathtool: Hash names (e.g., SHA256) for --totp are now upper
    case.  Lower/mixed case hash names are supported for
    compatibility.
  * pam_oath: Fail gracefully for missing users.
    This allows you to incrementally add support for OATH
    authentication instead of forcing it on all users.
  * Fix libpskc memory corruption bug.
  * Fix man pages.
  * Build fixes.
- Update to version 2.6.3
  * pam_oath: Fix self-tests.
- Drop not longer needed patches:
  * 0001-Fix-no-return-in-nonvoid-function-errors-reported-by.patch
  * 0003-pam_oath-assign-safe-default-to-alwaysok-config-memb.patch
  * 0002-update_gnulibs_files.patch
  * gnulib-libio.patch
- Use source verification
- Use proper source URLs</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1611144000">- Update to version 2.6.6
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.  KEY and OTP may now be given as '-' to mean
    stdin, or @FILE to read from a particular file.  This is
    recommended on multi-user systems, since secrets as command
    line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1619956800">- Update to version 2.6.7
  * pam_oath: Support variables in usersfile string parameter.
    These changes introduce the ${USER} and ${HOME} placeholder
    values for the usersfile string in the pam_oath configuration
    file. The placeholder values allow the user credentials file
    to be stored in a file path that is relative to the user, and
    mimics similar behavior found in google-authenticator-libpam.
    The motivation for these changes is to allow for
    non-privileged processes to use pam_oath (e.g., for 2FA with
    xscreensaver). Non-privileged and non-suid programs are
    unable to use pam_oath. These changes are a proposed
    alternative to a suid helper binary as well.
  * doc: Fix project URL in man pages.
  * build: Drop use of libxml's AM_PATH_XML2 in favor of pkg-config.
  * build: Modernize autotools usage.
    Most importantly, no longer use -Werror with AM_INIT_AUTOMAKE
    to make rebuilding from source more safe with future automake
    versions.
  * Updated gnulib files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url -&gt; https</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1659441600">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1688904000">- Update to version 2.6.8
  * libpskc: Fixes for recent libxmlsec releases.
  * pam_oath: Provide fallback pam_modutil_getpwnam implementation.
  * pam_oath: Don't fail authentication when pam_modutil_getpwnam
  doesn't ** know the user when usersfile don't include ${USER}
  or ${HOME}.
  * pam_oath: Self-test improvements.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.11
  * liboath: Handle invalid base32 encoded secrets.  Fixes: #41.
  * Various build fixes including updated gnulib files.
  * Improve compatibility with recent libxmlsec.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1726228800">- Fix security issue CVE-2024-47191 by adding
  0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch .
- Add patch to implement new null_usersfile_okay argument
  42-null_usersfile_okay.patch .
- Makes this version 2.6.11.12 to be able to depend on it.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1729080000">- Update 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  with bsc#1231699 improvements for security fix CVE-2024-47191</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1770120000">- Update to version 2.6.14
  * pam_oath: Support null_usersfile_okay parameter. The argument
    no_usersfile_okay forces the module to act as if the user is
    not present in the config, if the config file does not exist.
    This has security implications only use if you know what you
    are doing. E.g. if the file is in a mount like home and that
    fails to be mounted, then this will succeed even if the OTP if
    configured for that user. Patch by Luna, Jan Zerebecki, and
    Miika Alikirri; see
    https://codeberg.org/oath-toolkit/oath-toolkit/pulls/94.
  * pam_oath README: Suggest KbdInteractiveAuthentication. Instead
    of deprecated ChallengeResponseAuthentication.
    see https://codeberg.org/oath-toolkit/oath-toolkit/pulls/112.
  * Various build fixes including updated gnulib files. Fixes
    building with glibc 2.43.
- Update to version 2.6.13
  * liboath/libpskc: Fix _FORTIFY_SOURCE build problem and allow
    configuration.
  * liboath: Fix --with-openssl builds
  * Git hosting moved from gitlab.com to codeberg.org. The new URL
    is https://codeberg.org/oath-toolkit/oath-toolkit although the
    old GitLab project will continue to be used for pipelines.
    https://gitlab.com/oath-toolkit/oath-toolkit/-/pipelines
  * Various build fixes including updated gnulib files. Gnulib
    files are no longer stored in git version control. As a
    consequence, gnulib is a required build dependency when
    building from git, see CONTRIBUTING.md.
- Update to version 2.6.12
  * Reported by Fabian Vogt (SUSE), and associated with
    CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings,
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    Quoting a writeup in an alternate patch by Matthias Gerstner
    (SUSE): With the addition of the possibility to place a
    usersfile also into a the usersfile= path specification,
    security issues sneaked in. The PAM process usually runs with
    root privileges. The file operations in an unprivileged user’s
    home directory follow symlinks both when reading and creating
    files, allowing for a potential local root exploit, because of
    the fchown() performed on the newly created usersfile.
  * We drop privileges to the user that is being logged into,
    assuming it has the necessary permissions for the usersfile
    belonging in their home directory. This restricts the ability
    for non-root users to affect files beyond their control via
    liboath.
  * liboath: Don’t follow symbolic links for usersfile updates.
    Reported by Fabian Vogt (SUSE), and associated with CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings, see
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    The fix is to open files for writing in exclusive mode (i.e., fail
    if the file exists including if it is a symbolic link).
  * oathtool: Fix test suite on 32-bit big-endian platforms.
  * libpskc: Don’t call deprecated xmlMemoryDump.
  * Various build fixes including updated gnulib files.
- Drop not longer needed patches (fixed upstream):
  * 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  * 42-null_usersfile_okay.patch
- Use %ldconfig_scriptlets macro.</changelog>
</package>
<package pkgid="aef3549b7b9842cef31dd0869ef3fadb82e58850d82a92626e16d24a76a5115539500560dc68baef136f90e6a4622ea9dea7bae6617f82e65fec6953ebd05082" name="oath-toolkit" arch="src">
  <version epoch="0" ver="2.6.14" rel="41.9"/>
  <changelog author="t.gruner@katodev.de" date="1441800000">- Update to Version 2.6.1 (released 2015-07-31)
  - liboath: Fix 'make check' on 32-bit systems.
- Version 2.6.0 (released 2015-05-19)
  - liboath: Support TOTP with HMAC-SHA256 and HMAC-SHA512.
    This adds new APIs oath_totp_generate2, oath_totp_validate4 and
    oath_totp_validate4_callback.
  - oathtool: The --totp parameter now take an optional argument to specify MAC.
    For example use --totp=sha256 to use HMAC-SHA256.  When --totp is used
    the default HMAC-SHA1 is used, as before.
  - pam_oath: Mention in README that you shouldn't use insecure keys.
  - pam_oath: Check return value from strdup.
  - The files 'gdoc' and 'expect.oath' are now included in the tarball.</changelog>
  <changelog author="mardnh@gmx.de" date="1472472000">- Update to Version 2.6.2
  - no changes in upstream code
- Fix RPM groups for -devel packages
- build with libpskc on supported suse-versions
- Add patch:
  - 0001-Fix-no-return-in-nonvoid-function-errors-reported-by.patch</changelog>
  <changelog author="dmarcoux@posteo.de" date="1516104000">- Add patch (last commit which changed source, not released in 2.6.2):
  - 0002-update_gnulibs_files.patch</changelog>
  <changelog author="ncutler@suse.com" date="1523448000">- use %license instead of %doc to package license-related files</changelog>
  <changelog author="ncutler@suse.com" date="1523448001">- bring License line into closer accordance with actual licenses
  mentioned in the tarball
- split off xml/pskc/ directory/files from liboath0 into a separate
  "oath-toolkit-xml" subpackage to prevent conflicts if two versions of the
  liboath library were ever installed at the same time</changelog>
  <changelog author="mpluskal@suse.com" date="1523620800">- Run spe-cleaner
- Drop useless conditions</changelog>
  <changelog author="jengelh@inai.de" date="1524052800">- Trim/update descriptions. Fix RPM groups. Remove useless
  - -with-pic.</changelog>
  <changelog author="julio@juliogonzalez.es" date="1526817600">- Fix build for openSUSE Leap 42.2 and 42.3</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1530792000">- Add patch 0003-pam_oath-assign-safe-default-to-alwaysok-config-memb.patch:
  - fix potential security issue in low memory situation (bsc#1089114)</changelog>
  <changelog author="schwab@suse.de" date="1533556800">- gnulib-libio.patch: Update gnulib for libio.h removal</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1609243200">- Update to version 2.6.5
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.
    KEY and OTP may now be given as '-' to mean stdin, or @FILE to
    read from a particular file.  This is recommended on multi-user
    systems, since secrets as command line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.
  * Doc fixes.
- Update to version 2.6.4
  * libpskc: New --with-xmlsec-crypto-engine to hard-code crypto
    engine.  Use it like --with-xmlsec-crypto-engine=gnutls or
  - -with-xmlsec-crypto-engine=openssl if the default dynamic
    loading fails because of runtime linker search path issues.
  * oathtool --totp --verbose now prints TOTP hash mode.
  * oathtool: Hash names (e.g., SHA256) for --totp are now upper
    case.  Lower/mixed case hash names are supported for
    compatibility.
  * pam_oath: Fail gracefully for missing users.
    This allows you to incrementally add support for OATH
    authentication instead of forcing it on all users.
  * Fix libpskc memory corruption bug.
  * Fix man pages.
  * Build fixes.
- Update to version 2.6.3
  * pam_oath: Fix self-tests.
- Drop not longer needed patches:
  * 0001-Fix-no-return-in-nonvoid-function-errors-reported-by.patch
  * 0003-pam_oath-assign-safe-default-to-alwaysok-config-memb.patch
  * 0002-update_gnulibs_files.patch
  * gnulib-libio.patch
- Use source verification
- Use proper source URLs</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1611144000">- Update to version 2.6.6
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.  KEY and OTP may now be given as '-' to mean
    stdin, or @FILE to read from a particular file.  This is
    recommended on multi-user systems, since secrets as command
    line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1619956800">- Update to version 2.6.7
  * pam_oath: Support variables in usersfile string parameter.
    These changes introduce the ${USER} and ${HOME} placeholder
    values for the usersfile string in the pam_oath configuration
    file. The placeholder values allow the user credentials file
    to be stored in a file path that is relative to the user, and
    mimics similar behavior found in google-authenticator-libpam.
    The motivation for these changes is to allow for
    non-privileged processes to use pam_oath (e.g., for 2FA with
    xscreensaver). Non-privileged and non-suid programs are
    unable to use pam_oath. These changes are a proposed
    alternative to a suid helper binary as well.
  * doc: Fix project URL in man pages.
  * build: Drop use of libxml's AM_PATH_XML2 in favor of pkg-config.
  * build: Modernize autotools usage.
    Most importantly, no longer use -Werror with AM_INIT_AUTOMAKE
    to make rebuilding from source more safe with future automake
    versions.
  * Updated gnulib files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url -&gt; https</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1659441600">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1688904000">- Update to version 2.6.8
  * libpskc: Fixes for recent libxmlsec releases.
  * pam_oath: Provide fallback pam_modutil_getpwnam implementation.
  * pam_oath: Don't fail authentication when pam_modutil_getpwnam
  doesn't ** know the user when usersfile don't include ${USER}
  or ${HOME}.
  * pam_oath: Self-test improvements.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.11
  * liboath: Handle invalid base32 encoded secrets.  Fixes: #41.
  * Various build fixes including updated gnulib files.
  * Improve compatibility with recent libxmlsec.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1726228800">- Fix security issue CVE-2024-47191 by adding
  0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch .
- Add patch to implement new null_usersfile_okay argument
  42-null_usersfile_okay.patch .
- Makes this version 2.6.11.12 to be able to depend on it.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1729080000">- Update 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  with bsc#1231699 improvements for security fix CVE-2024-47191</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1770120000">- Update to version 2.6.14
  * pam_oath: Support null_usersfile_okay parameter. The argument
    no_usersfile_okay forces the module to act as if the user is
    not present in the config, if the config file does not exist.
    This has security implications only use if you know what you
    are doing. E.g. if the file is in a mount like home and that
    fails to be mounted, then this will succeed even if the OTP if
    configured for that user. Patch by Luna, Jan Zerebecki, and
    Miika Alikirri; see
    https://codeberg.org/oath-toolkit/oath-toolkit/pulls/94.
  * pam_oath README: Suggest KbdInteractiveAuthentication. Instead
    of deprecated ChallengeResponseAuthentication.
    see https://codeberg.org/oath-toolkit/oath-toolkit/pulls/112.
  * Various build fixes including updated gnulib files. Fixes
    building with glibc 2.43.
- Update to version 2.6.13
  * liboath/libpskc: Fix _FORTIFY_SOURCE build problem and allow
    configuration.
  * liboath: Fix --with-openssl builds
  * Git hosting moved from gitlab.com to codeberg.org. The new URL
    is https://codeberg.org/oath-toolkit/oath-toolkit although the
    old GitLab project will continue to be used for pipelines.
    https://gitlab.com/oath-toolkit/oath-toolkit/-/pipelines
  * Various build fixes including updated gnulib files. Gnulib
    files are no longer stored in git version control. As a
    consequence, gnulib is a required build dependency when
    building from git, see CONTRIBUTING.md.
- Update to version 2.6.12
  * Reported by Fabian Vogt (SUSE), and associated with
    CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings,
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    Quoting a writeup in an alternate patch by Matthias Gerstner
    (SUSE): With the addition of the possibility to place a
    usersfile also into a the usersfile= path specification,
    security issues sneaked in. The PAM process usually runs with
    root privileges. The file operations in an unprivileged user’s
    home directory follow symlinks both when reading and creating
    files, allowing for a potential local root exploit, because of
    the fchown() performed on the newly created usersfile.
  * We drop privileges to the user that is being logged into,
    assuming it has the necessary permissions for the usersfile
    belonging in their home directory. This restricts the ability
    for non-root users to affect files beyond their control via
    liboath.
  * liboath: Don’t follow symbolic links for usersfile updates.
    Reported by Fabian Vogt (SUSE), and associated with CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings, see
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    The fix is to open files for writing in exclusive mode (i.e., fail
    if the file exists including if it is a symbolic link).
  * oathtool: Fix test suite on 32-bit big-endian platforms.
  * libpskc: Don’t call deprecated xmlMemoryDump.
  * Various build fixes including updated gnulib files.
- Drop not longer needed patches (fixed upstream):
  * 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  * 42-null_usersfile_okay.patch
- Use %ldconfig_scriptlets macro.</changelog>
</package>
<package pkgid="21f9372216c2d7db0b529a5ad564053c35812f21bcc66e30e9cc9d6b91cd3bb293df1c4848c24520ea48ba4ad39f09229053d30bc136f5dd55b03ec3d7d69701" name="oath-toolkit-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.14" rel="41.9"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1609243200">- Update to version 2.6.5
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.
    KEY and OTP may now be given as '-' to mean stdin, or @FILE to
    read from a particular file.  This is recommended on multi-user
    systems, since secrets as command line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.
  * Doc fixes.
- Update to version 2.6.4
  * libpskc: New --with-xmlsec-crypto-engine to hard-code crypto
    engine.  Use it like --with-xmlsec-crypto-engine=gnutls or
  - -with-xmlsec-crypto-engine=openssl if the default dynamic
    loading fails because of runtime linker search path issues.
  * oathtool --totp --verbose now prints TOTP hash mode.
  * oathtool: Hash names (e.g., SHA256) for --totp are now upper
    case.  Lower/mixed case hash names are supported for
    compatibility.
  * pam_oath: Fail gracefully for missing users.
    This allows you to incrementally add support for OATH
    authentication instead of forcing it on all users.
  * Fix libpskc memory corruption bug.
  * Fix man pages.
  * Build fixes.
- Update to version 2.6.3
  * pam_oath: Fix self-tests.
- Drop not longer needed patches:
  * 0001-Fix-no-return-in-nonvoid-function-errors-reported-by.patch
  * 0003-pam_oath-assign-safe-default-to-alwaysok-config-memb.patch
  * 0002-update_gnulibs_files.patch
  * gnulib-libio.patch
- Use source verification
- Use proper source URLs</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1611144000">- Update to version 2.6.6
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.  KEY and OTP may now be given as '-' to mean
    stdin, or @FILE to read from a particular file.  This is
    recommended on multi-user systems, since secrets as command
    line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1619956800">- Update to version 2.6.7
  * pam_oath: Support variables in usersfile string parameter.
    These changes introduce the ${USER} and ${HOME} placeholder
    values for the usersfile string in the pam_oath configuration
    file. The placeholder values allow the user credentials file
    to be stored in a file path that is relative to the user, and
    mimics similar behavior found in google-authenticator-libpam.
    The motivation for these changes is to allow for
    non-privileged processes to use pam_oath (e.g., for 2FA with
    xscreensaver). Non-privileged and non-suid programs are
    unable to use pam_oath. These changes are a proposed
    alternative to a suid helper binary as well.
  * doc: Fix project URL in man pages.
  * build: Drop use of libxml's AM_PATH_XML2 in favor of pkg-config.
  * build: Modernize autotools usage.
    Most importantly, no longer use -Werror with AM_INIT_AUTOMAKE
    to make rebuilding from source more safe with future automake
    versions.
  * Updated gnulib files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url -&gt; https</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1659441600">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1688904000">- Update to version 2.6.8
  * libpskc: Fixes for recent libxmlsec releases.
  * pam_oath: Provide fallback pam_modutil_getpwnam implementation.
  * pam_oath: Don't fail authentication when pam_modutil_getpwnam
  doesn't ** know the user when usersfile don't include ${USER}
  or ${HOME}.
  * pam_oath: Self-test improvements.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.11
  * liboath: Handle invalid base32 encoded secrets.  Fixes: #41.
  * Various build fixes including updated gnulib files.
  * Improve compatibility with recent libxmlsec.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1726228800">- Fix security issue CVE-2024-47191 by adding
  0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch .
- Add patch to implement new null_usersfile_okay argument
  42-null_usersfile_okay.patch .
- Makes this version 2.6.11.12 to be able to depend on it.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1729080000">- Update 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  with bsc#1231699 improvements for security fix CVE-2024-47191</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1770120000">- Update to version 2.6.14
  * pam_oath: Support null_usersfile_okay parameter. The argument
    no_usersfile_okay forces the module to act as if the user is
    not present in the config, if the config file does not exist.
    This has security implications only use if you know what you
    are doing. E.g. if the file is in a mount like home and that
    fails to be mounted, then this will succeed even if the OTP if
    configured for that user. Patch by Luna, Jan Zerebecki, and
    Miika Alikirri; see
    https://codeberg.org/oath-toolkit/oath-toolkit/pulls/94.
  * pam_oath README: Suggest KbdInteractiveAuthentication. Instead
    of deprecated ChallengeResponseAuthentication.
    see https://codeberg.org/oath-toolkit/oath-toolkit/pulls/112.
  * Various build fixes including updated gnulib files. Fixes
    building with glibc 2.43.
- Update to version 2.6.13
  * liboath/libpskc: Fix _FORTIFY_SOURCE build problem and allow
    configuration.
  * liboath: Fix --with-openssl builds
  * Git hosting moved from gitlab.com to codeberg.org. The new URL
    is https://codeberg.org/oath-toolkit/oath-toolkit although the
    old GitLab project will continue to be used for pipelines.
    https://gitlab.com/oath-toolkit/oath-toolkit/-/pipelines
  * Various build fixes including updated gnulib files. Gnulib
    files are no longer stored in git version control. As a
    consequence, gnulib is a required build dependency when
    building from git, see CONTRIBUTING.md.
- Update to version 2.6.12
  * Reported by Fabian Vogt (SUSE), and associated with
    CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings,
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    Quoting a writeup in an alternate patch by Matthias Gerstner
    (SUSE): With the addition of the possibility to place a
    usersfile also into a the usersfile= path specification,
    security issues sneaked in. The PAM process usually runs with
    root privileges. The file operations in an unprivileged user’s
    home directory follow symlinks both when reading and creating
    files, allowing for a potential local root exploit, because of
    the fchown() performed on the newly created usersfile.
  * We drop privileges to the user that is being logged into,
    assuming it has the necessary permissions for the usersfile
    belonging in their home directory. This restricts the ability
    for non-root users to affect files beyond their control via
    liboath.
  * liboath: Don’t follow symbolic links for usersfile updates.
    Reported by Fabian Vogt (SUSE), and associated with CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings, see
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    The fix is to open files for writing in exclusive mode (i.e., fail
    if the file exists including if it is a symbolic link).
  * oathtool: Fix test suite on 32-bit big-endian platforms.
  * libpskc: Don’t call deprecated xmlMemoryDump.
  * Various build fixes including updated gnulib files.
- Drop not longer needed patches (fixed upstream):
  * 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  * 42-null_usersfile_okay.patch
- Use %ldconfig_scriptlets macro.</changelog>
</package>
<package pkgid="1ac956ceb57be42c053a7cc385e156b273e397fa8c28f8ae54044bae0a652ef462f55a74d6b535271e813dfa8e8498ff1ebb0bd155f64ba94669667bc79f0c4c" name="oath-toolkit-debugsource" arch="s390x">
  <version epoch="0" ver="2.6.14" rel="41.9"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1609243200">- Update to version 2.6.5
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.
    KEY and OTP may now be given as '-' to mean stdin, or @FILE to
    read from a particular file.  This is recommended on multi-user
    systems, since secrets as command line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.
  * Doc fixes.
- Update to version 2.6.4
  * libpskc: New --with-xmlsec-crypto-engine to hard-code crypto
    engine.  Use it like --with-xmlsec-crypto-engine=gnutls or
  - -with-xmlsec-crypto-engine=openssl if the default dynamic
    loading fails because of runtime linker search path issues.
  * oathtool --totp --verbose now prints TOTP hash mode.
  * oathtool: Hash names (e.g., SHA256) for --totp are now upper
    case.  Lower/mixed case hash names are supported for
    compatibility.
  * pam_oath: Fail gracefully for missing users.
    This allows you to incrementally add support for OATH
    authentication instead of forcing it on all users.
  * Fix libpskc memory corruption bug.
  * Fix man pages.
  * Build fixes.
- Update to version 2.6.3
  * pam_oath: Fix self-tests.
- Drop not longer needed patches:
  * 0001-Fix-no-return-in-nonvoid-function-errors-reported-by.patch
  * 0003-pam_oath-assign-safe-default-to-alwaysok-config-memb.patch
  * 0002-update_gnulibs_files.patch
  * gnulib-libio.patch
- Use source verification
- Use proper source URLs</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1611144000">- Update to version 2.6.6
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.  KEY and OTP may now be given as '-' to mean
    stdin, or @FILE to read from a particular file.  This is
    recommended on multi-user systems, since secrets as command
    line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1619956800">- Update to version 2.6.7
  * pam_oath: Support variables in usersfile string parameter.
    These changes introduce the ${USER} and ${HOME} placeholder
    values for the usersfile string in the pam_oath configuration
    file. The placeholder values allow the user credentials file
    to be stored in a file path that is relative to the user, and
    mimics similar behavior found in google-authenticator-libpam.
    The motivation for these changes is to allow for
    non-privileged processes to use pam_oath (e.g., for 2FA with
    xscreensaver). Non-privileged and non-suid programs are
    unable to use pam_oath. These changes are a proposed
    alternative to a suid helper binary as well.
  * doc: Fix project URL in man pages.
  * build: Drop use of libxml's AM_PATH_XML2 in favor of pkg-config.
  * build: Modernize autotools usage.
    Most importantly, no longer use -Werror with AM_INIT_AUTOMAKE
    to make rebuilding from source more safe with future automake
    versions.
  * Updated gnulib files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url -&gt; https</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1659441600">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1688904000">- Update to version 2.6.8
  * libpskc: Fixes for recent libxmlsec releases.
  * pam_oath: Provide fallback pam_modutil_getpwnam implementation.
  * pam_oath: Don't fail authentication when pam_modutil_getpwnam
  doesn't ** know the user when usersfile don't include ${USER}
  or ${HOME}.
  * pam_oath: Self-test improvements.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.11
  * liboath: Handle invalid base32 encoded secrets.  Fixes: #41.
  * Various build fixes including updated gnulib files.
  * Improve compatibility with recent libxmlsec.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1726228800">- Fix security issue CVE-2024-47191 by adding
  0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch .
- Add patch to implement new null_usersfile_okay argument
  42-null_usersfile_okay.patch .
- Makes this version 2.6.11.12 to be able to depend on it.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1729080000">- Update 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  with bsc#1231699 improvements for security fix CVE-2024-47191</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1770120000">- Update to version 2.6.14
  * pam_oath: Support null_usersfile_okay parameter. The argument
    no_usersfile_okay forces the module to act as if the user is
    not present in the config, if the config file does not exist.
    This has security implications only use if you know what you
    are doing. E.g. if the file is in a mount like home and that
    fails to be mounted, then this will succeed even if the OTP if
    configured for that user. Patch by Luna, Jan Zerebecki, and
    Miika Alikirri; see
    https://codeberg.org/oath-toolkit/oath-toolkit/pulls/94.
  * pam_oath README: Suggest KbdInteractiveAuthentication. Instead
    of deprecated ChallengeResponseAuthentication.
    see https://codeberg.org/oath-toolkit/oath-toolkit/pulls/112.
  * Various build fixes including updated gnulib files. Fixes
    building with glibc 2.43.
- Update to version 2.6.13
  * liboath/libpskc: Fix _FORTIFY_SOURCE build problem and allow
    configuration.
  * liboath: Fix --with-openssl builds
  * Git hosting moved from gitlab.com to codeberg.org. The new URL
    is https://codeberg.org/oath-toolkit/oath-toolkit although the
    old GitLab project will continue to be used for pipelines.
    https://gitlab.com/oath-toolkit/oath-toolkit/-/pipelines
  * Various build fixes including updated gnulib files. Gnulib
    files are no longer stored in git version control. As a
    consequence, gnulib is a required build dependency when
    building from git, see CONTRIBUTING.md.
- Update to version 2.6.12
  * Reported by Fabian Vogt (SUSE), and associated with
    CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings,
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    Quoting a writeup in an alternate patch by Matthias Gerstner
    (SUSE): With the addition of the possibility to place a
    usersfile also into a the usersfile= path specification,
    security issues sneaked in. The PAM process usually runs with
    root privileges. The file operations in an unprivileged user’s
    home directory follow symlinks both when reading and creating
    files, allowing for a potential local root exploit, because of
    the fchown() performed on the newly created usersfile.
  * We drop privileges to the user that is being logged into,
    assuming it has the necessary permissions for the usersfile
    belonging in their home directory. This restricts the ability
    for non-root users to affect files beyond their control via
    liboath.
  * liboath: Don’t follow symbolic links for usersfile updates.
    Reported by Fabian Vogt (SUSE), and associated with CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings, see
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    The fix is to open files for writing in exclusive mode (i.e., fail
    if the file exists including if it is a symbolic link).
  * oathtool: Fix test suite on 32-bit big-endian platforms.
  * libpskc: Don’t call deprecated xmlMemoryDump.
  * Various build fixes including updated gnulib files.
- Drop not longer needed patches (fixed upstream):
  * 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  * 42-null_usersfile_okay.patch
- Use %ldconfig_scriptlets macro.</changelog>
</package>
<package pkgid="b784aae442b29dd93e2d95269125f285290ae350fc69cc4f11af133161d379d835be0c907687134cb33c72272385d1cab13311d7d1bd3ad5f6b687f2d48f1aed" name="oath-toolkit-xml" arch="noarch">
  <version epoch="0" ver="2.6.14" rel="41.9"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1609243200">- Update to version 2.6.5
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.
    KEY and OTP may now be given as '-' to mean stdin, or @FILE to
    read from a particular file.  This is recommended on multi-user
    systems, since secrets as command line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.
  * Doc fixes.
- Update to version 2.6.4
  * libpskc: New --with-xmlsec-crypto-engine to hard-code crypto
    engine.  Use it like --with-xmlsec-crypto-engine=gnutls or
  - -with-xmlsec-crypto-engine=openssl if the default dynamic
    loading fails because of runtime linker search path issues.
  * oathtool --totp --verbose now prints TOTP hash mode.
  * oathtool: Hash names (e.g., SHA256) for --totp are now upper
    case.  Lower/mixed case hash names are supported for
    compatibility.
  * pam_oath: Fail gracefully for missing users.
    This allows you to incrementally add support for OATH
    authentication instead of forcing it on all users.
  * Fix libpskc memory corruption bug.
  * Fix man pages.
  * Build fixes.
- Update to version 2.6.3
  * pam_oath: Fix self-tests.
- Drop not longer needed patches:
  * 0001-Fix-no-return-in-nonvoid-function-errors-reported-by.patch
  * 0003-pam_oath-assign-safe-default-to-alwaysok-config-memb.patch
  * 0002-update_gnulibs_files.patch
  * gnulib-libio.patch
- Use source verification
- Use proper source URLs</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1611144000">- Update to version 2.6.6
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.  KEY and OTP may now be given as '-' to mean
    stdin, or @FILE to read from a particular file.  This is
    recommended on multi-user systems, since secrets as command
    line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1619956800">- Update to version 2.6.7
  * pam_oath: Support variables in usersfile string parameter.
    These changes introduce the ${USER} and ${HOME} placeholder
    values for the usersfile string in the pam_oath configuration
    file. The placeholder values allow the user credentials file
    to be stored in a file path that is relative to the user, and
    mimics similar behavior found in google-authenticator-libpam.
    The motivation for these changes is to allow for
    non-privileged processes to use pam_oath (e.g., for 2FA with
    xscreensaver). Non-privileged and non-suid programs are
    unable to use pam_oath. These changes are a proposed
    alternative to a suid helper binary as well.
  * doc: Fix project URL in man pages.
  * build: Drop use of libxml's AM_PATH_XML2 in favor of pkg-config.
  * build: Modernize autotools usage.
    Most importantly, no longer use -Werror with AM_INIT_AUTOMAKE
    to make rebuilding from source more safe with future automake
    versions.
  * Updated gnulib files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url -&gt; https</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1659441600">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1688904000">- Update to version 2.6.8
  * libpskc: Fixes for recent libxmlsec releases.
  * pam_oath: Provide fallback pam_modutil_getpwnam implementation.
  * pam_oath: Don't fail authentication when pam_modutil_getpwnam
  doesn't ** know the user when usersfile don't include ${USER}
  or ${HOME}.
  * pam_oath: Self-test improvements.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.11
  * liboath: Handle invalid base32 encoded secrets.  Fixes: #41.
  * Various build fixes including updated gnulib files.
  * Improve compatibility with recent libxmlsec.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1726228800">- Fix security issue CVE-2024-47191 by adding
  0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch .
- Add patch to implement new null_usersfile_okay argument
  42-null_usersfile_okay.patch .
- Makes this version 2.6.11.12 to be able to depend on it.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1729080000">- Update 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  with bsc#1231699 improvements for security fix CVE-2024-47191</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1770120000">- Update to version 2.6.14
  * pam_oath: Support null_usersfile_okay parameter. The argument
    no_usersfile_okay forces the module to act as if the user is
    not present in the config, if the config file does not exist.
    This has security implications only use if you know what you
    are doing. E.g. if the file is in a mount like home and that
    fails to be mounted, then this will succeed even if the OTP if
    configured for that user. Patch by Luna, Jan Zerebecki, and
    Miika Alikirri; see
    https://codeberg.org/oath-toolkit/oath-toolkit/pulls/94.
  * pam_oath README: Suggest KbdInteractiveAuthentication. Instead
    of deprecated ChallengeResponseAuthentication.
    see https://codeberg.org/oath-toolkit/oath-toolkit/pulls/112.
  * Various build fixes including updated gnulib files. Fixes
    building with glibc 2.43.
- Update to version 2.6.13
  * liboath/libpskc: Fix _FORTIFY_SOURCE build problem and allow
    configuration.
  * liboath: Fix --with-openssl builds
  * Git hosting moved from gitlab.com to codeberg.org. The new URL
    is https://codeberg.org/oath-toolkit/oath-toolkit although the
    old GitLab project will continue to be used for pipelines.
    https://gitlab.com/oath-toolkit/oath-toolkit/-/pipelines
  * Various build fixes including updated gnulib files. Gnulib
    files are no longer stored in git version control. As a
    consequence, gnulib is a required build dependency when
    building from git, see CONTRIBUTING.md.
- Update to version 2.6.12
  * Reported by Fabian Vogt (SUSE), and associated with
    CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings,
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    Quoting a writeup in an alternate patch by Matthias Gerstner
    (SUSE): With the addition of the possibility to place a
    usersfile also into a the usersfile= path specification,
    security issues sneaked in. The PAM process usually runs with
    root privileges. The file operations in an unprivileged user’s
    home directory follow symlinks both when reading and creating
    files, allowing for a potential local root exploit, because of
    the fchown() performed on the newly created usersfile.
  * We drop privileges to the user that is being logged into,
    assuming it has the necessary permissions for the usersfile
    belonging in their home directory. This restricts the ability
    for non-root users to affect files beyond their control via
    liboath.
  * liboath: Don’t follow symbolic links for usersfile updates.
    Reported by Fabian Vogt (SUSE), and associated with CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings, see
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    The fix is to open files for writing in exclusive mode (i.e., fail
    if the file exists including if it is a symbolic link).
  * oathtool: Fix test suite on 32-bit big-endian platforms.
  * libpskc: Don’t call deprecated xmlMemoryDump.
  * Various build fixes including updated gnulib files.
- Drop not longer needed patches (fixed upstream):
  * 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  * 42-null_usersfile_okay.patch
- Use %ldconfig_scriptlets macro.</changelog>
</package>
<package pkgid="be0e42f8da291b439c319a80104bbd983f9b2a7b9d825bf23c1b0dc2c64bda85b05c9972d021b1d11babe9811e319cf0c5423fae0908bc2de82d9717112d052d" name="obs-service-post_build_checks_containers" arch="noarch">
  <version epoch="0" ver="1.0" rel="2.4"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1762171200">- empty service that ensures we pull in post-build-checks-containers for brp usage</changelog>
</package>
<package pkgid="f2344292eb6f8ea26e224809e9b5e865f9e51c3fb795b97523312b18fb80225f55fa6fb28da1c9b5285d56491fc12a09cf9e4fd5c814371b4177c1aeeab6f24c" name="obs-service-post_build_checks_containers" arch="src">
  <version epoch="0" ver="1.0" rel="2.4"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1762171200">- empty service that ensures we pull in post-build-checks-containers for brp usage</changelog>
</package>
<package pkgid="288219ea1266a96ccc6c3b049aa69659b006e42337a0b47e07e0dd2268310012fc7e54959e5f5fd1eec0da7868b5a95a6e71480857ce8bfbf3612dcbaeb4053a" name="obs-service-post_build_checks_containers" arch="noarch">
  <version epoch="0" ver="1.0" rel="3.1"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1762171200">- empty service that ensures we pull in post-build-checks-containers for brp usage</changelog>
</package>
<package pkgid="c3ec43df09ce87f3016169c95b4f3db5226eb40615bcf8d5d269633f212d98af3d395d9ec84230632558a767951755ed79ff42470ffffa309f3911c4eb038735" name="obs-service-post_build_checks_containers" arch="src">
  <version epoch="0" ver="1.0" rel="3.1"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1762171200">- empty service that ensures we pull in post-build-checks-containers for brp usage</changelog>
</package>
<package pkgid="d6ed22d3008203f9b9074b53c5cbc2df442e3da45c3892c8c62c439518c9f74838a4bae0c6da5b0cc6d1e29edf298de6fb6319e5e5bd626d753e5b875a0f3d37" name="oci-seccomp-bpf-hook" arch="s390x">
  <version epoch="0" ver="1.2.10" rel="1.49"/>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726056000">- Initialize the building for oci-seccomp-bpf-hook package</changelog>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726228800">- Avoid %{_libexec} because it expands to different directories
  on Tumbleweed and Leap currently</changelog>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726228801">- The package owns the directory /usr/libexec on Leap</changelog>
</package>
<package pkgid="a24250a2e5e7dc9f6131b5e2447d1f55703ce10193d6fe423a12e364a8834f894ac455be69375327aa5d3ce0676a139f54e2e8aa30016a2a71d402ffc875d14e" name="oci-seccomp-bpf-hook" arch="src">
  <version epoch="0" ver="1.2.10" rel="1.49"/>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726056000">- Initialize the building for oci-seccomp-bpf-hook package</changelog>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726228800">- Avoid %{_libexec} because it expands to different directories
  on Tumbleweed and Leap currently</changelog>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726228801">- The package owns the directory /usr/libexec on Leap</changelog>
</package>
<package pkgid="63df11283aab72786f093264d6e198701655c786e55bbfc23403a90074ce7f6cb0abc6cd6846e53634cb30ba2a2088f2ab5254116ca79751d6a1d9bab697e6fc" name="oci-seccomp-bpf-hook-debuginfo" arch="s390x">
  <version epoch="0" ver="1.2.10" rel="1.49"/>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726056000">- Initialize the building for oci-seccomp-bpf-hook package</changelog>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726228800">- Avoid %{_libexec} because it expands to different directories
  on Tumbleweed and Leap currently</changelog>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726228801">- The package owns the directory /usr/libexec on Leap</changelog>
</package>
<package pkgid="f7bf83cbbe83dc83fa79540ed632933499a630e886c54a00c8ba6cf10339d2df6e175582a88692d3811e45040de7286f7bd45aea63a815154680f93653407556" name="oci-seccomp-bpf-hook-debugsource" arch="s390x">
  <version epoch="0" ver="1.2.10" rel="1.49"/>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726056000">- Initialize the building for oci-seccomp-bpf-hook package</changelog>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726228800">- Avoid %{_libexec} because it expands to different directories
  on Tumbleweed and Leap currently</changelog>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726228801">- The package owns the directory /usr/libexec on Leap</changelog>
</package>
<package pkgid="e0809e7a590ac39892ab2f9f1adcb22365275e0f691c9a729138c5e586a7205816a566455e267ad4cbf9bd018a93739dff53ecfdb91351633047ffc268e3d855" name="oci-seccomp-bpf-hook-tests" arch="noarch">
  <version epoch="0" ver="1.2.10" rel="1.49"/>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726056000">- Initialize the building for oci-seccomp-bpf-hook package</changelog>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726228800">- Avoid %{_libexec} because it expands to different directories
  on Tumbleweed and Leap currently</changelog>
  <changelog author="Wei &lt;wei@hardenedlinux.org&gt;" date="1726228801">- The package owns the directory /usr/libexec on Leap</changelog>
</package>
<package pkgid="4f5930ab6f9c93f26562705c15ff8216585e3c3f48f6d664e23f5d35eb48ec1142785e4cdfdbd99d5acd12e80d3b2a9c0ef978c6035474c0dfa501abca58d29b" name="opa" arch="s390x">
  <version epoch="0" ver="1.19.0" rel="52.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145600">- Update to version 1.12.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Support for String Interpolation in the Rego language
  - Faster compilation and runtime
  - Fixes published in the v1.11.1 release
  * String Interpolation (#4733)
  - The Rego language has been extended to support String
    Interpolation, which provides a readable means to compose
    strings containing dynamic values determined at evaluation
    time.
    An interpolated string is composed of a template-string
    containing zero or more template-expressions that evaluates
    to a value at evaluation time.
    The $ character prefix identifies a template-string, and
    template-expressions are declared by being enclosed in
    curly-braces ({, }).
    Additionally, undefined template-expression values don't halt
    evaluation; instead, &lt;undefined&gt; will be injected into the
    generated string.
    package interpolation
    allowed_roles := ["admin", "employee"]
    default role := "guest"
    role := input.role
    deny contains $"User {input.username}'s role was '{role}', but must be one of {allowed_roles}" if {
    not role in allowed_roles
    }
    {
    "deny": [
    "User &lt;undefined&gt;'s role was 'guest', but must be one of [\"admin\", \"employee\"]"
    ],
    }
    String interpolation is a more readable and less error-prone
    substitute for the sprintf built-in function.
    Authored by @johanfylling reported by @anderseknert
    Tip
    Help us out!
    New Rego language features are exciting, and we want to
    maximize their usefulness. If you come across tools and
    integrations in the community where string interpolation
    isn't properly handled, such as syntax highlighting, please
    reach out and let us know.
  * Runtime, SDK, Tooling
  - oracle: Refactor Oracle better support some and every (#8105,
    [#8131], #8138) authored by @charlieegan3
  - plugins/bundle: Prevent ns-level polling by validating
    intervals (#8082) authored by @jjhwan-h
  - plugins/discovery: Initialize plugins before downloading
    (#8071) authored by @jt28828
  - topdown: Introduce sink for context cancellation
  - topdown: Make regex.replace respect cancellation (#8089)
    authored by @srenatus
  - topdown: Make replace and strings.replace_n respect
    cancellation (#8089) authored by @srenatus
  - topdown: Use sink for concat (#8090) authored by @srenatus
  - perf: Avoid extra allocation in sink if no cancel (#8104)
    authored by @anderseknert
  * Compiler, Topdown and Rego
  - ast/compile: Deal with error limit without panic/defer
    (#8087) authored by @srenatus
  - ast/parser: Check if we need to unescape at all (#8135)
    authored by @srenatus
  - perf: Improved visitor implementation (10% faster
    compilation) (#8078) authored by @anderseknert
  - perf: Reduce allocations handling terms (#8116) authored by
    @anderseknert
  - perf: Type-checker performance improvements (#8143) authored
    by @anderseknert
  * Docs, Website, Ecosystem
  - website: Add support for rego string interpolation syntax
    highlighting (#8092) authored by @charlieegan3
  - docs/ocp: Update "concepts" for v0.3.0 (#8117) authored by
    @srenatus
  - website: Show playground errors (#8141) authored by
    @charlieegan3
  - website: Update a number of links to their new location
    (#8100) authored by @charlieegan3
  - docs: Remove link to feedback form (#8101) authored by
    @charlieegan3
  - website: Remove survey bar (#8136) authored by @charlieegan3
  - docs: Update community contacts (#8108) authored by
    @charlieegan3
  * Miscellaneous
  - ast/checks_test: Fix flaky tests (#8111) authored by
    @srenatus
  - benchmarks: Install node v24 (#8122) authored by @srenatus
  - download: Fix when compiling with tag opa_no_oci (#8070)
    authored by @srenatus reported by @mg0083
  - tests: Race in TestStatusUpdateBuffer (#8133) authored by
    @thevilledev
  - workflow: Integrate benchmarks notebook (#8121) authored by
    @srenatus
  - workflows: Skip all tests in benchmarks run (#8086) authored
    by @srenatus
  - Dependency updates; notably:
  - build: Bump golang from 1.25.4 to 1.25.5 (#8107) authored
    by @srenatus
  - build(deps): Bump google.golang.org/grpc from 1.76.0 to
    1.77.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145601">- Update to version 1.12.1:
  This bug fix release reverts a change to regex.replace that
  unintentionally changed its behaviour for anchored regular
  expressions.
  * Revert "topdown: make regex.replace respect cancellation"
    (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 1.12.2:
  This bug fix release address issues found in the new string
  interpolation feature
  * Add (*TemplateString).Copy() method (#8159) authored by
    @anderseknert
  * Fix template string not serialized with escaped { (#8161)
    authored by @anderseknert
  * fix(ast): skip template string vars in ref safety (#8174)
    authored by @thevilledev
  * fix(ast): use original var names in template error (#8180)
    authored by @thevilledev</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768478400">- Update to version 1.12.3:
  This is a bug fix release addressing two issues:
  * Bundle polling is being misconfigured when discovery bundle is
    updated (#8215)
    This is an issue where the polling interval for discovery
    (discovery.polling.min_delay_seconds and
    discovery.polling.max_delay_seconds) were misinterpreted on
    reconfiguration, causing extremely long update intervals.
  * Decision log size buffer buffer_size_limit_bytes misconfigured
    during reconfiguration (#8213)
    This is a regression in the decision log, where the
    decision_logs.reporting.buffer_size_limit_bytes was mistakenly
    assigned the value of
    decision_logs.reporting.upload_size_limit_bytes during
    reconfiguration.
    This issue is only present when
    decision_logs.reporting.buffer_type is set to size, which is
    the default value.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769774400">- Update to version 1.13.1:
  This bug fix release addresses an issue found in the new
  array.flatten built-in function
  - Fix issue in array.flatten handling of single item arrays
    (#8273) (#8272) authored by @anderseknert
- Update to version 1.13.0:
  This release contains a mix of new features, performance
  improvements, and bugfixes. Notably:
  - A new immediate upload trigger mode in the Decision Logger
  - A new array.flatten built-in function
  - Numerous performance improvements
  * Immediate Upload Trigger Mode in Decision Logger (#8110)
  - An immediate trigger mode has been added to the Decision
    Logger; enabled by setting the
    decision_logs.reporting.trigger configuration option to
    immediate.
    When enabled, log events are pushed to the log service as
    soon as the configured upload chunk size criteria is met; or,
    at latest, when the configured upload delay is reached.
  * Runtime, SDK, Tooling
  - cmd/fmt: Do not overwrite file on fmt without changes (#8222)
    authored by @Loic-R
  - cmd/test: Enable sorting JSON test results by duration
    (#7444) authored by @sspaink
  - profiler: nil *Profiler should not report Enabled() (#8256)
    authored by @anderseknert
  - rego: Add Data function to simplify adding data from map
    (#5961) authored by @majiayu000 reported by @anderseknert
  - runtime: Correct naming &amp; docs for version checking (#8191)
    authored by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Body.String() doesn't panic on empty body (#8244)
    authored by @srenatus
  - ast: Improve type error message when referencing functions
    (#6840) authored by @sspaink
  - ast: Type Checker recognizes when a variable has multiple
    assignments but is an undefined function (#7463) authored by
    @sspaink reported by @anderseknert
  - ast/parser: Avoid duplicate loc copies (#8142) authored by
    @srenatus
  - topdown: Add array.flatten built-in function (#8226) authored
    by @anderseknert
  - topdown: Fix issue where numbers.range_step built-in could
    erroneously return undefined value (#8194) authored by
    @thevilledev
  - topdown: Remove hard-coded missing key error in
    strings.render_template built-in (#7931) authored by
    @colinjlacy reported by @anderseknert
  - topdown: Re-introduce cancellation-awareness for
    regex.replace built-in (#8179) authored by @srenatus
  - from having been reverted in v1.12.1
  - topdown: Support arrays as input for json.match_schema
    (#6615) authored by @sspaink reported by @mscudlik
  * Performance
  - ast: Improved annotations parsing (#8210) authored by
    @anderseknert
  - ast: Reinstate zero-alloc paths in Ref.String() (#8202)
    authored by @anderseknert
  - ast: Replace regex implementation in IsVarCompatibleString
    (#8164) authored by @anderseknert
  - ast: Optimize Set.Intersect and Set.Diff (#8167) authored by
    @thevilledev
  - ast: Optimize Set.Union (#8172) authored by @thevilledev
  - ast: Reduce allocations in Expr.MarshalJSON (#8204) authored
    by @thevilledev
  - ast: Reduce allocations in Rule.MarshalJSON (#8205) authored
    by @thevilledev
  - ast: Reduce allocations in Term.MarshalJSON (#8200) authored
    by @thevilledev
  - ast: Reduce allocations in With.MarshalJSON (#8206) authored
    by @thevilledev
  - perf: String() implementations using appenders (#8192)
    authored by @anderseknert
  - topdown: Avoid redundancy in builtinTrim (#8237) authored by
    @thevilledev
  - topdown: Eliminate closure allocations in Set and virtual doc
    enumeration (#8242) authored by @alex60217101990
  - topdown: Fast paths for array.reverse (#8177) authored by
    @thevilledev
  - topdown: Optimize json.remove and json.filter (#8193)
    authored by @thevilledev
  - topdown: Optimize object built-ins (#8175) authored by
    @thevilledev
  - topdown: Optimize union built-in (#8173) authored by
    @thevilledev
  - topdown: Pre-alloc in various built-ins (#8198) authored by
    @thevilledev
  - topdown: Reduce allocs in float sum/product (#8235) authored
    by @thevilledev
  - topdown: Skip set copy in getObjectKeysParam (#8176) authored
    by @thevilledev
  * Docs, Website, Ecosystem
  - docs: Add authz-spring-boot-starter to Spring Security API
    ecosystem entry (#8234) authored by @francois-eckert
  - docs: Add header for crypto example to make (#8259) authored
    by @charlieegan3
  - docs: Add notes for automated agents (#8147, #8203) authored
    by @charlieegan3
  - docs: Add opa-wasm-zig to the ecosystem (#8163) authored by
    @burdzwastaken
  - docs: Add scripts to import docs from source (#8148) authored
    by @charlieegan3
  - docs: Explain how to use the SDK without a initialising a
    server (#8248) authored by @andrewcameronsims
  - docs: Fix a number of redirecting links (#8165 authored by
    @charlieegan3
  - docs: Fix template-expression examples (#8199) authored by
    @johanfylling
  - docs/ocp: Mention source prefix/path options (#8238) authored
    by @srenatus
  - website: Add redirect section for immutable referrers (#8262)
    authored by @charlieegan3 reported by @KraLeoD
  - website: Display 2025 survey results on the website (#8258)
    authored by @charlieegan3
  - website: Show breadcrumbs in search results (#8207) authored
    by @charlieegan3
  * Miscellaneous
  - Decoupled the Rego job check from the Go job checks in the
    Github PR workflow (#8203) authored by @SeanLedford
  - build: Format pr_check.rego with opa fmt (#8201) authored by
    @thevilledev
  - build: Migrate PR check to OPA policy (#8183) authored by
    @SeanLedford
  - build: Run go get against main to spot redacted (#8146)
    authored by @charlieegan3
  - deps: Switch to maintained go.yaml.in/yaml/v3 yaml library
    (#8182) authored by @mrueg
  - test/cases: Increase yaml test coverage for some regex and
    string builtins (#8152) authored by @srenatus
  - Dependency updates; notably:
  - build: bump golang from 1.25.5 to 1.25.6 (#8224) authored
    by @srenatus
  - build(deps): bump go.opentelemetry.io deps from
    1.38.0/0.63.0 to 1.39.0/0.64.0
  - build(deps): bump klauspost/compress from v1.18.1 to
    v1.18.2 (#8184) authored by @srenatus
  - because of redaction warning
  - build(deps): bump github.com/go-ini/ini from v1.67.0 to
    gopkg.in/ini.v1 v1.67.1 (#8208) authored by @gabrpt</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1771416000">- Update to version 1.13.2:
  This release updates the version of Go used to build the OPA
  binaries and images to 1.25.7.
  That version of the Go standard library contains a fix for
  GO-2026-4337.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772193600">- Update to version 1.14.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Improved rule indexing of variable assignments and x in {...}
    expressions
  - Support for --h2c with unix domain socket for opa run
  - A new glossary tooltip for technical terms in the docs
  - Fixes published in the v1.13.1 and v1.13.2 releases
  * Improved rule indexing of variable assignments and x in {...}
    expressions (#1841)
    With this change, the rule indexer will index expressions like:
    allow if input.role in {"admin", "user"}
    On lookup, the rule body will only be returned if input.role is
    either one of "admin" or "user".
    The reverse case is also indexed:
    allow if "admin" in input.roles
    in which the searched collection is unknown.
  * Runtime, SDK, Tooling
  - cmd,run: Support --h2c with unix domain socket (UDS) (#8282)
    authored by @srenatus reported by @theJC
  - cmd,tester: Add line number next to test file in pretty
    format (#8328) authored by @sspaink reported by @anderseknert
  - plugins: Fix race accessing registeredTriggers (#8363)
    reported and authored by @szuecs
  - rego: Add ResultValue[T]() helper method (#8320) authored by
    @srenatus
  - runtime: Add custom storage backend registration API (#8277)
    authored and reported by @alex60217101990
  - topdown: Add config option to disable named inter-query
    built-in cache (#7519) authored by @sspaink reported by
    @johanfylling
  * Compiler, Topdown and Rego
  - ast: Add index else == nil test, fix it (#8348) authored by
    @srenatus
  - ast: Add scaffolding to introspect and skip compiler stages
    (#8304) (authored by @srenatus)
  - ast: Ensure term values implement ast.StringLengther (#8374)
    authored by @charlieegan3
  - ast: Fix double-fix for refs["with-a"].dash as package
    (#8286) authored by @srenatus
  - ast: Optimized template-expression handling of values known
    to be defined (#8310) authored by @anderseknert
  - ast: Put rule indices into rule tree, change Values to
    []*Rule (#8298) authored by @srenatus
  - ast: Replace true expr when appending to empty body (#8299)
    authored by @anderseknert
  - ast: Return correct location of unsafe var in object (#7935)
    authored by @sspaink reported by @anderseknert
  - ast: Use StageID in WithStageAfterID, also for QueryCompiler
    (follow-up) (#8306) authored by @srenatus
  - compile: Add StringLength to lazy object (#8369) authored by
    @charlieegan3 reported by @robmyersrobmyers
  - parser: Add test to verify filename interning in Location
    (#8322) authored by @anderseknert
  - perf: Allocate less in array unification (#8351) authored by
    @anderseknert
  - perf: Various minor eval performance tweaks (#8290) authored
    by @anderseknert
  - perf: json.patch + interning improvements (#8289) authored by
    @anderseknert
  - topdown: Optimize bindings allocation with dynamic pre-sizing
    (#7266) authored by @alex60217101990
  - topdown: Preserve original package name with special
    characters in optimized builds (#8284) authored by @sspaink
    reported by @at50989
  - wasm: Updates (LLVM+tools) (#8295) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs: Add examples to glob.match built-in documentation
    (#8252) authored by @sibasispadhi reported by @anderseknert
  - docs: Add workflow to auto update Regal docs (#8318) authored
    by @charlieegan3
  - docs: Document metrics for http.send, regex, and glob
    built-ins (#6730) authored by @anivar reported by @rudrakhp
  - docs: Fix json.patch target description (#8271) authored by
    @anderseknert
  - docs: Update broken links (#8285) authored by @charlieegan3
  - docs: Update bundle signing docs to clarify key config
    (#8307) authored by @charlieegan3
  - docs: Update faulty example using bundle optimize (#5379)
    authored by @sspaink reported by @bluebrown
  - docs: Update interface{} -&gt; any in golang snippets (#8373)
    authored by @srenatus
  - docs/website: Add a new KubeCon event page (#8311) authored
    by @charlieegan3
  - docs/website: Add formatting and linting checks (#8288)
    authored by @charlieegan3
  - docs/website: Allow Regal import to use local dir (#8312)
    authored by @charlieegan3
  - docs/website: Implement new GlossaryTooltip component (#8367)
    authored by @charlieegan3
  - docs/website: Markdown linting and spell checking for
    documentation (#8292) authored by @charlieegan3
  - docs/website: Redirect /docs/latest/ecosystem (#8315)
    authored by @charlieegan3 reported by @tweekSun1
  * Miscellaneous
  - maintainers: Moving nilekhc to emeritus, and renew maintainer
    terms (#8276) authored by @JaydipGabani
  - ast: Add public method to extend the compliance test cases
    with IR plans (#7556) authored by @sspaink reported by
    @shomron
  - ast: Tiny nitpicky cleanup (#8309) authored by @srenatus
  - chore: Clean up bundle storage tests (#8267) authored by
    @anderseknert
  - chore: Remove unnecessary comment from bundle JWT
    verification impl (#8354) authored by @johanfylling
  - ci: Bump golangci-lint (v2.9.0), fix issues (#8314) authored
    by @srenatus
  - ci: Harden and update all GH Actions workflows (#8356, #8377,
    [#8368] authored by @philipaconrad and @srenatus
  - go: Cleanup old build flags (#8314) authored by @srenatus
  - rego: Remove superfluous package import of plugins (#6754)
    authored by @srenatus reported by @oxisto
  - tests: Extract runtime Info to new package (#8362) authored
    by @charlieegan3
  - tests: Fix BenchmarkFunctionArgumentCounts query (#8327)
    authored by @alex60217101990
  - tests: Disable rule indexing for benchmark (#8375) authored
    by @srenatus
  - workflows: Add nightly vuln checks for released
    versions/images (#8336 #8339) authored by @srenatus
  - Dependency updates; notably:
  - build: bump golang from 1.25.6 to 1.26.0
  - build(deps): build(deps): bump go.opentelemetry.io deps
    from 1.39.0/0.64.0 to 1.40.0/0.65.0
  - Applying fix for GHSA-9h8m-3fm2-qjrq
  - build(deps): bump github.com/dgraph-io/badger/v4 from 4.9.0
    to 4.9.1
  - build(deps): bump github.com/huandu/go-sqlbuilder from
    1.39.0 to 1.39.1
  - build(deps): bump golang.org/x/net from 0.49.0 to 0.50.0
  - build(deps): bump golang.org/x/text from 0.33.0 to 0.34.0
  - build(deps): bump google.golang.org/grpc from 1.78.0 to
    1.79.1
  - build(deps): bump go.opentelemetry.io deps from
    1.39.0/0.64.0 to 1.40.0/0.65.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773057600">- Update to version 1.14.1:
  This is a patch release collecting two bug fixes and various
  dependency updates for Golang standard library and common package
  vulnerabilities.
  These bug fixes include a revert of the rule indexer tweaks
  shipped in 1.14.0, which had caused unexpected lookup failures
  for some users. (We expect to properly fix the issue in 1.15.0,
  but for now, a revert is the quicker choice.)
  * Changes
  - Fix intermittent plugins manager deadlock on opa.configure
    (#8407)
  - Revert "ast: make rule index track var assignments and x in
    {...} (#8341)" (#8410)
  - build: bump deps (go.mod from main)
  - build: bump go 1.26.1 (#8409)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774612800">- Update to version 1.15.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Add logger plugin interface and file logger implementation
    with log rotation
  - Custom HTTPAuthPlugin behavior change, all per-request
    authentication logic must be moved from NewClient() to
    Prepare()
  - AWS signing supports for web identity for assume role
    credentials
  * Logger Plugin Support (#8434) (authored by @srenatus)
    OPA now supports pluggable logging implementations via the
    logger plugin interface, which is based on Go's standard
    log/slog.Handler interface. This allows any slog.Handler
    implementation to be used as a logger plugin. Loggers can be
    configured via the server.logger_plugin configuration option
    and used for both runtime logging and decision logs. OPA
    includes a built-in file logger plugin (file_logger) that
    writes structured JSON logs with rotation support using
    lumberjack. Users can also implement and register custom logger
    plugins when building OPA.
    Example configuration for server logging:
    server:
    logger_plugin: file_logger
    plugins:
    file_logger:
    path: /var/log/opa/server.log
    max_size_mb: 100
    max_age_days: 28
    max_backups: 3
    compress: true
    level: info
    Example configuration for decision logs using the same plugin:
    server:
    logger_plugin: file_logger
    decision_logs:
    plugin: file_logger
    plugins:
    file_logger:
    path: /var/log/opa/server.log
    max_size_mb: 100
    max_age_days: 28
    max_backups: 3
    compress: true
    level: info
  * Custom HTTPAuthPlugin behavior change (#8376) (authored by @srenatus)
    The HTTPAuthPlugin.NewClient() method is now called once per
    Client instance and cached rather than being called for every
    request. Custom plugins that performed per-request operations
    in NewClient() (such as request counters, per-request transport
    wrapping, or logging/metrics side effects) will now only
    execute those operations once. All per-request authentication
    logic must be moved from NewClient() to Prepare(). All plugins
    included in OPA have been updated and are unaffected by this
    change.
  * Runtime, SDK, Tooling
  - plugins/logger: Add logger plugin interface and file logger
    implementation with log rotation (#8434) (authored by
    @srenatus)
  - plugins/logs: Decision logs can now use logger plugins for
    output (#8434) (authored by @srenatus)
  - logging: Add BufferedLogger to capture early startup logs
    before plugins are initialized (#8434) (authored by
    @srenatus)
  - plugins/rest: Configurable re-read interval for TLS client
    certificates via cert_reread_interval_seconds field.
    Defaults to re-reading on every request for backwards
    compatibility.  The implementation also uses content hashing
    to detect changes and avoid re-parsing unchanged TLS
    certificates and keys. (#8376) (authored by @srenatus)
  - plugins/rest: All TLS configurations now inherit the minimum
    version and TLS ciphersuites as configured for the server.
    (#8376) (authored by @srenatus)
  - internal/providers/aws: Refactor deprecated crypto/elliptic
    APIs to crypto/ecdh (#8395) (authored by @kanywst)
    plugins/rest: AWS Signing - Allow Service Account (Web
    Identity) credentials for Assume Role Credentials (#8386) (
    authored by @tiagogviegas)
  * Compiler, Topdown and Rego
  - ast: fix overlapping array and scalar pattern in rule index
    (authored by @srenatus)
  * Bundles
  - optimized bundles: filter metadata comments properly ( #8388)
    (#6529) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs(ecosystem): add Kopa ecosystem entry (#8405) (authored
    by @sfreet)
  - docs: Update KubeCon event listing (#8439) (authored by
    @charlieegan3)
  - docs: fix input of partial-evaluation example (#8430)
    (authored by @edobrb)
  - ecosystem: add Big ACL (#8389) (authored by @francois-eckert)
  - Regal v0.39.0 doc updates (#8383) (authored by @anderseknert)
  * Miscellaneous
  - build/generate-extended-cases: Fix testcase loader to use
    json.Number. (#8429) (authored by @philipaconrad)
  - Filter compliance test cases using capabilities file (#8418)
    (authored by @sspaink)
  - Fix intermittent plugins manager deadlock on opa.configure
    (#8407) (authored by @sspaink)
  - Linter configuration cleanup (#8397) (authored by
    @anderseknert)
  - fix nightly.yaml by moving secret to env (#8381) (authored by
    @sspaink)
  - fix release-vulnerability-check.yaml (authored by @sspaink)
  - nightly+release-vuln-check: add links to slack msg payloads
    (authored by @srenatus)
  - Dependency updates; notably:
  - build: bump go 1.26.1 (#8409) (authored by @srenatus)
  - gha: bump trivy-action (authored by @srenatus)
  - build(deps): bump google.golang.org/grpc from 1.79.1 to
    1.79.3 (#8428) (authored by @dependabot[bot])
  - build(deps): bump github.com/vektah/gqlparser/v2 from
    2.5.31 to 2.5.32 (#8399) (authored by @dependabot[bot])
  - build(deps): bump modernc.org/sqlite from 1.45.0 to 1.46.1
    (#8399) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/time from 0.14.0 to 0.15.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump github.com/microsoft/go-mssqldb from
    1.9.6 to 1.9.7(#8412) (authored by @dependabot[bot])</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774872000">- Update to version 1.15.1:
  * Miscellaneous
  - logging: make WithContext() optional (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775736000">- Update to version 1.15.2:
  No changes related to the openSUSE package, only GitHub release
  workflow updates (use go1.26.2)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777550400">- Update to version 1.16.0:
  This release contains a mix of new features, performance
  improvements, and bugfixes. Notably:
  - New uri.parse and uri.is_valid built-in functions
  - Data API Request/Response Metadata
  - Prometheus metrics exported via OTLP
  - Formatter improvements
  NOTE:
  In v1.15.x, OPA was dropping logs for bundle downloads, print()
  calls and other plugin-originated logs.
  Users are advised to update, v1.16.0 fixes this bug in (#8544).
  * New uri.parse and uri.is_valid built-in functions (#8263)
    Two new built-in functions have been added: uri.parse for
    parsing a given URI, and uri.is_valid for verifying the
    structure of a given URI.
  - uri.parse
    Parses a URI and returns an object containing its components
    according to RFC 3986. Empty components are omitted.
    package example
    test_uri if {
    uri.parse("https://example.com:8080/api?q=1#top") == {
    "scheme": "https",
    "hostname": "example.com",
    "port": "8080",
    "path": "/api",
    "raw_path": "/api",
    "raw_query": "q=1",
    "fragment": "top",
    }
    }
  - uri.is_valid
    Returns true if the input can be parsed as a URI, false otherwise.
    package example
    deny contains "invalid URI" if {
    not uri.is_valid("http://[invalid")
    }
  * Data API Request/Response Metadata (#8570)
    Wrapping projects can now attach custom metadata to Data API
    requests and have evaluation produce response metadata.
    Two distinct metadata paths are introduced:
  - Request metadata: parsed from extra top-level keys in the
    request body, made available to builtins via
    BuiltinContext.RequestMetadata. Logged in the decision log
    under Custom["request_metadata"].
  - Response metadata: a separate map
    (BuiltinContext.ResponseMetadata) that builtins can populate
    during evaluation. Only included in the API response and
    decision log if non-empty.
    In vanilla OPA, no builtins write response metadata, so
    responses are unchanged. The request metadata map is only
    allocated when the request carries extra fields; the response
    map is one empty map per request.
    To avoid conflicts with future OPA top-level keys, callers
    should use a namespaced key: {"input": {...},
    "com.example.opa/md": {...}}.
    Request with metadata:
    curl -H 'Content-Type: application/json' \
  - d '{"input": {"user": "alice"}, "com.example.opa/metadata": {"corp-id": "acme-42"}}' \
    http://localhost:8181/v1/data/example/allow
    Response (response metadata included if, for example, set by a
    custom builtin):
    {
    "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
    "result": true,
    "com.example.opa/response": {
    "snapshot_version": "v3"
    }
    }
    Decision log entry:
    {
    "custom": {
    "request_metadata": {
    "com.example.opa/metadata": {
    "corp-id": "acme-42"
    }
    },
    "response_metadata": {
    "com.example.opa/response": {
    "snapshot_version": "v3"
    }
    }
    },
    "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
    "input": { "user": "alice" },
    "msg": "Decision Log",
    "path": "example/allow",
    "result": true
    }
  * Runtime, SDK, Tooling
  - distributedtracing: Export Prometheus metrics via OTLP
    (#7591) reported and authored by @Munken
  - cmd,tester: Update opa test to stream test case results
    (#3676) authored by @sspaink reported by @tsandall
  - cmd,tester: Show full errors when test fails and using
  - -coverage (#8438) authored by @grosser
  - format: Add new line between METADATA blocks (#8483) authored
    by @sspaink
  - format: Allow indenting all withs in expression (#8508)
    authored by @anderseknert
  - format: Fix dropping comments after handling
    unexpectedCommentError (#8553) authored by @sspaink
  - format: Preserve location of trailing comments inside every
    body (#8558) authored by @johanfylling
  - format: Prevent opa fmt from formatting single attribute
    objects with comments (#7565) authored by @sspaink reported
    by @anderseknert
  - logging: Keep forwarding from BufferedLogger after Flush()
    (#8544) authored by @srenatus reported by @annieyhuang
  - plugins/logs: Fix logBuffer eviction loop only dropping one
    element (#8543) authored by @sspaink
  - plugins/logs: Fix out-of-order plugin status notifications
    (#8009) authored by @sspaink reported by @Pushpalanka
  - plugins/rest: Carry over all of *tls.Config (#8473) authored
    by @srenatus reported by @ashu2496
  - server: Drop HTML index page query form (#8477) authored by
    @johanfylling reported by @srenatus and @r0binak
  - server: Skip chmod for abstract Unix domain sockets (#8536)
    authored by @bakayolo
  - storage/inmem: Avoid allocations from Read() in MakeDir()
    (#8561) authored by @srenatus
  - tester: Add method to match tests by ref prefixes (#6696)
    authored by @anderseknert
  - Note: Experimental.
  * Compiler, Topdown and Rego
  - ast: Allow Back-to-back metadata blocks (#8482) authored by
    @sspaink reported by @johanfylling
  - ast: Catch functions in dynamic extent of ref head rule
    (#8461) authored by @srenatus reported by @johanfylling
  - ast: Fix parenthesis in String() of {obj,arr,set}
    comprehensions (#8511) authored by @srenatus
  - ast: Fix parsing of unary - in front of a ref (#5014)
    authored by @mmzzuu reported by @philipaconrad
  - ast: Fix type checker match error for objects with set keys
    (#6260) authored by @sspaink reported by @tsandall
  - ast: Fix type checker to recognize numeric index in generated
    map (#6736) authored by @sspaink reported by @anderseknert
  - ast: Handle underdetermined function args (#5234) authored by
    @sspaink reported by @obataku
  - ast: Identify compatible type from reference in type checker
    (#7273) authored by @sspaink reported by @anderseknert
  - ast: Support recursive JSON Schemas (#6099) authored by
    @sspaink reported by @anderseknert
  - builtins: Add support for days, weeks and years in
    time.parse_duration_ns built-in function (#2719) authored by
    @sspaink reported by @freeseacher
  - builtins: Fix graph.reachable_paths to return all reachable
    paths (#5871) authored by @davidmarne-wf reported by
    @ericjkao
  - builtins: Limit exponent size in units.parse_bytes built-in
    function to prevent timeout bypass (#8326) authored by
    @isaiahvita reported by @anderseknert
  - perf: Add CopyNonGround() methods for Array, Set, and Object
    (#8323) authored by @alex60217101990
  - resolver/wasm: Add NewWithContext to allow passing context
    (#8499) authored by @dominikschulz
  * Docs, Website, Ecosystem
  - docs: Add aggregates examples for count and sum built-in
    functions (#8566) authored by @alliasgher reported by
    @srenatus
  - docs: Add generated output.jsons for docs examples (#8535)
    authored by @charlieegan3
  - docs: Add spec for OCP bundle status tracking API (#8502)
    authored by @ashutosh-narkar
  - docs: Add the latest videos to the README presentations
    section (#8523) authored by @sspaink
  - docs: Add Windows development notes to dev reference guide
    (#8422) authored by @raajheshkannaa
  - docs: Fix input value type in not undefined example (#8580)
    authored by @menma1234
  - docs: Update Regal docs to v0.40.0 (#8538) authored by
    @charlieegan3
  - docs: Updated roadmap link (#8501) authored by @johanfylling
  - docs: Various typo fixes (#8529) authored by @sspaink
  - ecosystem: Add vulnetix ecosystem entry (#8532) authored by
    @0x73746F66
  - ecosystem: Add KubeStellar Console (#8560) authored by
    @clubanderson
  - website: Add banner to show when event has passed (#8493)
    authored by @charlieegan3
  - website: Add copy-as-markdown button to doc pages (#8540)
    authored by @charlieegan3
  - website: Copy button improvements (#8577) authored by
    @charlieegan3
  - website: Remove old redirects, add new management redirect
    (#8424) authored by @charlieegan3 reported by @narainar
  - website: Update intro video on homepage (#8547) authored by
    @charlieegan3
  * Miscellaneous
  - build: Exclude domains that cause false positives (#8533)
    (#8495) authored by @charlieegan3
  - e2e/cli: Add test for debug print() logging (#8567) authored
    by @srenatus
  - e2e/cli: Start CLI E2E tests (#8545) authored by @srenatus
  - github: declare formatted rego as rego (#8564) authored by
    @srenatus
  - Security policy update (#8479) authored by @anderseknert
  - Dependency updates; notably:
  - build: bump go 1.26.2 (#8497) authored by @sspaink
  - build(deps): bump wasmtime-go from v39.0.1 to v43.0.2
  - build(deps): bump go.opentelemetry.io deps from
    1.40.0/0.65.0 to 1.43.0/0.68.0
  - build(deps): bump github.com/containerd/containerd/v2 from
    2.2.1 to 2.2.3
  - build(deps): bump ithub.com/huandu/go-sqlbuilder from
    1.39.1 to 1.40.2
  - build(deps): bump golang.org/x/net from 0.51.0 to 0.53.0
  - build(deps): bump golang.org/x/text from 0.34.0 to 0.36.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777636800">- Update to version 1.16.1:
  This is a patch release addressing a regression in the plugin
  manager that may cause the service to hang on shutdown (#8590).</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.16.2:
  This release updates the version of Go used to build the OPA
  binaries and images to 1.26.3; addressing a number of
  vulnerabilities.
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
  This is CVE-2026-42501 and Go issue https://go.dev/issue/79070
  * build: bump go 1.26.2 -&gt; 1.26.3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 1.17.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - A new future.keywords.not import that adds improved semantics
    to the not keyword.
  - Rule Labels in Decision Logs
  - Published json schema for IR and bundle manifest
  - Dropped automaxprocs and x/net dependencies
  * Improved Negation Semantics (#8387)
    This OPA release introduces a new future.keywords.not import
    that fixes a long-standing semantic issue with negation in
    Rego.
    Without the import, the compiler expands a negated composite
    expression like not f(g(input.x)) into a series of
    sub-expressions evaluated before the not:
    __local0__ = input.x
    g(__local0__, __local1__)
    not f(__local1__)
    If any sub-expression fails — for example, input.x is undefined
    or g produces an undefined result — the entire rule fails
    rather than the not succeeding.  This is unintuitive: the
    user's intent is "the condition does not hold," but an
    undefined intermediate value causes a silent failure instead of
    the expected not result.
    With import future.keywords.not, composite-expression negation
    wraps the full compiler expansion in an implicit body:
    not { __local0__ = input.x; g(__local0__, __local1__); f(__local1__) }
    Now, if any sub-expression is undefined or fails, the body is
    unsatisfiable and the not expression succeeds; matching the
    intuition that "the condition does not hold."
    NOTE:
    Users are recommended to import future.keywords.not whenever
    the not keyword is used in a policy.
  * Rule Labels in Decision Logs (#2089)
    Rule annotations now support a labels field. Labels from all
    successfully evaluated rules are collected and included in each
    decision log entry as a top-level rule_labels array. Each
    element is the merged label map for one successfully evaluated
    rule, with inner-scope-wins precedence across the rule's
    annotation chain (subpackages &lt; package &lt; document &lt; rule).
    Merged maps are deduplicated across rules so that identical
    label sets collapse to a single entry.
    [#] METADATA
    [#] scope: package
    [#] labels:
    [#]   service: authz
    [#]   severity: info
    package myapp
    [#] METADATA
    [#] labels:
    [#]   severity: low
    [#]   team: platform
    allow if input.role == "admin"
    The resulting decision log entry will contain:
    {"rule_labels": [{"service": "authz", "severity": "low", "team": "platform"}]}
    Note how severity: info from the package scope is overridden by
    severity: low from the rule scope. Queries against rule_labels
    can now rely on each entry carrying the full label context for
    a single rule, rather than one entry per contributing scope.
    Both the runtime and the Go SDK now process metadata
    annotations by default.
  * Runtime, SDK, Tooling
  - ast: Allow $ref in allOf in JSON schemas (#6523) authored by
    @deeglaze reported by @mosiac1
  - bundle: Update bundle roots conflict detection algorithm.
    (#8664) authored by @philipaconrad
  - download: Use oras, not containerd (#8639) authored by
    @srenatus
  - server: Remove dead code (s.partials) (#8708) authored by
    @srenatus
  - server: Wire in response/request metadata for compile handler
    (#8650) authored by @srenatus
  - server/types: generalize request/response metadata (#8650)
    authored by @srenatus
  * Compiler, Topdown and Rego
  - builtins: Enable pattern validation in json.verify_schema and
    json.match_schema built-in functions (#6089) authored by
    @sspaink reported by @ewout8
  - ir: Don't capitalize index field in MakeNumberRefStmt IR
    statement (#6266) authored by @sspaink reported by
    @johanfylling
  - perf: Avoid allocating in binary and/or operators when
    possible (#8689) authored by @anderseknert
  - rego: Allow per-eval GenerateJSON function (#8690) authored
    by @anderseknert
  * Docs, Website, Ecosystem
  - ecosystem: add OPA MCP (#8618) authored by @OrygnsCode
  - docs: Add explicit address binding to examples (#8688)
    authored by @charlieegan3
  - docs: Add titles to code blocks in policy-testing (#8649)
    authored by @charlieegan3
  - docs: Correct OCP SSH key docs (#8675) authored by @taurelius
  - docs: Update diagram to match index examples (#8667) authored
    by @charlieegan3
  * Miscellaneous
  - ast,storage/inmem: Add inmem.NewFromASTObject and add missing
    string case to ast.InternedValue (#8707) authored by
    @anderseknert
  - build: go install -&gt; go install tool to control checksums
    (#8646) authored by @srenatus
  - build: Push edge binaries to bucket (#8668) authored by
    @charlieegan3
  - workflows: Fix benchmarks workflow (replace action, avoid
    stackoverflow) (#8655) authored by @srenatus
  - workflows: Note improvements in benchmark comments (#8673)
    authored by @srenatus
  - Generate a JSON Schema for the IR plan (#8662) authored by
    @sspaink reported by @kroekle
  - Generate a JSON Schema for the bundle manifest (#8661)
    authored by @sspaink reported by @kroekle
  - Dependency updates; notably:
  - build(deps): Remove automaxprocs dependency (#8696)
    authored by @anderseknert
  - build(deps): Remove direct x/net dependency (#8697)
    authored by @anderseknert
  - build(deps): Bump github.com/bytecodealliance/wasmtime-go
    from 43.0.2 to 44.0.0 (8652) authored by @srenatus
  - build(deps): Bump github.com/fsnotify/fsnotify from 1.9.0
    to 1.10.1
  - build(deps): Bump github.com/huandu/go-sqlbuilder from
    1.40.2 to 1.41.0
  - build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.0
    to 3.1.1
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    2.5.32 to 2.5.33
  - build(deps): Bump google.golang.org/grpc from 1.80.0 to
    1.81.0
  - build(deps): Bump gopkg.in/ini.v1 from 1.67.1 to 1.67.2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780920000">- Update to version 1.17.1:
  This release uses the latest version of Go (1.26.4) to build OPA,
  fixing stdlib vulnerabilities in code that OPA's HTTP handler and
  crypto builtins use:
  - https://pkg.go.dev/vuln/GO-2026-5039
  - https://pkg.go.dev/vuln/GO-2026-5037
  It is otherwise the same code as v1.17.0.
  * Miscellaneous
  - build: bump go 1.26.3 -&gt; 1.26.4 (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782648000">- Update to version 1.18.0:
  This release contains a mix of bugfixes and small features.
  Notably:
  - A breaking fix to the outbound User-Agent header so it conforms
    to RFC 9110 (see below)
  - Container-aware resource limits: automatic GOMAXPROCS is
    restored and automatic GOMEMLIMIT is now supported
  - Several opa fmt correctness fixes
  - Improvements to opa test --coverage (ranges in report, inline
    rule head tracking, conjunction-expression coverage)
  * Breaking: Fix User-Agent according to RFC9110 (#8792)
  - OPA's outbound HTTP requests (bundle, discovery, decision
    log, status, http.send, AWS KMS/ECR) previously sent
    User-Agent: Open Policy Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;), which
    is not a valid RFC 9110 User-Agent value because the product
    token cannot contain spaces. The header is now
    Open-Policy-Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;). Server-side log
    filters or WAF rules that exact-match the old string will
    need to be updated.
  * Runtime, SDK, Tooling
  - bundle: fix per-module rego version lookup (#8797) authored
    by @sspaink, reported by @xubinzheng
  - bundle: improve determinism of file_rego_versions patterns
    with overlap (#8733) authored by @philipaconrad
  - cover: Track inline rule head in post trace walk (#6531)
    authored by @charlieegan3, reported by @anderseknert
  - cover: Update report to include ranges (#8748) reported and
    authored by @charlieegan3
  - cover: Add support for coverage of conjunction exprs (#8809)
    authored by @charlieegan3
  - download/oci: Set Accept headers (#8720) authored by
    @charlieegan3
  - fmt: preserve the multiline but single entry iterables
    (#8557) authored by @unichronic, reported by @anderseknert
  - format: Fix dropped with-clause after comment in object value
    (#8765) authored by @sspaink, reported by @srabraham
  - format: keep lone with on the closing-bracket line of
    multi-line expressions (#8804) authored by @anneheartrecord,
    reported by @burnster
  - oracle: Fix find-definition on expressions inside ast.Not
    nodes (#8731) authored by @johanfylling
  - runtime: Restore goautomaxprocs, add automemlimit (#8784)
    authored by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Apply location to inner ast.Not expressions (#8717)
    authored by @johanfylling, reported by @anderseknert
  - ast: Clean up code for value comparisons (#8737) authored by
    @anderseknert
  - ast: Fix PE regression for future.keywords.not negation
    inside every (#8781) authored by @johanfylling
  - internal/edittree: Add recursive tree node recycling (#8693)
    authored by @philipaconrad
  - internal: compile,planner: improve determinism of plan/wasm
    bundle builds (#8732) authored by @philipaconrad
  - perf: avoid allocations in object.get (#8729) authored by
    @anderseknert
  - topdown: Fix PE not namespacing vars in comprehensions nested
    inside every (#8816) authored by @johanfylling
  - topdown: remove dst.Compare(src) shortcut (#8739) authored by
    @srenatus
  - topdown: skip strconv.ParseInt in format_int base-10 fast
    path (#8801) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs/chore: Remove broken links (#8714) authored by
    @charlieegan3, reported by @github-actions
  - docs: PoC for kapa.ai (#8125) reported and authored by
    @charlieegan3
  - docs(ecosystem): update OPA MCP entry with video, blog, and
    distribution links (#8712) authored by @OrygnsCode
  - docs/contributing: add formatting (#8740) authored by @mmzzuu
  - docs: Add SDK references for evaluating IR plans (#8783)
    authored by @charlieegan3
  - docs: Add depkeep to enterprise support (#8685) authored by
    @pkuzco
  - docs: Add notes about use of GOMEMLIMIT (#8771) authored by
    @charlieegan3
  - docs: Add we/our/us check to spell check (#8787) authored by
    @charlieegan3
  - docs: Update built-in index page titles (#8728) authored by
    @charlieegan3
  - docs: Update documentation to be more consistent and sound
    more like reference docs (#8786) authored by @charlieegan3
  - docs: Update regal docs for 0.41.1 release (#8730) authored
    by @charlieegan3
  - docs: Update to agents.md regarding security dependences
    'fixes' (#8754) authored by @charlieegan3
  - docs: clarify environment variable substitution behaviour
    (#8713) authored by @taurelius
  - docs: remove duplicated word in Rego style guide (#8800)
    authored by @s3onghyun
  - website: Add .md alternate content types for llms (#8725)
    authored by @charlieegan3
  - website: Add support page disclaimer and sort by date added
    (#8736) authored by @charlieegan3
  - website: Fix build from missing dateAdded (#8764) authored by
    @charlieegan3
  - website: Update docusaurus (#8756) authored by @charlieegan3
  - website: Update homepage AI example to tool calls (#8755)
    authored by @charlieegan3
  - website: Various updates to node and website deps (#8768)
    authored by @charlieegan3
  - website: add ossrisk to ecosystem (#8780) authored by @pkuzco
  * Miscellaneous
  - benchmarks: smaller tweaks (#8759) authored by @srenatus
  - benchmarks: split off script, emit markdown table (#8812)
    authored by @srenatus
  - benchmarks: use details+summary comments for benchlab results
    (#8811) authored by @srenatus
  - capabilities: Integrate 1.17.1 patch release (#8798) authored
    by @sspaink
  - chore: tidy go.mod to remove untagged versions (#8791)
    authored by @thaJeztah
  - e2e: Add proto schemas for the IR plan and bundle manifest
    (#8766) reported and authored by @sspaink
  - gha: deduplicate change-detection output in pr CI checks
    (#8808) authored by @sspaink
  - nightly: use regal@main (#8735) authored by @srenatus
  - workflow: remove tests from docker (edge) image build (#8721)
    authored by @srenatus
  - workflows: bring back docker edge tags for post-merge (#8718)
    authored by @srenatus
  - workflows: use go-version-file with actions/setup-go (#8751)
    authored by @srenatus
  - Dependency updates; notably:
  - build(deps): Add github.com/KimMachineGun/automemlimit
    v0.7.5
  - build(deps): Add go.uber.org/automaxprocs v1.6.0
  - build(deps): Bump github.com/dgraph-io/badger/v4 from
    v4.9.1 to v4.9.2
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    v2.5.33 to v2.5.34
  - build(deps): Bump
    go.opentelemetry.io/contrib/bridges/prometheus from v0.68.0
    to v0.69.0
  - build(deps): Bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
    from v0.68.0 to v0.69.0
  - build(deps): Bump go.opentelemetry.io/otel from v1.43.0 to
    v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace from
    v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
    from v1.43.0 to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/sdk from v1.43.0
    to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/sdk/metric from
    v1.43.0 to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/trace from
    v1.43.0 to v1.44.0
  - build(deps): Bump golang.org/x/sync from v0.20.0 to v0.21.0
  - build(deps): Bump golang.org/x/text from v0.37.0 to v0.38.0
  - build(deps): Bump google.golang.org/grpc from v1.81.0 to
    v1.81.1
  - build(deps): Bump gopkg.in/ini.v1 from v1.67.2 to v1.67.3
  - build(deps): Bump oras.land/oras-go/v2 from v2.6.0 to
    v2.6.1
  - build(deps): bump golang.org/x/crypto to v0.52.0 and
    golang.org/x/net to v0.55.0 (#8745) authored by @BGebken
  - build: bump go 1.26.3 -&gt; 1.26.4 (#8726) authored by
    @srenatus</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782907200">- Update to version 1.18.1:
  This release fixes a memory leak introduced in OPA v1.17.0. It is
  advised to update if you notice excess memory usage when running
  OPA server.
  * Fixes
  - ast: fix AnnotationSet memory leak via runtime.AddCleanup
    cycle (#8817) authored by @srenatus reported by @keydon and
    @gorsr01</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782993600">- Update to version 1.18.2:
  This release includes a bug fix for a opa fmt regression
  introduced in v1.18.0.
  The original fix for #8557 had the formatter enforce newlines in
  single-item collections (arrays, objects, sets) rather than
  merely honoring existing ones. As a result, running opa fmt on
  already-formatted policies could introduce a large number of
  unwanted changes. This patch release restores the intended
  behavior: only newlines already present in the source determine
  whether a single-item collection is formatted on one line or
  across multiple lines.
  * Fixes
  - Fix regression in fix of #8557 (#8845) (authored by
    @anderseknert)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1785499200">- Update to version 1.19.0:
  * This release contains a mix of new features and bug fixes.
    Notably:
  - A fixed SQL injection vector in the Compile API
  - Stricter safety checking for Rego assignments (:=)
  - A cgo-free, faster WebAssembly runtime (wazero replaces
    wasmtime-go)
  - Startup warnings for unknown configuration options
  - A new strings.split_n built-in function
  - A REPL line reader that handles pasted input correctly,
    migrating existing history files
  * Fix SQL injection vector in Compile API: Quote SQL filter field
    identifiers (#8945)
  - The field names in the SQL emitted by the Compile API come
    from partially evaluated refs, so a policy that selects a
    dynamic key — such as input.fruits[input.column] — puts
    caller-controlled text in an identifier position. That text
    was emitted verbatim, which turns
    WHERE fruit.name = 'allowed'
    into
    WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'
    and an application appending the filter to its query returns
    rows the policy denies.
    Field segments that are not bare identifiers are now quoted
    at the UCAST-to-SQL boundary, with any embedded quote
    character escaped. Ordinary column names stay unquoted, so
    existing filters keep their current shape and remain
    case-insensitive on Postgres.
  * Behavior change: stricter safety for assignment (:=) (#3546)
  - The assignment operator (:=) is documented as "syntactic
    sugar for =, local variable creation, and additional compiler
    checks," and the safety checker reflects that: after
    rewriting, := is treated identically to = (unification), so
    an assignment's right-hand side can be made safe by unifying
    "backwards" through the left-hand side. This means policies
    like x := y; x = 7 compile (binding y to 7) even though y is
    never assigned, and x := y; obj[x] can silently degrade an
    expected constant-time lookup into full iteration.
    This change makes the right-hand-side of := be treated as a
    read that must be made safe by other expressions, and can no
    longer be satisfied through the left-hand-side. Affected
    policies that previously compiled now fail with a
    rego_unsafe_var_error. Reference iteration on the
    right-hand-side (e.g.  some k; v := obj[k]) is unaffected.
    Note: this is a deliberate semantic change, not a fix to
    match documented behavior — the intended semantics of := in
    this case were never specified.
  - WebAssembly runtime: wasmtime-go replaced with wazero (#7557)
    OPA's WebAssembly runtime — used by the wasm evaluation
    target and the WASM SDK — now runs on the pure-Go wazero
    runtime instead of bytecodealliance/wasmtime-go. This removes
    the cgo dependency from this path, so wasm-enabled builds no
    longer need a C toolchain.
    Compiled policy modules are now cached process-wide, so
    repeated VM creation for the same policy skips recompilation.
    On an Apple M4 Max this makes wasm cold start (compile +
    instantiate + first eval) about 73% faster, and warm
    evaluation about 29% faster with ~28% fewer allocations.
  - Configuration validation moved to Rego, with warnings on
    unknown options (#8891)
    Top-level configuration validation and default injection
    (default_decision, default_authorization_decision, labels) is
    now expressed as an embedded Rego policy rather than
    hand-written Go, as is the validation of server.metrics and
    metrics_export.
    The user-visible effect is that unrecognized configuration
    options are reported instead of being silently ignored. A
    typo such as decision_log instead of decision_logs now logs a
    warning at startup:
    {"level":"warning","msg":"unknown configuration option \"decision_log\" encountered"}
    These are warnings, not errors: OPA starts as before, and
    sections that are intentionally user-extensible are left
    alone, so extra keys there do not warn. Embedders reading
    configuration through config.ParseConfig can find the same
    messages on Config.Warnings.
  - Add strings.split_n built-in function (#8344)
    Policies often need only the first or last few parts of a
    split string, but the existing split built-in always returns
    every part, so the count has to be worked around with
    wildcards or a slice.
    strings.split_n takes the first n split parts from the front
    or the back of the string, depending on whether n is positive
    or negative:
    result := strings.split_n("a.b.c.d", ".", 2)
    [#] result == ["a", "b"]
    result := strings.split_n("a.b.c.d", ".", -2)
    [#] result == ["c", "d"]
    If abs(n) is larger than the number of parts, all parts are
    returned. An n of 0 returns an empty array.
  - Improved REPL line editing, with history file migration
    (#962)
    Pasting a tab-indented snippet into the REPL triggered
    tab-completion on the pasted tab, corrupting the input (e.g.
    injecting a completion candidate mid-line and producing a
    spurious parse error).  Fixing that requires bracketed paste,
    where the terminal wraps pasted text in markers so the line
    reader inserts it literally instead of treating an embedded
    tab as a completion request. The previous reader,
    peterh/liner, has no bracketed-paste support and is
    unmaintained (last release 2021), so it has been replaced
    with reeflective/readline.
    The new reader persists history as JSON lines instead of one
    command per line. Existing history files (~/.opa_history by
    default, or the path given to --history) are detected and
    migrated in place the first time the REPL loads them, so
    history written by earlier versions of OPA is kept.  OPA's
    own multi-line buffering is unchanged, and readline's native
    multi-line editing is left disabled to avoid changing REPL
    behavior.
  * Runtime, SDK, Tooling
  - cmd: Avoid intermediate buffer when writing bundle (#8909)
    authored by @anderseknert
  - cmd/build: Add --format flag for proto/JSON plan bundles to
    opa build (#8825) authored by @sspaink
  - cmd/check: Report wrapped structured errors individually
    (#3663) authored by @sspaink, reported by @oren-zohar
  - compile: Preserve package annotations in wasm bundle builds
    (#8854) authored by @srenatus, reported by @me-viper
  - format: Keep rule body inline when the head spans multiple
    lines (#8894) authored by @Kunalbehbud, reported by
    @charlieegan3
  - repl: Use a plain line reader for non-terminal input (#8941)
    authored by @sspaink
  - server: Set ReadHeaderTimeout to 32s on all HTTP servers
    (#8877) authored by @RinZ27
  - server/failtracer: Skip self-referential undefined-ref hints
    (#8916) authored by @srenatus
  - sdk: Allow customizing HTTP RoundTripper per Decision (#8884)
    authored by @paulo-raca
  - sdk: Fix deadlock between OPA.Plugin and manager onCommit
    (#8873) reported and authored by @sspaink
  - tester: Make Result JSON round-trippable (#8014) authored by
    @vsolano9, reported by @anderseknert
  - topdown: Resolve ground refs in --var-values cmd output
    (#7830) authored by @sspaink, reported by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Add support for Go 1.27 &amp; jsonv2 (#8947) authored by
    @anderseknert and @charlieegan3
  - ast: Fix aliased comment buffer in annotation parser (#8757)
    authored by @sspaink, reported by @0hardik1
  - ast: Fix non-deterministic type errors when shadowing a
    built-in (#3729) authored by @sspaink, reported by @srenatus
  - ast: Fix leaky future.keywords.not import in Rego v0 (#8953)
    authored by @johanfylling
  - ast: Fix panic when indexing composite literal values in x in
    [...] (#8918) reported and authored by @srenatus
  - ast: Fix TermValueEqual performance regression (#8863)
    authored by @mchitten
  - ast: Improve rule conflict error (#6391) authored by
    @unichronic, reported by @johanfylling
  - ast: Make CogeneratedExprs return deterministic order (#8895)
    authored by @sspaink
  - ast: Reject partial set and -object rules sharing a name
    (#8860) authored by @sspaink, reported by @shomron
  - ast: Restore location on unsafe var errors for rewritten head
    vars (#8719) authored by @Atishyy27, reported by
    @anderseknert
  - ast: Use more precise return types for object.* builtins
    (#8692) reported and authored by @anderseknert
  - ast+topdown: Let rule external sources distinguish absent
    from unknown (#8878) authored by @srenatus
  - ast+topdown: Parametrized (prefix) external rule sources
    (#8881) authored by @srenatus
  - topdown: Fix "a", "a" in {"a"} not returning true (#8747)
    authored by @anderseknert
  - topdown: Fix format_int precision loss for integers larger
    than 64 bits (#8857) authored by @Synvoya
  - topdown: Fix precision loss for integers larger than 64 bits
    in arithmetic and aggregates (#6281) authored by @Atishyy27,
    reported by @tsandall
  - topdown: Don't leak internal vars in Partial-Evaluation
    results (#6378) authored by @sspaink, reported by @nkey0
  - topdown/copypropagation: Avoid circular reference in
    Partial-Evaluation through call (#6428) authored by @sspaink,
    reported by @nkey0
  - topdown+util: Add generic SliceStack/GroupStack, unify
    refStack/functionMocksStack/saveStack (#8886) authored by
    @srenatus
  - topdown+util: Replace hand-rolled evalFunc/evalBuiltin pools
    with generic ResettablePool (#8886) authored by @srenatus
  - perf: Avoid allocations with custom Atoi and Atoi64 helpers
    (#8758) authored by @anderseknert
  - perf: Lazy init of scalars map in indexer (#8936) authored by
    @anderseknert
  - perf: Reduce allocations in index lookup (#8835) authored by
    @anderseknert
  - planner: Avoid redundant ruletrie.Children() call in Depth()
    (#8886) authored by @srenatus
  - planner: Unify functionMocksStack on generic GroupStack[T]
    (#8886) authored by @srenatus
  * Docs, Website, Ecosystem
  - ecosystem: Add agt-policies-africa — African data protection
    OPA policy pack (#8850) authored by @kingztech2019
  - ecosystem: Add Ghostunnel and NATS Plugin to Ecosystem
    (#8871) authored by @charlieegan3
  - ecosystem: Add Sencillo projects to ecosystem (#8818)
    authored by @hooksie1
  - docs: Add kubecon NA page (#8876) authored by @charlieegan3
  - docs: Add recommendations to follow Envoy's best practices
    (#8944) authored by @johanfylling
  - docs: Document rule indexer support for in, bare refs;
    modernize rego (#8822) authored by @srenatus, reported by
    @tsandall
  - docs: Document the compile metadata annotation (#8824)
    authored by @youdie006, reported by @anderseknert
  - docs: Fix broken OAuth2/OIDC policy examples (#8840) authored
    by @mailnike
  - docs: Fix decision_logs buffer_size_limit_events default in
    prose (#8866) authored by @s3onghyun
  - docs: Remove import rego.v1 (#8867) authored by @charlieegan3
  - docs: Some minor bug fixes to improve reporting (#8917)
    authored by @charlieegan3
  - docs: The Zed Rego extension link points at
    github.com/StyraInc/zed-rego (404). The repo now lives at
    github.com/StyraOSS/zed-rego. (#8883) authored by @mailnike
  - docs: Update cheatsheet files (#8868) authored by
    @charlieegan3
  - docs: Update regal and blog links (#8901) authored by
    @charlieegan3
  - docs: Updates examples to use some...in, add link to debugger
    (#8806) authored by @charlieegan3
  - website: Improve partial evaluation / data filtering
    documentation (#8625) authored by @mmzzuu
  - website: Import blog from medium (#8898) authored by
    @charlieegan3
  * Miscellaneous
  - ast: Add benchmark for rule index ref ordering (#8943)
    authored by @srenatus
  - ast: Various style fixes (#8938) authored by @anderseknert
  - build: Add Dockerfile.rego to validate image builds (#8401)
    authored by @jasdeepbhalla, reported by @anderseknert
  - build: Get just the needed commits for CI (#8940) authored by
    @charlieegan3
  - test: Start decommissioning test.WithTempFS (#8908) authored
    by @anderseknert
  - topdown: Add regression test for partial eval local names
    (#5226) authored by @sspaink, reported by @fab29p
  - topdown: Fix Partial-Evaluation test rejected by new conflict
    check (#8860) authored by @sspaink, reported by @shomron
  - topdown: Vendor a method-less text/template to restore
    whole-binary linker DCE (#7903) authored by @rchildress87,
    reported by @kruskall
  - workflows: Remove cpp from CodeQL language matrix (#8864)
    authored by @sspaink
  - workflows: Prune benchmarks to last 250 runs (#8834) authored
    by @srenatus
  - Dependency updates; notably:
  - build(go): Bump Go from 1.26.4 to 1.26.5 (#8875) authored
    by @srenatus
  - build(deps): Add github.com/reeflective/readline 1.3.0
  - build(deps): Add golang.org/x/term 0.45.0
  - build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.2
    to 4.9.4
  - build(deps): Bump github.com/go-logr/logr from 1.4.3 to
    1.4.4
  - build(deps): Bump github.com/huandu/go-sqlbuilder from
    1.41.0 to 1.42.1
  - build(deps): Bump github.com/prometheus/client_golang from
    1.23.2 to 1.24.0
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    2.5.34 to 2.5.36
  - build(deps): Bump golang.org/x/sync from 0.21.0 to 0.22.0
  - build(deps): Bump golang.org/x/text from 0.38.0 to 0.40.0
  - build(deps): Bump google.golang.org/grpc from 1.81.1 to
    1.82.1
  - build(deps): Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2
    (#8889) authored by @ahbarrios
  - Addressing GHSA-fxhp-mv3v-67qp
  - build(deps): Drop github.com/peterh/liner
  - build(deps): Drop github.com/KimMachineGun/automemlimit
    (#8869) authored by @charlieegan3
  - build(deps): Drop go.uber.org/automaxprocs (#8869) authored
    by @charlieegan3</changelog>
</package>
<package pkgid="1ebf2f6514eb6cb38b4994cf2041ab278d5317ee4bc83b173f84d252328902ffdc0447bd5f55aa6fda4eaa7743129049befecbcd31b60dbd6943b7c7b48cc4f4" name="opa" arch="src">
  <version epoch="0" ver="1.19.0" rel="52.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145600">- Update to version 1.12.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Support for String Interpolation in the Rego language
  - Faster compilation and runtime
  - Fixes published in the v1.11.1 release
  * String Interpolation (#4733)
  - The Rego language has been extended to support String
    Interpolation, which provides a readable means to compose
    strings containing dynamic values determined at evaluation
    time.
    An interpolated string is composed of a template-string
    containing zero or more template-expressions that evaluates
    to a value at evaluation time.
    The $ character prefix identifies a template-string, and
    template-expressions are declared by being enclosed in
    curly-braces ({, }).
    Additionally, undefined template-expression values don't halt
    evaluation; instead, &lt;undefined&gt; will be injected into the
    generated string.
    package interpolation
    allowed_roles := ["admin", "employee"]
    default role := "guest"
    role := input.role
    deny contains $"User {input.username}'s role was '{role}', but must be one of {allowed_roles}" if {
    not role in allowed_roles
    }
    {
    "deny": [
    "User &lt;undefined&gt;'s role was 'guest', but must be one of [\"admin\", \"employee\"]"
    ],
    }
    String interpolation is a more readable and less error-prone
    substitute for the sprintf built-in function.
    Authored by @johanfylling reported by @anderseknert
    Tip
    Help us out!
    New Rego language features are exciting, and we want to
    maximize their usefulness. If you come across tools and
    integrations in the community where string interpolation
    isn't properly handled, such as syntax highlighting, please
    reach out and let us know.
  * Runtime, SDK, Tooling
  - oracle: Refactor Oracle better support some and every (#8105,
    [#8131], #8138) authored by @charlieegan3
  - plugins/bundle: Prevent ns-level polling by validating
    intervals (#8082) authored by @jjhwan-h
  - plugins/discovery: Initialize plugins before downloading
    (#8071) authored by @jt28828
  - topdown: Introduce sink for context cancellation
  - topdown: Make regex.replace respect cancellation (#8089)
    authored by @srenatus
  - topdown: Make replace and strings.replace_n respect
    cancellation (#8089) authored by @srenatus
  - topdown: Use sink for concat (#8090) authored by @srenatus
  - perf: Avoid extra allocation in sink if no cancel (#8104)
    authored by @anderseknert
  * Compiler, Topdown and Rego
  - ast/compile: Deal with error limit without panic/defer
    (#8087) authored by @srenatus
  - ast/parser: Check if we need to unescape at all (#8135)
    authored by @srenatus
  - perf: Improved visitor implementation (10% faster
    compilation) (#8078) authored by @anderseknert
  - perf: Reduce allocations handling terms (#8116) authored by
    @anderseknert
  - perf: Type-checker performance improvements (#8143) authored
    by @anderseknert
  * Docs, Website, Ecosystem
  - website: Add support for rego string interpolation syntax
    highlighting (#8092) authored by @charlieegan3
  - docs/ocp: Update "concepts" for v0.3.0 (#8117) authored by
    @srenatus
  - website: Show playground errors (#8141) authored by
    @charlieegan3
  - website: Update a number of links to their new location
    (#8100) authored by @charlieegan3
  - docs: Remove link to feedback form (#8101) authored by
    @charlieegan3
  - website: Remove survey bar (#8136) authored by @charlieegan3
  - docs: Update community contacts (#8108) authored by
    @charlieegan3
  * Miscellaneous
  - ast/checks_test: Fix flaky tests (#8111) authored by
    @srenatus
  - benchmarks: Install node v24 (#8122) authored by @srenatus
  - download: Fix when compiling with tag opa_no_oci (#8070)
    authored by @srenatus reported by @mg0083
  - tests: Race in TestStatusUpdateBuffer (#8133) authored by
    @thevilledev
  - workflow: Integrate benchmarks notebook (#8121) authored by
    @srenatus
  - workflows: Skip all tests in benchmarks run (#8086) authored
    by @srenatus
  - Dependency updates; notably:
  - build: Bump golang from 1.25.4 to 1.25.5 (#8107) authored
    by @srenatus
  - build(deps): Bump google.golang.org/grpc from 1.76.0 to
    1.77.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145601">- Update to version 1.12.1:
  This bug fix release reverts a change to regex.replace that
  unintentionally changed its behaviour for anchored regular
  expressions.
  * Revert "topdown: make regex.replace respect cancellation"
    (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 1.12.2:
  This bug fix release address issues found in the new string
  interpolation feature
  * Add (*TemplateString).Copy() method (#8159) authored by
    @anderseknert
  * Fix template string not serialized with escaped { (#8161)
    authored by @anderseknert
  * fix(ast): skip template string vars in ref safety (#8174)
    authored by @thevilledev
  * fix(ast): use original var names in template error (#8180)
    authored by @thevilledev</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768478400">- Update to version 1.12.3:
  This is a bug fix release addressing two issues:
  * Bundle polling is being misconfigured when discovery bundle is
    updated (#8215)
    This is an issue where the polling interval for discovery
    (discovery.polling.min_delay_seconds and
    discovery.polling.max_delay_seconds) were misinterpreted on
    reconfiguration, causing extremely long update intervals.
  * Decision log size buffer buffer_size_limit_bytes misconfigured
    during reconfiguration (#8213)
    This is a regression in the decision log, where the
    decision_logs.reporting.buffer_size_limit_bytes was mistakenly
    assigned the value of
    decision_logs.reporting.upload_size_limit_bytes during
    reconfiguration.
    This issue is only present when
    decision_logs.reporting.buffer_type is set to size, which is
    the default value.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769774400">- Update to version 1.13.1:
  This bug fix release addresses an issue found in the new
  array.flatten built-in function
  - Fix issue in array.flatten handling of single item arrays
    (#8273) (#8272) authored by @anderseknert
- Update to version 1.13.0:
  This release contains a mix of new features, performance
  improvements, and bugfixes. Notably:
  - A new immediate upload trigger mode in the Decision Logger
  - A new array.flatten built-in function
  - Numerous performance improvements
  * Immediate Upload Trigger Mode in Decision Logger (#8110)
  - An immediate trigger mode has been added to the Decision
    Logger; enabled by setting the
    decision_logs.reporting.trigger configuration option to
    immediate.
    When enabled, log events are pushed to the log service as
    soon as the configured upload chunk size criteria is met; or,
    at latest, when the configured upload delay is reached.
  * Runtime, SDK, Tooling
  - cmd/fmt: Do not overwrite file on fmt without changes (#8222)
    authored by @Loic-R
  - cmd/test: Enable sorting JSON test results by duration
    (#7444) authored by @sspaink
  - profiler: nil *Profiler should not report Enabled() (#8256)
    authored by @anderseknert
  - rego: Add Data function to simplify adding data from map
    (#5961) authored by @majiayu000 reported by @anderseknert
  - runtime: Correct naming &amp; docs for version checking (#8191)
    authored by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Body.String() doesn't panic on empty body (#8244)
    authored by @srenatus
  - ast: Improve type error message when referencing functions
    (#6840) authored by @sspaink
  - ast: Type Checker recognizes when a variable has multiple
    assignments but is an undefined function (#7463) authored by
    @sspaink reported by @anderseknert
  - ast/parser: Avoid duplicate loc copies (#8142) authored by
    @srenatus
  - topdown: Add array.flatten built-in function (#8226) authored
    by @anderseknert
  - topdown: Fix issue where numbers.range_step built-in could
    erroneously return undefined value (#8194) authored by
    @thevilledev
  - topdown: Remove hard-coded missing key error in
    strings.render_template built-in (#7931) authored by
    @colinjlacy reported by @anderseknert
  - topdown: Re-introduce cancellation-awareness for
    regex.replace built-in (#8179) authored by @srenatus
  - from having been reverted in v1.12.1
  - topdown: Support arrays as input for json.match_schema
    (#6615) authored by @sspaink reported by @mscudlik
  * Performance
  - ast: Improved annotations parsing (#8210) authored by
    @anderseknert
  - ast: Reinstate zero-alloc paths in Ref.String() (#8202)
    authored by @anderseknert
  - ast: Replace regex implementation in IsVarCompatibleString
    (#8164) authored by @anderseknert
  - ast: Optimize Set.Intersect and Set.Diff (#8167) authored by
    @thevilledev
  - ast: Optimize Set.Union (#8172) authored by @thevilledev
  - ast: Reduce allocations in Expr.MarshalJSON (#8204) authored
    by @thevilledev
  - ast: Reduce allocations in Rule.MarshalJSON (#8205) authored
    by @thevilledev
  - ast: Reduce allocations in Term.MarshalJSON (#8200) authored
    by @thevilledev
  - ast: Reduce allocations in With.MarshalJSON (#8206) authored
    by @thevilledev
  - perf: String() implementations using appenders (#8192)
    authored by @anderseknert
  - topdown: Avoid redundancy in builtinTrim (#8237) authored by
    @thevilledev
  - topdown: Eliminate closure allocations in Set and virtual doc
    enumeration (#8242) authored by @alex60217101990
  - topdown: Fast paths for array.reverse (#8177) authored by
    @thevilledev
  - topdown: Optimize json.remove and json.filter (#8193)
    authored by @thevilledev
  - topdown: Optimize object built-ins (#8175) authored by
    @thevilledev
  - topdown: Optimize union built-in (#8173) authored by
    @thevilledev
  - topdown: Pre-alloc in various built-ins (#8198) authored by
    @thevilledev
  - topdown: Reduce allocs in float sum/product (#8235) authored
    by @thevilledev
  - topdown: Skip set copy in getObjectKeysParam (#8176) authored
    by @thevilledev
  * Docs, Website, Ecosystem
  - docs: Add authz-spring-boot-starter to Spring Security API
    ecosystem entry (#8234) authored by @francois-eckert
  - docs: Add header for crypto example to make (#8259) authored
    by @charlieegan3
  - docs: Add notes for automated agents (#8147, #8203) authored
    by @charlieegan3
  - docs: Add opa-wasm-zig to the ecosystem (#8163) authored by
    @burdzwastaken
  - docs: Add scripts to import docs from source (#8148) authored
    by @charlieegan3
  - docs: Explain how to use the SDK without a initialising a
    server (#8248) authored by @andrewcameronsims
  - docs: Fix a number of redirecting links (#8165 authored by
    @charlieegan3
  - docs: Fix template-expression examples (#8199) authored by
    @johanfylling
  - docs/ocp: Mention source prefix/path options (#8238) authored
    by @srenatus
  - website: Add redirect section for immutable referrers (#8262)
    authored by @charlieegan3 reported by @KraLeoD
  - website: Display 2025 survey results on the website (#8258)
    authored by @charlieegan3
  - website: Show breadcrumbs in search results (#8207) authored
    by @charlieegan3
  * Miscellaneous
  - Decoupled the Rego job check from the Go job checks in the
    Github PR workflow (#8203) authored by @SeanLedford
  - build: Format pr_check.rego with opa fmt (#8201) authored by
    @thevilledev
  - build: Migrate PR check to OPA policy (#8183) authored by
    @SeanLedford
  - build: Run go get against main to spot redacted (#8146)
    authored by @charlieegan3
  - deps: Switch to maintained go.yaml.in/yaml/v3 yaml library
    (#8182) authored by @mrueg
  - test/cases: Increase yaml test coverage for some regex and
    string builtins (#8152) authored by @srenatus
  - Dependency updates; notably:
  - build: bump golang from 1.25.5 to 1.25.6 (#8224) authored
    by @srenatus
  - build(deps): bump go.opentelemetry.io deps from
    1.38.0/0.63.0 to 1.39.0/0.64.0
  - build(deps): bump klauspost/compress from v1.18.1 to
    v1.18.2 (#8184) authored by @srenatus
  - because of redaction warning
  - build(deps): bump github.com/go-ini/ini from v1.67.0 to
    gopkg.in/ini.v1 v1.67.1 (#8208) authored by @gabrpt</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1771416000">- Update to version 1.13.2:
  This release updates the version of Go used to build the OPA
  binaries and images to 1.25.7.
  That version of the Go standard library contains a fix for
  GO-2026-4337.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772193600">- Update to version 1.14.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Improved rule indexing of variable assignments and x in {...}
    expressions
  - Support for --h2c with unix domain socket for opa run
  - A new glossary tooltip for technical terms in the docs
  - Fixes published in the v1.13.1 and v1.13.2 releases
  * Improved rule indexing of variable assignments and x in {...}
    expressions (#1841)
    With this change, the rule indexer will index expressions like:
    allow if input.role in {"admin", "user"}
    On lookup, the rule body will only be returned if input.role is
    either one of "admin" or "user".
    The reverse case is also indexed:
    allow if "admin" in input.roles
    in which the searched collection is unknown.
  * Runtime, SDK, Tooling
  - cmd,run: Support --h2c with unix domain socket (UDS) (#8282)
    authored by @srenatus reported by @theJC
  - cmd,tester: Add line number next to test file in pretty
    format (#8328) authored by @sspaink reported by @anderseknert
  - plugins: Fix race accessing registeredTriggers (#8363)
    reported and authored by @szuecs
  - rego: Add ResultValue[T]() helper method (#8320) authored by
    @srenatus
  - runtime: Add custom storage backend registration API (#8277)
    authored and reported by @alex60217101990
  - topdown: Add config option to disable named inter-query
    built-in cache (#7519) authored by @sspaink reported by
    @johanfylling
  * Compiler, Topdown and Rego
  - ast: Add index else == nil test, fix it (#8348) authored by
    @srenatus
  - ast: Add scaffolding to introspect and skip compiler stages
    (#8304) (authored by @srenatus)
  - ast: Ensure term values implement ast.StringLengther (#8374)
    authored by @charlieegan3
  - ast: Fix double-fix for refs["with-a"].dash as package
    (#8286) authored by @srenatus
  - ast: Optimized template-expression handling of values known
    to be defined (#8310) authored by @anderseknert
  - ast: Put rule indices into rule tree, change Values to
    []*Rule (#8298) authored by @srenatus
  - ast: Replace true expr when appending to empty body (#8299)
    authored by @anderseknert
  - ast: Return correct location of unsafe var in object (#7935)
    authored by @sspaink reported by @anderseknert
  - ast: Use StageID in WithStageAfterID, also for QueryCompiler
    (follow-up) (#8306) authored by @srenatus
  - compile: Add StringLength to lazy object (#8369) authored by
    @charlieegan3 reported by @robmyersrobmyers
  - parser: Add test to verify filename interning in Location
    (#8322) authored by @anderseknert
  - perf: Allocate less in array unification (#8351) authored by
    @anderseknert
  - perf: Various minor eval performance tweaks (#8290) authored
    by @anderseknert
  - perf: json.patch + interning improvements (#8289) authored by
    @anderseknert
  - topdown: Optimize bindings allocation with dynamic pre-sizing
    (#7266) authored by @alex60217101990
  - topdown: Preserve original package name with special
    characters in optimized builds (#8284) authored by @sspaink
    reported by @at50989
  - wasm: Updates (LLVM+tools) (#8295) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs: Add examples to glob.match built-in documentation
    (#8252) authored by @sibasispadhi reported by @anderseknert
  - docs: Add workflow to auto update Regal docs (#8318) authored
    by @charlieegan3
  - docs: Document metrics for http.send, regex, and glob
    built-ins (#6730) authored by @anivar reported by @rudrakhp
  - docs: Fix json.patch target description (#8271) authored by
    @anderseknert
  - docs: Update broken links (#8285) authored by @charlieegan3
  - docs: Update bundle signing docs to clarify key config
    (#8307) authored by @charlieegan3
  - docs: Update faulty example using bundle optimize (#5379)
    authored by @sspaink reported by @bluebrown
  - docs: Update interface{} -&gt; any in golang snippets (#8373)
    authored by @srenatus
  - docs/website: Add a new KubeCon event page (#8311) authored
    by @charlieegan3
  - docs/website: Add formatting and linting checks (#8288)
    authored by @charlieegan3
  - docs/website: Allow Regal import to use local dir (#8312)
    authored by @charlieegan3
  - docs/website: Implement new GlossaryTooltip component (#8367)
    authored by @charlieegan3
  - docs/website: Markdown linting and spell checking for
    documentation (#8292) authored by @charlieegan3
  - docs/website: Redirect /docs/latest/ecosystem (#8315)
    authored by @charlieegan3 reported by @tweekSun1
  * Miscellaneous
  - maintainers: Moving nilekhc to emeritus, and renew maintainer
    terms (#8276) authored by @JaydipGabani
  - ast: Add public method to extend the compliance test cases
    with IR plans (#7556) authored by @sspaink reported by
    @shomron
  - ast: Tiny nitpicky cleanup (#8309) authored by @srenatus
  - chore: Clean up bundle storage tests (#8267) authored by
    @anderseknert
  - chore: Remove unnecessary comment from bundle JWT
    verification impl (#8354) authored by @johanfylling
  - ci: Bump golangci-lint (v2.9.0), fix issues (#8314) authored
    by @srenatus
  - ci: Harden and update all GH Actions workflows (#8356, #8377,
    [#8368] authored by @philipaconrad and @srenatus
  - go: Cleanup old build flags (#8314) authored by @srenatus
  - rego: Remove superfluous package import of plugins (#6754)
    authored by @srenatus reported by @oxisto
  - tests: Extract runtime Info to new package (#8362) authored
    by @charlieegan3
  - tests: Fix BenchmarkFunctionArgumentCounts query (#8327)
    authored by @alex60217101990
  - tests: Disable rule indexing for benchmark (#8375) authored
    by @srenatus
  - workflows: Add nightly vuln checks for released
    versions/images (#8336 #8339) authored by @srenatus
  - Dependency updates; notably:
  - build: bump golang from 1.25.6 to 1.26.0
  - build(deps): build(deps): bump go.opentelemetry.io deps
    from 1.39.0/0.64.0 to 1.40.0/0.65.0
  - Applying fix for GHSA-9h8m-3fm2-qjrq
  - build(deps): bump github.com/dgraph-io/badger/v4 from 4.9.0
    to 4.9.1
  - build(deps): bump github.com/huandu/go-sqlbuilder from
    1.39.0 to 1.39.1
  - build(deps): bump golang.org/x/net from 0.49.0 to 0.50.0
  - build(deps): bump golang.org/x/text from 0.33.0 to 0.34.0
  - build(deps): bump google.golang.org/grpc from 1.78.0 to
    1.79.1
  - build(deps): bump go.opentelemetry.io deps from
    1.39.0/0.64.0 to 1.40.0/0.65.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773057600">- Update to version 1.14.1:
  This is a patch release collecting two bug fixes and various
  dependency updates for Golang standard library and common package
  vulnerabilities.
  These bug fixes include a revert of the rule indexer tweaks
  shipped in 1.14.0, which had caused unexpected lookup failures
  for some users. (We expect to properly fix the issue in 1.15.0,
  but for now, a revert is the quicker choice.)
  * Changes
  - Fix intermittent plugins manager deadlock on opa.configure
    (#8407)
  - Revert "ast: make rule index track var assignments and x in
    {...} (#8341)" (#8410)
  - build: bump deps (go.mod from main)
  - build: bump go 1.26.1 (#8409)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774612800">- Update to version 1.15.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Add logger plugin interface and file logger implementation
    with log rotation
  - Custom HTTPAuthPlugin behavior change, all per-request
    authentication logic must be moved from NewClient() to
    Prepare()
  - AWS signing supports for web identity for assume role
    credentials
  * Logger Plugin Support (#8434) (authored by @srenatus)
    OPA now supports pluggable logging implementations via the
    logger plugin interface, which is based on Go's standard
    log/slog.Handler interface. This allows any slog.Handler
    implementation to be used as a logger plugin. Loggers can be
    configured via the server.logger_plugin configuration option
    and used for both runtime logging and decision logs. OPA
    includes a built-in file logger plugin (file_logger) that
    writes structured JSON logs with rotation support using
    lumberjack. Users can also implement and register custom logger
    plugins when building OPA.
    Example configuration for server logging:
    server:
    logger_plugin: file_logger
    plugins:
    file_logger:
    path: /var/log/opa/server.log
    max_size_mb: 100
    max_age_days: 28
    max_backups: 3
    compress: true
    level: info
    Example configuration for decision logs using the same plugin:
    server:
    logger_plugin: file_logger
    decision_logs:
    plugin: file_logger
    plugins:
    file_logger:
    path: /var/log/opa/server.log
    max_size_mb: 100
    max_age_days: 28
    max_backups: 3
    compress: true
    level: info
  * Custom HTTPAuthPlugin behavior change (#8376) (authored by @srenatus)
    The HTTPAuthPlugin.NewClient() method is now called once per
    Client instance and cached rather than being called for every
    request. Custom plugins that performed per-request operations
    in NewClient() (such as request counters, per-request transport
    wrapping, or logging/metrics side effects) will now only
    execute those operations once. All per-request authentication
    logic must be moved from NewClient() to Prepare(). All plugins
    included in OPA have been updated and are unaffected by this
    change.
  * Runtime, SDK, Tooling
  - plugins/logger: Add logger plugin interface and file logger
    implementation with log rotation (#8434) (authored by
    @srenatus)
  - plugins/logs: Decision logs can now use logger plugins for
    output (#8434) (authored by @srenatus)
  - logging: Add BufferedLogger to capture early startup logs
    before plugins are initialized (#8434) (authored by
    @srenatus)
  - plugins/rest: Configurable re-read interval for TLS client
    certificates via cert_reread_interval_seconds field.
    Defaults to re-reading on every request for backwards
    compatibility.  The implementation also uses content hashing
    to detect changes and avoid re-parsing unchanged TLS
    certificates and keys. (#8376) (authored by @srenatus)
  - plugins/rest: All TLS configurations now inherit the minimum
    version and TLS ciphersuites as configured for the server.
    (#8376) (authored by @srenatus)
  - internal/providers/aws: Refactor deprecated crypto/elliptic
    APIs to crypto/ecdh (#8395) (authored by @kanywst)
    plugins/rest: AWS Signing - Allow Service Account (Web
    Identity) credentials for Assume Role Credentials (#8386) (
    authored by @tiagogviegas)
  * Compiler, Topdown and Rego
  - ast: fix overlapping array and scalar pattern in rule index
    (authored by @srenatus)
  * Bundles
  - optimized bundles: filter metadata comments properly ( #8388)
    (#6529) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs(ecosystem): add Kopa ecosystem entry (#8405) (authored
    by @sfreet)
  - docs: Update KubeCon event listing (#8439) (authored by
    @charlieegan3)
  - docs: fix input of partial-evaluation example (#8430)
    (authored by @edobrb)
  - ecosystem: add Big ACL (#8389) (authored by @francois-eckert)
  - Regal v0.39.0 doc updates (#8383) (authored by @anderseknert)
  * Miscellaneous
  - build/generate-extended-cases: Fix testcase loader to use
    json.Number. (#8429) (authored by @philipaconrad)
  - Filter compliance test cases using capabilities file (#8418)
    (authored by @sspaink)
  - Fix intermittent plugins manager deadlock on opa.configure
    (#8407) (authored by @sspaink)
  - Linter configuration cleanup (#8397) (authored by
    @anderseknert)
  - fix nightly.yaml by moving secret to env (#8381) (authored by
    @sspaink)
  - fix release-vulnerability-check.yaml (authored by @sspaink)
  - nightly+release-vuln-check: add links to slack msg payloads
    (authored by @srenatus)
  - Dependency updates; notably:
  - build: bump go 1.26.1 (#8409) (authored by @srenatus)
  - gha: bump trivy-action (authored by @srenatus)
  - build(deps): bump google.golang.org/grpc from 1.79.1 to
    1.79.3 (#8428) (authored by @dependabot[bot])
  - build(deps): bump github.com/vektah/gqlparser/v2 from
    2.5.31 to 2.5.32 (#8399) (authored by @dependabot[bot])
  - build(deps): bump modernc.org/sqlite from 1.45.0 to 1.46.1
    (#8399) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/time from 0.14.0 to 0.15.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump github.com/microsoft/go-mssqldb from
    1.9.6 to 1.9.7(#8412) (authored by @dependabot[bot])</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774872000">- Update to version 1.15.1:
  * Miscellaneous
  - logging: make WithContext() optional (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775736000">- Update to version 1.15.2:
  No changes related to the openSUSE package, only GitHub release
  workflow updates (use go1.26.2)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777550400">- Update to version 1.16.0:
  This release contains a mix of new features, performance
  improvements, and bugfixes. Notably:
  - New uri.parse and uri.is_valid built-in functions
  - Data API Request/Response Metadata
  - Prometheus metrics exported via OTLP
  - Formatter improvements
  NOTE:
  In v1.15.x, OPA was dropping logs for bundle downloads, print()
  calls and other plugin-originated logs.
  Users are advised to update, v1.16.0 fixes this bug in (#8544).
  * New uri.parse and uri.is_valid built-in functions (#8263)
    Two new built-in functions have been added: uri.parse for
    parsing a given URI, and uri.is_valid for verifying the
    structure of a given URI.
  - uri.parse
    Parses a URI and returns an object containing its components
    according to RFC 3986. Empty components are omitted.
    package example
    test_uri if {
    uri.parse("https://example.com:8080/api?q=1#top") == {
    "scheme": "https",
    "hostname": "example.com",
    "port": "8080",
    "path": "/api",
    "raw_path": "/api",
    "raw_query": "q=1",
    "fragment": "top",
    }
    }
  - uri.is_valid
    Returns true if the input can be parsed as a URI, false otherwise.
    package example
    deny contains "invalid URI" if {
    not uri.is_valid("http://[invalid")
    }
  * Data API Request/Response Metadata (#8570)
    Wrapping projects can now attach custom metadata to Data API
    requests and have evaluation produce response metadata.
    Two distinct metadata paths are introduced:
  - Request metadata: parsed from extra top-level keys in the
    request body, made available to builtins via
    BuiltinContext.RequestMetadata. Logged in the decision log
    under Custom["request_metadata"].
  - Response metadata: a separate map
    (BuiltinContext.ResponseMetadata) that builtins can populate
    during evaluation. Only included in the API response and
    decision log if non-empty.
    In vanilla OPA, no builtins write response metadata, so
    responses are unchanged. The request metadata map is only
    allocated when the request carries extra fields; the response
    map is one empty map per request.
    To avoid conflicts with future OPA top-level keys, callers
    should use a namespaced key: {"input": {...},
    "com.example.opa/md": {...}}.
    Request with metadata:
    curl -H 'Content-Type: application/json' \
  - d '{"input": {"user": "alice"}, "com.example.opa/metadata": {"corp-id": "acme-42"}}' \
    http://localhost:8181/v1/data/example/allow
    Response (response metadata included if, for example, set by a
    custom builtin):
    {
    "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
    "result": true,
    "com.example.opa/response": {
    "snapshot_version": "v3"
    }
    }
    Decision log entry:
    {
    "custom": {
    "request_metadata": {
    "com.example.opa/metadata": {
    "corp-id": "acme-42"
    }
    },
    "response_metadata": {
    "com.example.opa/response": {
    "snapshot_version": "v3"
    }
    }
    },
    "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
    "input": { "user": "alice" },
    "msg": "Decision Log",
    "path": "example/allow",
    "result": true
    }
  * Runtime, SDK, Tooling
  - distributedtracing: Export Prometheus metrics via OTLP
    (#7591) reported and authored by @Munken
  - cmd,tester: Update opa test to stream test case results
    (#3676) authored by @sspaink reported by @tsandall
  - cmd,tester: Show full errors when test fails and using
  - -coverage (#8438) authored by @grosser
  - format: Add new line between METADATA blocks (#8483) authored
    by @sspaink
  - format: Allow indenting all withs in expression (#8508)
    authored by @anderseknert
  - format: Fix dropping comments after handling
    unexpectedCommentError (#8553) authored by @sspaink
  - format: Preserve location of trailing comments inside every
    body (#8558) authored by @johanfylling
  - format: Prevent opa fmt from formatting single attribute
    objects with comments (#7565) authored by @sspaink reported
    by @anderseknert
  - logging: Keep forwarding from BufferedLogger after Flush()
    (#8544) authored by @srenatus reported by @annieyhuang
  - plugins/logs: Fix logBuffer eviction loop only dropping one
    element (#8543) authored by @sspaink
  - plugins/logs: Fix out-of-order plugin status notifications
    (#8009) authored by @sspaink reported by @Pushpalanka
  - plugins/rest: Carry over all of *tls.Config (#8473) authored
    by @srenatus reported by @ashu2496
  - server: Drop HTML index page query form (#8477) authored by
    @johanfylling reported by @srenatus and @r0binak
  - server: Skip chmod for abstract Unix domain sockets (#8536)
    authored by @bakayolo
  - storage/inmem: Avoid allocations from Read() in MakeDir()
    (#8561) authored by @srenatus
  - tester: Add method to match tests by ref prefixes (#6696)
    authored by @anderseknert
  - Note: Experimental.
  * Compiler, Topdown and Rego
  - ast: Allow Back-to-back metadata blocks (#8482) authored by
    @sspaink reported by @johanfylling
  - ast: Catch functions in dynamic extent of ref head rule
    (#8461) authored by @srenatus reported by @johanfylling
  - ast: Fix parenthesis in String() of {obj,arr,set}
    comprehensions (#8511) authored by @srenatus
  - ast: Fix parsing of unary - in front of a ref (#5014)
    authored by @mmzzuu reported by @philipaconrad
  - ast: Fix type checker match error for objects with set keys
    (#6260) authored by @sspaink reported by @tsandall
  - ast: Fix type checker to recognize numeric index in generated
    map (#6736) authored by @sspaink reported by @anderseknert
  - ast: Handle underdetermined function args (#5234) authored by
    @sspaink reported by @obataku
  - ast: Identify compatible type from reference in type checker
    (#7273) authored by @sspaink reported by @anderseknert
  - ast: Support recursive JSON Schemas (#6099) authored by
    @sspaink reported by @anderseknert
  - builtins: Add support for days, weeks and years in
    time.parse_duration_ns built-in function (#2719) authored by
    @sspaink reported by @freeseacher
  - builtins: Fix graph.reachable_paths to return all reachable
    paths (#5871) authored by @davidmarne-wf reported by
    @ericjkao
  - builtins: Limit exponent size in units.parse_bytes built-in
    function to prevent timeout bypass (#8326) authored by
    @isaiahvita reported by @anderseknert
  - perf: Add CopyNonGround() methods for Array, Set, and Object
    (#8323) authored by @alex60217101990
  - resolver/wasm: Add NewWithContext to allow passing context
    (#8499) authored by @dominikschulz
  * Docs, Website, Ecosystem
  - docs: Add aggregates examples for count and sum built-in
    functions (#8566) authored by @alliasgher reported by
    @srenatus
  - docs: Add generated output.jsons for docs examples (#8535)
    authored by @charlieegan3
  - docs: Add spec for OCP bundle status tracking API (#8502)
    authored by @ashutosh-narkar
  - docs: Add the latest videos to the README presentations
    section (#8523) authored by @sspaink
  - docs: Add Windows development notes to dev reference guide
    (#8422) authored by @raajheshkannaa
  - docs: Fix input value type in not undefined example (#8580)
    authored by @menma1234
  - docs: Update Regal docs to v0.40.0 (#8538) authored by
    @charlieegan3
  - docs: Updated roadmap link (#8501) authored by @johanfylling
  - docs: Various typo fixes (#8529) authored by @sspaink
  - ecosystem: Add vulnetix ecosystem entry (#8532) authored by
    @0x73746F66
  - ecosystem: Add KubeStellar Console (#8560) authored by
    @clubanderson
  - website: Add banner to show when event has passed (#8493)
    authored by @charlieegan3
  - website: Add copy-as-markdown button to doc pages (#8540)
    authored by @charlieegan3
  - website: Copy button improvements (#8577) authored by
    @charlieegan3
  - website: Remove old redirects, add new management redirect
    (#8424) authored by @charlieegan3 reported by @narainar
  - website: Update intro video on homepage (#8547) authored by
    @charlieegan3
  * Miscellaneous
  - build: Exclude domains that cause false positives (#8533)
    (#8495) authored by @charlieegan3
  - e2e/cli: Add test for debug print() logging (#8567) authored
    by @srenatus
  - e2e/cli: Start CLI E2E tests (#8545) authored by @srenatus
  - github: declare formatted rego as rego (#8564) authored by
    @srenatus
  - Security policy update (#8479) authored by @anderseknert
  - Dependency updates; notably:
  - build: bump go 1.26.2 (#8497) authored by @sspaink
  - build(deps): bump wasmtime-go from v39.0.1 to v43.0.2
  - build(deps): bump go.opentelemetry.io deps from
    1.40.0/0.65.0 to 1.43.0/0.68.0
  - build(deps): bump github.com/containerd/containerd/v2 from
    2.2.1 to 2.2.3
  - build(deps): bump ithub.com/huandu/go-sqlbuilder from
    1.39.1 to 1.40.2
  - build(deps): bump golang.org/x/net from 0.51.0 to 0.53.0
  - build(deps): bump golang.org/x/text from 0.34.0 to 0.36.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777636800">- Update to version 1.16.1:
  This is a patch release addressing a regression in the plugin
  manager that may cause the service to hang on shutdown (#8590).</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.16.2:
  This release updates the version of Go used to build the OPA
  binaries and images to 1.26.3; addressing a number of
  vulnerabilities.
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
  This is CVE-2026-42501 and Go issue https://go.dev/issue/79070
  * build: bump go 1.26.2 -&gt; 1.26.3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 1.17.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - A new future.keywords.not import that adds improved semantics
    to the not keyword.
  - Rule Labels in Decision Logs
  - Published json schema for IR and bundle manifest
  - Dropped automaxprocs and x/net dependencies
  * Improved Negation Semantics (#8387)
    This OPA release introduces a new future.keywords.not import
    that fixes a long-standing semantic issue with negation in
    Rego.
    Without the import, the compiler expands a negated composite
    expression like not f(g(input.x)) into a series of
    sub-expressions evaluated before the not:
    __local0__ = input.x
    g(__local0__, __local1__)
    not f(__local1__)
    If any sub-expression fails — for example, input.x is undefined
    or g produces an undefined result — the entire rule fails
    rather than the not succeeding.  This is unintuitive: the
    user's intent is "the condition does not hold," but an
    undefined intermediate value causes a silent failure instead of
    the expected not result.
    With import future.keywords.not, composite-expression negation
    wraps the full compiler expansion in an implicit body:
    not { __local0__ = input.x; g(__local0__, __local1__); f(__local1__) }
    Now, if any sub-expression is undefined or fails, the body is
    unsatisfiable and the not expression succeeds; matching the
    intuition that "the condition does not hold."
    NOTE:
    Users are recommended to import future.keywords.not whenever
    the not keyword is used in a policy.
  * Rule Labels in Decision Logs (#2089)
    Rule annotations now support a labels field. Labels from all
    successfully evaluated rules are collected and included in each
    decision log entry as a top-level rule_labels array. Each
    element is the merged label map for one successfully evaluated
    rule, with inner-scope-wins precedence across the rule's
    annotation chain (subpackages &lt; package &lt; document &lt; rule).
    Merged maps are deduplicated across rules so that identical
    label sets collapse to a single entry.
    [#] METADATA
    [#] scope: package
    [#] labels:
    [#]   service: authz
    [#]   severity: info
    package myapp
    [#] METADATA
    [#] labels:
    [#]   severity: low
    [#]   team: platform
    allow if input.role == "admin"
    The resulting decision log entry will contain:
    {"rule_labels": [{"service": "authz", "severity": "low", "team": "platform"}]}
    Note how severity: info from the package scope is overridden by
    severity: low from the rule scope. Queries against rule_labels
    can now rely on each entry carrying the full label context for
    a single rule, rather than one entry per contributing scope.
    Both the runtime and the Go SDK now process metadata
    annotations by default.
  * Runtime, SDK, Tooling
  - ast: Allow $ref in allOf in JSON schemas (#6523) authored by
    @deeglaze reported by @mosiac1
  - bundle: Update bundle roots conflict detection algorithm.
    (#8664) authored by @philipaconrad
  - download: Use oras, not containerd (#8639) authored by
    @srenatus
  - server: Remove dead code (s.partials) (#8708) authored by
    @srenatus
  - server: Wire in response/request metadata for compile handler
    (#8650) authored by @srenatus
  - server/types: generalize request/response metadata (#8650)
    authored by @srenatus
  * Compiler, Topdown and Rego
  - builtins: Enable pattern validation in json.verify_schema and
    json.match_schema built-in functions (#6089) authored by
    @sspaink reported by @ewout8
  - ir: Don't capitalize index field in MakeNumberRefStmt IR
    statement (#6266) authored by @sspaink reported by
    @johanfylling
  - perf: Avoid allocating in binary and/or operators when
    possible (#8689) authored by @anderseknert
  - rego: Allow per-eval GenerateJSON function (#8690) authored
    by @anderseknert
  * Docs, Website, Ecosystem
  - ecosystem: add OPA MCP (#8618) authored by @OrygnsCode
  - docs: Add explicit address binding to examples (#8688)
    authored by @charlieegan3
  - docs: Add titles to code blocks in policy-testing (#8649)
    authored by @charlieegan3
  - docs: Correct OCP SSH key docs (#8675) authored by @taurelius
  - docs: Update diagram to match index examples (#8667) authored
    by @charlieegan3
  * Miscellaneous
  - ast,storage/inmem: Add inmem.NewFromASTObject and add missing
    string case to ast.InternedValue (#8707) authored by
    @anderseknert
  - build: go install -&gt; go install tool to control checksums
    (#8646) authored by @srenatus
  - build: Push edge binaries to bucket (#8668) authored by
    @charlieegan3
  - workflows: Fix benchmarks workflow (replace action, avoid
    stackoverflow) (#8655) authored by @srenatus
  - workflows: Note improvements in benchmark comments (#8673)
    authored by @srenatus
  - Generate a JSON Schema for the IR plan (#8662) authored by
    @sspaink reported by @kroekle
  - Generate a JSON Schema for the bundle manifest (#8661)
    authored by @sspaink reported by @kroekle
  - Dependency updates; notably:
  - build(deps): Remove automaxprocs dependency (#8696)
    authored by @anderseknert
  - build(deps): Remove direct x/net dependency (#8697)
    authored by @anderseknert
  - build(deps): Bump github.com/bytecodealliance/wasmtime-go
    from 43.0.2 to 44.0.0 (8652) authored by @srenatus
  - build(deps): Bump github.com/fsnotify/fsnotify from 1.9.0
    to 1.10.1
  - build(deps): Bump github.com/huandu/go-sqlbuilder from
    1.40.2 to 1.41.0
  - build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.0
    to 3.1.1
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    2.5.32 to 2.5.33
  - build(deps): Bump google.golang.org/grpc from 1.80.0 to
    1.81.0
  - build(deps): Bump gopkg.in/ini.v1 from 1.67.1 to 1.67.2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780920000">- Update to version 1.17.1:
  This release uses the latest version of Go (1.26.4) to build OPA,
  fixing stdlib vulnerabilities in code that OPA's HTTP handler and
  crypto builtins use:
  - https://pkg.go.dev/vuln/GO-2026-5039
  - https://pkg.go.dev/vuln/GO-2026-5037
  It is otherwise the same code as v1.17.0.
  * Miscellaneous
  - build: bump go 1.26.3 -&gt; 1.26.4 (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782648000">- Update to version 1.18.0:
  This release contains a mix of bugfixes and small features.
  Notably:
  - A breaking fix to the outbound User-Agent header so it conforms
    to RFC 9110 (see below)
  - Container-aware resource limits: automatic GOMAXPROCS is
    restored and automatic GOMEMLIMIT is now supported
  - Several opa fmt correctness fixes
  - Improvements to opa test --coverage (ranges in report, inline
    rule head tracking, conjunction-expression coverage)
  * Breaking: Fix User-Agent according to RFC9110 (#8792)
  - OPA's outbound HTTP requests (bundle, discovery, decision
    log, status, http.send, AWS KMS/ECR) previously sent
    User-Agent: Open Policy Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;), which
    is not a valid RFC 9110 User-Agent value because the product
    token cannot contain spaces. The header is now
    Open-Policy-Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;). Server-side log
    filters or WAF rules that exact-match the old string will
    need to be updated.
  * Runtime, SDK, Tooling
  - bundle: fix per-module rego version lookup (#8797) authored
    by @sspaink, reported by @xubinzheng
  - bundle: improve determinism of file_rego_versions patterns
    with overlap (#8733) authored by @philipaconrad
  - cover: Track inline rule head in post trace walk (#6531)
    authored by @charlieegan3, reported by @anderseknert
  - cover: Update report to include ranges (#8748) reported and
    authored by @charlieegan3
  - cover: Add support for coverage of conjunction exprs (#8809)
    authored by @charlieegan3
  - download/oci: Set Accept headers (#8720) authored by
    @charlieegan3
  - fmt: preserve the multiline but single entry iterables
    (#8557) authored by @unichronic, reported by @anderseknert
  - format: Fix dropped with-clause after comment in object value
    (#8765) authored by @sspaink, reported by @srabraham
  - format: keep lone with on the closing-bracket line of
    multi-line expressions (#8804) authored by @anneheartrecord,
    reported by @burnster
  - oracle: Fix find-definition on expressions inside ast.Not
    nodes (#8731) authored by @johanfylling
  - runtime: Restore goautomaxprocs, add automemlimit (#8784)
    authored by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Apply location to inner ast.Not expressions (#8717)
    authored by @johanfylling, reported by @anderseknert
  - ast: Clean up code for value comparisons (#8737) authored by
    @anderseknert
  - ast: Fix PE regression for future.keywords.not negation
    inside every (#8781) authored by @johanfylling
  - internal/edittree: Add recursive tree node recycling (#8693)
    authored by @philipaconrad
  - internal: compile,planner: improve determinism of plan/wasm
    bundle builds (#8732) authored by @philipaconrad
  - perf: avoid allocations in object.get (#8729) authored by
    @anderseknert
  - topdown: Fix PE not namespacing vars in comprehensions nested
    inside every (#8816) authored by @johanfylling
  - topdown: remove dst.Compare(src) shortcut (#8739) authored by
    @srenatus
  - topdown: skip strconv.ParseInt in format_int base-10 fast
    path (#8801) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs/chore: Remove broken links (#8714) authored by
    @charlieegan3, reported by @github-actions
  - docs: PoC for kapa.ai (#8125) reported and authored by
    @charlieegan3
  - docs(ecosystem): update OPA MCP entry with video, blog, and
    distribution links (#8712) authored by @OrygnsCode
  - docs/contributing: add formatting (#8740) authored by @mmzzuu
  - docs: Add SDK references for evaluating IR plans (#8783)
    authored by @charlieegan3
  - docs: Add depkeep to enterprise support (#8685) authored by
    @pkuzco
  - docs: Add notes about use of GOMEMLIMIT (#8771) authored by
    @charlieegan3
  - docs: Add we/our/us check to spell check (#8787) authored by
    @charlieegan3
  - docs: Update built-in index page titles (#8728) authored by
    @charlieegan3
  - docs: Update documentation to be more consistent and sound
    more like reference docs (#8786) authored by @charlieegan3
  - docs: Update regal docs for 0.41.1 release (#8730) authored
    by @charlieegan3
  - docs: Update to agents.md regarding security dependences
    'fixes' (#8754) authored by @charlieegan3
  - docs: clarify environment variable substitution behaviour
    (#8713) authored by @taurelius
  - docs: remove duplicated word in Rego style guide (#8800)
    authored by @s3onghyun
  - website: Add .md alternate content types for llms (#8725)
    authored by @charlieegan3
  - website: Add support page disclaimer and sort by date added
    (#8736) authored by @charlieegan3
  - website: Fix build from missing dateAdded (#8764) authored by
    @charlieegan3
  - website: Update docusaurus (#8756) authored by @charlieegan3
  - website: Update homepage AI example to tool calls (#8755)
    authored by @charlieegan3
  - website: Various updates to node and website deps (#8768)
    authored by @charlieegan3
  - website: add ossrisk to ecosystem (#8780) authored by @pkuzco
  * Miscellaneous
  - benchmarks: smaller tweaks (#8759) authored by @srenatus
  - benchmarks: split off script, emit markdown table (#8812)
    authored by @srenatus
  - benchmarks: use details+summary comments for benchlab results
    (#8811) authored by @srenatus
  - capabilities: Integrate 1.17.1 patch release (#8798) authored
    by @sspaink
  - chore: tidy go.mod to remove untagged versions (#8791)
    authored by @thaJeztah
  - e2e: Add proto schemas for the IR plan and bundle manifest
    (#8766) reported and authored by @sspaink
  - gha: deduplicate change-detection output in pr CI checks
    (#8808) authored by @sspaink
  - nightly: use regal@main (#8735) authored by @srenatus
  - workflow: remove tests from docker (edge) image build (#8721)
    authored by @srenatus
  - workflows: bring back docker edge tags for post-merge (#8718)
    authored by @srenatus
  - workflows: use go-version-file with actions/setup-go (#8751)
    authored by @srenatus
  - Dependency updates; notably:
  - build(deps): Add github.com/KimMachineGun/automemlimit
    v0.7.5
  - build(deps): Add go.uber.org/automaxprocs v1.6.0
  - build(deps): Bump github.com/dgraph-io/badger/v4 from
    v4.9.1 to v4.9.2
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    v2.5.33 to v2.5.34
  - build(deps): Bump
    go.opentelemetry.io/contrib/bridges/prometheus from v0.68.0
    to v0.69.0
  - build(deps): Bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
    from v0.68.0 to v0.69.0
  - build(deps): Bump go.opentelemetry.io/otel from v1.43.0 to
    v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace from
    v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
    from v1.43.0 to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/sdk from v1.43.0
    to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/sdk/metric from
    v1.43.0 to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/trace from
    v1.43.0 to v1.44.0
  - build(deps): Bump golang.org/x/sync from v0.20.0 to v0.21.0
  - build(deps): Bump golang.org/x/text from v0.37.0 to v0.38.0
  - build(deps): Bump google.golang.org/grpc from v1.81.0 to
    v1.81.1
  - build(deps): Bump gopkg.in/ini.v1 from v1.67.2 to v1.67.3
  - build(deps): Bump oras.land/oras-go/v2 from v2.6.0 to
    v2.6.1
  - build(deps): bump golang.org/x/crypto to v0.52.0 and
    golang.org/x/net to v0.55.0 (#8745) authored by @BGebken
  - build: bump go 1.26.3 -&gt; 1.26.4 (#8726) authored by
    @srenatus</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782907200">- Update to version 1.18.1:
  This release fixes a memory leak introduced in OPA v1.17.0. It is
  advised to update if you notice excess memory usage when running
  OPA server.
  * Fixes
  - ast: fix AnnotationSet memory leak via runtime.AddCleanup
    cycle (#8817) authored by @srenatus reported by @keydon and
    @gorsr01</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782993600">- Update to version 1.18.2:
  This release includes a bug fix for a opa fmt regression
  introduced in v1.18.0.
  The original fix for #8557 had the formatter enforce newlines in
  single-item collections (arrays, objects, sets) rather than
  merely honoring existing ones. As a result, running opa fmt on
  already-formatted policies could introduce a large number of
  unwanted changes. This patch release restores the intended
  behavior: only newlines already present in the source determine
  whether a single-item collection is formatted on one line or
  across multiple lines.
  * Fixes
  - Fix regression in fix of #8557 (#8845) (authored by
    @anderseknert)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1785499200">- Update to version 1.19.0:
  * This release contains a mix of new features and bug fixes.
    Notably:
  - A fixed SQL injection vector in the Compile API
  - Stricter safety checking for Rego assignments (:=)
  - A cgo-free, faster WebAssembly runtime (wazero replaces
    wasmtime-go)
  - Startup warnings for unknown configuration options
  - A new strings.split_n built-in function
  - A REPL line reader that handles pasted input correctly,
    migrating existing history files
  * Fix SQL injection vector in Compile API: Quote SQL filter field
    identifiers (#8945)
  - The field names in the SQL emitted by the Compile API come
    from partially evaluated refs, so a policy that selects a
    dynamic key — such as input.fruits[input.column] — puts
    caller-controlled text in an identifier position. That text
    was emitted verbatim, which turns
    WHERE fruit.name = 'allowed'
    into
    WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'
    and an application appending the filter to its query returns
    rows the policy denies.
    Field segments that are not bare identifiers are now quoted
    at the UCAST-to-SQL boundary, with any embedded quote
    character escaped. Ordinary column names stay unquoted, so
    existing filters keep their current shape and remain
    case-insensitive on Postgres.
  * Behavior change: stricter safety for assignment (:=) (#3546)
  - The assignment operator (:=) is documented as "syntactic
    sugar for =, local variable creation, and additional compiler
    checks," and the safety checker reflects that: after
    rewriting, := is treated identically to = (unification), so
    an assignment's right-hand side can be made safe by unifying
    "backwards" through the left-hand side. This means policies
    like x := y; x = 7 compile (binding y to 7) even though y is
    never assigned, and x := y; obj[x] can silently degrade an
    expected constant-time lookup into full iteration.
    This change makes the right-hand-side of := be treated as a
    read that must be made safe by other expressions, and can no
    longer be satisfied through the left-hand-side. Affected
    policies that previously compiled now fail with a
    rego_unsafe_var_error. Reference iteration on the
    right-hand-side (e.g.  some k; v := obj[k]) is unaffected.
    Note: this is a deliberate semantic change, not a fix to
    match documented behavior — the intended semantics of := in
    this case were never specified.
  - WebAssembly runtime: wasmtime-go replaced with wazero (#7557)
    OPA's WebAssembly runtime — used by the wasm evaluation
    target and the WASM SDK — now runs on the pure-Go wazero
    runtime instead of bytecodealliance/wasmtime-go. This removes
    the cgo dependency from this path, so wasm-enabled builds no
    longer need a C toolchain.
    Compiled policy modules are now cached process-wide, so
    repeated VM creation for the same policy skips recompilation.
    On an Apple M4 Max this makes wasm cold start (compile +
    instantiate + first eval) about 73% faster, and warm
    evaluation about 29% faster with ~28% fewer allocations.
  - Configuration validation moved to Rego, with warnings on
    unknown options (#8891)
    Top-level configuration validation and default injection
    (default_decision, default_authorization_decision, labels) is
    now expressed as an embedded Rego policy rather than
    hand-written Go, as is the validation of server.metrics and
    metrics_export.
    The user-visible effect is that unrecognized configuration
    options are reported instead of being silently ignored. A
    typo such as decision_log instead of decision_logs now logs a
    warning at startup:
    {"level":"warning","msg":"unknown configuration option \"decision_log\" encountered"}
    These are warnings, not errors: OPA starts as before, and
    sections that are intentionally user-extensible are left
    alone, so extra keys there do not warn. Embedders reading
    configuration through config.ParseConfig can find the same
    messages on Config.Warnings.
  - Add strings.split_n built-in function (#8344)
    Policies often need only the first or last few parts of a
    split string, but the existing split built-in always returns
    every part, so the count has to be worked around with
    wildcards or a slice.
    strings.split_n takes the first n split parts from the front
    or the back of the string, depending on whether n is positive
    or negative:
    result := strings.split_n("a.b.c.d", ".", 2)
    [#] result == ["a", "b"]
    result := strings.split_n("a.b.c.d", ".", -2)
    [#] result == ["c", "d"]
    If abs(n) is larger than the number of parts, all parts are
    returned. An n of 0 returns an empty array.
  - Improved REPL line editing, with history file migration
    (#962)
    Pasting a tab-indented snippet into the REPL triggered
    tab-completion on the pasted tab, corrupting the input (e.g.
    injecting a completion candidate mid-line and producing a
    spurious parse error).  Fixing that requires bracketed paste,
    where the terminal wraps pasted text in markers so the line
    reader inserts it literally instead of treating an embedded
    tab as a completion request. The previous reader,
    peterh/liner, has no bracketed-paste support and is
    unmaintained (last release 2021), so it has been replaced
    with reeflective/readline.
    The new reader persists history as JSON lines instead of one
    command per line. Existing history files (~/.opa_history by
    default, or the path given to --history) are detected and
    migrated in place the first time the REPL loads them, so
    history written by earlier versions of OPA is kept.  OPA's
    own multi-line buffering is unchanged, and readline's native
    multi-line editing is left disabled to avoid changing REPL
    behavior.
  * Runtime, SDK, Tooling
  - cmd: Avoid intermediate buffer when writing bundle (#8909)
    authored by @anderseknert
  - cmd/build: Add --format flag for proto/JSON plan bundles to
    opa build (#8825) authored by @sspaink
  - cmd/check: Report wrapped structured errors individually
    (#3663) authored by @sspaink, reported by @oren-zohar
  - compile: Preserve package annotations in wasm bundle builds
    (#8854) authored by @srenatus, reported by @me-viper
  - format: Keep rule body inline when the head spans multiple
    lines (#8894) authored by @Kunalbehbud, reported by
    @charlieegan3
  - repl: Use a plain line reader for non-terminal input (#8941)
    authored by @sspaink
  - server: Set ReadHeaderTimeout to 32s on all HTTP servers
    (#8877) authored by @RinZ27
  - server/failtracer: Skip self-referential undefined-ref hints
    (#8916) authored by @srenatus
  - sdk: Allow customizing HTTP RoundTripper per Decision (#8884)
    authored by @paulo-raca
  - sdk: Fix deadlock between OPA.Plugin and manager onCommit
    (#8873) reported and authored by @sspaink
  - tester: Make Result JSON round-trippable (#8014) authored by
    @vsolano9, reported by @anderseknert
  - topdown: Resolve ground refs in --var-values cmd output
    (#7830) authored by @sspaink, reported by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Add support for Go 1.27 &amp; jsonv2 (#8947) authored by
    @anderseknert and @charlieegan3
  - ast: Fix aliased comment buffer in annotation parser (#8757)
    authored by @sspaink, reported by @0hardik1
  - ast: Fix non-deterministic type errors when shadowing a
    built-in (#3729) authored by @sspaink, reported by @srenatus
  - ast: Fix leaky future.keywords.not import in Rego v0 (#8953)
    authored by @johanfylling
  - ast: Fix panic when indexing composite literal values in x in
    [...] (#8918) reported and authored by @srenatus
  - ast: Fix TermValueEqual performance regression (#8863)
    authored by @mchitten
  - ast: Improve rule conflict error (#6391) authored by
    @unichronic, reported by @johanfylling
  - ast: Make CogeneratedExprs return deterministic order (#8895)
    authored by @sspaink
  - ast: Reject partial set and -object rules sharing a name
    (#8860) authored by @sspaink, reported by @shomron
  - ast: Restore location on unsafe var errors for rewritten head
    vars (#8719) authored by @Atishyy27, reported by
    @anderseknert
  - ast: Use more precise return types for object.* builtins
    (#8692) reported and authored by @anderseknert
  - ast+topdown: Let rule external sources distinguish absent
    from unknown (#8878) authored by @srenatus
  - ast+topdown: Parametrized (prefix) external rule sources
    (#8881) authored by @srenatus
  - topdown: Fix "a", "a" in {"a"} not returning true (#8747)
    authored by @anderseknert
  - topdown: Fix format_int precision loss for integers larger
    than 64 bits (#8857) authored by @Synvoya
  - topdown: Fix precision loss for integers larger than 64 bits
    in arithmetic and aggregates (#6281) authored by @Atishyy27,
    reported by @tsandall
  - topdown: Don't leak internal vars in Partial-Evaluation
    results (#6378) authored by @sspaink, reported by @nkey0
  - topdown/copypropagation: Avoid circular reference in
    Partial-Evaluation through call (#6428) authored by @sspaink,
    reported by @nkey0
  - topdown+util: Add generic SliceStack/GroupStack, unify
    refStack/functionMocksStack/saveStack (#8886) authored by
    @srenatus
  - topdown+util: Replace hand-rolled evalFunc/evalBuiltin pools
    with generic ResettablePool (#8886) authored by @srenatus
  - perf: Avoid allocations with custom Atoi and Atoi64 helpers
    (#8758) authored by @anderseknert
  - perf: Lazy init of scalars map in indexer (#8936) authored by
    @anderseknert
  - perf: Reduce allocations in index lookup (#8835) authored by
    @anderseknert
  - planner: Avoid redundant ruletrie.Children() call in Depth()
    (#8886) authored by @srenatus
  - planner: Unify functionMocksStack on generic GroupStack[T]
    (#8886) authored by @srenatus
  * Docs, Website, Ecosystem
  - ecosystem: Add agt-policies-africa — African data protection
    OPA policy pack (#8850) authored by @kingztech2019
  - ecosystem: Add Ghostunnel and NATS Plugin to Ecosystem
    (#8871) authored by @charlieegan3
  - ecosystem: Add Sencillo projects to ecosystem (#8818)
    authored by @hooksie1
  - docs: Add kubecon NA page (#8876) authored by @charlieegan3
  - docs: Add recommendations to follow Envoy's best practices
    (#8944) authored by @johanfylling
  - docs: Document rule indexer support for in, bare refs;
    modernize rego (#8822) authored by @srenatus, reported by
    @tsandall
  - docs: Document the compile metadata annotation (#8824)
    authored by @youdie006, reported by @anderseknert
  - docs: Fix broken OAuth2/OIDC policy examples (#8840) authored
    by @mailnike
  - docs: Fix decision_logs buffer_size_limit_events default in
    prose (#8866) authored by @s3onghyun
  - docs: Remove import rego.v1 (#8867) authored by @charlieegan3
  - docs: Some minor bug fixes to improve reporting (#8917)
    authored by @charlieegan3
  - docs: The Zed Rego extension link points at
    github.com/StyraInc/zed-rego (404). The repo now lives at
    github.com/StyraOSS/zed-rego. (#8883) authored by @mailnike
  - docs: Update cheatsheet files (#8868) authored by
    @charlieegan3
  - docs: Update regal and blog links (#8901) authored by
    @charlieegan3
  - docs: Updates examples to use some...in, add link to debugger
    (#8806) authored by @charlieegan3
  - website: Improve partial evaluation / data filtering
    documentation (#8625) authored by @mmzzuu
  - website: Import blog from medium (#8898) authored by
    @charlieegan3
  * Miscellaneous
  - ast: Add benchmark for rule index ref ordering (#8943)
    authored by @srenatus
  - ast: Various style fixes (#8938) authored by @anderseknert
  - build: Add Dockerfile.rego to validate image builds (#8401)
    authored by @jasdeepbhalla, reported by @anderseknert
  - build: Get just the needed commits for CI (#8940) authored by
    @charlieegan3
  - test: Start decommissioning test.WithTempFS (#8908) authored
    by @anderseknert
  - topdown: Add regression test for partial eval local names
    (#5226) authored by @sspaink, reported by @fab29p
  - topdown: Fix Partial-Evaluation test rejected by new conflict
    check (#8860) authored by @sspaink, reported by @shomron
  - topdown: Vendor a method-less text/template to restore
    whole-binary linker DCE (#7903) authored by @rchildress87,
    reported by @kruskall
  - workflows: Remove cpp from CodeQL language matrix (#8864)
    authored by @sspaink
  - workflows: Prune benchmarks to last 250 runs (#8834) authored
    by @srenatus
  - Dependency updates; notably:
  - build(go): Bump Go from 1.26.4 to 1.26.5 (#8875) authored
    by @srenatus
  - build(deps): Add github.com/reeflective/readline 1.3.0
  - build(deps): Add golang.org/x/term 0.45.0
  - build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.2
    to 4.9.4
  - build(deps): Bump github.com/go-logr/logr from 1.4.3 to
    1.4.4
  - build(deps): Bump github.com/huandu/go-sqlbuilder from
    1.41.0 to 1.42.1
  - build(deps): Bump github.com/prometheus/client_golang from
    1.23.2 to 1.24.0
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    2.5.34 to 2.5.36
  - build(deps): Bump golang.org/x/sync from 0.21.0 to 0.22.0
  - build(deps): Bump golang.org/x/text from 0.38.0 to 0.40.0
  - build(deps): Bump google.golang.org/grpc from 1.81.1 to
    1.82.1
  - build(deps): Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2
    (#8889) authored by @ahbarrios
  - Addressing GHSA-fxhp-mv3v-67qp
  - build(deps): Drop github.com/peterh/liner
  - build(deps): Drop github.com/KimMachineGun/automemlimit
    (#8869) authored by @charlieegan3
  - build(deps): Drop go.uber.org/automaxprocs (#8869) authored
    by @charlieegan3</changelog>
</package>
<package pkgid="dade41e9b7e1f1fef682e55cf7291295692fd506d0dac28a334ef523b6eb368f1f20bf929f455257dd6952ae148ea9049ef4972576efb5295041a892813723f5" name="opa-bash-completion" arch="noarch">
  <version epoch="0" ver="1.19.0" rel="52.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145600">- Update to version 1.12.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Support for String Interpolation in the Rego language
  - Faster compilation and runtime
  - Fixes published in the v1.11.1 release
  * String Interpolation (#4733)
  - The Rego language has been extended to support String
    Interpolation, which provides a readable means to compose
    strings containing dynamic values determined at evaluation
    time.
    An interpolated string is composed of a template-string
    containing zero or more template-expressions that evaluates
    to a value at evaluation time.
    The $ character prefix identifies a template-string, and
    template-expressions are declared by being enclosed in
    curly-braces ({, }).
    Additionally, undefined template-expression values don't halt
    evaluation; instead, &lt;undefined&gt; will be injected into the
    generated string.
    package interpolation
    allowed_roles := ["admin", "employee"]
    default role := "guest"
    role := input.role
    deny contains $"User {input.username}'s role was '{role}', but must be one of {allowed_roles}" if {
    not role in allowed_roles
    }
    {
    "deny": [
    "User &lt;undefined&gt;'s role was 'guest', but must be one of [\"admin\", \"employee\"]"
    ],
    }
    String interpolation is a more readable and less error-prone
    substitute for the sprintf built-in function.
    Authored by @johanfylling reported by @anderseknert
    Tip
    Help us out!
    New Rego language features are exciting, and we want to
    maximize their usefulness. If you come across tools and
    integrations in the community where string interpolation
    isn't properly handled, such as syntax highlighting, please
    reach out and let us know.
  * Runtime, SDK, Tooling
  - oracle: Refactor Oracle better support some and every (#8105,
    [#8131], #8138) authored by @charlieegan3
  - plugins/bundle: Prevent ns-level polling by validating
    intervals (#8082) authored by @jjhwan-h
  - plugins/discovery: Initialize plugins before downloading
    (#8071) authored by @jt28828
  - topdown: Introduce sink for context cancellation
  - topdown: Make regex.replace respect cancellation (#8089)
    authored by @srenatus
  - topdown: Make replace and strings.replace_n respect
    cancellation (#8089) authored by @srenatus
  - topdown: Use sink for concat (#8090) authored by @srenatus
  - perf: Avoid extra allocation in sink if no cancel (#8104)
    authored by @anderseknert
  * Compiler, Topdown and Rego
  - ast/compile: Deal with error limit without panic/defer
    (#8087) authored by @srenatus
  - ast/parser: Check if we need to unescape at all (#8135)
    authored by @srenatus
  - perf: Improved visitor implementation (10% faster
    compilation) (#8078) authored by @anderseknert
  - perf: Reduce allocations handling terms (#8116) authored by
    @anderseknert
  - perf: Type-checker performance improvements (#8143) authored
    by @anderseknert
  * Docs, Website, Ecosystem
  - website: Add support for rego string interpolation syntax
    highlighting (#8092) authored by @charlieegan3
  - docs/ocp: Update "concepts" for v0.3.0 (#8117) authored by
    @srenatus
  - website: Show playground errors (#8141) authored by
    @charlieegan3
  - website: Update a number of links to their new location
    (#8100) authored by @charlieegan3
  - docs: Remove link to feedback form (#8101) authored by
    @charlieegan3
  - website: Remove survey bar (#8136) authored by @charlieegan3
  - docs: Update community contacts (#8108) authored by
    @charlieegan3
  * Miscellaneous
  - ast/checks_test: Fix flaky tests (#8111) authored by
    @srenatus
  - benchmarks: Install node v24 (#8122) authored by @srenatus
  - download: Fix when compiling with tag opa_no_oci (#8070)
    authored by @srenatus reported by @mg0083
  - tests: Race in TestStatusUpdateBuffer (#8133) authored by
    @thevilledev
  - workflow: Integrate benchmarks notebook (#8121) authored by
    @srenatus
  - workflows: Skip all tests in benchmarks run (#8086) authored
    by @srenatus
  - Dependency updates; notably:
  - build: Bump golang from 1.25.4 to 1.25.5 (#8107) authored
    by @srenatus
  - build(deps): Bump google.golang.org/grpc from 1.76.0 to
    1.77.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145601">- Update to version 1.12.1:
  This bug fix release reverts a change to regex.replace that
  unintentionally changed its behaviour for anchored regular
  expressions.
  * Revert "topdown: make regex.replace respect cancellation"
    (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 1.12.2:
  This bug fix release address issues found in the new string
  interpolation feature
  * Add (*TemplateString).Copy() method (#8159) authored by
    @anderseknert
  * Fix template string not serialized with escaped { (#8161)
    authored by @anderseknert
  * fix(ast): skip template string vars in ref safety (#8174)
    authored by @thevilledev
  * fix(ast): use original var names in template error (#8180)
    authored by @thevilledev</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768478400">- Update to version 1.12.3:
  This is a bug fix release addressing two issues:
  * Bundle polling is being misconfigured when discovery bundle is
    updated (#8215)
    This is an issue where the polling interval for discovery
    (discovery.polling.min_delay_seconds and
    discovery.polling.max_delay_seconds) were misinterpreted on
    reconfiguration, causing extremely long update intervals.
  * Decision log size buffer buffer_size_limit_bytes misconfigured
    during reconfiguration (#8213)
    This is a regression in the decision log, where the
    decision_logs.reporting.buffer_size_limit_bytes was mistakenly
    assigned the value of
    decision_logs.reporting.upload_size_limit_bytes during
    reconfiguration.
    This issue is only present when
    decision_logs.reporting.buffer_type is set to size, which is
    the default value.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769774400">- Update to version 1.13.1:
  This bug fix release addresses an issue found in the new
  array.flatten built-in function
  - Fix issue in array.flatten handling of single item arrays
    (#8273) (#8272) authored by @anderseknert
- Update to version 1.13.0:
  This release contains a mix of new features, performance
  improvements, and bugfixes. Notably:
  - A new immediate upload trigger mode in the Decision Logger
  - A new array.flatten built-in function
  - Numerous performance improvements
  * Immediate Upload Trigger Mode in Decision Logger (#8110)
  - An immediate trigger mode has been added to the Decision
    Logger; enabled by setting the
    decision_logs.reporting.trigger configuration option to
    immediate.
    When enabled, log events are pushed to the log service as
    soon as the configured upload chunk size criteria is met; or,
    at latest, when the configured upload delay is reached.
  * Runtime, SDK, Tooling
  - cmd/fmt: Do not overwrite file on fmt without changes (#8222)
    authored by @Loic-R
  - cmd/test: Enable sorting JSON test results by duration
    (#7444) authored by @sspaink
  - profiler: nil *Profiler should not report Enabled() (#8256)
    authored by @anderseknert
  - rego: Add Data function to simplify adding data from map
    (#5961) authored by @majiayu000 reported by @anderseknert
  - runtime: Correct naming &amp; docs for version checking (#8191)
    authored by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Body.String() doesn't panic on empty body (#8244)
    authored by @srenatus
  - ast: Improve type error message when referencing functions
    (#6840) authored by @sspaink
  - ast: Type Checker recognizes when a variable has multiple
    assignments but is an undefined function (#7463) authored by
    @sspaink reported by @anderseknert
  - ast/parser: Avoid duplicate loc copies (#8142) authored by
    @srenatus
  - topdown: Add array.flatten built-in function (#8226) authored
    by @anderseknert
  - topdown: Fix issue where numbers.range_step built-in could
    erroneously return undefined value (#8194) authored by
    @thevilledev
  - topdown: Remove hard-coded missing key error in
    strings.render_template built-in (#7931) authored by
    @colinjlacy reported by @anderseknert
  - topdown: Re-introduce cancellation-awareness for
    regex.replace built-in (#8179) authored by @srenatus
  - from having been reverted in v1.12.1
  - topdown: Support arrays as input for json.match_schema
    (#6615) authored by @sspaink reported by @mscudlik
  * Performance
  - ast: Improved annotations parsing (#8210) authored by
    @anderseknert
  - ast: Reinstate zero-alloc paths in Ref.String() (#8202)
    authored by @anderseknert
  - ast: Replace regex implementation in IsVarCompatibleString
    (#8164) authored by @anderseknert
  - ast: Optimize Set.Intersect and Set.Diff (#8167) authored by
    @thevilledev
  - ast: Optimize Set.Union (#8172) authored by @thevilledev
  - ast: Reduce allocations in Expr.MarshalJSON (#8204) authored
    by @thevilledev
  - ast: Reduce allocations in Rule.MarshalJSON (#8205) authored
    by @thevilledev
  - ast: Reduce allocations in Term.MarshalJSON (#8200) authored
    by @thevilledev
  - ast: Reduce allocations in With.MarshalJSON (#8206) authored
    by @thevilledev
  - perf: String() implementations using appenders (#8192)
    authored by @anderseknert
  - topdown: Avoid redundancy in builtinTrim (#8237) authored by
    @thevilledev
  - topdown: Eliminate closure allocations in Set and virtual doc
    enumeration (#8242) authored by @alex60217101990
  - topdown: Fast paths for array.reverse (#8177) authored by
    @thevilledev
  - topdown: Optimize json.remove and json.filter (#8193)
    authored by @thevilledev
  - topdown: Optimize object built-ins (#8175) authored by
    @thevilledev
  - topdown: Optimize union built-in (#8173) authored by
    @thevilledev
  - topdown: Pre-alloc in various built-ins (#8198) authored by
    @thevilledev
  - topdown: Reduce allocs in float sum/product (#8235) authored
    by @thevilledev
  - topdown: Skip set copy in getObjectKeysParam (#8176) authored
    by @thevilledev
  * Docs, Website, Ecosystem
  - docs: Add authz-spring-boot-starter to Spring Security API
    ecosystem entry (#8234) authored by @francois-eckert
  - docs: Add header for crypto example to make (#8259) authored
    by @charlieegan3
  - docs: Add notes for automated agents (#8147, #8203) authored
    by @charlieegan3
  - docs: Add opa-wasm-zig to the ecosystem (#8163) authored by
    @burdzwastaken
  - docs: Add scripts to import docs from source (#8148) authored
    by @charlieegan3
  - docs: Explain how to use the SDK without a initialising a
    server (#8248) authored by @andrewcameronsims
  - docs: Fix a number of redirecting links (#8165 authored by
    @charlieegan3
  - docs: Fix template-expression examples (#8199) authored by
    @johanfylling
  - docs/ocp: Mention source prefix/path options (#8238) authored
    by @srenatus
  - website: Add redirect section for immutable referrers (#8262)
    authored by @charlieegan3 reported by @KraLeoD
  - website: Display 2025 survey results on the website (#8258)
    authored by @charlieegan3
  - website: Show breadcrumbs in search results (#8207) authored
    by @charlieegan3
  * Miscellaneous
  - Decoupled the Rego job check from the Go job checks in the
    Github PR workflow (#8203) authored by @SeanLedford
  - build: Format pr_check.rego with opa fmt (#8201) authored by
    @thevilledev
  - build: Migrate PR check to OPA policy (#8183) authored by
    @SeanLedford
  - build: Run go get against main to spot redacted (#8146)
    authored by @charlieegan3
  - deps: Switch to maintained go.yaml.in/yaml/v3 yaml library
    (#8182) authored by @mrueg
  - test/cases: Increase yaml test coverage for some regex and
    string builtins (#8152) authored by @srenatus
  - Dependency updates; notably:
  - build: bump golang from 1.25.5 to 1.25.6 (#8224) authored
    by @srenatus
  - build(deps): bump go.opentelemetry.io deps from
    1.38.0/0.63.0 to 1.39.0/0.64.0
  - build(deps): bump klauspost/compress from v1.18.1 to
    v1.18.2 (#8184) authored by @srenatus
  - because of redaction warning
  - build(deps): bump github.com/go-ini/ini from v1.67.0 to
    gopkg.in/ini.v1 v1.67.1 (#8208) authored by @gabrpt</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1771416000">- Update to version 1.13.2:
  This release updates the version of Go used to build the OPA
  binaries and images to 1.25.7.
  That version of the Go standard library contains a fix for
  GO-2026-4337.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772193600">- Update to version 1.14.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Improved rule indexing of variable assignments and x in {...}
    expressions
  - Support for --h2c with unix domain socket for opa run
  - A new glossary tooltip for technical terms in the docs
  - Fixes published in the v1.13.1 and v1.13.2 releases
  * Improved rule indexing of variable assignments and x in {...}
    expressions (#1841)
    With this change, the rule indexer will index expressions like:
    allow if input.role in {"admin", "user"}
    On lookup, the rule body will only be returned if input.role is
    either one of "admin" or "user".
    The reverse case is also indexed:
    allow if "admin" in input.roles
    in which the searched collection is unknown.
  * Runtime, SDK, Tooling
  - cmd,run: Support --h2c with unix domain socket (UDS) (#8282)
    authored by @srenatus reported by @theJC
  - cmd,tester: Add line number next to test file in pretty
    format (#8328) authored by @sspaink reported by @anderseknert
  - plugins: Fix race accessing registeredTriggers (#8363)
    reported and authored by @szuecs
  - rego: Add ResultValue[T]() helper method (#8320) authored by
    @srenatus
  - runtime: Add custom storage backend registration API (#8277)
    authored and reported by @alex60217101990
  - topdown: Add config option to disable named inter-query
    built-in cache (#7519) authored by @sspaink reported by
    @johanfylling
  * Compiler, Topdown and Rego
  - ast: Add index else == nil test, fix it (#8348) authored by
    @srenatus
  - ast: Add scaffolding to introspect and skip compiler stages
    (#8304) (authored by @srenatus)
  - ast: Ensure term values implement ast.StringLengther (#8374)
    authored by @charlieegan3
  - ast: Fix double-fix for refs["with-a"].dash as package
    (#8286) authored by @srenatus
  - ast: Optimized template-expression handling of values known
    to be defined (#8310) authored by @anderseknert
  - ast: Put rule indices into rule tree, change Values to
    []*Rule (#8298) authored by @srenatus
  - ast: Replace true expr when appending to empty body (#8299)
    authored by @anderseknert
  - ast: Return correct location of unsafe var in object (#7935)
    authored by @sspaink reported by @anderseknert
  - ast: Use StageID in WithStageAfterID, also for QueryCompiler
    (follow-up) (#8306) authored by @srenatus
  - compile: Add StringLength to lazy object (#8369) authored by
    @charlieegan3 reported by @robmyersrobmyers
  - parser: Add test to verify filename interning in Location
    (#8322) authored by @anderseknert
  - perf: Allocate less in array unification (#8351) authored by
    @anderseknert
  - perf: Various minor eval performance tweaks (#8290) authored
    by @anderseknert
  - perf: json.patch + interning improvements (#8289) authored by
    @anderseknert
  - topdown: Optimize bindings allocation with dynamic pre-sizing
    (#7266) authored by @alex60217101990
  - topdown: Preserve original package name with special
    characters in optimized builds (#8284) authored by @sspaink
    reported by @at50989
  - wasm: Updates (LLVM+tools) (#8295) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs: Add examples to glob.match built-in documentation
    (#8252) authored by @sibasispadhi reported by @anderseknert
  - docs: Add workflow to auto update Regal docs (#8318) authored
    by @charlieegan3
  - docs: Document metrics for http.send, regex, and glob
    built-ins (#6730) authored by @anivar reported by @rudrakhp
  - docs: Fix json.patch target description (#8271) authored by
    @anderseknert
  - docs: Update broken links (#8285) authored by @charlieegan3
  - docs: Update bundle signing docs to clarify key config
    (#8307) authored by @charlieegan3
  - docs: Update faulty example using bundle optimize (#5379)
    authored by @sspaink reported by @bluebrown
  - docs: Update interface{} -&gt; any in golang snippets (#8373)
    authored by @srenatus
  - docs/website: Add a new KubeCon event page (#8311) authored
    by @charlieegan3
  - docs/website: Add formatting and linting checks (#8288)
    authored by @charlieegan3
  - docs/website: Allow Regal import to use local dir (#8312)
    authored by @charlieegan3
  - docs/website: Implement new GlossaryTooltip component (#8367)
    authored by @charlieegan3
  - docs/website: Markdown linting and spell checking for
    documentation (#8292) authored by @charlieegan3
  - docs/website: Redirect /docs/latest/ecosystem (#8315)
    authored by @charlieegan3 reported by @tweekSun1
  * Miscellaneous
  - maintainers: Moving nilekhc to emeritus, and renew maintainer
    terms (#8276) authored by @JaydipGabani
  - ast: Add public method to extend the compliance test cases
    with IR plans (#7556) authored by @sspaink reported by
    @shomron
  - ast: Tiny nitpicky cleanup (#8309) authored by @srenatus
  - chore: Clean up bundle storage tests (#8267) authored by
    @anderseknert
  - chore: Remove unnecessary comment from bundle JWT
    verification impl (#8354) authored by @johanfylling
  - ci: Bump golangci-lint (v2.9.0), fix issues (#8314) authored
    by @srenatus
  - ci: Harden and update all GH Actions workflows (#8356, #8377,
    [#8368] authored by @philipaconrad and @srenatus
  - go: Cleanup old build flags (#8314) authored by @srenatus
  - rego: Remove superfluous package import of plugins (#6754)
    authored by @srenatus reported by @oxisto
  - tests: Extract runtime Info to new package (#8362) authored
    by @charlieegan3
  - tests: Fix BenchmarkFunctionArgumentCounts query (#8327)
    authored by @alex60217101990
  - tests: Disable rule indexing for benchmark (#8375) authored
    by @srenatus
  - workflows: Add nightly vuln checks for released
    versions/images (#8336 #8339) authored by @srenatus
  - Dependency updates; notably:
  - build: bump golang from 1.25.6 to 1.26.0
  - build(deps): build(deps): bump go.opentelemetry.io deps
    from 1.39.0/0.64.0 to 1.40.0/0.65.0
  - Applying fix for GHSA-9h8m-3fm2-qjrq
  - build(deps): bump github.com/dgraph-io/badger/v4 from 4.9.0
    to 4.9.1
  - build(deps): bump github.com/huandu/go-sqlbuilder from
    1.39.0 to 1.39.1
  - build(deps): bump golang.org/x/net from 0.49.0 to 0.50.0
  - build(deps): bump golang.org/x/text from 0.33.0 to 0.34.0
  - build(deps): bump google.golang.org/grpc from 1.78.0 to
    1.79.1
  - build(deps): bump go.opentelemetry.io deps from
    1.39.0/0.64.0 to 1.40.0/0.65.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773057600">- Update to version 1.14.1:
  This is a patch release collecting two bug fixes and various
  dependency updates for Golang standard library and common package
  vulnerabilities.
  These bug fixes include a revert of the rule indexer tweaks
  shipped in 1.14.0, which had caused unexpected lookup failures
  for some users. (We expect to properly fix the issue in 1.15.0,
  but for now, a revert is the quicker choice.)
  * Changes
  - Fix intermittent plugins manager deadlock on opa.configure
    (#8407)
  - Revert "ast: make rule index track var assignments and x in
    {...} (#8341)" (#8410)
  - build: bump deps (go.mod from main)
  - build: bump go 1.26.1 (#8409)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774612800">- Update to version 1.15.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Add logger plugin interface and file logger implementation
    with log rotation
  - Custom HTTPAuthPlugin behavior change, all per-request
    authentication logic must be moved from NewClient() to
    Prepare()
  - AWS signing supports for web identity for assume role
    credentials
  * Logger Plugin Support (#8434) (authored by @srenatus)
    OPA now supports pluggable logging implementations via the
    logger plugin interface, which is based on Go's standard
    log/slog.Handler interface. This allows any slog.Handler
    implementation to be used as a logger plugin. Loggers can be
    configured via the server.logger_plugin configuration option
    and used for both runtime logging and decision logs. OPA
    includes a built-in file logger plugin (file_logger) that
    writes structured JSON logs with rotation support using
    lumberjack. Users can also implement and register custom logger
    plugins when building OPA.
    Example configuration for server logging:
    server:
    logger_plugin: file_logger
    plugins:
    file_logger:
    path: /var/log/opa/server.log
    max_size_mb: 100
    max_age_days: 28
    max_backups: 3
    compress: true
    level: info
    Example configuration for decision logs using the same plugin:
    server:
    logger_plugin: file_logger
    decision_logs:
    plugin: file_logger
    plugins:
    file_logger:
    path: /var/log/opa/server.log
    max_size_mb: 100
    max_age_days: 28
    max_backups: 3
    compress: true
    level: info
  * Custom HTTPAuthPlugin behavior change (#8376) (authored by @srenatus)
    The HTTPAuthPlugin.NewClient() method is now called once per
    Client instance and cached rather than being called for every
    request. Custom plugins that performed per-request operations
    in NewClient() (such as request counters, per-request transport
    wrapping, or logging/metrics side effects) will now only
    execute those operations once. All per-request authentication
    logic must be moved from NewClient() to Prepare(). All plugins
    included in OPA have been updated and are unaffected by this
    change.
  * Runtime, SDK, Tooling
  - plugins/logger: Add logger plugin interface and file logger
    implementation with log rotation (#8434) (authored by
    @srenatus)
  - plugins/logs: Decision logs can now use logger plugins for
    output (#8434) (authored by @srenatus)
  - logging: Add BufferedLogger to capture early startup logs
    before plugins are initialized (#8434) (authored by
    @srenatus)
  - plugins/rest: Configurable re-read interval for TLS client
    certificates via cert_reread_interval_seconds field.
    Defaults to re-reading on every request for backwards
    compatibility.  The implementation also uses content hashing
    to detect changes and avoid re-parsing unchanged TLS
    certificates and keys. (#8376) (authored by @srenatus)
  - plugins/rest: All TLS configurations now inherit the minimum
    version and TLS ciphersuites as configured for the server.
    (#8376) (authored by @srenatus)
  - internal/providers/aws: Refactor deprecated crypto/elliptic
    APIs to crypto/ecdh (#8395) (authored by @kanywst)
    plugins/rest: AWS Signing - Allow Service Account (Web
    Identity) credentials for Assume Role Credentials (#8386) (
    authored by @tiagogviegas)
  * Compiler, Topdown and Rego
  - ast: fix overlapping array and scalar pattern in rule index
    (authored by @srenatus)
  * Bundles
  - optimized bundles: filter metadata comments properly ( #8388)
    (#6529) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs(ecosystem): add Kopa ecosystem entry (#8405) (authored
    by @sfreet)
  - docs: Update KubeCon event listing (#8439) (authored by
    @charlieegan3)
  - docs: fix input of partial-evaluation example (#8430)
    (authored by @edobrb)
  - ecosystem: add Big ACL (#8389) (authored by @francois-eckert)
  - Regal v0.39.0 doc updates (#8383) (authored by @anderseknert)
  * Miscellaneous
  - build/generate-extended-cases: Fix testcase loader to use
    json.Number. (#8429) (authored by @philipaconrad)
  - Filter compliance test cases using capabilities file (#8418)
    (authored by @sspaink)
  - Fix intermittent plugins manager deadlock on opa.configure
    (#8407) (authored by @sspaink)
  - Linter configuration cleanup (#8397) (authored by
    @anderseknert)
  - fix nightly.yaml by moving secret to env (#8381) (authored by
    @sspaink)
  - fix release-vulnerability-check.yaml (authored by @sspaink)
  - nightly+release-vuln-check: add links to slack msg payloads
    (authored by @srenatus)
  - Dependency updates; notably:
  - build: bump go 1.26.1 (#8409) (authored by @srenatus)
  - gha: bump trivy-action (authored by @srenatus)
  - build(deps): bump google.golang.org/grpc from 1.79.1 to
    1.79.3 (#8428) (authored by @dependabot[bot])
  - build(deps): bump github.com/vektah/gqlparser/v2 from
    2.5.31 to 2.5.32 (#8399) (authored by @dependabot[bot])
  - build(deps): bump modernc.org/sqlite from 1.45.0 to 1.46.1
    (#8399) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/time from 0.14.0 to 0.15.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump github.com/microsoft/go-mssqldb from
    1.9.6 to 1.9.7(#8412) (authored by @dependabot[bot])</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774872000">- Update to version 1.15.1:
  * Miscellaneous
  - logging: make WithContext() optional (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775736000">- Update to version 1.15.2:
  No changes related to the openSUSE package, only GitHub release
  workflow updates (use go1.26.2)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777550400">- Update to version 1.16.0:
  This release contains a mix of new features, performance
  improvements, and bugfixes. Notably:
  - New uri.parse and uri.is_valid built-in functions
  - Data API Request/Response Metadata
  - Prometheus metrics exported via OTLP
  - Formatter improvements
  NOTE:
  In v1.15.x, OPA was dropping logs for bundle downloads, print()
  calls and other plugin-originated logs.
  Users are advised to update, v1.16.0 fixes this bug in (#8544).
  * New uri.parse and uri.is_valid built-in functions (#8263)
    Two new built-in functions have been added: uri.parse for
    parsing a given URI, and uri.is_valid for verifying the
    structure of a given URI.
  - uri.parse
    Parses a URI and returns an object containing its components
    according to RFC 3986. Empty components are omitted.
    package example
    test_uri if {
    uri.parse("https://example.com:8080/api?q=1#top") == {
    "scheme": "https",
    "hostname": "example.com",
    "port": "8080",
    "path": "/api",
    "raw_path": "/api",
    "raw_query": "q=1",
    "fragment": "top",
    }
    }
  - uri.is_valid
    Returns true if the input can be parsed as a URI, false otherwise.
    package example
    deny contains "invalid URI" if {
    not uri.is_valid("http://[invalid")
    }
  * Data API Request/Response Metadata (#8570)
    Wrapping projects can now attach custom metadata to Data API
    requests and have evaluation produce response metadata.
    Two distinct metadata paths are introduced:
  - Request metadata: parsed from extra top-level keys in the
    request body, made available to builtins via
    BuiltinContext.RequestMetadata. Logged in the decision log
    under Custom["request_metadata"].
  - Response metadata: a separate map
    (BuiltinContext.ResponseMetadata) that builtins can populate
    during evaluation. Only included in the API response and
    decision log if non-empty.
    In vanilla OPA, no builtins write response metadata, so
    responses are unchanged. The request metadata map is only
    allocated when the request carries extra fields; the response
    map is one empty map per request.
    To avoid conflicts with future OPA top-level keys, callers
    should use a namespaced key: {"input": {...},
    "com.example.opa/md": {...}}.
    Request with metadata:
    curl -H 'Content-Type: application/json' \
  - d '{"input": {"user": "alice"}, "com.example.opa/metadata": {"corp-id": "acme-42"}}' \
    http://localhost:8181/v1/data/example/allow
    Response (response metadata included if, for example, set by a
    custom builtin):
    {
    "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
    "result": true,
    "com.example.opa/response": {
    "snapshot_version": "v3"
    }
    }
    Decision log entry:
    {
    "custom": {
    "request_metadata": {
    "com.example.opa/metadata": {
    "corp-id": "acme-42"
    }
    },
    "response_metadata": {
    "com.example.opa/response": {
    "snapshot_version": "v3"
    }
    }
    },
    "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
    "input": { "user": "alice" },
    "msg": "Decision Log",
    "path": "example/allow",
    "result": true
    }
  * Runtime, SDK, Tooling
  - distributedtracing: Export Prometheus metrics via OTLP
    (#7591) reported and authored by @Munken
  - cmd,tester: Update opa test to stream test case results
    (#3676) authored by @sspaink reported by @tsandall
  - cmd,tester: Show full errors when test fails and using
  - -coverage (#8438) authored by @grosser
  - format: Add new line between METADATA blocks (#8483) authored
    by @sspaink
  - format: Allow indenting all withs in expression (#8508)
    authored by @anderseknert
  - format: Fix dropping comments after handling
    unexpectedCommentError (#8553) authored by @sspaink
  - format: Preserve location of trailing comments inside every
    body (#8558) authored by @johanfylling
  - format: Prevent opa fmt from formatting single attribute
    objects with comments (#7565) authored by @sspaink reported
    by @anderseknert
  - logging: Keep forwarding from BufferedLogger after Flush()
    (#8544) authored by @srenatus reported by @annieyhuang
  - plugins/logs: Fix logBuffer eviction loop only dropping one
    element (#8543) authored by @sspaink
  - plugins/logs: Fix out-of-order plugin status notifications
    (#8009) authored by @sspaink reported by @Pushpalanka
  - plugins/rest: Carry over all of *tls.Config (#8473) authored
    by @srenatus reported by @ashu2496
  - server: Drop HTML index page query form (#8477) authored by
    @johanfylling reported by @srenatus and @r0binak
  - server: Skip chmod for abstract Unix domain sockets (#8536)
    authored by @bakayolo
  - storage/inmem: Avoid allocations from Read() in MakeDir()
    (#8561) authored by @srenatus
  - tester: Add method to match tests by ref prefixes (#6696)
    authored by @anderseknert
  - Note: Experimental.
  * Compiler, Topdown and Rego
  - ast: Allow Back-to-back metadata blocks (#8482) authored by
    @sspaink reported by @johanfylling
  - ast: Catch functions in dynamic extent of ref head rule
    (#8461) authored by @srenatus reported by @johanfylling
  - ast: Fix parenthesis in String() of {obj,arr,set}
    comprehensions (#8511) authored by @srenatus
  - ast: Fix parsing of unary - in front of a ref (#5014)
    authored by @mmzzuu reported by @philipaconrad
  - ast: Fix type checker match error for objects with set keys
    (#6260) authored by @sspaink reported by @tsandall
  - ast: Fix type checker to recognize numeric index in generated
    map (#6736) authored by @sspaink reported by @anderseknert
  - ast: Handle underdetermined function args (#5234) authored by
    @sspaink reported by @obataku
  - ast: Identify compatible type from reference in type checker
    (#7273) authored by @sspaink reported by @anderseknert
  - ast: Support recursive JSON Schemas (#6099) authored by
    @sspaink reported by @anderseknert
  - builtins: Add support for days, weeks and years in
    time.parse_duration_ns built-in function (#2719) authored by
    @sspaink reported by @freeseacher
  - builtins: Fix graph.reachable_paths to return all reachable
    paths (#5871) authored by @davidmarne-wf reported by
    @ericjkao
  - builtins: Limit exponent size in units.parse_bytes built-in
    function to prevent timeout bypass (#8326) authored by
    @isaiahvita reported by @anderseknert
  - perf: Add CopyNonGround() methods for Array, Set, and Object
    (#8323) authored by @alex60217101990
  - resolver/wasm: Add NewWithContext to allow passing context
    (#8499) authored by @dominikschulz
  * Docs, Website, Ecosystem
  - docs: Add aggregates examples for count and sum built-in
    functions (#8566) authored by @alliasgher reported by
    @srenatus
  - docs: Add generated output.jsons for docs examples (#8535)
    authored by @charlieegan3
  - docs: Add spec for OCP bundle status tracking API (#8502)
    authored by @ashutosh-narkar
  - docs: Add the latest videos to the README presentations
    section (#8523) authored by @sspaink
  - docs: Add Windows development notes to dev reference guide
    (#8422) authored by @raajheshkannaa
  - docs: Fix input value type in not undefined example (#8580)
    authored by @menma1234
  - docs: Update Regal docs to v0.40.0 (#8538) authored by
    @charlieegan3
  - docs: Updated roadmap link (#8501) authored by @johanfylling
  - docs: Various typo fixes (#8529) authored by @sspaink
  - ecosystem: Add vulnetix ecosystem entry (#8532) authored by
    @0x73746F66
  - ecosystem: Add KubeStellar Console (#8560) authored by
    @clubanderson
  - website: Add banner to show when event has passed (#8493)
    authored by @charlieegan3
  - website: Add copy-as-markdown button to doc pages (#8540)
    authored by @charlieegan3
  - website: Copy button improvements (#8577) authored by
    @charlieegan3
  - website: Remove old redirects, add new management redirect
    (#8424) authored by @charlieegan3 reported by @narainar
  - website: Update intro video on homepage (#8547) authored by
    @charlieegan3
  * Miscellaneous
  - build: Exclude domains that cause false positives (#8533)
    (#8495) authored by @charlieegan3
  - e2e/cli: Add test for debug print() logging (#8567) authored
    by @srenatus
  - e2e/cli: Start CLI E2E tests (#8545) authored by @srenatus
  - github: declare formatted rego as rego (#8564) authored by
    @srenatus
  - Security policy update (#8479) authored by @anderseknert
  - Dependency updates; notably:
  - build: bump go 1.26.2 (#8497) authored by @sspaink
  - build(deps): bump wasmtime-go from v39.0.1 to v43.0.2
  - build(deps): bump go.opentelemetry.io deps from
    1.40.0/0.65.0 to 1.43.0/0.68.0
  - build(deps): bump github.com/containerd/containerd/v2 from
    2.2.1 to 2.2.3
  - build(deps): bump ithub.com/huandu/go-sqlbuilder from
    1.39.1 to 1.40.2
  - build(deps): bump golang.org/x/net from 0.51.0 to 0.53.0
  - build(deps): bump golang.org/x/text from 0.34.0 to 0.36.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777636800">- Update to version 1.16.1:
  This is a patch release addressing a regression in the plugin
  manager that may cause the service to hang on shutdown (#8590).</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.16.2:
  This release updates the version of Go used to build the OPA
  binaries and images to 1.26.3; addressing a number of
  vulnerabilities.
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
  This is CVE-2026-42501 and Go issue https://go.dev/issue/79070
  * build: bump go 1.26.2 -&gt; 1.26.3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 1.17.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - A new future.keywords.not import that adds improved semantics
    to the not keyword.
  - Rule Labels in Decision Logs
  - Published json schema for IR and bundle manifest
  - Dropped automaxprocs and x/net dependencies
  * Improved Negation Semantics (#8387)
    This OPA release introduces a new future.keywords.not import
    that fixes a long-standing semantic issue with negation in
    Rego.
    Without the import, the compiler expands a negated composite
    expression like not f(g(input.x)) into a series of
    sub-expressions evaluated before the not:
    __local0__ = input.x
    g(__local0__, __local1__)
    not f(__local1__)
    If any sub-expression fails — for example, input.x is undefined
    or g produces an undefined result — the entire rule fails
    rather than the not succeeding.  This is unintuitive: the
    user's intent is "the condition does not hold," but an
    undefined intermediate value causes a silent failure instead of
    the expected not result.
    With import future.keywords.not, composite-expression negation
    wraps the full compiler expansion in an implicit body:
    not { __local0__ = input.x; g(__local0__, __local1__); f(__local1__) }
    Now, if any sub-expression is undefined or fails, the body is
    unsatisfiable and the not expression succeeds; matching the
    intuition that "the condition does not hold."
    NOTE:
    Users are recommended to import future.keywords.not whenever
    the not keyword is used in a policy.
  * Rule Labels in Decision Logs (#2089)
    Rule annotations now support a labels field. Labels from all
    successfully evaluated rules are collected and included in each
    decision log entry as a top-level rule_labels array. Each
    element is the merged label map for one successfully evaluated
    rule, with inner-scope-wins precedence across the rule's
    annotation chain (subpackages &lt; package &lt; document &lt; rule).
    Merged maps are deduplicated across rules so that identical
    label sets collapse to a single entry.
    [#] METADATA
    [#] scope: package
    [#] labels:
    [#]   service: authz
    [#]   severity: info
    package myapp
    [#] METADATA
    [#] labels:
    [#]   severity: low
    [#]   team: platform
    allow if input.role == "admin"
    The resulting decision log entry will contain:
    {"rule_labels": [{"service": "authz", "severity": "low", "team": "platform"}]}
    Note how severity: info from the package scope is overridden by
    severity: low from the rule scope. Queries against rule_labels
    can now rely on each entry carrying the full label context for
    a single rule, rather than one entry per contributing scope.
    Both the runtime and the Go SDK now process metadata
    annotations by default.
  * Runtime, SDK, Tooling
  - ast: Allow $ref in allOf in JSON schemas (#6523) authored by
    @deeglaze reported by @mosiac1
  - bundle: Update bundle roots conflict detection algorithm.
    (#8664) authored by @philipaconrad
  - download: Use oras, not containerd (#8639) authored by
    @srenatus
  - server: Remove dead code (s.partials) (#8708) authored by
    @srenatus
  - server: Wire in response/request metadata for compile handler
    (#8650) authored by @srenatus
  - server/types: generalize request/response metadata (#8650)
    authored by @srenatus
  * Compiler, Topdown and Rego
  - builtins: Enable pattern validation in json.verify_schema and
    json.match_schema built-in functions (#6089) authored by
    @sspaink reported by @ewout8
  - ir: Don't capitalize index field in MakeNumberRefStmt IR
    statement (#6266) authored by @sspaink reported by
    @johanfylling
  - perf: Avoid allocating in binary and/or operators when
    possible (#8689) authored by @anderseknert
  - rego: Allow per-eval GenerateJSON function (#8690) authored
    by @anderseknert
  * Docs, Website, Ecosystem
  - ecosystem: add OPA MCP (#8618) authored by @OrygnsCode
  - docs: Add explicit address binding to examples (#8688)
    authored by @charlieegan3
  - docs: Add titles to code blocks in policy-testing (#8649)
    authored by @charlieegan3
  - docs: Correct OCP SSH key docs (#8675) authored by @taurelius
  - docs: Update diagram to match index examples (#8667) authored
    by @charlieegan3
  * Miscellaneous
  - ast,storage/inmem: Add inmem.NewFromASTObject and add missing
    string case to ast.InternedValue (#8707) authored by
    @anderseknert
  - build: go install -&gt; go install tool to control checksums
    (#8646) authored by @srenatus
  - build: Push edge binaries to bucket (#8668) authored by
    @charlieegan3
  - workflows: Fix benchmarks workflow (replace action, avoid
    stackoverflow) (#8655) authored by @srenatus
  - workflows: Note improvements in benchmark comments (#8673)
    authored by @srenatus
  - Generate a JSON Schema for the IR plan (#8662) authored by
    @sspaink reported by @kroekle
  - Generate a JSON Schema for the bundle manifest (#8661)
    authored by @sspaink reported by @kroekle
  - Dependency updates; notably:
  - build(deps): Remove automaxprocs dependency (#8696)
    authored by @anderseknert
  - build(deps): Remove direct x/net dependency (#8697)
    authored by @anderseknert
  - build(deps): Bump github.com/bytecodealliance/wasmtime-go
    from 43.0.2 to 44.0.0 (8652) authored by @srenatus
  - build(deps): Bump github.com/fsnotify/fsnotify from 1.9.0
    to 1.10.1
  - build(deps): Bump github.com/huandu/go-sqlbuilder from
    1.40.2 to 1.41.0
  - build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.0
    to 3.1.1
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    2.5.32 to 2.5.33
  - build(deps): Bump google.golang.org/grpc from 1.80.0 to
    1.81.0
  - build(deps): Bump gopkg.in/ini.v1 from 1.67.1 to 1.67.2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780920000">- Update to version 1.17.1:
  This release uses the latest version of Go (1.26.4) to build OPA,
  fixing stdlib vulnerabilities in code that OPA's HTTP handler and
  crypto builtins use:
  - https://pkg.go.dev/vuln/GO-2026-5039
  - https://pkg.go.dev/vuln/GO-2026-5037
  It is otherwise the same code as v1.17.0.
  * Miscellaneous
  - build: bump go 1.26.3 -&gt; 1.26.4 (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782648000">- Update to version 1.18.0:
  This release contains a mix of bugfixes and small features.
  Notably:
  - A breaking fix to the outbound User-Agent header so it conforms
    to RFC 9110 (see below)
  - Container-aware resource limits: automatic GOMAXPROCS is
    restored and automatic GOMEMLIMIT is now supported
  - Several opa fmt correctness fixes
  - Improvements to opa test --coverage (ranges in report, inline
    rule head tracking, conjunction-expression coverage)
  * Breaking: Fix User-Agent according to RFC9110 (#8792)
  - OPA's outbound HTTP requests (bundle, discovery, decision
    log, status, http.send, AWS KMS/ECR) previously sent
    User-Agent: Open Policy Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;), which
    is not a valid RFC 9110 User-Agent value because the product
    token cannot contain spaces. The header is now
    Open-Policy-Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;). Server-side log
    filters or WAF rules that exact-match the old string will
    need to be updated.
  * Runtime, SDK, Tooling
  - bundle: fix per-module rego version lookup (#8797) authored
    by @sspaink, reported by @xubinzheng
  - bundle: improve determinism of file_rego_versions patterns
    with overlap (#8733) authored by @philipaconrad
  - cover: Track inline rule head in post trace walk (#6531)
    authored by @charlieegan3, reported by @anderseknert
  - cover: Update report to include ranges (#8748) reported and
    authored by @charlieegan3
  - cover: Add support for coverage of conjunction exprs (#8809)
    authored by @charlieegan3
  - download/oci: Set Accept headers (#8720) authored by
    @charlieegan3
  - fmt: preserve the multiline but single entry iterables
    (#8557) authored by @unichronic, reported by @anderseknert
  - format: Fix dropped with-clause after comment in object value
    (#8765) authored by @sspaink, reported by @srabraham
  - format: keep lone with on the closing-bracket line of
    multi-line expressions (#8804) authored by @anneheartrecord,
    reported by @burnster
  - oracle: Fix find-definition on expressions inside ast.Not
    nodes (#8731) authored by @johanfylling
  - runtime: Restore goautomaxprocs, add automemlimit (#8784)
    authored by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Apply location to inner ast.Not expressions (#8717)
    authored by @johanfylling, reported by @anderseknert
  - ast: Clean up code for value comparisons (#8737) authored by
    @anderseknert
  - ast: Fix PE regression for future.keywords.not negation
    inside every (#8781) authored by @johanfylling
  - internal/edittree: Add recursive tree node recycling (#8693)
    authored by @philipaconrad
  - internal: compile,planner: improve determinism of plan/wasm
    bundle builds (#8732) authored by @philipaconrad
  - perf: avoid allocations in object.get (#8729) authored by
    @anderseknert
  - topdown: Fix PE not namespacing vars in comprehensions nested
    inside every (#8816) authored by @johanfylling
  - topdown: remove dst.Compare(src) shortcut (#8739) authored by
    @srenatus
  - topdown: skip strconv.ParseInt in format_int base-10 fast
    path (#8801) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs/chore: Remove broken links (#8714) authored by
    @charlieegan3, reported by @github-actions
  - docs: PoC for kapa.ai (#8125) reported and authored by
    @charlieegan3
  - docs(ecosystem): update OPA MCP entry with video, blog, and
    distribution links (#8712) authored by @OrygnsCode
  - docs/contributing: add formatting (#8740) authored by @mmzzuu
  - docs: Add SDK references for evaluating IR plans (#8783)
    authored by @charlieegan3
  - docs: Add depkeep to enterprise support (#8685) authored by
    @pkuzco
  - docs: Add notes about use of GOMEMLIMIT (#8771) authored by
    @charlieegan3
  - docs: Add we/our/us check to spell check (#8787) authored by
    @charlieegan3
  - docs: Update built-in index page titles (#8728) authored by
    @charlieegan3
  - docs: Update documentation to be more consistent and sound
    more like reference docs (#8786) authored by @charlieegan3
  - docs: Update regal docs for 0.41.1 release (#8730) authored
    by @charlieegan3
  - docs: Update to agents.md regarding security dependences
    'fixes' (#8754) authored by @charlieegan3
  - docs: clarify environment variable substitution behaviour
    (#8713) authored by @taurelius
  - docs: remove duplicated word in Rego style guide (#8800)
    authored by @s3onghyun
  - website: Add .md alternate content types for llms (#8725)
    authored by @charlieegan3
  - website: Add support page disclaimer and sort by date added
    (#8736) authored by @charlieegan3
  - website: Fix build from missing dateAdded (#8764) authored by
    @charlieegan3
  - website: Update docusaurus (#8756) authored by @charlieegan3
  - website: Update homepage AI example to tool calls (#8755)
    authored by @charlieegan3
  - website: Various updates to node and website deps (#8768)
    authored by @charlieegan3
  - website: add ossrisk to ecosystem (#8780) authored by @pkuzco
  * Miscellaneous
  - benchmarks: smaller tweaks (#8759) authored by @srenatus
  - benchmarks: split off script, emit markdown table (#8812)
    authored by @srenatus
  - benchmarks: use details+summary comments for benchlab results
    (#8811) authored by @srenatus
  - capabilities: Integrate 1.17.1 patch release (#8798) authored
    by @sspaink
  - chore: tidy go.mod to remove untagged versions (#8791)
    authored by @thaJeztah
  - e2e: Add proto schemas for the IR plan and bundle manifest
    (#8766) reported and authored by @sspaink
  - gha: deduplicate change-detection output in pr CI checks
    (#8808) authored by @sspaink
  - nightly: use regal@main (#8735) authored by @srenatus
  - workflow: remove tests from docker (edge) image build (#8721)
    authored by @srenatus
  - workflows: bring back docker edge tags for post-merge (#8718)
    authored by @srenatus
  - workflows: use go-version-file with actions/setup-go (#8751)
    authored by @srenatus
  - Dependency updates; notably:
  - build(deps): Add github.com/KimMachineGun/automemlimit
    v0.7.5
  - build(deps): Add go.uber.org/automaxprocs v1.6.0
  - build(deps): Bump github.com/dgraph-io/badger/v4 from
    v4.9.1 to v4.9.2
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    v2.5.33 to v2.5.34
  - build(deps): Bump
    go.opentelemetry.io/contrib/bridges/prometheus from v0.68.0
    to v0.69.0
  - build(deps): Bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
    from v0.68.0 to v0.69.0
  - build(deps): Bump go.opentelemetry.io/otel from v1.43.0 to
    v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace from
    v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
    from v1.43.0 to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/sdk from v1.43.0
    to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/sdk/metric from
    v1.43.0 to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/trace from
    v1.43.0 to v1.44.0
  - build(deps): Bump golang.org/x/sync from v0.20.0 to v0.21.0
  - build(deps): Bump golang.org/x/text from v0.37.0 to v0.38.0
  - build(deps): Bump google.golang.org/grpc from v1.81.0 to
    v1.81.1
  - build(deps): Bump gopkg.in/ini.v1 from v1.67.2 to v1.67.3
  - build(deps): Bump oras.land/oras-go/v2 from v2.6.0 to
    v2.6.1
  - build(deps): bump golang.org/x/crypto to v0.52.0 and
    golang.org/x/net to v0.55.0 (#8745) authored by @BGebken
  - build: bump go 1.26.3 -&gt; 1.26.4 (#8726) authored by
    @srenatus</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782907200">- Update to version 1.18.1:
  This release fixes a memory leak introduced in OPA v1.17.0. It is
  advised to update if you notice excess memory usage when running
  OPA server.
  * Fixes
  - ast: fix AnnotationSet memory leak via runtime.AddCleanup
    cycle (#8817) authored by @srenatus reported by @keydon and
    @gorsr01</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782993600">- Update to version 1.18.2:
  This release includes a bug fix for a opa fmt regression
  introduced in v1.18.0.
  The original fix for #8557 had the formatter enforce newlines in
  single-item collections (arrays, objects, sets) rather than
  merely honoring existing ones. As a result, running opa fmt on
  already-formatted policies could introduce a large number of
  unwanted changes. This patch release restores the intended
  behavior: only newlines already present in the source determine
  whether a single-item collection is formatted on one line or
  across multiple lines.
  * Fixes
  - Fix regression in fix of #8557 (#8845) (authored by
    @anderseknert)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1785499200">- Update to version 1.19.0:
  * This release contains a mix of new features and bug fixes.
    Notably:
  - A fixed SQL injection vector in the Compile API
  - Stricter safety checking for Rego assignments (:=)
  - A cgo-free, faster WebAssembly runtime (wazero replaces
    wasmtime-go)
  - Startup warnings for unknown configuration options
  - A new strings.split_n built-in function
  - A REPL line reader that handles pasted input correctly,
    migrating existing history files
  * Fix SQL injection vector in Compile API: Quote SQL filter field
    identifiers (#8945)
  - The field names in the SQL emitted by the Compile API come
    from partially evaluated refs, so a policy that selects a
    dynamic key — such as input.fruits[input.column] — puts
    caller-controlled text in an identifier position. That text
    was emitted verbatim, which turns
    WHERE fruit.name = 'allowed'
    into
    WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'
    and an application appending the filter to its query returns
    rows the policy denies.
    Field segments that are not bare identifiers are now quoted
    at the UCAST-to-SQL boundary, with any embedded quote
    character escaped. Ordinary column names stay unquoted, so
    existing filters keep their current shape and remain
    case-insensitive on Postgres.
  * Behavior change: stricter safety for assignment (:=) (#3546)
  - The assignment operator (:=) is documented as "syntactic
    sugar for =, local variable creation, and additional compiler
    checks," and the safety checker reflects that: after
    rewriting, := is treated identically to = (unification), so
    an assignment's right-hand side can be made safe by unifying
    "backwards" through the left-hand side. This means policies
    like x := y; x = 7 compile (binding y to 7) even though y is
    never assigned, and x := y; obj[x] can silently degrade an
    expected constant-time lookup into full iteration.
    This change makes the right-hand-side of := be treated as a
    read that must be made safe by other expressions, and can no
    longer be satisfied through the left-hand-side. Affected
    policies that previously compiled now fail with a
    rego_unsafe_var_error. Reference iteration on the
    right-hand-side (e.g.  some k; v := obj[k]) is unaffected.
    Note: this is a deliberate semantic change, not a fix to
    match documented behavior — the intended semantics of := in
    this case were never specified.
  - WebAssembly runtime: wasmtime-go replaced with wazero (#7557)
    OPA's WebAssembly runtime — used by the wasm evaluation
    target and the WASM SDK — now runs on the pure-Go wazero
    runtime instead of bytecodealliance/wasmtime-go. This removes
    the cgo dependency from this path, so wasm-enabled builds no
    longer need a C toolchain.
    Compiled policy modules are now cached process-wide, so
    repeated VM creation for the same policy skips recompilation.
    On an Apple M4 Max this makes wasm cold start (compile +
    instantiate + first eval) about 73% faster, and warm
    evaluation about 29% faster with ~28% fewer allocations.
  - Configuration validation moved to Rego, with warnings on
    unknown options (#8891)
    Top-level configuration validation and default injection
    (default_decision, default_authorization_decision, labels) is
    now expressed as an embedded Rego policy rather than
    hand-written Go, as is the validation of server.metrics and
    metrics_export.
    The user-visible effect is that unrecognized configuration
    options are reported instead of being silently ignored. A
    typo such as decision_log instead of decision_logs now logs a
    warning at startup:
    {"level":"warning","msg":"unknown configuration option \"decision_log\" encountered"}
    These are warnings, not errors: OPA starts as before, and
    sections that are intentionally user-extensible are left
    alone, so extra keys there do not warn. Embedders reading
    configuration through config.ParseConfig can find the same
    messages on Config.Warnings.
  - Add strings.split_n built-in function (#8344)
    Policies often need only the first or last few parts of a
    split string, but the existing split built-in always returns
    every part, so the count has to be worked around with
    wildcards or a slice.
    strings.split_n takes the first n split parts from the front
    or the back of the string, depending on whether n is positive
    or negative:
    result := strings.split_n("a.b.c.d", ".", 2)
    [#] result == ["a", "b"]
    result := strings.split_n("a.b.c.d", ".", -2)
    [#] result == ["c", "d"]
    If abs(n) is larger than the number of parts, all parts are
    returned. An n of 0 returns an empty array.
  - Improved REPL line editing, with history file migration
    (#962)
    Pasting a tab-indented snippet into the REPL triggered
    tab-completion on the pasted tab, corrupting the input (e.g.
    injecting a completion candidate mid-line and producing a
    spurious parse error).  Fixing that requires bracketed paste,
    where the terminal wraps pasted text in markers so the line
    reader inserts it literally instead of treating an embedded
    tab as a completion request. The previous reader,
    peterh/liner, has no bracketed-paste support and is
    unmaintained (last release 2021), so it has been replaced
    with reeflective/readline.
    The new reader persists history as JSON lines instead of one
    command per line. Existing history files (~/.opa_history by
    default, or the path given to --history) are detected and
    migrated in place the first time the REPL loads them, so
    history written by earlier versions of OPA is kept.  OPA's
    own multi-line buffering is unchanged, and readline's native
    multi-line editing is left disabled to avoid changing REPL
    behavior.
  * Runtime, SDK, Tooling
  - cmd: Avoid intermediate buffer when writing bundle (#8909)
    authored by @anderseknert
  - cmd/build: Add --format flag for proto/JSON plan bundles to
    opa build (#8825) authored by @sspaink
  - cmd/check: Report wrapped structured errors individually
    (#3663) authored by @sspaink, reported by @oren-zohar
  - compile: Preserve package annotations in wasm bundle builds
    (#8854) authored by @srenatus, reported by @me-viper
  - format: Keep rule body inline when the head spans multiple
    lines (#8894) authored by @Kunalbehbud, reported by
    @charlieegan3
  - repl: Use a plain line reader for non-terminal input (#8941)
    authored by @sspaink
  - server: Set ReadHeaderTimeout to 32s on all HTTP servers
    (#8877) authored by @RinZ27
  - server/failtracer: Skip self-referential undefined-ref hints
    (#8916) authored by @srenatus
  - sdk: Allow customizing HTTP RoundTripper per Decision (#8884)
    authored by @paulo-raca
  - sdk: Fix deadlock between OPA.Plugin and manager onCommit
    (#8873) reported and authored by @sspaink
  - tester: Make Result JSON round-trippable (#8014) authored by
    @vsolano9, reported by @anderseknert
  - topdown: Resolve ground refs in --var-values cmd output
    (#7830) authored by @sspaink, reported by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Add support for Go 1.27 &amp; jsonv2 (#8947) authored by
    @anderseknert and @charlieegan3
  - ast: Fix aliased comment buffer in annotation parser (#8757)
    authored by @sspaink, reported by @0hardik1
  - ast: Fix non-deterministic type errors when shadowing a
    built-in (#3729) authored by @sspaink, reported by @srenatus
  - ast: Fix leaky future.keywords.not import in Rego v0 (#8953)
    authored by @johanfylling
  - ast: Fix panic when indexing composite literal values in x in
    [...] (#8918) reported and authored by @srenatus
  - ast: Fix TermValueEqual performance regression (#8863)
    authored by @mchitten
  - ast: Improve rule conflict error (#6391) authored by
    @unichronic, reported by @johanfylling
  - ast: Make CogeneratedExprs return deterministic order (#8895)
    authored by @sspaink
  - ast: Reject partial set and -object rules sharing a name
    (#8860) authored by @sspaink, reported by @shomron
  - ast: Restore location on unsafe var errors for rewritten head
    vars (#8719) authored by @Atishyy27, reported by
    @anderseknert
  - ast: Use more precise return types for object.* builtins
    (#8692) reported and authored by @anderseknert
  - ast+topdown: Let rule external sources distinguish absent
    from unknown (#8878) authored by @srenatus
  - ast+topdown: Parametrized (prefix) external rule sources
    (#8881) authored by @srenatus
  - topdown: Fix "a", "a" in {"a"} not returning true (#8747)
    authored by @anderseknert
  - topdown: Fix format_int precision loss for integers larger
    than 64 bits (#8857) authored by @Synvoya
  - topdown: Fix precision loss for integers larger than 64 bits
    in arithmetic and aggregates (#6281) authored by @Atishyy27,
    reported by @tsandall
  - topdown: Don't leak internal vars in Partial-Evaluation
    results (#6378) authored by @sspaink, reported by @nkey0
  - topdown/copypropagation: Avoid circular reference in
    Partial-Evaluation through call (#6428) authored by @sspaink,
    reported by @nkey0
  - topdown+util: Add generic SliceStack/GroupStack, unify
    refStack/functionMocksStack/saveStack (#8886) authored by
    @srenatus
  - topdown+util: Replace hand-rolled evalFunc/evalBuiltin pools
    with generic ResettablePool (#8886) authored by @srenatus
  - perf: Avoid allocations with custom Atoi and Atoi64 helpers
    (#8758) authored by @anderseknert
  - perf: Lazy init of scalars map in indexer (#8936) authored by
    @anderseknert
  - perf: Reduce allocations in index lookup (#8835) authored by
    @anderseknert
  - planner: Avoid redundant ruletrie.Children() call in Depth()
    (#8886) authored by @srenatus
  - planner: Unify functionMocksStack on generic GroupStack[T]
    (#8886) authored by @srenatus
  * Docs, Website, Ecosystem
  - ecosystem: Add agt-policies-africa — African data protection
    OPA policy pack (#8850) authored by @kingztech2019
  - ecosystem: Add Ghostunnel and NATS Plugin to Ecosystem
    (#8871) authored by @charlieegan3
  - ecosystem: Add Sencillo projects to ecosystem (#8818)
    authored by @hooksie1
  - docs: Add kubecon NA page (#8876) authored by @charlieegan3
  - docs: Add recommendations to follow Envoy's best practices
    (#8944) authored by @johanfylling
  - docs: Document rule indexer support for in, bare refs;
    modernize rego (#8822) authored by @srenatus, reported by
    @tsandall
  - docs: Document the compile metadata annotation (#8824)
    authored by @youdie006, reported by @anderseknert
  - docs: Fix broken OAuth2/OIDC policy examples (#8840) authored
    by @mailnike
  - docs: Fix decision_logs buffer_size_limit_events default in
    prose (#8866) authored by @s3onghyun
  - docs: Remove import rego.v1 (#8867) authored by @charlieegan3
  - docs: Some minor bug fixes to improve reporting (#8917)
    authored by @charlieegan3
  - docs: The Zed Rego extension link points at
    github.com/StyraInc/zed-rego (404). The repo now lives at
    github.com/StyraOSS/zed-rego. (#8883) authored by @mailnike
  - docs: Update cheatsheet files (#8868) authored by
    @charlieegan3
  - docs: Update regal and blog links (#8901) authored by
    @charlieegan3
  - docs: Updates examples to use some...in, add link to debugger
    (#8806) authored by @charlieegan3
  - website: Improve partial evaluation / data filtering
    documentation (#8625) authored by @mmzzuu
  - website: Import blog from medium (#8898) authored by
    @charlieegan3
  * Miscellaneous
  - ast: Add benchmark for rule index ref ordering (#8943)
    authored by @srenatus
  - ast: Various style fixes (#8938) authored by @anderseknert
  - build: Add Dockerfile.rego to validate image builds (#8401)
    authored by @jasdeepbhalla, reported by @anderseknert
  - build: Get just the needed commits for CI (#8940) authored by
    @charlieegan3
  - test: Start decommissioning test.WithTempFS (#8908) authored
    by @anderseknert
  - topdown: Add regression test for partial eval local names
    (#5226) authored by @sspaink, reported by @fab29p
  - topdown: Fix Partial-Evaluation test rejected by new conflict
    check (#8860) authored by @sspaink, reported by @shomron
  - topdown: Vendor a method-less text/template to restore
    whole-binary linker DCE (#7903) authored by @rchildress87,
    reported by @kruskall
  - workflows: Remove cpp from CodeQL language matrix (#8864)
    authored by @sspaink
  - workflows: Prune benchmarks to last 250 runs (#8834) authored
    by @srenatus
  - Dependency updates; notably:
  - build(go): Bump Go from 1.26.4 to 1.26.5 (#8875) authored
    by @srenatus
  - build(deps): Add github.com/reeflective/readline 1.3.0
  - build(deps): Add golang.org/x/term 0.45.0
  - build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.2
    to 4.9.4
  - build(deps): Bump github.com/go-logr/logr from 1.4.3 to
    1.4.4
  - build(deps): Bump github.com/huandu/go-sqlbuilder from
    1.41.0 to 1.42.1
  - build(deps): Bump github.com/prometheus/client_golang from
    1.23.2 to 1.24.0
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    2.5.34 to 2.5.36
  - build(deps): Bump golang.org/x/sync from 0.21.0 to 0.22.0
  - build(deps): Bump golang.org/x/text from 0.38.0 to 0.40.0
  - build(deps): Bump google.golang.org/grpc from 1.81.1 to
    1.82.1
  - build(deps): Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2
    (#8889) authored by @ahbarrios
  - Addressing GHSA-fxhp-mv3v-67qp
  - build(deps): Drop github.com/peterh/liner
  - build(deps): Drop github.com/KimMachineGun/automemlimit
    (#8869) authored by @charlieegan3
  - build(deps): Drop go.uber.org/automaxprocs (#8869) authored
    by @charlieegan3</changelog>
</package>
<package pkgid="7e2460f17db0b93c1361439f5d2e30c5a3cdfb94df767410e7441a0bd08e71a412eb81044b549da0d75a725d89eb079fb0f8464bc6ee39ad8b495dd43ff3d0fa" name="opa-debuginfo" arch="s390x">
  <version epoch="0" ver="1.19.0" rel="52.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145600">- Update to version 1.12.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Support for String Interpolation in the Rego language
  - Faster compilation and runtime
  - Fixes published in the v1.11.1 release
  * String Interpolation (#4733)
  - The Rego language has been extended to support String
    Interpolation, which provides a readable means to compose
    strings containing dynamic values determined at evaluation
    time.
    An interpolated string is composed of a template-string
    containing zero or more template-expressions that evaluates
    to a value at evaluation time.
    The $ character prefix identifies a template-string, and
    template-expressions are declared by being enclosed in
    curly-braces ({, }).
    Additionally, undefined template-expression values don't halt
    evaluation; instead, &lt;undefined&gt; will be injected into the
    generated string.
    package interpolation
    allowed_roles := ["admin", "employee"]
    default role := "guest"
    role := input.role
    deny contains $"User {input.username}'s role was '{role}', but must be one of {allowed_roles}" if {
    not role in allowed_roles
    }
    {
    "deny": [
    "User &lt;undefined&gt;'s role was 'guest', but must be one of [\"admin\", \"employee\"]"
    ],
    }
    String interpolation is a more readable and less error-prone
    substitute for the sprintf built-in function.
    Authored by @johanfylling reported by @anderseknert
    Tip
    Help us out!
    New Rego language features are exciting, and we want to
    maximize their usefulness. If you come across tools and
    integrations in the community where string interpolation
    isn't properly handled, such as syntax highlighting, please
    reach out and let us know.
  * Runtime, SDK, Tooling
  - oracle: Refactor Oracle better support some and every (#8105,
    [#8131], #8138) authored by @charlieegan3
  - plugins/bundle: Prevent ns-level polling by validating
    intervals (#8082) authored by @jjhwan-h
  - plugins/discovery: Initialize plugins before downloading
    (#8071) authored by @jt28828
  - topdown: Introduce sink for context cancellation
  - topdown: Make regex.replace respect cancellation (#8089)
    authored by @srenatus
  - topdown: Make replace and strings.replace_n respect
    cancellation (#8089) authored by @srenatus
  - topdown: Use sink for concat (#8090) authored by @srenatus
  - perf: Avoid extra allocation in sink if no cancel (#8104)
    authored by @anderseknert
  * Compiler, Topdown and Rego
  - ast/compile: Deal with error limit without panic/defer
    (#8087) authored by @srenatus
  - ast/parser: Check if we need to unescape at all (#8135)
    authored by @srenatus
  - perf: Improved visitor implementation (10% faster
    compilation) (#8078) authored by @anderseknert
  - perf: Reduce allocations handling terms (#8116) authored by
    @anderseknert
  - perf: Type-checker performance improvements (#8143) authored
    by @anderseknert
  * Docs, Website, Ecosystem
  - website: Add support for rego string interpolation syntax
    highlighting (#8092) authored by @charlieegan3
  - docs/ocp: Update "concepts" for v0.3.0 (#8117) authored by
    @srenatus
  - website: Show playground errors (#8141) authored by
    @charlieegan3
  - website: Update a number of links to their new location
    (#8100) authored by @charlieegan3
  - docs: Remove link to feedback form (#8101) authored by
    @charlieegan3
  - website: Remove survey bar (#8136) authored by @charlieegan3
  - docs: Update community contacts (#8108) authored by
    @charlieegan3
  * Miscellaneous
  - ast/checks_test: Fix flaky tests (#8111) authored by
    @srenatus
  - benchmarks: Install node v24 (#8122) authored by @srenatus
  - download: Fix when compiling with tag opa_no_oci (#8070)
    authored by @srenatus reported by @mg0083
  - tests: Race in TestStatusUpdateBuffer (#8133) authored by
    @thevilledev
  - workflow: Integrate benchmarks notebook (#8121) authored by
    @srenatus
  - workflows: Skip all tests in benchmarks run (#8086) authored
    by @srenatus
  - Dependency updates; notably:
  - build: Bump golang from 1.25.4 to 1.25.5 (#8107) authored
    by @srenatus
  - build(deps): Bump google.golang.org/grpc from 1.76.0 to
    1.77.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145601">- Update to version 1.12.1:
  This bug fix release reverts a change to regex.replace that
  unintentionally changed its behaviour for anchored regular
  expressions.
  * Revert "topdown: make regex.replace respect cancellation"
    (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 1.12.2:
  This bug fix release address issues found in the new string
  interpolation feature
  * Add (*TemplateString).Copy() method (#8159) authored by
    @anderseknert
  * Fix template string not serialized with escaped { (#8161)
    authored by @anderseknert
  * fix(ast): skip template string vars in ref safety (#8174)
    authored by @thevilledev
  * fix(ast): use original var names in template error (#8180)
    authored by @thevilledev</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768478400">- Update to version 1.12.3:
  This is a bug fix release addressing two issues:
  * Bundle polling is being misconfigured when discovery bundle is
    updated (#8215)
    This is an issue where the polling interval for discovery
    (discovery.polling.min_delay_seconds and
    discovery.polling.max_delay_seconds) were misinterpreted on
    reconfiguration, causing extremely long update intervals.
  * Decision log size buffer buffer_size_limit_bytes misconfigured
    during reconfiguration (#8213)
    This is a regression in the decision log, where the
    decision_logs.reporting.buffer_size_limit_bytes was mistakenly
    assigned the value of
    decision_logs.reporting.upload_size_limit_bytes during
    reconfiguration.
    This issue is only present when
    decision_logs.reporting.buffer_type is set to size, which is
    the default value.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769774400">- Update to version 1.13.1:
  This bug fix release addresses an issue found in the new
  array.flatten built-in function
  - Fix issue in array.flatten handling of single item arrays
    (#8273) (#8272) authored by @anderseknert
- Update to version 1.13.0:
  This release contains a mix of new features, performance
  improvements, and bugfixes. Notably:
  - A new immediate upload trigger mode in the Decision Logger
  - A new array.flatten built-in function
  - Numerous performance improvements
  * Immediate Upload Trigger Mode in Decision Logger (#8110)
  - An immediate trigger mode has been added to the Decision
    Logger; enabled by setting the
    decision_logs.reporting.trigger configuration option to
    immediate.
    When enabled, log events are pushed to the log service as
    soon as the configured upload chunk size criteria is met; or,
    at latest, when the configured upload delay is reached.
  * Runtime, SDK, Tooling
  - cmd/fmt: Do not overwrite file on fmt without changes (#8222)
    authored by @Loic-R
  - cmd/test: Enable sorting JSON test results by duration
    (#7444) authored by @sspaink
  - profiler: nil *Profiler should not report Enabled() (#8256)
    authored by @anderseknert
  - rego: Add Data function to simplify adding data from map
    (#5961) authored by @majiayu000 reported by @anderseknert
  - runtime: Correct naming &amp; docs for version checking (#8191)
    authored by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Body.String() doesn't panic on empty body (#8244)
    authored by @srenatus
  - ast: Improve type error message when referencing functions
    (#6840) authored by @sspaink
  - ast: Type Checker recognizes when a variable has multiple
    assignments but is an undefined function (#7463) authored by
    @sspaink reported by @anderseknert
  - ast/parser: Avoid duplicate loc copies (#8142) authored by
    @srenatus
  - topdown: Add array.flatten built-in function (#8226) authored
    by @anderseknert
  - topdown: Fix issue where numbers.range_step built-in could
    erroneously return undefined value (#8194) authored by
    @thevilledev
  - topdown: Remove hard-coded missing key error in
    strings.render_template built-in (#7931) authored by
    @colinjlacy reported by @anderseknert
  - topdown: Re-introduce cancellation-awareness for
    regex.replace built-in (#8179) authored by @srenatus
  - from having been reverted in v1.12.1
  - topdown: Support arrays as input for json.match_schema
    (#6615) authored by @sspaink reported by @mscudlik
  * Performance
  - ast: Improved annotations parsing (#8210) authored by
    @anderseknert
  - ast: Reinstate zero-alloc paths in Ref.String() (#8202)
    authored by @anderseknert
  - ast: Replace regex implementation in IsVarCompatibleString
    (#8164) authored by @anderseknert
  - ast: Optimize Set.Intersect and Set.Diff (#8167) authored by
    @thevilledev
  - ast: Optimize Set.Union (#8172) authored by @thevilledev
  - ast: Reduce allocations in Expr.MarshalJSON (#8204) authored
    by @thevilledev
  - ast: Reduce allocations in Rule.MarshalJSON (#8205) authored
    by @thevilledev
  - ast: Reduce allocations in Term.MarshalJSON (#8200) authored
    by @thevilledev
  - ast: Reduce allocations in With.MarshalJSON (#8206) authored
    by @thevilledev
  - perf: String() implementations using appenders (#8192)
    authored by @anderseknert
  - topdown: Avoid redundancy in builtinTrim (#8237) authored by
    @thevilledev
  - topdown: Eliminate closure allocations in Set and virtual doc
    enumeration (#8242) authored by @alex60217101990
  - topdown: Fast paths for array.reverse (#8177) authored by
    @thevilledev
  - topdown: Optimize json.remove and json.filter (#8193)
    authored by @thevilledev
  - topdown: Optimize object built-ins (#8175) authored by
    @thevilledev
  - topdown: Optimize union built-in (#8173) authored by
    @thevilledev
  - topdown: Pre-alloc in various built-ins (#8198) authored by
    @thevilledev
  - topdown: Reduce allocs in float sum/product (#8235) authored
    by @thevilledev
  - topdown: Skip set copy in getObjectKeysParam (#8176) authored
    by @thevilledev
  * Docs, Website, Ecosystem
  - docs: Add authz-spring-boot-starter to Spring Security API
    ecosystem entry (#8234) authored by @francois-eckert
  - docs: Add header for crypto example to make (#8259) authored
    by @charlieegan3
  - docs: Add notes for automated agents (#8147, #8203) authored
    by @charlieegan3
  - docs: Add opa-wasm-zig to the ecosystem (#8163) authored by
    @burdzwastaken
  - docs: Add scripts to import docs from source (#8148) authored
    by @charlieegan3
  - docs: Explain how to use the SDK without a initialising a
    server (#8248) authored by @andrewcameronsims
  - docs: Fix a number of redirecting links (#8165 authored by
    @charlieegan3
  - docs: Fix template-expression examples (#8199) authored by
    @johanfylling
  - docs/ocp: Mention source prefix/path options (#8238) authored
    by @srenatus
  - website: Add redirect section for immutable referrers (#8262)
    authored by @charlieegan3 reported by @KraLeoD
  - website: Display 2025 survey results on the website (#8258)
    authored by @charlieegan3
  - website: Show breadcrumbs in search results (#8207) authored
    by @charlieegan3
  * Miscellaneous
  - Decoupled the Rego job check from the Go job checks in the
    Github PR workflow (#8203) authored by @SeanLedford
  - build: Format pr_check.rego with opa fmt (#8201) authored by
    @thevilledev
  - build: Migrate PR check to OPA policy (#8183) authored by
    @SeanLedford
  - build: Run go get against main to spot redacted (#8146)
    authored by @charlieegan3
  - deps: Switch to maintained go.yaml.in/yaml/v3 yaml library
    (#8182) authored by @mrueg
  - test/cases: Increase yaml test coverage for some regex and
    string builtins (#8152) authored by @srenatus
  - Dependency updates; notably:
  - build: bump golang from 1.25.5 to 1.25.6 (#8224) authored
    by @srenatus
  - build(deps): bump go.opentelemetry.io deps from
    1.38.0/0.63.0 to 1.39.0/0.64.0
  - build(deps): bump klauspost/compress from v1.18.1 to
    v1.18.2 (#8184) authored by @srenatus
  - because of redaction warning
  - build(deps): bump github.com/go-ini/ini from v1.67.0 to
    gopkg.in/ini.v1 v1.67.1 (#8208) authored by @gabrpt</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1771416000">- Update to version 1.13.2:
  This release updates the version of Go used to build the OPA
  binaries and images to 1.25.7.
  That version of the Go standard library contains a fix for
  GO-2026-4337.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772193600">- Update to version 1.14.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Improved rule indexing of variable assignments and x in {...}
    expressions
  - Support for --h2c with unix domain socket for opa run
  - A new glossary tooltip for technical terms in the docs
  - Fixes published in the v1.13.1 and v1.13.2 releases
  * Improved rule indexing of variable assignments and x in {...}
    expressions (#1841)
    With this change, the rule indexer will index expressions like:
    allow if input.role in {"admin", "user"}
    On lookup, the rule body will only be returned if input.role is
    either one of "admin" or "user".
    The reverse case is also indexed:
    allow if "admin" in input.roles
    in which the searched collection is unknown.
  * Runtime, SDK, Tooling
  - cmd,run: Support --h2c with unix domain socket (UDS) (#8282)
    authored by @srenatus reported by @theJC
  - cmd,tester: Add line number next to test file in pretty
    format (#8328) authored by @sspaink reported by @anderseknert
  - plugins: Fix race accessing registeredTriggers (#8363)
    reported and authored by @szuecs
  - rego: Add ResultValue[T]() helper method (#8320) authored by
    @srenatus
  - runtime: Add custom storage backend registration API (#8277)
    authored and reported by @alex60217101990
  - topdown: Add config option to disable named inter-query
    built-in cache (#7519) authored by @sspaink reported by
    @johanfylling
  * Compiler, Topdown and Rego
  - ast: Add index else == nil test, fix it (#8348) authored by
    @srenatus
  - ast: Add scaffolding to introspect and skip compiler stages
    (#8304) (authored by @srenatus)
  - ast: Ensure term values implement ast.StringLengther (#8374)
    authored by @charlieegan3
  - ast: Fix double-fix for refs["with-a"].dash as package
    (#8286) authored by @srenatus
  - ast: Optimized template-expression handling of values known
    to be defined (#8310) authored by @anderseknert
  - ast: Put rule indices into rule tree, change Values to
    []*Rule (#8298) authored by @srenatus
  - ast: Replace true expr when appending to empty body (#8299)
    authored by @anderseknert
  - ast: Return correct location of unsafe var in object (#7935)
    authored by @sspaink reported by @anderseknert
  - ast: Use StageID in WithStageAfterID, also for QueryCompiler
    (follow-up) (#8306) authored by @srenatus
  - compile: Add StringLength to lazy object (#8369) authored by
    @charlieegan3 reported by @robmyersrobmyers
  - parser: Add test to verify filename interning in Location
    (#8322) authored by @anderseknert
  - perf: Allocate less in array unification (#8351) authored by
    @anderseknert
  - perf: Various minor eval performance tweaks (#8290) authored
    by @anderseknert
  - perf: json.patch + interning improvements (#8289) authored by
    @anderseknert
  - topdown: Optimize bindings allocation with dynamic pre-sizing
    (#7266) authored by @alex60217101990
  - topdown: Preserve original package name with special
    characters in optimized builds (#8284) authored by @sspaink
    reported by @at50989
  - wasm: Updates (LLVM+tools) (#8295) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs: Add examples to glob.match built-in documentation
    (#8252) authored by @sibasispadhi reported by @anderseknert
  - docs: Add workflow to auto update Regal docs (#8318) authored
    by @charlieegan3
  - docs: Document metrics for http.send, regex, and glob
    built-ins (#6730) authored by @anivar reported by @rudrakhp
  - docs: Fix json.patch target description (#8271) authored by
    @anderseknert
  - docs: Update broken links (#8285) authored by @charlieegan3
  - docs: Update bundle signing docs to clarify key config
    (#8307) authored by @charlieegan3
  - docs: Update faulty example using bundle optimize (#5379)
    authored by @sspaink reported by @bluebrown
  - docs: Update interface{} -&gt; any in golang snippets (#8373)
    authored by @srenatus
  - docs/website: Add a new KubeCon event page (#8311) authored
    by @charlieegan3
  - docs/website: Add formatting and linting checks (#8288)
    authored by @charlieegan3
  - docs/website: Allow Regal import to use local dir (#8312)
    authored by @charlieegan3
  - docs/website: Implement new GlossaryTooltip component (#8367)
    authored by @charlieegan3
  - docs/website: Markdown linting and spell checking for
    documentation (#8292) authored by @charlieegan3
  - docs/website: Redirect /docs/latest/ecosystem (#8315)
    authored by @charlieegan3 reported by @tweekSun1
  * Miscellaneous
  - maintainers: Moving nilekhc to emeritus, and renew maintainer
    terms (#8276) authored by @JaydipGabani
  - ast: Add public method to extend the compliance test cases
    with IR plans (#7556) authored by @sspaink reported by
    @shomron
  - ast: Tiny nitpicky cleanup (#8309) authored by @srenatus
  - chore: Clean up bundle storage tests (#8267) authored by
    @anderseknert
  - chore: Remove unnecessary comment from bundle JWT
    verification impl (#8354) authored by @johanfylling
  - ci: Bump golangci-lint (v2.9.0), fix issues (#8314) authored
    by @srenatus
  - ci: Harden and update all GH Actions workflows (#8356, #8377,
    [#8368] authored by @philipaconrad and @srenatus
  - go: Cleanup old build flags (#8314) authored by @srenatus
  - rego: Remove superfluous package import of plugins (#6754)
    authored by @srenatus reported by @oxisto
  - tests: Extract runtime Info to new package (#8362) authored
    by @charlieegan3
  - tests: Fix BenchmarkFunctionArgumentCounts query (#8327)
    authored by @alex60217101990
  - tests: Disable rule indexing for benchmark (#8375) authored
    by @srenatus
  - workflows: Add nightly vuln checks for released
    versions/images (#8336 #8339) authored by @srenatus
  - Dependency updates; notably:
  - build: bump golang from 1.25.6 to 1.26.0
  - build(deps): build(deps): bump go.opentelemetry.io deps
    from 1.39.0/0.64.0 to 1.40.0/0.65.0
  - Applying fix for GHSA-9h8m-3fm2-qjrq
  - build(deps): bump github.com/dgraph-io/badger/v4 from 4.9.0
    to 4.9.1
  - build(deps): bump github.com/huandu/go-sqlbuilder from
    1.39.0 to 1.39.1
  - build(deps): bump golang.org/x/net from 0.49.0 to 0.50.0
  - build(deps): bump golang.org/x/text from 0.33.0 to 0.34.0
  - build(deps): bump google.golang.org/grpc from 1.78.0 to
    1.79.1
  - build(deps): bump go.opentelemetry.io deps from
    1.39.0/0.64.0 to 1.40.0/0.65.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773057600">- Update to version 1.14.1:
  This is a patch release collecting two bug fixes and various
  dependency updates for Golang standard library and common package
  vulnerabilities.
  These bug fixes include a revert of the rule indexer tweaks
  shipped in 1.14.0, which had caused unexpected lookup failures
  for some users. (We expect to properly fix the issue in 1.15.0,
  but for now, a revert is the quicker choice.)
  * Changes
  - Fix intermittent plugins manager deadlock on opa.configure
    (#8407)
  - Revert "ast: make rule index track var assignments and x in
    {...} (#8341)" (#8410)
  - build: bump deps (go.mod from main)
  - build: bump go 1.26.1 (#8409)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774612800">- Update to version 1.15.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Add logger plugin interface and file logger implementation
    with log rotation
  - Custom HTTPAuthPlugin behavior change, all per-request
    authentication logic must be moved from NewClient() to
    Prepare()
  - AWS signing supports for web identity for assume role
    credentials
  * Logger Plugin Support (#8434) (authored by @srenatus)
    OPA now supports pluggable logging implementations via the
    logger plugin interface, which is based on Go's standard
    log/slog.Handler interface. This allows any slog.Handler
    implementation to be used as a logger plugin. Loggers can be
    configured via the server.logger_plugin configuration option
    and used for both runtime logging and decision logs. OPA
    includes a built-in file logger plugin (file_logger) that
    writes structured JSON logs with rotation support using
    lumberjack. Users can also implement and register custom logger
    plugins when building OPA.
    Example configuration for server logging:
    server:
    logger_plugin: file_logger
    plugins:
    file_logger:
    path: /var/log/opa/server.log
    max_size_mb: 100
    max_age_days: 28
    max_backups: 3
    compress: true
    level: info
    Example configuration for decision logs using the same plugin:
    server:
    logger_plugin: file_logger
    decision_logs:
    plugin: file_logger
    plugins:
    file_logger:
    path: /var/log/opa/server.log
    max_size_mb: 100
    max_age_days: 28
    max_backups: 3
    compress: true
    level: info
  * Custom HTTPAuthPlugin behavior change (#8376) (authored by @srenatus)
    The HTTPAuthPlugin.NewClient() method is now called once per
    Client instance and cached rather than being called for every
    request. Custom plugins that performed per-request operations
    in NewClient() (such as request counters, per-request transport
    wrapping, or logging/metrics side effects) will now only
    execute those operations once. All per-request authentication
    logic must be moved from NewClient() to Prepare(). All plugins
    included in OPA have been updated and are unaffected by this
    change.
  * Runtime, SDK, Tooling
  - plugins/logger: Add logger plugin interface and file logger
    implementation with log rotation (#8434) (authored by
    @srenatus)
  - plugins/logs: Decision logs can now use logger plugins for
    output (#8434) (authored by @srenatus)
  - logging: Add BufferedLogger to capture early startup logs
    before plugins are initialized (#8434) (authored by
    @srenatus)
  - plugins/rest: Configurable re-read interval for TLS client
    certificates via cert_reread_interval_seconds field.
    Defaults to re-reading on every request for backwards
    compatibility.  The implementation also uses content hashing
    to detect changes and avoid re-parsing unchanged TLS
    certificates and keys. (#8376) (authored by @srenatus)
  - plugins/rest: All TLS configurations now inherit the minimum
    version and TLS ciphersuites as configured for the server.
    (#8376) (authored by @srenatus)
  - internal/providers/aws: Refactor deprecated crypto/elliptic
    APIs to crypto/ecdh (#8395) (authored by @kanywst)
    plugins/rest: AWS Signing - Allow Service Account (Web
    Identity) credentials for Assume Role Credentials (#8386) (
    authored by @tiagogviegas)
  * Compiler, Topdown and Rego
  - ast: fix overlapping array and scalar pattern in rule index
    (authored by @srenatus)
  * Bundles
  - optimized bundles: filter metadata comments properly ( #8388)
    (#6529) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs(ecosystem): add Kopa ecosystem entry (#8405) (authored
    by @sfreet)
  - docs: Update KubeCon event listing (#8439) (authored by
    @charlieegan3)
  - docs: fix input of partial-evaluation example (#8430)
    (authored by @edobrb)
  - ecosystem: add Big ACL (#8389) (authored by @francois-eckert)
  - Regal v0.39.0 doc updates (#8383) (authored by @anderseknert)
  * Miscellaneous
  - build/generate-extended-cases: Fix testcase loader to use
    json.Number. (#8429) (authored by @philipaconrad)
  - Filter compliance test cases using capabilities file (#8418)
    (authored by @sspaink)
  - Fix intermittent plugins manager deadlock on opa.configure
    (#8407) (authored by @sspaink)
  - Linter configuration cleanup (#8397) (authored by
    @anderseknert)
  - fix nightly.yaml by moving secret to env (#8381) (authored by
    @sspaink)
  - fix release-vulnerability-check.yaml (authored by @sspaink)
  - nightly+release-vuln-check: add links to slack msg payloads
    (authored by @srenatus)
  - Dependency updates; notably:
  - build: bump go 1.26.1 (#8409) (authored by @srenatus)
  - gha: bump trivy-action (authored by @srenatus)
  - build(deps): bump google.golang.org/grpc from 1.79.1 to
    1.79.3 (#8428) (authored by @dependabot[bot])
  - build(deps): bump github.com/vektah/gqlparser/v2 from
    2.5.31 to 2.5.32 (#8399) (authored by @dependabot[bot])
  - build(deps): bump modernc.org/sqlite from 1.45.0 to 1.46.1
    (#8399) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/time from 0.14.0 to 0.15.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump github.com/microsoft/go-mssqldb from
    1.9.6 to 1.9.7(#8412) (authored by @dependabot[bot])</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774872000">- Update to version 1.15.1:
  * Miscellaneous
  - logging: make WithContext() optional (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775736000">- Update to version 1.15.2:
  No changes related to the openSUSE package, only GitHub release
  workflow updates (use go1.26.2)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777550400">- Update to version 1.16.0:
  This release contains a mix of new features, performance
  improvements, and bugfixes. Notably:
  - New uri.parse and uri.is_valid built-in functions
  - Data API Request/Response Metadata
  - Prometheus metrics exported via OTLP
  - Formatter improvements
  NOTE:
  In v1.15.x, OPA was dropping logs for bundle downloads, print()
  calls and other plugin-originated logs.
  Users are advised to update, v1.16.0 fixes this bug in (#8544).
  * New uri.parse and uri.is_valid built-in functions (#8263)
    Two new built-in functions have been added: uri.parse for
    parsing a given URI, and uri.is_valid for verifying the
    structure of a given URI.
  - uri.parse
    Parses a URI and returns an object containing its components
    according to RFC 3986. Empty components are omitted.
    package example
    test_uri if {
    uri.parse("https://example.com:8080/api?q=1#top") == {
    "scheme": "https",
    "hostname": "example.com",
    "port": "8080",
    "path": "/api",
    "raw_path": "/api",
    "raw_query": "q=1",
    "fragment": "top",
    }
    }
  - uri.is_valid
    Returns true if the input can be parsed as a URI, false otherwise.
    package example
    deny contains "invalid URI" if {
    not uri.is_valid("http://[invalid")
    }
  * Data API Request/Response Metadata (#8570)
    Wrapping projects can now attach custom metadata to Data API
    requests and have evaluation produce response metadata.
    Two distinct metadata paths are introduced:
  - Request metadata: parsed from extra top-level keys in the
    request body, made available to builtins via
    BuiltinContext.RequestMetadata. Logged in the decision log
    under Custom["request_metadata"].
  - Response metadata: a separate map
    (BuiltinContext.ResponseMetadata) that builtins can populate
    during evaluation. Only included in the API response and
    decision log if non-empty.
    In vanilla OPA, no builtins write response metadata, so
    responses are unchanged. The request metadata map is only
    allocated when the request carries extra fields; the response
    map is one empty map per request.
    To avoid conflicts with future OPA top-level keys, callers
    should use a namespaced key: {"input": {...},
    "com.example.opa/md": {...}}.
    Request with metadata:
    curl -H 'Content-Type: application/json' \
  - d '{"input": {"user": "alice"}, "com.example.opa/metadata": {"corp-id": "acme-42"}}' \
    http://localhost:8181/v1/data/example/allow
    Response (response metadata included if, for example, set by a
    custom builtin):
    {
    "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
    "result": true,
    "com.example.opa/response": {
    "snapshot_version": "v3"
    }
    }
    Decision log entry:
    {
    "custom": {
    "request_metadata": {
    "com.example.opa/metadata": {
    "corp-id": "acme-42"
    }
    },
    "response_metadata": {
    "com.example.opa/response": {
    "snapshot_version": "v3"
    }
    }
    },
    "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
    "input": { "user": "alice" },
    "msg": "Decision Log",
    "path": "example/allow",
    "result": true
    }
  * Runtime, SDK, Tooling
  - distributedtracing: Export Prometheus metrics via OTLP
    (#7591) reported and authored by @Munken
  - cmd,tester: Update opa test to stream test case results
    (#3676) authored by @sspaink reported by @tsandall
  - cmd,tester: Show full errors when test fails and using
  - -coverage (#8438) authored by @grosser
  - format: Add new line between METADATA blocks (#8483) authored
    by @sspaink
  - format: Allow indenting all withs in expression (#8508)
    authored by @anderseknert
  - format: Fix dropping comments after handling
    unexpectedCommentError (#8553) authored by @sspaink
  - format: Preserve location of trailing comments inside every
    body (#8558) authored by @johanfylling
  - format: Prevent opa fmt from formatting single attribute
    objects with comments (#7565) authored by @sspaink reported
    by @anderseknert
  - logging: Keep forwarding from BufferedLogger after Flush()
    (#8544) authored by @srenatus reported by @annieyhuang
  - plugins/logs: Fix logBuffer eviction loop only dropping one
    element (#8543) authored by @sspaink
  - plugins/logs: Fix out-of-order plugin status notifications
    (#8009) authored by @sspaink reported by @Pushpalanka
  - plugins/rest: Carry over all of *tls.Config (#8473) authored
    by @srenatus reported by @ashu2496
  - server: Drop HTML index page query form (#8477) authored by
    @johanfylling reported by @srenatus and @r0binak
  - server: Skip chmod for abstract Unix domain sockets (#8536)
    authored by @bakayolo
  - storage/inmem: Avoid allocations from Read() in MakeDir()
    (#8561) authored by @srenatus
  - tester: Add method to match tests by ref prefixes (#6696)
    authored by @anderseknert
  - Note: Experimental.
  * Compiler, Topdown and Rego
  - ast: Allow Back-to-back metadata blocks (#8482) authored by
    @sspaink reported by @johanfylling
  - ast: Catch functions in dynamic extent of ref head rule
    (#8461) authored by @srenatus reported by @johanfylling
  - ast: Fix parenthesis in String() of {obj,arr,set}
    comprehensions (#8511) authored by @srenatus
  - ast: Fix parsing of unary - in front of a ref (#5014)
    authored by @mmzzuu reported by @philipaconrad
  - ast: Fix type checker match error for objects with set keys
    (#6260) authored by @sspaink reported by @tsandall
  - ast: Fix type checker to recognize numeric index in generated
    map (#6736) authored by @sspaink reported by @anderseknert
  - ast: Handle underdetermined function args (#5234) authored by
    @sspaink reported by @obataku
  - ast: Identify compatible type from reference in type checker
    (#7273) authored by @sspaink reported by @anderseknert
  - ast: Support recursive JSON Schemas (#6099) authored by
    @sspaink reported by @anderseknert
  - builtins: Add support for days, weeks and years in
    time.parse_duration_ns built-in function (#2719) authored by
    @sspaink reported by @freeseacher
  - builtins: Fix graph.reachable_paths to return all reachable
    paths (#5871) authored by @davidmarne-wf reported by
    @ericjkao
  - builtins: Limit exponent size in units.parse_bytes built-in
    function to prevent timeout bypass (#8326) authored by
    @isaiahvita reported by @anderseknert
  - perf: Add CopyNonGround() methods for Array, Set, and Object
    (#8323) authored by @alex60217101990
  - resolver/wasm: Add NewWithContext to allow passing context
    (#8499) authored by @dominikschulz
  * Docs, Website, Ecosystem
  - docs: Add aggregates examples for count and sum built-in
    functions (#8566) authored by @alliasgher reported by
    @srenatus
  - docs: Add generated output.jsons for docs examples (#8535)
    authored by @charlieegan3
  - docs: Add spec for OCP bundle status tracking API (#8502)
    authored by @ashutosh-narkar
  - docs: Add the latest videos to the README presentations
    section (#8523) authored by @sspaink
  - docs: Add Windows development notes to dev reference guide
    (#8422) authored by @raajheshkannaa
  - docs: Fix input value type in not undefined example (#8580)
    authored by @menma1234
  - docs: Update Regal docs to v0.40.0 (#8538) authored by
    @charlieegan3
  - docs: Updated roadmap link (#8501) authored by @johanfylling
  - docs: Various typo fixes (#8529) authored by @sspaink
  - ecosystem: Add vulnetix ecosystem entry (#8532) authored by
    @0x73746F66
  - ecosystem: Add KubeStellar Console (#8560) authored by
    @clubanderson
  - website: Add banner to show when event has passed (#8493)
    authored by @charlieegan3
  - website: Add copy-as-markdown button to doc pages (#8540)
    authored by @charlieegan3
  - website: Copy button improvements (#8577) authored by
    @charlieegan3
  - website: Remove old redirects, add new management redirect
    (#8424) authored by @charlieegan3 reported by @narainar
  - website: Update intro video on homepage (#8547) authored by
    @charlieegan3
  * Miscellaneous
  - build: Exclude domains that cause false positives (#8533)
    (#8495) authored by @charlieegan3
  - e2e/cli: Add test for debug print() logging (#8567) authored
    by @srenatus
  - e2e/cli: Start CLI E2E tests (#8545) authored by @srenatus
  - github: declare formatted rego as rego (#8564) authored by
    @srenatus
  - Security policy update (#8479) authored by @anderseknert
  - Dependency updates; notably:
  - build: bump go 1.26.2 (#8497) authored by @sspaink
  - build(deps): bump wasmtime-go from v39.0.1 to v43.0.2
  - build(deps): bump go.opentelemetry.io deps from
    1.40.0/0.65.0 to 1.43.0/0.68.0
  - build(deps): bump github.com/containerd/containerd/v2 from
    2.2.1 to 2.2.3
  - build(deps): bump ithub.com/huandu/go-sqlbuilder from
    1.39.1 to 1.40.2
  - build(deps): bump golang.org/x/net from 0.51.0 to 0.53.0
  - build(deps): bump golang.org/x/text from 0.34.0 to 0.36.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777636800">- Update to version 1.16.1:
  This is a patch release addressing a regression in the plugin
  manager that may cause the service to hang on shutdown (#8590).</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.16.2:
  This release updates the version of Go used to build the OPA
  binaries and images to 1.26.3; addressing a number of
  vulnerabilities.
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
  This is CVE-2026-42501 and Go issue https://go.dev/issue/79070
  * build: bump go 1.26.2 -&gt; 1.26.3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 1.17.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - A new future.keywords.not import that adds improved semantics
    to the not keyword.
  - Rule Labels in Decision Logs
  - Published json schema for IR and bundle manifest
  - Dropped automaxprocs and x/net dependencies
  * Improved Negation Semantics (#8387)
    This OPA release introduces a new future.keywords.not import
    that fixes a long-standing semantic issue with negation in
    Rego.
    Without the import, the compiler expands a negated composite
    expression like not f(g(input.x)) into a series of
    sub-expressions evaluated before the not:
    __local0__ = input.x
    g(__local0__, __local1__)
    not f(__local1__)
    If any sub-expression fails — for example, input.x is undefined
    or g produces an undefined result — the entire rule fails
    rather than the not succeeding.  This is unintuitive: the
    user's intent is "the condition does not hold," but an
    undefined intermediate value causes a silent failure instead of
    the expected not result.
    With import future.keywords.not, composite-expression negation
    wraps the full compiler expansion in an implicit body:
    not { __local0__ = input.x; g(__local0__, __local1__); f(__local1__) }
    Now, if any sub-expression is undefined or fails, the body is
    unsatisfiable and the not expression succeeds; matching the
    intuition that "the condition does not hold."
    NOTE:
    Users are recommended to import future.keywords.not whenever
    the not keyword is used in a policy.
  * Rule Labels in Decision Logs (#2089)
    Rule annotations now support a labels field. Labels from all
    successfully evaluated rules are collected and included in each
    decision log entry as a top-level rule_labels array. Each
    element is the merged label map for one successfully evaluated
    rule, with inner-scope-wins precedence across the rule's
    annotation chain (subpackages &lt; package &lt; document &lt; rule).
    Merged maps are deduplicated across rules so that identical
    label sets collapse to a single entry.
    [#] METADATA
    [#] scope: package
    [#] labels:
    [#]   service: authz
    [#]   severity: info
    package myapp
    [#] METADATA
    [#] labels:
    [#]   severity: low
    [#]   team: platform
    allow if input.role == "admin"
    The resulting decision log entry will contain:
    {"rule_labels": [{"service": "authz", "severity": "low", "team": "platform"}]}
    Note how severity: info from the package scope is overridden by
    severity: low from the rule scope. Queries against rule_labels
    can now rely on each entry carrying the full label context for
    a single rule, rather than one entry per contributing scope.
    Both the runtime and the Go SDK now process metadata
    annotations by default.
  * Runtime, SDK, Tooling
  - ast: Allow $ref in allOf in JSON schemas (#6523) authored by
    @deeglaze reported by @mosiac1
  - bundle: Update bundle roots conflict detection algorithm.
    (#8664) authored by @philipaconrad
  - download: Use oras, not containerd (#8639) authored by
    @srenatus
  - server: Remove dead code (s.partials) (#8708) authored by
    @srenatus
  - server: Wire in response/request metadata for compile handler
    (#8650) authored by @srenatus
  - server/types: generalize request/response metadata (#8650)
    authored by @srenatus
  * Compiler, Topdown and Rego
  - builtins: Enable pattern validation in json.verify_schema and
    json.match_schema built-in functions (#6089) authored by
    @sspaink reported by @ewout8
  - ir: Don't capitalize index field in MakeNumberRefStmt IR
    statement (#6266) authored by @sspaink reported by
    @johanfylling
  - perf: Avoid allocating in binary and/or operators when
    possible (#8689) authored by @anderseknert
  - rego: Allow per-eval GenerateJSON function (#8690) authored
    by @anderseknert
  * Docs, Website, Ecosystem
  - ecosystem: add OPA MCP (#8618) authored by @OrygnsCode
  - docs: Add explicit address binding to examples (#8688)
    authored by @charlieegan3
  - docs: Add titles to code blocks in policy-testing (#8649)
    authored by @charlieegan3
  - docs: Correct OCP SSH key docs (#8675) authored by @taurelius
  - docs: Update diagram to match index examples (#8667) authored
    by @charlieegan3
  * Miscellaneous
  - ast,storage/inmem: Add inmem.NewFromASTObject and add missing
    string case to ast.InternedValue (#8707) authored by
    @anderseknert
  - build: go install -&gt; go install tool to control checksums
    (#8646) authored by @srenatus
  - build: Push edge binaries to bucket (#8668) authored by
    @charlieegan3
  - workflows: Fix benchmarks workflow (replace action, avoid
    stackoverflow) (#8655) authored by @srenatus
  - workflows: Note improvements in benchmark comments (#8673)
    authored by @srenatus
  - Generate a JSON Schema for the IR plan (#8662) authored by
    @sspaink reported by @kroekle
  - Generate a JSON Schema for the bundle manifest (#8661)
    authored by @sspaink reported by @kroekle
  - Dependency updates; notably:
  - build(deps): Remove automaxprocs dependency (#8696)
    authored by @anderseknert
  - build(deps): Remove direct x/net dependency (#8697)
    authored by @anderseknert
  - build(deps): Bump github.com/bytecodealliance/wasmtime-go
    from 43.0.2 to 44.0.0 (8652) authored by @srenatus
  - build(deps): Bump github.com/fsnotify/fsnotify from 1.9.0
    to 1.10.1
  - build(deps): Bump github.com/huandu/go-sqlbuilder from
    1.40.2 to 1.41.0
  - build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.0
    to 3.1.1
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    2.5.32 to 2.5.33
  - build(deps): Bump google.golang.org/grpc from 1.80.0 to
    1.81.0
  - build(deps): Bump gopkg.in/ini.v1 from 1.67.1 to 1.67.2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780920000">- Update to version 1.17.1:
  This release uses the latest version of Go (1.26.4) to build OPA,
  fixing stdlib vulnerabilities in code that OPA's HTTP handler and
  crypto builtins use:
  - https://pkg.go.dev/vuln/GO-2026-5039
  - https://pkg.go.dev/vuln/GO-2026-5037
  It is otherwise the same code as v1.17.0.
  * Miscellaneous
  - build: bump go 1.26.3 -&gt; 1.26.4 (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782648000">- Update to version 1.18.0:
  This release contains a mix of bugfixes and small features.
  Notably:
  - A breaking fix to the outbound User-Agent header so it conforms
    to RFC 9110 (see below)
  - Container-aware resource limits: automatic GOMAXPROCS is
    restored and automatic GOMEMLIMIT is now supported
  - Several opa fmt correctness fixes
  - Improvements to opa test --coverage (ranges in report, inline
    rule head tracking, conjunction-expression coverage)
  * Breaking: Fix User-Agent according to RFC9110 (#8792)
  - OPA's outbound HTTP requests (bundle, discovery, decision
    log, status, http.send, AWS KMS/ECR) previously sent
    User-Agent: Open Policy Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;), which
    is not a valid RFC 9110 User-Agent value because the product
    token cannot contain spaces. The header is now
    Open-Policy-Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;). Server-side log
    filters or WAF rules that exact-match the old string will
    need to be updated.
  * Runtime, SDK, Tooling
  - bundle: fix per-module rego version lookup (#8797) authored
    by @sspaink, reported by @xubinzheng
  - bundle: improve determinism of file_rego_versions patterns
    with overlap (#8733) authored by @philipaconrad
  - cover: Track inline rule head in post trace walk (#6531)
    authored by @charlieegan3, reported by @anderseknert
  - cover: Update report to include ranges (#8748) reported and
    authored by @charlieegan3
  - cover: Add support for coverage of conjunction exprs (#8809)
    authored by @charlieegan3
  - download/oci: Set Accept headers (#8720) authored by
    @charlieegan3
  - fmt: preserve the multiline but single entry iterables
    (#8557) authored by @unichronic, reported by @anderseknert
  - format: Fix dropped with-clause after comment in object value
    (#8765) authored by @sspaink, reported by @srabraham
  - format: keep lone with on the closing-bracket line of
    multi-line expressions (#8804) authored by @anneheartrecord,
    reported by @burnster
  - oracle: Fix find-definition on expressions inside ast.Not
    nodes (#8731) authored by @johanfylling
  - runtime: Restore goautomaxprocs, add automemlimit (#8784)
    authored by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Apply location to inner ast.Not expressions (#8717)
    authored by @johanfylling, reported by @anderseknert
  - ast: Clean up code for value comparisons (#8737) authored by
    @anderseknert
  - ast: Fix PE regression for future.keywords.not negation
    inside every (#8781) authored by @johanfylling
  - internal/edittree: Add recursive tree node recycling (#8693)
    authored by @philipaconrad
  - internal: compile,planner: improve determinism of plan/wasm
    bundle builds (#8732) authored by @philipaconrad
  - perf: avoid allocations in object.get (#8729) authored by
    @anderseknert
  - topdown: Fix PE not namespacing vars in comprehensions nested
    inside every (#8816) authored by @johanfylling
  - topdown: remove dst.Compare(src) shortcut (#8739) authored by
    @srenatus
  - topdown: skip strconv.ParseInt in format_int base-10 fast
    path (#8801) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs/chore: Remove broken links (#8714) authored by
    @charlieegan3, reported by @github-actions
  - docs: PoC for kapa.ai (#8125) reported and authored by
    @charlieegan3
  - docs(ecosystem): update OPA MCP entry with video, blog, and
    distribution links (#8712) authored by @OrygnsCode
  - docs/contributing: add formatting (#8740) authored by @mmzzuu
  - docs: Add SDK references for evaluating IR plans (#8783)
    authored by @charlieegan3
  - docs: Add depkeep to enterprise support (#8685) authored by
    @pkuzco
  - docs: Add notes about use of GOMEMLIMIT (#8771) authored by
    @charlieegan3
  - docs: Add we/our/us check to spell check (#8787) authored by
    @charlieegan3
  - docs: Update built-in index page titles (#8728) authored by
    @charlieegan3
  - docs: Update documentation to be more consistent and sound
    more like reference docs (#8786) authored by @charlieegan3
  - docs: Update regal docs for 0.41.1 release (#8730) authored
    by @charlieegan3
  - docs: Update to agents.md regarding security dependences
    'fixes' (#8754) authored by @charlieegan3
  - docs: clarify environment variable substitution behaviour
    (#8713) authored by @taurelius
  - docs: remove duplicated word in Rego style guide (#8800)
    authored by @s3onghyun
  - website: Add .md alternate content types for llms (#8725)
    authored by @charlieegan3
  - website: Add support page disclaimer and sort by date added
    (#8736) authored by @charlieegan3
  - website: Fix build from missing dateAdded (#8764) authored by
    @charlieegan3
  - website: Update docusaurus (#8756) authored by @charlieegan3
  - website: Update homepage AI example to tool calls (#8755)
    authored by @charlieegan3
  - website: Various updates to node and website deps (#8768)
    authored by @charlieegan3
  - website: add ossrisk to ecosystem (#8780) authored by @pkuzco
  * Miscellaneous
  - benchmarks: smaller tweaks (#8759) authored by @srenatus
  - benchmarks: split off script, emit markdown table (#8812)
    authored by @srenatus
  - benchmarks: use details+summary comments for benchlab results
    (#8811) authored by @srenatus
  - capabilities: Integrate 1.17.1 patch release (#8798) authored
    by @sspaink
  - chore: tidy go.mod to remove untagged versions (#8791)
    authored by @thaJeztah
  - e2e: Add proto schemas for the IR plan and bundle manifest
    (#8766) reported and authored by @sspaink
  - gha: deduplicate change-detection output in pr CI checks
    (#8808) authored by @sspaink
  - nightly: use regal@main (#8735) authored by @srenatus
  - workflow: remove tests from docker (edge) image build (#8721)
    authored by @srenatus
  - workflows: bring back docker edge tags for post-merge (#8718)
    authored by @srenatus
  - workflows: use go-version-file with actions/setup-go (#8751)
    authored by @srenatus
  - Dependency updates; notably:
  - build(deps): Add github.com/KimMachineGun/automemlimit
    v0.7.5
  - build(deps): Add go.uber.org/automaxprocs v1.6.0
  - build(deps): Bump github.com/dgraph-io/badger/v4 from
    v4.9.1 to v4.9.2
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    v2.5.33 to v2.5.34
  - build(deps): Bump
    go.opentelemetry.io/contrib/bridges/prometheus from v0.68.0
    to v0.69.0
  - build(deps): Bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
    from v0.68.0 to v0.69.0
  - build(deps): Bump go.opentelemetry.io/otel from v1.43.0 to
    v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace from
    v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
    from v1.43.0 to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/sdk from v1.43.0
    to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/sdk/metric from
    v1.43.0 to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/trace from
    v1.43.0 to v1.44.0
  - build(deps): Bump golang.org/x/sync from v0.20.0 to v0.21.0
  - build(deps): Bump golang.org/x/text from v0.37.0 to v0.38.0
  - build(deps): Bump google.golang.org/grpc from v1.81.0 to
    v1.81.1
  - build(deps): Bump gopkg.in/ini.v1 from v1.67.2 to v1.67.3
  - build(deps): Bump oras.land/oras-go/v2 from v2.6.0 to
    v2.6.1
  - build(deps): bump golang.org/x/crypto to v0.52.0 and
    golang.org/x/net to v0.55.0 (#8745) authored by @BGebken
  - build: bump go 1.26.3 -&gt; 1.26.4 (#8726) authored by
    @srenatus</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782907200">- Update to version 1.18.1:
  This release fixes a memory leak introduced in OPA v1.17.0. It is
  advised to update if you notice excess memory usage when running
  OPA server.
  * Fixes
  - ast: fix AnnotationSet memory leak via runtime.AddCleanup
    cycle (#8817) authored by @srenatus reported by @keydon and
    @gorsr01</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782993600">- Update to version 1.18.2:
  This release includes a bug fix for a opa fmt regression
  introduced in v1.18.0.
  The original fix for #8557 had the formatter enforce newlines in
  single-item collections (arrays, objects, sets) rather than
  merely honoring existing ones. As a result, running opa fmt on
  already-formatted policies could introduce a large number of
  unwanted changes. This patch release restores the intended
  behavior: only newlines already present in the source determine
  whether a single-item collection is formatted on one line or
  across multiple lines.
  * Fixes
  - Fix regression in fix of #8557 (#8845) (authored by
    @anderseknert)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1785499200">- Update to version 1.19.0:
  * This release contains a mix of new features and bug fixes.
    Notably:
  - A fixed SQL injection vector in the Compile API
  - Stricter safety checking for Rego assignments (:=)
  - A cgo-free, faster WebAssembly runtime (wazero replaces
    wasmtime-go)
  - Startup warnings for unknown configuration options
  - A new strings.split_n built-in function
  - A REPL line reader that handles pasted input correctly,
    migrating existing history files
  * Fix SQL injection vector in Compile API: Quote SQL filter field
    identifiers (#8945)
  - The field names in the SQL emitted by the Compile API come
    from partially evaluated refs, so a policy that selects a
    dynamic key — such as input.fruits[input.column] — puts
    caller-controlled text in an identifier position. That text
    was emitted verbatim, which turns
    WHERE fruit.name = 'allowed'
    into
    WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'
    and an application appending the filter to its query returns
    rows the policy denies.
    Field segments that are not bare identifiers are now quoted
    at the UCAST-to-SQL boundary, with any embedded quote
    character escaped. Ordinary column names stay unquoted, so
    existing filters keep their current shape and remain
    case-insensitive on Postgres.
  * Behavior change: stricter safety for assignment (:=) (#3546)
  - The assignment operator (:=) is documented as "syntactic
    sugar for =, local variable creation, and additional compiler
    checks," and the safety checker reflects that: after
    rewriting, := is treated identically to = (unification), so
    an assignment's right-hand side can be made safe by unifying
    "backwards" through the left-hand side. This means policies
    like x := y; x = 7 compile (binding y to 7) even though y is
    never assigned, and x := y; obj[x] can silently degrade an
    expected constant-time lookup into full iteration.
    This change makes the right-hand-side of := be treated as a
    read that must be made safe by other expressions, and can no
    longer be satisfied through the left-hand-side. Affected
    policies that previously compiled now fail with a
    rego_unsafe_var_error. Reference iteration on the
    right-hand-side (e.g.  some k; v := obj[k]) is unaffected.
    Note: this is a deliberate semantic change, not a fix to
    match documented behavior — the intended semantics of := in
    this case were never specified.
  - WebAssembly runtime: wasmtime-go replaced with wazero (#7557)
    OPA's WebAssembly runtime — used by the wasm evaluation
    target and the WASM SDK — now runs on the pure-Go wazero
    runtime instead of bytecodealliance/wasmtime-go. This removes
    the cgo dependency from this path, so wasm-enabled builds no
    longer need a C toolchain.
    Compiled policy modules are now cached process-wide, so
    repeated VM creation for the same policy skips recompilation.
    On an Apple M4 Max this makes wasm cold start (compile +
    instantiate + first eval) about 73% faster, and warm
    evaluation about 29% faster with ~28% fewer allocations.
  - Configuration validation moved to Rego, with warnings on
    unknown options (#8891)
    Top-level configuration validation and default injection
    (default_decision, default_authorization_decision, labels) is
    now expressed as an embedded Rego policy rather than
    hand-written Go, as is the validation of server.metrics and
    metrics_export.
    The user-visible effect is that unrecognized configuration
    options are reported instead of being silently ignored. A
    typo such as decision_log instead of decision_logs now logs a
    warning at startup:
    {"level":"warning","msg":"unknown configuration option \"decision_log\" encountered"}
    These are warnings, not errors: OPA starts as before, and
    sections that are intentionally user-extensible are left
    alone, so extra keys there do not warn. Embedders reading
    configuration through config.ParseConfig can find the same
    messages on Config.Warnings.
  - Add strings.split_n built-in function (#8344)
    Policies often need only the first or last few parts of a
    split string, but the existing split built-in always returns
    every part, so the count has to be worked around with
    wildcards or a slice.
    strings.split_n takes the first n split parts from the front
    or the back of the string, depending on whether n is positive
    or negative:
    result := strings.split_n("a.b.c.d", ".", 2)
    [#] result == ["a", "b"]
    result := strings.split_n("a.b.c.d", ".", -2)
    [#] result == ["c", "d"]
    If abs(n) is larger than the number of parts, all parts are
    returned. An n of 0 returns an empty array.
  - Improved REPL line editing, with history file migration
    (#962)
    Pasting a tab-indented snippet into the REPL triggered
    tab-completion on the pasted tab, corrupting the input (e.g.
    injecting a completion candidate mid-line and producing a
    spurious parse error).  Fixing that requires bracketed paste,
    where the terminal wraps pasted text in markers so the line
    reader inserts it literally instead of treating an embedded
    tab as a completion request. The previous reader,
    peterh/liner, has no bracketed-paste support and is
    unmaintained (last release 2021), so it has been replaced
    with reeflective/readline.
    The new reader persists history as JSON lines instead of one
    command per line. Existing history files (~/.opa_history by
    default, or the path given to --history) are detected and
    migrated in place the first time the REPL loads them, so
    history written by earlier versions of OPA is kept.  OPA's
    own multi-line buffering is unchanged, and readline's native
    multi-line editing is left disabled to avoid changing REPL
    behavior.
  * Runtime, SDK, Tooling
  - cmd: Avoid intermediate buffer when writing bundle (#8909)
    authored by @anderseknert
  - cmd/build: Add --format flag for proto/JSON plan bundles to
    opa build (#8825) authored by @sspaink
  - cmd/check: Report wrapped structured errors individually
    (#3663) authored by @sspaink, reported by @oren-zohar
  - compile: Preserve package annotations in wasm bundle builds
    (#8854) authored by @srenatus, reported by @me-viper
  - format: Keep rule body inline when the head spans multiple
    lines (#8894) authored by @Kunalbehbud, reported by
    @charlieegan3
  - repl: Use a plain line reader for non-terminal input (#8941)
    authored by @sspaink
  - server: Set ReadHeaderTimeout to 32s on all HTTP servers
    (#8877) authored by @RinZ27
  - server/failtracer: Skip self-referential undefined-ref hints
    (#8916) authored by @srenatus
  - sdk: Allow customizing HTTP RoundTripper per Decision (#8884)
    authored by @paulo-raca
  - sdk: Fix deadlock between OPA.Plugin and manager onCommit
    (#8873) reported and authored by @sspaink
  - tester: Make Result JSON round-trippable (#8014) authored by
    @vsolano9, reported by @anderseknert
  - topdown: Resolve ground refs in --var-values cmd output
    (#7830) authored by @sspaink, reported by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Add support for Go 1.27 &amp; jsonv2 (#8947) authored by
    @anderseknert and @charlieegan3
  - ast: Fix aliased comment buffer in annotation parser (#8757)
    authored by @sspaink, reported by @0hardik1
  - ast: Fix non-deterministic type errors when shadowing a
    built-in (#3729) authored by @sspaink, reported by @srenatus
  - ast: Fix leaky future.keywords.not import in Rego v0 (#8953)
    authored by @johanfylling
  - ast: Fix panic when indexing composite literal values in x in
    [...] (#8918) reported and authored by @srenatus
  - ast: Fix TermValueEqual performance regression (#8863)
    authored by @mchitten
  - ast: Improve rule conflict error (#6391) authored by
    @unichronic, reported by @johanfylling
  - ast: Make CogeneratedExprs return deterministic order (#8895)
    authored by @sspaink
  - ast: Reject partial set and -object rules sharing a name
    (#8860) authored by @sspaink, reported by @shomron
  - ast: Restore location on unsafe var errors for rewritten head
    vars (#8719) authored by @Atishyy27, reported by
    @anderseknert
  - ast: Use more precise return types for object.* builtins
    (#8692) reported and authored by @anderseknert
  - ast+topdown: Let rule external sources distinguish absent
    from unknown (#8878) authored by @srenatus
  - ast+topdown: Parametrized (prefix) external rule sources
    (#8881) authored by @srenatus
  - topdown: Fix "a", "a" in {"a"} not returning true (#8747)
    authored by @anderseknert
  - topdown: Fix format_int precision loss for integers larger
    than 64 bits (#8857) authored by @Synvoya
  - topdown: Fix precision loss for integers larger than 64 bits
    in arithmetic and aggregates (#6281) authored by @Atishyy27,
    reported by @tsandall
  - topdown: Don't leak internal vars in Partial-Evaluation
    results (#6378) authored by @sspaink, reported by @nkey0
  - topdown/copypropagation: Avoid circular reference in
    Partial-Evaluation through call (#6428) authored by @sspaink,
    reported by @nkey0
  - topdown+util: Add generic SliceStack/GroupStack, unify
    refStack/functionMocksStack/saveStack (#8886) authored by
    @srenatus
  - topdown+util: Replace hand-rolled evalFunc/evalBuiltin pools
    with generic ResettablePool (#8886) authored by @srenatus
  - perf: Avoid allocations with custom Atoi and Atoi64 helpers
    (#8758) authored by @anderseknert
  - perf: Lazy init of scalars map in indexer (#8936) authored by
    @anderseknert
  - perf: Reduce allocations in index lookup (#8835) authored by
    @anderseknert
  - planner: Avoid redundant ruletrie.Children() call in Depth()
    (#8886) authored by @srenatus
  - planner: Unify functionMocksStack on generic GroupStack[T]
    (#8886) authored by @srenatus
  * Docs, Website, Ecosystem
  - ecosystem: Add agt-policies-africa — African data protection
    OPA policy pack (#8850) authored by @kingztech2019
  - ecosystem: Add Ghostunnel and NATS Plugin to Ecosystem
    (#8871) authored by @charlieegan3
  - ecosystem: Add Sencillo projects to ecosystem (#8818)
    authored by @hooksie1
  - docs: Add kubecon NA page (#8876) authored by @charlieegan3
  - docs: Add recommendations to follow Envoy's best practices
    (#8944) authored by @johanfylling
  - docs: Document rule indexer support for in, bare refs;
    modernize rego (#8822) authored by @srenatus, reported by
    @tsandall
  - docs: Document the compile metadata annotation (#8824)
    authored by @youdie006, reported by @anderseknert
  - docs: Fix broken OAuth2/OIDC policy examples (#8840) authored
    by @mailnike
  - docs: Fix decision_logs buffer_size_limit_events default in
    prose (#8866) authored by @s3onghyun
  - docs: Remove import rego.v1 (#8867) authored by @charlieegan3
  - docs: Some minor bug fixes to improve reporting (#8917)
    authored by @charlieegan3
  - docs: The Zed Rego extension link points at
    github.com/StyraInc/zed-rego (404). The repo now lives at
    github.com/StyraOSS/zed-rego. (#8883) authored by @mailnike
  - docs: Update cheatsheet files (#8868) authored by
    @charlieegan3
  - docs: Update regal and blog links (#8901) authored by
    @charlieegan3
  - docs: Updates examples to use some...in, add link to debugger
    (#8806) authored by @charlieegan3
  - website: Improve partial evaluation / data filtering
    documentation (#8625) authored by @mmzzuu
  - website: Import blog from medium (#8898) authored by
    @charlieegan3
  * Miscellaneous
  - ast: Add benchmark for rule index ref ordering (#8943)
    authored by @srenatus
  - ast: Various style fixes (#8938) authored by @anderseknert
  - build: Add Dockerfile.rego to validate image builds (#8401)
    authored by @jasdeepbhalla, reported by @anderseknert
  - build: Get just the needed commits for CI (#8940) authored by
    @charlieegan3
  - test: Start decommissioning test.WithTempFS (#8908) authored
    by @anderseknert
  - topdown: Add regression test for partial eval local names
    (#5226) authored by @sspaink, reported by @fab29p
  - topdown: Fix Partial-Evaluation test rejected by new conflict
    check (#8860) authored by @sspaink, reported by @shomron
  - topdown: Vendor a method-less text/template to restore
    whole-binary linker DCE (#7903) authored by @rchildress87,
    reported by @kruskall
  - workflows: Remove cpp from CodeQL language matrix (#8864)
    authored by @sspaink
  - workflows: Prune benchmarks to last 250 runs (#8834) authored
    by @srenatus
  - Dependency updates; notably:
  - build(go): Bump Go from 1.26.4 to 1.26.5 (#8875) authored
    by @srenatus
  - build(deps): Add github.com/reeflective/readline 1.3.0
  - build(deps): Add golang.org/x/term 0.45.0
  - build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.2
    to 4.9.4
  - build(deps): Bump github.com/go-logr/logr from 1.4.3 to
    1.4.4
  - build(deps): Bump github.com/huandu/go-sqlbuilder from
    1.41.0 to 1.42.1
  - build(deps): Bump github.com/prometheus/client_golang from
    1.23.2 to 1.24.0
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    2.5.34 to 2.5.36
  - build(deps): Bump golang.org/x/sync from 0.21.0 to 0.22.0
  - build(deps): Bump golang.org/x/text from 0.38.0 to 0.40.0
  - build(deps): Bump google.golang.org/grpc from 1.81.1 to
    1.82.1
  - build(deps): Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2
    (#8889) authored by @ahbarrios
  - Addressing GHSA-fxhp-mv3v-67qp
  - build(deps): Drop github.com/peterh/liner
  - build(deps): Drop github.com/KimMachineGun/automemlimit
    (#8869) authored by @charlieegan3
  - build(deps): Drop go.uber.org/automaxprocs (#8869) authored
    by @charlieegan3</changelog>
</package>
<package pkgid="d022bfd72d91cca7b37637dcb0af48f301ea8d988c3c0b04f55e92b79e7c523cf6bcb738d880e949a49cb26f6de67ebb1d63ea3ddbb88d1905bc57f2a5d840a7" name="opa-fish-completion" arch="noarch">
  <version epoch="0" ver="1.19.0" rel="52.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145600">- Update to version 1.12.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Support for String Interpolation in the Rego language
  - Faster compilation and runtime
  - Fixes published in the v1.11.1 release
  * String Interpolation (#4733)
  - The Rego language has been extended to support String
    Interpolation, which provides a readable means to compose
    strings containing dynamic values determined at evaluation
    time.
    An interpolated string is composed of a template-string
    containing zero or more template-expressions that evaluates
    to a value at evaluation time.
    The $ character prefix identifies a template-string, and
    template-expressions are declared by being enclosed in
    curly-braces ({, }).
    Additionally, undefined template-expression values don't halt
    evaluation; instead, &lt;undefined&gt; will be injected into the
    generated string.
    package interpolation
    allowed_roles := ["admin", "employee"]
    default role := "guest"
    role := input.role
    deny contains $"User {input.username}'s role was '{role}', but must be one of {allowed_roles}" if {
    not role in allowed_roles
    }
    {
    "deny": [
    "User &lt;undefined&gt;'s role was 'guest', but must be one of [\"admin\", \"employee\"]"
    ],
    }
    String interpolation is a more readable and less error-prone
    substitute for the sprintf built-in function.
    Authored by @johanfylling reported by @anderseknert
    Tip
    Help us out!
    New Rego language features are exciting, and we want to
    maximize their usefulness. If you come across tools and
    integrations in the community where string interpolation
    isn't properly handled, such as syntax highlighting, please
    reach out and let us know.
  * Runtime, SDK, Tooling
  - oracle: Refactor Oracle better support some and every (#8105,
    [#8131], #8138) authored by @charlieegan3
  - plugins/bundle: Prevent ns-level polling by validating
    intervals (#8082) authored by @jjhwan-h
  - plugins/discovery: Initialize plugins before downloading
    (#8071) authored by @jt28828
  - topdown: Introduce sink for context cancellation
  - topdown: Make regex.replace respect cancellation (#8089)
    authored by @srenatus
  - topdown: Make replace and strings.replace_n respect
    cancellation (#8089) authored by @srenatus
  - topdown: Use sink for concat (#8090) authored by @srenatus
  - perf: Avoid extra allocation in sink if no cancel (#8104)
    authored by @anderseknert
  * Compiler, Topdown and Rego
  - ast/compile: Deal with error limit without panic/defer
    (#8087) authored by @srenatus
  - ast/parser: Check if we need to unescape at all (#8135)
    authored by @srenatus
  - perf: Improved visitor implementation (10% faster
    compilation) (#8078) authored by @anderseknert
  - perf: Reduce allocations handling terms (#8116) authored by
    @anderseknert
  - perf: Type-checker performance improvements (#8143) authored
    by @anderseknert
  * Docs, Website, Ecosystem
  - website: Add support for rego string interpolation syntax
    highlighting (#8092) authored by @charlieegan3
  - docs/ocp: Update "concepts" for v0.3.0 (#8117) authored by
    @srenatus
  - website: Show playground errors (#8141) authored by
    @charlieegan3
  - website: Update a number of links to their new location
    (#8100) authored by @charlieegan3
  - docs: Remove link to feedback form (#8101) authored by
    @charlieegan3
  - website: Remove survey bar (#8136) authored by @charlieegan3
  - docs: Update community contacts (#8108) authored by
    @charlieegan3
  * Miscellaneous
  - ast/checks_test: Fix flaky tests (#8111) authored by
    @srenatus
  - benchmarks: Install node v24 (#8122) authored by @srenatus
  - download: Fix when compiling with tag opa_no_oci (#8070)
    authored by @srenatus reported by @mg0083
  - tests: Race in TestStatusUpdateBuffer (#8133) authored by
    @thevilledev
  - workflow: Integrate benchmarks notebook (#8121) authored by
    @srenatus
  - workflows: Skip all tests in benchmarks run (#8086) authored
    by @srenatus
  - Dependency updates; notably:
  - build: Bump golang from 1.25.4 to 1.25.5 (#8107) authored
    by @srenatus
  - build(deps): Bump google.golang.org/grpc from 1.76.0 to
    1.77.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145601">- Update to version 1.12.1:
  This bug fix release reverts a change to regex.replace that
  unintentionally changed its behaviour for anchored regular
  expressions.
  * Revert "topdown: make regex.replace respect cancellation"
    (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 1.12.2:
  This bug fix release address issues found in the new string
  interpolation feature
  * Add (*TemplateString).Copy() method (#8159) authored by
    @anderseknert
  * Fix template string not serialized with escaped { (#8161)
    authored by @anderseknert
  * fix(ast): skip template string vars in ref safety (#8174)
    authored by @thevilledev
  * fix(ast): use original var names in template error (#8180)
    authored by @thevilledev</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768478400">- Update to version 1.12.3:
  This is a bug fix release addressing two issues:
  * Bundle polling is being misconfigured when discovery bundle is
    updated (#8215)
    This is an issue where the polling interval for discovery
    (discovery.polling.min_delay_seconds and
    discovery.polling.max_delay_seconds) were misinterpreted on
    reconfiguration, causing extremely long update intervals.
  * Decision log size buffer buffer_size_limit_bytes misconfigured
    during reconfiguration (#8213)
    This is a regression in the decision log, where the
    decision_logs.reporting.buffer_size_limit_bytes was mistakenly
    assigned the value of
    decision_logs.reporting.upload_size_limit_bytes during
    reconfiguration.
    This issue is only present when
    decision_logs.reporting.buffer_type is set to size, which is
    the default value.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769774400">- Update to version 1.13.1:
  This bug fix release addresses an issue found in the new
  array.flatten built-in function
  - Fix issue in array.flatten handling of single item arrays
    (#8273) (#8272) authored by @anderseknert
- Update to version 1.13.0:
  This release contains a mix of new features, performance
  improvements, and bugfixes. Notably:
  - A new immediate upload trigger mode in the Decision Logger
  - A new array.flatten built-in function
  - Numerous performance improvements
  * Immediate Upload Trigger Mode in Decision Logger (#8110)
  - An immediate trigger mode has been added to the Decision
    Logger; enabled by setting the
    decision_logs.reporting.trigger configuration option to
    immediate.
    When enabled, log events are pushed to the log service as
    soon as the configured upload chunk size criteria is met; or,
    at latest, when the configured upload delay is reached.
  * Runtime, SDK, Tooling
  - cmd/fmt: Do not overwrite file on fmt without changes (#8222)
    authored by @Loic-R
  - cmd/test: Enable sorting JSON test results by duration
    (#7444) authored by @sspaink
  - profiler: nil *Profiler should not report Enabled() (#8256)
    authored by @anderseknert
  - rego: Add Data function to simplify adding data from map
    (#5961) authored by @majiayu000 reported by @anderseknert
  - runtime: Correct naming &amp; docs for version checking (#8191)
    authored by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Body.String() doesn't panic on empty body (#8244)
    authored by @srenatus
  - ast: Improve type error message when referencing functions
    (#6840) authored by @sspaink
  - ast: Type Checker recognizes when a variable has multiple
    assignments but is an undefined function (#7463) authored by
    @sspaink reported by @anderseknert
  - ast/parser: Avoid duplicate loc copies (#8142) authored by
    @srenatus
  - topdown: Add array.flatten built-in function (#8226) authored
    by @anderseknert
  - topdown: Fix issue where numbers.range_step built-in could
    erroneously return undefined value (#8194) authored by
    @thevilledev
  - topdown: Remove hard-coded missing key error in
    strings.render_template built-in (#7931) authored by
    @colinjlacy reported by @anderseknert
  - topdown: Re-introduce cancellation-awareness for
    regex.replace built-in (#8179) authored by @srenatus
  - from having been reverted in v1.12.1
  - topdown: Support arrays as input for json.match_schema
    (#6615) authored by @sspaink reported by @mscudlik
  * Performance
  - ast: Improved annotations parsing (#8210) authored by
    @anderseknert
  - ast: Reinstate zero-alloc paths in Ref.String() (#8202)
    authored by @anderseknert
  - ast: Replace regex implementation in IsVarCompatibleString
    (#8164) authored by @anderseknert
  - ast: Optimize Set.Intersect and Set.Diff (#8167) authored by
    @thevilledev
  - ast: Optimize Set.Union (#8172) authored by @thevilledev
  - ast: Reduce allocations in Expr.MarshalJSON (#8204) authored
    by @thevilledev
  - ast: Reduce allocations in Rule.MarshalJSON (#8205) authored
    by @thevilledev
  - ast: Reduce allocations in Term.MarshalJSON (#8200) authored
    by @thevilledev
  - ast: Reduce allocations in With.MarshalJSON (#8206) authored
    by @thevilledev
  - perf: String() implementations using appenders (#8192)
    authored by @anderseknert
  - topdown: Avoid redundancy in builtinTrim (#8237) authored by
    @thevilledev
  - topdown: Eliminate closure allocations in Set and virtual doc
    enumeration (#8242) authored by @alex60217101990
  - topdown: Fast paths for array.reverse (#8177) authored by
    @thevilledev
  - topdown: Optimize json.remove and json.filter (#8193)
    authored by @thevilledev
  - topdown: Optimize object built-ins (#8175) authored by
    @thevilledev
  - topdown: Optimize union built-in (#8173) authored by
    @thevilledev
  - topdown: Pre-alloc in various built-ins (#8198) authored by
    @thevilledev
  - topdown: Reduce allocs in float sum/product (#8235) authored
    by @thevilledev
  - topdown: Skip set copy in getObjectKeysParam (#8176) authored
    by @thevilledev
  * Docs, Website, Ecosystem
  - docs: Add authz-spring-boot-starter to Spring Security API
    ecosystem entry (#8234) authored by @francois-eckert
  - docs: Add header for crypto example to make (#8259) authored
    by @charlieegan3
  - docs: Add notes for automated agents (#8147, #8203) authored
    by @charlieegan3
  - docs: Add opa-wasm-zig to the ecosystem (#8163) authored by
    @burdzwastaken
  - docs: Add scripts to import docs from source (#8148) authored
    by @charlieegan3
  - docs: Explain how to use the SDK without a initialising a
    server (#8248) authored by @andrewcameronsims
  - docs: Fix a number of redirecting links (#8165 authored by
    @charlieegan3
  - docs: Fix template-expression examples (#8199) authored by
    @johanfylling
  - docs/ocp: Mention source prefix/path options (#8238) authored
    by @srenatus
  - website: Add redirect section for immutable referrers (#8262)
    authored by @charlieegan3 reported by @KraLeoD
  - website: Display 2025 survey results on the website (#8258)
    authored by @charlieegan3
  - website: Show breadcrumbs in search results (#8207) authored
    by @charlieegan3
  * Miscellaneous
  - Decoupled the Rego job check from the Go job checks in the
    Github PR workflow (#8203) authored by @SeanLedford
  - build: Format pr_check.rego with opa fmt (#8201) authored by
    @thevilledev
  - build: Migrate PR check to OPA policy (#8183) authored by
    @SeanLedford
  - build: Run go get against main to spot redacted (#8146)
    authored by @charlieegan3
  - deps: Switch to maintained go.yaml.in/yaml/v3 yaml library
    (#8182) authored by @mrueg
  - test/cases: Increase yaml test coverage for some regex and
    string builtins (#8152) authored by @srenatus
  - Dependency updates; notably:
  - build: bump golang from 1.25.5 to 1.25.6 (#8224) authored
    by @srenatus
  - build(deps): bump go.opentelemetry.io deps from
    1.38.0/0.63.0 to 1.39.0/0.64.0
  - build(deps): bump klauspost/compress from v1.18.1 to
    v1.18.2 (#8184) authored by @srenatus
  - because of redaction warning
  - build(deps): bump github.com/go-ini/ini from v1.67.0 to
    gopkg.in/ini.v1 v1.67.1 (#8208) authored by @gabrpt</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1771416000">- Update to version 1.13.2:
  This release updates the version of Go used to build the OPA
  binaries and images to 1.25.7.
  That version of the Go standard library contains a fix for
  GO-2026-4337.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772193600">- Update to version 1.14.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Improved rule indexing of variable assignments and x in {...}
    expressions
  - Support for --h2c with unix domain socket for opa run
  - A new glossary tooltip for technical terms in the docs
  - Fixes published in the v1.13.1 and v1.13.2 releases
  * Improved rule indexing of variable assignments and x in {...}
    expressions (#1841)
    With this change, the rule indexer will index expressions like:
    allow if input.role in {"admin", "user"}
    On lookup, the rule body will only be returned if input.role is
    either one of "admin" or "user".
    The reverse case is also indexed:
    allow if "admin" in input.roles
    in which the searched collection is unknown.
  * Runtime, SDK, Tooling
  - cmd,run: Support --h2c with unix domain socket (UDS) (#8282)
    authored by @srenatus reported by @theJC
  - cmd,tester: Add line number next to test file in pretty
    format (#8328) authored by @sspaink reported by @anderseknert
  - plugins: Fix race accessing registeredTriggers (#8363)
    reported and authored by @szuecs
  - rego: Add ResultValue[T]() helper method (#8320) authored by
    @srenatus
  - runtime: Add custom storage backend registration API (#8277)
    authored and reported by @alex60217101990
  - topdown: Add config option to disable named inter-query
    built-in cache (#7519) authored by @sspaink reported by
    @johanfylling
  * Compiler, Topdown and Rego
  - ast: Add index else == nil test, fix it (#8348) authored by
    @srenatus
  - ast: Add scaffolding to introspect and skip compiler stages
    (#8304) (authored by @srenatus)
  - ast: Ensure term values implement ast.StringLengther (#8374)
    authored by @charlieegan3
  - ast: Fix double-fix for refs["with-a"].dash as package
    (#8286) authored by @srenatus
  - ast: Optimized template-expression handling of values known
    to be defined (#8310) authored by @anderseknert
  - ast: Put rule indices into rule tree, change Values to
    []*Rule (#8298) authored by @srenatus
  - ast: Replace true expr when appending to empty body (#8299)
    authored by @anderseknert
  - ast: Return correct location of unsafe var in object (#7935)
    authored by @sspaink reported by @anderseknert
  - ast: Use StageID in WithStageAfterID, also for QueryCompiler
    (follow-up) (#8306) authored by @srenatus
  - compile: Add StringLength to lazy object (#8369) authored by
    @charlieegan3 reported by @robmyersrobmyers
  - parser: Add test to verify filename interning in Location
    (#8322) authored by @anderseknert
  - perf: Allocate less in array unification (#8351) authored by
    @anderseknert
  - perf: Various minor eval performance tweaks (#8290) authored
    by @anderseknert
  - perf: json.patch + interning improvements (#8289) authored by
    @anderseknert
  - topdown: Optimize bindings allocation with dynamic pre-sizing
    (#7266) authored by @alex60217101990
  - topdown: Preserve original package name with special
    characters in optimized builds (#8284) authored by @sspaink
    reported by @at50989
  - wasm: Updates (LLVM+tools) (#8295) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs: Add examples to glob.match built-in documentation
    (#8252) authored by @sibasispadhi reported by @anderseknert
  - docs: Add workflow to auto update Regal docs (#8318) authored
    by @charlieegan3
  - docs: Document metrics for http.send, regex, and glob
    built-ins (#6730) authored by @anivar reported by @rudrakhp
  - docs: Fix json.patch target description (#8271) authored by
    @anderseknert
  - docs: Update broken links (#8285) authored by @charlieegan3
  - docs: Update bundle signing docs to clarify key config
    (#8307) authored by @charlieegan3
  - docs: Update faulty example using bundle optimize (#5379)
    authored by @sspaink reported by @bluebrown
  - docs: Update interface{} -&gt; any in golang snippets (#8373)
    authored by @srenatus
  - docs/website: Add a new KubeCon event page (#8311) authored
    by @charlieegan3
  - docs/website: Add formatting and linting checks (#8288)
    authored by @charlieegan3
  - docs/website: Allow Regal import to use local dir (#8312)
    authored by @charlieegan3
  - docs/website: Implement new GlossaryTooltip component (#8367)
    authored by @charlieegan3
  - docs/website: Markdown linting and spell checking for
    documentation (#8292) authored by @charlieegan3
  - docs/website: Redirect /docs/latest/ecosystem (#8315)
    authored by @charlieegan3 reported by @tweekSun1
  * Miscellaneous
  - maintainers: Moving nilekhc to emeritus, and renew maintainer
    terms (#8276) authored by @JaydipGabani
  - ast: Add public method to extend the compliance test cases
    with IR plans (#7556) authored by @sspaink reported by
    @shomron
  - ast: Tiny nitpicky cleanup (#8309) authored by @srenatus
  - chore: Clean up bundle storage tests (#8267) authored by
    @anderseknert
  - chore: Remove unnecessary comment from bundle JWT
    verification impl (#8354) authored by @johanfylling
  - ci: Bump golangci-lint (v2.9.0), fix issues (#8314) authored
    by @srenatus
  - ci: Harden and update all GH Actions workflows (#8356, #8377,
    [#8368] authored by @philipaconrad and @srenatus
  - go: Cleanup old build flags (#8314) authored by @srenatus
  - rego: Remove superfluous package import of plugins (#6754)
    authored by @srenatus reported by @oxisto
  - tests: Extract runtime Info to new package (#8362) authored
    by @charlieegan3
  - tests: Fix BenchmarkFunctionArgumentCounts query (#8327)
    authored by @alex60217101990
  - tests: Disable rule indexing for benchmark (#8375) authored
    by @srenatus
  - workflows: Add nightly vuln checks for released
    versions/images (#8336 #8339) authored by @srenatus
  - Dependency updates; notably:
  - build: bump golang from 1.25.6 to 1.26.0
  - build(deps): build(deps): bump go.opentelemetry.io deps
    from 1.39.0/0.64.0 to 1.40.0/0.65.0
  - Applying fix for GHSA-9h8m-3fm2-qjrq
  - build(deps): bump github.com/dgraph-io/badger/v4 from 4.9.0
    to 4.9.1
  - build(deps): bump github.com/huandu/go-sqlbuilder from
    1.39.0 to 1.39.1
  - build(deps): bump golang.org/x/net from 0.49.0 to 0.50.0
  - build(deps): bump golang.org/x/text from 0.33.0 to 0.34.0
  - build(deps): bump google.golang.org/grpc from 1.78.0 to
    1.79.1
  - build(deps): bump go.opentelemetry.io deps from
    1.39.0/0.64.0 to 1.40.0/0.65.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773057600">- Update to version 1.14.1:
  This is a patch release collecting two bug fixes and various
  dependency updates for Golang standard library and common package
  vulnerabilities.
  These bug fixes include a revert of the rule indexer tweaks
  shipped in 1.14.0, which had caused unexpected lookup failures
  for some users. (We expect to properly fix the issue in 1.15.0,
  but for now, a revert is the quicker choice.)
  * Changes
  - Fix intermittent plugins manager deadlock on opa.configure
    (#8407)
  - Revert "ast: make rule index track var assignments and x in
    {...} (#8341)" (#8410)
  - build: bump deps (go.mod from main)
  - build: bump go 1.26.1 (#8409)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774612800">- Update to version 1.15.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Add logger plugin interface and file logger implementation
    with log rotation
  - Custom HTTPAuthPlugin behavior change, all per-request
    authentication logic must be moved from NewClient() to
    Prepare()
  - AWS signing supports for web identity for assume role
    credentials
  * Logger Plugin Support (#8434) (authored by @srenatus)
    OPA now supports pluggable logging implementations via the
    logger plugin interface, which is based on Go's standard
    log/slog.Handler interface. This allows any slog.Handler
    implementation to be used as a logger plugin. Loggers can be
    configured via the server.logger_plugin configuration option
    and used for both runtime logging and decision logs. OPA
    includes a built-in file logger plugin (file_logger) that
    writes structured JSON logs with rotation support using
    lumberjack. Users can also implement and register custom logger
    plugins when building OPA.
    Example configuration for server logging:
    server:
    logger_plugin: file_logger
    plugins:
    file_logger:
    path: /var/log/opa/server.log
    max_size_mb: 100
    max_age_days: 28
    max_backups: 3
    compress: true
    level: info
    Example configuration for decision logs using the same plugin:
    server:
    logger_plugin: file_logger
    decision_logs:
    plugin: file_logger
    plugins:
    file_logger:
    path: /var/log/opa/server.log
    max_size_mb: 100
    max_age_days: 28
    max_backups: 3
    compress: true
    level: info
  * Custom HTTPAuthPlugin behavior change (#8376) (authored by @srenatus)
    The HTTPAuthPlugin.NewClient() method is now called once per
    Client instance and cached rather than being called for every
    request. Custom plugins that performed per-request operations
    in NewClient() (such as request counters, per-request transport
    wrapping, or logging/metrics side effects) will now only
    execute those operations once. All per-request authentication
    logic must be moved from NewClient() to Prepare(). All plugins
    included in OPA have been updated and are unaffected by this
    change.
  * Runtime, SDK, Tooling
  - plugins/logger: Add logger plugin interface and file logger
    implementation with log rotation (#8434) (authored by
    @srenatus)
  - plugins/logs: Decision logs can now use logger plugins for
    output (#8434) (authored by @srenatus)
  - logging: Add BufferedLogger to capture early startup logs
    before plugins are initialized (#8434) (authored by
    @srenatus)
  - plugins/rest: Configurable re-read interval for TLS client
    certificates via cert_reread_interval_seconds field.
    Defaults to re-reading on every request for backwards
    compatibility.  The implementation also uses content hashing
    to detect changes and avoid re-parsing unchanged TLS
    certificates and keys. (#8376) (authored by @srenatus)
  - plugins/rest: All TLS configurations now inherit the minimum
    version and TLS ciphersuites as configured for the server.
    (#8376) (authored by @srenatus)
  - internal/providers/aws: Refactor deprecated crypto/elliptic
    APIs to crypto/ecdh (#8395) (authored by @kanywst)
    plugins/rest: AWS Signing - Allow Service Account (Web
    Identity) credentials for Assume Role Credentials (#8386) (
    authored by @tiagogviegas)
  * Compiler, Topdown and Rego
  - ast: fix overlapping array and scalar pattern in rule index
    (authored by @srenatus)
  * Bundles
  - optimized bundles: filter metadata comments properly ( #8388)
    (#6529) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs(ecosystem): add Kopa ecosystem entry (#8405) (authored
    by @sfreet)
  - docs: Update KubeCon event listing (#8439) (authored by
    @charlieegan3)
  - docs: fix input of partial-evaluation example (#8430)
    (authored by @edobrb)
  - ecosystem: add Big ACL (#8389) (authored by @francois-eckert)
  - Regal v0.39.0 doc updates (#8383) (authored by @anderseknert)
  * Miscellaneous
  - build/generate-extended-cases: Fix testcase loader to use
    json.Number. (#8429) (authored by @philipaconrad)
  - Filter compliance test cases using capabilities file (#8418)
    (authored by @sspaink)
  - Fix intermittent plugins manager deadlock on opa.configure
    (#8407) (authored by @sspaink)
  - Linter configuration cleanup (#8397) (authored by
    @anderseknert)
  - fix nightly.yaml by moving secret to env (#8381) (authored by
    @sspaink)
  - fix release-vulnerability-check.yaml (authored by @sspaink)
  - nightly+release-vuln-check: add links to slack msg payloads
    (authored by @srenatus)
  - Dependency updates; notably:
  - build: bump go 1.26.1 (#8409) (authored by @srenatus)
  - gha: bump trivy-action (authored by @srenatus)
  - build(deps): bump google.golang.org/grpc from 1.79.1 to
    1.79.3 (#8428) (authored by @dependabot[bot])
  - build(deps): bump github.com/vektah/gqlparser/v2 from
    2.5.31 to 2.5.32 (#8399) (authored by @dependabot[bot])
  - build(deps): bump modernc.org/sqlite from 1.45.0 to 1.46.1
    (#8399) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/time from 0.14.0 to 0.15.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump github.com/microsoft/go-mssqldb from
    1.9.6 to 1.9.7(#8412) (authored by @dependabot[bot])</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774872000">- Update to version 1.15.1:
  * Miscellaneous
  - logging: make WithContext() optional (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775736000">- Update to version 1.15.2:
  No changes related to the openSUSE package, only GitHub release
  workflow updates (use go1.26.2)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777550400">- Update to version 1.16.0:
  This release contains a mix of new features, performance
  improvements, and bugfixes. Notably:
  - New uri.parse and uri.is_valid built-in functions
  - Data API Request/Response Metadata
  - Prometheus metrics exported via OTLP
  - Formatter improvements
  NOTE:
  In v1.15.x, OPA was dropping logs for bundle downloads, print()
  calls and other plugin-originated logs.
  Users are advised to update, v1.16.0 fixes this bug in (#8544).
  * New uri.parse and uri.is_valid built-in functions (#8263)
    Two new built-in functions have been added: uri.parse for
    parsing a given URI, and uri.is_valid for verifying the
    structure of a given URI.
  - uri.parse
    Parses a URI and returns an object containing its components
    according to RFC 3986. Empty components are omitted.
    package example
    test_uri if {
    uri.parse("https://example.com:8080/api?q=1#top") == {
    "scheme": "https",
    "hostname": "example.com",
    "port": "8080",
    "path": "/api",
    "raw_path": "/api",
    "raw_query": "q=1",
    "fragment": "top",
    }
    }
  - uri.is_valid
    Returns true if the input can be parsed as a URI, false otherwise.
    package example
    deny contains "invalid URI" if {
    not uri.is_valid("http://[invalid")
    }
  * Data API Request/Response Metadata (#8570)
    Wrapping projects can now attach custom metadata to Data API
    requests and have evaluation produce response metadata.
    Two distinct metadata paths are introduced:
  - Request metadata: parsed from extra top-level keys in the
    request body, made available to builtins via
    BuiltinContext.RequestMetadata. Logged in the decision log
    under Custom["request_metadata"].
  - Response metadata: a separate map
    (BuiltinContext.ResponseMetadata) that builtins can populate
    during evaluation. Only included in the API response and
    decision log if non-empty.
    In vanilla OPA, no builtins write response metadata, so
    responses are unchanged. The request metadata map is only
    allocated when the request carries extra fields; the response
    map is one empty map per request.
    To avoid conflicts with future OPA top-level keys, callers
    should use a namespaced key: {"input": {...},
    "com.example.opa/md": {...}}.
    Request with metadata:
    curl -H 'Content-Type: application/json' \
  - d '{"input": {"user": "alice"}, "com.example.opa/metadata": {"corp-id": "acme-42"}}' \
    http://localhost:8181/v1/data/example/allow
    Response (response metadata included if, for example, set by a
    custom builtin):
    {
    "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
    "result": true,
    "com.example.opa/response": {
    "snapshot_version": "v3"
    }
    }
    Decision log entry:
    {
    "custom": {
    "request_metadata": {
    "com.example.opa/metadata": {
    "corp-id": "acme-42"
    }
    },
    "response_metadata": {
    "com.example.opa/response": {
    "snapshot_version": "v3"
    }
    }
    },
    "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
    "input": { "user": "alice" },
    "msg": "Decision Log",
    "path": "example/allow",
    "result": true
    }
  * Runtime, SDK, Tooling
  - distributedtracing: Export Prometheus metrics via OTLP
    (#7591) reported and authored by @Munken
  - cmd,tester: Update opa test to stream test case results
    (#3676) authored by @sspaink reported by @tsandall
  - cmd,tester: Show full errors when test fails and using
  - -coverage (#8438) authored by @grosser
  - format: Add new line between METADATA blocks (#8483) authored
    by @sspaink
  - format: Allow indenting all withs in expression (#8508)
    authored by @anderseknert
  - format: Fix dropping comments after handling
    unexpectedCommentError (#8553) authored by @sspaink
  - format: Preserve location of trailing comments inside every
    body (#8558) authored by @johanfylling
  - format: Prevent opa fmt from formatting single attribute
    objects with comments (#7565) authored by @sspaink reported
    by @anderseknert
  - logging: Keep forwarding from BufferedLogger after Flush()
    (#8544) authored by @srenatus reported by @annieyhuang
  - plugins/logs: Fix logBuffer eviction loop only dropping one
    element (#8543) authored by @sspaink
  - plugins/logs: Fix out-of-order plugin status notifications
    (#8009) authored by @sspaink reported by @Pushpalanka
  - plugins/rest: Carry over all of *tls.Config (#8473) authored
    by @srenatus reported by @ashu2496
  - server: Drop HTML index page query form (#8477) authored by
    @johanfylling reported by @srenatus and @r0binak
  - server: Skip chmod for abstract Unix domain sockets (#8536)
    authored by @bakayolo
  - storage/inmem: Avoid allocations from Read() in MakeDir()
    (#8561) authored by @srenatus
  - tester: Add method to match tests by ref prefixes (#6696)
    authored by @anderseknert
  - Note: Experimental.
  * Compiler, Topdown and Rego
  - ast: Allow Back-to-back metadata blocks (#8482) authored by
    @sspaink reported by @johanfylling
  - ast: Catch functions in dynamic extent of ref head rule
    (#8461) authored by @srenatus reported by @johanfylling
  - ast: Fix parenthesis in String() of {obj,arr,set}
    comprehensions (#8511) authored by @srenatus
  - ast: Fix parsing of unary - in front of a ref (#5014)
    authored by @mmzzuu reported by @philipaconrad
  - ast: Fix type checker match error for objects with set keys
    (#6260) authored by @sspaink reported by @tsandall
  - ast: Fix type checker to recognize numeric index in generated
    map (#6736) authored by @sspaink reported by @anderseknert
  - ast: Handle underdetermined function args (#5234) authored by
    @sspaink reported by @obataku
  - ast: Identify compatible type from reference in type checker
    (#7273) authored by @sspaink reported by @anderseknert
  - ast: Support recursive JSON Schemas (#6099) authored by
    @sspaink reported by @anderseknert
  - builtins: Add support for days, weeks and years in
    time.parse_duration_ns built-in function (#2719) authored by
    @sspaink reported by @freeseacher
  - builtins: Fix graph.reachable_paths to return all reachable
    paths (#5871) authored by @davidmarne-wf reported by
    @ericjkao
  - builtins: Limit exponent size in units.parse_bytes built-in
    function to prevent timeout bypass (#8326) authored by
    @isaiahvita reported by @anderseknert
  - perf: Add CopyNonGround() methods for Array, Set, and Object
    (#8323) authored by @alex60217101990
  - resolver/wasm: Add NewWithContext to allow passing context
    (#8499) authored by @dominikschulz
  * Docs, Website, Ecosystem
  - docs: Add aggregates examples for count and sum built-in
    functions (#8566) authored by @alliasgher reported by
    @srenatus
  - docs: Add generated output.jsons for docs examples (#8535)
    authored by @charlieegan3
  - docs: Add spec for OCP bundle status tracking API (#8502)
    authored by @ashutosh-narkar
  - docs: Add the latest videos to the README presentations
    section (#8523) authored by @sspaink
  - docs: Add Windows development notes to dev reference guide
    (#8422) authored by @raajheshkannaa
  - docs: Fix input value type in not undefined example (#8580)
    authored by @menma1234
  - docs: Update Regal docs to v0.40.0 (#8538) authored by
    @charlieegan3
  - docs: Updated roadmap link (#8501) authored by @johanfylling
  - docs: Various typo fixes (#8529) authored by @sspaink
  - ecosystem: Add vulnetix ecosystem entry (#8532) authored by
    @0x73746F66
  - ecosystem: Add KubeStellar Console (#8560) authored by
    @clubanderson
  - website: Add banner to show when event has passed (#8493)
    authored by @charlieegan3
  - website: Add copy-as-markdown button to doc pages (#8540)
    authored by @charlieegan3
  - website: Copy button improvements (#8577) authored by
    @charlieegan3
  - website: Remove old redirects, add new management redirect
    (#8424) authored by @charlieegan3 reported by @narainar
  - website: Update intro video on homepage (#8547) authored by
    @charlieegan3
  * Miscellaneous
  - build: Exclude domains that cause false positives (#8533)
    (#8495) authored by @charlieegan3
  - e2e/cli: Add test for debug print() logging (#8567) authored
    by @srenatus
  - e2e/cli: Start CLI E2E tests (#8545) authored by @srenatus
  - github: declare formatted rego as rego (#8564) authored by
    @srenatus
  - Security policy update (#8479) authored by @anderseknert
  - Dependency updates; notably:
  - build: bump go 1.26.2 (#8497) authored by @sspaink
  - build(deps): bump wasmtime-go from v39.0.1 to v43.0.2
  - build(deps): bump go.opentelemetry.io deps from
    1.40.0/0.65.0 to 1.43.0/0.68.0
  - build(deps): bump github.com/containerd/containerd/v2 from
    2.2.1 to 2.2.3
  - build(deps): bump ithub.com/huandu/go-sqlbuilder from
    1.39.1 to 1.40.2
  - build(deps): bump golang.org/x/net from 0.51.0 to 0.53.0
  - build(deps): bump golang.org/x/text from 0.34.0 to 0.36.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777636800">- Update to version 1.16.1:
  This is a patch release addressing a regression in the plugin
  manager that may cause the service to hang on shutdown (#8590).</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.16.2:
  This release updates the version of Go used to build the OPA
  binaries and images to 1.26.3; addressing a number of
  vulnerabilities.
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
  This is CVE-2026-42501 and Go issue https://go.dev/issue/79070
  * build: bump go 1.26.2 -&gt; 1.26.3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 1.17.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - A new future.keywords.not import that adds improved semantics
    to the not keyword.
  - Rule Labels in Decision Logs
  - Published json schema for IR and bundle manifest
  - Dropped automaxprocs and x/net dependencies
  * Improved Negation Semantics (#8387)
    This OPA release introduces a new future.keywords.not import
    that fixes a long-standing semantic issue with negation in
    Rego.
    Without the import, the compiler expands a negated composite
    expression like not f(g(input.x)) into a series of
    sub-expressions evaluated before the not:
    __local0__ = input.x
    g(__local0__, __local1__)
    not f(__local1__)
    If any sub-expression fails — for example, input.x is undefined
    or g produces an undefined result — the entire rule fails
    rather than the not succeeding.  This is unintuitive: the
    user's intent is "the condition does not hold," but an
    undefined intermediate value causes a silent failure instead of
    the expected not result.
    With import future.keywords.not, composite-expression negation
    wraps the full compiler expansion in an implicit body:
    not { __local0__ = input.x; g(__local0__, __local1__); f(__local1__) }
    Now, if any sub-expression is undefined or fails, the body is
    unsatisfiable and the not expression succeeds; matching the
    intuition that "the condition does not hold."
    NOTE:
    Users are recommended to import future.keywords.not whenever
    the not keyword is used in a policy.
  * Rule Labels in Decision Logs (#2089)
    Rule annotations now support a labels field. Labels from all
    successfully evaluated rules are collected and included in each
    decision log entry as a top-level rule_labels array. Each
    element is the merged label map for one successfully evaluated
    rule, with inner-scope-wins precedence across the rule's
    annotation chain (subpackages &lt; package &lt; document &lt; rule).
    Merged maps are deduplicated across rules so that identical
    label sets collapse to a single entry.
    [#] METADATA
    [#] scope: package
    [#] labels:
    [#]   service: authz
    [#]   severity: info
    package myapp
    [#] METADATA
    [#] labels:
    [#]   severity: low
    [#]   team: platform
    allow if input.role == "admin"
    The resulting decision log entry will contain:
    {"rule_labels": [{"service": "authz", "severity": "low", "team": "platform"}]}
    Note how severity: info from the package scope is overridden by
    severity: low from the rule scope. Queries against rule_labels
    can now rely on each entry carrying the full label context for
    a single rule, rather than one entry per contributing scope.
    Both the runtime and the Go SDK now process metadata
    annotations by default.
  * Runtime, SDK, Tooling
  - ast: Allow $ref in allOf in JSON schemas (#6523) authored by
    @deeglaze reported by @mosiac1
  - bundle: Update bundle roots conflict detection algorithm.
    (#8664) authored by @philipaconrad
  - download: Use oras, not containerd (#8639) authored by
    @srenatus
  - server: Remove dead code (s.partials) (#8708) authored by
    @srenatus
  - server: Wire in response/request metadata for compile handler
    (#8650) authored by @srenatus
  - server/types: generalize request/response metadata (#8650)
    authored by @srenatus
  * Compiler, Topdown and Rego
  - builtins: Enable pattern validation in json.verify_schema and
    json.match_schema built-in functions (#6089) authored by
    @sspaink reported by @ewout8
  - ir: Don't capitalize index field in MakeNumberRefStmt IR
    statement (#6266) authored by @sspaink reported by
    @johanfylling
  - perf: Avoid allocating in binary and/or operators when
    possible (#8689) authored by @anderseknert
  - rego: Allow per-eval GenerateJSON function (#8690) authored
    by @anderseknert
  * Docs, Website, Ecosystem
  - ecosystem: add OPA MCP (#8618) authored by @OrygnsCode
  - docs: Add explicit address binding to examples (#8688)
    authored by @charlieegan3
  - docs: Add titles to code blocks in policy-testing (#8649)
    authored by @charlieegan3
  - docs: Correct OCP SSH key docs (#8675) authored by @taurelius
  - docs: Update diagram to match index examples (#8667) authored
    by @charlieegan3
  * Miscellaneous
  - ast,storage/inmem: Add inmem.NewFromASTObject and add missing
    string case to ast.InternedValue (#8707) authored by
    @anderseknert
  - build: go install -&gt; go install tool to control checksums
    (#8646) authored by @srenatus
  - build: Push edge binaries to bucket (#8668) authored by
    @charlieegan3
  - workflows: Fix benchmarks workflow (replace action, avoid
    stackoverflow) (#8655) authored by @srenatus
  - workflows: Note improvements in benchmark comments (#8673)
    authored by @srenatus
  - Generate a JSON Schema for the IR plan (#8662) authored by
    @sspaink reported by @kroekle
  - Generate a JSON Schema for the bundle manifest (#8661)
    authored by @sspaink reported by @kroekle
  - Dependency updates; notably:
  - build(deps): Remove automaxprocs dependency (#8696)
    authored by @anderseknert
  - build(deps): Remove direct x/net dependency (#8697)
    authored by @anderseknert
  - build(deps): Bump github.com/bytecodealliance/wasmtime-go
    from 43.0.2 to 44.0.0 (8652) authored by @srenatus
  - build(deps): Bump github.com/fsnotify/fsnotify from 1.9.0
    to 1.10.1
  - build(deps): Bump github.com/huandu/go-sqlbuilder from
    1.40.2 to 1.41.0
  - build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.0
    to 3.1.1
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    2.5.32 to 2.5.33
  - build(deps): Bump google.golang.org/grpc from 1.80.0 to
    1.81.0
  - build(deps): Bump gopkg.in/ini.v1 from 1.67.1 to 1.67.2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780920000">- Update to version 1.17.1:
  This release uses the latest version of Go (1.26.4) to build OPA,
  fixing stdlib vulnerabilities in code that OPA's HTTP handler and
  crypto builtins use:
  - https://pkg.go.dev/vuln/GO-2026-5039
  - https://pkg.go.dev/vuln/GO-2026-5037
  It is otherwise the same code as v1.17.0.
  * Miscellaneous
  - build: bump go 1.26.3 -&gt; 1.26.4 (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782648000">- Update to version 1.18.0:
  This release contains a mix of bugfixes and small features.
  Notably:
  - A breaking fix to the outbound User-Agent header so it conforms
    to RFC 9110 (see below)
  - Container-aware resource limits: automatic GOMAXPROCS is
    restored and automatic GOMEMLIMIT is now supported
  - Several opa fmt correctness fixes
  - Improvements to opa test --coverage (ranges in report, inline
    rule head tracking, conjunction-expression coverage)
  * Breaking: Fix User-Agent according to RFC9110 (#8792)
  - OPA's outbound HTTP requests (bundle, discovery, decision
    log, status, http.send, AWS KMS/ECR) previously sent
    User-Agent: Open Policy Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;), which
    is not a valid RFC 9110 User-Agent value because the product
    token cannot contain spaces. The header is now
    Open-Policy-Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;). Server-side log
    filters or WAF rules that exact-match the old string will
    need to be updated.
  * Runtime, SDK, Tooling
  - bundle: fix per-module rego version lookup (#8797) authored
    by @sspaink, reported by @xubinzheng
  - bundle: improve determinism of file_rego_versions patterns
    with overlap (#8733) authored by @philipaconrad
  - cover: Track inline rule head in post trace walk (#6531)
    authored by @charlieegan3, reported by @anderseknert
  - cover: Update report to include ranges (#8748) reported and
    authored by @charlieegan3
  - cover: Add support for coverage of conjunction exprs (#8809)
    authored by @charlieegan3
  - download/oci: Set Accept headers (#8720) authored by
    @charlieegan3
  - fmt: preserve the multiline but single entry iterables
    (#8557) authored by @unichronic, reported by @anderseknert
  - format: Fix dropped with-clause after comment in object value
    (#8765) authored by @sspaink, reported by @srabraham
  - format: keep lone with on the closing-bracket line of
    multi-line expressions (#8804) authored by @anneheartrecord,
    reported by @burnster
  - oracle: Fix find-definition on expressions inside ast.Not
    nodes (#8731) authored by @johanfylling
  - runtime: Restore goautomaxprocs, add automemlimit (#8784)
    authored by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Apply location to inner ast.Not expressions (#8717)
    authored by @johanfylling, reported by @anderseknert
  - ast: Clean up code for value comparisons (#8737) authored by
    @anderseknert
  - ast: Fix PE regression for future.keywords.not negation
    inside every (#8781) authored by @johanfylling
  - internal/edittree: Add recursive tree node recycling (#8693)
    authored by @philipaconrad
  - internal: compile,planner: improve determinism of plan/wasm
    bundle builds (#8732) authored by @philipaconrad
  - perf: avoid allocations in object.get (#8729) authored by
    @anderseknert
  - topdown: Fix PE not namespacing vars in comprehensions nested
    inside every (#8816) authored by @johanfylling
  - topdown: remove dst.Compare(src) shortcut (#8739) authored by
    @srenatus
  - topdown: skip strconv.ParseInt in format_int base-10 fast
    path (#8801) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs/chore: Remove broken links (#8714) authored by
    @charlieegan3, reported by @github-actions
  - docs: PoC for kapa.ai (#8125) reported and authored by
    @charlieegan3
  - docs(ecosystem): update OPA MCP entry with video, blog, and
    distribution links (#8712) authored by @OrygnsCode
  - docs/contributing: add formatting (#8740) authored by @mmzzuu
  - docs: Add SDK references for evaluating IR plans (#8783)
    authored by @charlieegan3
  - docs: Add depkeep to enterprise support (#8685) authored by
    @pkuzco
  - docs: Add notes about use of GOMEMLIMIT (#8771) authored by
    @charlieegan3
  - docs: Add we/our/us check to spell check (#8787) authored by
    @charlieegan3
  - docs: Update built-in index page titles (#8728) authored by
    @charlieegan3
  - docs: Update documentation to be more consistent and sound
    more like reference docs (#8786) authored by @charlieegan3
  - docs: Update regal docs for 0.41.1 release (#8730) authored
    by @charlieegan3
  - docs: Update to agents.md regarding security dependences
    'fixes' (#8754) authored by @charlieegan3
  - docs: clarify environment variable substitution behaviour
    (#8713) authored by @taurelius
  - docs: remove duplicated word in Rego style guide (#8800)
    authored by @s3onghyun
  - website: Add .md alternate content types for llms (#8725)
    authored by @charlieegan3
  - website: Add support page disclaimer and sort by date added
    (#8736) authored by @charlieegan3
  - website: Fix build from missing dateAdded (#8764) authored by
    @charlieegan3
  - website: Update docusaurus (#8756) authored by @charlieegan3
  - website: Update homepage AI example to tool calls (#8755)
    authored by @charlieegan3
  - website: Various updates to node and website deps (#8768)
    authored by @charlieegan3
  - website: add ossrisk to ecosystem (#8780) authored by @pkuzco
  * Miscellaneous
  - benchmarks: smaller tweaks (#8759) authored by @srenatus
  - benchmarks: split off script, emit markdown table (#8812)
    authored by @srenatus
  - benchmarks: use details+summary comments for benchlab results
    (#8811) authored by @srenatus
  - capabilities: Integrate 1.17.1 patch release (#8798) authored
    by @sspaink
  - chore: tidy go.mod to remove untagged versions (#8791)
    authored by @thaJeztah
  - e2e: Add proto schemas for the IR plan and bundle manifest
    (#8766) reported and authored by @sspaink
  - gha: deduplicate change-detection output in pr CI checks
    (#8808) authored by @sspaink
  - nightly: use regal@main (#8735) authored by @srenatus
  - workflow: remove tests from docker (edge) image build (#8721)
    authored by @srenatus
  - workflows: bring back docker edge tags for post-merge (#8718)
    authored by @srenatus
  - workflows: use go-version-file with actions/setup-go (#8751)
    authored by @srenatus
  - Dependency updates; notably:
  - build(deps): Add github.com/KimMachineGun/automemlimit
    v0.7.5
  - build(deps): Add go.uber.org/automaxprocs v1.6.0
  - build(deps): Bump github.com/dgraph-io/badger/v4 from
    v4.9.1 to v4.9.2
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    v2.5.33 to v2.5.34
  - build(deps): Bump
    go.opentelemetry.io/contrib/bridges/prometheus from v0.68.0
    to v0.69.0
  - build(deps): Bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
    from v0.68.0 to v0.69.0
  - build(deps): Bump go.opentelemetry.io/otel from v1.43.0 to
    v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace from
    v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
    from v1.43.0 to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/sdk from v1.43.0
    to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/sdk/metric from
    v1.43.0 to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/trace from
    v1.43.0 to v1.44.0
  - build(deps): Bump golang.org/x/sync from v0.20.0 to v0.21.0
  - build(deps): Bump golang.org/x/text from v0.37.0 to v0.38.0
  - build(deps): Bump google.golang.org/grpc from v1.81.0 to
    v1.81.1
  - build(deps): Bump gopkg.in/ini.v1 from v1.67.2 to v1.67.3
  - build(deps): Bump oras.land/oras-go/v2 from v2.6.0 to
    v2.6.1
  - build(deps): bump golang.org/x/crypto to v0.52.0 and
    golang.org/x/net to v0.55.0 (#8745) authored by @BGebken
  - build: bump go 1.26.3 -&gt; 1.26.4 (#8726) authored by
    @srenatus</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782907200">- Update to version 1.18.1:
  This release fixes a memory leak introduced in OPA v1.17.0. It is
  advised to update if you notice excess memory usage when running
  OPA server.
  * Fixes
  - ast: fix AnnotationSet memory leak via runtime.AddCleanup
    cycle (#8817) authored by @srenatus reported by @keydon and
    @gorsr01</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782993600">- Update to version 1.18.2:
  This release includes a bug fix for a opa fmt regression
  introduced in v1.18.0.
  The original fix for #8557 had the formatter enforce newlines in
  single-item collections (arrays, objects, sets) rather than
  merely honoring existing ones. As a result, running opa fmt on
  already-formatted policies could introduce a large number of
  unwanted changes. This patch release restores the intended
  behavior: only newlines already present in the source determine
  whether a single-item collection is formatted on one line or
  across multiple lines.
  * Fixes
  - Fix regression in fix of #8557 (#8845) (authored by
    @anderseknert)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1785499200">- Update to version 1.19.0:
  * This release contains a mix of new features and bug fixes.
    Notably:
  - A fixed SQL injection vector in the Compile API
  - Stricter safety checking for Rego assignments (:=)
  - A cgo-free, faster WebAssembly runtime (wazero replaces
    wasmtime-go)
  - Startup warnings for unknown configuration options
  - A new strings.split_n built-in function
  - A REPL line reader that handles pasted input correctly,
    migrating existing history files
  * Fix SQL injection vector in Compile API: Quote SQL filter field
    identifiers (#8945)
  - The field names in the SQL emitted by the Compile API come
    from partially evaluated refs, so a policy that selects a
    dynamic key — such as input.fruits[input.column] — puts
    caller-controlled text in an identifier position. That text
    was emitted verbatim, which turns
    WHERE fruit.name = 'allowed'
    into
    WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'
    and an application appending the filter to its query returns
    rows the policy denies.
    Field segments that are not bare identifiers are now quoted
    at the UCAST-to-SQL boundary, with any embedded quote
    character escaped. Ordinary column names stay unquoted, so
    existing filters keep their current shape and remain
    case-insensitive on Postgres.
  * Behavior change: stricter safety for assignment (:=) (#3546)
  - The assignment operator (:=) is documented as "syntactic
    sugar for =, local variable creation, and additional compiler
    checks," and the safety checker reflects that: after
    rewriting, := is treated identically to = (unification), so
    an assignment's right-hand side can be made safe by unifying
    "backwards" through the left-hand side. This means policies
    like x := y; x = 7 compile (binding y to 7) even though y is
    never assigned, and x := y; obj[x] can silently degrade an
    expected constant-time lookup into full iteration.
    This change makes the right-hand-side of := be treated as a
    read that must be made safe by other expressions, and can no
    longer be satisfied through the left-hand-side. Affected
    policies that previously compiled now fail with a
    rego_unsafe_var_error. Reference iteration on the
    right-hand-side (e.g.  some k; v := obj[k]) is unaffected.
    Note: this is a deliberate semantic change, not a fix to
    match documented behavior — the intended semantics of := in
    this case were never specified.
  - WebAssembly runtime: wasmtime-go replaced with wazero (#7557)
    OPA's WebAssembly runtime — used by the wasm evaluation
    target and the WASM SDK — now runs on the pure-Go wazero
    runtime instead of bytecodealliance/wasmtime-go. This removes
    the cgo dependency from this path, so wasm-enabled builds no
    longer need a C toolchain.
    Compiled policy modules are now cached process-wide, so
    repeated VM creation for the same policy skips recompilation.
    On an Apple M4 Max this makes wasm cold start (compile +
    instantiate + first eval) about 73% faster, and warm
    evaluation about 29% faster with ~28% fewer allocations.
  - Configuration validation moved to Rego, with warnings on
    unknown options (#8891)
    Top-level configuration validation and default injection
    (default_decision, default_authorization_decision, labels) is
    now expressed as an embedded Rego policy rather than
    hand-written Go, as is the validation of server.metrics and
    metrics_export.
    The user-visible effect is that unrecognized configuration
    options are reported instead of being silently ignored. A
    typo such as decision_log instead of decision_logs now logs a
    warning at startup:
    {"level":"warning","msg":"unknown configuration option \"decision_log\" encountered"}
    These are warnings, not errors: OPA starts as before, and
    sections that are intentionally user-extensible are left
    alone, so extra keys there do not warn. Embedders reading
    configuration through config.ParseConfig can find the same
    messages on Config.Warnings.
  - Add strings.split_n built-in function (#8344)
    Policies often need only the first or last few parts of a
    split string, but the existing split built-in always returns
    every part, so the count has to be worked around with
    wildcards or a slice.
    strings.split_n takes the first n split parts from the front
    or the back of the string, depending on whether n is positive
    or negative:
    result := strings.split_n("a.b.c.d", ".", 2)
    [#] result == ["a", "b"]
    result := strings.split_n("a.b.c.d", ".", -2)
    [#] result == ["c", "d"]
    If abs(n) is larger than the number of parts, all parts are
    returned. An n of 0 returns an empty array.
  - Improved REPL line editing, with history file migration
    (#962)
    Pasting a tab-indented snippet into the REPL triggered
    tab-completion on the pasted tab, corrupting the input (e.g.
    injecting a completion candidate mid-line and producing a
    spurious parse error).  Fixing that requires bracketed paste,
    where the terminal wraps pasted text in markers so the line
    reader inserts it literally instead of treating an embedded
    tab as a completion request. The previous reader,
    peterh/liner, has no bracketed-paste support and is
    unmaintained (last release 2021), so it has been replaced
    with reeflective/readline.
    The new reader persists history as JSON lines instead of one
    command per line. Existing history files (~/.opa_history by
    default, or the path given to --history) are detected and
    migrated in place the first time the REPL loads them, so
    history written by earlier versions of OPA is kept.  OPA's
    own multi-line buffering is unchanged, and readline's native
    multi-line editing is left disabled to avoid changing REPL
    behavior.
  * Runtime, SDK, Tooling
  - cmd: Avoid intermediate buffer when writing bundle (#8909)
    authored by @anderseknert
  - cmd/build: Add --format flag for proto/JSON plan bundles to
    opa build (#8825) authored by @sspaink
  - cmd/check: Report wrapped structured errors individually
    (#3663) authored by @sspaink, reported by @oren-zohar
  - compile: Preserve package annotations in wasm bundle builds
    (#8854) authored by @srenatus, reported by @me-viper
  - format: Keep rule body inline when the head spans multiple
    lines (#8894) authored by @Kunalbehbud, reported by
    @charlieegan3
  - repl: Use a plain line reader for non-terminal input (#8941)
    authored by @sspaink
  - server: Set ReadHeaderTimeout to 32s on all HTTP servers
    (#8877) authored by @RinZ27
  - server/failtracer: Skip self-referential undefined-ref hints
    (#8916) authored by @srenatus
  - sdk: Allow customizing HTTP RoundTripper per Decision (#8884)
    authored by @paulo-raca
  - sdk: Fix deadlock between OPA.Plugin and manager onCommit
    (#8873) reported and authored by @sspaink
  - tester: Make Result JSON round-trippable (#8014) authored by
    @vsolano9, reported by @anderseknert
  - topdown: Resolve ground refs in --var-values cmd output
    (#7830) authored by @sspaink, reported by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Add support for Go 1.27 &amp; jsonv2 (#8947) authored by
    @anderseknert and @charlieegan3
  - ast: Fix aliased comment buffer in annotation parser (#8757)
    authored by @sspaink, reported by @0hardik1
  - ast: Fix non-deterministic type errors when shadowing a
    built-in (#3729) authored by @sspaink, reported by @srenatus
  - ast: Fix leaky future.keywords.not import in Rego v0 (#8953)
    authored by @johanfylling
  - ast: Fix panic when indexing composite literal values in x in
    [...] (#8918) reported and authored by @srenatus
  - ast: Fix TermValueEqual performance regression (#8863)
    authored by @mchitten
  - ast: Improve rule conflict error (#6391) authored by
    @unichronic, reported by @johanfylling
  - ast: Make CogeneratedExprs return deterministic order (#8895)
    authored by @sspaink
  - ast: Reject partial set and -object rules sharing a name
    (#8860) authored by @sspaink, reported by @shomron
  - ast: Restore location on unsafe var errors for rewritten head
    vars (#8719) authored by @Atishyy27, reported by
    @anderseknert
  - ast: Use more precise return types for object.* builtins
    (#8692) reported and authored by @anderseknert
  - ast+topdown: Let rule external sources distinguish absent
    from unknown (#8878) authored by @srenatus
  - ast+topdown: Parametrized (prefix) external rule sources
    (#8881) authored by @srenatus
  - topdown: Fix "a", "a" in {"a"} not returning true (#8747)
    authored by @anderseknert
  - topdown: Fix format_int precision loss for integers larger
    than 64 bits (#8857) authored by @Synvoya
  - topdown: Fix precision loss for integers larger than 64 bits
    in arithmetic and aggregates (#6281) authored by @Atishyy27,
    reported by @tsandall
  - topdown: Don't leak internal vars in Partial-Evaluation
    results (#6378) authored by @sspaink, reported by @nkey0
  - topdown/copypropagation: Avoid circular reference in
    Partial-Evaluation through call (#6428) authored by @sspaink,
    reported by @nkey0
  - topdown+util: Add generic SliceStack/GroupStack, unify
    refStack/functionMocksStack/saveStack (#8886) authored by
    @srenatus
  - topdown+util: Replace hand-rolled evalFunc/evalBuiltin pools
    with generic ResettablePool (#8886) authored by @srenatus
  - perf: Avoid allocations with custom Atoi and Atoi64 helpers
    (#8758) authored by @anderseknert
  - perf: Lazy init of scalars map in indexer (#8936) authored by
    @anderseknert
  - perf: Reduce allocations in index lookup (#8835) authored by
    @anderseknert
  - planner: Avoid redundant ruletrie.Children() call in Depth()
    (#8886) authored by @srenatus
  - planner: Unify functionMocksStack on generic GroupStack[T]
    (#8886) authored by @srenatus
  * Docs, Website, Ecosystem
  - ecosystem: Add agt-policies-africa — African data protection
    OPA policy pack (#8850) authored by @kingztech2019
  - ecosystem: Add Ghostunnel and NATS Plugin to Ecosystem
    (#8871) authored by @charlieegan3
  - ecosystem: Add Sencillo projects to ecosystem (#8818)
    authored by @hooksie1
  - docs: Add kubecon NA page (#8876) authored by @charlieegan3
  - docs: Add recommendations to follow Envoy's best practices
    (#8944) authored by @johanfylling
  - docs: Document rule indexer support for in, bare refs;
    modernize rego (#8822) authored by @srenatus, reported by
    @tsandall
  - docs: Document the compile metadata annotation (#8824)
    authored by @youdie006, reported by @anderseknert
  - docs: Fix broken OAuth2/OIDC policy examples (#8840) authored
    by @mailnike
  - docs: Fix decision_logs buffer_size_limit_events default in
    prose (#8866) authored by @s3onghyun
  - docs: Remove import rego.v1 (#8867) authored by @charlieegan3
  - docs: Some minor bug fixes to improve reporting (#8917)
    authored by @charlieegan3
  - docs: The Zed Rego extension link points at
    github.com/StyraInc/zed-rego (404). The repo now lives at
    github.com/StyraOSS/zed-rego. (#8883) authored by @mailnike
  - docs: Update cheatsheet files (#8868) authored by
    @charlieegan3
  - docs: Update regal and blog links (#8901) authored by
    @charlieegan3
  - docs: Updates examples to use some...in, add link to debugger
    (#8806) authored by @charlieegan3
  - website: Improve partial evaluation / data filtering
    documentation (#8625) authored by @mmzzuu
  - website: Import blog from medium (#8898) authored by
    @charlieegan3
  * Miscellaneous
  - ast: Add benchmark for rule index ref ordering (#8943)
    authored by @srenatus
  - ast: Various style fixes (#8938) authored by @anderseknert
  - build: Add Dockerfile.rego to validate image builds (#8401)
    authored by @jasdeepbhalla, reported by @anderseknert
  - build: Get just the needed commits for CI (#8940) authored by
    @charlieegan3
  - test: Start decommissioning test.WithTempFS (#8908) authored
    by @anderseknert
  - topdown: Add regression test for partial eval local names
    (#5226) authored by @sspaink, reported by @fab29p
  - topdown: Fix Partial-Evaluation test rejected by new conflict
    check (#8860) authored by @sspaink, reported by @shomron
  - topdown: Vendor a method-less text/template to restore
    whole-binary linker DCE (#7903) authored by @rchildress87,
    reported by @kruskall
  - workflows: Remove cpp from CodeQL language matrix (#8864)
    authored by @sspaink
  - workflows: Prune benchmarks to last 250 runs (#8834) authored
    by @srenatus
  - Dependency updates; notably:
  - build(go): Bump Go from 1.26.4 to 1.26.5 (#8875) authored
    by @srenatus
  - build(deps): Add github.com/reeflective/readline 1.3.0
  - build(deps): Add golang.org/x/term 0.45.0
  - build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.2
    to 4.9.4
  - build(deps): Bump github.com/go-logr/logr from 1.4.3 to
    1.4.4
  - build(deps): Bump github.com/huandu/go-sqlbuilder from
    1.41.0 to 1.42.1
  - build(deps): Bump github.com/prometheus/client_golang from
    1.23.2 to 1.24.0
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    2.5.34 to 2.5.36
  - build(deps): Bump golang.org/x/sync from 0.21.0 to 0.22.0
  - build(deps): Bump golang.org/x/text from 0.38.0 to 0.40.0
  - build(deps): Bump google.golang.org/grpc from 1.81.1 to
    1.82.1
  - build(deps): Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2
    (#8889) authored by @ahbarrios
  - Addressing GHSA-fxhp-mv3v-67qp
  - build(deps): Drop github.com/peterh/liner
  - build(deps): Drop github.com/KimMachineGun/automemlimit
    (#8869) authored by @charlieegan3
  - build(deps): Drop go.uber.org/automaxprocs (#8869) authored
    by @charlieegan3</changelog>
</package>
<package pkgid="5f8113faae3d9f837a9b709fbb5e04da842c331db7cad85bb00a9cc2d6cc5ec87ef2019e7228ae13d57145e28a2f4966e2dd37426c1973c2cdf9d238261881a0" name="opa-zsh-completion" arch="noarch">
  <version epoch="0" ver="1.19.0" rel="52.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145600">- Update to version 1.12.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Support for String Interpolation in the Rego language
  - Faster compilation and runtime
  - Fixes published in the v1.11.1 release
  * String Interpolation (#4733)
  - The Rego language has been extended to support String
    Interpolation, which provides a readable means to compose
    strings containing dynamic values determined at evaluation
    time.
    An interpolated string is composed of a template-string
    containing zero or more template-expressions that evaluates
    to a value at evaluation time.
    The $ character prefix identifies a template-string, and
    template-expressions are declared by being enclosed in
    curly-braces ({, }).
    Additionally, undefined template-expression values don't halt
    evaluation; instead, &lt;undefined&gt; will be injected into the
    generated string.
    package interpolation
    allowed_roles := ["admin", "employee"]
    default role := "guest"
    role := input.role
    deny contains $"User {input.username}'s role was '{role}', but must be one of {allowed_roles}" if {
    not role in allowed_roles
    }
    {
    "deny": [
    "User &lt;undefined&gt;'s role was 'guest', but must be one of [\"admin\", \"employee\"]"
    ],
    }
    String interpolation is a more readable and less error-prone
    substitute for the sprintf built-in function.
    Authored by @johanfylling reported by @anderseknert
    Tip
    Help us out!
    New Rego language features are exciting, and we want to
    maximize their usefulness. If you come across tools and
    integrations in the community where string interpolation
    isn't properly handled, such as syntax highlighting, please
    reach out and let us know.
  * Runtime, SDK, Tooling
  - oracle: Refactor Oracle better support some and every (#8105,
    [#8131], #8138) authored by @charlieegan3
  - plugins/bundle: Prevent ns-level polling by validating
    intervals (#8082) authored by @jjhwan-h
  - plugins/discovery: Initialize plugins before downloading
    (#8071) authored by @jt28828
  - topdown: Introduce sink for context cancellation
  - topdown: Make regex.replace respect cancellation (#8089)
    authored by @srenatus
  - topdown: Make replace and strings.replace_n respect
    cancellation (#8089) authored by @srenatus
  - topdown: Use sink for concat (#8090) authored by @srenatus
  - perf: Avoid extra allocation in sink if no cancel (#8104)
    authored by @anderseknert
  * Compiler, Topdown and Rego
  - ast/compile: Deal with error limit without panic/defer
    (#8087) authored by @srenatus
  - ast/parser: Check if we need to unescape at all (#8135)
    authored by @srenatus
  - perf: Improved visitor implementation (10% faster
    compilation) (#8078) authored by @anderseknert
  - perf: Reduce allocations handling terms (#8116) authored by
    @anderseknert
  - perf: Type-checker performance improvements (#8143) authored
    by @anderseknert
  * Docs, Website, Ecosystem
  - website: Add support for rego string interpolation syntax
    highlighting (#8092) authored by @charlieegan3
  - docs/ocp: Update "concepts" for v0.3.0 (#8117) authored by
    @srenatus
  - website: Show playground errors (#8141) authored by
    @charlieegan3
  - website: Update a number of links to their new location
    (#8100) authored by @charlieegan3
  - docs: Remove link to feedback form (#8101) authored by
    @charlieegan3
  - website: Remove survey bar (#8136) authored by @charlieegan3
  - docs: Update community contacts (#8108) authored by
    @charlieegan3
  * Miscellaneous
  - ast/checks_test: Fix flaky tests (#8111) authored by
    @srenatus
  - benchmarks: Install node v24 (#8122) authored by @srenatus
  - download: Fix when compiling with tag opa_no_oci (#8070)
    authored by @srenatus reported by @mg0083
  - tests: Race in TestStatusUpdateBuffer (#8133) authored by
    @thevilledev
  - workflow: Integrate benchmarks notebook (#8121) authored by
    @srenatus
  - workflows: Skip all tests in benchmarks run (#8086) authored
    by @srenatus
  - Dependency updates; notably:
  - build: Bump golang from 1.25.4 to 1.25.5 (#8107) authored
    by @srenatus
  - build(deps): Bump google.golang.org/grpc from 1.76.0 to
    1.77.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145601">- Update to version 1.12.1:
  This bug fix release reverts a change to regex.replace that
  unintentionally changed its behaviour for anchored regular
  expressions.
  * Revert "topdown: make regex.replace respect cancellation"
    (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 1.12.2:
  This bug fix release address issues found in the new string
  interpolation feature
  * Add (*TemplateString).Copy() method (#8159) authored by
    @anderseknert
  * Fix template string not serialized with escaped { (#8161)
    authored by @anderseknert
  * fix(ast): skip template string vars in ref safety (#8174)
    authored by @thevilledev
  * fix(ast): use original var names in template error (#8180)
    authored by @thevilledev</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768478400">- Update to version 1.12.3:
  This is a bug fix release addressing two issues:
  * Bundle polling is being misconfigured when discovery bundle is
    updated (#8215)
    This is an issue where the polling interval for discovery
    (discovery.polling.min_delay_seconds and
    discovery.polling.max_delay_seconds) were misinterpreted on
    reconfiguration, causing extremely long update intervals.
  * Decision log size buffer buffer_size_limit_bytes misconfigured
    during reconfiguration (#8213)
    This is a regression in the decision log, where the
    decision_logs.reporting.buffer_size_limit_bytes was mistakenly
    assigned the value of
    decision_logs.reporting.upload_size_limit_bytes during
    reconfiguration.
    This issue is only present when
    decision_logs.reporting.buffer_type is set to size, which is
    the default value.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769774400">- Update to version 1.13.1:
  This bug fix release addresses an issue found in the new
  array.flatten built-in function
  - Fix issue in array.flatten handling of single item arrays
    (#8273) (#8272) authored by @anderseknert
- Update to version 1.13.0:
  This release contains a mix of new features, performance
  improvements, and bugfixes. Notably:
  - A new immediate upload trigger mode in the Decision Logger
  - A new array.flatten built-in function
  - Numerous performance improvements
  * Immediate Upload Trigger Mode in Decision Logger (#8110)
  - An immediate trigger mode has been added to the Decision
    Logger; enabled by setting the
    decision_logs.reporting.trigger configuration option to
    immediate.
    When enabled, log events are pushed to the log service as
    soon as the configured upload chunk size criteria is met; or,
    at latest, when the configured upload delay is reached.
  * Runtime, SDK, Tooling
  - cmd/fmt: Do not overwrite file on fmt without changes (#8222)
    authored by @Loic-R
  - cmd/test: Enable sorting JSON test results by duration
    (#7444) authored by @sspaink
  - profiler: nil *Profiler should not report Enabled() (#8256)
    authored by @anderseknert
  - rego: Add Data function to simplify adding data from map
    (#5961) authored by @majiayu000 reported by @anderseknert
  - runtime: Correct naming &amp; docs for version checking (#8191)
    authored by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Body.String() doesn't panic on empty body (#8244)
    authored by @srenatus
  - ast: Improve type error message when referencing functions
    (#6840) authored by @sspaink
  - ast: Type Checker recognizes when a variable has multiple
    assignments but is an undefined function (#7463) authored by
    @sspaink reported by @anderseknert
  - ast/parser: Avoid duplicate loc copies (#8142) authored by
    @srenatus
  - topdown: Add array.flatten built-in function (#8226) authored
    by @anderseknert
  - topdown: Fix issue where numbers.range_step built-in could
    erroneously return undefined value (#8194) authored by
    @thevilledev
  - topdown: Remove hard-coded missing key error in
    strings.render_template built-in (#7931) authored by
    @colinjlacy reported by @anderseknert
  - topdown: Re-introduce cancellation-awareness for
    regex.replace built-in (#8179) authored by @srenatus
  - from having been reverted in v1.12.1
  - topdown: Support arrays as input for json.match_schema
    (#6615) authored by @sspaink reported by @mscudlik
  * Performance
  - ast: Improved annotations parsing (#8210) authored by
    @anderseknert
  - ast: Reinstate zero-alloc paths in Ref.String() (#8202)
    authored by @anderseknert
  - ast: Replace regex implementation in IsVarCompatibleString
    (#8164) authored by @anderseknert
  - ast: Optimize Set.Intersect and Set.Diff (#8167) authored by
    @thevilledev
  - ast: Optimize Set.Union (#8172) authored by @thevilledev
  - ast: Reduce allocations in Expr.MarshalJSON (#8204) authored
    by @thevilledev
  - ast: Reduce allocations in Rule.MarshalJSON (#8205) authored
    by @thevilledev
  - ast: Reduce allocations in Term.MarshalJSON (#8200) authored
    by @thevilledev
  - ast: Reduce allocations in With.MarshalJSON (#8206) authored
    by @thevilledev
  - perf: String() implementations using appenders (#8192)
    authored by @anderseknert
  - topdown: Avoid redundancy in builtinTrim (#8237) authored by
    @thevilledev
  - topdown: Eliminate closure allocations in Set and virtual doc
    enumeration (#8242) authored by @alex60217101990
  - topdown: Fast paths for array.reverse (#8177) authored by
    @thevilledev
  - topdown: Optimize json.remove and json.filter (#8193)
    authored by @thevilledev
  - topdown: Optimize object built-ins (#8175) authored by
    @thevilledev
  - topdown: Optimize union built-in (#8173) authored by
    @thevilledev
  - topdown: Pre-alloc in various built-ins (#8198) authored by
    @thevilledev
  - topdown: Reduce allocs in float sum/product (#8235) authored
    by @thevilledev
  - topdown: Skip set copy in getObjectKeysParam (#8176) authored
    by @thevilledev
  * Docs, Website, Ecosystem
  - docs: Add authz-spring-boot-starter to Spring Security API
    ecosystem entry (#8234) authored by @francois-eckert
  - docs: Add header for crypto example to make (#8259) authored
    by @charlieegan3
  - docs: Add notes for automated agents (#8147, #8203) authored
    by @charlieegan3
  - docs: Add opa-wasm-zig to the ecosystem (#8163) authored by
    @burdzwastaken
  - docs: Add scripts to import docs from source (#8148) authored
    by @charlieegan3
  - docs: Explain how to use the SDK without a initialising a
    server (#8248) authored by @andrewcameronsims
  - docs: Fix a number of redirecting links (#8165 authored by
    @charlieegan3
  - docs: Fix template-expression examples (#8199) authored by
    @johanfylling
  - docs/ocp: Mention source prefix/path options (#8238) authored
    by @srenatus
  - website: Add redirect section for immutable referrers (#8262)
    authored by @charlieegan3 reported by @KraLeoD
  - website: Display 2025 survey results on the website (#8258)
    authored by @charlieegan3
  - website: Show breadcrumbs in search results (#8207) authored
    by @charlieegan3
  * Miscellaneous
  - Decoupled the Rego job check from the Go job checks in the
    Github PR workflow (#8203) authored by @SeanLedford
  - build: Format pr_check.rego with opa fmt (#8201) authored by
    @thevilledev
  - build: Migrate PR check to OPA policy (#8183) authored by
    @SeanLedford
  - build: Run go get against main to spot redacted (#8146)
    authored by @charlieegan3
  - deps: Switch to maintained go.yaml.in/yaml/v3 yaml library
    (#8182) authored by @mrueg
  - test/cases: Increase yaml test coverage for some regex and
    string builtins (#8152) authored by @srenatus
  - Dependency updates; notably:
  - build: bump golang from 1.25.5 to 1.25.6 (#8224) authored
    by @srenatus
  - build(deps): bump go.opentelemetry.io deps from
    1.38.0/0.63.0 to 1.39.0/0.64.0
  - build(deps): bump klauspost/compress from v1.18.1 to
    v1.18.2 (#8184) authored by @srenatus
  - because of redaction warning
  - build(deps): bump github.com/go-ini/ini from v1.67.0 to
    gopkg.in/ini.v1 v1.67.1 (#8208) authored by @gabrpt</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1771416000">- Update to version 1.13.2:
  This release updates the version of Go used to build the OPA
  binaries and images to 1.25.7.
  That version of the Go standard library contains a fix for
  GO-2026-4337.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772193600">- Update to version 1.14.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Improved rule indexing of variable assignments and x in {...}
    expressions
  - Support for --h2c with unix domain socket for opa run
  - A new glossary tooltip for technical terms in the docs
  - Fixes published in the v1.13.1 and v1.13.2 releases
  * Improved rule indexing of variable assignments and x in {...}
    expressions (#1841)
    With this change, the rule indexer will index expressions like:
    allow if input.role in {"admin", "user"}
    On lookup, the rule body will only be returned if input.role is
    either one of "admin" or "user".
    The reverse case is also indexed:
    allow if "admin" in input.roles
    in which the searched collection is unknown.
  * Runtime, SDK, Tooling
  - cmd,run: Support --h2c with unix domain socket (UDS) (#8282)
    authored by @srenatus reported by @theJC
  - cmd,tester: Add line number next to test file in pretty
    format (#8328) authored by @sspaink reported by @anderseknert
  - plugins: Fix race accessing registeredTriggers (#8363)
    reported and authored by @szuecs
  - rego: Add ResultValue[T]() helper method (#8320) authored by
    @srenatus
  - runtime: Add custom storage backend registration API (#8277)
    authored and reported by @alex60217101990
  - topdown: Add config option to disable named inter-query
    built-in cache (#7519) authored by @sspaink reported by
    @johanfylling
  * Compiler, Topdown and Rego
  - ast: Add index else == nil test, fix it (#8348) authored by
    @srenatus
  - ast: Add scaffolding to introspect and skip compiler stages
    (#8304) (authored by @srenatus)
  - ast: Ensure term values implement ast.StringLengther (#8374)
    authored by @charlieegan3
  - ast: Fix double-fix for refs["with-a"].dash as package
    (#8286) authored by @srenatus
  - ast: Optimized template-expression handling of values known
    to be defined (#8310) authored by @anderseknert
  - ast: Put rule indices into rule tree, change Values to
    []*Rule (#8298) authored by @srenatus
  - ast: Replace true expr when appending to empty body (#8299)
    authored by @anderseknert
  - ast: Return correct location of unsafe var in object (#7935)
    authored by @sspaink reported by @anderseknert
  - ast: Use StageID in WithStageAfterID, also for QueryCompiler
    (follow-up) (#8306) authored by @srenatus
  - compile: Add StringLength to lazy object (#8369) authored by
    @charlieegan3 reported by @robmyersrobmyers
  - parser: Add test to verify filename interning in Location
    (#8322) authored by @anderseknert
  - perf: Allocate less in array unification (#8351) authored by
    @anderseknert
  - perf: Various minor eval performance tweaks (#8290) authored
    by @anderseknert
  - perf: json.patch + interning improvements (#8289) authored by
    @anderseknert
  - topdown: Optimize bindings allocation with dynamic pre-sizing
    (#7266) authored by @alex60217101990
  - topdown: Preserve original package name with special
    characters in optimized builds (#8284) authored by @sspaink
    reported by @at50989
  - wasm: Updates (LLVM+tools) (#8295) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs: Add examples to glob.match built-in documentation
    (#8252) authored by @sibasispadhi reported by @anderseknert
  - docs: Add workflow to auto update Regal docs (#8318) authored
    by @charlieegan3
  - docs: Document metrics for http.send, regex, and glob
    built-ins (#6730) authored by @anivar reported by @rudrakhp
  - docs: Fix json.patch target description (#8271) authored by
    @anderseknert
  - docs: Update broken links (#8285) authored by @charlieegan3
  - docs: Update bundle signing docs to clarify key config
    (#8307) authored by @charlieegan3
  - docs: Update faulty example using bundle optimize (#5379)
    authored by @sspaink reported by @bluebrown
  - docs: Update interface{} -&gt; any in golang snippets (#8373)
    authored by @srenatus
  - docs/website: Add a new KubeCon event page (#8311) authored
    by @charlieegan3
  - docs/website: Add formatting and linting checks (#8288)
    authored by @charlieegan3
  - docs/website: Allow Regal import to use local dir (#8312)
    authored by @charlieegan3
  - docs/website: Implement new GlossaryTooltip component (#8367)
    authored by @charlieegan3
  - docs/website: Markdown linting and spell checking for
    documentation (#8292) authored by @charlieegan3
  - docs/website: Redirect /docs/latest/ecosystem (#8315)
    authored by @charlieegan3 reported by @tweekSun1
  * Miscellaneous
  - maintainers: Moving nilekhc to emeritus, and renew maintainer
    terms (#8276) authored by @JaydipGabani
  - ast: Add public method to extend the compliance test cases
    with IR plans (#7556) authored by @sspaink reported by
    @shomron
  - ast: Tiny nitpicky cleanup (#8309) authored by @srenatus
  - chore: Clean up bundle storage tests (#8267) authored by
    @anderseknert
  - chore: Remove unnecessary comment from bundle JWT
    verification impl (#8354) authored by @johanfylling
  - ci: Bump golangci-lint (v2.9.0), fix issues (#8314) authored
    by @srenatus
  - ci: Harden and update all GH Actions workflows (#8356, #8377,
    [#8368] authored by @philipaconrad and @srenatus
  - go: Cleanup old build flags (#8314) authored by @srenatus
  - rego: Remove superfluous package import of plugins (#6754)
    authored by @srenatus reported by @oxisto
  - tests: Extract runtime Info to new package (#8362) authored
    by @charlieegan3
  - tests: Fix BenchmarkFunctionArgumentCounts query (#8327)
    authored by @alex60217101990
  - tests: Disable rule indexing for benchmark (#8375) authored
    by @srenatus
  - workflows: Add nightly vuln checks for released
    versions/images (#8336 #8339) authored by @srenatus
  - Dependency updates; notably:
  - build: bump golang from 1.25.6 to 1.26.0
  - build(deps): build(deps): bump go.opentelemetry.io deps
    from 1.39.0/0.64.0 to 1.40.0/0.65.0
  - Applying fix for GHSA-9h8m-3fm2-qjrq
  - build(deps): bump github.com/dgraph-io/badger/v4 from 4.9.0
    to 4.9.1
  - build(deps): bump github.com/huandu/go-sqlbuilder from
    1.39.0 to 1.39.1
  - build(deps): bump golang.org/x/net from 0.49.0 to 0.50.0
  - build(deps): bump golang.org/x/text from 0.33.0 to 0.34.0
  - build(deps): bump google.golang.org/grpc from 1.78.0 to
    1.79.1
  - build(deps): bump go.opentelemetry.io deps from
    1.39.0/0.64.0 to 1.40.0/0.65.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773057600">- Update to version 1.14.1:
  This is a patch release collecting two bug fixes and various
  dependency updates for Golang standard library and common package
  vulnerabilities.
  These bug fixes include a revert of the rule indexer tweaks
  shipped in 1.14.0, which had caused unexpected lookup failures
  for some users. (We expect to properly fix the issue in 1.15.0,
  but for now, a revert is the quicker choice.)
  * Changes
  - Fix intermittent plugins manager deadlock on opa.configure
    (#8407)
  - Revert "ast: make rule index track var assignments and x in
    {...} (#8341)" (#8410)
  - build: bump deps (go.mod from main)
  - build: bump go 1.26.1 (#8409)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774612800">- Update to version 1.15.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - Add logger plugin interface and file logger implementation
    with log rotation
  - Custom HTTPAuthPlugin behavior change, all per-request
    authentication logic must be moved from NewClient() to
    Prepare()
  - AWS signing supports for web identity for assume role
    credentials
  * Logger Plugin Support (#8434) (authored by @srenatus)
    OPA now supports pluggable logging implementations via the
    logger plugin interface, which is based on Go's standard
    log/slog.Handler interface. This allows any slog.Handler
    implementation to be used as a logger plugin. Loggers can be
    configured via the server.logger_plugin configuration option
    and used for both runtime logging and decision logs. OPA
    includes a built-in file logger plugin (file_logger) that
    writes structured JSON logs with rotation support using
    lumberjack. Users can also implement and register custom logger
    plugins when building OPA.
    Example configuration for server logging:
    server:
    logger_plugin: file_logger
    plugins:
    file_logger:
    path: /var/log/opa/server.log
    max_size_mb: 100
    max_age_days: 28
    max_backups: 3
    compress: true
    level: info
    Example configuration for decision logs using the same plugin:
    server:
    logger_plugin: file_logger
    decision_logs:
    plugin: file_logger
    plugins:
    file_logger:
    path: /var/log/opa/server.log
    max_size_mb: 100
    max_age_days: 28
    max_backups: 3
    compress: true
    level: info
  * Custom HTTPAuthPlugin behavior change (#8376) (authored by @srenatus)
    The HTTPAuthPlugin.NewClient() method is now called once per
    Client instance and cached rather than being called for every
    request. Custom plugins that performed per-request operations
    in NewClient() (such as request counters, per-request transport
    wrapping, or logging/metrics side effects) will now only
    execute those operations once. All per-request authentication
    logic must be moved from NewClient() to Prepare(). All plugins
    included in OPA have been updated and are unaffected by this
    change.
  * Runtime, SDK, Tooling
  - plugins/logger: Add logger plugin interface and file logger
    implementation with log rotation (#8434) (authored by
    @srenatus)
  - plugins/logs: Decision logs can now use logger plugins for
    output (#8434) (authored by @srenatus)
  - logging: Add BufferedLogger to capture early startup logs
    before plugins are initialized (#8434) (authored by
    @srenatus)
  - plugins/rest: Configurable re-read interval for TLS client
    certificates via cert_reread_interval_seconds field.
    Defaults to re-reading on every request for backwards
    compatibility.  The implementation also uses content hashing
    to detect changes and avoid re-parsing unchanged TLS
    certificates and keys. (#8376) (authored by @srenatus)
  - plugins/rest: All TLS configurations now inherit the minimum
    version and TLS ciphersuites as configured for the server.
    (#8376) (authored by @srenatus)
  - internal/providers/aws: Refactor deprecated crypto/elliptic
    APIs to crypto/ecdh (#8395) (authored by @kanywst)
    plugins/rest: AWS Signing - Allow Service Account (Web
    Identity) credentials for Assume Role Credentials (#8386) (
    authored by @tiagogviegas)
  * Compiler, Topdown and Rego
  - ast: fix overlapping array and scalar pattern in rule index
    (authored by @srenatus)
  * Bundles
  - optimized bundles: filter metadata comments properly ( #8388)
    (#6529) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs(ecosystem): add Kopa ecosystem entry (#8405) (authored
    by @sfreet)
  - docs: Update KubeCon event listing (#8439) (authored by
    @charlieegan3)
  - docs: fix input of partial-evaluation example (#8430)
    (authored by @edobrb)
  - ecosystem: add Big ACL (#8389) (authored by @francois-eckert)
  - Regal v0.39.0 doc updates (#8383) (authored by @anderseknert)
  * Miscellaneous
  - build/generate-extended-cases: Fix testcase loader to use
    json.Number. (#8429) (authored by @philipaconrad)
  - Filter compliance test cases using capabilities file (#8418)
    (authored by @sspaink)
  - Fix intermittent plugins manager deadlock on opa.configure
    (#8407) (authored by @sspaink)
  - Linter configuration cleanup (#8397) (authored by
    @anderseknert)
  - fix nightly.yaml by moving secret to env (#8381) (authored by
    @sspaink)
  - fix release-vulnerability-check.yaml (authored by @sspaink)
  - nightly+release-vuln-check: add links to slack msg payloads
    (authored by @srenatus)
  - Dependency updates; notably:
  - build: bump go 1.26.1 (#8409) (authored by @srenatus)
  - gha: bump trivy-action (authored by @srenatus)
  - build(deps): bump google.golang.org/grpc from 1.79.1 to
    1.79.3 (#8428) (authored by @dependabot[bot])
  - build(deps): bump github.com/vektah/gqlparser/v2 from
    2.5.31 to 2.5.32 (#8399) (authored by @dependabot[bot])
  - build(deps): bump modernc.org/sqlite from 1.45.0 to 1.46.1
    (#8399) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump golang.org/x/time from 0.14.0 to 0.15.0
    (#8412) (authored by @dependabot[bot])
  - build(deps): bump github.com/microsoft/go-mssqldb from
    1.9.6 to 1.9.7(#8412) (authored by @dependabot[bot])</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774872000">- Update to version 1.15.1:
  * Miscellaneous
  - logging: make WithContext() optional (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775736000">- Update to version 1.15.2:
  No changes related to the openSUSE package, only GitHub release
  workflow updates (use go1.26.2)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777550400">- Update to version 1.16.0:
  This release contains a mix of new features, performance
  improvements, and bugfixes. Notably:
  - New uri.parse and uri.is_valid built-in functions
  - Data API Request/Response Metadata
  - Prometheus metrics exported via OTLP
  - Formatter improvements
  NOTE:
  In v1.15.x, OPA was dropping logs for bundle downloads, print()
  calls and other plugin-originated logs.
  Users are advised to update, v1.16.0 fixes this bug in (#8544).
  * New uri.parse and uri.is_valid built-in functions (#8263)
    Two new built-in functions have been added: uri.parse for
    parsing a given URI, and uri.is_valid for verifying the
    structure of a given URI.
  - uri.parse
    Parses a URI and returns an object containing its components
    according to RFC 3986. Empty components are omitted.
    package example
    test_uri if {
    uri.parse("https://example.com:8080/api?q=1#top") == {
    "scheme": "https",
    "hostname": "example.com",
    "port": "8080",
    "path": "/api",
    "raw_path": "/api",
    "raw_query": "q=1",
    "fragment": "top",
    }
    }
  - uri.is_valid
    Returns true if the input can be parsed as a URI, false otherwise.
    package example
    deny contains "invalid URI" if {
    not uri.is_valid("http://[invalid")
    }
  * Data API Request/Response Metadata (#8570)
    Wrapping projects can now attach custom metadata to Data API
    requests and have evaluation produce response metadata.
    Two distinct metadata paths are introduced:
  - Request metadata: parsed from extra top-level keys in the
    request body, made available to builtins via
    BuiltinContext.RequestMetadata. Logged in the decision log
    under Custom["request_metadata"].
  - Response metadata: a separate map
    (BuiltinContext.ResponseMetadata) that builtins can populate
    during evaluation. Only included in the API response and
    decision log if non-empty.
    In vanilla OPA, no builtins write response metadata, so
    responses are unchanged. The request metadata map is only
    allocated when the request carries extra fields; the response
    map is one empty map per request.
    To avoid conflicts with future OPA top-level keys, callers
    should use a namespaced key: {"input": {...},
    "com.example.opa/md": {...}}.
    Request with metadata:
    curl -H 'Content-Type: application/json' \
  - d '{"input": {"user": "alice"}, "com.example.opa/metadata": {"corp-id": "acme-42"}}' \
    http://localhost:8181/v1/data/example/allow
    Response (response metadata included if, for example, set by a
    custom builtin):
    {
    "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
    "result": true,
    "com.example.opa/response": {
    "snapshot_version": "v3"
    }
    }
    Decision log entry:
    {
    "custom": {
    "request_metadata": {
    "com.example.opa/metadata": {
    "corp-id": "acme-42"
    }
    },
    "response_metadata": {
    "com.example.opa/response": {
    "snapshot_version": "v3"
    }
    }
    },
    "decision_id": "04789f85-de5a-477b-8aa5-6d59d7742135",
    "input": { "user": "alice" },
    "msg": "Decision Log",
    "path": "example/allow",
    "result": true
    }
  * Runtime, SDK, Tooling
  - distributedtracing: Export Prometheus metrics via OTLP
    (#7591) reported and authored by @Munken
  - cmd,tester: Update opa test to stream test case results
    (#3676) authored by @sspaink reported by @tsandall
  - cmd,tester: Show full errors when test fails and using
  - -coverage (#8438) authored by @grosser
  - format: Add new line between METADATA blocks (#8483) authored
    by @sspaink
  - format: Allow indenting all withs in expression (#8508)
    authored by @anderseknert
  - format: Fix dropping comments after handling
    unexpectedCommentError (#8553) authored by @sspaink
  - format: Preserve location of trailing comments inside every
    body (#8558) authored by @johanfylling
  - format: Prevent opa fmt from formatting single attribute
    objects with comments (#7565) authored by @sspaink reported
    by @anderseknert
  - logging: Keep forwarding from BufferedLogger after Flush()
    (#8544) authored by @srenatus reported by @annieyhuang
  - plugins/logs: Fix logBuffer eviction loop only dropping one
    element (#8543) authored by @sspaink
  - plugins/logs: Fix out-of-order plugin status notifications
    (#8009) authored by @sspaink reported by @Pushpalanka
  - plugins/rest: Carry over all of *tls.Config (#8473) authored
    by @srenatus reported by @ashu2496
  - server: Drop HTML index page query form (#8477) authored by
    @johanfylling reported by @srenatus and @r0binak
  - server: Skip chmod for abstract Unix domain sockets (#8536)
    authored by @bakayolo
  - storage/inmem: Avoid allocations from Read() in MakeDir()
    (#8561) authored by @srenatus
  - tester: Add method to match tests by ref prefixes (#6696)
    authored by @anderseknert
  - Note: Experimental.
  * Compiler, Topdown and Rego
  - ast: Allow Back-to-back metadata blocks (#8482) authored by
    @sspaink reported by @johanfylling
  - ast: Catch functions in dynamic extent of ref head rule
    (#8461) authored by @srenatus reported by @johanfylling
  - ast: Fix parenthesis in String() of {obj,arr,set}
    comprehensions (#8511) authored by @srenatus
  - ast: Fix parsing of unary - in front of a ref (#5014)
    authored by @mmzzuu reported by @philipaconrad
  - ast: Fix type checker match error for objects with set keys
    (#6260) authored by @sspaink reported by @tsandall
  - ast: Fix type checker to recognize numeric index in generated
    map (#6736) authored by @sspaink reported by @anderseknert
  - ast: Handle underdetermined function args (#5234) authored by
    @sspaink reported by @obataku
  - ast: Identify compatible type from reference in type checker
    (#7273) authored by @sspaink reported by @anderseknert
  - ast: Support recursive JSON Schemas (#6099) authored by
    @sspaink reported by @anderseknert
  - builtins: Add support for days, weeks and years in
    time.parse_duration_ns built-in function (#2719) authored by
    @sspaink reported by @freeseacher
  - builtins: Fix graph.reachable_paths to return all reachable
    paths (#5871) authored by @davidmarne-wf reported by
    @ericjkao
  - builtins: Limit exponent size in units.parse_bytes built-in
    function to prevent timeout bypass (#8326) authored by
    @isaiahvita reported by @anderseknert
  - perf: Add CopyNonGround() methods for Array, Set, and Object
    (#8323) authored by @alex60217101990
  - resolver/wasm: Add NewWithContext to allow passing context
    (#8499) authored by @dominikschulz
  * Docs, Website, Ecosystem
  - docs: Add aggregates examples for count and sum built-in
    functions (#8566) authored by @alliasgher reported by
    @srenatus
  - docs: Add generated output.jsons for docs examples (#8535)
    authored by @charlieegan3
  - docs: Add spec for OCP bundle status tracking API (#8502)
    authored by @ashutosh-narkar
  - docs: Add the latest videos to the README presentations
    section (#8523) authored by @sspaink
  - docs: Add Windows development notes to dev reference guide
    (#8422) authored by @raajheshkannaa
  - docs: Fix input value type in not undefined example (#8580)
    authored by @menma1234
  - docs: Update Regal docs to v0.40.0 (#8538) authored by
    @charlieegan3
  - docs: Updated roadmap link (#8501) authored by @johanfylling
  - docs: Various typo fixes (#8529) authored by @sspaink
  - ecosystem: Add vulnetix ecosystem entry (#8532) authored by
    @0x73746F66
  - ecosystem: Add KubeStellar Console (#8560) authored by
    @clubanderson
  - website: Add banner to show when event has passed (#8493)
    authored by @charlieegan3
  - website: Add copy-as-markdown button to doc pages (#8540)
    authored by @charlieegan3
  - website: Copy button improvements (#8577) authored by
    @charlieegan3
  - website: Remove old redirects, add new management redirect
    (#8424) authored by @charlieegan3 reported by @narainar
  - website: Update intro video on homepage (#8547) authored by
    @charlieegan3
  * Miscellaneous
  - build: Exclude domains that cause false positives (#8533)
    (#8495) authored by @charlieegan3
  - e2e/cli: Add test for debug print() logging (#8567) authored
    by @srenatus
  - e2e/cli: Start CLI E2E tests (#8545) authored by @srenatus
  - github: declare formatted rego as rego (#8564) authored by
    @srenatus
  - Security policy update (#8479) authored by @anderseknert
  - Dependency updates; notably:
  - build: bump go 1.26.2 (#8497) authored by @sspaink
  - build(deps): bump wasmtime-go from v39.0.1 to v43.0.2
  - build(deps): bump go.opentelemetry.io deps from
    1.40.0/0.65.0 to 1.43.0/0.68.0
  - build(deps): bump github.com/containerd/containerd/v2 from
    2.2.1 to 2.2.3
  - build(deps): bump ithub.com/huandu/go-sqlbuilder from
    1.39.1 to 1.40.2
  - build(deps): bump golang.org/x/net from 0.51.0 to 0.53.0
  - build(deps): bump golang.org/x/text from 0.34.0 to 0.36.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777636800">- Update to version 1.16.1:
  This is a patch release addressing a regression in the plugin
  manager that may cause the service to hang on shutdown (#8590).</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778587200">- Update to version 1.16.2:
  This release updates the version of Go used to build the OPA
  binaries and images to 1.26.3; addressing a number of
  vulnerabilities.
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
  This is CVE-2026-42501 and Go issue https://go.dev/issue/79070
  * build: bump go 1.26.2 -&gt; 1.26.3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 1.17.0:
  * This release contains a mix of new features, performance
    improvements, and bugfixes. Notably:
  - A new future.keywords.not import that adds improved semantics
    to the not keyword.
  - Rule Labels in Decision Logs
  - Published json schema for IR and bundle manifest
  - Dropped automaxprocs and x/net dependencies
  * Improved Negation Semantics (#8387)
    This OPA release introduces a new future.keywords.not import
    that fixes a long-standing semantic issue with negation in
    Rego.
    Without the import, the compiler expands a negated composite
    expression like not f(g(input.x)) into a series of
    sub-expressions evaluated before the not:
    __local0__ = input.x
    g(__local0__, __local1__)
    not f(__local1__)
    If any sub-expression fails — for example, input.x is undefined
    or g produces an undefined result — the entire rule fails
    rather than the not succeeding.  This is unintuitive: the
    user's intent is "the condition does not hold," but an
    undefined intermediate value causes a silent failure instead of
    the expected not result.
    With import future.keywords.not, composite-expression negation
    wraps the full compiler expansion in an implicit body:
    not { __local0__ = input.x; g(__local0__, __local1__); f(__local1__) }
    Now, if any sub-expression is undefined or fails, the body is
    unsatisfiable and the not expression succeeds; matching the
    intuition that "the condition does not hold."
    NOTE:
    Users are recommended to import future.keywords.not whenever
    the not keyword is used in a policy.
  * Rule Labels in Decision Logs (#2089)
    Rule annotations now support a labels field. Labels from all
    successfully evaluated rules are collected and included in each
    decision log entry as a top-level rule_labels array. Each
    element is the merged label map for one successfully evaluated
    rule, with inner-scope-wins precedence across the rule's
    annotation chain (subpackages &lt; package &lt; document &lt; rule).
    Merged maps are deduplicated across rules so that identical
    label sets collapse to a single entry.
    [#] METADATA
    [#] scope: package
    [#] labels:
    [#]   service: authz
    [#]   severity: info
    package myapp
    [#] METADATA
    [#] labels:
    [#]   severity: low
    [#]   team: platform
    allow if input.role == "admin"
    The resulting decision log entry will contain:
    {"rule_labels": [{"service": "authz", "severity": "low", "team": "platform"}]}
    Note how severity: info from the package scope is overridden by
    severity: low from the rule scope. Queries against rule_labels
    can now rely on each entry carrying the full label context for
    a single rule, rather than one entry per contributing scope.
    Both the runtime and the Go SDK now process metadata
    annotations by default.
  * Runtime, SDK, Tooling
  - ast: Allow $ref in allOf in JSON schemas (#6523) authored by
    @deeglaze reported by @mosiac1
  - bundle: Update bundle roots conflict detection algorithm.
    (#8664) authored by @philipaconrad
  - download: Use oras, not containerd (#8639) authored by
    @srenatus
  - server: Remove dead code (s.partials) (#8708) authored by
    @srenatus
  - server: Wire in response/request metadata for compile handler
    (#8650) authored by @srenatus
  - server/types: generalize request/response metadata (#8650)
    authored by @srenatus
  * Compiler, Topdown and Rego
  - builtins: Enable pattern validation in json.verify_schema and
    json.match_schema built-in functions (#6089) authored by
    @sspaink reported by @ewout8
  - ir: Don't capitalize index field in MakeNumberRefStmt IR
    statement (#6266) authored by @sspaink reported by
    @johanfylling
  - perf: Avoid allocating in binary and/or operators when
    possible (#8689) authored by @anderseknert
  - rego: Allow per-eval GenerateJSON function (#8690) authored
    by @anderseknert
  * Docs, Website, Ecosystem
  - ecosystem: add OPA MCP (#8618) authored by @OrygnsCode
  - docs: Add explicit address binding to examples (#8688)
    authored by @charlieegan3
  - docs: Add titles to code blocks in policy-testing (#8649)
    authored by @charlieegan3
  - docs: Correct OCP SSH key docs (#8675) authored by @taurelius
  - docs: Update diagram to match index examples (#8667) authored
    by @charlieegan3
  * Miscellaneous
  - ast,storage/inmem: Add inmem.NewFromASTObject and add missing
    string case to ast.InternedValue (#8707) authored by
    @anderseknert
  - build: go install -&gt; go install tool to control checksums
    (#8646) authored by @srenatus
  - build: Push edge binaries to bucket (#8668) authored by
    @charlieegan3
  - workflows: Fix benchmarks workflow (replace action, avoid
    stackoverflow) (#8655) authored by @srenatus
  - workflows: Note improvements in benchmark comments (#8673)
    authored by @srenatus
  - Generate a JSON Schema for the IR plan (#8662) authored by
    @sspaink reported by @kroekle
  - Generate a JSON Schema for the bundle manifest (#8661)
    authored by @sspaink reported by @kroekle
  - Dependency updates; notably:
  - build(deps): Remove automaxprocs dependency (#8696)
    authored by @anderseknert
  - build(deps): Remove direct x/net dependency (#8697)
    authored by @anderseknert
  - build(deps): Bump github.com/bytecodealliance/wasmtime-go
    from 43.0.2 to 44.0.0 (8652) authored by @srenatus
  - build(deps): Bump github.com/fsnotify/fsnotify from 1.9.0
    to 1.10.1
  - build(deps): Bump github.com/huandu/go-sqlbuilder from
    1.40.2 to 1.41.0
  - build(deps): Bump github.com/lestrrat-go/jwx/v3 from 3.1.0
    to 3.1.1
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    2.5.32 to 2.5.33
  - build(deps): Bump google.golang.org/grpc from 1.80.0 to
    1.81.0
  - build(deps): Bump gopkg.in/ini.v1 from 1.67.1 to 1.67.2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780920000">- Update to version 1.17.1:
  This release uses the latest version of Go (1.26.4) to build OPA,
  fixing stdlib vulnerabilities in code that OPA's HTTP handler and
  crypto builtins use:
  - https://pkg.go.dev/vuln/GO-2026-5039
  - https://pkg.go.dev/vuln/GO-2026-5037
  It is otherwise the same code as v1.17.0.
  * Miscellaneous
  - build: bump go 1.26.3 -&gt; 1.26.4 (authored by @srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782648000">- Update to version 1.18.0:
  This release contains a mix of bugfixes and small features.
  Notably:
  - A breaking fix to the outbound User-Agent header so it conforms
    to RFC 9110 (see below)
  - Container-aware resource limits: automatic GOMAXPROCS is
    restored and automatic GOMEMLIMIT is now supported
  - Several opa fmt correctness fixes
  - Improvements to opa test --coverage (ranges in report, inline
    rule head tracking, conjunction-expression coverage)
  * Breaking: Fix User-Agent according to RFC9110 (#8792)
  - OPA's outbound HTTP requests (bundle, discovery, decision
    log, status, http.send, AWS KMS/ECR) previously sent
    User-Agent: Open Policy Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;), which
    is not a valid RFC 9110 User-Agent value because the product
    token cannot contain spaces. The header is now
    Open-Policy-Agent/&lt;version&gt; (&lt;os&gt;, &lt;arch&gt;). Server-side log
    filters or WAF rules that exact-match the old string will
    need to be updated.
  * Runtime, SDK, Tooling
  - bundle: fix per-module rego version lookup (#8797) authored
    by @sspaink, reported by @xubinzheng
  - bundle: improve determinism of file_rego_versions patterns
    with overlap (#8733) authored by @philipaconrad
  - cover: Track inline rule head in post trace walk (#6531)
    authored by @charlieegan3, reported by @anderseknert
  - cover: Update report to include ranges (#8748) reported and
    authored by @charlieegan3
  - cover: Add support for coverage of conjunction exprs (#8809)
    authored by @charlieegan3
  - download/oci: Set Accept headers (#8720) authored by
    @charlieegan3
  - fmt: preserve the multiline but single entry iterables
    (#8557) authored by @unichronic, reported by @anderseknert
  - format: Fix dropped with-clause after comment in object value
    (#8765) authored by @sspaink, reported by @srabraham
  - format: keep lone with on the closing-bracket line of
    multi-line expressions (#8804) authored by @anneheartrecord,
    reported by @burnster
  - oracle: Fix find-definition on expressions inside ast.Not
    nodes (#8731) authored by @johanfylling
  - runtime: Restore goautomaxprocs, add automemlimit (#8784)
    authored by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Apply location to inner ast.Not expressions (#8717)
    authored by @johanfylling, reported by @anderseknert
  - ast: Clean up code for value comparisons (#8737) authored by
    @anderseknert
  - ast: Fix PE regression for future.keywords.not negation
    inside every (#8781) authored by @johanfylling
  - internal/edittree: Add recursive tree node recycling (#8693)
    authored by @philipaconrad
  - internal: compile,planner: improve determinism of plan/wasm
    bundle builds (#8732) authored by @philipaconrad
  - perf: avoid allocations in object.get (#8729) authored by
    @anderseknert
  - topdown: Fix PE not namespacing vars in comprehensions nested
    inside every (#8816) authored by @johanfylling
  - topdown: remove dst.Compare(src) shortcut (#8739) authored by
    @srenatus
  - topdown: skip strconv.ParseInt in format_int base-10 fast
    path (#8801) authored by @srenatus
  * Docs, Website, Ecosystem
  - docs/chore: Remove broken links (#8714) authored by
    @charlieegan3, reported by @github-actions
  - docs: PoC for kapa.ai (#8125) reported and authored by
    @charlieegan3
  - docs(ecosystem): update OPA MCP entry with video, blog, and
    distribution links (#8712) authored by @OrygnsCode
  - docs/contributing: add formatting (#8740) authored by @mmzzuu
  - docs: Add SDK references for evaluating IR plans (#8783)
    authored by @charlieegan3
  - docs: Add depkeep to enterprise support (#8685) authored by
    @pkuzco
  - docs: Add notes about use of GOMEMLIMIT (#8771) authored by
    @charlieegan3
  - docs: Add we/our/us check to spell check (#8787) authored by
    @charlieegan3
  - docs: Update built-in index page titles (#8728) authored by
    @charlieegan3
  - docs: Update documentation to be more consistent and sound
    more like reference docs (#8786) authored by @charlieegan3
  - docs: Update regal docs for 0.41.1 release (#8730) authored
    by @charlieegan3
  - docs: Update to agents.md regarding security dependences
    'fixes' (#8754) authored by @charlieegan3
  - docs: clarify environment variable substitution behaviour
    (#8713) authored by @taurelius
  - docs: remove duplicated word in Rego style guide (#8800)
    authored by @s3onghyun
  - website: Add .md alternate content types for llms (#8725)
    authored by @charlieegan3
  - website: Add support page disclaimer and sort by date added
    (#8736) authored by @charlieegan3
  - website: Fix build from missing dateAdded (#8764) authored by
    @charlieegan3
  - website: Update docusaurus (#8756) authored by @charlieegan3
  - website: Update homepage AI example to tool calls (#8755)
    authored by @charlieegan3
  - website: Various updates to node and website deps (#8768)
    authored by @charlieegan3
  - website: add ossrisk to ecosystem (#8780) authored by @pkuzco
  * Miscellaneous
  - benchmarks: smaller tweaks (#8759) authored by @srenatus
  - benchmarks: split off script, emit markdown table (#8812)
    authored by @srenatus
  - benchmarks: use details+summary comments for benchlab results
    (#8811) authored by @srenatus
  - capabilities: Integrate 1.17.1 patch release (#8798) authored
    by @sspaink
  - chore: tidy go.mod to remove untagged versions (#8791)
    authored by @thaJeztah
  - e2e: Add proto schemas for the IR plan and bundle manifest
    (#8766) reported and authored by @sspaink
  - gha: deduplicate change-detection output in pr CI checks
    (#8808) authored by @sspaink
  - nightly: use regal@main (#8735) authored by @srenatus
  - workflow: remove tests from docker (edge) image build (#8721)
    authored by @srenatus
  - workflows: bring back docker edge tags for post-merge (#8718)
    authored by @srenatus
  - workflows: use go-version-file with actions/setup-go (#8751)
    authored by @srenatus
  - Dependency updates; notably:
  - build(deps): Add github.com/KimMachineGun/automemlimit
    v0.7.5
  - build(deps): Add go.uber.org/automaxprocs v1.6.0
  - build(deps): Bump github.com/dgraph-io/badger/v4 from
    v4.9.1 to v4.9.2
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    v2.5.33 to v2.5.34
  - build(deps): Bump
    go.opentelemetry.io/contrib/bridges/prometheus from v0.68.0
    to v0.69.0
  - build(deps): Bump
    go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
    from v0.68.0 to v0.69.0
  - build(deps): Bump go.opentelemetry.io/otel from v1.43.0 to
    v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace from
    v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
    from v1.43.0 to v1.44.0
  - build(deps): Bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
    from v1.43.0 to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/sdk from v1.43.0
    to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/sdk/metric from
    v1.43.0 to v1.44.0
  - build(deps): Bump go.opentelemetry.io/otel/trace from
    v1.43.0 to v1.44.0
  - build(deps): Bump golang.org/x/sync from v0.20.0 to v0.21.0
  - build(deps): Bump golang.org/x/text from v0.37.0 to v0.38.0
  - build(deps): Bump google.golang.org/grpc from v1.81.0 to
    v1.81.1
  - build(deps): Bump gopkg.in/ini.v1 from v1.67.2 to v1.67.3
  - build(deps): Bump oras.land/oras-go/v2 from v2.6.0 to
    v2.6.1
  - build(deps): bump golang.org/x/crypto to v0.52.0 and
    golang.org/x/net to v0.55.0 (#8745) authored by @BGebken
  - build: bump go 1.26.3 -&gt; 1.26.4 (#8726) authored by
    @srenatus</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782907200">- Update to version 1.18.1:
  This release fixes a memory leak introduced in OPA v1.17.0. It is
  advised to update if you notice excess memory usage when running
  OPA server.
  * Fixes
  - ast: fix AnnotationSet memory leak via runtime.AddCleanup
    cycle (#8817) authored by @srenatus reported by @keydon and
    @gorsr01</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782993600">- Update to version 1.18.2:
  This release includes a bug fix for a opa fmt regression
  introduced in v1.18.0.
  The original fix for #8557 had the formatter enforce newlines in
  single-item collections (arrays, objects, sets) rather than
  merely honoring existing ones. As a result, running opa fmt on
  already-formatted policies could introduce a large number of
  unwanted changes. This patch release restores the intended
  behavior: only newlines already present in the source determine
  whether a single-item collection is formatted on one line or
  across multiple lines.
  * Fixes
  - Fix regression in fix of #8557 (#8845) (authored by
    @anderseknert)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1785499200">- Update to version 1.19.0:
  * This release contains a mix of new features and bug fixes.
    Notably:
  - A fixed SQL injection vector in the Compile API
  - Stricter safety checking for Rego assignments (:=)
  - A cgo-free, faster WebAssembly runtime (wazero replaces
    wasmtime-go)
  - Startup warnings for unknown configuration options
  - A new strings.split_n built-in function
  - A REPL line reader that handles pasted input correctly,
    migrating existing history files
  * Fix SQL injection vector in Compile API: Quote SQL filter field
    identifiers (#8945)
  - The field names in the SQL emitted by the Compile API come
    from partially evaluated refs, so a policy that selects a
    dynamic key — such as input.fruits[input.column] — puts
    caller-controlled text in an identifier position. That text
    was emitted verbatim, which turns
    WHERE fruit.name = 'allowed'
    into
    WHERE fruit.name = 'allowed' OR 1=1 -- = 'allowed'
    and an application appending the filter to its query returns
    rows the policy denies.
    Field segments that are not bare identifiers are now quoted
    at the UCAST-to-SQL boundary, with any embedded quote
    character escaped. Ordinary column names stay unquoted, so
    existing filters keep their current shape and remain
    case-insensitive on Postgres.
  * Behavior change: stricter safety for assignment (:=) (#3546)
  - The assignment operator (:=) is documented as "syntactic
    sugar for =, local variable creation, and additional compiler
    checks," and the safety checker reflects that: after
    rewriting, := is treated identically to = (unification), so
    an assignment's right-hand side can be made safe by unifying
    "backwards" through the left-hand side. This means policies
    like x := y; x = 7 compile (binding y to 7) even though y is
    never assigned, and x := y; obj[x] can silently degrade an
    expected constant-time lookup into full iteration.
    This change makes the right-hand-side of := be treated as a
    read that must be made safe by other expressions, and can no
    longer be satisfied through the left-hand-side. Affected
    policies that previously compiled now fail with a
    rego_unsafe_var_error. Reference iteration on the
    right-hand-side (e.g.  some k; v := obj[k]) is unaffected.
    Note: this is a deliberate semantic change, not a fix to
    match documented behavior — the intended semantics of := in
    this case were never specified.
  - WebAssembly runtime: wasmtime-go replaced with wazero (#7557)
    OPA's WebAssembly runtime — used by the wasm evaluation
    target and the WASM SDK — now runs on the pure-Go wazero
    runtime instead of bytecodealliance/wasmtime-go. This removes
    the cgo dependency from this path, so wasm-enabled builds no
    longer need a C toolchain.
    Compiled policy modules are now cached process-wide, so
    repeated VM creation for the same policy skips recompilation.
    On an Apple M4 Max this makes wasm cold start (compile +
    instantiate + first eval) about 73% faster, and warm
    evaluation about 29% faster with ~28% fewer allocations.
  - Configuration validation moved to Rego, with warnings on
    unknown options (#8891)
    Top-level configuration validation and default injection
    (default_decision, default_authorization_decision, labels) is
    now expressed as an embedded Rego policy rather than
    hand-written Go, as is the validation of server.metrics and
    metrics_export.
    The user-visible effect is that unrecognized configuration
    options are reported instead of being silently ignored. A
    typo such as decision_log instead of decision_logs now logs a
    warning at startup:
    {"level":"warning","msg":"unknown configuration option \"decision_log\" encountered"}
    These are warnings, not errors: OPA starts as before, and
    sections that are intentionally user-extensible are left
    alone, so extra keys there do not warn. Embedders reading
    configuration through config.ParseConfig can find the same
    messages on Config.Warnings.
  - Add strings.split_n built-in function (#8344)
    Policies often need only the first or last few parts of a
    split string, but the existing split built-in always returns
    every part, so the count has to be worked around with
    wildcards or a slice.
    strings.split_n takes the first n split parts from the front
    or the back of the string, depending on whether n is positive
    or negative:
    result := strings.split_n("a.b.c.d", ".", 2)
    [#] result == ["a", "b"]
    result := strings.split_n("a.b.c.d", ".", -2)
    [#] result == ["c", "d"]
    If abs(n) is larger than the number of parts, all parts are
    returned. An n of 0 returns an empty array.
  - Improved REPL line editing, with history file migration
    (#962)
    Pasting a tab-indented snippet into the REPL triggered
    tab-completion on the pasted tab, corrupting the input (e.g.
    injecting a completion candidate mid-line and producing a
    spurious parse error).  Fixing that requires bracketed paste,
    where the terminal wraps pasted text in markers so the line
    reader inserts it literally instead of treating an embedded
    tab as a completion request. The previous reader,
    peterh/liner, has no bracketed-paste support and is
    unmaintained (last release 2021), so it has been replaced
    with reeflective/readline.
    The new reader persists history as JSON lines instead of one
    command per line. Existing history files (~/.opa_history by
    default, or the path given to --history) are detected and
    migrated in place the first time the REPL loads them, so
    history written by earlier versions of OPA is kept.  OPA's
    own multi-line buffering is unchanged, and readline's native
    multi-line editing is left disabled to avoid changing REPL
    behavior.
  * Runtime, SDK, Tooling
  - cmd: Avoid intermediate buffer when writing bundle (#8909)
    authored by @anderseknert
  - cmd/build: Add --format flag for proto/JSON plan bundles to
    opa build (#8825) authored by @sspaink
  - cmd/check: Report wrapped structured errors individually
    (#3663) authored by @sspaink, reported by @oren-zohar
  - compile: Preserve package annotations in wasm bundle builds
    (#8854) authored by @srenatus, reported by @me-viper
  - format: Keep rule body inline when the head spans multiple
    lines (#8894) authored by @Kunalbehbud, reported by
    @charlieegan3
  - repl: Use a plain line reader for non-terminal input (#8941)
    authored by @sspaink
  - server: Set ReadHeaderTimeout to 32s on all HTTP servers
    (#8877) authored by @RinZ27
  - server/failtracer: Skip self-referential undefined-ref hints
    (#8916) authored by @srenatus
  - sdk: Allow customizing HTTP RoundTripper per Decision (#8884)
    authored by @paulo-raca
  - sdk: Fix deadlock between OPA.Plugin and manager onCommit
    (#8873) reported and authored by @sspaink
  - tester: Make Result JSON round-trippable (#8014) authored by
    @vsolano9, reported by @anderseknert
  - topdown: Resolve ground refs in --var-values cmd output
    (#7830) authored by @sspaink, reported by @charlieegan3
  * Compiler, Topdown and Rego
  - ast: Add support for Go 1.27 &amp; jsonv2 (#8947) authored by
    @anderseknert and @charlieegan3
  - ast: Fix aliased comment buffer in annotation parser (#8757)
    authored by @sspaink, reported by @0hardik1
  - ast: Fix non-deterministic type errors when shadowing a
    built-in (#3729) authored by @sspaink, reported by @srenatus
  - ast: Fix leaky future.keywords.not import in Rego v0 (#8953)
    authored by @johanfylling
  - ast: Fix panic when indexing composite literal values in x in
    [...] (#8918) reported and authored by @srenatus
  - ast: Fix TermValueEqual performance regression (#8863)
    authored by @mchitten
  - ast: Improve rule conflict error (#6391) authored by
    @unichronic, reported by @johanfylling
  - ast: Make CogeneratedExprs return deterministic order (#8895)
    authored by @sspaink
  - ast: Reject partial set and -object rules sharing a name
    (#8860) authored by @sspaink, reported by @shomron
  - ast: Restore location on unsafe var errors for rewritten head
    vars (#8719) authored by @Atishyy27, reported by
    @anderseknert
  - ast: Use more precise return types for object.* builtins
    (#8692) reported and authored by @anderseknert
  - ast+topdown: Let rule external sources distinguish absent
    from unknown (#8878) authored by @srenatus
  - ast+topdown: Parametrized (prefix) external rule sources
    (#8881) authored by @srenatus
  - topdown: Fix "a", "a" in {"a"} not returning true (#8747)
    authored by @anderseknert
  - topdown: Fix format_int precision loss for integers larger
    than 64 bits (#8857) authored by @Synvoya
  - topdown: Fix precision loss for integers larger than 64 bits
    in arithmetic and aggregates (#6281) authored by @Atishyy27,
    reported by @tsandall
  - topdown: Don't leak internal vars in Partial-Evaluation
    results (#6378) authored by @sspaink, reported by @nkey0
  - topdown/copypropagation: Avoid circular reference in
    Partial-Evaluation through call (#6428) authored by @sspaink,
    reported by @nkey0
  - topdown+util: Add generic SliceStack/GroupStack, unify
    refStack/functionMocksStack/saveStack (#8886) authored by
    @srenatus
  - topdown+util: Replace hand-rolled evalFunc/evalBuiltin pools
    with generic ResettablePool (#8886) authored by @srenatus
  - perf: Avoid allocations with custom Atoi and Atoi64 helpers
    (#8758) authored by @anderseknert
  - perf: Lazy init of scalars map in indexer (#8936) authored by
    @anderseknert
  - perf: Reduce allocations in index lookup (#8835) authored by
    @anderseknert
  - planner: Avoid redundant ruletrie.Children() call in Depth()
    (#8886) authored by @srenatus
  - planner: Unify functionMocksStack on generic GroupStack[T]
    (#8886) authored by @srenatus
  * Docs, Website, Ecosystem
  - ecosystem: Add agt-policies-africa — African data protection
    OPA policy pack (#8850) authored by @kingztech2019
  - ecosystem: Add Ghostunnel and NATS Plugin to Ecosystem
    (#8871) authored by @charlieegan3
  - ecosystem: Add Sencillo projects to ecosystem (#8818)
    authored by @hooksie1
  - docs: Add kubecon NA page (#8876) authored by @charlieegan3
  - docs: Add recommendations to follow Envoy's best practices
    (#8944) authored by @johanfylling
  - docs: Document rule indexer support for in, bare refs;
    modernize rego (#8822) authored by @srenatus, reported by
    @tsandall
  - docs: Document the compile metadata annotation (#8824)
    authored by @youdie006, reported by @anderseknert
  - docs: Fix broken OAuth2/OIDC policy examples (#8840) authored
    by @mailnike
  - docs: Fix decision_logs buffer_size_limit_events default in
    prose (#8866) authored by @s3onghyun
  - docs: Remove import rego.v1 (#8867) authored by @charlieegan3
  - docs: Some minor bug fixes to improve reporting (#8917)
    authored by @charlieegan3
  - docs: The Zed Rego extension link points at
    github.com/StyraInc/zed-rego (404). The repo now lives at
    github.com/StyraOSS/zed-rego. (#8883) authored by @mailnike
  - docs: Update cheatsheet files (#8868) authored by
    @charlieegan3
  - docs: Update regal and blog links (#8901) authored by
    @charlieegan3
  - docs: Updates examples to use some...in, add link to debugger
    (#8806) authored by @charlieegan3
  - website: Improve partial evaluation / data filtering
    documentation (#8625) authored by @mmzzuu
  - website: Import blog from medium (#8898) authored by
    @charlieegan3
  * Miscellaneous
  - ast: Add benchmark for rule index ref ordering (#8943)
    authored by @srenatus
  - ast: Various style fixes (#8938) authored by @anderseknert
  - build: Add Dockerfile.rego to validate image builds (#8401)
    authored by @jasdeepbhalla, reported by @anderseknert
  - build: Get just the needed commits for CI (#8940) authored by
    @charlieegan3
  - test: Start decommissioning test.WithTempFS (#8908) authored
    by @anderseknert
  - topdown: Add regression test for partial eval local names
    (#5226) authored by @sspaink, reported by @fab29p
  - topdown: Fix Partial-Evaluation test rejected by new conflict
    check (#8860) authored by @sspaink, reported by @shomron
  - topdown: Vendor a method-less text/template to restore
    whole-binary linker DCE (#7903) authored by @rchildress87,
    reported by @kruskall
  - workflows: Remove cpp from CodeQL language matrix (#8864)
    authored by @sspaink
  - workflows: Prune benchmarks to last 250 runs (#8834) authored
    by @srenatus
  - Dependency updates; notably:
  - build(go): Bump Go from 1.26.4 to 1.26.5 (#8875) authored
    by @srenatus
  - build(deps): Add github.com/reeflective/readline 1.3.0
  - build(deps): Add golang.org/x/term 0.45.0
  - build(deps): Bump github.com/dgraph-io/badger/v4 from 4.9.2
    to 4.9.4
  - build(deps): Bump github.com/go-logr/logr from 1.4.3 to
    1.4.4
  - build(deps): Bump github.com/huandu/go-sqlbuilder from
    1.41.0 to 1.42.1
  - build(deps): Bump github.com/prometheus/client_golang from
    1.23.2 to 1.24.0
  - build(deps): Bump github.com/vektah/gqlparser/v2 from
    2.5.34 to 2.5.36
  - build(deps): Bump golang.org/x/sync from 0.21.0 to 0.22.0
  - build(deps): Bump golang.org/x/text from 0.38.0 to 0.40.0
  - build(deps): Bump google.golang.org/grpc from 1.81.1 to
    1.82.1
  - build(deps): Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2
    (#8889) authored by @ahbarrios
  - Addressing GHSA-fxhp-mv3v-67qp
  - build(deps): Drop github.com/peterh/liner
  - build(deps): Drop github.com/KimMachineGun/automemlimit
    (#8869) authored by @charlieegan3
  - build(deps): Drop go.uber.org/automaxprocs (#8869) authored
    by @charlieegan3</changelog>
</package>
<package pkgid="02affe31f25777ddef67a43014bd9e260b22450c9cbbc98b2c49c92bc7a5690cc07b8d20c6a69343208e4d3f2b84628b2ebc741ff2c10a90e1223d912125de9d" name="openCryptoki" arch="s390x">
  <version epoch="0" ver="3.27.0" rel="270.3"/>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1721304000">- Amended the .spec file accorinding to the recommendation in (bsc#1225876)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1726833600">- Upgrade openCryptoki to version 3.24
  (jsc#PED-10291, jsc#PED-10290, jsc#PED-10241)
  * Add support for building Opencryptoki on the IBM AIX platform
  * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
  * Add support for protecting tokens with a token specific user group
  * EP11: Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
  * CCA: Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later
  * CCA: Add support for IBM Dilithium (CKM_IBM_DILITHIUM).
  - On Linux on IBM Z: Requires CCA v7.1 or later for Round2-65, and
    CCA v8.0 for the Round 3 variants.
  - On other platforms:
    Requires CCA v7.2.43 or later for Round2-65, the Round 3 variants are currently not supported
  * CCA: Add support for RSA-OAEP with SHA224, SHA384, and SHA512 on en-/decrypt.
  - Requires CCA v8.1 or later on Linux on IBM Z, not supported on other platforms
  * CCA: Add support for PKCS#11 v3.0 SHA3 mechanisms.
  - Requires CCA v8.1 on Linux on IBM Z, not supported on other platforms
  * ICA: Support new libica AES-GCM api using the KMA instruction on z14 and later
  * ICA/Soft/ICSF: Add support for PKCS#11 v3.0 SHA3 mechanisms
  * ICA/Soft: Add support for SHA based key derivation mechanisms
  * ICA/Soft: Add support for CKD_*_SP800 KDFs for ECDH
  * EP11/CCA/ICA/Soft: Add support for CKA_ALWAYS_AUTHENTICATE
  * EP11/CCA: Support live guest relocation for protected key (PKEY) operations
  * Soft: Experimental support for IBM Dilithium via OpenSSL OQS provider
  * ICSF: Add support for SHA-2 mechanisms
  * ICSF: Performance improvements for attribute retrieval
  * p11sak: Add support for exporting a key or certificate as URI-PEM file
  * p11sak: Import/export of IBM Dilithium keys in 'oqsprovider' format PEM files
  * p11sak: Add option to show the master key verification patterns of secure keys
  * Bug fixes
- Amended the .spec file
- Removed obsolete patch ocki-3.23-remove-make-install-chgrp.patchi
- Added a new patch ocki-3.24-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1728043200">- Amended the .spec file (jsc#PED-10241)
- Updated the %configure flags for i586
- Implemented a logic to exclude i586 arch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1732190400">- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
- Improved handling of user/group. use existing user/group if they
  exist. create user/group if not (bsc#1225876)
- Applied additional patch
  * ocki-3.24-remove-group-from-tests.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1733832000">- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
  * Changed attributes - %attr(0640,root,%{pkcs_group}) - of files below:
  - %{_sysconfdir}/opencryptoki/strength.conf
  - %{_sysconfdir}/opencryptoki/p11sak_defined_attrs.conf</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1733918400">- Moved pkcshsm_mk_change from openCryptoki-devel to openCryptoki
    (jsc#PED-10291, jsc#PED-10290)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade openCryptoki to version 3.25 (jsc#PED-3361)
  * Updates/add supports
  - ICA/Soft: Add support for PKCS#11 v3.0 SHAKE key derivation
  - EP11: Add support for PKCS#11 v3.0 SHA3 and SHA3-HMAC mechanisms
  - EP11: Add support for PKCS#11 v3.0 SHA3 mechanisms and MGFs for RSA-OAEP
  - EP11: Add support for PKCS#11 v3.0 SHA3 variants of RSA-PKCS and ECDSA mechanisms
  - CCA: Add support for CCA AES CIPHER secure key types
  - CCA: Add support for the CKM_ECDH1_DERIVE mechanism
  - Soft/ICA: Add support for the CKM_AES_KEY_WRAP[_*] mechanisms
  - CCA/Soft/ICA: Add support for the CKM_RSA_AES_KEY_WRAP mechanism
  - Soft/ICA: Add support for the CKM_ECDH_AES_KEY_WRAP mechanism
  - ICA: Report mechanisms dependent on if libica is in FIPS mode
  - P11KMIP: Add a tool for import and exporting PKCS#11 keys to a KMIP server
  - EP11: Add support for opaque secure key blob import via C_CreateObject
  - Soft/ICA: Add support for key wrapping with AES-GCM
  - CCA: Add support for newer CCA versions on s390x and non-s390x platforms
  - CCA: Add support for CKM_AES_GCM (single-part operations only)
  * Amended the .spec file
  * Removed obsolete patches:
  - ocki-3.24-remove-group-from-tests.patch
  - ocki-3.24-remove-make-install-chgrp.patch
  * Applied a new patch for version 3.25
  - ocki-3.25-remove-make-install-chgrp.patch
  * Bug fixes</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753790400">- Add riscv64 to openCryptoki_64bit_arch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1755172800">- Applied a patch (bsc#1248002)
  * ocki-3.25-PKCSSLOTD-Remove-the-use-of-MD5.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1762948800">- Upgrade openCryptoki to 3.26
  * Soft: Add support for RSA keys up to 16K bits.
  * CCA: Add support for RSA keys up to 8K bits (requires CCA v8.4 or v7.6 or later).
  * p11sak: Add support for generating RSA keys up to 16K bits.
  * Soft/ICA: Add support for SHA512/224 and SHA512/256 key derivation mechanism (CKM_SHA512_224_KEY_DERIVATION and CKM_SHA512_256_KEY_DERIVATION).
  * Soft/ICA/CCA/EP11: Add support for SHA-HMAC key types CKK_SHAxxx_HMAC and key gen mechanisms CKM_SHAxxx_KEY_GEN.
  * p11sak: Add support for SHA-HMAC key types and key generation.
  * p11sak: Add support for key wrap and unwrap commands to export and import private and secret keys by means of key wrapping/unwrapping
    with various key wrapping mechanism.
  * p11kmip: Add support for using an HSM-protected TLS client key via a PKCS#11 provider.
  * p11sak: Add support for exporting non-sensitive private keys to password protected PEM files.
  * Add support for canceling an operation via NULL mechanism pointer at C_XxxInit() call as an alternative to C_SessionCancel() (PKCS#11 v3.0).
  * EP11: Add support for pairing friendly BLS12-381 EC curve for sign/verify using CKM_IBM_ECDSA_OTHER and signature/public key aggregation using CKM_IBM_EC_AGGREGATE.
  * p11sak: Add support for generating BLS12-381 EC keys.
  * EP11: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later, and
    a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
  * CCA: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires CCA v8.4 or later).
  * Soft: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or the OQS-provider must be configured).
  * p11sak: Add support for IBM-specific ML-DSA and ML-KEM key types.
  * Bug fixes.
- Removed obsolete patches
  * ocki-3.25-remove-make-install-chgrp.patch
  * ocki-3.25-PKCSSLOTD-Remove-the-use-of-MD5.patch
- Applied a new patch for version 3.26
  * ocki-3.26-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767873600">- Modified the .spec file for Immutable Mode (jsc#PED-14798)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1768392000">- Applied a patch (bsc#1256673, CVE-2026-22791)
  * openCryptoki-CVE-2026-22791-commit-e37e912.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1769083200">- Applied a patch (bsc#1257116,  CVE-2026-23893)
  * openCryptoki-CVE-2026-23893-commit-5e6e4b4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1772366400">- Refactored .spec file to fully support transactional and immutable operating systems
  (jsc#PED-14609):
  * Migrated user and group creation (pkcs11, pkcsslotd) from imperative %pre shell commands to
    declarative systemd-sysusers configuration.
  * Replaced manual /var directory tracking and %ghost directives with
    comprehensive systemd-tmpfiles configurations.
  * Implemented dynamic, architecture-specific tmpfiles.d generation to properly provision
    hardware-specific token directories (e.g., ccatok, ep11tok, lite, and HSM_MK_CHANGE).
- Fixed permissions for /run/opencryptoki within tmpfiles.d to ensure the
  daemon can successfully drop privileges and bind its communication socket.
  * Moved 32-bit and 64-bit shared library symlink creation (such as PKCS11_API.so, stdll, and methods)
    from %post scriptlets into the %install phase,
    ensuring they are correctly packaged and tracked on the read-only /usr partition.
  * Removed legacy /etc/pkcs11 bash migration logic from %post,
    replacing it with a declarative tmpfiles.d symlink rule.
- Cleaned up scriptlets to only execute transaction-safe macros
  (such as ldconfig and systemd service handlers).</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1776686400">- Amended the .spec file (jsc#PED-14609)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1776772800">- Applied a modified patch (bsc#1262283 (CVE-2026-40253))
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1777896000">- Applied an updated patch provided by IBM (bsc#1263819 (CVE-2026-40253))
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1778846400">- Upgrade openCryptoki to version 3.27 (jsc#PED-14609)
  * Add base support for PKCS#11 v3.2.
  * Add support for PKCS#11 v3.2 C_VerifySignature[Init|Update|Final].
  * Add support for PKCS#11 v3.2 C_EncapsulateKey/C_DecapsulateKey.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with RSA-PKCS and RSA-OAEP mechanisms.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the ECDH mechanism.
  * Soft/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the DH-PKCS mechanism.
  * Soft: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or
    the OQS-provider must be configured).
  * CCA: Add support for PKCS#11 v3.2 ML-DSA key type and mechanisms (requires CCA v8.4 or later)
  * EP11: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later,
    and a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
  * p11sak: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types.
  * Soft/ICA: Add support for PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
  * p11sak: Add support for key wrapping with PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 mechanism CKM_PUB_KEY_FROM_PRIV_KEY.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.0 Edwards and Montgomery key types and mechanisms.
  * Soft/ICA: Support CKM_ECDH_AES_KEY_WRAP also for Montgomery keys.
  * p11sak: Add support for PKCS#11 v3.0 Edwards and Montgomery key types.
  * Soft: Add support for CKM_ECDH1_COFACTOR_DERIVE.
  * CCA: Add support for additional RSA public exponent values 5, 17, or 257.
  * p11sak: Add option to list-key command to show EP11 session IDs.
  * Make the maximum number of token objects supported configurable.
  * Fixes for CVE-2026-40253, CVE-2026-23893, and CVE-2026-22791.
  * Bug fixes.
- Removed obsolete patches:
  * ocki-3.26-remove-make-install-chgrp.patch
  * openCryptoki-CVE-2026-22791-commit-e37e912.patch
  * openCryptoki-CVE-2026-23893-commit-5e6e4b4.patch
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch
  Added a new patch for ver 3.27:
  * ocki-3.27-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782129600">- Updated the .spec file (bsc#126874)
  * fixed the permissions in `%{buildroot}%{_prefix}/lib/tmpfiles.d/opencryptoki.conf`</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1783944000">- Ammended the .spec file (bsc#1268745)
- Fixed pkcsslotd directory creation failures on immutable/transactional systems:
  * Added systemd service drop-in to allow dynamic token slot path creation
    (e.g., icatok_X) via ReadWritePaths.</changelog>
</package>
<package pkgid="9a29c96102eea5841f19b6f5db39daf6833ed805e3972e83b2c5a208d772b0f19cc541fc801633e25c6aefae9679aa7feb2cfecde63589add5ec5d811f5d7a1f" name="openCryptoki" arch="src">
  <version epoch="0" ver="3.27.0" rel="270.3"/>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1721304000">- Amended the .spec file accorinding to the recommendation in (bsc#1225876)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1726833600">- Upgrade openCryptoki to version 3.24
  (jsc#PED-10291, jsc#PED-10290, jsc#PED-10241)
  * Add support for building Opencryptoki on the IBM AIX platform
  * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
  * Add support for protecting tokens with a token specific user group
  * EP11: Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
  * CCA: Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later
  * CCA: Add support for IBM Dilithium (CKM_IBM_DILITHIUM).
  - On Linux on IBM Z: Requires CCA v7.1 or later for Round2-65, and
    CCA v8.0 for the Round 3 variants.
  - On other platforms:
    Requires CCA v7.2.43 or later for Round2-65, the Round 3 variants are currently not supported
  * CCA: Add support for RSA-OAEP with SHA224, SHA384, and SHA512 on en-/decrypt.
  - Requires CCA v8.1 or later on Linux on IBM Z, not supported on other platforms
  * CCA: Add support for PKCS#11 v3.0 SHA3 mechanisms.
  - Requires CCA v8.1 on Linux on IBM Z, not supported on other platforms
  * ICA: Support new libica AES-GCM api using the KMA instruction on z14 and later
  * ICA/Soft/ICSF: Add support for PKCS#11 v3.0 SHA3 mechanisms
  * ICA/Soft: Add support for SHA based key derivation mechanisms
  * ICA/Soft: Add support for CKD_*_SP800 KDFs for ECDH
  * EP11/CCA/ICA/Soft: Add support for CKA_ALWAYS_AUTHENTICATE
  * EP11/CCA: Support live guest relocation for protected key (PKEY) operations
  * Soft: Experimental support for IBM Dilithium via OpenSSL OQS provider
  * ICSF: Add support for SHA-2 mechanisms
  * ICSF: Performance improvements for attribute retrieval
  * p11sak: Add support for exporting a key or certificate as URI-PEM file
  * p11sak: Import/export of IBM Dilithium keys in 'oqsprovider' format PEM files
  * p11sak: Add option to show the master key verification patterns of secure keys
  * Bug fixes
- Amended the .spec file
- Removed obsolete patch ocki-3.23-remove-make-install-chgrp.patchi
- Added a new patch ocki-3.24-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1728043200">- Amended the .spec file (jsc#PED-10241)
- Updated the %configure flags for i586
- Implemented a logic to exclude i586 arch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1732190400">- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
- Improved handling of user/group. use existing user/group if they
  exist. create user/group if not (bsc#1225876)
- Applied additional patch
  * ocki-3.24-remove-group-from-tests.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1733832000">- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
  * Changed attributes - %attr(0640,root,%{pkcs_group}) - of files below:
  - %{_sysconfdir}/opencryptoki/strength.conf
  - %{_sysconfdir}/opencryptoki/p11sak_defined_attrs.conf</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1733918400">- Moved pkcshsm_mk_change from openCryptoki-devel to openCryptoki
    (jsc#PED-10291, jsc#PED-10290)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade openCryptoki to version 3.25 (jsc#PED-3361)
  * Updates/add supports
  - ICA/Soft: Add support for PKCS#11 v3.0 SHAKE key derivation
  - EP11: Add support for PKCS#11 v3.0 SHA3 and SHA3-HMAC mechanisms
  - EP11: Add support for PKCS#11 v3.0 SHA3 mechanisms and MGFs for RSA-OAEP
  - EP11: Add support for PKCS#11 v3.0 SHA3 variants of RSA-PKCS and ECDSA mechanisms
  - CCA: Add support for CCA AES CIPHER secure key types
  - CCA: Add support for the CKM_ECDH1_DERIVE mechanism
  - Soft/ICA: Add support for the CKM_AES_KEY_WRAP[_*] mechanisms
  - CCA/Soft/ICA: Add support for the CKM_RSA_AES_KEY_WRAP mechanism
  - Soft/ICA: Add support for the CKM_ECDH_AES_KEY_WRAP mechanism
  - ICA: Report mechanisms dependent on if libica is in FIPS mode
  - P11KMIP: Add a tool for import and exporting PKCS#11 keys to a KMIP server
  - EP11: Add support for opaque secure key blob import via C_CreateObject
  - Soft/ICA: Add support for key wrapping with AES-GCM
  - CCA: Add support for newer CCA versions on s390x and non-s390x platforms
  - CCA: Add support for CKM_AES_GCM (single-part operations only)
  * Amended the .spec file
  * Removed obsolete patches:
  - ocki-3.24-remove-group-from-tests.patch
  - ocki-3.24-remove-make-install-chgrp.patch
  * Applied a new patch for version 3.25
  - ocki-3.25-remove-make-install-chgrp.patch
  * Bug fixes</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753790400">- Add riscv64 to openCryptoki_64bit_arch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1755172800">- Applied a patch (bsc#1248002)
  * ocki-3.25-PKCSSLOTD-Remove-the-use-of-MD5.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1762948800">- Upgrade openCryptoki to 3.26
  * Soft: Add support for RSA keys up to 16K bits.
  * CCA: Add support for RSA keys up to 8K bits (requires CCA v8.4 or v7.6 or later).
  * p11sak: Add support for generating RSA keys up to 16K bits.
  * Soft/ICA: Add support for SHA512/224 and SHA512/256 key derivation mechanism (CKM_SHA512_224_KEY_DERIVATION and CKM_SHA512_256_KEY_DERIVATION).
  * Soft/ICA/CCA/EP11: Add support for SHA-HMAC key types CKK_SHAxxx_HMAC and key gen mechanisms CKM_SHAxxx_KEY_GEN.
  * p11sak: Add support for SHA-HMAC key types and key generation.
  * p11sak: Add support for key wrap and unwrap commands to export and import private and secret keys by means of key wrapping/unwrapping
    with various key wrapping mechanism.
  * p11kmip: Add support for using an HSM-protected TLS client key via a PKCS#11 provider.
  * p11sak: Add support for exporting non-sensitive private keys to password protected PEM files.
  * Add support for canceling an operation via NULL mechanism pointer at C_XxxInit() call as an alternative to C_SessionCancel() (PKCS#11 v3.0).
  * EP11: Add support for pairing friendly BLS12-381 EC curve for sign/verify using CKM_IBM_ECDSA_OTHER and signature/public key aggregation using CKM_IBM_EC_AGGREGATE.
  * p11sak: Add support for generating BLS12-381 EC keys.
  * EP11: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later, and
    a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
  * CCA: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires CCA v8.4 or later).
  * Soft: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or the OQS-provider must be configured).
  * p11sak: Add support for IBM-specific ML-DSA and ML-KEM key types.
  * Bug fixes.
- Removed obsolete patches
  * ocki-3.25-remove-make-install-chgrp.patch
  * ocki-3.25-PKCSSLOTD-Remove-the-use-of-MD5.patch
- Applied a new patch for version 3.26
  * ocki-3.26-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767873600">- Modified the .spec file for Immutable Mode (jsc#PED-14798)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1768392000">- Applied a patch (bsc#1256673, CVE-2026-22791)
  * openCryptoki-CVE-2026-22791-commit-e37e912.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1769083200">- Applied a patch (bsc#1257116,  CVE-2026-23893)
  * openCryptoki-CVE-2026-23893-commit-5e6e4b4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1772366400">- Refactored .spec file to fully support transactional and immutable operating systems
  (jsc#PED-14609):
  * Migrated user and group creation (pkcs11, pkcsslotd) from imperative %pre shell commands to
    declarative systemd-sysusers configuration.
  * Replaced manual /var directory tracking and %ghost directives with
    comprehensive systemd-tmpfiles configurations.
  * Implemented dynamic, architecture-specific tmpfiles.d generation to properly provision
    hardware-specific token directories (e.g., ccatok, ep11tok, lite, and HSM_MK_CHANGE).
- Fixed permissions for /run/opencryptoki within tmpfiles.d to ensure the
  daemon can successfully drop privileges and bind its communication socket.
  * Moved 32-bit and 64-bit shared library symlink creation (such as PKCS11_API.so, stdll, and methods)
    from %post scriptlets into the %install phase,
    ensuring they are correctly packaged and tracked on the read-only /usr partition.
  * Removed legacy /etc/pkcs11 bash migration logic from %post,
    replacing it with a declarative tmpfiles.d symlink rule.
- Cleaned up scriptlets to only execute transaction-safe macros
  (such as ldconfig and systemd service handlers).</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1776686400">- Amended the .spec file (jsc#PED-14609)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1776772800">- Applied a modified patch (bsc#1262283 (CVE-2026-40253))
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1777896000">- Applied an updated patch provided by IBM (bsc#1263819 (CVE-2026-40253))
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1778846400">- Upgrade openCryptoki to version 3.27 (jsc#PED-14609)
  * Add base support for PKCS#11 v3.2.
  * Add support for PKCS#11 v3.2 C_VerifySignature[Init|Update|Final].
  * Add support for PKCS#11 v3.2 C_EncapsulateKey/C_DecapsulateKey.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with RSA-PKCS and RSA-OAEP mechanisms.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the ECDH mechanism.
  * Soft/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the DH-PKCS mechanism.
  * Soft: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or
    the OQS-provider must be configured).
  * CCA: Add support for PKCS#11 v3.2 ML-DSA key type and mechanisms (requires CCA v8.4 or later)
  * EP11: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later,
    and a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
  * p11sak: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types.
  * Soft/ICA: Add support for PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
  * p11sak: Add support for key wrapping with PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 mechanism CKM_PUB_KEY_FROM_PRIV_KEY.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.0 Edwards and Montgomery key types and mechanisms.
  * Soft/ICA: Support CKM_ECDH_AES_KEY_WRAP also for Montgomery keys.
  * p11sak: Add support for PKCS#11 v3.0 Edwards and Montgomery key types.
  * Soft: Add support for CKM_ECDH1_COFACTOR_DERIVE.
  * CCA: Add support for additional RSA public exponent values 5, 17, or 257.
  * p11sak: Add option to list-key command to show EP11 session IDs.
  * Make the maximum number of token objects supported configurable.
  * Fixes for CVE-2026-40253, CVE-2026-23893, and CVE-2026-22791.
  * Bug fixes.
- Removed obsolete patches:
  * ocki-3.26-remove-make-install-chgrp.patch
  * openCryptoki-CVE-2026-22791-commit-e37e912.patch
  * openCryptoki-CVE-2026-23893-commit-5e6e4b4.patch
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch
  Added a new patch for ver 3.27:
  * ocki-3.27-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782129600">- Updated the .spec file (bsc#126874)
  * fixed the permissions in `%{buildroot}%{_prefix}/lib/tmpfiles.d/opencryptoki.conf`</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1783944000">- Ammended the .spec file (bsc#1268745)
- Fixed pkcsslotd directory creation failures on immutable/transactional systems:
  * Added systemd service drop-in to allow dynamic token slot path creation
    (e.g., icatok_X) via ReadWritePaths.</changelog>
</package>
<package pkgid="3febced963f27ebf82217bf13fc460eb7d343199e6eba26e0b15d6419037cce442526e531c2844fff8a0b6f05158971f869cda0e1ddac1d332cf775363e7b745" name="openCryptoki-64bit" arch="s390x">
  <version epoch="0" ver="3.27.0" rel="270.3"/>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1721304000">- Amended the .spec file accorinding to the recommendation in (bsc#1225876)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1726833600">- Upgrade openCryptoki to version 3.24
  (jsc#PED-10291, jsc#PED-10290, jsc#PED-10241)
  * Add support for building Opencryptoki on the IBM AIX platform
  * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
  * Add support for protecting tokens with a token specific user group
  * EP11: Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
  * CCA: Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later
  * CCA: Add support for IBM Dilithium (CKM_IBM_DILITHIUM).
  - On Linux on IBM Z: Requires CCA v7.1 or later for Round2-65, and
    CCA v8.0 for the Round 3 variants.
  - On other platforms:
    Requires CCA v7.2.43 or later for Round2-65, the Round 3 variants are currently not supported
  * CCA: Add support for RSA-OAEP with SHA224, SHA384, and SHA512 on en-/decrypt.
  - Requires CCA v8.1 or later on Linux on IBM Z, not supported on other platforms
  * CCA: Add support for PKCS#11 v3.0 SHA3 mechanisms.
  - Requires CCA v8.1 on Linux on IBM Z, not supported on other platforms
  * ICA: Support new libica AES-GCM api using the KMA instruction on z14 and later
  * ICA/Soft/ICSF: Add support for PKCS#11 v3.0 SHA3 mechanisms
  * ICA/Soft: Add support for SHA based key derivation mechanisms
  * ICA/Soft: Add support for CKD_*_SP800 KDFs for ECDH
  * EP11/CCA/ICA/Soft: Add support for CKA_ALWAYS_AUTHENTICATE
  * EP11/CCA: Support live guest relocation for protected key (PKEY) operations
  * Soft: Experimental support for IBM Dilithium via OpenSSL OQS provider
  * ICSF: Add support for SHA-2 mechanisms
  * ICSF: Performance improvements for attribute retrieval
  * p11sak: Add support for exporting a key or certificate as URI-PEM file
  * p11sak: Import/export of IBM Dilithium keys in 'oqsprovider' format PEM files
  * p11sak: Add option to show the master key verification patterns of secure keys
  * Bug fixes
- Amended the .spec file
- Removed obsolete patch ocki-3.23-remove-make-install-chgrp.patchi
- Added a new patch ocki-3.24-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1728043200">- Amended the .spec file (jsc#PED-10241)
- Updated the %configure flags for i586
- Implemented a logic to exclude i586 arch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1732190400">- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
- Improved handling of user/group. use existing user/group if they
  exist. create user/group if not (bsc#1225876)
- Applied additional patch
  * ocki-3.24-remove-group-from-tests.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1733832000">- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
  * Changed attributes - %attr(0640,root,%{pkcs_group}) - of files below:
  - %{_sysconfdir}/opencryptoki/strength.conf
  - %{_sysconfdir}/opencryptoki/p11sak_defined_attrs.conf</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1733918400">- Moved pkcshsm_mk_change from openCryptoki-devel to openCryptoki
    (jsc#PED-10291, jsc#PED-10290)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade openCryptoki to version 3.25 (jsc#PED-3361)
  * Updates/add supports
  - ICA/Soft: Add support for PKCS#11 v3.0 SHAKE key derivation
  - EP11: Add support for PKCS#11 v3.0 SHA3 and SHA3-HMAC mechanisms
  - EP11: Add support for PKCS#11 v3.0 SHA3 mechanisms and MGFs for RSA-OAEP
  - EP11: Add support for PKCS#11 v3.0 SHA3 variants of RSA-PKCS and ECDSA mechanisms
  - CCA: Add support for CCA AES CIPHER secure key types
  - CCA: Add support for the CKM_ECDH1_DERIVE mechanism
  - Soft/ICA: Add support for the CKM_AES_KEY_WRAP[_*] mechanisms
  - CCA/Soft/ICA: Add support for the CKM_RSA_AES_KEY_WRAP mechanism
  - Soft/ICA: Add support for the CKM_ECDH_AES_KEY_WRAP mechanism
  - ICA: Report mechanisms dependent on if libica is in FIPS mode
  - P11KMIP: Add a tool for import and exporting PKCS#11 keys to a KMIP server
  - EP11: Add support for opaque secure key blob import via C_CreateObject
  - Soft/ICA: Add support for key wrapping with AES-GCM
  - CCA: Add support for newer CCA versions on s390x and non-s390x platforms
  - CCA: Add support for CKM_AES_GCM (single-part operations only)
  * Amended the .spec file
  * Removed obsolete patches:
  - ocki-3.24-remove-group-from-tests.patch
  - ocki-3.24-remove-make-install-chgrp.patch
  * Applied a new patch for version 3.25
  - ocki-3.25-remove-make-install-chgrp.patch
  * Bug fixes</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753790400">- Add riscv64 to openCryptoki_64bit_arch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1755172800">- Applied a patch (bsc#1248002)
  * ocki-3.25-PKCSSLOTD-Remove-the-use-of-MD5.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1762948800">- Upgrade openCryptoki to 3.26
  * Soft: Add support for RSA keys up to 16K bits.
  * CCA: Add support for RSA keys up to 8K bits (requires CCA v8.4 or v7.6 or later).
  * p11sak: Add support for generating RSA keys up to 16K bits.
  * Soft/ICA: Add support for SHA512/224 and SHA512/256 key derivation mechanism (CKM_SHA512_224_KEY_DERIVATION and CKM_SHA512_256_KEY_DERIVATION).
  * Soft/ICA/CCA/EP11: Add support for SHA-HMAC key types CKK_SHAxxx_HMAC and key gen mechanisms CKM_SHAxxx_KEY_GEN.
  * p11sak: Add support for SHA-HMAC key types and key generation.
  * p11sak: Add support for key wrap and unwrap commands to export and import private and secret keys by means of key wrapping/unwrapping
    with various key wrapping mechanism.
  * p11kmip: Add support for using an HSM-protected TLS client key via a PKCS#11 provider.
  * p11sak: Add support for exporting non-sensitive private keys to password protected PEM files.
  * Add support for canceling an operation via NULL mechanism pointer at C_XxxInit() call as an alternative to C_SessionCancel() (PKCS#11 v3.0).
  * EP11: Add support for pairing friendly BLS12-381 EC curve for sign/verify using CKM_IBM_ECDSA_OTHER and signature/public key aggregation using CKM_IBM_EC_AGGREGATE.
  * p11sak: Add support for generating BLS12-381 EC keys.
  * EP11: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later, and
    a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
  * CCA: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires CCA v8.4 or later).
  * Soft: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or the OQS-provider must be configured).
  * p11sak: Add support for IBM-specific ML-DSA and ML-KEM key types.
  * Bug fixes.
- Removed obsolete patches
  * ocki-3.25-remove-make-install-chgrp.patch
  * ocki-3.25-PKCSSLOTD-Remove-the-use-of-MD5.patch
- Applied a new patch for version 3.26
  * ocki-3.26-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767873600">- Modified the .spec file for Immutable Mode (jsc#PED-14798)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1768392000">- Applied a patch (bsc#1256673, CVE-2026-22791)
  * openCryptoki-CVE-2026-22791-commit-e37e912.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1769083200">- Applied a patch (bsc#1257116,  CVE-2026-23893)
  * openCryptoki-CVE-2026-23893-commit-5e6e4b4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1772366400">- Refactored .spec file to fully support transactional and immutable operating systems
  (jsc#PED-14609):
  * Migrated user and group creation (pkcs11, pkcsslotd) from imperative %pre shell commands to
    declarative systemd-sysusers configuration.
  * Replaced manual /var directory tracking and %ghost directives with
    comprehensive systemd-tmpfiles configurations.
  * Implemented dynamic, architecture-specific tmpfiles.d generation to properly provision
    hardware-specific token directories (e.g., ccatok, ep11tok, lite, and HSM_MK_CHANGE).
- Fixed permissions for /run/opencryptoki within tmpfiles.d to ensure the
  daemon can successfully drop privileges and bind its communication socket.
  * Moved 32-bit and 64-bit shared library symlink creation (such as PKCS11_API.so, stdll, and methods)
    from %post scriptlets into the %install phase,
    ensuring they are correctly packaged and tracked on the read-only /usr partition.
  * Removed legacy /etc/pkcs11 bash migration logic from %post,
    replacing it with a declarative tmpfiles.d symlink rule.
- Cleaned up scriptlets to only execute transaction-safe macros
  (such as ldconfig and systemd service handlers).</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1776686400">- Amended the .spec file (jsc#PED-14609)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1776772800">- Applied a modified patch (bsc#1262283 (CVE-2026-40253))
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1777896000">- Applied an updated patch provided by IBM (bsc#1263819 (CVE-2026-40253))
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1778846400">- Upgrade openCryptoki to version 3.27 (jsc#PED-14609)
  * Add base support for PKCS#11 v3.2.
  * Add support for PKCS#11 v3.2 C_VerifySignature[Init|Update|Final].
  * Add support for PKCS#11 v3.2 C_EncapsulateKey/C_DecapsulateKey.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with RSA-PKCS and RSA-OAEP mechanisms.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the ECDH mechanism.
  * Soft/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the DH-PKCS mechanism.
  * Soft: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or
    the OQS-provider must be configured).
  * CCA: Add support for PKCS#11 v3.2 ML-DSA key type and mechanisms (requires CCA v8.4 or later)
  * EP11: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later,
    and a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
  * p11sak: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types.
  * Soft/ICA: Add support for PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
  * p11sak: Add support for key wrapping with PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 mechanism CKM_PUB_KEY_FROM_PRIV_KEY.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.0 Edwards and Montgomery key types and mechanisms.
  * Soft/ICA: Support CKM_ECDH_AES_KEY_WRAP also for Montgomery keys.
  * p11sak: Add support for PKCS#11 v3.0 Edwards and Montgomery key types.
  * Soft: Add support for CKM_ECDH1_COFACTOR_DERIVE.
  * CCA: Add support for additional RSA public exponent values 5, 17, or 257.
  * p11sak: Add option to list-key command to show EP11 session IDs.
  * Make the maximum number of token objects supported configurable.
  * Fixes for CVE-2026-40253, CVE-2026-23893, and CVE-2026-22791.
  * Bug fixes.
- Removed obsolete patches:
  * ocki-3.26-remove-make-install-chgrp.patch
  * openCryptoki-CVE-2026-22791-commit-e37e912.patch
  * openCryptoki-CVE-2026-23893-commit-5e6e4b4.patch
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch
  Added a new patch for ver 3.27:
  * ocki-3.27-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782129600">- Updated the .spec file (bsc#126874)
  * fixed the permissions in `%{buildroot}%{_prefix}/lib/tmpfiles.d/opencryptoki.conf`</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1783944000">- Ammended the .spec file (bsc#1268745)
- Fixed pkcsslotd directory creation failures on immutable/transactional systems:
  * Added systemd service drop-in to allow dynamic token slot path creation
    (e.g., icatok_X) via ReadWritePaths.</changelog>
</package>
<package pkgid="1da0e5edfc2b99e98ecfd5b063f97749fb53eae367d54c08d859d4ea2dbaa79b0a819c74b066dad3880d943154b65a2f32d30f7c46a3c4c6715a5328f148f280" name="openCryptoki-64bit-debuginfo" arch="s390x">
  <version epoch="0" ver="3.27.0" rel="270.3"/>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1721304000">- Amended the .spec file accorinding to the recommendation in (bsc#1225876)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1726833600">- Upgrade openCryptoki to version 3.24
  (jsc#PED-10291, jsc#PED-10290, jsc#PED-10241)
  * Add support for building Opencryptoki on the IBM AIX platform
  * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
  * Add support for protecting tokens with a token specific user group
  * EP11: Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
  * CCA: Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later
  * CCA: Add support for IBM Dilithium (CKM_IBM_DILITHIUM).
  - On Linux on IBM Z: Requires CCA v7.1 or later for Round2-65, and
    CCA v8.0 for the Round 3 variants.
  - On other platforms:
    Requires CCA v7.2.43 or later for Round2-65, the Round 3 variants are currently not supported
  * CCA: Add support for RSA-OAEP with SHA224, SHA384, and SHA512 on en-/decrypt.
  - Requires CCA v8.1 or later on Linux on IBM Z, not supported on other platforms
  * CCA: Add support for PKCS#11 v3.0 SHA3 mechanisms.
  - Requires CCA v8.1 on Linux on IBM Z, not supported on other platforms
  * ICA: Support new libica AES-GCM api using the KMA instruction on z14 and later
  * ICA/Soft/ICSF: Add support for PKCS#11 v3.0 SHA3 mechanisms
  * ICA/Soft: Add support for SHA based key derivation mechanisms
  * ICA/Soft: Add support for CKD_*_SP800 KDFs for ECDH
  * EP11/CCA/ICA/Soft: Add support for CKA_ALWAYS_AUTHENTICATE
  * EP11/CCA: Support live guest relocation for protected key (PKEY) operations
  * Soft: Experimental support for IBM Dilithium via OpenSSL OQS provider
  * ICSF: Add support for SHA-2 mechanisms
  * ICSF: Performance improvements for attribute retrieval
  * p11sak: Add support for exporting a key or certificate as URI-PEM file
  * p11sak: Import/export of IBM Dilithium keys in 'oqsprovider' format PEM files
  * p11sak: Add option to show the master key verification patterns of secure keys
  * Bug fixes
- Amended the .spec file
- Removed obsolete patch ocki-3.23-remove-make-install-chgrp.patchi
- Added a new patch ocki-3.24-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1728043200">- Amended the .spec file (jsc#PED-10241)
- Updated the %configure flags for i586
- Implemented a logic to exclude i586 arch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1732190400">- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
- Improved handling of user/group. use existing user/group if they
  exist. create user/group if not (bsc#1225876)
- Applied additional patch
  * ocki-3.24-remove-group-from-tests.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1733832000">- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
  * Changed attributes - %attr(0640,root,%{pkcs_group}) - of files below:
  - %{_sysconfdir}/opencryptoki/strength.conf
  - %{_sysconfdir}/opencryptoki/p11sak_defined_attrs.conf</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1733918400">- Moved pkcshsm_mk_change from openCryptoki-devel to openCryptoki
    (jsc#PED-10291, jsc#PED-10290)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade openCryptoki to version 3.25 (jsc#PED-3361)
  * Updates/add supports
  - ICA/Soft: Add support for PKCS#11 v3.0 SHAKE key derivation
  - EP11: Add support for PKCS#11 v3.0 SHA3 and SHA3-HMAC mechanisms
  - EP11: Add support for PKCS#11 v3.0 SHA3 mechanisms and MGFs for RSA-OAEP
  - EP11: Add support for PKCS#11 v3.0 SHA3 variants of RSA-PKCS and ECDSA mechanisms
  - CCA: Add support for CCA AES CIPHER secure key types
  - CCA: Add support for the CKM_ECDH1_DERIVE mechanism
  - Soft/ICA: Add support for the CKM_AES_KEY_WRAP[_*] mechanisms
  - CCA/Soft/ICA: Add support for the CKM_RSA_AES_KEY_WRAP mechanism
  - Soft/ICA: Add support for the CKM_ECDH_AES_KEY_WRAP mechanism
  - ICA: Report mechanisms dependent on if libica is in FIPS mode
  - P11KMIP: Add a tool for import and exporting PKCS#11 keys to a KMIP server
  - EP11: Add support for opaque secure key blob import via C_CreateObject
  - Soft/ICA: Add support for key wrapping with AES-GCM
  - CCA: Add support for newer CCA versions on s390x and non-s390x platforms
  - CCA: Add support for CKM_AES_GCM (single-part operations only)
  * Amended the .spec file
  * Removed obsolete patches:
  - ocki-3.24-remove-group-from-tests.patch
  - ocki-3.24-remove-make-install-chgrp.patch
  * Applied a new patch for version 3.25
  - ocki-3.25-remove-make-install-chgrp.patch
  * Bug fixes</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753790400">- Add riscv64 to openCryptoki_64bit_arch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1755172800">- Applied a patch (bsc#1248002)
  * ocki-3.25-PKCSSLOTD-Remove-the-use-of-MD5.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1762948800">- Upgrade openCryptoki to 3.26
  * Soft: Add support for RSA keys up to 16K bits.
  * CCA: Add support for RSA keys up to 8K bits (requires CCA v8.4 or v7.6 or later).
  * p11sak: Add support for generating RSA keys up to 16K bits.
  * Soft/ICA: Add support for SHA512/224 and SHA512/256 key derivation mechanism (CKM_SHA512_224_KEY_DERIVATION and CKM_SHA512_256_KEY_DERIVATION).
  * Soft/ICA/CCA/EP11: Add support for SHA-HMAC key types CKK_SHAxxx_HMAC and key gen mechanisms CKM_SHAxxx_KEY_GEN.
  * p11sak: Add support for SHA-HMAC key types and key generation.
  * p11sak: Add support for key wrap and unwrap commands to export and import private and secret keys by means of key wrapping/unwrapping
    with various key wrapping mechanism.
  * p11kmip: Add support for using an HSM-protected TLS client key via a PKCS#11 provider.
  * p11sak: Add support for exporting non-sensitive private keys to password protected PEM files.
  * Add support for canceling an operation via NULL mechanism pointer at C_XxxInit() call as an alternative to C_SessionCancel() (PKCS#11 v3.0).
  * EP11: Add support for pairing friendly BLS12-381 EC curve for sign/verify using CKM_IBM_ECDSA_OTHER and signature/public key aggregation using CKM_IBM_EC_AGGREGATE.
  * p11sak: Add support for generating BLS12-381 EC keys.
  * EP11: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later, and
    a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
  * CCA: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires CCA v8.4 or later).
  * Soft: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or the OQS-provider must be configured).
  * p11sak: Add support for IBM-specific ML-DSA and ML-KEM key types.
  * Bug fixes.
- Removed obsolete patches
  * ocki-3.25-remove-make-install-chgrp.patch
  * ocki-3.25-PKCSSLOTD-Remove-the-use-of-MD5.patch
- Applied a new patch for version 3.26
  * ocki-3.26-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767873600">- Modified the .spec file for Immutable Mode (jsc#PED-14798)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1768392000">- Applied a patch (bsc#1256673, CVE-2026-22791)
  * openCryptoki-CVE-2026-22791-commit-e37e912.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1769083200">- Applied a patch (bsc#1257116,  CVE-2026-23893)
  * openCryptoki-CVE-2026-23893-commit-5e6e4b4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1772366400">- Refactored .spec file to fully support transactional and immutable operating systems
  (jsc#PED-14609):
  * Migrated user and group creation (pkcs11, pkcsslotd) from imperative %pre shell commands to
    declarative systemd-sysusers configuration.
  * Replaced manual /var directory tracking and %ghost directives with
    comprehensive systemd-tmpfiles configurations.
  * Implemented dynamic, architecture-specific tmpfiles.d generation to properly provision
    hardware-specific token directories (e.g., ccatok, ep11tok, lite, and HSM_MK_CHANGE).
- Fixed permissions for /run/opencryptoki within tmpfiles.d to ensure the
  daemon can successfully drop privileges and bind its communication socket.
  * Moved 32-bit and 64-bit shared library symlink creation (such as PKCS11_API.so, stdll, and methods)
    from %post scriptlets into the %install phase,
    ensuring they are correctly packaged and tracked on the read-only /usr partition.
  * Removed legacy /etc/pkcs11 bash migration logic from %post,
    replacing it with a declarative tmpfiles.d symlink rule.
- Cleaned up scriptlets to only execute transaction-safe macros
  (such as ldconfig and systemd service handlers).</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1776686400">- Amended the .spec file (jsc#PED-14609)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1776772800">- Applied a modified patch (bsc#1262283 (CVE-2026-40253))
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1777896000">- Applied an updated patch provided by IBM (bsc#1263819 (CVE-2026-40253))
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1778846400">- Upgrade openCryptoki to version 3.27 (jsc#PED-14609)
  * Add base support for PKCS#11 v3.2.
  * Add support for PKCS#11 v3.2 C_VerifySignature[Init|Update|Final].
  * Add support for PKCS#11 v3.2 C_EncapsulateKey/C_DecapsulateKey.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with RSA-PKCS and RSA-OAEP mechanisms.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the ECDH mechanism.
  * Soft/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the DH-PKCS mechanism.
  * Soft: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or
    the OQS-provider must be configured).
  * CCA: Add support for PKCS#11 v3.2 ML-DSA key type and mechanisms (requires CCA v8.4 or later)
  * EP11: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later,
    and a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
  * p11sak: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types.
  * Soft/ICA: Add support for PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
  * p11sak: Add support for key wrapping with PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 mechanism CKM_PUB_KEY_FROM_PRIV_KEY.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.0 Edwards and Montgomery key types and mechanisms.
  * Soft/ICA: Support CKM_ECDH_AES_KEY_WRAP also for Montgomery keys.
  * p11sak: Add support for PKCS#11 v3.0 Edwards and Montgomery key types.
  * Soft: Add support for CKM_ECDH1_COFACTOR_DERIVE.
  * CCA: Add support for additional RSA public exponent values 5, 17, or 257.
  * p11sak: Add option to list-key command to show EP11 session IDs.
  * Make the maximum number of token objects supported configurable.
  * Fixes for CVE-2026-40253, CVE-2026-23893, and CVE-2026-22791.
  * Bug fixes.
- Removed obsolete patches:
  * ocki-3.26-remove-make-install-chgrp.patch
  * openCryptoki-CVE-2026-22791-commit-e37e912.patch
  * openCryptoki-CVE-2026-23893-commit-5e6e4b4.patch
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch
  Added a new patch for ver 3.27:
  * ocki-3.27-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782129600">- Updated the .spec file (bsc#126874)
  * fixed the permissions in `%{buildroot}%{_prefix}/lib/tmpfiles.d/opencryptoki.conf`</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1783944000">- Ammended the .spec file (bsc#1268745)
- Fixed pkcsslotd directory creation failures on immutable/transactional systems:
  * Added systemd service drop-in to allow dynamic token slot path creation
    (e.g., icatok_X) via ReadWritePaths.</changelog>
</package>
<package pkgid="f747fb5ca4d7f0e3498f26e537cc415d39be1c425eb1a0b162d65edaecff915f908e2e2ea76e4f4e830e2c0ff8707a1b3b5d6c1fa7a00a97b83a35a32ef5380e" name="openCryptoki-debuginfo" arch="s390x">
  <version epoch="0" ver="3.27.0" rel="270.3"/>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1721304000">- Amended the .spec file accorinding to the recommendation in (bsc#1225876)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1726833600">- Upgrade openCryptoki to version 3.24
  (jsc#PED-10291, jsc#PED-10290, jsc#PED-10241)
  * Add support for building Opencryptoki on the IBM AIX platform
  * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
  * Add support for protecting tokens with a token specific user group
  * EP11: Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
  * CCA: Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later
  * CCA: Add support for IBM Dilithium (CKM_IBM_DILITHIUM).
  - On Linux on IBM Z: Requires CCA v7.1 or later for Round2-65, and
    CCA v8.0 for the Round 3 variants.
  - On other platforms:
    Requires CCA v7.2.43 or later for Round2-65, the Round 3 variants are currently not supported
  * CCA: Add support for RSA-OAEP with SHA224, SHA384, and SHA512 on en-/decrypt.
  - Requires CCA v8.1 or later on Linux on IBM Z, not supported on other platforms
  * CCA: Add support for PKCS#11 v3.0 SHA3 mechanisms.
  - Requires CCA v8.1 on Linux on IBM Z, not supported on other platforms
  * ICA: Support new libica AES-GCM api using the KMA instruction on z14 and later
  * ICA/Soft/ICSF: Add support for PKCS#11 v3.0 SHA3 mechanisms
  * ICA/Soft: Add support for SHA based key derivation mechanisms
  * ICA/Soft: Add support for CKD_*_SP800 KDFs for ECDH
  * EP11/CCA/ICA/Soft: Add support for CKA_ALWAYS_AUTHENTICATE
  * EP11/CCA: Support live guest relocation for protected key (PKEY) operations
  * Soft: Experimental support for IBM Dilithium via OpenSSL OQS provider
  * ICSF: Add support for SHA-2 mechanisms
  * ICSF: Performance improvements for attribute retrieval
  * p11sak: Add support for exporting a key or certificate as URI-PEM file
  * p11sak: Import/export of IBM Dilithium keys in 'oqsprovider' format PEM files
  * p11sak: Add option to show the master key verification patterns of secure keys
  * Bug fixes
- Amended the .spec file
- Removed obsolete patch ocki-3.23-remove-make-install-chgrp.patchi
- Added a new patch ocki-3.24-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1728043200">- Amended the .spec file (jsc#PED-10241)
- Updated the %configure flags for i586
- Implemented a logic to exclude i586 arch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1732190400">- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
- Improved handling of user/group. use existing user/group if they
  exist. create user/group if not (bsc#1225876)
- Applied additional patch
  * ocki-3.24-remove-group-from-tests.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1733832000">- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
  * Changed attributes - %attr(0640,root,%{pkcs_group}) - of files below:
  - %{_sysconfdir}/opencryptoki/strength.conf
  - %{_sysconfdir}/opencryptoki/p11sak_defined_attrs.conf</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1733918400">- Moved pkcshsm_mk_change from openCryptoki-devel to openCryptoki
    (jsc#PED-10291, jsc#PED-10290)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade openCryptoki to version 3.25 (jsc#PED-3361)
  * Updates/add supports
  - ICA/Soft: Add support for PKCS#11 v3.0 SHAKE key derivation
  - EP11: Add support for PKCS#11 v3.0 SHA3 and SHA3-HMAC mechanisms
  - EP11: Add support for PKCS#11 v3.0 SHA3 mechanisms and MGFs for RSA-OAEP
  - EP11: Add support for PKCS#11 v3.0 SHA3 variants of RSA-PKCS and ECDSA mechanisms
  - CCA: Add support for CCA AES CIPHER secure key types
  - CCA: Add support for the CKM_ECDH1_DERIVE mechanism
  - Soft/ICA: Add support for the CKM_AES_KEY_WRAP[_*] mechanisms
  - CCA/Soft/ICA: Add support for the CKM_RSA_AES_KEY_WRAP mechanism
  - Soft/ICA: Add support for the CKM_ECDH_AES_KEY_WRAP mechanism
  - ICA: Report mechanisms dependent on if libica is in FIPS mode
  - P11KMIP: Add a tool for import and exporting PKCS#11 keys to a KMIP server
  - EP11: Add support for opaque secure key blob import via C_CreateObject
  - Soft/ICA: Add support for key wrapping with AES-GCM
  - CCA: Add support for newer CCA versions on s390x and non-s390x platforms
  - CCA: Add support for CKM_AES_GCM (single-part operations only)
  * Amended the .spec file
  * Removed obsolete patches:
  - ocki-3.24-remove-group-from-tests.patch
  - ocki-3.24-remove-make-install-chgrp.patch
  * Applied a new patch for version 3.25
  - ocki-3.25-remove-make-install-chgrp.patch
  * Bug fixes</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753790400">- Add riscv64 to openCryptoki_64bit_arch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1755172800">- Applied a patch (bsc#1248002)
  * ocki-3.25-PKCSSLOTD-Remove-the-use-of-MD5.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1762948800">- Upgrade openCryptoki to 3.26
  * Soft: Add support for RSA keys up to 16K bits.
  * CCA: Add support for RSA keys up to 8K bits (requires CCA v8.4 or v7.6 or later).
  * p11sak: Add support for generating RSA keys up to 16K bits.
  * Soft/ICA: Add support for SHA512/224 and SHA512/256 key derivation mechanism (CKM_SHA512_224_KEY_DERIVATION and CKM_SHA512_256_KEY_DERIVATION).
  * Soft/ICA/CCA/EP11: Add support for SHA-HMAC key types CKK_SHAxxx_HMAC and key gen mechanisms CKM_SHAxxx_KEY_GEN.
  * p11sak: Add support for SHA-HMAC key types and key generation.
  * p11sak: Add support for key wrap and unwrap commands to export and import private and secret keys by means of key wrapping/unwrapping
    with various key wrapping mechanism.
  * p11kmip: Add support for using an HSM-protected TLS client key via a PKCS#11 provider.
  * p11sak: Add support for exporting non-sensitive private keys to password protected PEM files.
  * Add support for canceling an operation via NULL mechanism pointer at C_XxxInit() call as an alternative to C_SessionCancel() (PKCS#11 v3.0).
  * EP11: Add support for pairing friendly BLS12-381 EC curve for sign/verify using CKM_IBM_ECDSA_OTHER and signature/public key aggregation using CKM_IBM_EC_AGGREGATE.
  * p11sak: Add support for generating BLS12-381 EC keys.
  * EP11: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later, and
    a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
  * CCA: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires CCA v8.4 or later).
  * Soft: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or the OQS-provider must be configured).
  * p11sak: Add support for IBM-specific ML-DSA and ML-KEM key types.
  * Bug fixes.
- Removed obsolete patches
  * ocki-3.25-remove-make-install-chgrp.patch
  * ocki-3.25-PKCSSLOTD-Remove-the-use-of-MD5.patch
- Applied a new patch for version 3.26
  * ocki-3.26-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767873600">- Modified the .spec file for Immutable Mode (jsc#PED-14798)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1768392000">- Applied a patch (bsc#1256673, CVE-2026-22791)
  * openCryptoki-CVE-2026-22791-commit-e37e912.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1769083200">- Applied a patch (bsc#1257116,  CVE-2026-23893)
  * openCryptoki-CVE-2026-23893-commit-5e6e4b4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1772366400">- Refactored .spec file to fully support transactional and immutable operating systems
  (jsc#PED-14609):
  * Migrated user and group creation (pkcs11, pkcsslotd) from imperative %pre shell commands to
    declarative systemd-sysusers configuration.
  * Replaced manual /var directory tracking and %ghost directives with
    comprehensive systemd-tmpfiles configurations.
  * Implemented dynamic, architecture-specific tmpfiles.d generation to properly provision
    hardware-specific token directories (e.g., ccatok, ep11tok, lite, and HSM_MK_CHANGE).
- Fixed permissions for /run/opencryptoki within tmpfiles.d to ensure the
  daemon can successfully drop privileges and bind its communication socket.
  * Moved 32-bit and 64-bit shared library symlink creation (such as PKCS11_API.so, stdll, and methods)
    from %post scriptlets into the %install phase,
    ensuring they are correctly packaged and tracked on the read-only /usr partition.
  * Removed legacy /etc/pkcs11 bash migration logic from %post,
    replacing it with a declarative tmpfiles.d symlink rule.
- Cleaned up scriptlets to only execute transaction-safe macros
  (such as ldconfig and systemd service handlers).</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1776686400">- Amended the .spec file (jsc#PED-14609)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1776772800">- Applied a modified patch (bsc#1262283 (CVE-2026-40253))
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1777896000">- Applied an updated patch provided by IBM (bsc#1263819 (CVE-2026-40253))
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1778846400">- Upgrade openCryptoki to version 3.27 (jsc#PED-14609)
  * Add base support for PKCS#11 v3.2.
  * Add support for PKCS#11 v3.2 C_VerifySignature[Init|Update|Final].
  * Add support for PKCS#11 v3.2 C_EncapsulateKey/C_DecapsulateKey.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with RSA-PKCS and RSA-OAEP mechanisms.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the ECDH mechanism.
  * Soft/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the DH-PKCS mechanism.
  * Soft: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or
    the OQS-provider must be configured).
  * CCA: Add support for PKCS#11 v3.2 ML-DSA key type and mechanisms (requires CCA v8.4 or later)
  * EP11: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later,
    and a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
  * p11sak: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types.
  * Soft/ICA: Add support for PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
  * p11sak: Add support for key wrapping with PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 mechanism CKM_PUB_KEY_FROM_PRIV_KEY.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.0 Edwards and Montgomery key types and mechanisms.
  * Soft/ICA: Support CKM_ECDH_AES_KEY_WRAP also for Montgomery keys.
  * p11sak: Add support for PKCS#11 v3.0 Edwards and Montgomery key types.
  * Soft: Add support for CKM_ECDH1_COFACTOR_DERIVE.
  * CCA: Add support for additional RSA public exponent values 5, 17, or 257.
  * p11sak: Add option to list-key command to show EP11 session IDs.
  * Make the maximum number of token objects supported configurable.
  * Fixes for CVE-2026-40253, CVE-2026-23893, and CVE-2026-22791.
  * Bug fixes.
- Removed obsolete patches:
  * ocki-3.26-remove-make-install-chgrp.patch
  * openCryptoki-CVE-2026-22791-commit-e37e912.patch
  * openCryptoki-CVE-2026-23893-commit-5e6e4b4.patch
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch
  Added a new patch for ver 3.27:
  * ocki-3.27-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782129600">- Updated the .spec file (bsc#126874)
  * fixed the permissions in `%{buildroot}%{_prefix}/lib/tmpfiles.d/opencryptoki.conf`</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1783944000">- Ammended the .spec file (bsc#1268745)
- Fixed pkcsslotd directory creation failures on immutable/transactional systems:
  * Added systemd service drop-in to allow dynamic token slot path creation
    (e.g., icatok_X) via ReadWritePaths.</changelog>
</package>
<package pkgid="f2c0c9c52e9ea4c93e9114aa19ba2f98438fbde42e92326ab3750e8d3686fc65d7b683b57495c8323e37534728c8cb0b4def96d6f67e3de404904742ddc09a26" name="openCryptoki-debugsource" arch="s390x">
  <version epoch="0" ver="3.27.0" rel="270.3"/>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1721304000">- Amended the .spec file accorinding to the recommendation in (bsc#1225876)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1726833600">- Upgrade openCryptoki to version 3.24
  (jsc#PED-10291, jsc#PED-10290, jsc#PED-10241)
  * Add support for building Opencryptoki on the IBM AIX platform
  * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
  * Add support for protecting tokens with a token specific user group
  * EP11: Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
  * CCA: Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later
  * CCA: Add support for IBM Dilithium (CKM_IBM_DILITHIUM).
  - On Linux on IBM Z: Requires CCA v7.1 or later for Round2-65, and
    CCA v8.0 for the Round 3 variants.
  - On other platforms:
    Requires CCA v7.2.43 or later for Round2-65, the Round 3 variants are currently not supported
  * CCA: Add support for RSA-OAEP with SHA224, SHA384, and SHA512 on en-/decrypt.
  - Requires CCA v8.1 or later on Linux on IBM Z, not supported on other platforms
  * CCA: Add support for PKCS#11 v3.0 SHA3 mechanisms.
  - Requires CCA v8.1 on Linux on IBM Z, not supported on other platforms
  * ICA: Support new libica AES-GCM api using the KMA instruction on z14 and later
  * ICA/Soft/ICSF: Add support for PKCS#11 v3.0 SHA3 mechanisms
  * ICA/Soft: Add support for SHA based key derivation mechanisms
  * ICA/Soft: Add support for CKD_*_SP800 KDFs for ECDH
  * EP11/CCA/ICA/Soft: Add support for CKA_ALWAYS_AUTHENTICATE
  * EP11/CCA: Support live guest relocation for protected key (PKEY) operations
  * Soft: Experimental support for IBM Dilithium via OpenSSL OQS provider
  * ICSF: Add support for SHA-2 mechanisms
  * ICSF: Performance improvements for attribute retrieval
  * p11sak: Add support for exporting a key or certificate as URI-PEM file
  * p11sak: Import/export of IBM Dilithium keys in 'oqsprovider' format PEM files
  * p11sak: Add option to show the master key verification patterns of secure keys
  * Bug fixes
- Amended the .spec file
- Removed obsolete patch ocki-3.23-remove-make-install-chgrp.patchi
- Added a new patch ocki-3.24-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1728043200">- Amended the .spec file (jsc#PED-10241)
- Updated the %configure flags for i586
- Implemented a logic to exclude i586 arch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1732190400">- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
- Improved handling of user/group. use existing user/group if they
  exist. create user/group if not (bsc#1225876)
- Applied additional patch
  * ocki-3.24-remove-group-from-tests.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1733832000">- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
  * Changed attributes - %attr(0640,root,%{pkcs_group}) - of files below:
  - %{_sysconfdir}/opencryptoki/strength.conf
  - %{_sysconfdir}/opencryptoki/p11sak_defined_attrs.conf</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1733918400">- Moved pkcshsm_mk_change from openCryptoki-devel to openCryptoki
    (jsc#PED-10291, jsc#PED-10290)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade openCryptoki to version 3.25 (jsc#PED-3361)
  * Updates/add supports
  - ICA/Soft: Add support for PKCS#11 v3.0 SHAKE key derivation
  - EP11: Add support for PKCS#11 v3.0 SHA3 and SHA3-HMAC mechanisms
  - EP11: Add support for PKCS#11 v3.0 SHA3 mechanisms and MGFs for RSA-OAEP
  - EP11: Add support for PKCS#11 v3.0 SHA3 variants of RSA-PKCS and ECDSA mechanisms
  - CCA: Add support for CCA AES CIPHER secure key types
  - CCA: Add support for the CKM_ECDH1_DERIVE mechanism
  - Soft/ICA: Add support for the CKM_AES_KEY_WRAP[_*] mechanisms
  - CCA/Soft/ICA: Add support for the CKM_RSA_AES_KEY_WRAP mechanism
  - Soft/ICA: Add support for the CKM_ECDH_AES_KEY_WRAP mechanism
  - ICA: Report mechanisms dependent on if libica is in FIPS mode
  - P11KMIP: Add a tool for import and exporting PKCS#11 keys to a KMIP server
  - EP11: Add support for opaque secure key blob import via C_CreateObject
  - Soft/ICA: Add support for key wrapping with AES-GCM
  - CCA: Add support for newer CCA versions on s390x and non-s390x platforms
  - CCA: Add support for CKM_AES_GCM (single-part operations only)
  * Amended the .spec file
  * Removed obsolete patches:
  - ocki-3.24-remove-group-from-tests.patch
  - ocki-3.24-remove-make-install-chgrp.patch
  * Applied a new patch for version 3.25
  - ocki-3.25-remove-make-install-chgrp.patch
  * Bug fixes</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753790400">- Add riscv64 to openCryptoki_64bit_arch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1755172800">- Applied a patch (bsc#1248002)
  * ocki-3.25-PKCSSLOTD-Remove-the-use-of-MD5.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1762948800">- Upgrade openCryptoki to 3.26
  * Soft: Add support for RSA keys up to 16K bits.
  * CCA: Add support for RSA keys up to 8K bits (requires CCA v8.4 or v7.6 or later).
  * p11sak: Add support for generating RSA keys up to 16K bits.
  * Soft/ICA: Add support for SHA512/224 and SHA512/256 key derivation mechanism (CKM_SHA512_224_KEY_DERIVATION and CKM_SHA512_256_KEY_DERIVATION).
  * Soft/ICA/CCA/EP11: Add support for SHA-HMAC key types CKK_SHAxxx_HMAC and key gen mechanisms CKM_SHAxxx_KEY_GEN.
  * p11sak: Add support for SHA-HMAC key types and key generation.
  * p11sak: Add support for key wrap and unwrap commands to export and import private and secret keys by means of key wrapping/unwrapping
    with various key wrapping mechanism.
  * p11kmip: Add support for using an HSM-protected TLS client key via a PKCS#11 provider.
  * p11sak: Add support for exporting non-sensitive private keys to password protected PEM files.
  * Add support for canceling an operation via NULL mechanism pointer at C_XxxInit() call as an alternative to C_SessionCancel() (PKCS#11 v3.0).
  * EP11: Add support for pairing friendly BLS12-381 EC curve for sign/verify using CKM_IBM_ECDSA_OTHER and signature/public key aggregation using CKM_IBM_EC_AGGREGATE.
  * p11sak: Add support for generating BLS12-381 EC keys.
  * EP11: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later, and
    a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
  * CCA: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires CCA v8.4 or later).
  * Soft: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or the OQS-provider must be configured).
  * p11sak: Add support for IBM-specific ML-DSA and ML-KEM key types.
  * Bug fixes.
- Removed obsolete patches
  * ocki-3.25-remove-make-install-chgrp.patch
  * ocki-3.25-PKCSSLOTD-Remove-the-use-of-MD5.patch
- Applied a new patch for version 3.26
  * ocki-3.26-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767873600">- Modified the .spec file for Immutable Mode (jsc#PED-14798)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1768392000">- Applied a patch (bsc#1256673, CVE-2026-22791)
  * openCryptoki-CVE-2026-22791-commit-e37e912.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1769083200">- Applied a patch (bsc#1257116,  CVE-2026-23893)
  * openCryptoki-CVE-2026-23893-commit-5e6e4b4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1772366400">- Refactored .spec file to fully support transactional and immutable operating systems
  (jsc#PED-14609):
  * Migrated user and group creation (pkcs11, pkcsslotd) from imperative %pre shell commands to
    declarative systemd-sysusers configuration.
  * Replaced manual /var directory tracking and %ghost directives with
    comprehensive systemd-tmpfiles configurations.
  * Implemented dynamic, architecture-specific tmpfiles.d generation to properly provision
    hardware-specific token directories (e.g., ccatok, ep11tok, lite, and HSM_MK_CHANGE).
- Fixed permissions for /run/opencryptoki within tmpfiles.d to ensure the
  daemon can successfully drop privileges and bind its communication socket.
  * Moved 32-bit and 64-bit shared library symlink creation (such as PKCS11_API.so, stdll, and methods)
    from %post scriptlets into the %install phase,
    ensuring they are correctly packaged and tracked on the read-only /usr partition.
  * Removed legacy /etc/pkcs11 bash migration logic from %post,
    replacing it with a declarative tmpfiles.d symlink rule.
- Cleaned up scriptlets to only execute transaction-safe macros
  (such as ldconfig and systemd service handlers).</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1776686400">- Amended the .spec file (jsc#PED-14609)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1776772800">- Applied a modified patch (bsc#1262283 (CVE-2026-40253))
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1777896000">- Applied an updated patch provided by IBM (bsc#1263819 (CVE-2026-40253))
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1778846400">- Upgrade openCryptoki to version 3.27 (jsc#PED-14609)
  * Add base support for PKCS#11 v3.2.
  * Add support for PKCS#11 v3.2 C_VerifySignature[Init|Update|Final].
  * Add support for PKCS#11 v3.2 C_EncapsulateKey/C_DecapsulateKey.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with RSA-PKCS and RSA-OAEP mechanisms.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the ECDH mechanism.
  * Soft/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the DH-PKCS mechanism.
  * Soft: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or
    the OQS-provider must be configured).
  * CCA: Add support for PKCS#11 v3.2 ML-DSA key type and mechanisms (requires CCA v8.4 or later)
  * EP11: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later,
    and a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
  * p11sak: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types.
  * Soft/ICA: Add support for PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
  * p11sak: Add support for key wrapping with PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 mechanism CKM_PUB_KEY_FROM_PRIV_KEY.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.0 Edwards and Montgomery key types and mechanisms.
  * Soft/ICA: Support CKM_ECDH_AES_KEY_WRAP also for Montgomery keys.
  * p11sak: Add support for PKCS#11 v3.0 Edwards and Montgomery key types.
  * Soft: Add support for CKM_ECDH1_COFACTOR_DERIVE.
  * CCA: Add support for additional RSA public exponent values 5, 17, or 257.
  * p11sak: Add option to list-key command to show EP11 session IDs.
  * Make the maximum number of token objects supported configurable.
  * Fixes for CVE-2026-40253, CVE-2026-23893, and CVE-2026-22791.
  * Bug fixes.
- Removed obsolete patches:
  * ocki-3.26-remove-make-install-chgrp.patch
  * openCryptoki-CVE-2026-22791-commit-e37e912.patch
  * openCryptoki-CVE-2026-23893-commit-5e6e4b4.patch
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch
  Added a new patch for ver 3.27:
  * ocki-3.27-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782129600">- Updated the .spec file (bsc#126874)
  * fixed the permissions in `%{buildroot}%{_prefix}/lib/tmpfiles.d/opencryptoki.conf`</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1783944000">- Ammended the .spec file (bsc#1268745)
- Fixed pkcsslotd directory creation failures on immutable/transactional systems:
  * Added systemd service drop-in to allow dynamic token slot path creation
    (e.g., icatok_X) via ReadWritePaths.</changelog>
</package>
<package pkgid="735bb01a41a0c5c98b9af06f693a00a2d80ef2d4c6edc4b316c8a8730fa19d2d98680bc6794937c7eefa5a9cafc27a5bc2bd5dcafd223162884bcdce0cd7f2b5" name="openCryptoki-devel" arch="s390x">
  <version epoch="0" ver="3.27.0" rel="270.3"/>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1721304000">- Amended the .spec file accorinding to the recommendation in (bsc#1225876)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1726833600">- Upgrade openCryptoki to version 3.24
  (jsc#PED-10291, jsc#PED-10290, jsc#PED-10241)
  * Add support for building Opencryptoki on the IBM AIX platform
  * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
  * Add support for protecting tokens with a token specific user group
  * EP11: Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
  * CCA: Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later
  * CCA: Add support for IBM Dilithium (CKM_IBM_DILITHIUM).
  - On Linux on IBM Z: Requires CCA v7.1 or later for Round2-65, and
    CCA v8.0 for the Round 3 variants.
  - On other platforms:
    Requires CCA v7.2.43 or later for Round2-65, the Round 3 variants are currently not supported
  * CCA: Add support for RSA-OAEP with SHA224, SHA384, and SHA512 on en-/decrypt.
  - Requires CCA v8.1 or later on Linux on IBM Z, not supported on other platforms
  * CCA: Add support for PKCS#11 v3.0 SHA3 mechanisms.
  - Requires CCA v8.1 on Linux on IBM Z, not supported on other platforms
  * ICA: Support new libica AES-GCM api using the KMA instruction on z14 and later
  * ICA/Soft/ICSF: Add support for PKCS#11 v3.0 SHA3 mechanisms
  * ICA/Soft: Add support for SHA based key derivation mechanisms
  * ICA/Soft: Add support for CKD_*_SP800 KDFs for ECDH
  * EP11/CCA/ICA/Soft: Add support for CKA_ALWAYS_AUTHENTICATE
  * EP11/CCA: Support live guest relocation for protected key (PKEY) operations
  * Soft: Experimental support for IBM Dilithium via OpenSSL OQS provider
  * ICSF: Add support for SHA-2 mechanisms
  * ICSF: Performance improvements for attribute retrieval
  * p11sak: Add support for exporting a key or certificate as URI-PEM file
  * p11sak: Import/export of IBM Dilithium keys in 'oqsprovider' format PEM files
  * p11sak: Add option to show the master key verification patterns of secure keys
  * Bug fixes
- Amended the .spec file
- Removed obsolete patch ocki-3.23-remove-make-install-chgrp.patchi
- Added a new patch ocki-3.24-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1728043200">- Amended the .spec file (jsc#PED-10241)
- Updated the %configure flags for i586
- Implemented a logic to exclude i586 arch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1732190400">- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
- Improved handling of user/group. use existing user/group if they
  exist. create user/group if not (bsc#1225876)
- Applied additional patch
  * ocki-3.24-remove-group-from-tests.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1733832000">- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
  * Changed attributes - %attr(0640,root,%{pkcs_group}) - of files below:
  - %{_sysconfdir}/opencryptoki/strength.conf
  - %{_sysconfdir}/opencryptoki/p11sak_defined_attrs.conf</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1733918400">- Moved pkcshsm_mk_change from openCryptoki-devel to openCryptoki
    (jsc#PED-10291, jsc#PED-10290)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1750075200">- Upgrade openCryptoki to version 3.25 (jsc#PED-3361)
  * Updates/add supports
  - ICA/Soft: Add support for PKCS#11 v3.0 SHAKE key derivation
  - EP11: Add support for PKCS#11 v3.0 SHA3 and SHA3-HMAC mechanisms
  - EP11: Add support for PKCS#11 v3.0 SHA3 mechanisms and MGFs for RSA-OAEP
  - EP11: Add support for PKCS#11 v3.0 SHA3 variants of RSA-PKCS and ECDSA mechanisms
  - CCA: Add support for CCA AES CIPHER secure key types
  - CCA: Add support for the CKM_ECDH1_DERIVE mechanism
  - Soft/ICA: Add support for the CKM_AES_KEY_WRAP[_*] mechanisms
  - CCA/Soft/ICA: Add support for the CKM_RSA_AES_KEY_WRAP mechanism
  - Soft/ICA: Add support for the CKM_ECDH_AES_KEY_WRAP mechanism
  - ICA: Report mechanisms dependent on if libica is in FIPS mode
  - P11KMIP: Add a tool for import and exporting PKCS#11 keys to a KMIP server
  - EP11: Add support for opaque secure key blob import via C_CreateObject
  - Soft/ICA: Add support for key wrapping with AES-GCM
  - CCA: Add support for newer CCA versions on s390x and non-s390x platforms
  - CCA: Add support for CKM_AES_GCM (single-part operations only)
  * Amended the .spec file
  * Removed obsolete patches:
  - ocki-3.24-remove-group-from-tests.patch
  - ocki-3.24-remove-make-install-chgrp.patch
  * Applied a new patch for version 3.25
  - ocki-3.25-remove-make-install-chgrp.patch
  * Bug fixes</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1753790400">- Add riscv64 to openCryptoki_64bit_arch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1755172800">- Applied a patch (bsc#1248002)
  * ocki-3.25-PKCSSLOTD-Remove-the-use-of-MD5.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1762948800">- Upgrade openCryptoki to 3.26
  * Soft: Add support for RSA keys up to 16K bits.
  * CCA: Add support for RSA keys up to 8K bits (requires CCA v8.4 or v7.6 or later).
  * p11sak: Add support for generating RSA keys up to 16K bits.
  * Soft/ICA: Add support for SHA512/224 and SHA512/256 key derivation mechanism (CKM_SHA512_224_KEY_DERIVATION and CKM_SHA512_256_KEY_DERIVATION).
  * Soft/ICA/CCA/EP11: Add support for SHA-HMAC key types CKK_SHAxxx_HMAC and key gen mechanisms CKM_SHAxxx_KEY_GEN.
  * p11sak: Add support for SHA-HMAC key types and key generation.
  * p11sak: Add support for key wrap and unwrap commands to export and import private and secret keys by means of key wrapping/unwrapping
    with various key wrapping mechanism.
  * p11kmip: Add support for using an HSM-protected TLS client key via a PKCS#11 provider.
  * p11sak: Add support for exporting non-sensitive private keys to password protected PEM files.
  * Add support for canceling an operation via NULL mechanism pointer at C_XxxInit() call as an alternative to C_SessionCancel() (PKCS#11 v3.0).
  * EP11: Add support for pairing friendly BLS12-381 EC curve for sign/verify using CKM_IBM_ECDSA_OTHER and signature/public key aggregation using CKM_IBM_EC_AGGREGATE.
  * p11sak: Add support for generating BLS12-381 EC keys.
  * EP11: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later, and
    a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
  * CCA: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires CCA v8.4 or later).
  * Soft: Add support for IBM-specific ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or the OQS-provider must be configured).
  * p11sak: Add support for IBM-specific ML-DSA and ML-KEM key types.
  * Bug fixes.
- Removed obsolete patches
  * ocki-3.25-remove-make-install-chgrp.patch
  * ocki-3.25-PKCSSLOTD-Remove-the-use-of-MD5.patch
- Applied a new patch for version 3.26
  * ocki-3.26-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1767873600">- Modified the .spec file for Immutable Mode (jsc#PED-14798)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1768392000">- Applied a patch (bsc#1256673, CVE-2026-22791)
  * openCryptoki-CVE-2026-22791-commit-e37e912.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1769083200">- Applied a patch (bsc#1257116,  CVE-2026-23893)
  * openCryptoki-CVE-2026-23893-commit-5e6e4b4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1772366400">- Refactored .spec file to fully support transactional and immutable operating systems
  (jsc#PED-14609):
  * Migrated user and group creation (pkcs11, pkcsslotd) from imperative %pre shell commands to
    declarative systemd-sysusers configuration.
  * Replaced manual /var directory tracking and %ghost directives with
    comprehensive systemd-tmpfiles configurations.
  * Implemented dynamic, architecture-specific tmpfiles.d generation to properly provision
    hardware-specific token directories (e.g., ccatok, ep11tok, lite, and HSM_MK_CHANGE).
- Fixed permissions for /run/opencryptoki within tmpfiles.d to ensure the
  daemon can successfully drop privileges and bind its communication socket.
  * Moved 32-bit and 64-bit shared library symlink creation (such as PKCS11_API.so, stdll, and methods)
    from %post scriptlets into the %install phase,
    ensuring they are correctly packaged and tracked on the read-only /usr partition.
  * Removed legacy /etc/pkcs11 bash migration logic from %post,
    replacing it with a declarative tmpfiles.d symlink rule.
- Cleaned up scriptlets to only execute transaction-safe macros
  (such as ldconfig and systemd service handlers).</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1776686400">- Amended the .spec file (jsc#PED-14609)</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1776772800">- Applied a modified patch (bsc#1262283 (CVE-2026-40253))
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1777896000">- Applied an updated patch provided by IBM (bsc#1263819 (CVE-2026-40253))
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1778846400">- Upgrade openCryptoki to version 3.27 (jsc#PED-14609)
  * Add base support for PKCS#11 v3.2.
  * Add support for PKCS#11 v3.2 C_VerifySignature[Init|Update|Final].
  * Add support for PKCS#11 v3.2 C_EncapsulateKey/C_DecapsulateKey.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with RSA-PKCS and RSA-OAEP mechanisms.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the ECDH mechanism.
  * Soft/EP11: Add support for PKCS#11 v3.2 en-/decapsulate with the DH-PKCS mechanism.
  * Soft: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires OpenSSL 3.5 or later, or
    the OQS-provider must be configured).
  * CCA: Add support for PKCS#11 v3.2 ML-DSA key type and mechanisms (requires CCA v8.4 or later)
  * EP11: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types and mechanisms (requires an EP11 host library v4.2 or later,
    and a CEX8P crypto card with firmware v9.6 or later on IBM z17, and v8.39 or later on IBM z16).
  * p11sak: Add support for PKCS#11 v3.2 ML-DSA and ML-KEM key types.
  * Soft/ICA: Add support for PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
  * p11sak: Add support for key wrapping with PKCS#11 v3.2 mechanisms CKM_ECDH_X_AES_KEY_WRAP and CKM_ECDH_COF_AES_KEY_WRAP.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.2 mechanism CKM_PUB_KEY_FROM_PRIV_KEY.
  * Soft/ICA/CCA/EP11: Add support for PKCS#11 v3.0 Edwards and Montgomery key types and mechanisms.
  * Soft/ICA: Support CKM_ECDH_AES_KEY_WRAP also for Montgomery keys.
  * p11sak: Add support for PKCS#11 v3.0 Edwards and Montgomery key types.
  * Soft: Add support for CKM_ECDH1_COFACTOR_DERIVE.
  * CCA: Add support for additional RSA public exponent values 5, 17, or 257.
  * p11sak: Add option to list-key command to show EP11 session IDs.
  * Make the maximum number of token objects supported configurable.
  * Fixes for CVE-2026-40253, CVE-2026-23893, and CVE-2026-22791.
  * Bug fixes.
- Removed obsolete patches:
  * ocki-3.26-remove-make-install-chgrp.patch
  * openCryptoki-CVE-2026-22791-commit-e37e912.patch
  * openCryptoki-CVE-2026-23893-commit-5e6e4b4.patch
  * openCryptoki-CVE-2026-40253-commit-ed378f4.patch
  Added a new patch for ver 3.27:
  * ocki-3.27-remove-make-install-chgrp.patch</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1782129600">- Updated the .spec file (bsc#126874)
  * fixed the permissions in `%{buildroot}%{_prefix}/lib/tmpfiles.d/opencryptoki.conf`</changelog>
  <changelog author="Nikolay Gueorguiev &lt;nikolay.gueorguiev@suse.com&gt;" date="1783944000">- Ammended the .spec file (bsc#1268745)
- Fixed pkcsslotd directory creation failures on immutable/transactional systems:
  * Added systemd service drop-in to allow dynamic token slot path creation
    (e.g., icatok_X) via ReadWritePaths.</changelog>
</package>
<package pkgid="81a46e1511c0a73c1a851bce2f0d2255d0ba744840add80694eece344c4fc87f0ecb975c9cf3573e7fec602379f22092ae383beded1141641dbb8b97a9488728" name="openbao" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="c82c5a4110b071a8c76d7c51b13a0d6769d92dc1dd29ed3758edf4738a606cf066ed93e935c739385d8334e8963fe9c583515a4b1a1bd7e73c5baa73b9253d61" name="openbao" arch="src">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="6ba29e39284732a1a345c1e4dff7290b2a12aa2047340b22e5f9c12722add674bae6228541fecded9b73f537f5220fa1175b9af3873101d729ec47819b00c43c" name="openbao-agent" arch="noarch">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="1238f337177e9d876f259d95439f944fb7d39162311055bdfedd732fe8aa8c0f898aa058f12fdf3ef3cfd4239474c6baec42af4ce202811428e1009acfb2e507" name="openbao-cassandra-database-plugin" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="2bff67d3eeacbf4a71974e5ec7e652205424faddab54d3af1ec30d16e045d1f7575427086cca95e0a0a284c2644a2ca3790e74a2b6be291f8cc67070b4341dec" name="openbao-cassandra-database-plugin-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="56a60f04160e3580e3477c4d2f697c3672cf50e90629be032187a2f3ffb8cadb3e63cc9cd06959309e0e5bb5c9423d7be22b9cfe213a731b584e954f8c77d4c1" name="openbao-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="49c6a1c5b897decda197474315e113cd4246d7d097141f9d997cfcb985e726cac5a2e71e18da8e19f450e74f85528b085d6bed48494d6d4cf1cd9ac07e780aa7" name="openbao-influxdb-database-plugin" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="4dd9986221e0761879df665a9b73ade3aa6e3f1cf680e4d5e776d025975946b002f90958e4f21414276ebe688f7ff593911b79d32c4e587d5299d32ef7fc7cbe" name="openbao-influxdb-database-plugin-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="fc182373caf75980cea540ad80f254a6e4ae559d7608ac3a4b028e9111de34d431141376010a883a47c642d8de442da49b13c95d7f737ffcaad1452139a6ba7e" name="openbao-mysql-database-plugin" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="df4823fdf777a65472be1359972c8cf86d8c1dd125e51362eb28676f0eea38b350e627d93d4cce5ee26b38ace2092223974405e9bb91b714982e20d9114e958a" name="openbao-mysql-database-plugin-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="2c61f1b2da2d1160dc283149be168a65474df5c56fd61476a67baeff76c0a48cb28be685841374b7631a44eed8e67c2f42786e04df47d0837a5a7d7fc8b10cb1" name="openbao-mysql-legacy-database-plugin" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="56d5585c58487d3e0e06178272a0b588bd1fc492d90fabae8f793675ace8119996b32c1aff7beae169ab1067b5f0997ed746c292d7b81f13aebc5d2523273dfb" name="openbao-mysql-legacy-database-plugin-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="57f2c0a51adae7a2f838e7f470717e8dcbd0f90ff0efbe4204ba714bcfe03b0d374c309f3865b4725f71f68cb5f8482ecaa0c16314aa5966e4154504b445fc18" name="openbao-postgresql-database-plugin" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="472ee1db30726dde58cd062a42c7633305accb3d8849ef1806d57e786e4a42a1d105169ac1b7622d17614678bcbf214448ca4fc1950775219406291a4c4a9053" name="openbao-postgresql-database-plugin-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="2f9de05c9827ff0533f79976ac032d462e66e59eeabd99a78fdfe063509d8be25f18dd33eb5e2c8d0a8bc9307af41b342e9abb5b44cb355bb78b45210cf4b472" name="openbao-server" arch="noarch">
  <version epoch="0" ver="2.6.1" rel="47.3"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732881600">- Update to version 2.1.0:
  * Note:
  - This release does not ship with the UI enabled. The UI will
    be available in the future. #129
  - OpenBao does not provide support for Vault Enterprise
    features. If there is an enterprise feature you would like to
    see added to the project, please open a feature request.
  - OpenBao is fully API compatible with Vault 1.14.9, and seal
    compatible with the plugins the project supports. Plugin
    support for OpenBao can be found here.
  * New Features:
  - Remove Mount Table Limits: Using transactional storage, we've
    split the
  - auth and secret mount tables into separate storage entires,
    removing the
  - requirement that the entire table fit into a single storage
    entry limited by
  - max_entry_size. This allows potentially hundreds of thousands
    of mounts on
  - a single scaled-up server. [GH-622]
  - Transactional Storage: Plugin developers can now take
    advantage of safe
  - storage modification APIs when the underlying physical
    storage supports
  - them. The physical.TransactionalBackend and
    logical.TransactionalStorage
  - types allow developers to begin read-only and writable
    transactions,
  - committing or rolling back the desired changes. [GH-292]
  - Transit: Support PKI CSR and certificate storage alongside
    key material. This allows callers to securely create keys and
    submit requests for certificates without the key material
    leaving Transit. Storage of the certificate on the key avoids
    the need for an additional K/V mount. Rotation of this
    certificate and its chain is also supported. [GH-536]
  - auth/oidc: Add a new callback_mode role option value device
    to use the oidc device flow instead of a callback, add a new
    poll_interval role option to control how often to poll for a
    response, and add a new callbackmode=device option to the
    oidc login method in the cli. [GH-319]
  - auth/oidc: Add new callback_mode=direct role option to cause
    the oidc callback to be direct to the server instead of the
    client, and add a callbackmode=direct option to the oidc
    login method in the cli. [GH-318]
  - physical/postgres: Reintroduce Postgres database for OpenBao
    storage, implementing paginated list support. This feature is
    currently in preview and breaking changes may occur. [GH-467]
  * Changelog
  - 93609bf: Add changelog for v2.1.0 GA (#772) (@cipherboy)
  - d083548: Bump go-kms-wrapping, openbao-template prior to
    release (#770) (@cipherboy)
  - Full changelog see
    https://github.com/openbao/openbao/releases/tag/v2.1.0
    https://github.com/openbao/openbao/releases/tag/v2.1.0-beta20241114.3</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737547200">- Update to version 2.1.1:
  * Add changelog for v2.1.1 (#932)
  * Update all keys and certs to TTL 100 years (#793) (#931)
  * Fix expired cert auth test-fixture (#892) (#930)
  * Bump to latest Go 1.23.5 version (#912) (#929)
  * Bump alpine from 3.20 to 3.21 (#831) (#928)
  * Bump extended standard library dependencies (#927)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741176000">- Update to version 2.2.0:
  Release notes: https://openbao.org/docs/release-notes/2-2-2/#220
  Full list of changes:
  https://github.com/openbao/openbao/compare/v2.1.0...v2.2.0
  * New Features:
  - ACME TLS Listener Certificate Provisioning: Automatically
    fetch TLS certificates for OpenBao Server's TCP listeners via
    an Automatic Certificate Management Environment (ACME - RFC
    8555) capable certificate authority (CA). This allows OpenBao
    to be self-hosted, using a CA contained within the instance
    to sign the instance's own certificates. [GH-857]
  - PKCS#11 Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a PKCS#11-enabled Hardware Security Module
    (HSM) or Key Management System (KMS). [GH-889]
  - Scanning: introduce the ability to recursively list (scan)
    within plugins, adding a separate scan ACL capability,
    operation type, HTTP verb (SCAN with GET fallback via
    ?scan=true), API, and CLI support. This also adds support to
    the KVv1 and KVv2 engines. [GH-763]
  - Transit: Add support for key derivation mechansims (derives a
    new key from a base key).
  - This path uses the named base key and derivation
    algorithm specific parameters to derive a new named key.
  - Currently, only the ECDH key agreement algorithm is
    supported: the base key is one's own ECC private key and
    the "peer_public_key" is the pem-encoded other party's
    ECC public key.The computed shared secret is the
    resulting derived key. [GH-811]
  - UI: Reintroduction of the WebUI. [GH-940]
  - raft: Added support for nodes to join the Raft cluster as
    non-voters. [GH-741]
  * Changes
  - command/server: Prevent and warn about loading of duplicate
    config file from config directory. [GH-816]
  - container: Set -dev-no-store-token in default container
    images, fixing default read-only containers. [GH-826]
  - core/seal: remove support for legacy pre-keyring barrier
    entries core/seal: remove support for legacy (direct) shamir
    unseal keys [GH-750]
  - core: Remove support for Solaris due to lack of Docker
    support. [GH-710]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 2.2.1:
  * Release v2.2.1 (#1255)
  * Backport core deps (#1252)
  * Return quoted string when -output-curl-string flag is passed
    [#1038] (#1238) (#1250)
  * build: update Go version and dependencies (#1209) (#1246)
  * Fix vulns (#1126) (#1245)
  * Fix vault/diagnose test failure (#1221) (#1247)
  * Do not encode empty subproblems in ACME (#1236) (#1248)
  * Fix name of org-level maintainers team (#1237) (#1249)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 2.2.2:
  Release notes:
  https://github.com/openbao/openbao/blob/v2.2.2/CHANGELOG.md
  * SECURITY:
  - sdk/framework: prevent information disclosure on invalid
    request. HCSEC-2025-09 / CVE-2025-4166. [GH-1323]
  * BUG FIXES:
  - ui: Fix description of Organizational Unit (OU) field in PKI.
    [GH-1333]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284800">- Update to version 2.3.1:
  OpenBao v2.3.0 is unreleased due to a bug in Illumos builds.
  * SECURITY
  - core/sys: Add listener parameter
    (disable_unauthed_rekey_endpoints, default: false) to
    optionally disable unauthenticated rekey operations (to
    sys/rekey/* and sys/rekey-recovery-key/*) for a listener.
    This will be set to true in a future release; see the
    deprecation notice for more information. Auditing is now
    enabled for these endpoints as well. CVE-2025-52894. Upstream
    HCSEC-2025-11 / CVE-2025-4656.
  - sdk/framework: prevent additional information disclosure on
    invalid request. CVE-2025-52893. [GH-1495]
  * CHANGES
  - packaging/systemd: Do not set LimitNOFILE, allowing Go to
    automatically manage this value on behalf of the server. See
    also golang/go#46279. [GH-1179]
  - storage/postgresql: Support empty connection URLs to use
    standard component-wise variables [GH-1297]
  - packaging: Support for Illumos removed due to broken builds
    [GH-1503]
  * FEATURES
  - KMIP Auto-Unseal: Add support for automatic unsealing of
    OpenBao using a KMIP protocol. [GH-1144]
  - Namespaces UI Support: Added namespace UI support, including
    namespace picker and namespace management pages. [GH-1406]
  - Namespaces: Support for tenant isolation using namespaces,
    application API compatible with upstream's implementation.
  - Create, read, update, delete a hierarchical directory of
    namespaces
  - Manage isolated per-namespace secrets engines, auth
    methods, tokens, policies and more
  - Migrate (remount) secrets engines and auth methods between
    namespaces
  - Lock and unlock namespaces
  - Route requests to namespaces via path
    (/my-namespace/secrets) or X-Vault-Namespace header (or
    both!)
  - CLI support via the bao namespace family of commands and
    the -namespace flag. [GH-1165]
  - Add ARM64 HSM builds and Alpine-based HSM container images
    [GH-1427]
  - Support Common Expression Language (CEL) in PKI. CEL allows
    role authors to create flexible, dynamic certificate policies
    with complex, custom validation support and arbitrary control
    over the final certificate object. [GH-794]
  - auth/jwt: Add support for Common Expression Language (CEL)
    login roles. CEL allows role authors to create flexible,
    dynamic policies with complex, custom claim validation
    support and arbitrary templating of logical.Auth data.
    [GH-869]
  - ssh: Support multiple certificate issuers in SSH secret
    engine mounts, enabling safer rotation of SSH CA key material
    [GH-880]
  * IMPROVEMENTS
  - When using auto-unseal via KMS, KMS-specific configuration
    information (non-sensitive) is now logged at server startup.
    [GH-1346]
  - approle: Use transactions for read + write operations
    [GH-992]
  - auth/jwt: Support lazy resolution of oidc_discovery_url or
    jwks_url when skip_jwks_validation=true is specified on
    auth/jwt/config; OIDC status is now reported on reading the
    configuration. [GH-1306]
  - core/identity: add unsafe_cross_namespace_identity to give
    compatibility with Vault Enterprise's cross-namespace group
    membership. [GH-1432]
  - core/policies: Add check-and-set support for modifying
    policies, allowing for protection against concurrent
    modifications. [GH-1162]
  - core/policies: Add endpoint to allow detailed listing of
    policies [GH-1224]
  - core/policies: Allow setting expiration on policies and
    component paths, removing policies or preventing usage of
    path rules after expiration. [GH-1142]
  - core: Support pagination and transactions in ClearView,
    CollectKeys, and ScanView, improving secret disable memory
    consumption and request consistency. [GH-1102]
  - database/valkey: Revive Redis plugin as Valkey, the
    OSI-licensed fork of Redis [GH-1019]
  - database: Use transactions for read-then-write methods in the
    database package [GH-995]
  - pki: add not_after_bound and not_before_bound role parameters
    to safely limit issuance duration [GH-1172]
  - ssh: Use transactions for read-then-write or multiple write
    methods in the ssh package [GH-989]
  - storage/postgresql: support retrying database connection on
    startup to gracefully handle service ordering issues
    [GH-1280]
  * DEPRECATIONS
  - Configuration of PKCS#11 auto-unseal using the duplicate and
    undocumented module, token and key options is now deprecated.
    Use the documented alternative options lib, token_label and
    key_label instead, respectively. (More details) [GH-1385]
  * BUG FIXES
  - api: Stop marshaling nil interface data and adding it as a
    request body on an api.Request [GH-1315]
  - core/identity: load namespace entities, groups into MemDB
    preventing them from disappearing on restart. [GH-1432]
  - oidc: add some buffer time after calling oidcPeriodicFunc in
    test, to prevent flakiness [GH-1178]
  - pki: addresses a timing issue revealed in pki
    Backend_RevokePlusTidy test [GH-1139]
  - sealing/pkcs11: OpenBao now correctly finalizes the PKCS#11
    library on shutdown (openbao/go-kms-wrapping#32).
  - This is unlikely to have caused many real-world issues so
    far. [GH-1349]
  - secrets/kv: Fix panic on detailed metadata list when results
    include a directory. [GH-1388]
  - storage/postgresql: Remove redundant PermitPool enforced by
    db.SetMaxOpenConns(...). [GH-1299]
  - storage/postgresql: skip table creation automatically on
    PostgreSQL replicas [GH-1478]
  - vault: addresses a timing issue revealed in OIDC_PeriodicFunc
    test [GH-1129]
  - vault: fixes a timing issue in OIDC_PeriodicFunc test
    [GH-1100]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751284801">- Update to version 2.3.1:
  * Bump to v2.3.1 - Drop Illumos support per policy in #711 (#1503)
  * Bump sdk to v2.3.1, add changelog to v2.3.0 (#1501)
  * Bump API to v2.3.1 in core, sdk (#1500)
  * Minor improvements to CEL for PKI  (#1390) (#1499)
  * Allow disabling unauthenticated rekey (#1498)
  * Add changelog entry for sdk/framework vulnerability (#1497)
  * Fix PostgreSQL table creation on replica (#1478) (#1494)
  * Namespaces UI support (#1406) (#1484)
  * Fix identity store resolution (#1432) (#1491)
  * Go dependency bumps to fix vulnerabilities in dependencies (#1492)
  * Backport go-viper/mapstructure/v2 move (#1488)
  * Point goreleaser and container image contacts to new OpenSSF domain (#1415) (#1489)
  * Fix changelog entries (#1440) (#1487)
  * HSM: Add arm64 builds &amp; Alpine containers (#1427) (#1486)
  * Fix flaky PostgreSQL backend connection test (#1368) (#1485)
  * Fix detailed metadata on list results (#1388) (#1483)
  * CEL for Certificate Issuance Policy (#794) (#1482)
  * Deprecation notice for undocumented duplicate PKCS#11 seal options (#1385) (#1481)
  * Bump github.com/ebitengine/purego to v0.8.4 (#1373)
  * Changelog for v2.3.0-beta20250528 (#1371)
  * Update to go-kms-wrapping/v2.4.0 (#1370)
  * Track lock in namespace entry directly (#1367)
  * Add check and set for policies (#1162)
  * Namespaces locking/unlocking implementation (#1347)
  * Add policy and path expiration (#1142)
  * Add NeoNephos to supporters section of homepage (#1363)
  * Support clearing views via pagination, with transaction (#1102)
  * Describe how user access and roles are managed to cover OSPS-AC-02.01 (#1359)
  * Use per-namespace storage layouts for identity (#1360)
  * Update contributors and maintainers information (#1305)
  * add hsm docker distribution to downloads page (#1353)
  * MFA Login namespace adjustments (#1348)
  * Describe usage of artifacts stores to cover OSPS-QA-05 (#1355)
  * Describe how dependencies are tracked as part of OSPS-QA-02.01 (#1354)
  * Detailed metadata in policy endpoint (#1224)
  * Display seal configuration info keys in logs (#1346)
  * Renew `goodcertbadroot.pem` (#1351)
  * discarded ctx cancel functions
  * struct literal uses unkeyed fields
  * malformed struct field tag
  * the ctxCancel function is not used on all paths (possible context leak)
  * unreachable code
  * Release note on PKCS#11 library finalization (see go-kms-wrapping)
  * Better document configuration directories
  * Add changelog entry
  * Fix description of OU field in UI
  * Namespaces: Test flake, deadlock, race condition cleanup (#1311)
  * Add changelog to namespaces (#1321)
  * Fix `/sys/remount` across namespaces (#1259)
  * Hierarchical namespace storage (#1317)
  * Move namespace resolution from http to core (#1279)
  * Delete namespace-level quota on namespace deletion (#1296)
  * fairshare job manager/worker: stop synchronously (#1291)
  * Namespace-aware password policy storage &amp; lookup (#1282)
  * Add namespace-aware rate-limit quota (#1161)
  * fix(identity): ensure identity store is set only for root namespace (#1271)
  * Fix preSeal ordering w.r.t NamespaceStore (#1269)
  * Implement Cascading Delete for Namespaces and Associated Resources (#1206)
  * move namespace uuid into namespace struct (#1167)
  * Forbid illegal namespace characters (#1203)
  * Namespaces Regression: Restricted APIs in `sys/raw` (#1163)
  * Tests for namespace  route resolution - issue #1020 (#1201)
  * Fix namespace, mount name exclusion logic (#1202)
  * Namespace aware identity store #1110 (#1159)
  * Namespace-aware Expiration Manager #1125 (#1158)
  * Namespace-aware token store #1068 (#1123)
  * Implement namespace name restrictions #1023 (#1143)
  * feat: add `bao namespace scan` (#1133)
  * Refactor namespace store (#1113)
  * implement namespace aware plugin storage (#1157)
  * Add support for child namespaces (#1051)
  * Implement namespace aware Cubbyhole #1067 (#1112)
  * Polish namespaces API (#1041)
  * Add PATCH support to namespaces API (#1027)
  * Namespace aware policy store #1069 (#1106)
  * Create required mounts when setting up namespace (#1047)
  * Correctly handle request routing (#1028)
  * Polish NamespaceStore implementation (#1026)
  * Add NamespaceStore to the namespace branch (#896)
  * Fix various minor docs formatting issues (#1344)
  * Add JSON configuration example to website (#1338)
  * Bump dependencies (#1318)
  * Bump ubi9-minimal from 9.5 to 9.6 (#1329)
  * Allow building with HSM support on MacOS (#1330)
  * Bump to Go 1.24.3 (#1324)
  * Prevent information disclosure on invalid request (#1323)
  * PostgreSQL - Remove redundant PermitPool (#1299)
  * Fix deadlock on legacy root key path migration (#1234)
  * Support retrying PostgreSQL connection (#1280)
  * Allow lazy discovery of OIDC connection information (#1306)
  * Bump actions/setup-go from 5.4.0 to 5.5.0 in /.github/actions/set-up-go (#1309)
  * Fix marshaling and setting nil request body (#1315)
  * Add JWT CEL Role RFC (#1312)
  * Add OSPS to policies (#1313)
  * Describe coverage of OSPS requirement OSPS-QA-01.02 (#1307)
  * Fix incorrect conversion between integer types (on &lt;64 bit systems) (#1310)
  * Bump go.opentelemetry.io/otel/trace from 1.34.0 to 1.35.0 (#1294)
  * CEL auth program evaluation during JWT login (#869)
  * Add CEL best practices RFC (#1267)
  * Affirm Level 1: OSPS-LE-02.01 (#1287)
  * Affirm Level 1: OSPS-VM-02.01 has been met (#1273)
  * Allow empty PostgreSQL connection URLs (#1297)
  * chore(tools): rm codechecker bin (#1292)
  * Affirm Level 1: OSPS-DO-01.01 (#1286)
  * Affirm Level 1: OSPS-GV-03.01 (#1285)
  * Document coverage of OSPS requirement OSPS-QA-01.01 (#1289)
  * Minor cleanup of the rekey webpage (#1288)
  * Bump actions/download-artifact from 4.2.1 to 4.3.0 (#1275)
  * Bump github.com/go-sql-driver/mysql from 1.8.1 to 1.9.2 (#1277)
  * Bump github.com/openbao/go-kms-wrapping/wrappers/pkcs11/v2 (#1276)
  * chore: remove artifacts in `dependencies/` (#1272)
  * Fix make goreleaser-check after split (#1257)
  * Add release notes for v2.2.1 to website (#1256)
  * Update critical dependencies (#1251)
  * Return quoted string when -output-curl-string flag is passed #1038 (#1238)
  * Bump ember-test-selectors from 6.0.0 to 7.1.0 in /ui (#1239)
  * match ssh test to updated behaviour (#1243)
  * (secrets/pki): add not_before_bound and not_after_bound (#1172)
  * Bump github.com/golangci/revgrep (#1240)
  * Bump k8s.io/api from 0.32.1 to 0.32.3 (#1241)
  * Bump actions/setup-node from 4.3.0 to 4.4.0 (#1242)
  * Do not encode empty subproblems in ACME (#1236)
  * Fix name of org-level maintainers team (#1237)
  * fix(ssh): `generate_signing_key=false` not honored on issuer submission endpoints (#1235)
  * Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#1148)
  * Fix test-ui (#1211)
  * Upgrade ESLint and prettier (#1218)
  * Bump highlight.js from 10.7.2 to 11.11.1 in /ui (#1035)
  * Bump honnef.co/go/tools from 0.4.3 to 0.6.1 (#1217)
  * Bump mvdan.cc/gofumpt from 0.7.0 to 0.8.0 (#1216)
  * Fix vault/diagnose test failure (#1221)
  * Add h1 for mfa-validate api-doc (#1230)
  * Clarify that region is required (#1220)
  * doc(telemetry.mdx): add metrics_prefix (#1214)
  * Do not set LimitNOFILE (#1179)
  * update SSH‑CA configure acceptance test for multi‑issuer flow (#1210)
  * build: update Go version and dependencies (#1209)
  * Another attempt to fix TestOIDC_PeriodicFunc (#1178)
  * Transactions for ssh-related functions (#989)
  * Bump github.com/ory/dockertest/v3 from 3.10.0 to 3.12.0 (#1197)
  * Add guide for listing detailed endpoints (#1190)
  * Bump typescript from 5.8.2 to 5.8.3 in /website (#1195)
  * Bump golang.org/x/text from 0.23.0 to 0.24.0 (#1196)
  * Bump actions/go-dependency-submission from 2.0.1 to 2.0.3 (#1192)
  * Bump actions/setup-go from 5.3.0 to 5.4.0 in /.github/actions/set-up-go (#1193)
  * fix mirror workflow (#1191)
  * Add Dave to DevWG voting members (#1187)
  * Add support for automatic unsealing of OpenBao using a KMIP protocol (#1144)
  * Add action to mirror repo to Codeberg (#1186)
  * Bump actions/cache from 4.2.2 to 4.2.3 (#1149)
  * Bump react-dom from 19.0.0 to 19.1.0 in /website (#1174)
  * Bump gotest.tools/gotestsum from 1.10.0 to 1.12.1 (#1118)
  * Bump actions/download-artifact from 4.1.9 to 4.2.1 (#1150)
  * Bump actions/setup-node from 4.2.0 to 4.3.0 (#1151)
  * Bump actions/cache from 4.2.2 to 4.2.3 in /.github/actions/set-up-go (#1152)
  * Bump github.com/hashicorp/go-secure-stdlib/password from 0.1.1 to 0.1.4 (#1153)
  * Add link to dev-wg project in CONTRIBUTING.md (#1180)
  * Add new moderators: voigt, Gabrielopesantos, karras (#1171)
  * docs: Add SSH CA Multi-issuer RFC to website docs (#1146)
  * Support Multiple Issuers for SSH Secret Engine Mounts (#880)
  * config.go: fix config file filename comment (de-vault) (#1141)
  * Validate policies can contain comments, be JSON (#1134)
  * PKI test failure (#1139)
  * Remove beta warning (#1138)
  * Add hex to templating for ACL policies (#1081)
  * Add webpage for OSPS baseline (#1124)
  * fix(docs/pkcs11): remove documentation regarding key generation (#1135)
  * Allow periodicFunc to execute "now" (#1129)
  * docs: Correct config file location in token helper docs (#1132)
  * Add EdgeX Selects OpenBao Blog (#1127)
  * Add GitLab to supporters section of homepage (#1128)
  * Address timing issue caused by race-detection slowdown (#1100)
  * Fix vulns (#1126)
  * Fix ACME TLS documentation (#1122)
  * Mitigate security risks found using Zizmor (#924)
  * add rfc#432 to docs rfc index (#1116)
  * Bump ember-cli-deprecation-workflow from 2.1.0 to 3.2.0 in /ui (#1104)
  * website: Fix typos in website content (#1108)
  * Officially add TSC membership process (#1101)
  * Bump browser-actions/setup-chrome from 1.7.2 to 1.7.3 (#1089)
  * Bump actions/setup-node from 4.1.0 to 4.2.0 (#1092)
  * Bump webpack from 5.97.1 to 5.98.0 in /ui (#1094)
  * Use consistent path for root key (#1006)
  * Bump github.com/shirou/gopsutil/v4 from 4.24.12 to 4.25.2 (#1095)
  * Bump actions/download-artifact from 4.1.8 to 4.1.9
  * Bump actions/upload-artifact from 4.6.0 to 4.6.1
  * Bump actions/setup-go from 4.0.1 to 5.3.0 in /.github/actions/set-up-go
  * Add wildcard so dependabot traverses child directories (#1088)
  * Add v2.2.0 changelog to release notes (#1085)
  * Nit: Fix link to create/update role in api/pki docs (#1071)
  * Bump github.com/hashicorp/cap from 0.8.0 to 0.9.0 (#1058)
  * Bump actions/cache to v4, use pinning (#1064)
  * Bump prettier-eslint-cli from 7.1.0 to 8.0.1 in /ui (#1059)
  * Bump typescript from 5.7.3 to 5.8.2 in /website (#1057)
  * Simplify Goreleaser templates (#1039)
  * userpass: fix the wrong error return value (#1055)
  * Add blog post for horizontal scalability (#1049)
  * fix(ui): repairs missing checkmarks, in checkboxes, due to invalid usage of sass-svg-uri (#1042)
  * Bump github.com/hashicorp/cap from 0.3.0 to 0.8.0 (#1036)
  * Bump swagger-ui-dist from 5.18.2 to 5.19.0 in /ui (#1034)
  * Bump d3-transition from 1.3.2 to 3.0.1 in /ui (#1032)
  * fix prerelease image tagging (#1030)
  * Revive Valkey plugin (#1019)
  * Add API and CLI commands to promote/demote nodes in the Raft cluster (#996)
  * cleanup leftover DR Token options (#1018)
  * Add transaction wrappers to database endpoints (#995)
  * Add transactions to AppRole funcs (#992)
  * Bump github.com/natefinch/atomic (#1012)
  * Update libraries.mdx (#1015)
  * Bump @types/rsvp from 4.0.4 to 4.0.9 in /ui (#1011)
  * Bump qunit-dom from 2.0.0 to 3.4.0 in /ui (#1010)
  * Bump @types/ember-resolver from 5.0.13 to 9.0.2 in /ui (#1009)
  * Bump ember-cli-htmlbars from 6.0.1 to 6.3.0 in /ui (#1008)
  * identity: return metadata when listing entity-aliases (#1013)
  * Minor docs improvements and chore (#1005)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754654400">- Update to version 2.3.2:
  * Breaking Changes
    Due to security vulnerabilities, there are three breaking
    changes in this security release:
  - audit subsystem will no longer allow creation of new devices
    via the API except by setting
    unsafe_allow_api_audit_creation.  In the v2.4.0 release,
    support for configuration-based audit device definition will
    be added.
  - auth/ldap has changed entity formats to normalize against
    whitespace and case-sensitivity when the unsafe
    username_as_alias=true parameter is set.
  - TOTP codes now must be exactly N numeric digits and cannot
    contain leading or trailing whitespace and will be rejected
    by the API if they do.
  * SECURITY
  - audit: Add server configuration options to disable audit
    mount creation via the API and to disable audit log
    prefixing. HCSEC-2025-14 / CVE-2025-6000 / CVE-2025-54997.
    [GH-1634]
  - unsafe_allow_api_audit_creation (default: false) controls
    the ability to create audit mounts via the API
  - allow_audit_log_prefixing (default: false) controls the
    availability of the prefix audit mount option
  - auth/mfa: correctly limit reuse of TOTP codes during login
    MFA enforcement. HCSEC-2025-19 / CVE-2025-6015 /
    CVE-2025-55003. [GH-1629]
  - auth/userpass: Prevent timing-based leak in userpass auth
    method. HCSEC-2025-15 / CVE-2025-6011 / CVE-2025-54999.
    Assumed to also apply to HCSEC-2025-21 / CVE-2025-6010.
    [GH-1628]
  - core/auth: Correctly handle alias lookahead for user lockout
    consistency. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/userpass: Consistently handle alias lookahead as case
    insensitive. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998.
  - auth/ldap: Attempt consistent entity aliasing w.r.t. spacing
    and casing. HCSEC-2025-16 / CVE-2025-6004 / CVE-2025-54998
    and HCSEC-2025-20 / CVE-2025-6013 / CVE-2025-55001. [GH-1632]
  - core/identity: Correctly lowercase policy names to prevent
    root policy assignment. HCSEC-2025-13 / CVE-2025-5999 /
    CVE-2025-54996. [GH-1627]
  - secrets/totp: Fix TOTP verification reuse bypass when the
    TOTP code contains spaces. HCSEC-2025-17 / CVE-2025-6014 /
    CVE-2025-55000. [GH-1625]
  * IMPROVEMENTS
  - core: Update to Go 1.24.6. [GH-1637]
  * BUG FIXES
  - Ignore missing mounts when deleting a namespace. This can
    happen when a mount is unmounted in parallel. [GH-1594]
  - agent/template: add missing backoff mechanism for the
    templating server [GH-1448]
  - core/namespaces: fixed race condition in namespace deletion
    operation during instance sealing [GH-1525]
  - core/policies: fix bug with missing existing policies in
    namespaces during failover, startup [GH-1613]
  - identity/oidc: Fix unintentional lowercasing of namespace
    accessor in assignments. [GH-1539]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756468800">- Update to version 2.4.0:
  * SECURITY
  - audit/file: Restrict mode parameter
  - Refuse setting an irregular file mode
  - Silently strip any executable bits [GH-1651]
  * CHANGES
  - certutil.ParsePublicKeyPEM of the package
    github.com/openbao/openbao/sdk/v2/helper/certutil will now
    return a crypto.PublicKey instead of any. You might need to
    remove type assertions from your code. [GH-1611]
  - database: Drop obsolete upgrade check in roleAtPath()
    function introduced in v0.10 of Vault. [GH-1675]
  - sdk/framework: Remove LegacyStringToSliceHookFunc, use
    mapstructure.StringToWeakSliceHookFunc instead. [GH-1626]
  - sdk/helper: Removed sdk/helper/base62, sdk/helper/mlock,
    sdk/helper/parseutil, sdk/helper/password,
    sdk/helper/strutil, and sdk/helper/tlsutil packages.
    Please use github.com/openbao/go-secure-stdlib/xxx or
    github.com/hashicorp/go-secure-stdlib/xxx instead.
  - sdk/database/helper/connutil: Removed Initialize from
    ConnectionProducer interface, and SQLConnectionProducer
    struct. [GH-1676]
  - sdk/logical: Introduce context to
    logical.HandleListPage(...). [GH-1696]
  - sdk: Bump Go version to 1.24.0 [GH-1690]
  - vault/seal: removal of deprecated migration path of an old
    pre-Vault v1.0 (encrypted) recovery config location [GH-1424]
  * FEATURES
  - Allow filtering LIST, SCAN responses via the
    list_scan_response_keys_filter_path parameter to restrict
    information to only readable or listable values. [GH-1389]
  - Configuration-Based Audit Devices: Create and remove audit
    devices through server configuration updates. Changes are
    applied on restart and SIGHUP with issues appearing in the
    logs. [GH-1700]
  - Declarative Self-Initialization: allow server operators to
    define initial service state through request-driven
    initialization that occurs automatically on first server
    start. Operators can reference environment variables and
    files to provision initial authentication, audit, and secret
    mounts in addition to having full control over general
    requests to OpenBao It is suggested to put the minimal
    necessary configuration in this and use a proper IaC platform
    like OpenTofu to perform further configuration of the
    instance. [GH-1506]
  - Delay recovery key generation for auto-unseal mechanisms and
    make rotation authenticated: Add authenticated root and
    recovery key rotation endpoints, allow delayed recovery key
    generation (setting initial shares to 0).  Solve the issue
    with the unauthenticated recovery key rotation APIs.
    [GH-1518]
  - Inline, Write-less Authentication: support passing
    authentication information inline with the desired main
    operation to avoid the need for separate authentication
    calls, storing and maintaining tokens. This authentication
    form will not work with operations that create leases.  In
    this form of authentication, no storage writes occur as a
    result of authentication allowing its use on future
    read-enabled standby nodes. [GH-1433]
  - Add static key unseal mechanism to allow auto-unseal in
    environments with explicit trust chaining. [GH-1425]
  * IMPROVEMENTS
  - api/auth/jwt: initial implementation of JWT Auth Method
    [GH-1526]
  - auth/oidc: Add new show_qr=true cli option to display a QR
    code of the login URL. [GH-1561]
  - auto-unsealing: Improved the clarity of the warning message
    logged when the server is uninitialized and auto-unsealing is
    configured. [GH-1411]
  - builtin/credential/jwt: Support TLS authentication against
    explicit alt name/subject. [GH-1533]
  - cel: Add cel-go ext helpers for string, list, optional,
    regex, math, set, and encoder operations [GH-1697]
  - cel: Unify CEL helper functions between JWT and PKI modules,
    making email validation and other utilities available across
    both authentication and certificate management [GH-1697]
  - cli: add new subcommand "bao operator validate-config" to
    validate a configuration file syntax [GH-1609]
  - core: sys/seal-status: endpoint now always returns the
    barrier seal type, explicitly adds recovery seal type
    [GH-1638]
  - deps: Update go-jose v3 to go-jose v4 [GH-1477]
  - secrets/kv: Add CAS (Compare-And-Swap) support for metadata
    operations in KV v2 secrets engine. Metadata updates now
    support versioning via metadata_cas parameter and
    metadata_cas_required configuration option to prevent
    concurrent modification conflicts. [GH-1372]
  - ui: change the message 'Vault is sealed to 'OpenBao is
    Sealed' by changing the title of the unseal template
    [GH-1652]
  - seal/pkcs11: Support and default to software encryption for
    RSA key types. [GH-1742]
  * DEPRECATIONS
  - storage/postgresql: remove support for legacy PostgreSQL
    versions before 9.5 which require a special upsert function.
    [GH-1570]
  * BUGFIXES
  - api: Fix compatibility with sys/health from Vault Enterprise
    [GH-1730]
  - command: fixes typo in Windows command for setting BAO_ADDR
    in development mode [GH-1527]
  - core/namespaces: Prevent infinite loop in namespace loading
    due to incorrect list pagination when more than 100 sibling
    namespaces exist under a given parent [GH-1696]
  - identity: fix nil panic when collecting metrics with
    unsafe_cross_namespace_identity=true. [GH-1715]
  - pki: Truncate should error on expired certificates [GH-1369]
  - releases: add missing container image manifests for *-hsm
    variants [GH-1597]
  - sdk: Various constants in the sdk package mistakenly had no
    explicit type. They now now typed correctly. [GH-1523]
  - secrets/pki: Prevent infinite loop in tidy stemming from
    incorrect list pagination [GH-1696]
  - storage/postgresql: more graceful handling of parallel table
    creation [GH-1506]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758283200">- Update to version 2.4.1:
  * SECURITY
  - http: Limit the complexity of JSON in HTTP request bodies
    through max_request_json_memory and max_request_json_strings.
    HCSEC-2025-24 / CVE-2025-6203 / CVE-2025-59043. [GH-1756]
  * BUG FIXES
  - auth/jwt: Add missing OIDC flow in JWK validator construction
    [GH-1779]
  - auth/jwt: Support token renewal with CEL roles. [GH-1776]
  - auth/mfa: Allow single-flow MFA to work with inline
    authentication. [GH-1753]
  - auth/mfa: Correctly persist tokens created through two-step
    MFA login enforcement. [GH-1753]
  - command: fix operator init not allowing for 0 as
    recovery_shares value. [GH-1754]
  - command: fix operator rotate-keys not returning recovery keys
    when server is initialized with 0 recovery_shares. [GH-1754]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761220800">- Update to version 2.4.3 (2.4.2 was not released):
  * SECURITY
  - audit: redact HTTPRawBody response parameter in audit logs;
    CVE-2025-62513 / GHSA-ghfh-fmx4-26h8. [GH-2002]
  - audit: redact []byte type response parameters in audit logs;
    CVE-2025-62705 / GHSA-rc54-2g2c-g36g. [GH-2002]
  * IMPROVEMENTS
  - core/namespaces: Setting the X-Vault-Namespace Header (or the
    BAO_NAMESPACE environment variable when using the cli) to
    "root" now maps to the root namespace. [GH-1918]
  * BUG FIXES
  - core/identity: Entities timestamps are now correctly
    formatted in RFC3339Nano, as previously done so. [GH-1873]
  - core/namespaces: Fix mount creation failing if mount name is
    equal to the name of the containing namespace [GH-1958]
  - core/namespaces: ensure interrupted namespace creation fails
    gracefully; prevents identity store panic and partial
    memory-only namespaces [GH-1990]
  - core/namespaces: only report namespaces which the provided
    token has access to from sys/internal/ui/namespaces [GH-1982]
  - raft: fix memory leak on standby nodes [GH-1889]
  - sdk/framework: Reduce memory usage of repeated mounts through
    singleton pattern regex cache [GH-1893]
  - secrets/kv: KV entries timestamps are now correctly formatted
    in RFC3339Nano, as previously done so. [GH-1872]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764072000">- Update to version 2.4.4:
  * SECURITY
  - core/identity: Correctly lowercase policy names on identity
    groups to prevent root policy assignment. CVE-2025-64761 /
    GHSA-7ff4-jw48-3436. Second part of upstream's HCSEC-2025-13
    / CVE-2025-5999. [GH-2143]
  * IMPROVEMENTS
  - command: operator diagnose certificate expiration warnings
    are now raised if less than 15% of the certificate's validity
    period remains. Previously, any certificate that was set to
    expire in the next 30 days would be flagged. This made little
    sense for short-lived certificates. [GH-2062]
  * BUG FIXES
  - auth/cert: allow use of always-fresh OCSP servers which elide
    NextUpdate [GH-2079]
  - auth/jwt: Fix token renewal of pre-v2.3.x JWT tokens and all
    OIDC tokens after CEL support was introduced. [GH-2148]
  - command: operator diagnose certificate expiration warnings
    now contain the correct time to expiration. [GH-2062]
  - command: operator diagnose now correctly ignores trailing
    data in certificate files. [GH-2065]
  - command: operator diagnose now correctly verifies
    intermediate certs if no root certs are supplied. [GH-2065]
  - command: pki health check error now contains actual mount
    path instead of a template placeholder. [GH-2061]
  - core: fix nil panic in the rare case were an expiration retry
    is running during shutdown [GH-2019]
  - raft: fix memory leak when using only non-transactional
    operations. This was a regression introduced in release 2.4.2
    with #1889. [GH-2067]
  - sdk/helper/ocsp: allow use of always-fresh OCSP servers which
    elide NextUpdate [GH-2079]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770292800">- Update to version 2.5.0:
  This release adds support for horizontal read scalability!
  * SECURITY
  - core/sys: BREAKING: default value of
    disable_unauthed_rekey_endpoints is true, to continue using
    unauthed rekey endpoints, set
    disable_unauthed_rekey_endpoints=false in listeners
    explicitly. [GH-2125]
  * CHANGES
  - Remove the deprecated creation_statements,
    revocation_statements, rollback_statements, and
    renew_statements fields from the dbplugin Statements protobuf
    message [GH-1962]
  - api: The deprecated api.MountConfigOutput.PluginName field
    was removed. This was already always empty. [GH-2036]
  - auth/jwt: Return error msg on OIDCDiscoveryURL including
    .well-known/openid-configuration component. [GH-2066]
  - core/audit: removed jsonx as a output format option for audit
    mounts [GH-2047]
  - sys/host-info: This endpoint may start reporting slightly
    higher memory usage than before (On Linux only). See
    https://github.com/shirou/gopsutil/releases/tag/v4.25.8 for
    more information. [GH-1887]
  * FEATURES
  - Add declarative plugin distribution via OCI images: using the
    plugin configuration keyword.  Plugins can be automatically
    downloaded via the plugin_auto_download=true option.  Plugins
    can be manually downloaded via the bao plugin init command.
    Plugins can be automatically registered via the
    plugin_auto_register=true option, regardless if they were
    manually provisioned or from OCI images. [GH-1824]
  - Support Horizontal Read Scalability: all existing HA standby
    nodes are automatically upgraded with read support.  Requests
    which only perform storage read operations will be handled
    locally on the standby node.  Requests which perform a
    storage write operation (or as indicated by plugins) are
    forwarded to the active leader.  Results are eventually
    consistent: a write may not be immediately visible on the
    standby.  To disable, set disable_standby_reads=true in the
    config file before startup. [GH-1986]
  - OIDC Provider: Add Client Credentials flow to OIDC Provider.
    [GH-1732]
  - sdk/framework: add Response.SchemaName to allow custom
    response schema names in the generated OpenAPI spec.
    [GH-1714]
  * IMPROVEMENTS
  - audit: Add http audit device for low-volume, webhook-based
    audit event reporting. [GH-1709]
  - auth/jwt: Add type checking to role. [GH-1854]
  - command: Add environment variables to provide configuration
    for Proxy, Agent, and bao operator migrate via
    BAO_PROXY_CONFIG_PATH, BAO_AGENT_CONFIG_PATH, and
    BAO_MIGRATE_CONFIG_PATH. [GH-2153]
  - command: Support BAO_CONFIG_PATH in plugin init, just like
    server &amp;c do. [GH-2164]
  - command: server, operator diagnose and 'operator
    validate-config` now support the environment variable
    BAO_CONFIG_FILE for the -config command option. [GH-2115]
  - core/metrics: Support custom path for metrics on metrics-only
    listeners. [GH-1853]
  - core/namespaces: Use JobManager for namespace deletion,
    decreasing lock contention. [GH-2226]
  - core/policies: Add endpoint to allow detailed listing of a
    subset of policies. [GH-1965]
  - core/policies: Use per-namespace write lock, improving
    parallelism. [GH-2226]
  - core: Added metrics_only and disallow_metrics options to
    control metrics endpoint exposure on a per-listener basis.
    [GH-1834]
  - database/valkey: Adds the ability to configure the Valkey
    database connection using a single connection_url parameter.
    [GH-1923]
  - database: all database plugins now ignore "not found" errors
    on revoke by default. See Plugin Author Guide for rationale.
    [GH-2101]
  - openapi: Add response schemas for token store operations and
    update operation suffixes. [GH-1840]
  - pki: add allowed_ip_sans_cidr parameter to PKI role system,
    to provide additional checks for IP SANs. [GH-1833]
  - storage/postgresql: implement physical.FencingHABackend to
    minimize chances that writes on secondary nodes occur.
    [GH-1571]
  - transit: Add associated_data parameter to generate data key.
    [GH-1828]
  - website: Add an example of current role statement from
    Valkey. [GH-1811]
  * DEPRECATIONS
  - core/seal: Remove the undocumented "aead" seal mechanism.
    Consider switching to the static seal instead as a
    replacement. [GH-1910]
  - core: Removed FeatureFlags parsing and related code.
    [GH-2045]
  - sdk: Removed sdk/v2/helper/license package. [GH-2045]
  - ui: Removed internal/ui/feature-flags endpoint and all its
    usage. [GH-2045]
  * BUG FIXES
  - agent/auth: Fix token reissue error with kerberos method.
    [GH-2373]
  - auth/jwt: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]
  - core/identity: Ensure periodic func only operates on a single
    namespace at a time, decreasing storage contention. [GH-2226]
  - core/identity: fix corrupt data being stored when referencing
    member_group_ids across namespaces (requires
    unsafe_cross_namespace_identity=true) [GH-2321]
  - core/namespaces: Ensure namespace creation is interruptable,
    allowing namespace deletion for cleanup. [GH-2226]
  - core/namespaces: Fix deadlock on namespace creation, deletion
    due to transaction/lock ordering. [GH-2226]
  - core/namespaces: Fix storage failures in namespace creation
    leading to a total system deadlock. [GH-2166]
  - core/namespaces: improve recovery from partial deletion of
    namespaces, preventing server startup failure. [GH-2188]
  - database/valkey: The creation_statements parameter now
    correctly accepts a standard array of strings for ACL rules
    (e.g., ["+@read", "~*"]). Previously, it incorrectly required
    a stringified JSON array. The old format is still supported
    for backward compatibility. [GH-1959]
  - helper/jobmanager: Fix queue length metrics to report as
    gauges. [GH-2226]
  - physical/postgresql: ensure underlying HA lock removal from
    database causes lock loss, write failures. [GH-2100]
  - raft: return correct raft leader id from read replica nodes
    when using bao operator raft list-peers. [GH-2331]
  - sdk/logical: Use created transaction for WithTransaction
    callback. [GH-2226]
  - secrets/pki: Fix ordering of variable declarations in CEL
    program roles. [GH-1854]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 2.5.1:
  * SECURITY
  - Build with Go 1.25.7 to resolve CVE-2025-68121 /
    GO-2026-4337. [GH-2426]
  - Bump go.opentelemetry.io/otel/sdk to 1.40.0 to resolve
    CVE-2026-24051 / GO-2026-4394 / GHSA-9h8m-3fm2-qjrq.
    [GH-2518]
  * BUG FIXES
  - seal: Fix Auto Unseal failing when upgrading to v2.5.0 or
    downgrading from v2.5.0 to an earlier version. This affected
    the following providers: AliCloud KMS, AWS KMS, Azure Key
    Vault, GCP Cloud KMS &amp; OCI KMS. [GH-2505]
  - core/mounts: Don't attempt to upgrade legacy mount tables
    when in read-only standby mode. [GH-2467]
  - core/expiration: Fix total lease count not being decremented
    when revoking irrevocable leases. [GH-2414]
  - pki: Fix "context canceled" issue when processing cache
    invalidation, leading to pki returning 500 until reload.
    [GH-2472]
  - command: Fix panic when the home directory cannot be
    trivially deduced via environment variables. [GH-2446]
  * CHANGES
  - core/identity: Remove pre-v2.5.0 corrupt namespace identity
    groups during unseal; corrupt groups need to be recreated by
    an admin. Check for deleting corrupt group in server startup
    logs. [GH-2454]
- add script to package webassets inside a podman container, to not
  endanger or pollute the host system with npm</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774526400">- Update to version 2.5.2:
  * SECURITY
  - auth/jwt: Prevent XSS via error_description parameter in
    callback_mode=direct auth methods. CVE-2026-33758. [GH-2709]
  - auth/jwt: Prompt for confirmation during direct callback mode
    to authorize OpenBao token issuance. CVE-2026-33757.
    [GH-2710]
  * BUG FIXES
  - command: External token helpers now inherit environment
    variables from the parent process. [GH-2570]
  - core/metrics: Fix count of leases/tokens/kv-secrets/entities
    metric not being emitted. [GH-2672]
  - core/mounts, core/namespaces: Fix lock ordering in mount
    deletion racing against namespace updates, causing deadlocks.
    [GH-2625]
  - core/seal: Fix /sys/rotate/root call rotating both root key
    and unseal key when using a Shamir Seal, losing all key
    shares. [GH-2619]
  - core: Skip re-scheduling lease expiration jobs that need to
    write to storage when a node unseals in read-only mode.
    [GH-2549]
  - core: Fix potential deadlock in JobManager, which can cause
    mount deletion timeouts. [GH-2630]
  - http: Forward help requests to active node when unable to
    handle them on standby with read requests handling disabled.
    [GH-2572]
  - identity/oidc: Fix OIDC named key rotation silently skipping
    in non-root namespaces due to double namespace prefix in
    storage path lookup. [GH-2669]
  - raft: Propagate peer join/remove/promote/demote and autopilot
    read/update requests to active node. [GH-2574]
  * What's Changed
  - Bump github.com/bgentry/speakeasy to v0.2.0 (#2535 by
    @agrimault-dinum) backported by @agrimault-dinum in #2545
  - Fix expired test certificates (#2552 by @satoqz) backported
    by @phil9909 in #2631
  - Skip lease restoration on standby nodes (#2549 by
    @wslabosz-reply) backported by @phil9909 in #2632
  - Pass full environment to token helper (#2570 by @satoqz)
    backported by @phil9909 in #2633
  - Handle help requests on standby nodes when reads are disabled
    (#2572 by @wslabosz-reply) backported by @phil9909 in #2634
  - Don't iterate namespaces on mount deletion (#2625 by @satoqz)
    backported by @phil9909 in #2635
  - fix race condition in jobmanager (#2630 by @phil9909)
    backported by @phil9909 in #2636
  - Bump github.com/cloudflare/circl to v1.6.3 (#2577 by @satoqz)
    backported by @satoqz in #2652
  - Fix root key rotation endpoint rotating Shamir's KEK (#2619
    by @wslabosz-reply) backported by @satoqz in #2650
  - Bump to Go 1.25.8 (#2609 by @satoqz) backported by @satoqz in
    [#2651]
  - Forward raft autopilot operations (#2574 by @wslabosz-reply)
    backported by @satoqz in #2659
  - Fix regression in OIDC named key rotation (#2669 by
    @JAYKRISHNAN) backported by @phil9909 in #2694
  - Fix missing emitMetricsActiveNode metrics (#2672 by
    @wslabosz-reply) backported by @satoqz in #2697
  - Resolve GHSA-cpj3-3r2f-xj59 (#2709 by @gianklug) by
    @cipherboy in #2711
  - Resolve GHSA-7q7g-x6vg-xpc3 (#2710 by @gianklug) by
    @cipherboy in #2713
  - Add changelog for v2.5.2 by @cipherboy in #2715</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 2.5.3:
  * SECURITY
  - auth/cert: Prevent token renewal with different-but-valid
    certificate. GHSA-7ccv-rp6m-rffr / CVE-2026-39388. [GH-2932]
  - auth/token: Prevent cross-namespace token renewal, revocation
    by accessor. GHSA-p49j-v9wc-wg57 / CVE-2026-40264. [GH-2934]
  - core: Disallow sys/generate-root/* by default due to
    unauthenticated cancellation; use
    disable_unauthed_generate_root_endpoints=false to temporarily
    re-enable. Upstream HCSEC-2026-08 / CVE-2026-5807. [GH-2912]
  - core: Forbid request path traversal using . and .. segments
    by default. If required, set the unsafe_relative_paths.
    Upstream HCSEC-2026-05 / CVE-2026-3605. [GH-2910]
  - core/plugins: Validate and restrict downloaded plugin binary
    size from OCI images; set plugin_download_max_size to limit
    the size (defaults to 512MB). GHSA-r65v-xgwc-g56j /
    CVE-2026-39396. [GH-2941]
  - core/namespaces: Ensure lease revocation on namespace
    re-deletion. GHSA-vv66-6rp4-wr4f. [GH-2935]
  - database/postgresql: Correctly quote schema name in revoke
    statement. GHSA-6vgr-cp5c-ffx3 / CVE-2026-39946. [GH-2931]
  * BUG FIXES
  - command/server: Refuse repeated startup if
    self-initialization failed on initial run. [GH-2908]
  - core: Fix namespace invalidation on standby when
    disable_cache=true is set. [GH-2822]
  - core: Loosen overly strict check for view path check,
    strictly forbidding .. as a substring within path segments.
    [GH-2910]
  - secret/database, secret/openldap, secret/rabbitmq: Fix
    dynamic secret requests failing with an "Internal Server
    Error" on standby nodes [GH-2853]
  * What's Changed
  - Add note for direct install using the Arch Linux package
    manager (#2718 by @hashworks) backported by @hashworks in
    [#2719]
  - fix: some dynamic secret engines did not forward the request
    to the primary (#2853 by @phil9909 ) backported by @phil9909
    in #2855
  - Fix namespace invalidation without caching (#2822 by
    @cipherboy) backported by @phil9909 in #2856
  - Make self-init failures fatal (#2908 by @satoqz &amp; #2195
    @KrzysztofKornalewski-Reply) backported by @satoqz in #2924
  - v2.5.3 dependency bumps by @satoqz in #2907
  - Forbid path traversal by default (#2910 @cipherboy)
    backported by @satoqz in #2929
  - Check certificate match during renewal (#2932 by @cipherboy)
    backported by @satoqz in #2937
  - Correctly quote schema name in PostgreSQL revoke (#2931 by
    @cipherboy) backported by @satoqz in #2938
  - Prevent cross-namespace token accessor use (#2934 by
    @cipherboy) backported by @satoqz in #2939
  - Additional v2.5.3 dependency bumps by @satoqz in #2930
  - Ensure lease revocation on namespace re-deletion (#2935 by
    @cipherboy) backported by @satoqz in #2943
  - Validate downloaded plugin binary size (#2941 by @JanMa)
    backported by @satoqz in #2944
  - Forbid generate-root by default (#2912 by @cipherboy)
    backported by @cipherboy in #2945
  - Add release notes for v2.5.3 by @satoqz in #2946</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1779364800">- Update to version 2.5.4:
  * SECURITY
  - core/auth: Fix audit logs dropping custom headers when using
    inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076]
  - core: Prevent hidden default token issuance from auth plugin
    endpoints returning both a logical.Auth{} response object and
    an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150]
  - core: Remove legacy lease endpoints (sys/revoke, sys/renew,
    sys/revoke-prefix, and sys/revoke-force) due to
    cross-namespace lease modification. GHSA-v8v8-cm84-m686 /
    CVE-2026-45808. [GH-3152]
  * IMPROVEMENTS
  - storage/postgresql: Set constraint name to table+"_pkey" and
    ha_table+"_pkey" and index to table+"_idx" for uniqueness
    when reusing the same database partition for multiple OpenBao
    instances. [GH-2876]
  * BUG FIXES
  - auth/kerberos: Do not return logical.Auth{} response during
    initial negotiation at the same time as an error. [GH-3150]
  - core/mfa: Handle invalidation for login MFA, ensuring standby
    nodes respond appropriately on writes. [GH-3083]
  - core/policies: Fix list_scan_response_keys_filter_path
    incorrectly erring on empty list responses. [GH-3063]
  - core/quotas: Correctly handle default rate limit exempt paths
    on quota configuration invalidation. [GH-2953]
  - core: Disallow logical secret engines from creating
    authentication tokens. [GH-3087]
  - core: Forward generate-root, step-down and rekey requests to
    active node to resolve inconsistent standby behavior.
    [GH-3006]
  - storage/raft: Wait for autopilot shutdown to avoid panic when
    racing to retrieve known servers. [GH-3054]
  - storage/postgresql: Revert accidental rename of ha_table
    option to haTable. Both spellings are now supported to retain
    compatibility, though ha_table takes precedence. [GH-2876]
  * What's Changed
  - Remove 2.5.x community docs by @cipherboy in #3071
  - Disallow non-auth plugins from creating tokens (#3087 by
    @cipherboy) backported by @phil9909 in #3112
  - Handle invalidation of LoginMFA keys (#3083 by @cipherboy)
    backported by @phil9909 in #3113
  - Fix audit logs dropping custom headers when using inline auth
    (#3076 by @jackyliao123) backported by @phil9909 in #3114
  - fix: nil-guard d.autopilot before calling GetState (#3054 by
    @mpldr) backported by @phil9909 in #3115
  - fix: Fix request handling filtering for the no data case
    (#3063 by @eklatzer) backported by @phil9909 in #3116
  - Update vulnerable deps before 2.5.4 by @cipherboy in #3121
  - Fix cache invalidation memory leak (#3105 by @cipherboy)
    backported by @phil9909 in #3131
  - Use unique constraints, indices in PostgreSQL storage (#2876
    by @cipherboy) backported by @phil9909 in #3132
  - Correctly handle default_rate_limit_exempt_paths_toggle
    invalidation (#2953 by @cipherboy) backported by @phil9909 in
    [#3134]
  - Fix /v1/sys/ forwarding regressions for standby instances
    (#3006 by @tsaarni) backported by @phil9909 in #3133
  - Remove legacy cross-namespace lease endpoints (#3152 by
    @cipherboy) backported by @cipherboy in #3153
  - Prevent errors from creating orphaned tokens (#3150 by
    @cipherboy) backported by @cipherboy in #3151
  - Add release notes for v2.5.4 by @satoqz in #3154</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781784000">- Update to version 2.5.5:
  * SECURITY
  - auth/ldap: Prevent unlikely post-bind LDAP injection via bind
    DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306]
  - secrets/ldap: Prevent potential LDAP injection with
    unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9.
    [GH-3306]
  - secrets/transit: Prevent server crash due to unlock of
    unlocked mutex for RSA keys created with derived=true.
    GHSA-8w8f-r2xv-4q4j. [GH-3309]
  - core/leases: Fix unauthorized cross-namespace lease
    revocation via leaked lease identifiers. GHSA-c36x-h252-g9x2.
    [GH-3307]
  - core/namespaces: Fix namespace path canonicalization of
    "root" enabling unauthorized operations on the parent
    namespace. GHSA-mwr2-wmgp-crj6. [GH-3308]
  * BUG FIXES
  - core/ha: Return to read-enabled standby mode instead of
    read-disabled standby mode after stepping down from active
    mode when standby reads are enabled. This also fixes SIGHUPs
    crashing standby nodes if they've previously stepped down
    from active. [GH-3223]
  - auth/mfa: Correctly forward two-phase MFA validations on
    standby nodes. [GH-3246]
  - sys/namespaces: Support clearing a namespace's
    custom_metadata by providing a patch that sets
    custom_metadata to null at the top-level. [GH-3273]
  - sys/plugins: Fix /sys/plugins/catalog and
    /sys/plugins/catalog/&lt;type&gt; not returning versioned plugins.
    [GH-3186]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784116800">- Update to version 2.6.0:
  * FEATURES
  - Namespace Sealing: Allow Shamir seal configuration on
    namespace creation. [GH-3297]
  - Partitions tenant storage with distinct cryptographic key
    material.
  - Allows tenants to revoke access to their namespace via seal
    operation without impacting other tenants.
  - Uses global synchronization of namespace seal status,
    allowing easier management from multi-node deployments.
  - Auto Unseal plugins: Add a new kms plugin type that enables
    Auto Unseal mechanisms to be distributed as external binary
    plugins. [GH-2586]
  - Declaratively register KMS plugins via plugin "kms" "name"
    { } stanzas in the server configuration, making "name"
    available as an Auto Unseal mechanism via seal "name" { }.
  - KMS plugins automatically restart and recover from crashes,
    avoiding a full instance restart when a seal reaches a bad
    state (e.g., via a misbehaving PKCS#11 library).
  - Pre-built plugins for many of the seals currently built
    into OpenBao are available at
    https://github.com/openbao/openbao-plugins. A plugin-based
    seal takes priority over a built-in seal if a matching
    plugin is installed. Note that several provider-specific
    built-in seals will be removed from OpenBao in v2.7.0 and
    remain available as external plugins only. Also see the
    deprecations section of these release notes.
  - Develop custom Auto Unseal mechanisms tailored to your use
    case using the SDK.
  - Workflows: This adds new endpoints under sys/workflows to
    allow operators to create workflows and users to execute
    them.
  - Workflows allow the creation of simplified or managed
    interfaces over OpenBao's standard API.
  - Use of the allow_unauthenticated_workflows server
    configuration value enables unauthenticated execution of
    workflows; any dispatched requests still require
    authentication but this can be provided as a request
    parameter.
  - Workflows are built on the common profile engine powering
    declarative self-initialization and use the same syntax.
    [GH-2728]
  - Authenticated root generation: New /sys/generate-root-token
    endpoints are available as replacements for the deprecated
    unauthenticated ones. [GH-3041]
  * SECURITY
  - command/agent: Ensure previously rendered secrets do not
    appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
  - core/recovery: Use constant-time token comparison in recovery
    mode. GHSA-34fc-gh42-pj53. [GH-3388]
  - core/policies: Prevent LIST operations bypassing capabilities
    = ["deny"] from a more specific wildcard ACL grant.
    GHSA-xp3c-3jw3-4vcr. [GH-3389]
  - core/policies: If the value of a template expression contains
    a + or * character, it will now be rejected by default. Set
    allow_wildcards_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - core/policies: If the value of a template expression contains
    a / character, it will now be rejected by default. Set
    allow_slashes_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/pki: If the value of a template expression in
    allowed_uri_sans_template and allowed_domains contains a *
    character, it will now be rejected by default. Set
    allow_globs_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  - secret/ssh: If the value of a template expression in
    allowed_users or allowed_domains contains a , character, it
    will now be rejected by default. Set
    allow_commas_in_identity_templates = true to overwrite.
    GHSA-59w7-v8rr-pr4p. [GH-3401]
  * IMPROVEMENTS
  - command: Allow overriding the location of ~/.vault-token via
    the BAO_TOKEN_PATH environment variable. [GH-2706]
  - command/server: Error when unknown keys are present in the
    declarative self-initialization configuration. [GH-2883]
  - command/server: Add CEL support to self-initialization,
    allowing finer control over structuring requests. [GH-2671]
  - command/server: Add text/template support to
    self-initialization, allowing templating of values from other
    requests/responses. [GH-2727]
  - command/server: Allow conditional execution of
    self-initialization requests with when keyword. [GH-2739]
  - command/server: Allow self-initialization stanzas in
    development server mode. [GH-2463]
  - command/server: Allow setting headers on declarative
    self-initialization requests. [GH-2737]
  - command/agent: Add uid and gid configuration options for the
    file sink. [GH-2851]
  - command/agent: SIGHUP now reloads the client TLS
    configuration. [GH-3038]
  - command/login: Support Kubernetes service account token
    authentication via -method=kubernetes with both interactive
    and non-interactive modes. [GH-1891]
  - http: Always include full JSON parse and complexity errors in
    the response instead of hiding it behind a constant error
    message. [GH-3240]
  - http: Ensure that passthrough_request_headers can pass the
    Host header to plugins. [GH-3325]
  - core: The sys/ backend is now a singleton shared across all
    namespaces, reducing idle memory usage of the OpenBao
    instance. [GH-3007]
  - core/leases: Lease lookup responses will now include path,
    namespace_path and revoke_error. [GH-1906]
  - core/listeners: Add a parameter to allow cross-origin
    requests to include credentials
    (Access-Control-Allow-Credentials header). [GH-2262]
  - core/profiles: Canonicalize headers before evaluating
    request. [GH-3465]
  - core/profiles: Parse login MFA from request header
    information. [GH-3465]
  - seal/azurekeyvault: Support explicitly setting Azure
    authentication methods and add support for authenticating
    using Azure managed identities. [GH-2519]
  - seal/pkcs11: When using public/private key encryption, fall
    back to finding the public key via the private key's CKA_ID
    if both key halves did not share the same CKA_LABEL.
    [GH-3231]
  - physical/raft: Detect, log, and rollback transactions that
    have never been committed or rolled-back. If you see the
    message "transaction was leaked" in your logs, please open an
    issue. [GH-2185]
  - physical/raft: Improve snapshot duration while slightly
    increasing snapshot size. [GH-3061]
  - physical/raft: Support auto_join via DNS SRV records.
    [GH-3397]
  - auth/cert: Add support for X-Tls-Client-Cert, to allow
    processing of a leaf certificate forwarded from a
    TLS-terminating reverse proxy. [GH-2080]
  - auth/jwt: Add new Kubernetes JWT provider that authenticates
    to the Kubernetes API using a pod's service account token.
    [GH-2114]
  - auth/kerberos: Add the decode_pac option in order to improve
    compatibility with Kerberos systems. [GH-2211]
  - auth/userpass: Add password_hash field to allow providing a
    pre-hashed bcrypt password instead of plaintext. [GH-2702]
  - secrets/pki: Add encode_json and decode_json CEL helpers.
    [GH-1549]
  - secrets/totp: Add generated, expire_time, and period fields
    to code generation response. [GH-2585]
  - secrets/ssh: Search for public and private key files if
  - public-key-path and -private-key-path flags aren't given,
    respectively. [GH-2419]
  - database/mysql: Add multi-host connection failover support.
    Connection URLs can now specify multiple hosts (e.g.,
    tcp(host1:3306,host2:3306)) for automatic failover when a
    host becomes unavailable. [GH-2312]
  - api, sdk: Add additional constants for commonly used headers.
    [GH-2323]
  - api: Add ClientCertBytes and ClientKeyBytes as possible
    in-memory cert contents in TLSConfig. [GH-2798]
  - api: Add first-class support for /sys/namespaces APIs via
    .Sys().CreateNamespace(...) &amp; co. [GH-2955]
  - api: Add methods to list and scan keys to the KVv1 and KVv2
    client. [GH-3220]
  - api: Allow disabling automatic configuration from environment
    variables in the API client via a DisableEnvironment field on
    Config and a NewConfig constructor to create clean client
    configurations. [GH-2834]
  - sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB.
    [GH-2464]
  - ui: Add lang="en" attribute to html tag. [GH-2580]
  - ui: Update EmberJS to v4.12 LTS. [GH-2653]
  * CHANGES
  - command: Remove buffering and delayed release of logs during
    startup phase of server, agent, proxy &amp; debug subcommands.
    This includes the removal of the undocumented and hidden
  - disable-gated-logs flag. [GH-2620]
  - command: operator generate-root now uses the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - core: net/http.ServeMux in Go 1.26 now uses a 307 redirect
    instead of a 301 redirect when given a bare path which
    doesn't exist in the multiplexer but which a path with a
    trailing slash exists for. This causes some POST/PUT
    operations to fail with a 400 instead of 404, as OpenBao does
    not allow writes to paths ending in a slash. See also:
    https://go.dev/doc/go1.26. [GH-3072]
  - core/identity: Remove corrupt namespace identity groups
    created prior to v2.5.0 during unseal; affected groups must
    be recreated by an administrator. Check for deleting corrupt
    group in server startup logs. [GH-2454]
  - sys/init, sys/rekey/init: The stored_shares parameter was
    removed and will now be ignored. [GH-2662]
  - sys/seal-status: Renamed misleading build_date response field
    to commit_date. [GH-2678]
  - sys/version-history: Renamed misleading build_date response
    field to commit_date. [GH-2678]
  - api: Removed the StoredShares field from InitRequest and
    RotateInitRequest structs. [GH-2662]
  - api: (*Sys).GenerateRoot* methods now use the authenticated
    /sys/generate-root-token endpoints instead of the deprecated
    /sys/generate-root endpoints. [GH-3190]
  - packaging: Renamed misleading ldflags definition BuildDate to
    CommitDate. Build systems need to adjust their pipelines to
    reflect this change. [GH-2678]
  - packaging/container: Removed name, maintainer, vendor,
    version, release, revision, summary, and description labels
    from container images in favor of the already attached
    OpenContainers labels. If you have tooling that relies on
    these labels, instruct it to use the OpenContainers labels
    instead. [GH-2589]
  - packaging/container: The openbao &amp; openbao-hsm container
    images now run under the openbao user rather than the root
    user by default, matching the default behavior of openbao-ubi
    variants: Note that the container entrypoint will always drop
    down to the openbao user before starting OpenBao even if
    started as root. The additional capabilities are only used
    pre-startup to automatically fix up permissions of files
    accessed by OpenBao. [GH-2589] If you rely on the container
    initially running as root by default, you can revert to this
    behavior by manually specifying the user in your container
    engine.
  - packaging/ui: Switch from yarn to pnpm. [GH-2791]
  - releases: Artifacts on GitHub now follow consistent naming
    across archives, SBOMs and signatures. Most notably, "x86_64"
    or "amd64" is now always "amd64", and the operating system is
    always lowercased. [GH-3209]
  - releases: Checksums are now provided as a single,
    consolidated checksums.txt artifact as opposed to per-OS
    checksum files such as checksums-linux.txt. [GH-3209]
  * BUG FIXES
  - command: Fix bao operator rotate-keys and bao operator rekey
    warning about new key shares when rotating the barrier root
    key only. [GH-2648]
  - command/agent: Fix in-memory sink panic when proxying
    auth/token/lookup-self while unauthenticated. [GH-3462]
  - command/server: Revoke the transient root token after
    declarative self-initialization, including failure paths.
    [GH-3346]
  - core: Propagate keyring upgrades of sealable namespaces to
    read-enabled standby nodes. [GH-3409]
  - core/seal: Fix /sys/rotate/root/update returning a random,
    unused key share value when rotating the barrier root key
    using recovery keys. [GH-2648]
  - core/listeners: Close HTTP servers first before closing the
    underlying listener. [GH-2703]
  - core/namespaces: Fix PATCH on a namespace returning status
    500 on missing or nonexistent namespace. [GH-2955]
  - core/audit: Ensure config-driven audit mounts are removed
    from storage when removed from configuration. [GH-3488]
  - core/audit: Include request.id for path-help audit entries
    [GH-3440]
  - core/auth: Ensure inline auth does not generate in-memory
    lease information. [GH-3343]
  - core/mfa: Handle invalidation for login MFA within
    namespaces, ensuring standby nodes respond appropriately on
    writes. [GH-3283]
  - core/workflows: Ensure logical.Request.Connection is set to
    allow certificate auth and login MFA to work. [GH-3465]
  - seal/pkcs11: Fix "invalid key format" error when key_id is
    provided but key_label is not. [GH-3231]
  - seal/pkcs11: Properly strip hex prefix when setting key_id as
    hex value. [GH-3231]
  - physical/raft: Forward bootstrap challenge/answer requests to
    active node, fixing raft join failures via load balancer.
    [GH-2976]
  - sys/plugin: Fix plugin reload returning success for
    non-existent plugin. [GH-2398]
  - sys/quotas: Fix unintentional attempts to delete quotas on
    standby nodes when mount is removed. [GH-3316]
  - sys/raw: Prevent writes to and return distinctive error
    reading storage associated with sealed namespaces. [GH-3426]
  - secrets/pki: Add missing migration for not_after_bound and
    not_before_bound role fields. [GH-3031]
  - secrets/pki: /sign-verbatim now preserves the original
    subject encoding from the CSR. Previously, UTF8String values
    were re-encoded as PrintableString when the subject contained
    only ASCII characters. [GH-2861]
  - openapi: Add missing support for reporting SCAN on endpoints.
    [GH-2902]
  - openapi: Add missing support for reporting PATCH support on
    endpoints. [GH-3289
  * DEPRECATIONS
  - core/seal: Following the introduction of pluggable Auto
    Unseal support in this release, the built-in versions of the
    alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and
    pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and
    remain available as external plugins only. [GH-2586]
  - physical/file: Deprecate file storage backend for removal in
    v2.7.0. [GH-2849]
  - packaging, seal/pkcs11: Following the introduction of
    pluginized HSM/PKCS#11 Auto Unseal support in this release,
    the HSM distribution of OpenBao will be discontinued by
    v2.7.0. PKCS#11 support remains available via the PKCS#11
    plugin which can be used together with the standard
    distribution of OpenBao. [GH-2586]
  - packaging: Drop builds for 32-bit ARM Windows as part of its
    removal from Go 1.26. [GH-3191]
  - packaging/container: Architecture-specific container image
    tags such as openbao/openbao:2.6.0-arm64 will not be
    published starting with this release. Refer to multi-arch
    container images instead (simply openbao/openbao:2.6.0).
    [GH-3209]
  - auth/kerberos: The built-in Kerberos auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/ldap: The built-in LDAP auth plugin has been deprecated
    and slated for removal from the main OpenBao binary
    distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - auth/radius: The built-in RADIUS auth plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]
  - secret/ldap: The built-in LDAP secrets plugin has been
    deprecated and slated for removal from the main OpenBao
    binary distribution in v2.7.0. It will be included in
    openbao-plugins going forward. [GH-3371]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 2.6.1:
  * IMPROVEMENTS
  - core: Warn on sys/ key with no explicit invalidation handler;
    please report if you see a log line with no mechanism to
    invalidate cache. [GH-3555]
  - core/policies: Introduce PATCH operation support for
    modifying the values of specific parameters. [GH-3506]
  * BUG FIXES
  - core/expiration: Ensure leases are not inadvertently cached
    on standby nodes. [GH-3555]
  - core/policies: Allow removal of expiration from policies on
    POST/PUT to sys/policies/acl/&lt;name&gt; by eliding the parameter;
    use PATCH to update policies without modifying unnecessary
    parameters. [GH-3506]
  - core/policies: Fix limit=0 and negative limits bypassing the
    pagination_limit ACL option. [GH-3518]
  - core/policies: Fix persistence of new
    allow_wildcards_in_identity_templates,
    allow_slashes_in_identity_templates parameters in storage.
    [GH-3506]
  - auth/approle: Ensure initial salt is created without
    transaction to avoid deadlocks. [GH-3556]
  - auth/jwt: Fix patch operation of CEL roles losing existing
    data (bound_audiences not_before_leeway, clock_skew_leeway
    and expiration_leeway). [GH-3551]
  - auth/token: Ensure salt cache is invalidated properly on
    standby nodes. [GH-3555]
  - sdk/plugin: Ensure all log messages are visible under
    plugin.ServeMultiplex(...) by default to align with
    plugin.Serve(...). [GH-3536]
  - sdk: Better support non-usr-merged distributions in
    containerized testing. [GH-3554]
  * What's Changed
  - Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo)
    backported by @satoqz in #3524
  - Fix policy persistence issue, introduce PATCH support for
    policies (#3506 by @cipherboy) backported by @phil9909 in
    [#3538]
  - Allow all log messages in multiplexed plugins (#3536 by
    @cipherboy) backported by @phil9909 in #3537
  - Fix limit=0 and negative limits bypassing pagination_limit
    ACL cap (#3518 by @RealFakeAccount) backported by @phil9909
    in #3548
  - Fix profile source headings, response field (#3550 by
    @cipherboy) backported by @phil9909 in #3553
  - auth/jwt: fix patch operation of CEL roles lost data (#3551
    by @phil9909) backported by @phil9909 in #3552
  - Fix lease renewal cache invalidation (#3555 by @cipherboy)
    backported by @phil9909 in #3566
  - Ensure AppRole salt is created without transaction (#3556 by
    @cipherboy) backported by @phil9909 in #3565</changelog>
</package>
<package pkgid="bbb3aca42909b42f668604ff0af20f8f9efbee82cd456ec59ad016feb1b2007c6ba12df3c1c1d24e9725a90ecb0ecb86830a8f91590ff3be0ec22968f5a77bf5" name="opendoas" arch="s390x">
  <version epoch="0" ver="6.8.2" rel="1.10"/>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1612180800">- Initial package. PLEASE BE AWARE THAT THIS PACKAGE HAS NOT BEEN AUDITED BY
  THE SUSE SECURITY TEAM!</changelog>
  <changelog author="Cameron Rapp &lt;camspam@redhyena.net&gt;" date="1614859200">- Add support for build without usretc.</changelog>
  <changelog author="Joshua Smith &lt;jsmithfpv@gmail.com&gt;" date="1687694400">- Update to 6.8.2:
  * Adds a patch from PR#92 to aborting early if argv is not set
    or empty</changelog>
</package>
<package pkgid="1ac2f3f6a8a1529f61307cc20c099de85ed74d6af6049f9c8edfb061c05597f70e86421b931bb598c3a27060b65ef79417ab8ea937988f6a521911143902f8d8" name="opendoas" arch="src">
  <version epoch="0" ver="6.8.2" rel="1.10"/>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1612180800">- Initial package. PLEASE BE AWARE THAT THIS PACKAGE HAS NOT BEEN AUDITED BY
  THE SUSE SECURITY TEAM!</changelog>
  <changelog author="Cameron Rapp &lt;camspam@redhyena.net&gt;" date="1614859200">- Add support for build without usretc.</changelog>
  <changelog author="Joshua Smith &lt;jsmithfpv@gmail.com&gt;" date="1687694400">- Update to 6.8.2:
  * Adds a patch from PR#92 to aborting early if argv is not set
    or empty</changelog>
</package>
<package pkgid="77925b94be8cf3a70ec01efe2c78cf4b495a862941994dac5f21feb110caa8bca54de503fce6750d5349b0a607127f76d8ea599e2705dd4f39617864222f94d2" name="opendoas-debuginfo" arch="s390x">
  <version epoch="0" ver="6.8.2" rel="1.10"/>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1612180800">- Initial package. PLEASE BE AWARE THAT THIS PACKAGE HAS NOT BEEN AUDITED BY
  THE SUSE SECURITY TEAM!</changelog>
  <changelog author="Cameron Rapp &lt;camspam@redhyena.net&gt;" date="1614859200">- Add support for build without usretc.</changelog>
  <changelog author="Joshua Smith &lt;jsmithfpv@gmail.com&gt;" date="1687694400">- Update to 6.8.2:
  * Adds a patch from PR#92 to aborting early if argv is not set
    or empty</changelog>
</package>
<package pkgid="e55770e367e85c2cc073d30ca2a39fd05115a277c188569b7e81a8e2cc635ca7f4bf955f250b22d8ea03eaf21fdde52a6562f9d25235a265b19ab78989c3c97d" name="openscap" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="295.8"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1674129600">- 0001-Use-correct-includes.patch: fixed build with rpm 4.18</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1674475200">- Require systemd for building, was pulled in before by indirect
  dependencies which don't exist anymore</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.3.7:
  * openscap-1.3.7
  * Bump soname from 25.5.0 to 25.5.1
  * Bump version to openscap-1.3.7
  * Fix typos in docs
  * Remove a check for suspicious files
  * Add debian_evr_string tests to CMakeLists
  * Add a few unittests for debian_evr_string
  * Remove To be done
  * Move release guide to upstream
- add 0005-rename-requires-reqs-for-C-20-compatibility.patch
- rename patches
  openscap-opensuse-cpe.patch to 0001-Add-openSUSE-cpe-links.patch
  openscap-suse-cpe.patch to 0002-Add-SUSE-cpe-links.patch
  openscap-docker-add-suse.patch to 0003-Use-openSUSE-SUSE-cpe-links.patch
  oscap-remediate.service.in.patch to 0004-oscap-remediate-is-located-in-bindir.patch
- drop 0001-Use-correct-includes.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680091200">- remove _service confusion, we use final tarballs.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1687348800">- openscap 1.3.8
  * New features
  - The boot-time remediation service for systemd's Offline Update mode is now disabled by default
  - Add offline capabilities to the shadow OVAL probe
  - Add offline capabilities to the sysctl OVAL probe
  - Add 'auristorfs' to list of network fileystems
  - Add new experimental linux-bound fwupdsecattr probe for system firmware security attributes (fwupd-based)
  * Maintenance, bug fix
  - Use ListUnitFiles D-Bus method to fetch all units in systemd OVAL probe
  - Fix minor resource leaks</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 1.3.9:
  * use PCRE2 library
  * Fix offline mode (OVAL/sysctl)
  * Fix leak of dpkg cache when dpkginfo_init is called multiple times
  * Fix un-expanded variable in xccdf report output
  * Fix issues when parsing profiles
  * Fix minor problems and resource leaks</changelog>
  <changelog author="Jaime Marqu&#xED;nez Ferr&#xE1;ndiz &lt;jaime.marquinez.ferrandiz@fastmail.net&gt;" date="1709035200">- Use the correct documentation's path.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710936000">- update to 1.3.10:
  * New features
  - Dump all env. variables that affects the behaviour on INFO log level
  - Support Blueprint services customization for masking
  - Fix Blueprint template to be self-contained
  - Add a refine-rule tailoring ability to autotailor
  - Introduce JSON tailoring import option for autotailor
  - Select rules based on reference
  - Skip certain paths from scanning (controlled via env. variable)
  - Introduce a limit of collected items (controlled via env. variable)
  * Maintenance, bug fix
  - Fix partition probe for PCRE2
  - Fix NSS crypto backend
  - Wrap Bash snippets in a subshell when generating a fix script
  - Improve references in HTML guides and reports
  - Update html report with OVAL details
  - Rewrite dpkginfo probe without using APT
  - Fix incorrect openscap-cpe-oval result filename
  - Implement xccdf_session_get_rule_results function in XCCDF session API
  - Implement xccdf_session_result_reset function in XCCDF session API
- drop 0005-rename-requires-reqs-for-C-20-compatibility.patch: fixed upstream</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1710936001">- Rename oscap-docker to oscap-containers and provide oscap-podman as well
  (Relates to jsc#SLE-12852)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1714824000">- 0001-Add-openSUSE-cpe-links.patch: added Leap 15.6</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1726488000">- disable sendmail buildrequires (seems unused)
- only use distribution-release to make work everywhere</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1736337600">- update to 1.4.1:
  * New features
  - Introduce "oscap-im" - script that can be used in Containerfiles to build
  - hardened bootable container images to run as Image Mode Operating System
    Maintenance, bug fix
  - Add support for containers with no entrypoint/cmd in "oscap-docker"
  - Stop printing useless component reference information in "oscap info"
  - Fix missing declaration of PATH_MAX on Solaris
  - Fix RPM database path in RPM probes (RHEL-55251, #2151)
  - Fix issues reported by OpenScanHub after 1.4.0 release
  - Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x
  - architecture
  - Ensure xlink namespace exists (RHEL-34104)
  - Minor fixes in test suite and CI
- update to 1.4.0:
  * New features
  - Introduce ability to generate Kickstarts for unattended OS installation using the oscap xccdf generate fix --fix-type kickstart command
  - Add ability to process multi-profile JSON tailorings by the autotailor tool
  * Removed features
  - Removed cve, cvss, cvrf modules
  - Removed ds submodules sds-compose, sds-add, sds-split, rds-create, rds-split
  - Removed --template, --oval-template and --sce-template options from the xccdf generate submodule
  - Remove the --skip-valid option (replaced by --skip-validation)
  * Maintenance, bug fix
  - Advertise path to SSG in remediation scripts
  - Remove the option to build with PCRE
  - Process CPE AL platforms if CPE dictionary isn't part of data stream
  - Disable GConf probe by default (and remove dependencies from docs)
  - Disable MD5 and SHA-1 by default
  - Remove CPE dictionary
  - Fix compiler warnings
  - Update User Manual
- Remove SUSE/openSUSE CPE dictionary patches.
  * drop 0001-Add-openSUSE-cpe-links.patch
  * drop 0002-Add-SUSE-cpe-links.patch
- Set .so version to 33.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1779105600">- update to 1.4.4:
  * New features
  - List rules and variables in a profile by "oscap info"
  * Maintenance, bug fix
  - Add null check for ns_uri in cpe_dict_detect_version_priv
  - Fix autotailor json bugs
  - Use stable _init_completion API in bash completion
  - Add PanFS to the list of remote filesystems
  - Move to localtime_r
  - Fix Non-constant format string issues
  - Fix schema ordering when adding tailoring to ARF files
  - Fix null ptr deref in xccdf_benchmark_parse
  - Fix name space nulls in OVAL
  - Fix segfault in error handling for cpe_item_parse
  - Always check the current lists before inserting on blueprints
- update to 1.4.3:
  * New features
  - Show rule details in output
  * Maintenance, bug fix
  - Fix inverted fields in HTML report
  - Add new STIG URL - 1.4
  - Bump OVAL_SUPPORTED to 5.11.3
  - Handle virtual packages in dpkginfo probe
  - Inherit environment for scanning and remediating in oscap-im wrapper
  - Fix the way we check rpm library version in CMake
  - Explicitly allow xmlsec1 to load key data from KeyValue
  - Fix double-free in xccdf_policy_remediate.c
  - Fix unterminated-string-initialization errors
  - Inherit OpenSCAP environment when executing Bash remediations with --remediate option
  - Fix verbose command line option
- update to 1.4.2:
  * Maintenance, bug fix
  - Fix thread synchronization bugs
  - Fix textfilecontent54_probe behaviour for negative instance numbers
  - Fix signature obtaining in rpm_info probe</changelog>
</package>
<package pkgid="61b370ea75f9c350afb784fe4e52b0acb467476b0b0fb98d6d4190e9bf3daa6c97bffe0dda3edbfbcddd5d89c67e662cd79b2feef58288e6915a3c8f6d6d048c" name="openscap" arch="src">
  <version epoch="0" ver="1.4.4" rel="295.8"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1629374400">- Since upstream has moved to Python 3, switch the BuildRequires from
  python-devel to python3-devel.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1633348800">- ship python3 docker module always</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1638878400">- openscap-docker-add-suse.patch: add SLES support oscap-docker
  (bsc#1179314)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1642680000">- openscap 1.3.6
  * New features
  - Select and exclude groups of rules on the command line
  - The boot-time remediation service for systemd's Offline Update mode
  - Memory limit control using OSCAP_PROBE_MEMORY_USAGE_RATIO environment variable
  - Allow disablement of SHA-1 and MD5
  - Allow providing pre-downloaded components
  - Introduce OSBuild Blueprint fix type
  * Maintenance, bug fix
  - Fix coverity issues
  - Patch the `segfault` in dpkginfo_fini()
  - Add an alternative source of hostname
  - Fail download on HTTP errors
  - Compile "environmentvariable_probe" on Windows
  - FreeBSD build and test fixes
  - Add offline mode for password probe
  - Initialize crypto API only once
  - Fix UBI 9 scan
  - oval/yamlfilecontent: Add 'null' values handling
  - Do not set Rpath
  - Do not split `XCCDF:requires` with multiple `idrefs`
  - Allow empty /proc in offline mode
- oscap-remediate is shipped via /usr/bin
  Added oscap-remediate.service.in.patch
- spec-cleaner run</changelog>
  <changelog author="Bj&#xF8;rn Lie &lt;bjorn.lie@gmail.com&gt;" date="1645272000">- Conditionally drop optional gconf2-devel BuildRequires for
  openSUSE Tumbleweed and newer: gconf2 is being droppped from
  openSUSE Tumbleweed, build without gconf2 support.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1663243200">- added Leap 15.4 and 15.5 dictionary entries. (bsc#1203408)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1663761600">- require shared library in the same version or newer</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1674129600">- 0001-Use-correct-includes.patch: fixed build with rpm 4.18</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1674475200">- Require systemd for building, was pulled in before by indirect
  dependencies which don't exist anymore</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.3.7:
  * openscap-1.3.7
  * Bump soname from 25.5.0 to 25.5.1
  * Bump version to openscap-1.3.7
  * Fix typos in docs
  * Remove a check for suspicious files
  * Add debian_evr_string tests to CMakeLists
  * Add a few unittests for debian_evr_string
  * Remove To be done
  * Move release guide to upstream
- add 0005-rename-requires-reqs-for-C-20-compatibility.patch
- rename patches
  openscap-opensuse-cpe.patch to 0001-Add-openSUSE-cpe-links.patch
  openscap-suse-cpe.patch to 0002-Add-SUSE-cpe-links.patch
  openscap-docker-add-suse.patch to 0003-Use-openSUSE-SUSE-cpe-links.patch
  oscap-remediate.service.in.patch to 0004-oscap-remediate-is-located-in-bindir.patch
- drop 0001-Use-correct-includes.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680091200">- remove _service confusion, we use final tarballs.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1687348800">- openscap 1.3.8
  * New features
  - The boot-time remediation service for systemd's Offline Update mode is now disabled by default
  - Add offline capabilities to the shadow OVAL probe
  - Add offline capabilities to the sysctl OVAL probe
  - Add 'auristorfs' to list of network fileystems
  - Add new experimental linux-bound fwupdsecattr probe for system firmware security attributes (fwupd-based)
  * Maintenance, bug fix
  - Use ListUnitFiles D-Bus method to fetch all units in systemd OVAL probe
  - Fix minor resource leaks</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 1.3.9:
  * use PCRE2 library
  * Fix offline mode (OVAL/sysctl)
  * Fix leak of dpkg cache when dpkginfo_init is called multiple times
  * Fix un-expanded variable in xccdf report output
  * Fix issues when parsing profiles
  * Fix minor problems and resource leaks</changelog>
  <changelog author="Jaime Marqu&#xED;nez Ferr&#xE1;ndiz &lt;jaime.marquinez.ferrandiz@fastmail.net&gt;" date="1709035200">- Use the correct documentation's path.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710936000">- update to 1.3.10:
  * New features
  - Dump all env. variables that affects the behaviour on INFO log level
  - Support Blueprint services customization for masking
  - Fix Blueprint template to be self-contained
  - Add a refine-rule tailoring ability to autotailor
  - Introduce JSON tailoring import option for autotailor
  - Select rules based on reference
  - Skip certain paths from scanning (controlled via env. variable)
  - Introduce a limit of collected items (controlled via env. variable)
  * Maintenance, bug fix
  - Fix partition probe for PCRE2
  - Fix NSS crypto backend
  - Wrap Bash snippets in a subshell when generating a fix script
  - Improve references in HTML guides and reports
  - Update html report with OVAL details
  - Rewrite dpkginfo probe without using APT
  - Fix incorrect openscap-cpe-oval result filename
  - Implement xccdf_session_get_rule_results function in XCCDF session API
  - Implement xccdf_session_result_reset function in XCCDF session API
- drop 0005-rename-requires-reqs-for-C-20-compatibility.patch: fixed upstream</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1710936001">- Rename oscap-docker to oscap-containers and provide oscap-podman as well
  (Relates to jsc#SLE-12852)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1714824000">- 0001-Add-openSUSE-cpe-links.patch: added Leap 15.6</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1726488000">- disable sendmail buildrequires (seems unused)
- only use distribution-release to make work everywhere</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1736337600">- update to 1.4.1:
  * New features
  - Introduce "oscap-im" - script that can be used in Containerfiles to build
  - hardened bootable container images to run as Image Mode Operating System
    Maintenance, bug fix
  - Add support for containers with no entrypoint/cmd in "oscap-docker"
  - Stop printing useless component reference information in "oscap info"
  - Fix missing declaration of PATH_MAX on Solaris
  - Fix RPM database path in RPM probes (RHEL-55251, #2151)
  - Fix issues reported by OpenScanHub after 1.4.0 release
  - Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x
  - architecture
  - Ensure xlink namespace exists (RHEL-34104)
  - Minor fixes in test suite and CI
- update to 1.4.0:
  * New features
  - Introduce ability to generate Kickstarts for unattended OS installation using the oscap xccdf generate fix --fix-type kickstart command
  - Add ability to process multi-profile JSON tailorings by the autotailor tool
  * Removed features
  - Removed cve, cvss, cvrf modules
  - Removed ds submodules sds-compose, sds-add, sds-split, rds-create, rds-split
  - Removed --template, --oval-template and --sce-template options from the xccdf generate submodule
  - Remove the --skip-valid option (replaced by --skip-validation)
  * Maintenance, bug fix
  - Advertise path to SSG in remediation scripts
  - Remove the option to build with PCRE
  - Process CPE AL platforms if CPE dictionary isn't part of data stream
  - Disable GConf probe by default (and remove dependencies from docs)
  - Disable MD5 and SHA-1 by default
  - Remove CPE dictionary
  - Fix compiler warnings
  - Update User Manual
- Remove SUSE/openSUSE CPE dictionary patches.
  * drop 0001-Add-openSUSE-cpe-links.patch
  * drop 0002-Add-SUSE-cpe-links.patch
- Set .so version to 33.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1779105600">- update to 1.4.4:
  * New features
  - List rules and variables in a profile by "oscap info"
  * Maintenance, bug fix
  - Add null check for ns_uri in cpe_dict_detect_version_priv
  - Fix autotailor json bugs
  - Use stable _init_completion API in bash completion
  - Add PanFS to the list of remote filesystems
  - Move to localtime_r
  - Fix Non-constant format string issues
  - Fix schema ordering when adding tailoring to ARF files
  - Fix null ptr deref in xccdf_benchmark_parse
  - Fix name space nulls in OVAL
  - Fix segfault in error handling for cpe_item_parse
  - Always check the current lists before inserting on blueprints
- update to 1.4.3:
  * New features
  - Show rule details in output
  * Maintenance, bug fix
  - Fix inverted fields in HTML report
  - Add new STIG URL - 1.4
  - Bump OVAL_SUPPORTED to 5.11.3
  - Handle virtual packages in dpkginfo probe
  - Inherit environment for scanning and remediating in oscap-im wrapper
  - Fix the way we check rpm library version in CMake
  - Explicitly allow xmlsec1 to load key data from KeyValue
  - Fix double-free in xccdf_policy_remediate.c
  - Fix unterminated-string-initialization errors
  - Inherit OpenSCAP environment when executing Bash remediations with --remediate option
  - Fix verbose command line option
- update to 1.4.2:
  * Maintenance, bug fix
  - Fix thread synchronization bugs
  - Fix textfilecontent54_probe behaviour for negative instance numbers
  - Fix signature obtaining in rpm_info probe</changelog>
</package>
<package pkgid="3d214189660bbb226ecfc9a2c174d2ffce0f00ee0b39f5cc99949cbdce707b1cd8bf84bd625c4bc0e1295f6be3baf0a224c80a1a1f3fc98f40ebb15b023150d6" name="openscap-containers" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="295.8"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1674129600">- 0001-Use-correct-includes.patch: fixed build with rpm 4.18</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1674475200">- Require systemd for building, was pulled in before by indirect
  dependencies which don't exist anymore</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.3.7:
  * openscap-1.3.7
  * Bump soname from 25.5.0 to 25.5.1
  * Bump version to openscap-1.3.7
  * Fix typos in docs
  * Remove a check for suspicious files
  * Add debian_evr_string tests to CMakeLists
  * Add a few unittests for debian_evr_string
  * Remove To be done
  * Move release guide to upstream
- add 0005-rename-requires-reqs-for-C-20-compatibility.patch
- rename patches
  openscap-opensuse-cpe.patch to 0001-Add-openSUSE-cpe-links.patch
  openscap-suse-cpe.patch to 0002-Add-SUSE-cpe-links.patch
  openscap-docker-add-suse.patch to 0003-Use-openSUSE-SUSE-cpe-links.patch
  oscap-remediate.service.in.patch to 0004-oscap-remediate-is-located-in-bindir.patch
- drop 0001-Use-correct-includes.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680091200">- remove _service confusion, we use final tarballs.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1687348800">- openscap 1.3.8
  * New features
  - The boot-time remediation service for systemd's Offline Update mode is now disabled by default
  - Add offline capabilities to the shadow OVAL probe
  - Add offline capabilities to the sysctl OVAL probe
  - Add 'auristorfs' to list of network fileystems
  - Add new experimental linux-bound fwupdsecattr probe for system firmware security attributes (fwupd-based)
  * Maintenance, bug fix
  - Use ListUnitFiles D-Bus method to fetch all units in systemd OVAL probe
  - Fix minor resource leaks</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 1.3.9:
  * use PCRE2 library
  * Fix offline mode (OVAL/sysctl)
  * Fix leak of dpkg cache when dpkginfo_init is called multiple times
  * Fix un-expanded variable in xccdf report output
  * Fix issues when parsing profiles
  * Fix minor problems and resource leaks</changelog>
  <changelog author="Jaime Marqu&#xED;nez Ferr&#xE1;ndiz &lt;jaime.marquinez.ferrandiz@fastmail.net&gt;" date="1709035200">- Use the correct documentation's path.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710936000">- update to 1.3.10:
  * New features
  - Dump all env. variables that affects the behaviour on INFO log level
  - Support Blueprint services customization for masking
  - Fix Blueprint template to be self-contained
  - Add a refine-rule tailoring ability to autotailor
  - Introduce JSON tailoring import option for autotailor
  - Select rules based on reference
  - Skip certain paths from scanning (controlled via env. variable)
  - Introduce a limit of collected items (controlled via env. variable)
  * Maintenance, bug fix
  - Fix partition probe for PCRE2
  - Fix NSS crypto backend
  - Wrap Bash snippets in a subshell when generating a fix script
  - Improve references in HTML guides and reports
  - Update html report with OVAL details
  - Rewrite dpkginfo probe without using APT
  - Fix incorrect openscap-cpe-oval result filename
  - Implement xccdf_session_get_rule_results function in XCCDF session API
  - Implement xccdf_session_result_reset function in XCCDF session API
- drop 0005-rename-requires-reqs-for-C-20-compatibility.patch: fixed upstream</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1710936001">- Rename oscap-docker to oscap-containers and provide oscap-podman as well
  (Relates to jsc#SLE-12852)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1714824000">- 0001-Add-openSUSE-cpe-links.patch: added Leap 15.6</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1726488000">- disable sendmail buildrequires (seems unused)
- only use distribution-release to make work everywhere</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1736337600">- update to 1.4.1:
  * New features
  - Introduce "oscap-im" - script that can be used in Containerfiles to build
  - hardened bootable container images to run as Image Mode Operating System
    Maintenance, bug fix
  - Add support for containers with no entrypoint/cmd in "oscap-docker"
  - Stop printing useless component reference information in "oscap info"
  - Fix missing declaration of PATH_MAX on Solaris
  - Fix RPM database path in RPM probes (RHEL-55251, #2151)
  - Fix issues reported by OpenScanHub after 1.4.0 release
  - Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x
  - architecture
  - Ensure xlink namespace exists (RHEL-34104)
  - Minor fixes in test suite and CI
- update to 1.4.0:
  * New features
  - Introduce ability to generate Kickstarts for unattended OS installation using the oscap xccdf generate fix --fix-type kickstart command
  - Add ability to process multi-profile JSON tailorings by the autotailor tool
  * Removed features
  - Removed cve, cvss, cvrf modules
  - Removed ds submodules sds-compose, sds-add, sds-split, rds-create, rds-split
  - Removed --template, --oval-template and --sce-template options from the xccdf generate submodule
  - Remove the --skip-valid option (replaced by --skip-validation)
  * Maintenance, bug fix
  - Advertise path to SSG in remediation scripts
  - Remove the option to build with PCRE
  - Process CPE AL platforms if CPE dictionary isn't part of data stream
  - Disable GConf probe by default (and remove dependencies from docs)
  - Disable MD5 and SHA-1 by default
  - Remove CPE dictionary
  - Fix compiler warnings
  - Update User Manual
- Remove SUSE/openSUSE CPE dictionary patches.
  * drop 0001-Add-openSUSE-cpe-links.patch
  * drop 0002-Add-SUSE-cpe-links.patch
- Set .so version to 33.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1779105600">- update to 1.4.4:
  * New features
  - List rules and variables in a profile by "oscap info"
  * Maintenance, bug fix
  - Add null check for ns_uri in cpe_dict_detect_version_priv
  - Fix autotailor json bugs
  - Use stable _init_completion API in bash completion
  - Add PanFS to the list of remote filesystems
  - Move to localtime_r
  - Fix Non-constant format string issues
  - Fix schema ordering when adding tailoring to ARF files
  - Fix null ptr deref in xccdf_benchmark_parse
  - Fix name space nulls in OVAL
  - Fix segfault in error handling for cpe_item_parse
  - Always check the current lists before inserting on blueprints
- update to 1.4.3:
  * New features
  - Show rule details in output
  * Maintenance, bug fix
  - Fix inverted fields in HTML report
  - Add new STIG URL - 1.4
  - Bump OVAL_SUPPORTED to 5.11.3
  - Handle virtual packages in dpkginfo probe
  - Inherit environment for scanning and remediating in oscap-im wrapper
  - Fix the way we check rpm library version in CMake
  - Explicitly allow xmlsec1 to load key data from KeyValue
  - Fix double-free in xccdf_policy_remediate.c
  - Fix unterminated-string-initialization errors
  - Inherit OpenSCAP environment when executing Bash remediations with --remediate option
  - Fix verbose command line option
- update to 1.4.2:
  * Maintenance, bug fix
  - Fix thread synchronization bugs
  - Fix textfilecontent54_probe behaviour for negative instance numbers
  - Fix signature obtaining in rpm_info probe</changelog>
</package>
<package pkgid="cf1e9873eb2e398790f065eea3ea0c84c588b27c900545d1cd13a51a38f2185ea8cd1ceb6700c6ce007b97a5df0c171c59d54e3bd56a779213216f48d7e28ca5" name="openscap-content" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="295.8"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1674129600">- 0001-Use-correct-includes.patch: fixed build with rpm 4.18</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1674475200">- Require systemd for building, was pulled in before by indirect
  dependencies which don't exist anymore</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.3.7:
  * openscap-1.3.7
  * Bump soname from 25.5.0 to 25.5.1
  * Bump version to openscap-1.3.7
  * Fix typos in docs
  * Remove a check for suspicious files
  * Add debian_evr_string tests to CMakeLists
  * Add a few unittests for debian_evr_string
  * Remove To be done
  * Move release guide to upstream
- add 0005-rename-requires-reqs-for-C-20-compatibility.patch
- rename patches
  openscap-opensuse-cpe.patch to 0001-Add-openSUSE-cpe-links.patch
  openscap-suse-cpe.patch to 0002-Add-SUSE-cpe-links.patch
  openscap-docker-add-suse.patch to 0003-Use-openSUSE-SUSE-cpe-links.patch
  oscap-remediate.service.in.patch to 0004-oscap-remediate-is-located-in-bindir.patch
- drop 0001-Use-correct-includes.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680091200">- remove _service confusion, we use final tarballs.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1687348800">- openscap 1.3.8
  * New features
  - The boot-time remediation service for systemd's Offline Update mode is now disabled by default
  - Add offline capabilities to the shadow OVAL probe
  - Add offline capabilities to the sysctl OVAL probe
  - Add 'auristorfs' to list of network fileystems
  - Add new experimental linux-bound fwupdsecattr probe for system firmware security attributes (fwupd-based)
  * Maintenance, bug fix
  - Use ListUnitFiles D-Bus method to fetch all units in systemd OVAL probe
  - Fix minor resource leaks</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 1.3.9:
  * use PCRE2 library
  * Fix offline mode (OVAL/sysctl)
  * Fix leak of dpkg cache when dpkginfo_init is called multiple times
  * Fix un-expanded variable in xccdf report output
  * Fix issues when parsing profiles
  * Fix minor problems and resource leaks</changelog>
  <changelog author="Jaime Marqu&#xED;nez Ferr&#xE1;ndiz &lt;jaime.marquinez.ferrandiz@fastmail.net&gt;" date="1709035200">- Use the correct documentation's path.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710936000">- update to 1.3.10:
  * New features
  - Dump all env. variables that affects the behaviour on INFO log level
  - Support Blueprint services customization for masking
  - Fix Blueprint template to be self-contained
  - Add a refine-rule tailoring ability to autotailor
  - Introduce JSON tailoring import option for autotailor
  - Select rules based on reference
  - Skip certain paths from scanning (controlled via env. variable)
  - Introduce a limit of collected items (controlled via env. variable)
  * Maintenance, bug fix
  - Fix partition probe for PCRE2
  - Fix NSS crypto backend
  - Wrap Bash snippets in a subshell when generating a fix script
  - Improve references in HTML guides and reports
  - Update html report with OVAL details
  - Rewrite dpkginfo probe without using APT
  - Fix incorrect openscap-cpe-oval result filename
  - Implement xccdf_session_get_rule_results function in XCCDF session API
  - Implement xccdf_session_result_reset function in XCCDF session API
- drop 0005-rename-requires-reqs-for-C-20-compatibility.patch: fixed upstream</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1710936001">- Rename oscap-docker to oscap-containers and provide oscap-podman as well
  (Relates to jsc#SLE-12852)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1714824000">- 0001-Add-openSUSE-cpe-links.patch: added Leap 15.6</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1726488000">- disable sendmail buildrequires (seems unused)
- only use distribution-release to make work everywhere</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1736337600">- update to 1.4.1:
  * New features
  - Introduce "oscap-im" - script that can be used in Containerfiles to build
  - hardened bootable container images to run as Image Mode Operating System
    Maintenance, bug fix
  - Add support for containers with no entrypoint/cmd in "oscap-docker"
  - Stop printing useless component reference information in "oscap info"
  - Fix missing declaration of PATH_MAX on Solaris
  - Fix RPM database path in RPM probes (RHEL-55251, #2151)
  - Fix issues reported by OpenScanHub after 1.4.0 release
  - Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x
  - architecture
  - Ensure xlink namespace exists (RHEL-34104)
  - Minor fixes in test suite and CI
- update to 1.4.0:
  * New features
  - Introduce ability to generate Kickstarts for unattended OS installation using the oscap xccdf generate fix --fix-type kickstart command
  - Add ability to process multi-profile JSON tailorings by the autotailor tool
  * Removed features
  - Removed cve, cvss, cvrf modules
  - Removed ds submodules sds-compose, sds-add, sds-split, rds-create, rds-split
  - Removed --template, --oval-template and --sce-template options from the xccdf generate submodule
  - Remove the --skip-valid option (replaced by --skip-validation)
  * Maintenance, bug fix
  - Advertise path to SSG in remediation scripts
  - Remove the option to build with PCRE
  - Process CPE AL platforms if CPE dictionary isn't part of data stream
  - Disable GConf probe by default (and remove dependencies from docs)
  - Disable MD5 and SHA-1 by default
  - Remove CPE dictionary
  - Fix compiler warnings
  - Update User Manual
- Remove SUSE/openSUSE CPE dictionary patches.
  * drop 0001-Add-openSUSE-cpe-links.patch
  * drop 0002-Add-SUSE-cpe-links.patch
- Set .so version to 33.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1779105600">- update to 1.4.4:
  * New features
  - List rules and variables in a profile by "oscap info"
  * Maintenance, bug fix
  - Add null check for ns_uri in cpe_dict_detect_version_priv
  - Fix autotailor json bugs
  - Use stable _init_completion API in bash completion
  - Add PanFS to the list of remote filesystems
  - Move to localtime_r
  - Fix Non-constant format string issues
  - Fix schema ordering when adding tailoring to ARF files
  - Fix null ptr deref in xccdf_benchmark_parse
  - Fix name space nulls in OVAL
  - Fix segfault in error handling for cpe_item_parse
  - Always check the current lists before inserting on blueprints
- update to 1.4.3:
  * New features
  - Show rule details in output
  * Maintenance, bug fix
  - Fix inverted fields in HTML report
  - Add new STIG URL - 1.4
  - Bump OVAL_SUPPORTED to 5.11.3
  - Handle virtual packages in dpkginfo probe
  - Inherit environment for scanning and remediating in oscap-im wrapper
  - Fix the way we check rpm library version in CMake
  - Explicitly allow xmlsec1 to load key data from KeyValue
  - Fix double-free in xccdf_policy_remediate.c
  - Fix unterminated-string-initialization errors
  - Inherit OpenSCAP environment when executing Bash remediations with --remediate option
  - Fix verbose command line option
- update to 1.4.2:
  * Maintenance, bug fix
  - Fix thread synchronization bugs
  - Fix textfilecontent54_probe behaviour for negative instance numbers
  - Fix signature obtaining in rpm_info probe</changelog>
</package>
<package pkgid="2038a2b2ce8dfede93dd17cd031e31db8f13860a724ef56c87dcd22db01ab50d2d844606c3b5b590f49606de92dcbc64c90dcce0acc672cfa416ac535bd1f7b4" name="openscap-debuginfo" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="295.8"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1674129600">- 0001-Use-correct-includes.patch: fixed build with rpm 4.18</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1674475200">- Require systemd for building, was pulled in before by indirect
  dependencies which don't exist anymore</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.3.7:
  * openscap-1.3.7
  * Bump soname from 25.5.0 to 25.5.1
  * Bump version to openscap-1.3.7
  * Fix typos in docs
  * Remove a check for suspicious files
  * Add debian_evr_string tests to CMakeLists
  * Add a few unittests for debian_evr_string
  * Remove To be done
  * Move release guide to upstream
- add 0005-rename-requires-reqs-for-C-20-compatibility.patch
- rename patches
  openscap-opensuse-cpe.patch to 0001-Add-openSUSE-cpe-links.patch
  openscap-suse-cpe.patch to 0002-Add-SUSE-cpe-links.patch
  openscap-docker-add-suse.patch to 0003-Use-openSUSE-SUSE-cpe-links.patch
  oscap-remediate.service.in.patch to 0004-oscap-remediate-is-located-in-bindir.patch
- drop 0001-Use-correct-includes.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680091200">- remove _service confusion, we use final tarballs.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1687348800">- openscap 1.3.8
  * New features
  - The boot-time remediation service for systemd's Offline Update mode is now disabled by default
  - Add offline capabilities to the shadow OVAL probe
  - Add offline capabilities to the sysctl OVAL probe
  - Add 'auristorfs' to list of network fileystems
  - Add new experimental linux-bound fwupdsecattr probe for system firmware security attributes (fwupd-based)
  * Maintenance, bug fix
  - Use ListUnitFiles D-Bus method to fetch all units in systemd OVAL probe
  - Fix minor resource leaks</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 1.3.9:
  * use PCRE2 library
  * Fix offline mode (OVAL/sysctl)
  * Fix leak of dpkg cache when dpkginfo_init is called multiple times
  * Fix un-expanded variable in xccdf report output
  * Fix issues when parsing profiles
  * Fix minor problems and resource leaks</changelog>
  <changelog author="Jaime Marqu&#xED;nez Ferr&#xE1;ndiz &lt;jaime.marquinez.ferrandiz@fastmail.net&gt;" date="1709035200">- Use the correct documentation's path.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710936000">- update to 1.3.10:
  * New features
  - Dump all env. variables that affects the behaviour on INFO log level
  - Support Blueprint services customization for masking
  - Fix Blueprint template to be self-contained
  - Add a refine-rule tailoring ability to autotailor
  - Introduce JSON tailoring import option for autotailor
  - Select rules based on reference
  - Skip certain paths from scanning (controlled via env. variable)
  - Introduce a limit of collected items (controlled via env. variable)
  * Maintenance, bug fix
  - Fix partition probe for PCRE2
  - Fix NSS crypto backend
  - Wrap Bash snippets in a subshell when generating a fix script
  - Improve references in HTML guides and reports
  - Update html report with OVAL details
  - Rewrite dpkginfo probe without using APT
  - Fix incorrect openscap-cpe-oval result filename
  - Implement xccdf_session_get_rule_results function in XCCDF session API
  - Implement xccdf_session_result_reset function in XCCDF session API
- drop 0005-rename-requires-reqs-for-C-20-compatibility.patch: fixed upstream</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1710936001">- Rename oscap-docker to oscap-containers and provide oscap-podman as well
  (Relates to jsc#SLE-12852)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1714824000">- 0001-Add-openSUSE-cpe-links.patch: added Leap 15.6</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1726488000">- disable sendmail buildrequires (seems unused)
- only use distribution-release to make work everywhere</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1736337600">- update to 1.4.1:
  * New features
  - Introduce "oscap-im" - script that can be used in Containerfiles to build
  - hardened bootable container images to run as Image Mode Operating System
    Maintenance, bug fix
  - Add support for containers with no entrypoint/cmd in "oscap-docker"
  - Stop printing useless component reference information in "oscap info"
  - Fix missing declaration of PATH_MAX on Solaris
  - Fix RPM database path in RPM probes (RHEL-55251, #2151)
  - Fix issues reported by OpenScanHub after 1.4.0 release
  - Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x
  - architecture
  - Ensure xlink namespace exists (RHEL-34104)
  - Minor fixes in test suite and CI
- update to 1.4.0:
  * New features
  - Introduce ability to generate Kickstarts for unattended OS installation using the oscap xccdf generate fix --fix-type kickstart command
  - Add ability to process multi-profile JSON tailorings by the autotailor tool
  * Removed features
  - Removed cve, cvss, cvrf modules
  - Removed ds submodules sds-compose, sds-add, sds-split, rds-create, rds-split
  - Removed --template, --oval-template and --sce-template options from the xccdf generate submodule
  - Remove the --skip-valid option (replaced by --skip-validation)
  * Maintenance, bug fix
  - Advertise path to SSG in remediation scripts
  - Remove the option to build with PCRE
  - Process CPE AL platforms if CPE dictionary isn't part of data stream
  - Disable GConf probe by default (and remove dependencies from docs)
  - Disable MD5 and SHA-1 by default
  - Remove CPE dictionary
  - Fix compiler warnings
  - Update User Manual
- Remove SUSE/openSUSE CPE dictionary patches.
  * drop 0001-Add-openSUSE-cpe-links.patch
  * drop 0002-Add-SUSE-cpe-links.patch
- Set .so version to 33.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1779105600">- update to 1.4.4:
  * New features
  - List rules and variables in a profile by "oscap info"
  * Maintenance, bug fix
  - Add null check for ns_uri in cpe_dict_detect_version_priv
  - Fix autotailor json bugs
  - Use stable _init_completion API in bash completion
  - Add PanFS to the list of remote filesystems
  - Move to localtime_r
  - Fix Non-constant format string issues
  - Fix schema ordering when adding tailoring to ARF files
  - Fix null ptr deref in xccdf_benchmark_parse
  - Fix name space nulls in OVAL
  - Fix segfault in error handling for cpe_item_parse
  - Always check the current lists before inserting on blueprints
- update to 1.4.3:
  * New features
  - Show rule details in output
  * Maintenance, bug fix
  - Fix inverted fields in HTML report
  - Add new STIG URL - 1.4
  - Bump OVAL_SUPPORTED to 5.11.3
  - Handle virtual packages in dpkginfo probe
  - Inherit environment for scanning and remediating in oscap-im wrapper
  - Fix the way we check rpm library version in CMake
  - Explicitly allow xmlsec1 to load key data from KeyValue
  - Fix double-free in xccdf_policy_remediate.c
  - Fix unterminated-string-initialization errors
  - Inherit OpenSCAP environment when executing Bash remediations with --remediate option
  - Fix verbose command line option
- update to 1.4.2:
  * Maintenance, bug fix
  - Fix thread synchronization bugs
  - Fix textfilecontent54_probe behaviour for negative instance numbers
  - Fix signature obtaining in rpm_info probe</changelog>
</package>
<package pkgid="428330de31ae27f560899be5f0cb78528e76ac5afdc8c5cdbc02c5f6ed7cf80f06558ac579ab53c57c512adf15db0447276c1a63c6959606c9ed653fe818da86" name="openscap-debugsource" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="295.8"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1674129600">- 0001-Use-correct-includes.patch: fixed build with rpm 4.18</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1674475200">- Require systemd for building, was pulled in before by indirect
  dependencies which don't exist anymore</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.3.7:
  * openscap-1.3.7
  * Bump soname from 25.5.0 to 25.5.1
  * Bump version to openscap-1.3.7
  * Fix typos in docs
  * Remove a check for suspicious files
  * Add debian_evr_string tests to CMakeLists
  * Add a few unittests for debian_evr_string
  * Remove To be done
  * Move release guide to upstream
- add 0005-rename-requires-reqs-for-C-20-compatibility.patch
- rename patches
  openscap-opensuse-cpe.patch to 0001-Add-openSUSE-cpe-links.patch
  openscap-suse-cpe.patch to 0002-Add-SUSE-cpe-links.patch
  openscap-docker-add-suse.patch to 0003-Use-openSUSE-SUSE-cpe-links.patch
  oscap-remediate.service.in.patch to 0004-oscap-remediate-is-located-in-bindir.patch
- drop 0001-Use-correct-includes.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680091200">- remove _service confusion, we use final tarballs.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1687348800">- openscap 1.3.8
  * New features
  - The boot-time remediation service for systemd's Offline Update mode is now disabled by default
  - Add offline capabilities to the shadow OVAL probe
  - Add offline capabilities to the sysctl OVAL probe
  - Add 'auristorfs' to list of network fileystems
  - Add new experimental linux-bound fwupdsecattr probe for system firmware security attributes (fwupd-based)
  * Maintenance, bug fix
  - Use ListUnitFiles D-Bus method to fetch all units in systemd OVAL probe
  - Fix minor resource leaks</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 1.3.9:
  * use PCRE2 library
  * Fix offline mode (OVAL/sysctl)
  * Fix leak of dpkg cache when dpkginfo_init is called multiple times
  * Fix un-expanded variable in xccdf report output
  * Fix issues when parsing profiles
  * Fix minor problems and resource leaks</changelog>
  <changelog author="Jaime Marqu&#xED;nez Ferr&#xE1;ndiz &lt;jaime.marquinez.ferrandiz@fastmail.net&gt;" date="1709035200">- Use the correct documentation's path.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710936000">- update to 1.3.10:
  * New features
  - Dump all env. variables that affects the behaviour on INFO log level
  - Support Blueprint services customization for masking
  - Fix Blueprint template to be self-contained
  - Add a refine-rule tailoring ability to autotailor
  - Introduce JSON tailoring import option for autotailor
  - Select rules based on reference
  - Skip certain paths from scanning (controlled via env. variable)
  - Introduce a limit of collected items (controlled via env. variable)
  * Maintenance, bug fix
  - Fix partition probe for PCRE2
  - Fix NSS crypto backend
  - Wrap Bash snippets in a subshell when generating a fix script
  - Improve references in HTML guides and reports
  - Update html report with OVAL details
  - Rewrite dpkginfo probe without using APT
  - Fix incorrect openscap-cpe-oval result filename
  - Implement xccdf_session_get_rule_results function in XCCDF session API
  - Implement xccdf_session_result_reset function in XCCDF session API
- drop 0005-rename-requires-reqs-for-C-20-compatibility.patch: fixed upstream</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1710936001">- Rename oscap-docker to oscap-containers and provide oscap-podman as well
  (Relates to jsc#SLE-12852)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1714824000">- 0001-Add-openSUSE-cpe-links.patch: added Leap 15.6</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1726488000">- disable sendmail buildrequires (seems unused)
- only use distribution-release to make work everywhere</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1736337600">- update to 1.4.1:
  * New features
  - Introduce "oscap-im" - script that can be used in Containerfiles to build
  - hardened bootable container images to run as Image Mode Operating System
    Maintenance, bug fix
  - Add support for containers with no entrypoint/cmd in "oscap-docker"
  - Stop printing useless component reference information in "oscap info"
  - Fix missing declaration of PATH_MAX on Solaris
  - Fix RPM database path in RPM probes (RHEL-55251, #2151)
  - Fix issues reported by OpenScanHub after 1.4.0 release
  - Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x
  - architecture
  - Ensure xlink namespace exists (RHEL-34104)
  - Minor fixes in test suite and CI
- update to 1.4.0:
  * New features
  - Introduce ability to generate Kickstarts for unattended OS installation using the oscap xccdf generate fix --fix-type kickstart command
  - Add ability to process multi-profile JSON tailorings by the autotailor tool
  * Removed features
  - Removed cve, cvss, cvrf modules
  - Removed ds submodules sds-compose, sds-add, sds-split, rds-create, rds-split
  - Removed --template, --oval-template and --sce-template options from the xccdf generate submodule
  - Remove the --skip-valid option (replaced by --skip-validation)
  * Maintenance, bug fix
  - Advertise path to SSG in remediation scripts
  - Remove the option to build with PCRE
  - Process CPE AL platforms if CPE dictionary isn't part of data stream
  - Disable GConf probe by default (and remove dependencies from docs)
  - Disable MD5 and SHA-1 by default
  - Remove CPE dictionary
  - Fix compiler warnings
  - Update User Manual
- Remove SUSE/openSUSE CPE dictionary patches.
  * drop 0001-Add-openSUSE-cpe-links.patch
  * drop 0002-Add-SUSE-cpe-links.patch
- Set .so version to 33.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1779105600">- update to 1.4.4:
  * New features
  - List rules and variables in a profile by "oscap info"
  * Maintenance, bug fix
  - Add null check for ns_uri in cpe_dict_detect_version_priv
  - Fix autotailor json bugs
  - Use stable _init_completion API in bash completion
  - Add PanFS to the list of remote filesystems
  - Move to localtime_r
  - Fix Non-constant format string issues
  - Fix schema ordering when adding tailoring to ARF files
  - Fix null ptr deref in xccdf_benchmark_parse
  - Fix name space nulls in OVAL
  - Fix segfault in error handling for cpe_item_parse
  - Always check the current lists before inserting on blueprints
- update to 1.4.3:
  * New features
  - Show rule details in output
  * Maintenance, bug fix
  - Fix inverted fields in HTML report
  - Add new STIG URL - 1.4
  - Bump OVAL_SUPPORTED to 5.11.3
  - Handle virtual packages in dpkginfo probe
  - Inherit environment for scanning and remediating in oscap-im wrapper
  - Fix the way we check rpm library version in CMake
  - Explicitly allow xmlsec1 to load key data from KeyValue
  - Fix double-free in xccdf_policy_remediate.c
  - Fix unterminated-string-initialization errors
  - Inherit OpenSCAP environment when executing Bash remediations with --remediate option
  - Fix verbose command line option
- update to 1.4.2:
  * Maintenance, bug fix
  - Fix thread synchronization bugs
  - Fix textfilecontent54_probe behaviour for negative instance numbers
  - Fix signature obtaining in rpm_info probe</changelog>
</package>
<package pkgid="13edae3b4b2f8db9a0804570424190ce591dec66c2ebfea75502d414753df2db9bebc31b0e74def349e9b2543f2d4cd4891c0a2b075b7fc8200d3bacedd5caa5" name="openscap-devel" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="295.8"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1674129600">- 0001-Use-correct-includes.patch: fixed build with rpm 4.18</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1674475200">- Require systemd for building, was pulled in before by indirect
  dependencies which don't exist anymore</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.3.7:
  * openscap-1.3.7
  * Bump soname from 25.5.0 to 25.5.1
  * Bump version to openscap-1.3.7
  * Fix typos in docs
  * Remove a check for suspicious files
  * Add debian_evr_string tests to CMakeLists
  * Add a few unittests for debian_evr_string
  * Remove To be done
  * Move release guide to upstream
- add 0005-rename-requires-reqs-for-C-20-compatibility.patch
- rename patches
  openscap-opensuse-cpe.patch to 0001-Add-openSUSE-cpe-links.patch
  openscap-suse-cpe.patch to 0002-Add-SUSE-cpe-links.patch
  openscap-docker-add-suse.patch to 0003-Use-openSUSE-SUSE-cpe-links.patch
  oscap-remediate.service.in.patch to 0004-oscap-remediate-is-located-in-bindir.patch
- drop 0001-Use-correct-includes.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680091200">- remove _service confusion, we use final tarballs.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1687348800">- openscap 1.3.8
  * New features
  - The boot-time remediation service for systemd's Offline Update mode is now disabled by default
  - Add offline capabilities to the shadow OVAL probe
  - Add offline capabilities to the sysctl OVAL probe
  - Add 'auristorfs' to list of network fileystems
  - Add new experimental linux-bound fwupdsecattr probe for system firmware security attributes (fwupd-based)
  * Maintenance, bug fix
  - Use ListUnitFiles D-Bus method to fetch all units in systemd OVAL probe
  - Fix minor resource leaks</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 1.3.9:
  * use PCRE2 library
  * Fix offline mode (OVAL/sysctl)
  * Fix leak of dpkg cache when dpkginfo_init is called multiple times
  * Fix un-expanded variable in xccdf report output
  * Fix issues when parsing profiles
  * Fix minor problems and resource leaks</changelog>
  <changelog author="Jaime Marqu&#xED;nez Ferr&#xE1;ndiz &lt;jaime.marquinez.ferrandiz@fastmail.net&gt;" date="1709035200">- Use the correct documentation's path.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710936000">- update to 1.3.10:
  * New features
  - Dump all env. variables that affects the behaviour on INFO log level
  - Support Blueprint services customization for masking
  - Fix Blueprint template to be self-contained
  - Add a refine-rule tailoring ability to autotailor
  - Introduce JSON tailoring import option for autotailor
  - Select rules based on reference
  - Skip certain paths from scanning (controlled via env. variable)
  - Introduce a limit of collected items (controlled via env. variable)
  * Maintenance, bug fix
  - Fix partition probe for PCRE2
  - Fix NSS crypto backend
  - Wrap Bash snippets in a subshell when generating a fix script
  - Improve references in HTML guides and reports
  - Update html report with OVAL details
  - Rewrite dpkginfo probe without using APT
  - Fix incorrect openscap-cpe-oval result filename
  - Implement xccdf_session_get_rule_results function in XCCDF session API
  - Implement xccdf_session_result_reset function in XCCDF session API
- drop 0005-rename-requires-reqs-for-C-20-compatibility.patch: fixed upstream</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1710936001">- Rename oscap-docker to oscap-containers and provide oscap-podman as well
  (Relates to jsc#SLE-12852)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1714824000">- 0001-Add-openSUSE-cpe-links.patch: added Leap 15.6</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1726488000">- disable sendmail buildrequires (seems unused)
- only use distribution-release to make work everywhere</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1736337600">- update to 1.4.1:
  * New features
  - Introduce "oscap-im" - script that can be used in Containerfiles to build
  - hardened bootable container images to run as Image Mode Operating System
    Maintenance, bug fix
  - Add support for containers with no entrypoint/cmd in "oscap-docker"
  - Stop printing useless component reference information in "oscap info"
  - Fix missing declaration of PATH_MAX on Solaris
  - Fix RPM database path in RPM probes (RHEL-55251, #2151)
  - Fix issues reported by OpenScanHub after 1.4.0 release
  - Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x
  - architecture
  - Ensure xlink namespace exists (RHEL-34104)
  - Minor fixes in test suite and CI
- update to 1.4.0:
  * New features
  - Introduce ability to generate Kickstarts for unattended OS installation using the oscap xccdf generate fix --fix-type kickstart command
  - Add ability to process multi-profile JSON tailorings by the autotailor tool
  * Removed features
  - Removed cve, cvss, cvrf modules
  - Removed ds submodules sds-compose, sds-add, sds-split, rds-create, rds-split
  - Removed --template, --oval-template and --sce-template options from the xccdf generate submodule
  - Remove the --skip-valid option (replaced by --skip-validation)
  * Maintenance, bug fix
  - Advertise path to SSG in remediation scripts
  - Remove the option to build with PCRE
  - Process CPE AL platforms if CPE dictionary isn't part of data stream
  - Disable GConf probe by default (and remove dependencies from docs)
  - Disable MD5 and SHA-1 by default
  - Remove CPE dictionary
  - Fix compiler warnings
  - Update User Manual
- Remove SUSE/openSUSE CPE dictionary patches.
  * drop 0001-Add-openSUSE-cpe-links.patch
  * drop 0002-Add-SUSE-cpe-links.patch
- Set .so version to 33.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1779105600">- update to 1.4.4:
  * New features
  - List rules and variables in a profile by "oscap info"
  * Maintenance, bug fix
  - Add null check for ns_uri in cpe_dict_detect_version_priv
  - Fix autotailor json bugs
  - Use stable _init_completion API in bash completion
  - Add PanFS to the list of remote filesystems
  - Move to localtime_r
  - Fix Non-constant format string issues
  - Fix schema ordering when adding tailoring to ARF files
  - Fix null ptr deref in xccdf_benchmark_parse
  - Fix name space nulls in OVAL
  - Fix segfault in error handling for cpe_item_parse
  - Always check the current lists before inserting on blueprints
- update to 1.4.3:
  * New features
  - Show rule details in output
  * Maintenance, bug fix
  - Fix inverted fields in HTML report
  - Add new STIG URL - 1.4
  - Bump OVAL_SUPPORTED to 5.11.3
  - Handle virtual packages in dpkginfo probe
  - Inherit environment for scanning and remediating in oscap-im wrapper
  - Fix the way we check rpm library version in CMake
  - Explicitly allow xmlsec1 to load key data from KeyValue
  - Fix double-free in xccdf_policy_remediate.c
  - Fix unterminated-string-initialization errors
  - Inherit OpenSCAP environment when executing Bash remediations with --remediate option
  - Fix verbose command line option
- update to 1.4.2:
  * Maintenance, bug fix
  - Fix thread synchronization bugs
  - Fix textfilecontent54_probe behaviour for negative instance numbers
  - Fix signature obtaining in rpm_info probe</changelog>
</package>
<package pkgid="2f1cfd204e31ac4275a606563c1fc12d8b267cb0573946120f613c184a25d3878aa25d009727c0d8ddb06346e5e0b2de3e310e08c22aec4de6ec121dfcb61b4f" name="openscap-report" arch="noarch">
  <version epoch="0" ver="0.2.6" rel="12.13"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- initial import 0.2.2</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1686830400">- Fix building against other python versions than 3.10.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 0.2.5:
  * Explain the calculation of the score
  * Fix deprecation warning
  * Fix empty Value property value
  * Rework the OVAL test details
  * Resolve references to OVAL endpoints
- includes changes from 0.2.4:
  * Show references and identifier as plain text when href is unavailable
  * Implement clear button for search bar
  * Explain OVAL and CPE AL operators
  * Various output updates
- includes changes from 0.2.3:
  * Add support for the check-fact-ref element in CPE-AL
  * Explanation of the result mapping between XCCDF and OVAL
  * Add multi-check rules
  * Change loading of OVAL result reports
  * Discover upstream in tmt</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1718884800">- update to 0.2.6:
  * Rearrange fields in Rule detail and OVAL definition detail
  * Distinguish Between Configuration OVAL And Applicability Checks
  * Present references in a table</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1751025600">- Use pyproject macros from python-rpm-macros to build and install.
- Run the testsuite.
- Sprinkle in fdupes.</changelog>
</package>
<package pkgid="510021545bb02afe61b68f16b70afa9bb0e77fa770e60f74d5802e95920878c88b744d093f89bcfaa500821d055c40a705184d4c94e8884e4f85d4d83cf97386" name="openscap-report" arch="src">
  <version epoch="0" ver="0.2.6" rel="12.13"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1681214400">- initial import 0.2.2</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1686830400">- Fix building against other python versions than 3.10.</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 0.2.5:
  * Explain the calculation of the score
  * Fix deprecation warning
  * Fix empty Value property value
  * Rework the OVAL test details
  * Resolve references to OVAL endpoints
- includes changes from 0.2.4:
  * Show references and identifier as plain text when href is unavailable
  * Implement clear button for search bar
  * Explain OVAL and CPE AL operators
  * Various output updates
- includes changes from 0.2.3:
  * Add support for the check-fact-ref element in CPE-AL
  * Explanation of the result mapping between XCCDF and OVAL
  * Add multi-check rules
  * Change loading of OVAL result reports
  * Discover upstream in tmt</changelog>
  <changelog author="ming li &lt;mli@suse.com&gt;" date="1718884800">- update to 0.2.6:
  * Rearrange fields in Rule detail and OVAL definition detail
  * Distinguish Between Configuration OVAL And Applicability Checks
  * Present references in a table</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1751025600">- Use pyproject macros from python-rpm-macros to build and install.
- Run the testsuite.
- Sprinkle in fdupes.</changelog>
</package>
<package pkgid="976c7f32df1fbacf861555565e30d986824b65f0862fc805252af8a32f909bd57f0b2e62f5e6ffba8ea8002d3453fd330f1c3c67e07df50289ef418692e2afbb" name="openscap-utils" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="295.8"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1674129600">- 0001-Use-correct-includes.patch: fixed build with rpm 4.18</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1674475200">- Require systemd for building, was pulled in before by indirect
  dependencies which don't exist anymore</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.3.7:
  * openscap-1.3.7
  * Bump soname from 25.5.0 to 25.5.1
  * Bump version to openscap-1.3.7
  * Fix typos in docs
  * Remove a check for suspicious files
  * Add debian_evr_string tests to CMakeLists
  * Add a few unittests for debian_evr_string
  * Remove To be done
  * Move release guide to upstream
- add 0005-rename-requires-reqs-for-C-20-compatibility.patch
- rename patches
  openscap-opensuse-cpe.patch to 0001-Add-openSUSE-cpe-links.patch
  openscap-suse-cpe.patch to 0002-Add-SUSE-cpe-links.patch
  openscap-docker-add-suse.patch to 0003-Use-openSUSE-SUSE-cpe-links.patch
  oscap-remediate.service.in.patch to 0004-oscap-remediate-is-located-in-bindir.patch
- drop 0001-Use-correct-includes.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680091200">- remove _service confusion, we use final tarballs.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1687348800">- openscap 1.3.8
  * New features
  - The boot-time remediation service for systemd's Offline Update mode is now disabled by default
  - Add offline capabilities to the shadow OVAL probe
  - Add offline capabilities to the sysctl OVAL probe
  - Add 'auristorfs' to list of network fileystems
  - Add new experimental linux-bound fwupdsecattr probe for system firmware security attributes (fwupd-based)
  * Maintenance, bug fix
  - Use ListUnitFiles D-Bus method to fetch all units in systemd OVAL probe
  - Fix minor resource leaks</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 1.3.9:
  * use PCRE2 library
  * Fix offline mode (OVAL/sysctl)
  * Fix leak of dpkg cache when dpkginfo_init is called multiple times
  * Fix un-expanded variable in xccdf report output
  * Fix issues when parsing profiles
  * Fix minor problems and resource leaks</changelog>
  <changelog author="Jaime Marqu&#xED;nez Ferr&#xE1;ndiz &lt;jaime.marquinez.ferrandiz@fastmail.net&gt;" date="1709035200">- Use the correct documentation's path.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710936000">- update to 1.3.10:
  * New features
  - Dump all env. variables that affects the behaviour on INFO log level
  - Support Blueprint services customization for masking
  - Fix Blueprint template to be self-contained
  - Add a refine-rule tailoring ability to autotailor
  - Introduce JSON tailoring import option for autotailor
  - Select rules based on reference
  - Skip certain paths from scanning (controlled via env. variable)
  - Introduce a limit of collected items (controlled via env. variable)
  * Maintenance, bug fix
  - Fix partition probe for PCRE2
  - Fix NSS crypto backend
  - Wrap Bash snippets in a subshell when generating a fix script
  - Improve references in HTML guides and reports
  - Update html report with OVAL details
  - Rewrite dpkginfo probe without using APT
  - Fix incorrect openscap-cpe-oval result filename
  - Implement xccdf_session_get_rule_results function in XCCDF session API
  - Implement xccdf_session_result_reset function in XCCDF session API
- drop 0005-rename-requires-reqs-for-C-20-compatibility.patch: fixed upstream</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1710936001">- Rename oscap-docker to oscap-containers and provide oscap-podman as well
  (Relates to jsc#SLE-12852)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1714824000">- 0001-Add-openSUSE-cpe-links.patch: added Leap 15.6</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1726488000">- disable sendmail buildrequires (seems unused)
- only use distribution-release to make work everywhere</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1736337600">- update to 1.4.1:
  * New features
  - Introduce "oscap-im" - script that can be used in Containerfiles to build
  - hardened bootable container images to run as Image Mode Operating System
    Maintenance, bug fix
  - Add support for containers with no entrypoint/cmd in "oscap-docker"
  - Stop printing useless component reference information in "oscap info"
  - Fix missing declaration of PATH_MAX on Solaris
  - Fix RPM database path in RPM probes (RHEL-55251, #2151)
  - Fix issues reported by OpenScanHub after 1.4.0 release
  - Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x
  - architecture
  - Ensure xlink namespace exists (RHEL-34104)
  - Minor fixes in test suite and CI
- update to 1.4.0:
  * New features
  - Introduce ability to generate Kickstarts for unattended OS installation using the oscap xccdf generate fix --fix-type kickstart command
  - Add ability to process multi-profile JSON tailorings by the autotailor tool
  * Removed features
  - Removed cve, cvss, cvrf modules
  - Removed ds submodules sds-compose, sds-add, sds-split, rds-create, rds-split
  - Removed --template, --oval-template and --sce-template options from the xccdf generate submodule
  - Remove the --skip-valid option (replaced by --skip-validation)
  * Maintenance, bug fix
  - Advertise path to SSG in remediation scripts
  - Remove the option to build with PCRE
  - Process CPE AL platforms if CPE dictionary isn't part of data stream
  - Disable GConf probe by default (and remove dependencies from docs)
  - Disable MD5 and SHA-1 by default
  - Remove CPE dictionary
  - Fix compiler warnings
  - Update User Manual
- Remove SUSE/openSUSE CPE dictionary patches.
  * drop 0001-Add-openSUSE-cpe-links.patch
  * drop 0002-Add-SUSE-cpe-links.patch
- Set .so version to 33.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1779105600">- update to 1.4.4:
  * New features
  - List rules and variables in a profile by "oscap info"
  * Maintenance, bug fix
  - Add null check for ns_uri in cpe_dict_detect_version_priv
  - Fix autotailor json bugs
  - Use stable _init_completion API in bash completion
  - Add PanFS to the list of remote filesystems
  - Move to localtime_r
  - Fix Non-constant format string issues
  - Fix schema ordering when adding tailoring to ARF files
  - Fix null ptr deref in xccdf_benchmark_parse
  - Fix name space nulls in OVAL
  - Fix segfault in error handling for cpe_item_parse
  - Always check the current lists before inserting on blueprints
- update to 1.4.3:
  * New features
  - Show rule details in output
  * Maintenance, bug fix
  - Fix inverted fields in HTML report
  - Add new STIG URL - 1.4
  - Bump OVAL_SUPPORTED to 5.11.3
  - Handle virtual packages in dpkginfo probe
  - Inherit environment for scanning and remediating in oscap-im wrapper
  - Fix the way we check rpm library version in CMake
  - Explicitly allow xmlsec1 to load key data from KeyValue
  - Fix double-free in xccdf_policy_remediate.c
  - Fix unterminated-string-initialization errors
  - Inherit OpenSCAP environment when executing Bash remediations with --remediate option
  - Fix verbose command line option
- update to 1.4.2:
  * Maintenance, bug fix
  - Fix thread synchronization bugs
  - Fix textfilecontent54_probe behaviour for negative instance numbers
  - Fix signature obtaining in rpm_info probe</changelog>
</package>
<package pkgid="0706764391526d45f0c4ab5822dcc1bd50e1599f6b2ffd5e6740577cf231ebfbb1e7a651b21cd7b232a950733edfe1f723e40890ad5402396fb1206992756489" name="openscap-utils-debuginfo" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="295.8"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1674129600">- 0001-Use-correct-includes.patch: fixed build with rpm 4.18</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1674475200">- Require systemd for building, was pulled in before by indirect
  dependencies which don't exist anymore</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.3.7:
  * openscap-1.3.7
  * Bump soname from 25.5.0 to 25.5.1
  * Bump version to openscap-1.3.7
  * Fix typos in docs
  * Remove a check for suspicious files
  * Add debian_evr_string tests to CMakeLists
  * Add a few unittests for debian_evr_string
  * Remove To be done
  * Move release guide to upstream
- add 0005-rename-requires-reqs-for-C-20-compatibility.patch
- rename patches
  openscap-opensuse-cpe.patch to 0001-Add-openSUSE-cpe-links.patch
  openscap-suse-cpe.patch to 0002-Add-SUSE-cpe-links.patch
  openscap-docker-add-suse.patch to 0003-Use-openSUSE-SUSE-cpe-links.patch
  oscap-remediate.service.in.patch to 0004-oscap-remediate-is-located-in-bindir.patch
- drop 0001-Use-correct-includes.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680091200">- remove _service confusion, we use final tarballs.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1687348800">- openscap 1.3.8
  * New features
  - The boot-time remediation service for systemd's Offline Update mode is now disabled by default
  - Add offline capabilities to the shadow OVAL probe
  - Add offline capabilities to the sysctl OVAL probe
  - Add 'auristorfs' to list of network fileystems
  - Add new experimental linux-bound fwupdsecattr probe for system firmware security attributes (fwupd-based)
  * Maintenance, bug fix
  - Use ListUnitFiles D-Bus method to fetch all units in systemd OVAL probe
  - Fix minor resource leaks</changelog>
  <changelog author="Andreas Stieger &lt;andreas.stieger@gmx.de&gt;" date="1695297600">- update to 1.3.9:
  * use PCRE2 library
  * Fix offline mode (OVAL/sysctl)
  * Fix leak of dpkg cache when dpkginfo_init is called multiple times
  * Fix un-expanded variable in xccdf report output
  * Fix issues when parsing profiles
  * Fix minor problems and resource leaks</changelog>
  <changelog author="Jaime Marqu&#xED;nez Ferr&#xE1;ndiz &lt;jaime.marquinez.ferrandiz@fastmail.net&gt;" date="1709035200">- Use the correct documentation's path.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1710936000">- update to 1.3.10:
  * New features
  - Dump all env. variables that affects the behaviour on INFO log level
  - Support Blueprint services customization for masking
  - Fix Blueprint template to be self-contained
  - Add a refine-rule tailoring ability to autotailor
  - Introduce JSON tailoring import option for autotailor
  - Select rules based on reference
  - Skip certain paths from scanning (controlled via env. variable)
  - Introduce a limit of collected items (controlled via env. variable)
  * Maintenance, bug fix
  - Fix partition probe for PCRE2
  - Fix NSS crypto backend
  - Wrap Bash snippets in a subshell when generating a fix script
  - Improve references in HTML guides and reports
  - Update html report with OVAL details
  - Rewrite dpkginfo probe without using APT
  - Fix incorrect openscap-cpe-oval result filename
  - Implement xccdf_session_get_rule_results function in XCCDF session API
  - Implement xccdf_session_result_reset function in XCCDF session API
- drop 0005-rename-requires-reqs-for-C-20-compatibility.patch: fixed upstream</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1710936001">- Rename oscap-docker to oscap-containers and provide oscap-podman as well
  (Relates to jsc#SLE-12852)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1714824000">- 0001-Add-openSUSE-cpe-links.patch: added Leap 15.6</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1726488000">- disable sendmail buildrequires (seems unused)
- only use distribution-release to make work everywhere</changelog>
  <changelog author="Alexander Bergmann &lt;abergmann@suse.com&gt;" date="1736337600">- update to 1.4.1:
  * New features
  - Introduce "oscap-im" - script that can be used in Containerfiles to build
  - hardened bootable container images to run as Image Mode Operating System
    Maintenance, bug fix
  - Add support for containers with no entrypoint/cmd in "oscap-docker"
  - Stop printing useless component reference information in "oscap info"
  - Fix missing declaration of PATH_MAX on Solaris
  - Fix RPM database path in RPM probes (RHEL-55251, #2151)
  - Fix issues reported by OpenScanHub after 1.4.0 release
  - Fix failing test probes/filehash58/test_probes_filehash58.sh on s390x
  - architecture
  - Ensure xlink namespace exists (RHEL-34104)
  - Minor fixes in test suite and CI
- update to 1.4.0:
  * New features
  - Introduce ability to generate Kickstarts for unattended OS installation using the oscap xccdf generate fix --fix-type kickstart command
  - Add ability to process multi-profile JSON tailorings by the autotailor tool
  * Removed features
  - Removed cve, cvss, cvrf modules
  - Removed ds submodules sds-compose, sds-add, sds-split, rds-create, rds-split
  - Removed --template, --oval-template and --sce-template options from the xccdf generate submodule
  - Remove the --skip-valid option (replaced by --skip-validation)
  * Maintenance, bug fix
  - Advertise path to SSG in remediation scripts
  - Remove the option to build with PCRE
  - Process CPE AL platforms if CPE dictionary isn't part of data stream
  - Disable GConf probe by default (and remove dependencies from docs)
  - Disable MD5 and SHA-1 by default
  - Remove CPE dictionary
  - Fix compiler warnings
  - Update User Manual
- Remove SUSE/openSUSE CPE dictionary patches.
  * drop 0001-Add-openSUSE-cpe-links.patch
  * drop 0002-Add-SUSE-cpe-links.patch
- Set .so version to 33.</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1779105600">- update to 1.4.4:
  * New features
  - List rules and variables in a profile by "oscap info"
  * Maintenance, bug fix
  - Add null check for ns_uri in cpe_dict_detect_version_priv
  - Fix autotailor json bugs
  - Use stable _init_completion API in bash completion
  - Add PanFS to the list of remote filesystems
  - Move to localtime_r
  - Fix Non-constant format string issues
  - Fix schema ordering when adding tailoring to ARF files
  - Fix null ptr deref in xccdf_benchmark_parse
  - Fix name space nulls in OVAL
  - Fix segfault in error handling for cpe_item_parse
  - Always check the current lists before inserting on blueprints
- update to 1.4.3:
  * New features
  - Show rule details in output
  * Maintenance, bug fix
  - Fix inverted fields in HTML report
  - Add new STIG URL - 1.4
  - Bump OVAL_SUPPORTED to 5.11.3
  - Handle virtual packages in dpkginfo probe
  - Inherit environment for scanning and remediating in oscap-im wrapper
  - Fix the way we check rpm library version in CMake
  - Explicitly allow xmlsec1 to load key data from KeyValue
  - Fix double-free in xccdf_policy_remediate.c
  - Fix unterminated-string-initialization errors
  - Inherit OpenSCAP environment when executing Bash remediations with --remediate option
  - Fix verbose command line option
- update to 1.4.2:
  * Maintenance, bug fix
  - Fix thread synchronization bugs
  - Fix textfilecontent54_probe behaviour for negative instance numbers
  - Fix signature obtaining in rpm_info probe</changelog>
</package>
<package pkgid="8b847bfcc88fbf138529f43b98d379cad6934760f16d47a2c645cb4fff366190179b275522df1780e989e12f6ec9cdcc7a8fea14d08964fc7f35029c6e32a1c7" name="osv-scanner" arch="s390x">
  <version epoch="0" ver="2.5.0" rel="95.2"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1734609600">- Update to version 1.9.2:
  * chore: v1.9.2 Changelog (#1455)
  * chore: cherry-pick fixes to v1 (#1459)
  * chore: Update test dockerfile node hash
  * chore(deps): update alpine docker tag to v3.21 (#1431)
  * test(maven): remove the test of transitive scanning on native
    data source (#1425)
  * chore: update golangci-lint to version 1.62.2 (#1426)
  * test: update snapshots (#1421)
  * ci: add versions fixture generator for Red Hat (#1356)
  * docs: clarify commit message requirements in `contribution.md`
    (#1416)
  * chore(deps): lock file maintenance (#1415)
  * feat(output): show package view for container scanning table
    result (#1407)
  * feat: warn if a vulnerability is ignored multiple times in the
    same config (#1377)
  * fix(guided remediation): handle extraneous/missing packages in
    package-lock.json more leniently (#1394)
  * feat(output): add a unified output result (#1397)
  * chore(deps): update codecov/codecov-action action to v5 (#1403)
  * chore(deps): lock file maintenance (#1404)
  * fix(deps): update osv-scanner minor (#1402)
  * chore(deps): update alpine:3.20 docker digest to 1e42bbe
    (#1401)
  * chore(deps): update workflows (#1393)
  * chore(deps): update golang docker tag to v1.23.3 (#1392)
  * test: use internal utility for creating tmp directory (#1371)
  * test: rewrite `models` to use snapshots and tables (#1382)
  * docs: corrected field names in osv scanner results in the JSON
    doc (#1398)
  * chore: update snapshots (#1399)
  * feat(output): update HTML output to a new design (#1383)
  * fix: add "slices" import back in (#1395)
  * feat: support evaluating spdx license expressions (#1329)
  * feat(container-scanning): set unimportant vulns as uncalled
    (#1385)
  * feat: add support for comparing Red Hat versions locally
    (#1355)
  * fix(deps): update osv-scanner minor (#1348)
  * chore(deps): lock file maintenance (#1384)
  * fix(deps): update module github.com/charmbracelet/lipgloss to
    v1 (#1373)
  * chore(deps): update workflows (#1347)
  * chore(deps): update dependency webrick to v1.9.0 (#1372)
  * test: use traditional `tt` variable name and remove unneeded
    loop-copy-var (#1381)
  * chore: update snapshots (#1375)
  * test(semantic): include ecosystems not supported by `lockfile`
    (#1364)
  * refactor: rename internal struct to avoid stuttering (#1370)
  * chore: remove deprecated internal functions (#1369)
  * test: update snapshots (#1368)
  * refactor(semantic): simplify comparing of "pre" letters in PyPI
    versions (#1366)
  * refactor(semantic): remove unneeded condition in PyPI version
    comparator (#1362)
  * refactor(semantic): simplify comparing of RubyGem version
    components (#1361)
  * refactor(semantic): remove unneeded logic in parsing
    semver-like versions (#1360)
  * fix(semantic): support parsing versions without a numeric
    component (#1365)
  * refactor(semantic): sort ecosystems by name (#1363)
  * fix: parsing crash on malformed pnpm lockfile (#1327)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1742212800">- Update to version 2.0.0:
  Important: This release includes several breaking changes aimed
  at future-proofing OSV-Scanner. Please consult our comprehensive
  Migration Guide to ensure a smooth upgrade.
  https://google.github.io/osv-scanner/migration-guide.html
  * Features:
  - Layer and base image-aware container scanning:
  - Rewritten support for Debian, Ubuntu, and Alpine container
    images.
  - Layer level analysis and vulnerability breakdown.
  - Supports Go, Java, Node, and Python artifacts within
    supported distros.
  - Base image identification via deps.dev.
  - Usage: osv-scanner scan image &lt;image-name&gt;:&lt;tag&gt;
  - Interactive HTML output:
  - Severity breakdown, package/ID/importance filtering,
    vulnerability details.
  - Container image layer filtering, layer info, base image
    identification.
  - Usage: osv-scanner scan --serve ...
  - Guided Remediation for Maven pom.xml:
  - Remediate direct and transitive dependencies
    (non-interactive mode).
  - New override remediation strategy.
  - Support for reading/writing pom.xml and parent POM files.
  - Private registry support for Maven metadata.
  - Machine-readable output for guided remediation.
  - Enhanced Dependency Extraction with osv-scalibr:
  - Haskell: cabal.project.freeze, stack.yaml.lock
  - .NET: deps.json
  - Python: uv.lock
  - Artifacts: node_modules, Python wheels, Java uber jars, Go
    binaries
  - Feature #1636 osv-scanner update command for updating the
    local vulnerability database (formerly experimental).
  - Feature #1582 Add container scanning information to vertical
    output format.
  - Feature #1587 Add support for severity in SARIF report
    format.
  - Feature #1569 Add support for bun.lock lockfiles.
  - Feature #1547 Add experimental config support to the scan
    image command.
  - Feature #1557 Allow setting port number with --serve using
    the new --port flag.
  * Breaking Changes:
  - Feature #1670 Guided remediation now defaults to
    non-interactive mode; use the --interactive flag for
    interactive mode.
  - Feature #1670 Removed the --verbosity=verbose verbosity
    level.
  - Feature #1673 &amp; Feature #1664 All previous experimental flags
    are now out of experimental, and the experimental flag
    mechanism has been removed.
  - Feature #1651 Multiple license flags have been merged into a
    single --license flag.
  - Feature #1666 API: reporter removed; logging now uses slog,
    which can be overridden.
  - Feature #1638 API: Deprecated packages removed, including
    lockfile (migrated to OSV-Scalibr).
  * Improvements:
  - Feature #1561 Updated HTML report for better contrast and
    usability (from beta2).
  - Feature #1584 Make skipping the root git repository the
    default behavior (from beta2).
  - Feature #1648 Updated HTML report styling to improve contrast
    (from rc1).
  * Fixes:
  - Fix #1598 Fix table output vulnerability ordering.
  - Fix #1616 Filter out Ubuntu unimportant vulnerabilities.
  - Fix #1585 Fixed issue where base images are occasionally
    duplicated.
  - Fix #1597 Fixed issue where SBOM parsers are not correctly
    parsing CycloneDX files when using the bom.xml filename.
  - Fix #1566 Fixed issue where offline scanning returns
    different results from online scanning.
  - Fix #1538 Reduce memory usage when using guided remediation.
  We encourage everyone to upgrade to OSV-Scanner v2.0.0 and
  experience these powerful new capabilities! As always, your
  feedback is invaluable, so please don't hesitate to share your
  thoughts and suggestions.
  - General V2 feedback
    https://github.com/google/osv-scanner/discussions/1529
  - Container scanning feedback
    https://github.com/google/osv-scanner/discussions/1521</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743681600">- Update to version 2.0.1:
  * Features:
  - Feature #1730 Add support for extracting dependencies from
    .NET packages.config and packages.lock.json files.
  - Feature #1770 Add support for extracting dependencies from
    rust binaries compiled with cargo-auditable.
  - Feature #1761 Improve output when scanning for OS packages,
    we now show binary packages associated with a source package
    in the table output.
  * Fixes:
  - Bug #1752 Fix paging depth issue when querying the osv.dev
    API.
  - Bug #1747 Ensure osv-reporter prints warnings instead of
    errors for certain messages to return correct exit code
    (related to osv-scanner-action#65).
  - Bug #1717 Fix issue where nested CycloneDX components were
    not being parsed.
  - Bug #1744 Fix issue where empty CycloneDX SBOMs was causing a
    panic.
  - Bug #1726 De-duplicate references in CycloneDX report output
    for improved validity.
  - Bug #1727 Remove automatic opening of HTML reports in the
    browser (fixes #1721).
  - Bug #1735 Require a tag when scanning container images to
    prevent potential errors.
  * API Changes:
  - API Change #1763 Made the SourceType enum public.
  * Dependencies:
  - chore(deps): bump github.com/containerd/containerd from
    1.7.18 to 1.7.27 in the go_modules group across 1 directory
    (#1719)
  - chore(deps): update goreleaser/goreleaser-action action to
    v6.3.0 (#1765)
  - chore(deps): update workflows (#1713)
  - chore(deps): update workflows (#1731)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746014400">- Update to version 2.0.2:
  * Fixes:
  - Bug #1842 Fix an issue in the GitHub Action where call
    analysis for Go projects using the tool directive (Go 1.24+)
    in go.mod files would fail. The scanner image has been
    updated to use a newer Go version.
  - Bug #1806 Fix an issue where license overrides were not
    correctly reflected in the final scan results and license
    summary.
  - Fix #1825, #1809, #1805, #1803, #1787 Enhance XML output
    stability and consistency by preserving original spacing and
    minimizing unnecessary escaping. This helps reduce
    differences when XML files are processed.
  * What's changed
  - chore(deps-dev): bump nokogiri from 1.18.4 to 1.18.8 in /docs
    in the bundler group across 1 directory (#1815)
  - chore: Changelog for v2.0.2 (#1847)
  - fix(gh-action): call analysis doesn't work for go 1.24
    (#1842)
  - test(osv-scanner/fix): actually import command from package
    (#1845)
  - test(fix): use public package (#1832)
  - test: add case for when "false" is explicitly passed as the
    value for `--offline` (#1841)
  - refactor(cmd): rename and cleanup `licenseGenericFlag`
    implementation (#1834)
  - test: only include specific command under test in `cmd`
    package tests (#1831)
  - test: update snapshots (#1833)
  - feat(xml): store the original text in CharData (#1825)
  - chore: Update snaps again (#1824)
  - chore(deps): update workflows (#1799)
  - fix(deps): update osv-scanner minor (#1800)
  - chore(deps): lock file maintenance (#1801)
  - test: move `source` cases into subpackage (#1759)
  - chore: Remove renovatebot constraint (#1820)
  - refactor: use constants for extractor names (#1819)
  - test: ensure that all tests are run in parallel (#1817)
  - refactor: ensure all extractors have a single interface check
    at the bottom of the file (#1818)
  - refactor: avoid repeated call to get scan global flags
    (#1816)
  - docs: Update Maven Central and private registries support
    (#1812)
  - chore: Update snapshots (#1813)
  - feat(xml): do not escape texts in char data (#1809)
  - feat: Parallel tests with global logger (#1798)
  - fix: override licenses in scan results (#1806)
  - chore: Update snapshot again again (#1807)
  - feat(xml): keep the white space between attributes (#1805)
  - refactor: Switch to use public osvdev client (#1804)
  - feat(xml): do not escape double quotes (#1803)
  - chore: Update scalibr to use the new inventory format.
    (#1797)
  - chore: Update snapshot again (#1802)
  - chore: Update snapshots (#1796)
  - feat(xml): keep the extra space in self-closing tags (#1787)
  - chore(deps): update
    gaurav-nelson/github-action-markdown-link-check digest to
    3c3b66f (#1784)
  - chore(deps): update golang docker tag to v1.24.2 (#1785)
  - test: update snapshots (#1786)
  - feat: support outputting results in `spdx` format (#1776)
  - test: update snapshots (#1782)
  - build: move off deprecated archives.format and
    archives.builds properties again (#1779)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1750075200">- Update to version 2.0.3:
  * Features:
  - Feature #1943 Added a flag to suppress "no package sources
    found" error.
  - Feature #1844 Allow flags to be passed after scan targets,
    e.g. osv-scanner ./scan-this-dir --format=vertical, by
    updating to cli/v3
  - Feature #1882 Added a stable tag to container images for
    releases that follow semantic versioning.
  - Feature #1846 Experimental: Add --experimental-extractors and
  - -experimental-disable-extractors flags to allow for more
    granular control over which OSV-Scalibr dependency extractors
    are used.
  * Fixes:
  - Bug #1856 Improve XML output by guessing and matching the
    indentation of existing &lt;dependency&gt; elements.
  - Bug #1850 Prevent escaping of single quotes in XML attributes
    for better readability and correctness.
  - Bug #1922 Prevent a potential panic in MatchVulnerabilities
    when the API response is nil, particularly on timeout.
  - Bug #1916 Add the "ubuntu" namespace to the debian purl type
    to correctly parse dpkg BOMs generated on Ubuntu.
  - Bug #1871 Ensure inventories are sorted by PURL in addition
    to name and version to prevent incorrect deduplication of
    packages.
  - Bug #1919 Improve error reporting by including the underlying
    error when the response body from a Maven registry cannot be
    read.
  - Bug #1857 Fix an issue where SPDX output is not correctly
    outputted because it was getting overwritten.
  - Bug #1873 Fix the GitHub Action to not ignore general errors
    during execution.
  - Bug #1955 Fix issue causing error messages to be spammed when
    not running in a git repository.
  - Bug #1930 Fix issue where Maven client loses auth data during
    extraction.
  * Misc:
  - Update dependencies and updated golang to 1.24.4
  - fix(deps): update osv-scanner minor (#1951)
  - chore(deps): update golang docker tag to v1.24.4 (#1933)
  - chore(deps): update github/codeql-action action to v3.29.0
    (#1932)
  - fix(deps): update osv-scanner minor (#1914)
  - chore(deps): update ossf/scorecard-action action to v2.4.2
    (#1915)
  - chore(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 in
    /experimental/javareach in the go_modules group across 1
    directory (#1811)
  - chore(deps): update golangci/golangci-lint-action action to
    v8 (#1766)
  - fix(deps): update osv-scanner minor (#1863)
  - chore(deps): update workflows (#1837)
  - chore(deps): lock file maintenance (#1838)
  - chore(deps): update golang docker tag to v1.24.3 (#1864)
  - fix(deps): update osv-scanner minor (#1836)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1752235200">- Update to version 2.1.0:
  * Features:
  - Feature #2038 Add CycloneDX location field to the output
    source string.
  - Feature #2036 Include upstream source information in
    vulnerability grouping to improve accuracy.
  - Feature #1970 Hide unimportant vulnerabilities by default to
    reduce noise, and adds a --show-all-vulns flag to show all.
  - Feature #2003 Add experimental summary output format for the
    reporter.
  - Feature #1988 Add support for CycloneDX 1.6 report format.
  - Feature #1987 Add support for gems.locked files used by
    Bundler.
  - Feature #1980 Enable transitive dependency extraction for
    Python requirements.txt files.
  - Feature #1961 Deprecate the --sbom flag in favor of the
    existing -L/--lockfile flag for scanning SBOMs.
  - Feature #1963 Stabilize various experimental fields in the
    output by moving them out of the experimental struct.
  - Feature #1957 Use a dedicated exit code for invalid
    configuration files.
  * Fixes:
  - Bug #2046 Correctly set the user agent string for all
    outgoing requests.
  - Bug #2019 Use more natural language in the descriptions for
    extractor-related flags.
  - Bug #1982 Correctly parse Ubuntu package information with
    suffixes (e.g. :Pro, :LTS).
  - Bug #2000 Ensure CDATA content in XML is correctly outputted
    in guided remediation.
  - Bug #1949 Fix filtering of package types in vulnerability
    counts.
  * Dependencies
  - chore(deps): lock file maintenance (#2006)
  - chore(deps): update alpine docker tag to v3.22 (#1952)
  - chore(deps): update github/codeql-action action to v3.29.2
    (#2018)
  - chore(deps): update workflows (#1989)
  - chore: Update go-sarif to v3 from v2 (#1985)
  - chore: Update scalibr again (#2044)
  - chore: Update scalibr and remove javareach (#2011)
  - chore: ignore use of our own deprecated field (#1991)
  - chore: remove unneeded `goland:noinspection
    GoBoolExpressions` comments (#2043)
  - chore: update linter to v2.2 (#2016)
  - chore: v2.1.0 Changelog (#2054)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754568000">- Update to version 2.2.0:
  OSV-Scanner now supports all OSV-Scalibr features behind
  experimental flags (--experimental-plugins, see details here)!
  * Features:
  - Feature #2146 Allow manual OSV-Scalibr plugin selection.
  - Feature #2144 Add OSV-Scalibr version to osv-scanner
  - -version output.
  - Feature #2021 Add experimental support for running
    OSV-Scalibr detectors.
  - Feature #2079 Fall back to offline extractor if the
    transitive one fails, so at least direct dependencies are
    returned.
  - Feature #2032 Add summary section at the top of outputs and a
    'Fixed Version' column.
  - Feature #2076 Support Ubuntu severity type.
  * Fixes:
  - Bug #2141 Fix OSV-Scanner json scans not matching with
    correct ecosystem.
  - Bug #2084 Show absolute paths when scanning containers.
  - Bug #2126 Log and preserve package count before continuing on
    db error.
  - Bug #2095 Pass through plugin capabilities correctly.
  - Bug #2051 Properly flag if running on Linux or Mac OSs for
    plugin compatibility.
  - Bug #2072 Add missing "text" property in description fields.
  - Bug #2068 Change links in output to go to the specific
    vulnerability page instead of the list page.
  - Bug #2064 Fix SARIF v3 output to include results.
  * API Changes:
  - API Change #2096 Allow log handler to be overridden.
  * Dependencies:
  - chore(deps): update alpine:3.22 docker digest to 4bcff63
    (#2089)
  - chore(deps): update github/codeql-action action to v3.29.5
    (#2116)
  - chore(deps): update golang docker tag to v1.24.5 (#2062)
  - chore(deps): update golang:1.24.5-alpine3.21 docker digest to
    6edc205 (#2090)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755604800">- Update to version 2.2.1:
  * Fixes
  - Bug #2151 Filter by ecosystem before querying.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756382400">- Update to version 2.2.2:
  * Features:
  - Feature #2113 Add support for Java reachability analysis to
    identify uncalled vulnerabilities in JAR files.
  - Feature #2177 Automatically parse osv-scanner-custom.json
    files as osv-scanner.json custom lockfiles.
  * Fixes:
  - Bug #2204 Add a warning to guide users to the correct GitHub
    Action.
  - Bug #2202 Fix incorrect exit code when unimportant
    vulnerabilities are found in non-container scans.
  - Bug #2188 Fix handling of absolute paths on Windows.
  * Dependencies
  - fix(deps): update osv-scalibr (#2175)
  - chore(deps): update golang docker tag to v1.24.6 (#2167)
  - chore(deps): update workflows (#2165)
  - chore(deps): lock file maintenance (#2143)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1759320000">- Update to version 2.2.3:
  * Features:
  - Feature #2209 Add support for resolving git packages that
    have a version specified.
  - Feature #2210 Make the --experimental-plugins flag additive
    by default, and introduce a new
  - -experimental-no-default-plugins flag.
  - Feature #2203 Update osv-scalibr to 0.3.4 for improved
    dependency extraction. See osv-scalibr changelog for
    additional information.
  * Fixes:
  - Bug #2214 Fix issue where input.Path was incorrectly
    constructed on Windows when using the -L flag.
  - Fix #2241 Performance: Greatly reduce memory usage in the
    local matcher by only loading advisories relevant to the
    packages being scanned.
  * Dependencies
  - chore(deps): update workflows (#2251)
  - fix(deps): update osv-scanner minor (#2250)
  - fix(deps): update osv-scanner minor (#2231)
  - chore(deps): update golang docker tag to v1.25.1 (#2223)
  - chore(deps): update workflows (#2224)
  - chore(deps): update workflows (major) (#2232)
  - chore(deps): lock file maintenance (#2233)
  - chore(deps-dev): bump rexml from 3.4.1 to 3.4.2 in /docs in
    the bundler group across 1 directory (#2237)
  - fix(deps): update osv-scanner minor (#2213)
  - fix(deps): update osv-scanner minor (#2166)
  - chore(deps): update golang docker tag to v1.25.0 (#2185)
  - chore(deps): update workflows (#2186)
  - chore(deps): lock file maintenance (#2187)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761739200">- Update to version 2.2.4:
  * Features:
  - Feature #2256 Add experimental OSV-Scanner MCP server.
    (osv-scanner experimental-mcp)
  - Feature #2284 Update osv-scalibr integration, replacing
    baseimagematch with the base image enricher.
  - Feature #2216 Warn when vulnerabilities specified in the
    ignore config are not found during a scan (fixes #2206).
  * Fixes:
  - Bug #2305 Ignore common protocols and .git suffix when
    checking if an advisory affects a git repository (fixes
    [#2291]).
  - Bug #2300 Ensure the global logger is used in cmdlogger and
    osv-scalibr when set (fixes #2081).
  - Bug #2295 Fix Go stdlib license result matching (fixes
    [#2191]).
  * Dependencies
  - chore(deps): lock file maintenance (#2265)
  - chore(deps): update alpine:3.22 docker digest to 4b7ce07
    (#2272)
  - chore(deps): update github/codeql-action action to v3.30.9
    (#2287)
  - chore(deps): update golang docker tag to v1.25.3 (#2275)
  - chore(deps): update workflows (#2264)
  - chore(deps): update workflows (#2273)
  - chore(deps): update workflows (major) (#2288)
  - chore(deps): update workflows (major) (#2302)
  - fix(deps): update osv-scanner minor (#2263)
  - fix(deps): update osv-scanner minor (#2276)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763553600">- Update to version 2.3.0:
  * Features:
  - Feature #2321 Add support for license checks for RubyGems.
  - Feature #2294 Replace requirementsenhanceable extractor with
    transitive enricher.
  - Feature #2344 Use osduplicate annotators.
  * Fixes:
  - Bug #2329 Add --ignore-scripts flag to npm lockfile
    generation.
  - Bug #2311 Improve logic for --all-packages flag.
  - Bug #2309 Exit with a non-zero code when showing help.
  - Bug #2316 Pre-commit hook now defaults to scanning current
    directory instead of failing.
  - Bug #1507 (osv-scalibr) Interpolate Maven projects before
    extracting repositories.
  * Dependencies
  - chore(deps): update github/codeql-action action to v4.31.3
    (#2347)
  - fix(deps): update osv-scanner minor (#2346)
  - fix(deps): update osv-scanner minor (#2286)
  - chore(deps): bump github.com/opencontainers/selinux from
    1.12.0 to 1.13.0 in the go_modules group across 1 directory
    (#2338)
  - chore(deps): bump github.com/containerd/containerd from
    1.7.27 to 1.7.29 in the go_modules group across 1 directory
    (#2326)
  - chore(deps): update docker/setup-qemu-action digest to
    c7c5346 (#2334)
  - chore(deps): update golang docker tag to v1.25.4 (#2335)
  - chore(deps): update golangci/golangci-lint-action action to
    v9 (#2336)
  - chore(deps): update github/codeql-action action to v4.31.2
    (#2301)
  - chore(deps): lock file maintenance (#2315)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 2.3.1:
  * Features:
  - Feature #2370 Add support for the packagedeprecation plugin
    via the new --experimental-flag-deprecated-packages flag. The
    result is available in all output formats except SPDX.
  * Fixes:
  - Bug #2395 Fix license scanning to correctly match new
    deps.dev package names.
  - Bug #2333 Deduplicate SARIF outputs for GitHub.
  - Bug #2259 Fix lookup of Go packages with major versions by
    including the subpath of Go PURLs, preventing false
    positives.
  * Misc:
  - Updated Go version to v1.25.5 to support Go reachability
    analysis for the latest version.
  * Dependencies
  - chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0
    in the go_modules group across 1 directory (#2357)
  - chore(deps): update actions/checkout action to v6 (#2379)
  - chore(deps): update dependency webrick to v1.9.2 (#2378)
  - chore(deps): update workflows (#2364)
  - chore(deps): update workflows (#2402)
  - fix(deps): update osv-scanner minor (#2365)
  - fix(deps): update osv-scanner minor (#2400)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768478400">- Update to version 2.3.2:
  This release includes performance improvements for local
  scanning, reducing memory usage and avoiding unnecessary advisory
  loading. It also fixes issues with MCP's
  get_vulnerability_details tool, git queries in osv-scanner.json,
  and ignore entry tracking, along with documentation updates.
  * Fixes:
  - Bug #2415 Add more PURL-to-ecosystem mappings
  - Bug #2422 MCP error for get_vulnerability_id because type
    definition is incorrect.
  - Bug #2460 Enable osv-scanner.json git queries
  - Bug #2456 Properly track if an ignore entry has been used
  - Bug #2450 Performance: Avoid loading the entire advisory
    unless it will actually be used
  - Bug #2445 Performance: Don't read the entire zip into memory
  - Bug #2433 Allow specifying user agent in v2 osvscanner
    package
  * Misc:
  - Misc #2453 Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3
  - Misc #2447 Include bun.lock as a supported lockfile
  - Misc #2444 Document GoVersionOverride in configuration.md
  * Dependencies
  - fix(deps): update osv-scanner minor (#2459)
  - chore(deps): update ruby docker tag to v4 (#2432)
  - chore(deps): update alpine:3.23 docker digest to 865b95f
    (#2425)
  - chore(deps): update docker/setup-buildx-action digest to
    8d2750c (#2426)
  - chore(deps): switch from gopkg.in/yaml.v3 to
    go.yaml.in/yaml/v3 (#2453)
  - fix(deps): update osv-scanner minor (#2427)
  - chore(deps): update alpine docker tag to v3.23 (#2401)
  - chore(deps): update workflows (#2417)
  - fix(deps): update osv-scanner minor (#2418)
  - chore(deps): update workflows (major) (#2419)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770897600">- Update to version 2.3.3:
  * Features:
  - Feature #2458 Add --exclude flag to skip paths during
    scanning.
  - Feature #2477 Add pylock extractor.
  - Feature #2475 Add base image info to container scanning
    output header (in table, markdown and vertical formats).
  * Misc:
  - Update Go version to 1.25.7.
  - Update osv-scalibr from v0.4.1 to v0.4.2. Release note.
  - Refactor to better align with osv-scalibr plugins and
    inventory data structure.
  * Dependencies
  - build(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to
    5.16.5 in the go_modules group across 1 directory (#2504)
  - build(deps-dev): bump faraday from 2.14.0 to 2.14.1 in /docs
    in the bundler group across 1 directory (#2503)
  - chore(deps): update workflows (#2471)
  - chore: update Go version to v1.25.6 (#2490)
  - fix(deps): update osv-scanner minor (#2470)
  - fix: bump Go to v1.25.7 (#2506)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774440000">- Update to version 2.3.5 (.4 was not released):
  * Features:
  - Feature #2571 Enable transitive scanning for Python
    requirements.txt files using the deps.dev API.
  - Feature #2649 Add ability to allow unsafe plugins, logging a
    warning when any unsafe plugin is enabled.
  * Fixes:
  - Bug #2630 Improve startup performance on Windows Terminal by
    updating lipgloss.
  - Bug #2599 Ensure the package deprecation enricher respects
    the same configuration as other plugins.
  - Bug #2600 Ensure the Java extractor plugin for call analysis
    respects the same configuration as other plugins.
  * Misc:
  - Update osv-scalibr from v0.4.2 to v0.4.5. Release notes:
    v0.4.3, v0.4.4, v0.4.5.
  - Fix broken release workflow.
  * Dependencies
  - build(deps): bump github.com/cloudflare/circl from 1.6.1 to
    1.6.3 in the go_modules group across 1 directory (#2550)
  - build(deps): bump github.com/docker/cli from
    28.3.3+incompatible to 29.2.0+incompatible in the go_modules
    group across 1 directory (#2590)
  - build(deps): bump github.com/modelcontextprotocol/go-sdk from
    1.4.0 to 1.4.1 in the go_modules group across 1 directory
    (#2659)
  - build(deps-dev): bump json from 2.18.1 to 2.19.2 in /docs in
    the bundler group across 1 directory (#2660)
  - build(deps-dev): bump nokogiri from 1.18.10 to 1.19.1 in
    /docs in the bundler group across 1 directory (#2536)
  - chore(deps): lock file maintenance (#2563)
  - chore(deps): update alpine:3.23 docker digest to 2510918
    (#2561)
  - chore(deps): update docker/setup-buildx-action action to v4
    (#2621)
  - chore(deps): update golang docker tag to v1.26.1 (#2618)
  - chore(deps): update ruby:3 docker digest to cddc8a7 (#2647)
  - chore(deps): update workflows (#2562)
  - chore(deps): update workflows (#2620)
  - chore(deps): update workflows (#2648)
  - chore(deps): update workflows (major) (#2569)
  - fix(deps): update module
    github.com/modelcontextprotocol/go-sdk to v1.3.1 [security]
    (#2560)
  - fix(deps): update module google.golang.org/grpc to v1.79.3
    [security] (#2655)
  - fix(deps): update osv-scanner minor (#2566)
  - fix(deps): update osv-scanner minor (#2619)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777636800">- Update to version 2.3.6:
  * Features:
  - Feature #2658 Support regex matching for package name
    overrides.
  - Feature #2510 Scan Homebrew inventory using git repository
    metadata.
  * Fixes:
  - Bug #2750 Sanitize \r/\n in default/table/vertical output to
    prevent GitHub Actions workflow command injection.
  - Bug #2641 Correctly output packages from osv-scanner.json
    source in spdx format.
  - Bug #2729 Increase color contrast of vulnerability stats.
  - Bug #2664 Remove second newline at end of vertical output.
  - Bug #2669 Sanitize \r in gh-annotations to prevent GitHub
    Actions workflow command injection.
  * Misc:
  - Update osv-scalibr to v0.4.6-0.20260428235529-7791e288d6c1.
  - Update Go version to 1.26.2 (#2706).</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778241600">- Update to version 2.3.8 (.7 was not released):
  * Fixes:
  - Fix installation issues with go install due to dependency
    conflicts (downgrade containerd/cgroups/v3, moby/buildkit and
    opencontainers/runtime-spec). (#2782)
  - Bug #2762 Skip packages with short commit hashes instead of
    aborting scan.
  - Bug #2781 Secure file path handling with os.OpenRoot.
  - Bug #2766 Correct typos across docs, configs, and Go source.
  * Misc:
  - Update osv-scalibr to v0.4.6-0.20260504042738-9293bfa4f86f.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781870400">- Update to version 2.4.0:
  * Features:
  - Feature #2815 Add support for the CycloneDX 1.7 specification
    (bumps cyclonedx-go to v0.11.0).
  - Feature #2799 Enable .csproj and Central Package Management
    (nugetcpm) source scanning plugins by default.
  - Feature #2871 Extract and parse Alpine OS distro version
    (e.g. Alpine:v3.17, Alpine:edge) from PURL distro qualifiers
    to scan packages under their respective Alpine ecosystems.
  - Feature #2801 Enable the swift/packageresolved plugin by
    default to support SwiftURL vulnerability scans.
  - Feature #2666 Add a Docker-based variant of the pre-commit
    hook in .pre-commit-hooks.yaml to avoid local compilation.
  - Feature #2637 Add a new configuration setting
    ScanGoModVersion (disabled by default) to avoid parsing
    toolchain version directives directly from go.mod, preventing
    misleading warnings.
  - Feature #2772 Scan container images built with Canonical
    Chisel by enabling the os/chisel extractor plugin.
  * Fixes:
  - Bug #2807 Sanitize package name, source, and version fields
    in the vertical output format to prevent GitHub Actions
    workflow command injection vulnerabilities from crafted lock
    files.
  - Bug #2876 Improve HTML scan report usability by supporting
    standard click modifiers (Ctrl/Cmd/middle click) to open
    vulnerabilities in new tabs, and preserving scroll position
    when switching tabs.
  - Bug #2783 Keep transitive dependency scanning enabled when
    specifying the --offline-vulnerabilities flag.
  - Bug #2808 Deduplicate equivalent OSV matcher requests before
    executing bulk queries to reduce API overhead.
  - Bug #2837 Prevent panics during offline matcher scans (e.g.
    on unsupported GitHub Actions ecosystem) by avoiding parsing
    errors when checking version ranges.
  - Bug #2836 Ensure the scanner returns an exit code of 0 when
  - -help or -h is explicitly requested.
  * Misc:
  - Update Go version to 1.26.4.
  - Update osv-scalibr to v0.4.6-0.20260612031204-164402d9140e.
  - Tag built Docker and GitHub Action images with the major
    version (e.g. :v2) to allow users to pin to a major version
    (#2857).
  * Dependencies
  - chore(deps): update golang.org/x/{crypto,net,sys} (#2853)
  - chore(deps): update golang docker tag to v1.26.3 (#2811)
  - fix(deps): update osv-scanner minor (#2851)
  - build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 in the go_modules group across 1 directory (#2822)
  - chore(deps): update workflows (#2852)
  - chore(deps): update workflows (#2764)
  - fix(deps): update osv-scanner minor (#2812)
  - chore(deps): lock file maintenance (#2834)
  - build(deps): bump faraday from 2.14.1 to 2.14.2 in /docs in
    the bundler group across 1 directory (#2817)
  - fix(deps): update osv-scanner minor (#2763)
  - chore(deps): lock file maintenance (#2718)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1786104000">- Update to version 2.5.0:
  * Features &amp; Refactors:
  - Full OSV-Scalibr pipeline: Migrated scanning, filtering, and
    matching in osv-scanner to use osv-scalibr end-to-end, so
    most plugins that's supported in osv-scalibr should be
    supported via the --experimental-plugins flag (#2935).
  - New extractors and ecosystem support via osv-scalibr:
  - Add javascript/vsix extractor to support scanning VS Code
    extension (.vsix) packages.
  - Extend ecosystem mapping for:
  - SUSE
  - Azure Linux / Mariner
  - Alpaquita
  - Mageia
  - openSUSE Leap
  - Debian and Ubuntu PURL
  - PURL Type Resolution: Updated osvscannerjson extractor to map
    ecosystem names to valid PURL types (golang, gem, cargo, npm,
    etc.).
  * Fixes:
  - Bug #2915 Fix issue where osv-scanner reported already-fixed
    advisories as unfixed for RHEL-family RPM packages (Red Hat,
    AlmaLinux, Rocky Linux) with epochs by sending
    epoch-qualified versions.
  - Fix Python requirements.txt extractor in osv-scalibr,
    specifically regular expressions used to extract package
    names and per-requirement options (Fixes #2940, #2931)
  - Fix NPM and Composer PURL generation in osv-scalibr,
    separating package namespace (scope) from package name
  * Dependencies
  - build(deps): bump faraday from 2.14.2 to 2.14.3 in /docs in
    the bundler group across 1 directory (#2900)</changelog>
</package>
<package pkgid="ba46d732a868bdfaaab45f66e631ad991f39f36a523ea8b24a5b3778df650c0bdaaebc13f9cfb7fe4c5779b700ea4cf468ce080e55ce53e878fe04ea777e07e0" name="osv-scanner" arch="src">
  <version epoch="0" ver="2.5.0" rel="95.2"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1734609600">- Update to version 1.9.2:
  * chore: v1.9.2 Changelog (#1455)
  * chore: cherry-pick fixes to v1 (#1459)
  * chore: Update test dockerfile node hash
  * chore(deps): update alpine docker tag to v3.21 (#1431)
  * test(maven): remove the test of transitive scanning on native
    data source (#1425)
  * chore: update golangci-lint to version 1.62.2 (#1426)
  * test: update snapshots (#1421)
  * ci: add versions fixture generator for Red Hat (#1356)
  * docs: clarify commit message requirements in `contribution.md`
    (#1416)
  * chore(deps): lock file maintenance (#1415)
  * feat(output): show package view for container scanning table
    result (#1407)
  * feat: warn if a vulnerability is ignored multiple times in the
    same config (#1377)
  * fix(guided remediation): handle extraneous/missing packages in
    package-lock.json more leniently (#1394)
  * feat(output): add a unified output result (#1397)
  * chore(deps): update codecov/codecov-action action to v5 (#1403)
  * chore(deps): lock file maintenance (#1404)
  * fix(deps): update osv-scanner minor (#1402)
  * chore(deps): update alpine:3.20 docker digest to 1e42bbe
    (#1401)
  * chore(deps): update workflows (#1393)
  * chore(deps): update golang docker tag to v1.23.3 (#1392)
  * test: use internal utility for creating tmp directory (#1371)
  * test: rewrite `models` to use snapshots and tables (#1382)
  * docs: corrected field names in osv scanner results in the JSON
    doc (#1398)
  * chore: update snapshots (#1399)
  * feat(output): update HTML output to a new design (#1383)
  * fix: add "slices" import back in (#1395)
  * feat: support evaluating spdx license expressions (#1329)
  * feat(container-scanning): set unimportant vulns as uncalled
    (#1385)
  * feat: add support for comparing Red Hat versions locally
    (#1355)
  * fix(deps): update osv-scanner minor (#1348)
  * chore(deps): lock file maintenance (#1384)
  * fix(deps): update module github.com/charmbracelet/lipgloss to
    v1 (#1373)
  * chore(deps): update workflows (#1347)
  * chore(deps): update dependency webrick to v1.9.0 (#1372)
  * test: use traditional `tt` variable name and remove unneeded
    loop-copy-var (#1381)
  * chore: update snapshots (#1375)
  * test(semantic): include ecosystems not supported by `lockfile`
    (#1364)
  * refactor: rename internal struct to avoid stuttering (#1370)
  * chore: remove deprecated internal functions (#1369)
  * test: update snapshots (#1368)
  * refactor(semantic): simplify comparing of "pre" letters in PyPI
    versions (#1366)
  * refactor(semantic): remove unneeded condition in PyPI version
    comparator (#1362)
  * refactor(semantic): simplify comparing of RubyGem version
    components (#1361)
  * refactor(semantic): remove unneeded logic in parsing
    semver-like versions (#1360)
  * fix(semantic): support parsing versions without a numeric
    component (#1365)
  * refactor(semantic): sort ecosystems by name (#1363)
  * fix: parsing crash on malformed pnpm lockfile (#1327)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1742212800">- Update to version 2.0.0:
  Important: This release includes several breaking changes aimed
  at future-proofing OSV-Scanner. Please consult our comprehensive
  Migration Guide to ensure a smooth upgrade.
  https://google.github.io/osv-scanner/migration-guide.html
  * Features:
  - Layer and base image-aware container scanning:
  - Rewritten support for Debian, Ubuntu, and Alpine container
    images.
  - Layer level analysis and vulnerability breakdown.
  - Supports Go, Java, Node, and Python artifacts within
    supported distros.
  - Base image identification via deps.dev.
  - Usage: osv-scanner scan image &lt;image-name&gt;:&lt;tag&gt;
  - Interactive HTML output:
  - Severity breakdown, package/ID/importance filtering,
    vulnerability details.
  - Container image layer filtering, layer info, base image
    identification.
  - Usage: osv-scanner scan --serve ...
  - Guided Remediation for Maven pom.xml:
  - Remediate direct and transitive dependencies
    (non-interactive mode).
  - New override remediation strategy.
  - Support for reading/writing pom.xml and parent POM files.
  - Private registry support for Maven metadata.
  - Machine-readable output for guided remediation.
  - Enhanced Dependency Extraction with osv-scalibr:
  - Haskell: cabal.project.freeze, stack.yaml.lock
  - .NET: deps.json
  - Python: uv.lock
  - Artifacts: node_modules, Python wheels, Java uber jars, Go
    binaries
  - Feature #1636 osv-scanner update command for updating the
    local vulnerability database (formerly experimental).
  - Feature #1582 Add container scanning information to vertical
    output format.
  - Feature #1587 Add support for severity in SARIF report
    format.
  - Feature #1569 Add support for bun.lock lockfiles.
  - Feature #1547 Add experimental config support to the scan
    image command.
  - Feature #1557 Allow setting port number with --serve using
    the new --port flag.
  * Breaking Changes:
  - Feature #1670 Guided remediation now defaults to
    non-interactive mode; use the --interactive flag for
    interactive mode.
  - Feature #1670 Removed the --verbosity=verbose verbosity
    level.
  - Feature #1673 &amp; Feature #1664 All previous experimental flags
    are now out of experimental, and the experimental flag
    mechanism has been removed.
  - Feature #1651 Multiple license flags have been merged into a
    single --license flag.
  - Feature #1666 API: reporter removed; logging now uses slog,
    which can be overridden.
  - Feature #1638 API: Deprecated packages removed, including
    lockfile (migrated to OSV-Scalibr).
  * Improvements:
  - Feature #1561 Updated HTML report for better contrast and
    usability (from beta2).
  - Feature #1584 Make skipping the root git repository the
    default behavior (from beta2).
  - Feature #1648 Updated HTML report styling to improve contrast
    (from rc1).
  * Fixes:
  - Fix #1598 Fix table output vulnerability ordering.
  - Fix #1616 Filter out Ubuntu unimportant vulnerabilities.
  - Fix #1585 Fixed issue where base images are occasionally
    duplicated.
  - Fix #1597 Fixed issue where SBOM parsers are not correctly
    parsing CycloneDX files when using the bom.xml filename.
  - Fix #1566 Fixed issue where offline scanning returns
    different results from online scanning.
  - Fix #1538 Reduce memory usage when using guided remediation.
  We encourage everyone to upgrade to OSV-Scanner v2.0.0 and
  experience these powerful new capabilities! As always, your
  feedback is invaluable, so please don't hesitate to share your
  thoughts and suggestions.
  - General V2 feedback
    https://github.com/google/osv-scanner/discussions/1529
  - Container scanning feedback
    https://github.com/google/osv-scanner/discussions/1521</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743681600">- Update to version 2.0.1:
  * Features:
  - Feature #1730 Add support for extracting dependencies from
    .NET packages.config and packages.lock.json files.
  - Feature #1770 Add support for extracting dependencies from
    rust binaries compiled with cargo-auditable.
  - Feature #1761 Improve output when scanning for OS packages,
    we now show binary packages associated with a source package
    in the table output.
  * Fixes:
  - Bug #1752 Fix paging depth issue when querying the osv.dev
    API.
  - Bug #1747 Ensure osv-reporter prints warnings instead of
    errors for certain messages to return correct exit code
    (related to osv-scanner-action#65).
  - Bug #1717 Fix issue where nested CycloneDX components were
    not being parsed.
  - Bug #1744 Fix issue where empty CycloneDX SBOMs was causing a
    panic.
  - Bug #1726 De-duplicate references in CycloneDX report output
    for improved validity.
  - Bug #1727 Remove automatic opening of HTML reports in the
    browser (fixes #1721).
  - Bug #1735 Require a tag when scanning container images to
    prevent potential errors.
  * API Changes:
  - API Change #1763 Made the SourceType enum public.
  * Dependencies:
  - chore(deps): bump github.com/containerd/containerd from
    1.7.18 to 1.7.27 in the go_modules group across 1 directory
    (#1719)
  - chore(deps): update goreleaser/goreleaser-action action to
    v6.3.0 (#1765)
  - chore(deps): update workflows (#1713)
  - chore(deps): update workflows (#1731)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746014400">- Update to version 2.0.2:
  * Fixes:
  - Bug #1842 Fix an issue in the GitHub Action where call
    analysis for Go projects using the tool directive (Go 1.24+)
    in go.mod files would fail. The scanner image has been
    updated to use a newer Go version.
  - Bug #1806 Fix an issue where license overrides were not
    correctly reflected in the final scan results and license
    summary.
  - Fix #1825, #1809, #1805, #1803, #1787 Enhance XML output
    stability and consistency by preserving original spacing and
    minimizing unnecessary escaping. This helps reduce
    differences when XML files are processed.
  * What's changed
  - chore(deps-dev): bump nokogiri from 1.18.4 to 1.18.8 in /docs
    in the bundler group across 1 directory (#1815)
  - chore: Changelog for v2.0.2 (#1847)
  - fix(gh-action): call analysis doesn't work for go 1.24
    (#1842)
  - test(osv-scanner/fix): actually import command from package
    (#1845)
  - test(fix): use public package (#1832)
  - test: add case for when "false" is explicitly passed as the
    value for `--offline` (#1841)
  - refactor(cmd): rename and cleanup `licenseGenericFlag`
    implementation (#1834)
  - test: only include specific command under test in `cmd`
    package tests (#1831)
  - test: update snapshots (#1833)
  - feat(xml): store the original text in CharData (#1825)
  - chore: Update snaps again (#1824)
  - chore(deps): update workflows (#1799)
  - fix(deps): update osv-scanner minor (#1800)
  - chore(deps): lock file maintenance (#1801)
  - test: move `source` cases into subpackage (#1759)
  - chore: Remove renovatebot constraint (#1820)
  - refactor: use constants for extractor names (#1819)
  - test: ensure that all tests are run in parallel (#1817)
  - refactor: ensure all extractors have a single interface check
    at the bottom of the file (#1818)
  - refactor: avoid repeated call to get scan global flags
    (#1816)
  - docs: Update Maven Central and private registries support
    (#1812)
  - chore: Update snapshots (#1813)
  - feat(xml): do not escape texts in char data (#1809)
  - feat: Parallel tests with global logger (#1798)
  - fix: override licenses in scan results (#1806)
  - chore: Update snapshot again again (#1807)
  - feat(xml): keep the white space between attributes (#1805)
  - refactor: Switch to use public osvdev client (#1804)
  - feat(xml): do not escape double quotes (#1803)
  - chore: Update scalibr to use the new inventory format.
    (#1797)
  - chore: Update snapshot again (#1802)
  - chore: Update snapshots (#1796)
  - feat(xml): keep the extra space in self-closing tags (#1787)
  - chore(deps): update
    gaurav-nelson/github-action-markdown-link-check digest to
    3c3b66f (#1784)
  - chore(deps): update golang docker tag to v1.24.2 (#1785)
  - test: update snapshots (#1786)
  - feat: support outputting results in `spdx` format (#1776)
  - test: update snapshots (#1782)
  - build: move off deprecated archives.format and
    archives.builds properties again (#1779)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1750075200">- Update to version 2.0.3:
  * Features:
  - Feature #1943 Added a flag to suppress "no package sources
    found" error.
  - Feature #1844 Allow flags to be passed after scan targets,
    e.g. osv-scanner ./scan-this-dir --format=vertical, by
    updating to cli/v3
  - Feature #1882 Added a stable tag to container images for
    releases that follow semantic versioning.
  - Feature #1846 Experimental: Add --experimental-extractors and
  - -experimental-disable-extractors flags to allow for more
    granular control over which OSV-Scalibr dependency extractors
    are used.
  * Fixes:
  - Bug #1856 Improve XML output by guessing and matching the
    indentation of existing &lt;dependency&gt; elements.
  - Bug #1850 Prevent escaping of single quotes in XML attributes
    for better readability and correctness.
  - Bug #1922 Prevent a potential panic in MatchVulnerabilities
    when the API response is nil, particularly on timeout.
  - Bug #1916 Add the "ubuntu" namespace to the debian purl type
    to correctly parse dpkg BOMs generated on Ubuntu.
  - Bug #1871 Ensure inventories are sorted by PURL in addition
    to name and version to prevent incorrect deduplication of
    packages.
  - Bug #1919 Improve error reporting by including the underlying
    error when the response body from a Maven registry cannot be
    read.
  - Bug #1857 Fix an issue where SPDX output is not correctly
    outputted because it was getting overwritten.
  - Bug #1873 Fix the GitHub Action to not ignore general errors
    during execution.
  - Bug #1955 Fix issue causing error messages to be spammed when
    not running in a git repository.
  - Bug #1930 Fix issue where Maven client loses auth data during
    extraction.
  * Misc:
  - Update dependencies and updated golang to 1.24.4
  - fix(deps): update osv-scanner minor (#1951)
  - chore(deps): update golang docker tag to v1.24.4 (#1933)
  - chore(deps): update github/codeql-action action to v3.29.0
    (#1932)
  - fix(deps): update osv-scanner minor (#1914)
  - chore(deps): update ossf/scorecard-action action to v2.4.2
    (#1915)
  - chore(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 in
    /experimental/javareach in the go_modules group across 1
    directory (#1811)
  - chore(deps): update golangci/golangci-lint-action action to
    v8 (#1766)
  - fix(deps): update osv-scanner minor (#1863)
  - chore(deps): update workflows (#1837)
  - chore(deps): lock file maintenance (#1838)
  - chore(deps): update golang docker tag to v1.24.3 (#1864)
  - fix(deps): update osv-scanner minor (#1836)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1752235200">- Update to version 2.1.0:
  * Features:
  - Feature #2038 Add CycloneDX location field to the output
    source string.
  - Feature #2036 Include upstream source information in
    vulnerability grouping to improve accuracy.
  - Feature #1970 Hide unimportant vulnerabilities by default to
    reduce noise, and adds a --show-all-vulns flag to show all.
  - Feature #2003 Add experimental summary output format for the
    reporter.
  - Feature #1988 Add support for CycloneDX 1.6 report format.
  - Feature #1987 Add support for gems.locked files used by
    Bundler.
  - Feature #1980 Enable transitive dependency extraction for
    Python requirements.txt files.
  - Feature #1961 Deprecate the --sbom flag in favor of the
    existing -L/--lockfile flag for scanning SBOMs.
  - Feature #1963 Stabilize various experimental fields in the
    output by moving them out of the experimental struct.
  - Feature #1957 Use a dedicated exit code for invalid
    configuration files.
  * Fixes:
  - Bug #2046 Correctly set the user agent string for all
    outgoing requests.
  - Bug #2019 Use more natural language in the descriptions for
    extractor-related flags.
  - Bug #1982 Correctly parse Ubuntu package information with
    suffixes (e.g. :Pro, :LTS).
  - Bug #2000 Ensure CDATA content in XML is correctly outputted
    in guided remediation.
  - Bug #1949 Fix filtering of package types in vulnerability
    counts.
  * Dependencies
  - chore(deps): lock file maintenance (#2006)
  - chore(deps): update alpine docker tag to v3.22 (#1952)
  - chore(deps): update github/codeql-action action to v3.29.2
    (#2018)
  - chore(deps): update workflows (#1989)
  - chore: Update go-sarif to v3 from v2 (#1985)
  - chore: Update scalibr again (#2044)
  - chore: Update scalibr and remove javareach (#2011)
  - chore: ignore use of our own deprecated field (#1991)
  - chore: remove unneeded `goland:noinspection
    GoBoolExpressions` comments (#2043)
  - chore: update linter to v2.2 (#2016)
  - chore: v2.1.0 Changelog (#2054)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754568000">- Update to version 2.2.0:
  OSV-Scanner now supports all OSV-Scalibr features behind
  experimental flags (--experimental-plugins, see details here)!
  * Features:
  - Feature #2146 Allow manual OSV-Scalibr plugin selection.
  - Feature #2144 Add OSV-Scalibr version to osv-scanner
  - -version output.
  - Feature #2021 Add experimental support for running
    OSV-Scalibr detectors.
  - Feature #2079 Fall back to offline extractor if the
    transitive one fails, so at least direct dependencies are
    returned.
  - Feature #2032 Add summary section at the top of outputs and a
    'Fixed Version' column.
  - Feature #2076 Support Ubuntu severity type.
  * Fixes:
  - Bug #2141 Fix OSV-Scanner json scans not matching with
    correct ecosystem.
  - Bug #2084 Show absolute paths when scanning containers.
  - Bug #2126 Log and preserve package count before continuing on
    db error.
  - Bug #2095 Pass through plugin capabilities correctly.
  - Bug #2051 Properly flag if running on Linux or Mac OSs for
    plugin compatibility.
  - Bug #2072 Add missing "text" property in description fields.
  - Bug #2068 Change links in output to go to the specific
    vulnerability page instead of the list page.
  - Bug #2064 Fix SARIF v3 output to include results.
  * API Changes:
  - API Change #2096 Allow log handler to be overridden.
  * Dependencies:
  - chore(deps): update alpine:3.22 docker digest to 4bcff63
    (#2089)
  - chore(deps): update github/codeql-action action to v3.29.5
    (#2116)
  - chore(deps): update golang docker tag to v1.24.5 (#2062)
  - chore(deps): update golang:1.24.5-alpine3.21 docker digest to
    6edc205 (#2090)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755604800">- Update to version 2.2.1:
  * Fixes
  - Bug #2151 Filter by ecosystem before querying.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756382400">- Update to version 2.2.2:
  * Features:
  - Feature #2113 Add support for Java reachability analysis to
    identify uncalled vulnerabilities in JAR files.
  - Feature #2177 Automatically parse osv-scanner-custom.json
    files as osv-scanner.json custom lockfiles.
  * Fixes:
  - Bug #2204 Add a warning to guide users to the correct GitHub
    Action.
  - Bug #2202 Fix incorrect exit code when unimportant
    vulnerabilities are found in non-container scans.
  - Bug #2188 Fix handling of absolute paths on Windows.
  * Dependencies
  - fix(deps): update osv-scalibr (#2175)
  - chore(deps): update golang docker tag to v1.24.6 (#2167)
  - chore(deps): update workflows (#2165)
  - chore(deps): lock file maintenance (#2143)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1759320000">- Update to version 2.2.3:
  * Features:
  - Feature #2209 Add support for resolving git packages that
    have a version specified.
  - Feature #2210 Make the --experimental-plugins flag additive
    by default, and introduce a new
  - -experimental-no-default-plugins flag.
  - Feature #2203 Update osv-scalibr to 0.3.4 for improved
    dependency extraction. See osv-scalibr changelog for
    additional information.
  * Fixes:
  - Bug #2214 Fix issue where input.Path was incorrectly
    constructed on Windows when using the -L flag.
  - Fix #2241 Performance: Greatly reduce memory usage in the
    local matcher by only loading advisories relevant to the
    packages being scanned.
  * Dependencies
  - chore(deps): update workflows (#2251)
  - fix(deps): update osv-scanner minor (#2250)
  - fix(deps): update osv-scanner minor (#2231)
  - chore(deps): update golang docker tag to v1.25.1 (#2223)
  - chore(deps): update workflows (#2224)
  - chore(deps): update workflows (major) (#2232)
  - chore(deps): lock file maintenance (#2233)
  - chore(deps-dev): bump rexml from 3.4.1 to 3.4.2 in /docs in
    the bundler group across 1 directory (#2237)
  - fix(deps): update osv-scanner minor (#2213)
  - fix(deps): update osv-scanner minor (#2166)
  - chore(deps): update golang docker tag to v1.25.0 (#2185)
  - chore(deps): update workflows (#2186)
  - chore(deps): lock file maintenance (#2187)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761739200">- Update to version 2.2.4:
  * Features:
  - Feature #2256 Add experimental OSV-Scanner MCP server.
    (osv-scanner experimental-mcp)
  - Feature #2284 Update osv-scalibr integration, replacing
    baseimagematch with the base image enricher.
  - Feature #2216 Warn when vulnerabilities specified in the
    ignore config are not found during a scan (fixes #2206).
  * Fixes:
  - Bug #2305 Ignore common protocols and .git suffix when
    checking if an advisory affects a git repository (fixes
    [#2291]).
  - Bug #2300 Ensure the global logger is used in cmdlogger and
    osv-scalibr when set (fixes #2081).
  - Bug #2295 Fix Go stdlib license result matching (fixes
    [#2191]).
  * Dependencies
  - chore(deps): lock file maintenance (#2265)
  - chore(deps): update alpine:3.22 docker digest to 4b7ce07
    (#2272)
  - chore(deps): update github/codeql-action action to v3.30.9
    (#2287)
  - chore(deps): update golang docker tag to v1.25.3 (#2275)
  - chore(deps): update workflows (#2264)
  - chore(deps): update workflows (#2273)
  - chore(deps): update workflows (major) (#2288)
  - chore(deps): update workflows (major) (#2302)
  - fix(deps): update osv-scanner minor (#2263)
  - fix(deps): update osv-scanner minor (#2276)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763553600">- Update to version 2.3.0:
  * Features:
  - Feature #2321 Add support for license checks for RubyGems.
  - Feature #2294 Replace requirementsenhanceable extractor with
    transitive enricher.
  - Feature #2344 Use osduplicate annotators.
  * Fixes:
  - Bug #2329 Add --ignore-scripts flag to npm lockfile
    generation.
  - Bug #2311 Improve logic for --all-packages flag.
  - Bug #2309 Exit with a non-zero code when showing help.
  - Bug #2316 Pre-commit hook now defaults to scanning current
    directory instead of failing.
  - Bug #1507 (osv-scalibr) Interpolate Maven projects before
    extracting repositories.
  * Dependencies
  - chore(deps): update github/codeql-action action to v4.31.3
    (#2347)
  - fix(deps): update osv-scanner minor (#2346)
  - fix(deps): update osv-scanner minor (#2286)
  - chore(deps): bump github.com/opencontainers/selinux from
    1.12.0 to 1.13.0 in the go_modules group across 1 directory
    (#2338)
  - chore(deps): bump github.com/containerd/containerd from
    1.7.27 to 1.7.29 in the go_modules group across 1 directory
    (#2326)
  - chore(deps): update docker/setup-qemu-action digest to
    c7c5346 (#2334)
  - chore(deps): update golang docker tag to v1.25.4 (#2335)
  - chore(deps): update golangci/golangci-lint-action action to
    v9 (#2336)
  - chore(deps): update github/codeql-action action to v4.31.2
    (#2301)
  - chore(deps): lock file maintenance (#2315)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 2.3.1:
  * Features:
  - Feature #2370 Add support for the packagedeprecation plugin
    via the new --experimental-flag-deprecated-packages flag. The
    result is available in all output formats except SPDX.
  * Fixes:
  - Bug #2395 Fix license scanning to correctly match new
    deps.dev package names.
  - Bug #2333 Deduplicate SARIF outputs for GitHub.
  - Bug #2259 Fix lookup of Go packages with major versions by
    including the subpath of Go PURLs, preventing false
    positives.
  * Misc:
  - Updated Go version to v1.25.5 to support Go reachability
    analysis for the latest version.
  * Dependencies
  - chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0
    in the go_modules group across 1 directory (#2357)
  - chore(deps): update actions/checkout action to v6 (#2379)
  - chore(deps): update dependency webrick to v1.9.2 (#2378)
  - chore(deps): update workflows (#2364)
  - chore(deps): update workflows (#2402)
  - fix(deps): update osv-scanner minor (#2365)
  - fix(deps): update osv-scanner minor (#2400)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768478400">- Update to version 2.3.2:
  This release includes performance improvements for local
  scanning, reducing memory usage and avoiding unnecessary advisory
  loading. It also fixes issues with MCP's
  get_vulnerability_details tool, git queries in osv-scanner.json,
  and ignore entry tracking, along with documentation updates.
  * Fixes:
  - Bug #2415 Add more PURL-to-ecosystem mappings
  - Bug #2422 MCP error for get_vulnerability_id because type
    definition is incorrect.
  - Bug #2460 Enable osv-scanner.json git queries
  - Bug #2456 Properly track if an ignore entry has been used
  - Bug #2450 Performance: Avoid loading the entire advisory
    unless it will actually be used
  - Bug #2445 Performance: Don't read the entire zip into memory
  - Bug #2433 Allow specifying user agent in v2 osvscanner
    package
  * Misc:
  - Misc #2453 Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3
  - Misc #2447 Include bun.lock as a supported lockfile
  - Misc #2444 Document GoVersionOverride in configuration.md
  * Dependencies
  - fix(deps): update osv-scanner minor (#2459)
  - chore(deps): update ruby docker tag to v4 (#2432)
  - chore(deps): update alpine:3.23 docker digest to 865b95f
    (#2425)
  - chore(deps): update docker/setup-buildx-action digest to
    8d2750c (#2426)
  - chore(deps): switch from gopkg.in/yaml.v3 to
    go.yaml.in/yaml/v3 (#2453)
  - fix(deps): update osv-scanner minor (#2427)
  - chore(deps): update alpine docker tag to v3.23 (#2401)
  - chore(deps): update workflows (#2417)
  - fix(deps): update osv-scanner minor (#2418)
  - chore(deps): update workflows (major) (#2419)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770897600">- Update to version 2.3.3:
  * Features:
  - Feature #2458 Add --exclude flag to skip paths during
    scanning.
  - Feature #2477 Add pylock extractor.
  - Feature #2475 Add base image info to container scanning
    output header (in table, markdown and vertical formats).
  * Misc:
  - Update Go version to 1.25.7.
  - Update osv-scalibr from v0.4.1 to v0.4.2. Release note.
  - Refactor to better align with osv-scalibr plugins and
    inventory data structure.
  * Dependencies
  - build(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to
    5.16.5 in the go_modules group across 1 directory (#2504)
  - build(deps-dev): bump faraday from 2.14.0 to 2.14.1 in /docs
    in the bundler group across 1 directory (#2503)
  - chore(deps): update workflows (#2471)
  - chore: update Go version to v1.25.6 (#2490)
  - fix(deps): update osv-scanner minor (#2470)
  - fix: bump Go to v1.25.7 (#2506)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774440000">- Update to version 2.3.5 (.4 was not released):
  * Features:
  - Feature #2571 Enable transitive scanning for Python
    requirements.txt files using the deps.dev API.
  - Feature #2649 Add ability to allow unsafe plugins, logging a
    warning when any unsafe plugin is enabled.
  * Fixes:
  - Bug #2630 Improve startup performance on Windows Terminal by
    updating lipgloss.
  - Bug #2599 Ensure the package deprecation enricher respects
    the same configuration as other plugins.
  - Bug #2600 Ensure the Java extractor plugin for call analysis
    respects the same configuration as other plugins.
  * Misc:
  - Update osv-scalibr from v0.4.2 to v0.4.5. Release notes:
    v0.4.3, v0.4.4, v0.4.5.
  - Fix broken release workflow.
  * Dependencies
  - build(deps): bump github.com/cloudflare/circl from 1.6.1 to
    1.6.3 in the go_modules group across 1 directory (#2550)
  - build(deps): bump github.com/docker/cli from
    28.3.3+incompatible to 29.2.0+incompatible in the go_modules
    group across 1 directory (#2590)
  - build(deps): bump github.com/modelcontextprotocol/go-sdk from
    1.4.0 to 1.4.1 in the go_modules group across 1 directory
    (#2659)
  - build(deps-dev): bump json from 2.18.1 to 2.19.2 in /docs in
    the bundler group across 1 directory (#2660)
  - build(deps-dev): bump nokogiri from 1.18.10 to 1.19.1 in
    /docs in the bundler group across 1 directory (#2536)
  - chore(deps): lock file maintenance (#2563)
  - chore(deps): update alpine:3.23 docker digest to 2510918
    (#2561)
  - chore(deps): update docker/setup-buildx-action action to v4
    (#2621)
  - chore(deps): update golang docker tag to v1.26.1 (#2618)
  - chore(deps): update ruby:3 docker digest to cddc8a7 (#2647)
  - chore(deps): update workflows (#2562)
  - chore(deps): update workflows (#2620)
  - chore(deps): update workflows (#2648)
  - chore(deps): update workflows (major) (#2569)
  - fix(deps): update module
    github.com/modelcontextprotocol/go-sdk to v1.3.1 [security]
    (#2560)
  - fix(deps): update module google.golang.org/grpc to v1.79.3
    [security] (#2655)
  - fix(deps): update osv-scanner minor (#2566)
  - fix(deps): update osv-scanner minor (#2619)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777636800">- Update to version 2.3.6:
  * Features:
  - Feature #2658 Support regex matching for package name
    overrides.
  - Feature #2510 Scan Homebrew inventory using git repository
    metadata.
  * Fixes:
  - Bug #2750 Sanitize \r/\n in default/table/vertical output to
    prevent GitHub Actions workflow command injection.
  - Bug #2641 Correctly output packages from osv-scanner.json
    source in spdx format.
  - Bug #2729 Increase color contrast of vulnerability stats.
  - Bug #2664 Remove second newline at end of vertical output.
  - Bug #2669 Sanitize \r in gh-annotations to prevent GitHub
    Actions workflow command injection.
  * Misc:
  - Update osv-scalibr to v0.4.6-0.20260428235529-7791e288d6c1.
  - Update Go version to 1.26.2 (#2706).</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778241600">- Update to version 2.3.8 (.7 was not released):
  * Fixes:
  - Fix installation issues with go install due to dependency
    conflicts (downgrade containerd/cgroups/v3, moby/buildkit and
    opencontainers/runtime-spec). (#2782)
  - Bug #2762 Skip packages with short commit hashes instead of
    aborting scan.
  - Bug #2781 Secure file path handling with os.OpenRoot.
  - Bug #2766 Correct typos across docs, configs, and Go source.
  * Misc:
  - Update osv-scalibr to v0.4.6-0.20260504042738-9293bfa4f86f.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781870400">- Update to version 2.4.0:
  * Features:
  - Feature #2815 Add support for the CycloneDX 1.7 specification
    (bumps cyclonedx-go to v0.11.0).
  - Feature #2799 Enable .csproj and Central Package Management
    (nugetcpm) source scanning plugins by default.
  - Feature #2871 Extract and parse Alpine OS distro version
    (e.g. Alpine:v3.17, Alpine:edge) from PURL distro qualifiers
    to scan packages under their respective Alpine ecosystems.
  - Feature #2801 Enable the swift/packageresolved plugin by
    default to support SwiftURL vulnerability scans.
  - Feature #2666 Add a Docker-based variant of the pre-commit
    hook in .pre-commit-hooks.yaml to avoid local compilation.
  - Feature #2637 Add a new configuration setting
    ScanGoModVersion (disabled by default) to avoid parsing
    toolchain version directives directly from go.mod, preventing
    misleading warnings.
  - Feature #2772 Scan container images built with Canonical
    Chisel by enabling the os/chisel extractor plugin.
  * Fixes:
  - Bug #2807 Sanitize package name, source, and version fields
    in the vertical output format to prevent GitHub Actions
    workflow command injection vulnerabilities from crafted lock
    files.
  - Bug #2876 Improve HTML scan report usability by supporting
    standard click modifiers (Ctrl/Cmd/middle click) to open
    vulnerabilities in new tabs, and preserving scroll position
    when switching tabs.
  - Bug #2783 Keep transitive dependency scanning enabled when
    specifying the --offline-vulnerabilities flag.
  - Bug #2808 Deduplicate equivalent OSV matcher requests before
    executing bulk queries to reduce API overhead.
  - Bug #2837 Prevent panics during offline matcher scans (e.g.
    on unsupported GitHub Actions ecosystem) by avoiding parsing
    errors when checking version ranges.
  - Bug #2836 Ensure the scanner returns an exit code of 0 when
  - -help or -h is explicitly requested.
  * Misc:
  - Update Go version to 1.26.4.
  - Update osv-scalibr to v0.4.6-0.20260612031204-164402d9140e.
  - Tag built Docker and GitHub Action images with the major
    version (e.g. :v2) to allow users to pin to a major version
    (#2857).
  * Dependencies
  - chore(deps): update golang.org/x/{crypto,net,sys} (#2853)
  - chore(deps): update golang docker tag to v1.26.3 (#2811)
  - fix(deps): update osv-scanner minor (#2851)
  - build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 in the go_modules group across 1 directory (#2822)
  - chore(deps): update workflows (#2852)
  - chore(deps): update workflows (#2764)
  - fix(deps): update osv-scanner minor (#2812)
  - chore(deps): lock file maintenance (#2834)
  - build(deps): bump faraday from 2.14.1 to 2.14.2 in /docs in
    the bundler group across 1 directory (#2817)
  - fix(deps): update osv-scanner minor (#2763)
  - chore(deps): lock file maintenance (#2718)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1786104000">- Update to version 2.5.0:
  * Features &amp; Refactors:
  - Full OSV-Scalibr pipeline: Migrated scanning, filtering, and
    matching in osv-scanner to use osv-scalibr end-to-end, so
    most plugins that's supported in osv-scalibr should be
    supported via the --experimental-plugins flag (#2935).
  - New extractors and ecosystem support via osv-scalibr:
  - Add javascript/vsix extractor to support scanning VS Code
    extension (.vsix) packages.
  - Extend ecosystem mapping for:
  - SUSE
  - Azure Linux / Mariner
  - Alpaquita
  - Mageia
  - openSUSE Leap
  - Debian and Ubuntu PURL
  - PURL Type Resolution: Updated osvscannerjson extractor to map
    ecosystem names to valid PURL types (golang, gem, cargo, npm,
    etc.).
  * Fixes:
  - Bug #2915 Fix issue where osv-scanner reported already-fixed
    advisories as unfixed for RHEL-family RPM packages (Red Hat,
    AlmaLinux, Rocky Linux) with epochs by sending
    epoch-qualified versions.
  - Fix Python requirements.txt extractor in osv-scalibr,
    specifically regular expressions used to extract package
    names and per-requirement options (Fixes #2940, #2931)
  - Fix NPM and Composer PURL generation in osv-scalibr,
    separating package namespace (scope) from package name
  * Dependencies
  - build(deps): bump faraday from 2.14.2 to 2.14.3 in /docs in
    the bundler group across 1 directory (#2900)</changelog>
</package>
<package pkgid="9aa02b71bc647b5df3d184838f4e77e597bced3c867876713615216cbf08ccdee7ad0787895c8453fbc762ebfb42402632df72489d3c9901cde52110133a45f7" name="osv-scanner-debuginfo" arch="s390x">
  <version epoch="0" ver="2.5.0" rel="95.2"/>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1734609600">- Update to version 1.9.2:
  * chore: v1.9.2 Changelog (#1455)
  * chore: cherry-pick fixes to v1 (#1459)
  * chore: Update test dockerfile node hash
  * chore(deps): update alpine docker tag to v3.21 (#1431)
  * test(maven): remove the test of transitive scanning on native
    data source (#1425)
  * chore: update golangci-lint to version 1.62.2 (#1426)
  * test: update snapshots (#1421)
  * ci: add versions fixture generator for Red Hat (#1356)
  * docs: clarify commit message requirements in `contribution.md`
    (#1416)
  * chore(deps): lock file maintenance (#1415)
  * feat(output): show package view for container scanning table
    result (#1407)
  * feat: warn if a vulnerability is ignored multiple times in the
    same config (#1377)
  * fix(guided remediation): handle extraneous/missing packages in
    package-lock.json more leniently (#1394)
  * feat(output): add a unified output result (#1397)
  * chore(deps): update codecov/codecov-action action to v5 (#1403)
  * chore(deps): lock file maintenance (#1404)
  * fix(deps): update osv-scanner minor (#1402)
  * chore(deps): update alpine:3.20 docker digest to 1e42bbe
    (#1401)
  * chore(deps): update workflows (#1393)
  * chore(deps): update golang docker tag to v1.23.3 (#1392)
  * test: use internal utility for creating tmp directory (#1371)
  * test: rewrite `models` to use snapshots and tables (#1382)
  * docs: corrected field names in osv scanner results in the JSON
    doc (#1398)
  * chore: update snapshots (#1399)
  * feat(output): update HTML output to a new design (#1383)
  * fix: add "slices" import back in (#1395)
  * feat: support evaluating spdx license expressions (#1329)
  * feat(container-scanning): set unimportant vulns as uncalled
    (#1385)
  * feat: add support for comparing Red Hat versions locally
    (#1355)
  * fix(deps): update osv-scanner minor (#1348)
  * chore(deps): lock file maintenance (#1384)
  * fix(deps): update module github.com/charmbracelet/lipgloss to
    v1 (#1373)
  * chore(deps): update workflows (#1347)
  * chore(deps): update dependency webrick to v1.9.0 (#1372)
  * test: use traditional `tt` variable name and remove unneeded
    loop-copy-var (#1381)
  * chore: update snapshots (#1375)
  * test(semantic): include ecosystems not supported by `lockfile`
    (#1364)
  * refactor: rename internal struct to avoid stuttering (#1370)
  * chore: remove deprecated internal functions (#1369)
  * test: update snapshots (#1368)
  * refactor(semantic): simplify comparing of "pre" letters in PyPI
    versions (#1366)
  * refactor(semantic): remove unneeded condition in PyPI version
    comparator (#1362)
  * refactor(semantic): simplify comparing of RubyGem version
    components (#1361)
  * refactor(semantic): remove unneeded logic in parsing
    semver-like versions (#1360)
  * fix(semantic): support parsing versions without a numeric
    component (#1365)
  * refactor(semantic): sort ecosystems by name (#1363)
  * fix: parsing crash on malformed pnpm lockfile (#1327)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1742212800">- Update to version 2.0.0:
  Important: This release includes several breaking changes aimed
  at future-proofing OSV-Scanner. Please consult our comprehensive
  Migration Guide to ensure a smooth upgrade.
  https://google.github.io/osv-scanner/migration-guide.html
  * Features:
  - Layer and base image-aware container scanning:
  - Rewritten support for Debian, Ubuntu, and Alpine container
    images.
  - Layer level analysis and vulnerability breakdown.
  - Supports Go, Java, Node, and Python artifacts within
    supported distros.
  - Base image identification via deps.dev.
  - Usage: osv-scanner scan image &lt;image-name&gt;:&lt;tag&gt;
  - Interactive HTML output:
  - Severity breakdown, package/ID/importance filtering,
    vulnerability details.
  - Container image layer filtering, layer info, base image
    identification.
  - Usage: osv-scanner scan --serve ...
  - Guided Remediation for Maven pom.xml:
  - Remediate direct and transitive dependencies
    (non-interactive mode).
  - New override remediation strategy.
  - Support for reading/writing pom.xml and parent POM files.
  - Private registry support for Maven metadata.
  - Machine-readable output for guided remediation.
  - Enhanced Dependency Extraction with osv-scalibr:
  - Haskell: cabal.project.freeze, stack.yaml.lock
  - .NET: deps.json
  - Python: uv.lock
  - Artifacts: node_modules, Python wheels, Java uber jars, Go
    binaries
  - Feature #1636 osv-scanner update command for updating the
    local vulnerability database (formerly experimental).
  - Feature #1582 Add container scanning information to vertical
    output format.
  - Feature #1587 Add support for severity in SARIF report
    format.
  - Feature #1569 Add support for bun.lock lockfiles.
  - Feature #1547 Add experimental config support to the scan
    image command.
  - Feature #1557 Allow setting port number with --serve using
    the new --port flag.
  * Breaking Changes:
  - Feature #1670 Guided remediation now defaults to
    non-interactive mode; use the --interactive flag for
    interactive mode.
  - Feature #1670 Removed the --verbosity=verbose verbosity
    level.
  - Feature #1673 &amp; Feature #1664 All previous experimental flags
    are now out of experimental, and the experimental flag
    mechanism has been removed.
  - Feature #1651 Multiple license flags have been merged into a
    single --license flag.
  - Feature #1666 API: reporter removed; logging now uses slog,
    which can be overridden.
  - Feature #1638 API: Deprecated packages removed, including
    lockfile (migrated to OSV-Scalibr).
  * Improvements:
  - Feature #1561 Updated HTML report for better contrast and
    usability (from beta2).
  - Feature #1584 Make skipping the root git repository the
    default behavior (from beta2).
  - Feature #1648 Updated HTML report styling to improve contrast
    (from rc1).
  * Fixes:
  - Fix #1598 Fix table output vulnerability ordering.
  - Fix #1616 Filter out Ubuntu unimportant vulnerabilities.
  - Fix #1585 Fixed issue where base images are occasionally
    duplicated.
  - Fix #1597 Fixed issue where SBOM parsers are not correctly
    parsing CycloneDX files when using the bom.xml filename.
  - Fix #1566 Fixed issue where offline scanning returns
    different results from online scanning.
  - Fix #1538 Reduce memory usage when using guided remediation.
  We encourage everyone to upgrade to OSV-Scanner v2.0.0 and
  experience these powerful new capabilities! As always, your
  feedback is invaluable, so please don't hesitate to share your
  thoughts and suggestions.
  - General V2 feedback
    https://github.com/google/osv-scanner/discussions/1529
  - Container scanning feedback
    https://github.com/google/osv-scanner/discussions/1521</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743681600">- Update to version 2.0.1:
  * Features:
  - Feature #1730 Add support for extracting dependencies from
    .NET packages.config and packages.lock.json files.
  - Feature #1770 Add support for extracting dependencies from
    rust binaries compiled with cargo-auditable.
  - Feature #1761 Improve output when scanning for OS packages,
    we now show binary packages associated with a source package
    in the table output.
  * Fixes:
  - Bug #1752 Fix paging depth issue when querying the osv.dev
    API.
  - Bug #1747 Ensure osv-reporter prints warnings instead of
    errors for certain messages to return correct exit code
    (related to osv-scanner-action#65).
  - Bug #1717 Fix issue where nested CycloneDX components were
    not being parsed.
  - Bug #1744 Fix issue where empty CycloneDX SBOMs was causing a
    panic.
  - Bug #1726 De-duplicate references in CycloneDX report output
    for improved validity.
  - Bug #1727 Remove automatic opening of HTML reports in the
    browser (fixes #1721).
  - Bug #1735 Require a tag when scanning container images to
    prevent potential errors.
  * API Changes:
  - API Change #1763 Made the SourceType enum public.
  * Dependencies:
  - chore(deps): bump github.com/containerd/containerd from
    1.7.18 to 1.7.27 in the go_modules group across 1 directory
    (#1719)
  - chore(deps): update goreleaser/goreleaser-action action to
    v6.3.0 (#1765)
  - chore(deps): update workflows (#1713)
  - chore(deps): update workflows (#1731)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746014400">- Update to version 2.0.2:
  * Fixes:
  - Bug #1842 Fix an issue in the GitHub Action where call
    analysis for Go projects using the tool directive (Go 1.24+)
    in go.mod files would fail. The scanner image has been
    updated to use a newer Go version.
  - Bug #1806 Fix an issue where license overrides were not
    correctly reflected in the final scan results and license
    summary.
  - Fix #1825, #1809, #1805, #1803, #1787 Enhance XML output
    stability and consistency by preserving original spacing and
    minimizing unnecessary escaping. This helps reduce
    differences when XML files are processed.
  * What's changed
  - chore(deps-dev): bump nokogiri from 1.18.4 to 1.18.8 in /docs
    in the bundler group across 1 directory (#1815)
  - chore: Changelog for v2.0.2 (#1847)
  - fix(gh-action): call analysis doesn't work for go 1.24
    (#1842)
  - test(osv-scanner/fix): actually import command from package
    (#1845)
  - test(fix): use public package (#1832)
  - test: add case for when "false" is explicitly passed as the
    value for `--offline` (#1841)
  - refactor(cmd): rename and cleanup `licenseGenericFlag`
    implementation (#1834)
  - test: only include specific command under test in `cmd`
    package tests (#1831)
  - test: update snapshots (#1833)
  - feat(xml): store the original text in CharData (#1825)
  - chore: Update snaps again (#1824)
  - chore(deps): update workflows (#1799)
  - fix(deps): update osv-scanner minor (#1800)
  - chore(deps): lock file maintenance (#1801)
  - test: move `source` cases into subpackage (#1759)
  - chore: Remove renovatebot constraint (#1820)
  - refactor: use constants for extractor names (#1819)
  - test: ensure that all tests are run in parallel (#1817)
  - refactor: ensure all extractors have a single interface check
    at the bottom of the file (#1818)
  - refactor: avoid repeated call to get scan global flags
    (#1816)
  - docs: Update Maven Central and private registries support
    (#1812)
  - chore: Update snapshots (#1813)
  - feat(xml): do not escape texts in char data (#1809)
  - feat: Parallel tests with global logger (#1798)
  - fix: override licenses in scan results (#1806)
  - chore: Update snapshot again again (#1807)
  - feat(xml): keep the white space between attributes (#1805)
  - refactor: Switch to use public osvdev client (#1804)
  - feat(xml): do not escape double quotes (#1803)
  - chore: Update scalibr to use the new inventory format.
    (#1797)
  - chore: Update snapshot again (#1802)
  - chore: Update snapshots (#1796)
  - feat(xml): keep the extra space in self-closing tags (#1787)
  - chore(deps): update
    gaurav-nelson/github-action-markdown-link-check digest to
    3c3b66f (#1784)
  - chore(deps): update golang docker tag to v1.24.2 (#1785)
  - test: update snapshots (#1786)
  - feat: support outputting results in `spdx` format (#1776)
  - test: update snapshots (#1782)
  - build: move off deprecated archives.format and
    archives.builds properties again (#1779)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1750075200">- Update to version 2.0.3:
  * Features:
  - Feature #1943 Added a flag to suppress "no package sources
    found" error.
  - Feature #1844 Allow flags to be passed after scan targets,
    e.g. osv-scanner ./scan-this-dir --format=vertical, by
    updating to cli/v3
  - Feature #1882 Added a stable tag to container images for
    releases that follow semantic versioning.
  - Feature #1846 Experimental: Add --experimental-extractors and
  - -experimental-disable-extractors flags to allow for more
    granular control over which OSV-Scalibr dependency extractors
    are used.
  * Fixes:
  - Bug #1856 Improve XML output by guessing and matching the
    indentation of existing &lt;dependency&gt; elements.
  - Bug #1850 Prevent escaping of single quotes in XML attributes
    for better readability and correctness.
  - Bug #1922 Prevent a potential panic in MatchVulnerabilities
    when the API response is nil, particularly on timeout.
  - Bug #1916 Add the "ubuntu" namespace to the debian purl type
    to correctly parse dpkg BOMs generated on Ubuntu.
  - Bug #1871 Ensure inventories are sorted by PURL in addition
    to name and version to prevent incorrect deduplication of
    packages.
  - Bug #1919 Improve error reporting by including the underlying
    error when the response body from a Maven registry cannot be
    read.
  - Bug #1857 Fix an issue where SPDX output is not correctly
    outputted because it was getting overwritten.
  - Bug #1873 Fix the GitHub Action to not ignore general errors
    during execution.
  - Bug #1955 Fix issue causing error messages to be spammed when
    not running in a git repository.
  - Bug #1930 Fix issue where Maven client loses auth data during
    extraction.
  * Misc:
  - Update dependencies and updated golang to 1.24.4
  - fix(deps): update osv-scanner minor (#1951)
  - chore(deps): update golang docker tag to v1.24.4 (#1933)
  - chore(deps): update github/codeql-action action to v3.29.0
    (#1932)
  - fix(deps): update osv-scanner minor (#1914)
  - chore(deps): update ossf/scorecard-action action to v2.4.2
    (#1915)
  - chore(deps): bump golang.org/x/net from 0.36.0 to 0.38.0 in
    /experimental/javareach in the go_modules group across 1
    directory (#1811)
  - chore(deps): update golangci/golangci-lint-action action to
    v8 (#1766)
  - fix(deps): update osv-scanner minor (#1863)
  - chore(deps): update workflows (#1837)
  - chore(deps): lock file maintenance (#1838)
  - chore(deps): update golang docker tag to v1.24.3 (#1864)
  - fix(deps): update osv-scanner minor (#1836)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1752235200">- Update to version 2.1.0:
  * Features:
  - Feature #2038 Add CycloneDX location field to the output
    source string.
  - Feature #2036 Include upstream source information in
    vulnerability grouping to improve accuracy.
  - Feature #1970 Hide unimportant vulnerabilities by default to
    reduce noise, and adds a --show-all-vulns flag to show all.
  - Feature #2003 Add experimental summary output format for the
    reporter.
  - Feature #1988 Add support for CycloneDX 1.6 report format.
  - Feature #1987 Add support for gems.locked files used by
    Bundler.
  - Feature #1980 Enable transitive dependency extraction for
    Python requirements.txt files.
  - Feature #1961 Deprecate the --sbom flag in favor of the
    existing -L/--lockfile flag for scanning SBOMs.
  - Feature #1963 Stabilize various experimental fields in the
    output by moving them out of the experimental struct.
  - Feature #1957 Use a dedicated exit code for invalid
    configuration files.
  * Fixes:
  - Bug #2046 Correctly set the user agent string for all
    outgoing requests.
  - Bug #2019 Use more natural language in the descriptions for
    extractor-related flags.
  - Bug #1982 Correctly parse Ubuntu package information with
    suffixes (e.g. :Pro, :LTS).
  - Bug #2000 Ensure CDATA content in XML is correctly outputted
    in guided remediation.
  - Bug #1949 Fix filtering of package types in vulnerability
    counts.
  * Dependencies
  - chore(deps): lock file maintenance (#2006)
  - chore(deps): update alpine docker tag to v3.22 (#1952)
  - chore(deps): update github/codeql-action action to v3.29.2
    (#2018)
  - chore(deps): update workflows (#1989)
  - chore: Update go-sarif to v3 from v2 (#1985)
  - chore: Update scalibr again (#2044)
  - chore: Update scalibr and remove javareach (#2011)
  - chore: ignore use of our own deprecated field (#1991)
  - chore: remove unneeded `goland:noinspection
    GoBoolExpressions` comments (#2043)
  - chore: update linter to v2.2 (#2016)
  - chore: v2.1.0 Changelog (#2054)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754568000">- Update to version 2.2.0:
  OSV-Scanner now supports all OSV-Scalibr features behind
  experimental flags (--experimental-plugins, see details here)!
  * Features:
  - Feature #2146 Allow manual OSV-Scalibr plugin selection.
  - Feature #2144 Add OSV-Scalibr version to osv-scanner
  - -version output.
  - Feature #2021 Add experimental support for running
    OSV-Scalibr detectors.
  - Feature #2079 Fall back to offline extractor if the
    transitive one fails, so at least direct dependencies are
    returned.
  - Feature #2032 Add summary section at the top of outputs and a
    'Fixed Version' column.
  - Feature #2076 Support Ubuntu severity type.
  * Fixes:
  - Bug #2141 Fix OSV-Scanner json scans not matching with
    correct ecosystem.
  - Bug #2084 Show absolute paths when scanning containers.
  - Bug #2126 Log and preserve package count before continuing on
    db error.
  - Bug #2095 Pass through plugin capabilities correctly.
  - Bug #2051 Properly flag if running on Linux or Mac OSs for
    plugin compatibility.
  - Bug #2072 Add missing "text" property in description fields.
  - Bug #2068 Change links in output to go to the specific
    vulnerability page instead of the list page.
  - Bug #2064 Fix SARIF v3 output to include results.
  * API Changes:
  - API Change #2096 Allow log handler to be overridden.
  * Dependencies:
  - chore(deps): update alpine:3.22 docker digest to 4bcff63
    (#2089)
  - chore(deps): update github/codeql-action action to v3.29.5
    (#2116)
  - chore(deps): update golang docker tag to v1.24.5 (#2062)
  - chore(deps): update golang:1.24.5-alpine3.21 docker digest to
    6edc205 (#2090)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755604800">- Update to version 2.2.1:
  * Fixes
  - Bug #2151 Filter by ecosystem before querying.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756382400">- Update to version 2.2.2:
  * Features:
  - Feature #2113 Add support for Java reachability analysis to
    identify uncalled vulnerabilities in JAR files.
  - Feature #2177 Automatically parse osv-scanner-custom.json
    files as osv-scanner.json custom lockfiles.
  * Fixes:
  - Bug #2204 Add a warning to guide users to the correct GitHub
    Action.
  - Bug #2202 Fix incorrect exit code when unimportant
    vulnerabilities are found in non-container scans.
  - Bug #2188 Fix handling of absolute paths on Windows.
  * Dependencies
  - fix(deps): update osv-scalibr (#2175)
  - chore(deps): update golang docker tag to v1.24.6 (#2167)
  - chore(deps): update workflows (#2165)
  - chore(deps): lock file maintenance (#2143)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1759320000">- Update to version 2.2.3:
  * Features:
  - Feature #2209 Add support for resolving git packages that
    have a version specified.
  - Feature #2210 Make the --experimental-plugins flag additive
    by default, and introduce a new
  - -experimental-no-default-plugins flag.
  - Feature #2203 Update osv-scalibr to 0.3.4 for improved
    dependency extraction. See osv-scalibr changelog for
    additional information.
  * Fixes:
  - Bug #2214 Fix issue where input.Path was incorrectly
    constructed on Windows when using the -L flag.
  - Fix #2241 Performance: Greatly reduce memory usage in the
    local matcher by only loading advisories relevant to the
    packages being scanned.
  * Dependencies
  - chore(deps): update workflows (#2251)
  - fix(deps): update osv-scanner minor (#2250)
  - fix(deps): update osv-scanner minor (#2231)
  - chore(deps): update golang docker tag to v1.25.1 (#2223)
  - chore(deps): update workflows (#2224)
  - chore(deps): update workflows (major) (#2232)
  - chore(deps): lock file maintenance (#2233)
  - chore(deps-dev): bump rexml from 3.4.1 to 3.4.2 in /docs in
    the bundler group across 1 directory (#2237)
  - fix(deps): update osv-scanner minor (#2213)
  - fix(deps): update osv-scanner minor (#2166)
  - chore(deps): update golang docker tag to v1.25.0 (#2185)
  - chore(deps): update workflows (#2186)
  - chore(deps): lock file maintenance (#2187)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761739200">- Update to version 2.2.4:
  * Features:
  - Feature #2256 Add experimental OSV-Scanner MCP server.
    (osv-scanner experimental-mcp)
  - Feature #2284 Update osv-scalibr integration, replacing
    baseimagematch with the base image enricher.
  - Feature #2216 Warn when vulnerabilities specified in the
    ignore config are not found during a scan (fixes #2206).
  * Fixes:
  - Bug #2305 Ignore common protocols and .git suffix when
    checking if an advisory affects a git repository (fixes
    [#2291]).
  - Bug #2300 Ensure the global logger is used in cmdlogger and
    osv-scalibr when set (fixes #2081).
  - Bug #2295 Fix Go stdlib license result matching (fixes
    [#2191]).
  * Dependencies
  - chore(deps): lock file maintenance (#2265)
  - chore(deps): update alpine:3.22 docker digest to 4b7ce07
    (#2272)
  - chore(deps): update github/codeql-action action to v3.30.9
    (#2287)
  - chore(deps): update golang docker tag to v1.25.3 (#2275)
  - chore(deps): update workflows (#2264)
  - chore(deps): update workflows (#2273)
  - chore(deps): update workflows (major) (#2288)
  - chore(deps): update workflows (major) (#2302)
  - fix(deps): update osv-scanner minor (#2263)
  - fix(deps): update osv-scanner minor (#2276)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763553600">- Update to version 2.3.0:
  * Features:
  - Feature #2321 Add support for license checks for RubyGems.
  - Feature #2294 Replace requirementsenhanceable extractor with
    transitive enricher.
  - Feature #2344 Use osduplicate annotators.
  * Fixes:
  - Bug #2329 Add --ignore-scripts flag to npm lockfile
    generation.
  - Bug #2311 Improve logic for --all-packages flag.
  - Bug #2309 Exit with a non-zero code when showing help.
  - Bug #2316 Pre-commit hook now defaults to scanning current
    directory instead of failing.
  - Bug #1507 (osv-scalibr) Interpolate Maven projects before
    extracting repositories.
  * Dependencies
  - chore(deps): update github/codeql-action action to v4.31.3
    (#2347)
  - fix(deps): update osv-scanner minor (#2346)
  - fix(deps): update osv-scanner minor (#2286)
  - chore(deps): bump github.com/opencontainers/selinux from
    1.12.0 to 1.13.0 in the go_modules group across 1 directory
    (#2338)
  - chore(deps): bump github.com/containerd/containerd from
    1.7.27 to 1.7.29 in the go_modules group across 1 directory
    (#2326)
  - chore(deps): update docker/setup-qemu-action digest to
    c7c5346 (#2334)
  - chore(deps): update golang docker tag to v1.25.4 (#2335)
  - chore(deps): update golangci/golangci-lint-action action to
    v9 (#2336)
  - chore(deps): update github/codeql-action action to v4.31.2
    (#2301)
  - chore(deps): lock file maintenance (#2315)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 2.3.1:
  * Features:
  - Feature #2370 Add support for the packagedeprecation plugin
    via the new --experimental-flag-deprecated-packages flag. The
    result is available in all output formats except SPDX.
  * Fixes:
  - Bug #2395 Fix license scanning to correctly match new
    deps.dev package names.
  - Bug #2333 Deduplicate SARIF outputs for GitHub.
  - Bug #2259 Fix lookup of Go packages with major versions by
    including the subpath of Go PURLs, preventing false
    positives.
  * Misc:
  - Updated Go version to v1.25.5 to support Go reachability
    analysis for the latest version.
  * Dependencies
  - chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0
    in the go_modules group across 1 directory (#2357)
  - chore(deps): update actions/checkout action to v6 (#2379)
  - chore(deps): update dependency webrick to v1.9.2 (#2378)
  - chore(deps): update workflows (#2364)
  - chore(deps): update workflows (#2402)
  - fix(deps): update osv-scanner minor (#2365)
  - fix(deps): update osv-scanner minor (#2400)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768478400">- Update to version 2.3.2:
  This release includes performance improvements for local
  scanning, reducing memory usage and avoiding unnecessary advisory
  loading. It also fixes issues with MCP's
  get_vulnerability_details tool, git queries in osv-scanner.json,
  and ignore entry tracking, along with documentation updates.
  * Fixes:
  - Bug #2415 Add more PURL-to-ecosystem mappings
  - Bug #2422 MCP error for get_vulnerability_id because type
    definition is incorrect.
  - Bug #2460 Enable osv-scanner.json git queries
  - Bug #2456 Properly track if an ignore entry has been used
  - Bug #2450 Performance: Avoid loading the entire advisory
    unless it will actually be used
  - Bug #2445 Performance: Don't read the entire zip into memory
  - Bug #2433 Allow specifying user agent in v2 osvscanner
    package
  * Misc:
  - Misc #2453 Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3
  - Misc #2447 Include bun.lock as a supported lockfile
  - Misc #2444 Document GoVersionOverride in configuration.md
  * Dependencies
  - fix(deps): update osv-scanner minor (#2459)
  - chore(deps): update ruby docker tag to v4 (#2432)
  - chore(deps): update alpine:3.23 docker digest to 865b95f
    (#2425)
  - chore(deps): update docker/setup-buildx-action digest to
    8d2750c (#2426)
  - chore(deps): switch from gopkg.in/yaml.v3 to
    go.yaml.in/yaml/v3 (#2453)
  - fix(deps): update osv-scanner minor (#2427)
  - chore(deps): update alpine docker tag to v3.23 (#2401)
  - chore(deps): update workflows (#2417)
  - fix(deps): update osv-scanner minor (#2418)
  - chore(deps): update workflows (major) (#2419)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770897600">- Update to version 2.3.3:
  * Features:
  - Feature #2458 Add --exclude flag to skip paths during
    scanning.
  - Feature #2477 Add pylock extractor.
  - Feature #2475 Add base image info to container scanning
    output header (in table, markdown and vertical formats).
  * Misc:
  - Update Go version to 1.25.7.
  - Update osv-scalibr from v0.4.1 to v0.4.2. Release note.
  - Refactor to better align with osv-scalibr plugins and
    inventory data structure.
  * Dependencies
  - build(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to
    5.16.5 in the go_modules group across 1 directory (#2504)
  - build(deps-dev): bump faraday from 2.14.0 to 2.14.1 in /docs
    in the bundler group across 1 directory (#2503)
  - chore(deps): update workflows (#2471)
  - chore: update Go version to v1.25.6 (#2490)
  - fix(deps): update osv-scanner minor (#2470)
  - fix: bump Go to v1.25.7 (#2506)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774440000">- Update to version 2.3.5 (.4 was not released):
  * Features:
  - Feature #2571 Enable transitive scanning for Python
    requirements.txt files using the deps.dev API.
  - Feature #2649 Add ability to allow unsafe plugins, logging a
    warning when any unsafe plugin is enabled.
  * Fixes:
  - Bug #2630 Improve startup performance on Windows Terminal by
    updating lipgloss.
  - Bug #2599 Ensure the package deprecation enricher respects
    the same configuration as other plugins.
  - Bug #2600 Ensure the Java extractor plugin for call analysis
    respects the same configuration as other plugins.
  * Misc:
  - Update osv-scalibr from v0.4.2 to v0.4.5. Release notes:
    v0.4.3, v0.4.4, v0.4.5.
  - Fix broken release workflow.
  * Dependencies
  - build(deps): bump github.com/cloudflare/circl from 1.6.1 to
    1.6.3 in the go_modules group across 1 directory (#2550)
  - build(deps): bump github.com/docker/cli from
    28.3.3+incompatible to 29.2.0+incompatible in the go_modules
    group across 1 directory (#2590)
  - build(deps): bump github.com/modelcontextprotocol/go-sdk from
    1.4.0 to 1.4.1 in the go_modules group across 1 directory
    (#2659)
  - build(deps-dev): bump json from 2.18.1 to 2.19.2 in /docs in
    the bundler group across 1 directory (#2660)
  - build(deps-dev): bump nokogiri from 1.18.10 to 1.19.1 in
    /docs in the bundler group across 1 directory (#2536)
  - chore(deps): lock file maintenance (#2563)
  - chore(deps): update alpine:3.23 docker digest to 2510918
    (#2561)
  - chore(deps): update docker/setup-buildx-action action to v4
    (#2621)
  - chore(deps): update golang docker tag to v1.26.1 (#2618)
  - chore(deps): update ruby:3 docker digest to cddc8a7 (#2647)
  - chore(deps): update workflows (#2562)
  - chore(deps): update workflows (#2620)
  - chore(deps): update workflows (#2648)
  - chore(deps): update workflows (major) (#2569)
  - fix(deps): update module
    github.com/modelcontextprotocol/go-sdk to v1.3.1 [security]
    (#2560)
  - fix(deps): update module google.golang.org/grpc to v1.79.3
    [security] (#2655)
  - fix(deps): update osv-scanner minor (#2566)
  - fix(deps): update osv-scanner minor (#2619)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777636800">- Update to version 2.3.6:
  * Features:
  - Feature #2658 Support regex matching for package name
    overrides.
  - Feature #2510 Scan Homebrew inventory using git repository
    metadata.
  * Fixes:
  - Bug #2750 Sanitize \r/\n in default/table/vertical output to
    prevent GitHub Actions workflow command injection.
  - Bug #2641 Correctly output packages from osv-scanner.json
    source in spdx format.
  - Bug #2729 Increase color contrast of vulnerability stats.
  - Bug #2664 Remove second newline at end of vertical output.
  - Bug #2669 Sanitize \r in gh-annotations to prevent GitHub
    Actions workflow command injection.
  * Misc:
  - Update osv-scalibr to v0.4.6-0.20260428235529-7791e288d6c1.
  - Update Go version to 1.26.2 (#2706).</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778241600">- Update to version 2.3.8 (.7 was not released):
  * Fixes:
  - Fix installation issues with go install due to dependency
    conflicts (downgrade containerd/cgroups/v3, moby/buildkit and
    opencontainers/runtime-spec). (#2782)
  - Bug #2762 Skip packages with short commit hashes instead of
    aborting scan.
  - Bug #2781 Secure file path handling with os.OpenRoot.
  - Bug #2766 Correct typos across docs, configs, and Go source.
  * Misc:
  - Update osv-scalibr to v0.4.6-0.20260504042738-9293bfa4f86f.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781870400">- Update to version 2.4.0:
  * Features:
  - Feature #2815 Add support for the CycloneDX 1.7 specification
    (bumps cyclonedx-go to v0.11.0).
  - Feature #2799 Enable .csproj and Central Package Management
    (nugetcpm) source scanning plugins by default.
  - Feature #2871 Extract and parse Alpine OS distro version
    (e.g. Alpine:v3.17, Alpine:edge) from PURL distro qualifiers
    to scan packages under their respective Alpine ecosystems.
  - Feature #2801 Enable the swift/packageresolved plugin by
    default to support SwiftURL vulnerability scans.
  - Feature #2666 Add a Docker-based variant of the pre-commit
    hook in .pre-commit-hooks.yaml to avoid local compilation.
  - Feature #2637 Add a new configuration setting
    ScanGoModVersion (disabled by default) to avoid parsing
    toolchain version directives directly from go.mod, preventing
    misleading warnings.
  - Feature #2772 Scan container images built with Canonical
    Chisel by enabling the os/chisel extractor plugin.
  * Fixes:
  - Bug #2807 Sanitize package name, source, and version fields
    in the vertical output format to prevent GitHub Actions
    workflow command injection vulnerabilities from crafted lock
    files.
  - Bug #2876 Improve HTML scan report usability by supporting
    standard click modifiers (Ctrl/Cmd/middle click) to open
    vulnerabilities in new tabs, and preserving scroll position
    when switching tabs.
  - Bug #2783 Keep transitive dependency scanning enabled when
    specifying the --offline-vulnerabilities flag.
  - Bug #2808 Deduplicate equivalent OSV matcher requests before
    executing bulk queries to reduce API overhead.
  - Bug #2837 Prevent panics during offline matcher scans (e.g.
    on unsupported GitHub Actions ecosystem) by avoiding parsing
    errors when checking version ranges.
  - Bug #2836 Ensure the scanner returns an exit code of 0 when
  - -help or -h is explicitly requested.
  * Misc:
  - Update Go version to 1.26.4.
  - Update osv-scalibr to v0.4.6-0.20260612031204-164402d9140e.
  - Tag built Docker and GitHub Action images with the major
    version (e.g. :v2) to allow users to pin to a major version
    (#2857).
  * Dependencies
  - chore(deps): update golang.org/x/{crypto,net,sys} (#2853)
  - chore(deps): update golang docker tag to v1.26.3 (#2811)
  - fix(deps): update osv-scanner minor (#2851)
  - build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
    5.19.1 in the go_modules group across 1 directory (#2822)
  - chore(deps): update workflows (#2852)
  - chore(deps): update workflows (#2764)
  - fix(deps): update osv-scanner minor (#2812)
  - chore(deps): lock file maintenance (#2834)
  - build(deps): bump faraday from 2.14.1 to 2.14.2 in /docs in
    the bundler group across 1 directory (#2817)
  - fix(deps): update osv-scanner minor (#2763)
  - chore(deps): lock file maintenance (#2718)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1786104000">- Update to version 2.5.0:
  * Features &amp; Refactors:
  - Full OSV-Scalibr pipeline: Migrated scanning, filtering, and
    matching in osv-scanner to use osv-scalibr end-to-end, so
    most plugins that's supported in osv-scalibr should be
    supported via the --experimental-plugins flag (#2935).
  - New extractors and ecosystem support via osv-scalibr:
  - Add javascript/vsix extractor to support scanning VS Code
    extension (.vsix) packages.
  - Extend ecosystem mapping for:
  - SUSE
  - Azure Linux / Mariner
  - Alpaquita
  - Mageia
  - openSUSE Leap
  - Debian and Ubuntu PURL
  - PURL Type Resolution: Updated osvscannerjson extractor to map
    ecosystem names to valid PURL types (golang, gem, cargo, npm,
    etc.).
  * Fixes:
  - Bug #2915 Fix issue where osv-scanner reported already-fixed
    advisories as unfixed for RHEL-family RPM packages (Red Hat,
    AlmaLinux, Rocky Linux) with epochs by sending
    epoch-qualified versions.
  - Fix Python requirements.txt extractor in osv-scalibr,
    specifically regular expressions used to extract package
    names and per-requirement options (Fixes #2940, #2931)
  - Fix NPM and Composer PURL generation in osv-scalibr,
    separating package namespace (scope) from package name
  * Dependencies
  - build(deps): bump faraday from 2.14.2 to 2.14.3 in /docs in
    the bundler group across 1 directory (#2900)</changelog>
</package>
<package pkgid="894814de96f0c74402063f43e0994d6fecee470a517a5e1b92b876ee3642befb0db6c778267e73ef4c9c21879729abe26e007bc221d8747d01c19e2c02a556f0" name="owasp-modsecurity-crs" arch="noarch">
  <version epoch="0" ver="4.27.0" rel="32.3"/>
  <changelog author="bwiedemann@suse.com" date="1500897600">- sort conf file entries to fix build-compare (boo#1041090)</changelog>
  <changelog author="pgajdos@suse.com" date="1606824000">- use system apache rpm macros</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1684497600">- Version 3.3.4.
  * Important Notice: From CRS 3.2.2, 3.3.3 and up, ModSecurity 2.9.6 or 3.0.8 (or versions with backported patches) are required due to the addition of new protections. We recommend upgrading your ModSecurity as soon as possible. If your ModSecurity is too old, your webserver will refuse to start with an Unknown variable: &amp;MULTIPART_PART_HEADERS error. If you are in trouble, you can temporarily delete file rules/REQUEST-922-MULTIPART-ATTACK.conf as a workaround and get your server up, however, you will be missing some protections. Therefore we recommend to upgrade ModSecurity before deploying this release.</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1692187200">- Version 3.3.5.
  * This is the OWASP ModSecurity Core Rule Set version 3.3.5.
  * Important changes:
  - Backport fix for CVE-2023-38199 from CRS v4 via new rule 920620 (Andrea Menin, Felipe Zipitría)
  * Fixes:
  - Fix paranoia level-related scoring issue in rule 921422 (Walter Hop)
  - Move auditLogParts actions to the end of chained rules where used (Ervin Hegedus)
  * Chore:
  - Clean up redundant paranoia level tags (Ervin Hegedus)
  - Clean up YAML test files to support go-ftw testing framework (Felipe Zipitría)
  - Move testing framework from ftw to go-ftw (Felipe Zipitría)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1693569600">- use upstream archive for building the package, the base folder name in the
  archive changed</changelog>
  <changelog author="Flavio Castelli &lt;fcastelli@suse.com&gt;" date="1733227200">- Version 4.9.0
  * Important changes
  - feat: add variable to skip response rules by @fzipi in #3944
  * New features and detections
  - feat: add fish shell files to restricted-files.data by @OhMyVolk in #3915
  - feat: add quantitative testing to Git workflow by @airween in #3924
  * Other Changes
  - feat: added support for new web shells by @azurit in #3898
  - fix(security): remove double URL decode (921151 PL2, 932190 PL3, 942441 PL2, 942442 PL2, 942460 PL3) by @azurit in #3741
  - docs: extended rule documentation (900200) by @dune73 in #3934
- Version 4.8.0
  * Important changes:
  - fix: 9EA-241022 v4 by @RedXanadu in #3905
  * New features and detections
  - chore: set up nginx tests by @theseion in #3856
  * Other Changes
  - fix: remove unnecessary capture groups by @TimDiam0nd in #3849
  - fix(942120): update operators by @Xhoenix in #3841
  - fix(933120): do not match on base64 encoded strings by @fzipi in #3863
  - fix(refactor): 942130 and 942131 regex-assembly by @Xhoenix in #3862
  - fix(942520): SQL operators can be one or more characters by @Xhoenix in #3845
  - chore: remove verify id-range by @fzipi in #3885
  - chore: remove find-max-datalen-in-tests by @fzipi in #3891
  - chore: remove honeypot sensor by @fzipi in #3883
  - chore: remove browser tools by @fzipi in #3887
  - chore: remove send-payload-pls by @fzipi in #3879
  - chore: remove geo-location by @fzipi in #3875
  - chore: remove crs2 renumbering by @fzipi in #3873
  - chore: remove change-version script by @fzipi in #3869
  - chore: remove join multiline rules by @fzipi in #3877
  - chore: remove av-scanning by @fzipi in #3871
  - chore: remove util virtual patching by @fzipi in #3889
  - fix: include v3.3.6 release notes in latest by @fzipi in #3867
  - chore: remove fp-finder by @fzipi in #3893
- Version 4.7.0
  * New features and detections
  - feat: added sendgrid.env into restricted files by @azurit in #3823
  * Other Changes
  - fix: Changed regex (920470) to match multiple whitespaces after Content-Type parameters to avoid false-positives by @lostmann-owl-it in #3818
  - fix: fp with user-agent containing ; pg (932239 PL2) by @franbuehler in #3727
  - fix: update xss detection with onwebkitplaybacktargetavailabilitychanged event by @fzipi in #3822
  - feat: refactoring (944110 PL1) by @azurit in #3715
- Version 4.6.0
  * Important changes:
  - fix: prevent using backslash in file names by @fzipi in #3799
  - feat: add new rule to catch invalid character in multipart headers by @airween, @theseion, @fzipi in #3796
  * Other Changes
  - feat: rule to detect bash tilde expansion by @Xhoenix in #3765
  - fix: Update 932270's ver by @airween in #3786
  - perf: remove unnecessary chain rule and capture (921180 PL3) by @EsadCetiner in #3787
  - fix: add pem to restricted file extensions by @EsadCetiner in #3789
  - fix(942160): check REQUEST_FILENAME by @mat1010 in #3782
- Version 4.5.0
  * New features and detections
  - feat: added arithmetic expansion payload by @Xhoenix in #3756
  * Other Changes
  - fix(security): alias false negative by @Xhoenix in #3740
  - feat: add test overrides for nginx by @theseion in #3369
  - fix: use proper capture for log output of 932300 by @theseion in #3763
  - chore: use lowercase character class for 932320 by @theseion in #3772
  - fix: remove nonnecessary variable (932260 PL1) by @dune73 in #3773
- Version 4.4.0
  * New features and detections
  - feat: skip response rules if data are compressed by @azurit in #3742, #3712
  * Other Changes
  - fix(934140): update regex by @fzipi in #3731
  - fix: replacing t:UrlDecode with t:UrlDecodeUni (921240 PL1, 932170 PL1, 932171 PL1, 932190 PL3, 932190 PL1, 933211 PL3, 941310 PL1, 941350 PL1) by @azurit in #3713
- Version 4.3.0
  * New features and detections
  - feat: catch Java PostgreSQL errors (951240 PL1) by @azurit in #3686
  - feat: block The Mysterious Mozlila User Agent bot (913100 PL1) by @brentclark in #3646
  * Other Changes
  - fix: Oracle SQL database data leakage FP (951120 PL1) by @azurit in #3685
  - fix: typos in 920330 and 942280 tests by @TimDiam0nd in #3688
  - test: change pl-1 to pl1 to be inline with others by @TimDiam0nd in #3690
  - feat: use renovate to update docker-compose by @theseion in #3697
  - fix: FP for sched (932235 PL1, 932236 PL2, 932237 PL3, 932239 PL2, … by @theseion in #3701
  - fix: collections not being initialized without User-Agent header by @azurit in #3645
  - feat: refactoring of rule 941310 (PL1 941310) by @azurit in #3700
  - fix: resolving more FPs with Oracle error messages (951120 PL1) by @azurit in #3703
  - fix: removing double t:urlDecodeUni (920221 PL1, 920440 PL1, 932200 PL2, 932205 PL2, 932206 PL2) by @azurit in #3699
  - fix: false positives from PHP config directives and functions (933120 PL1, 933151 PL2) by @ssigwart in #3638
  - feat: prevent detection of web shells rules as malware by Windows Defender (955260 PL1) by @azurit in #3687
  - fix: fp with name axel by removing it from rce rule (932260 PL1) by @franbuehler in #3705
- Version 4.2.0
  * Changes with direct rule impact (sorted by lowest rule ID per change where available):
  - fix: increase length of Accept-Encoding header from 50 to 100 (920520 PL1) (Franziska Bühler) [#3661]
  - fix: add missing roundcube files (930120 PL1, 930121 PL2, 930130 PL1, 932180 PL1) (Esad Cetiner) [#3635]
  - fix: add visudo and cscli to unix-shell.data (932160 PL1, 932161 PL2) (Esad Cetiner) [#3663]
  - feat: block crowdsec cscli and visudo commands (932235 PL1, 932236 PL2, 932237 PL3, 932239 PL2, 932260 PL1) (Esad Cetiner) [#3649]
  - fix: add detection for php evasion attempt (933100 PL1) (Franziska Bühler) [#3667]
  * Changes without direct rule impact:
  - feat: disassemble php rule (933100 PL1) (Franziska Bühler) [#3662]
  - chore: remove references to nonexistant 942110 rule (Esad Cetiner) [#3648]
- Version 4.1.0.
  - feat: add check for combinations of t:lowercase and (?i) to lint (Franziska Bühler) [#3584]
  - feat: add support for additional ansible and chef commands (932160 PL1, 932161 PL2, 932235 PL1, 932260 PL1, 932236 PL2, 932239 PL2, 932237 PL3) (Esad Cetiner) [#3601]
  - feat: move HTTP header rules to phase 1 (932161 PL2, 932205 PL2, 932206 PL2, 932237 PL3) (Esad Cetiner) [#3570]
  - fix: prevent FPs against names due to "cron" (932260 PL1, 932236 PL2, 932237 PL3, 932239 PL2) (@superlgn) [#3578]
  - fix: add missing tags and ver action (various rules) (Jozef Sudolský) [#3571]
  - fix: adding more missing tags and ver actions (Jozef Sudolský) [#3593]
  - fix: do not check URL fragments in referer headers as part of the existing rule to prevent FPs (932205 PL2) (Max Leske) [#3485]
  - fix: range expressions must not start with \v (various rules) (Max Leske) [#3615]
  - fix: remove t:lowercase from rules that use '(?i)' modifier in their regex (942150 PL2, 942151 PL1, 942152 PL2) (Ervin Hegedus) [#3585]
  - test: change HTTP method to uppercase for test 932260-28 (Matteo Pace) [#3580]
  - chore(deps): update workflow actions (Max Leske) [#3613]
  - chore: add Esad Cetiner to list of developers (@EsadCetiner) [#3589]
- Version 4.0.0.
  * Important changes:
  - feat: introduce plugin architecture for extending CRS and minimizing attack surface. (Christian Folini, Max Leske, Jozef Sudolský, Andrew Howe) [#2038, #2448, #2404]
  - feat: migrate application exclusions and less-used functionality to plugins (Christian Folini, Max Leske, Jozef Sudolský, Andrew Howe)
  - feat: introduce early blocking option (Christian Folini) [#1955]
  - feat: introduce new rule file/category to detect use of common web shells in responses (955100-955340 PL1, 955350 PL2) (Jozef Sudolský, Andrea Menin) [#1962, #2039, #2116]
  - feat: rename 'Node.js' category to 'generic' (Felipe Zipitría) [#2340]
  - feat: make all formerly PCRE-only regular expressions compatible with RE2/Hyperscan regular expression engines (Max Leske, Felipe Zipitría, Allan Boll, Franziska Bühler) [#1868, #2356, #2425, #2426, #2371, #2372]
  - feat: add support for HTTP/3 (Jozef Sudolský) [#3218]
  - feat: add granular control over reporting levels in 9801xx rules (Simon Studer, Andrew Howe, Christian Folini) [#2482, #2488]
  - feat: add new rule to explicitly detect multiple Content-Type abuse (CVE-2023-38199) (920620 PL1) (Andrea Menin) [#3237]
  - feat: add enable_default_collections flag to not initialize collections by default (Matteo Pace) [#3141]
  - feat: extend definition of restricted headers to include Content-Encoding and Accept-Charset by default (920450 PL1, 920451 PL2) (Walter Hop) [#2780, #2782]
  - feat: drop HTTP/0.9 support to resolve FP (Federico G. Schwindt) [#1966]
  - fix: refactor and rename anomaly scoring variables and paranoia level definition (Simon Studer) [#2417]
  - tests: complete goal of 100% test coverage for rules (entire team, Juan-Pablo Tosso, NiceYouKnow)
  - feat: switch to using WordNet instead of spell for finding English words in spell.sh (Max Leske) [#3242]
  - feat: publish nightly packages regularly (Felipe Zipitría) [#2207]
  * Changes with direct rule impact (sorted by lowest rule ID per change where available):
  - feat: add placeholder files for new plugin architecture (Walter Hop) [#2515]
  - feat: check initialization and use for all TX variables (Ervin Hegedus) [#3043]
  - feat: extend rule to detect restricted method override headers (Mark Zeman / KramNamez) [#3056]
  - feat: extend rules to detect keyword time as prefix of *nix and Windows RCE rules (rules later replaced) (Franziska Bühler) [#2819]
  - feat: improve Unix shell evasion prefix (various rules) (Jitendra Patro, Max Leske) [#3518]
  - feat: improve performance by removing unnecessary lowercase transformations (various rules) (Jozef Sudolský) [#2106]
  - feat: add additional prefix commands to 'unix-shell-evasion-prefix' (various rules) (Jitendra Patro) [#3557
  - feat: consolidate 'unix-evasion-prefix*' files to ensure they don't diverge (various rules) (Franziska Bühler, Max Leske, Andrew Howe) [#3531]
  - feat: move regexp-assemble data files to root directory (Felipe Zipitría) [#3002]
  - feat: move rules to the earliest phase possible based on their inputs (various rules) (Ervin Hegedus) [#1941]
  - feat: remove superfluous 'urlDecodeUni' transformations (various rules) (Federico G. Schwindt) [#1845]
  - feat: rename 'tx.blocking_early' to 'tx.early_blocking' (various rules) (Christian Folini) [#2414]
  - feat: simplify regular expressions by replacing upper-case with lower-case matches if the expression is case-insensitive (various rules) (Felipe Zipitría) [#2485]
  - feat: remove SecCollectionTimeout from crs-setup.conf (Christian Folini) [#3559]
  - fix: do not log 'MATCHED_VAR' when the it contains the full response body (various rules) (Jozef Sudolský) [#1985]
  - fix: do not unnecessarily escape forward slashes in regular expressions (various rules) (Federico G. Schwindt) [#1842]
  - fix: reformat several initialization rules to follow project guidelines (Ervin Hegedus) [#3157]
  - fix: remove auditLogParts actions from all rules where present (Andrea Menin, Ervin Hegedus) [#3034, #3081]
  - fix: remove uncommon Content Types from default in crs-setup.conf.example (Andrea Menin) [#2768]
  - fix: update diverse rules to follow new naming convention with paranoia level TX variables (Christoph Hansen) [#2937]
  - fix: update various rules to consolidate use of backslashes to \x5c representation for better compatibility with known WAF engines (various rules) (Andrew Howe, Max Leske) [#2335, #2345, #2375, #2376, #2399, #2400, #2402, #2410, #2420, #2441, #2442, #2454, #2426]
  - fix: remove initialization rules for redundant IP reputation variables (901150, 901152) (Andrew Howe) [#2833]
  - fix: initialize all variables used properly (901169) (Ervin Hegedus) [#2802]
  - feat: improve sampling mode efficiency (901410, 901420, 901440) (Paul Beckett) [#2094]
  - fix: replace uses of 'ctl:ruleEngine=Off' with "ctl:ruleRemoveByTag=OWASP_CRS" to accomodate more than one ruleset (901450, 905100, 905110) (Jozef Sudolský) [#2156]
  - feat: remove old, commented-out IP reputation check rule (910110 PL1) (Paul Beckett) [#2148]
  - feat: detect 'burpcollaborator' scanner (913100 PL1) (Amir Hosein Aliakbarian) [#2152]
  - feat: detect 'httpx' scanner (913100 PL1) (Will Woodson) [#2045]
  - feat: detect 'LeakIX' scanner (913100 PL1) (Jozef Sudolský) [#1961]
  - feat: detect 'QQGameHall' malware (913100 PL1) (Walter Hop) [#2144]
  - feat: detect User-Agent of Tsunami Security Scanner (913100 PL1) (@hoexter) [#3480]
  - fix: avoid FP for YAM package manager (913100 PL1) (Jozef Sudolský) [#2022]
  - fix: move 'ecairn' from scanners to crawlers (913100 PL1) (Felipe Zipitría) [#2408]
  - feat: detect 'CensysInspect' and seoscanners.net crawlers (913102 PL2) (Andrew Howe) [#2155]
  - feat: detect 'ecairn' crawler (913102 PL2) (Jozef Sudolský) [#2024]
  - feat: detect 'Krzana' bot (913102 PL2) (Deepshikha Sinha) [#2432]
  - fix: remove rule to detect security scanner http headers (913110 PL1) (Christian Folini) [#3241]
  - feat: remove ineffective anti-scanner list scanners-urls.data and associated rule (913120 PL1) (Christian Folini) [#3235]
  - fix: correct the regular expression assembly (920120 PL1) (Max Leske) [#2333]
  - feat: increase rule score from warning to critial (920220 PL1) (Max Leske) [#3512]
  - fix: reduce FPs by handling the last path segment separately in new rule (920220 PL1, 920221 PL1) (Max Leske) [#3512]
  - fix: reduce FPs by matching on decoded variables (920220 PL1) (Max Leske) [#3512]
  - feat: prevent FPs by moving rule to higher PL (920240 PL2) (Max Leske) [#3506]
  - feat: valiadate 'SEC-CH-UA' and 'SEC-CH-UA-MOBILE' request headers (920274 PL4) (Chaim Sanders) [#1970]
  - fix: use the right kind of validation for 'Sec-CH-UA' and 'Sec-CH-UA-Mobile' request headers (920274 PL4, 920275 PL4) (somechris) [#2028]
  - fix: make validatioin of 'Sec-Fetch-User' header more strict (920275 PL4) (somechris) [#2020]
  - feat: move rule from PL2 to PL3 (920300 PL3) (Franziska Bühler) [#2013]
  - fix: amend rule to exclude CONNECT requests from requiring an Accept header (920300 PL3) (Andrew Howe) [#2297]
  - feat: add IPv6 to the 'Host header is a numeric IP address' check (920350 PL1) (itsTheFae, Ervin Hegedus, Jozef Sudolský) [#1929]
  - fix: avoid FP on '.axd' in restricted extensions, these are public (920440 PL1) (Jozef Sudolský) [#1925]
  - feat: rework restricted headers mechanism into two separate lists (920450 PL1, 920451 PL2) (Andrew Howe) [#3152]
  - fix: avoid FP in 'application/*+json' Content-Type (920470 PL1) (Mirko Dziadzka, Walter Hop) [#2455]
  - fix: avoid FP in CalDAV Content-Type (920470 PL1) (Vandan Rohatgi) [#2505]
  - fix: avoid FP in 'Content-Type' header with '#' character (920470 PL1) (Jozef Sudolský) [#1856]
  - fix: avoid FP on 'version' string in Content-Type header (920470 PL1) (Jozef Sudolský) [#1901]
  - fix: resolve false negative when matching against allowed charsets variable (920480 PL1) (katef, Federico G. Schwindt) [#1957]
  - fix: replace unnecessary capture groups in regular expressions with non-capturing groups (920510 PL3, 932200 PL2, 942510 PL2, 942511 PL3) (Federico G. Schwindt) [#1983]
  - feat: improve explanatory rule comments (920520 PL1) (Max Leske) [#2391]
  - feat: validate 'Accept-Encoding' header (920520 PL1, 920521 PL3) (Franziska Bühler) [#2357]
  - feat: new rule detect multiple occurrences of charset keyword in content type header (920530 PL1) (Jan Gora / terjanq) [#2571]
  - feat: new rule to detect Unicode character bypass check for non JSON requests (920540 PL1) (Franziska Bühler, 0SPwn) [#2512]
  - feat: new rule to detect # char in URIs (920610 PL1) (Karel Knibbe) [#2919]
  - fix: use correct anomaly scoring variables and paranoia level tags across several rules (921170 PL1, 921220 PL4, 932220 PL2, 932331 PL3, 933211 PL3, 934101 PL1, 942362 PL2, 951100) (Christoph Hansen) [#2931]
  - feat: new rules to detect HTTP parameter pollution bypasses (921210 PL3, 921220 PL4) (Christian Folini) [#2747]
  - fix: use correct anomaly scoring variables and paranoia level tags across several rules (921220 PL4, 932101 PL2, 932331 PL3, 933211 PL3, 942362 PL2) (Ervin Hegedus) [#2832]
  - feat: new rule to detect range header that is now forbidden on PL3 and up (921230 PL3) (Christian Folini) [#2760]
  - feat: new rule to detect mod_proxy attack (CVE-2021-40438) (921240 PL1) (Franziska Bühler) [#2818]
  - fix: add urlDecodeUni transformation rules with REQUEST_URI / REQUEST_BASENAME in phase 1 (921240 PL1, 920440 PL1, 920201 PL2, 920202 PL4) (Christian Folini) [#3411]
  - feat: new rules to detecting ModSecurity body processor confusion using the Content-Type HTTP header (921421 PL1, 921422 PL2) (Simon Studer, Ervin Hegedus) [#2763]
  - fix: handle false positives when detecting ModSecurity body processor confusion (921422 PL2) (Ervin Hegedus) [#2784]
  - feat: new rules detecting attacks on multipart headers (922100 PL1, 922110 PL1, 922120 PL1) (Felipe Zipitría) [#2769]
  - fix: prevent unintended match of character set substrings in multipart/form-data requests (922100 PL1) (Jozef Sudolský) [#3470]
  - feat: remove redundant t:lowercase for a little performance (922110 PL1) (Jozef Sudolský) [#3469]
  - fix: remove possessive quantifiers (922110 PL1) (Felipe Zipitría) [#2989]
  - fix: update comments (922110 PL1, 942440 PL2) (Jozef Sudolský) [#3468]
  - fix: add missing quotes at the end of action lists (930050) (Ervin Hegedus) [#2184]
  - feat: disassemble regular expression (930100 PL1) (Andrew Howe) [#2298]
  - fix: detect path traversal in uploaded file names (930100 PL1, 930110 PL1) (k4n5ha0, Franziska Bühler, Felipe Zipitría) [#2451]
  - fix: detect triple dot path traversal (930100 PL1, 930110 PL1) (Franziska Bühler) [#2309, #2310]
  - feat: extended rule to detect Tomcat specific path traversal attack (930110 PL1) (Christoph Hansen) [#2915]
  - fix: avoid FP for '..' without slashes (930110 PL1) (Tetrik, Walter Hop) [#2016]
  - feat: block access to AWS CLI files (930120 PL1, 930121 PL2) (Jozef Sudolský) [#2439]
  - feat: block access to extended list of sensitive files (930120 PL1, 930121 PL2, 930130 PL1) (Jozef Sudolský) [#1960]
  - feat: detect /proc and /sys access attempts (930120 PL1, 930130 PL1) (Andrew Howe) [#2154]
  - feat: extend rule to detect access attempts to /tmp/ (930120 PL1, 930121 PL2) (Max Leske) [#3131]
  - feat: extend rule to detect ECDSA type SSH identity files via list of sensitive *nix files (930120 PL1) (Pinaki Mondal / 0xInfection) [#2586]
  - fix: avoid detecting Google OAuth2 callback requests as malicious (930120 PL1, 930121 PL1) (Jozef Sudolský, Christian Folini) [#1958]
  - feat: extend rule to detect additional sensitive files on *nix systems (930121 PL2, 930130 PL1) (Gwendal Le Coguic / gwen001) [#2560]
  - feat: new rules to detect LFI and SQLi in user-agent and referer request headers (930121 PL2, 942152 PL2, 942321 PL2) (Franziska Bühler, Max Leske, Shivam Bathla) [#3102]
  - fix: extend rule to detect more LFI (930121 PL2) (Felipe Zipitría) [#2791]
  - feat: add BlockCypher.log to restricted-files.data (930130 PL1) (Jozef Sudolský) [#3501]
  - feat: add 'sslvpn_websession' to restricted-files.data (930130 PL1) (Jozef Sudolský) [#2338]
  - feat: add .vscode to restricted-files.data (930130 PL1) (Frederik Himpe) [#3471]
  - feat: extend data file to include additional restricted file names (restricted-files.data, 930130 PL1) (Jitendra Patro) [#3219]
  - feat: extend data file to include PrestaShop configuration file (restricted-files.data, 930130 PL1) (Jean-François Viguier) [#3192]
  - feat: extend rule to detect npm-shrinkwrap.json to restricted-files (930130 PL1) (Esa Jokinen / oh2fih) [#2627]
  - fix: block access to the Java-related WEB-INF directory (930130 PL1) (Jozef Sudolský) [#2092]
  - fix: remove duplicate keyword (930130 PL1) (Jozef Sudolský) [#3517]
  - feat: extend rules to detect additional protocols in RFI attacks (931130 PL2, 934120 PL2) (Karel Knibbe) [#2572]
  - feat: extend rule to detect url:file: schema in Java RFI attacks (931130 PL2) (Andrew Howe) [#2727]
  - fix: add local_file scheme from Python 2 (931130 PL2, 934120 PL2) (Felipe Zipitría) [#2809]
  - fix: close userinfo-based bypass (931130 PL2) (Andrea Menin) [#2479]
  - feat: new rule to detect path traversal attacks using URL encoded URL schemes in Java applications (931131 PL2) (Christoph Hansen) [#2902]
  - feat: extend rule to detect additional *nix shell commands (931160 PL1) (Gwendal Le Coguic / gwen001) [#2563]
  - feat: disassemble complex regexes for 932xxx rules that were subsequently replaced by other rules (Max Leske) [#2566]
  - feat: detect additional Unix RCE commands (932100 PL1, 932105 PL1) (Felipe Zipitría) [#2129]
  - feat: extend rule to detect additional entries to *nix command lists (932100 PL1, 932105 PL1) (Finn Westendorf / wfinn) [#2552]
  - feat: extend rule to detect additional *nix commands (932100 PL1) (Felipe Zipitría) [#2676]
  - feat: improve and extend cmdline processor to find more evasions (932100 PL1, 932105 PL1, 932230 PL1, 932150 PL1, 932175 PL1, 932220 PL2, 932240 PL1, 932106 PL3) (Felipe Zipitría) [#2907]
  - fix: avoid false positive with certain HTML character entities (932100 PL1) (Franziska Bühler) [#1954]
  - feat: move *nix command injection rule 932101, 932106 into the same range as the other *nix command injection rules (932231 PL2, 932232 PL3) (Felipe Zipitría, Max Leske) [#3092]
  - feat: extend rule to detect additional *nix commands (932105 PL1) (Felipe Zipitría) [#2677]
  - feat: extend rule to detect mshta in Windows shell commands (932110 PL1) (Somdev Sangwan / s0md3v) [#2588]
  - feat: new Windows commands rules based on lolbas-project replacing 932110, 932115 (932370 PL1, 932380 PL1) (Felipe Zipitría, Franziska Bühler, Max Leske) [#3059, 3170]
  - fix: avoid false positive on 'sort' (932115 PL1) (Franziska Bühler) [#2012]
  - feat: detect 'Invoke-WebRequest' command (932120 PL1) (Paul Beckett) [#2271]
  - feat: extend rule to detect additional PowerShell cmdlet on Windows (932120 PL1) (Pinaki Mondal / 0xInfection) [#2589]
  - feat: extend rule to detect PowerShell RCEs better via new automation (932120 PL1) (Felipe Zipitría) [#2669]
  - feat: new rule to detect Windows cmdlet aliases (932125 PL1) (Pinaki Mondal / 0xInfection) [#2589]
  - fix: extend rule to detect character class *nix expressions (932130 PL1) (Somdev Sangwan / s0md3v, Walter Hop) [#2594]
  - feat: new rules to detect Log4j / Log4Shell attacks (932131 PL2, 944150 PL1, 944151 PL2, 944152 PL4) (Christian Folini, Max Leske) [#2349]
  - fix: prevent false positives against brackets in User-Agent header (932131 PL2) (Max Leske) [#3486]
  - feat: extend rule to detect busybox, $SHELL, and ${SHELL} in *nix RCE attacks (932150 PL1) (Walter Hop) [#2728]
  - feat: extend rule to detect C99 and printf utilities (932150 PL1) (Karel Knibbe) [#2569]
  - feat: extend rule to detect ksh in *nix RCE attacks (932150 PL1) (Andrew Howe) [#2721]
  - feat: extend rule to detect RCE attacks using compression utilities (932150 PL1) (Andrew Howe) [#2712]
  - feat: extend rule to detect RCEs using Base64 evasions (932150 PL1) (Somdev Sangwan / s0md3v, Andrew Howe) [#2590]
  - feat: extend rule to detect RCEs using evasions quotes with python... commands (932150 PL1) (Somdev Sangwan / s0md3v, Andrew Howe) [#2590]
  - feat: new rule to detect generalised *nix RCE (932150 PL2) (Karel Knibbe) [#2583]
  - feat: replace *nix command injection rules 932150 PL1, 932151 PL1 with new rules for commands of less than 4 characters and commands of more than 4 characters in length respectively (932250 PL1, 932260 PL1) (Felipe Zipitría, Max Leske) [#3092]
  - fix: avoid FP on 'time' and 'ping' keywords (932150 PL1) (Walter Hop) [#2457]
  - feat: extend rule to detect RCE better via automation (932160 PL1) (Felipe Zipitría) [#2662]
  - fix: remove unnecessary prefixes from paths in unix-shell.data (932160 PL1) (Felipe Zipitría) [#2662]
  - feat: extend rule to detect expre in unix-shell list (932161 PL2) (Felipe Zipitría) [#2667]
  - feat: new rules to detect *nix commands in user-agent and referer request headers (932161 PL2, 932237 PL3) (Franziska Bühler, Max Leske, Shivam Bathla) [#3132]
  - feat: new rule detecting alias builtin (932175 PL1) (Felipe Zipitría) [#2796]
  - feat: use new automation to generate restricted-uploads.data from restricted-files.data (932180 PL1) (Max Leske) [#3282]
  - fix: use correct anomaly scoring variable (932180 PL1, 932200 PL2) (Jozef Sudolský) [#2324]
  - feat: detect RCE attempts with uninitialized shell vars (932200 PL2) (Andrea Menin) [#2151]
  - feat: extend rule to detect RCE in user-agent request header (932200 PL2) (Franziska Bühler, Shivam Bathla) [#3108]
  - feat: reduce FPs by removing User-Agent from individual target list (932200 PL2) (Max Leske) [#3489]
  - fix: generate correct log entries when using 'MATCHED_VAR_NAME' in conjunction with chain rules (932200 PL2, 933120 PL1, 933151 PL2) (Jozef Sudolský) [#2347]
  - fix: new rules to handle referer header and fix false positive (932205 PL2, 932206 PL2) (Max Leske) [#3300]
  - feat: extend rule to detect quote evasion (932210 PL2) (Max Leske) [#3120]
  - feat: extend rule to detect sh (932210 PL2) (Franziska Bühler) [#2816]
  - feat: extend rule to detect SQLi via automation of keyword list updates (932210 PL2) (Felipe Zipitría) [#2801]
  - feat: new rule to detect SQLite system command injection (932210 PL2) (flo405, Andrea Menin, Christian Folini) [#2032]
  - fix: add word boundaries for sh in RCE rules (932230 PL1, 932250 PL1) (Max Leske) [#3186]
  - fix: avoid FPs in RCE detections against words 'environment' and 'performance' (932230 PL1, 932235 PL1, 932260 PL1, 932236 PL2, 932237 PL3, 932239 PL2) (Esad Cetiner) [#3477]
  - fix: handle false positive against sh in *nix command injection attacks (932230 PL1, 932250 PL1, 932236 PL2) (Max Leske) [#3186]
  - feat: add unix commands pyversions and py3versions (932235 PL1, 932260 PL1, 932236 PL2, 932237 PL3, 932239 PL2) (Jitendra Patro) [#3465]
  - feat: replace *-with-params.ra files with suffix replacements (932235 PL1, 932236 PL2, 932239 PL2, 932237 PL3) (Max Leske) [#3331]
  - fix: prevent FP on keywords 'more' and 'time' in Unix RCE (932235 PL1) (Franziska Bühler) [#3488]
  - fix: reduce FPs at the start of strings by excluding 'as' and 'at' (932236 PL2) (Franziska Bühler, Max Leske, Andrew Howe) [#3531
  - fix: prevent FPs against names due to "axel" and "perl" (932235 PL1, 932260 PL1, 932236 PL2, 932239 PL2, 932237 PL3) (@superlgn) [#3492]
  - fix: add whitespace after keywords mail and task to solve false positives (932236 PL2) (Franziska Bühler) [#3274]
  - fix: align unix-shell-upto3* files (932236 PL2) (Max Leske) [#3128]
  - fix: handle false positives with word "settings" (932236 PL2, 932237 PL3, 932239 PL2) (Esad Cetiner) [#3394]
  - fix: prevent FP on keywords more and time in Unix RCE (932236 PL2) (Franziska Bühler) [#3487]
  - fix: solved false positives with creation of word boundaries for commonly used words used in *nix RCE rules (932236 PL2) (Max Leske) [#3187]
  - fix: use correct anomaly scoring variable (932236 PL2) (Ervin Hegedus) [#3112]
  - fix: improve rule by matching non-word-boundary of commands with options (932237 PL3) (Max Leske) [#3425]
  - feat: new rule to detect *nix commands in user-agent and referer request headers (932239 PL2) (Franziska Bühler, Shivam Bathla) [#3104, #3318]
  - fix: reduce FPs in generic quote evasion detection (932240 PL2) (Max Leske) [#3494]
  - fix: remove ARGS_NAME from target variables in (932240 PL2) (Andrea Menin) [#2960]
  - fix: use correct anomaly scoring variables and paranoia level tags across for rule (932240 PL2) (Ervin Hegedus) [#2963]
  - fix: false positives by requiring specific tokens to follow commands (932250 PL1) (Max Leske) [#3186]
  - fix: Added missing target name to logdata (932260 PL1, 932240 PL2) (Ervin Hegedus) [#3409]
  - fix: remove chained rule (932260 PL1) (Max Leske) [#3521]
  - feat: new rules to detect email protocol attacks (932300 PL2, 932310 PL2, 932320 PL2) (Felipe Zipitría) [#2322]
  - fix: remove additional range expression that cause parsing errors for RE2 (932311 PL3) (Felipe Zipitría) [#2484]
  - feat: new rules to detect detecting *nix shell history invocations (932330 PL1, 932331 PL3) (Karel Knibbe) [#2577]
  - fix: remove 'time' prefix from Windows RCE detection (932370 PL1, 932380 PL1) (Max Leske) [#3528]
  - feat: extend rule to detect additional file extensions via list of executable PHP files (933110) (Jan Gora / terjanq) [#2585]
  - feat: extend data file to add missing PHP config directives (php-config-directives.data, 933120 PL1) (Max Leske) [#3028]
  - feat: extend rule to detect additional sensitive PHP directives (933120 PL1) (Gwendal Le Coguic / gwen001) [#2561]
  - feat: extend rule to detect PHP config directives via automation of keyword list updates (933120 PL1) (Felipe Zipitría) [#2696]
  - feat: extend rule to detect sensitive PHP variables better (933130 PL1) (Felipe Zipitría) [#2668]
  - tests: clean test definitions and provide proper descriptions (933150 PL1, 933160 PL1) (Andrea Menin, Matteo Pace, Max Leske) [#3462]
  - feat: extend data file to include additional php function names (php-function-names-933151.data, 933151 PL2) (Jitendra Patro) [#3212]
  - feat: automate generation of PHP function dictionaries, revisited detection (933160 PL1, 933161 PL3, 933150 PL1, 933151 PL2) (Juan-Pablo Tosso, Christian Folini, Matteo Pace) [#3273]
  - feat: extend rule to detect document.domain XSS (933160 PL1, 941180 PL1) (Franziska Bühler, 0SPwn) [#2567]
  - feat: extend rule to detect evasions in PHP contexts with " (933160 PL1) (Somdev Sangwan / s0md3v) [#2596]
  - feat: rearrange keywords (933160 PL1, 941390 PL1) (Karel Knibbe) [#2905]
  - fix: handle false positive by fixing whitespace matching after PHP command (933160 PL1) (Max Leske) [#3432]
  - fix: solve ReDoS issue in rule (933161 PL3) (Andrea Menin) [#2302]
  - feat: extend rule to detect bzip2 wrapper in PHP injection attacks (933200 PL1) (Andrew Howe) [#2723]
  - feat: extend rule to detect ssh2.\* wrappers in PHP injection attacks (933200 PL1) (Andrew Howe) [#2731]
  - fix: avoid false positive when cookie contains slash (933210 PL1) (Ervin Hegedus) [#1996]
  - fix: close PHP whitespace bypass (933210 PL1) (Walter Hop) [#2033]
  - fix: prevent excessive backtracking (933210 PL1) (Andrea Menin) [#2214]
  - feat: new rule to detect PHP injection attacks without terminating semi-colon (933211 PL3) (Karel Knibbe) [#2581]
  - feat: extended rule to detect Node.js injection attacks using require and child_process (934100 PL1, 932101 PL2) (Andrea Menin) [#2893]
  - feat: extend rule to detect Node.js RCE better (934100 PL1) (rektor0) [#2578]
  - feat: improve transformation pipeline to detect Base64-encoded evasions (934100 PL1) (Andrew Howe) [#3203]
  - feat: new rule to detect Node.js RCE detection (934101 PL2) (rektor0) [#2578]
  - fix: improve js rule transformation pipelines (934101 PL1, 934130 PL1, 934169 PL1, 934131 PL2) (Andrew Howe) [#3312]
  - feat: extend data file to include additional indicators (ssrf.data, 934110 PL1) (Jitendra Patro) [#3213]
  - feat: extend rule to detect SSRF better (934110 PL1) (Felipe Zipitría) [#2660]
  - feat: new rules to detect common IP-based SSRF targets (934110 PL1, 934120 PL2) (Felipe Zipitría) [#2259]
  - feat: extend rule to detect additional schema and IP evasion techniques in SSRF (934120 PL2) (Felipe Zipitría, Max Leske) [#2599]
  - feat: extend rule to detect octal address of AWS metadata endpoints (934120 PL2) (Karel Knibbe) [#2555]
  - feat: extend rule to detect SSRF better by inspecting targets beyond just ARGS (934120 PL2) (Karel Knibbe) [#2555]
  - feat: new rules to detect JavaScript prototype pollution (934130 PL1, 934131 PL2) (Walter Hop) [#2411]
  - fix: remove base64 transformation due to limited effectiveness and to align behavior across ModSecurity v2.x and libModSecurity v3.x engines (934130 PL1) (Andrea Menin) [#3378]
  - fix: remove overly specific rule with limited benefits and lack of cross-engine compatibility (934131 PL2) (Andrea Menin) [#3378]
  - feat: new rules to detect detection of Perl and Ruby RCE signatures in a generic way (934140 PL2, 934150 PL1) (Karel Knibbe) [#2587]
  - feat: new rule to detect Node DoS attack via expressions resolving to true (934160 PL1) (Karel Knibbe) [#2917]
  - feat: new rule for PHP supporting data: scheme without using // before the content-type (934170 PL1) (Felipe Zipitría) [#3018]
  - feat: extend rules to detect path based XSS via new target REQUEST_FILENAME in 941xxx rules (Walter Hop) [#2894]
  - feat: run libinjection XSS detector on request filename in PL2 (941101 PL2) (Andrew Howe) [#2208]
  - feat: move rule from PL1 to PL2 (941120 PL2) (Christian Folini) [#2306]
  - fix: avoid false positive by adding character limit (941120 PL2) (Christian Folini) [#1872]
  - fix: avoid FP in Base64 content (941120 PL1) (Jozef Sudolský) [#2226]
  - fix: remove unnecessary character escape (941120 PL2) (Andrew Howe) [#2805]
  - fix: avoid FP in XMLNLS (941130 PL1) (Walter Hop) [#2192]
  - fix: solve ReDoS issue in rule (941140 PL1) (Andrea Menin) [#2050]
  - feat: detect 'dialog' tag in XSS no-script payloads (941160 PL1) (Jitendra Patro) [#3473]
  - feat: disassemble complex regex fully (941160 PL1) (Felipe Zipitría) [#2701]
  - fix: make regular expression more restrictive (941170 PL1) (Andrea Menin) [#2292]
  - fix: new rule at PL2 to move the detection of '--&gt;' out of PL1 due to false positives (941181 PL2) (Paul Beckett) [#2082]
  - feat: disassemble complex regex (941210 PL1) (Felipe Zipitría) [#3262]
  - feat: extend rule to detect XSS evasions using carriage return (\r) and new line (\n) characters (941210 PL1) (oct0pus7) [#2576]
  - feat: disassemble complex regex (941220 PL1) (Felipe Zipitría) [#3263]
  - fix: correct numerical values used for HTML entity evasion detection (941220 PL1) (Jitendra Patro) [#3479]
  - fix: avoid false positive with Russian characters (941310 PL1) (Max Leske) [#2107]
  - feat: improve detection by adding missing javascript prompt and confirm methods (941390 PL1) (Jitendra Patro) [#3395]
  - feat: new rule to detect JavaScript methods (941390 PL1) (Franziska Bühler) [#2702]
  - feat: extend rule and moved rule from PL3 to PL2 (942101 PL2) (Matteo Pace) [#2922]
  - feat: extended rule to detect common SQL injection probing in path segments (942110 PL2) (Andrea Menin) [#2914]
  - feat: prevent FPs by removing rule (942110 PL2) (Max Leske) [#3505]
  - feat: add target REQUEST_FILENAME to rule to detect path-based SQLi attacks (942120 PL2) (Andrew Howe) [#3057]
  - feat: extend rule to detect use of collate in SQLite injection attacks (942120 PL2) (Jan Gora / terjanq) [#2584]
  - fix: extend rule to detect more SQLi (942120 PL2) (Karel Knibbe) [#2556]
  - fix: resolve issue with regular expression and improve SQLi detection by detecting 'not between' (942120 PL2) (NiceYouKnow, Max Leske, Franziska Bühler) [#2115]
  - fix: update SQL reserved words (942120 PL2) (Felipe Zipitría) [#2798]
  - feat: extend rule to detect glob in list of SQLi tautologies (942130 PL2) (Franziska Bühler) [#2729]
  - fix: remove unneeded TX variables (942130 PL2, 942131 PL2, 942521 PL3) (Andrea Menin) [#3293]
  - feat: detect more error-based SQL injections (942150 PL2, 951230 PL1) (Jozef Sudolský) [#2429]
  - feat: extend rule to detect more SQL function names (942150 PL2) (Karel Knibbe) [#2895]
  - feat: extend rules to detect more SQL error messages and functions (942151 PL1, 942152 PL1, 951220 PL1, 951230 PL1, 951240 PL1) (Jitendra Patros) [#3336]
  - feat: extend rule to detect additional SQL function signatures (942151 PL1) (Karel Knibbe) [#2570]
  - feat: extend rule to detect endswith, startswith, unistr, pg_client_encoding and various JSON SQL functions (942151 PL1) (Franziska Bühler) [#2874]
  - feat: extend rule to detect various JSON functions (942151 PL1) (Franziska Bühler) [#3041]
  - fix: avoid FP in SQL function names by splitting between PL1/PL2 (942151 PL1, 942150 PL2) (Jozef Sudolský) [#2480]
  - feat: extend rule to detect sql_compileoption_get in SQLite injection attacks (942152 PL1) (Andrew Howe) [#2718]
  - fix: extend blind SQLi detection (942160 PL1) (Franziska Bühler, Christian Folini) [#1956]
  - feat: new regex-assembly file for rule (942170 PL1) (Andrea Menin) [#2939]
  - feat: extend rule to detect SQL injection authentication bypasses (942180 PL2) (rekter0) [#2575]
  - feat: improve SQLi detection with spaces (942190 PL1, 942390 PL2) (Manuel Spartan, Max Leske) [#2436]
  - fix: avoid FP in SQLi by adding word boundary checks (942190 PL1) (Jozef Sudolský) [#2078]
  - fix: avoid FP in SQLi with keyword 'union' (942190 PL1) (Franziska Bühler) [#2058]
  - fix: prevent comment-based SQL evasion (942190 PL1) (Andrea Menin) [#1910]
  - fix: resolve bug in regular expression and add test case (942190 PL1) (NiceYouKnow, Max Leske, Franziska Bühler) [#2112]
  - feat: disassemble complex regex (942200 PL2) (Franziska Bühler, Max Leske) [#2932]
  - feat: extend rule to detect SQLi in user-agent and referer request headers (942200 PL2, 942370 PL2) (Franziska Bühler, Shivam Bathla) [#3106]
  - feat: improve regex-assembly file for rule (942210 PL2) (Andrew Howe) [#2945]
  - fix: detect the correct magic numbers that crash old PHP versions (942220 PL1) (Kyzentun, Walter Hop) [#2010]
  - fix: avoid false positive with 'case' (942230 PL1) (Franziska Bühler) [#2035]
  - fix: detect SQL false negative (942230 PL1) (Max Leske) [#2348]
  - feat: disassemble complex regex (942240 PL1) (Franziska Bühler, Max Leske) [#2938]
  - fix: avoid FP in 'having' SQLi (942251 PL3) (Felipe Zipitría) [#2248]
  - feat: new regex-assembly file for rule (942280 PL1) (Andrea Menin) [#2933]
  - feat: extend rule to detect additional MongoDB operators via NoSQL commands list (942290 PL1) (rekter0) [#2579]
  - feat: new regex-assembly file for rule (942290 PL1) (Andrea Menin) [#2942]
  - feat: improve regex-assembly format (942300 PL2) (Felipe Zipitría) [#3296]
  - fix: avoid false positive by adding word boundary checks (942300 PL2) (Franziska Bühler) [#2099]
  - fix: remove unnecessary part of regular expression (942310 PL2) (NiceYouKnow) [#2189]
  - feat: extend rule to detect ::int and ::bool SQL data conversions (942320 PL1) (Franziska Bühler) [#2872]
  - feat: extend rule to detect lo_get and ::text via PostgreSQL functions list (942320 PL2) (Franziska Bühler, Walter Hop, Shivam Bathla) [#2925]
  - feat: extend rule to detect lo_import and div via PostgreSQL functions list (942320 PL2) (Franziska Bühler, Shivam Bathla) [#2916]
  - feat: extend rule to detect more PostgreSQL data types (942320 PL2) (Franziska Bühler, Shivam Bathla) [#3019]
  - fix: add word boundaries to keywords to solve false positives (942330 PL2) (Franziska Bühler) [#3207]
  - feat: extend rule to detect SQL injection better (942340 PL2) (Karel Knibbe) [#2557]
  - fix: extend rule to detect more SQLi (942340 PL2) (Jan Gora / terjanq) [#2559]
  - feat: detect SQLi using the 'drop' keyword (942350 PL1, 942360 PL1, 942200 PL2, 942362 PL2) (Jozef Sudolský) [#2218]
  - fix: solve ReDoS issue in rule (942350 PL1) (Andrea Menin) [#2300]
  - feat: new regex-assembly file for rule (942370 PL2) (Christoph Hansen, Max Leske) [#2954]
  - feat: detect SQLi with 'if exists' (942380 PL2) (NiceYouKnow) [#2121]
  - feat: optimize regex (942400 PL2) (Jozef Sudolský) [#2323]
  - feat: disassemble complex chained regex (942440 PL2) (Felipe Zipitría) [#3295]
  - feat: optimize regex (942440 PL2) (Felipe Zipitría) [#2459]
  - fix: adapt rule to work in all ModSecurity versions (942440 PL2) (Andrew Howe) [#2201]
  - fix: avoid FP in JWT tokens (942440 PL2) (Andrea Menin) [#2460]
  - fix: reformat rules to follow project guidelines (942440 PL2, 949959, 949159, 959059, 959159) (Ervin Hegedus) [#3206]
  - fix: solve errors in regex pattern (942440 PL2) (Andrea Menin) [#3290]
  - fix: prevent FPs for click identifiers in query string by placing arg specific rule exclusions in rule set (942441, 942442) (Max Leske) [#3500]
  - feat: extend rules to detect current_user and overlay (942470 PL1, 942480 PL2) (Franziska Bühler) [#2875]
  - feat: extended rule to detect detect SQL injection attacks using headers (942480 PL2) (Paul Beckett) [#2911]
  - feat: extend rule to detect newlines in overlay (942480 PL2) (Franziska Bühler, Shivam Bathla) [#3040]
  - fix: detect MySQL optimizer hints (942500 PL1) (Max Leske) [#3431]
  - feat: new rules to detect SQL authentication bypasses (942520 PL2, 942521 PL2, 942522 PL2) (Jan Gora / terjanq) [#2603]
  - feat: extend rule to detect SQLi in user-agent and referer request headers (942521 PL2) (Franziska Bühler, Shivam Bathla) [#3107]
  - fix: replace 'MATCHED_VAR' in 'logdata' argument with stable variable (942521 PL2, 943110 PL1, 943120 PL1) (Ervin Hegedus) [#3543]
  - feat: new rule to detect '; in SQLi (942530 PL3) (Franziska Bühler) [#2808]
  - feat: new rule to detect authentication bypass via SQL injection that abuses semi-colons to end the SQL query (942540 PL1) (Karel Knibbe) [#2904]
  - fix: update scoring variable (942540 PL2) (Walter Hop) [#2970]
  - feat: new rule to detect MySQL scientific notation attacks (942560 PL1) (Jitendra Patro) [#3316]
  - fix: remove unnessecary 'lowercase' transformation from chain rule (944120 PL1) (Federico G. Schwindt) [#1852]
  - feat: extend rule to detect JAVA exploits better via java-classes.data file (944130 PL1) (Dennis Brown) [#3048]
  - feat: new rule to deny uploading .jsp and .jspx files (944140 PL1) (Walter Hop) [#2456]
  - feat: new rule to detect Spring4Shell (944260 PL2) (Christian Folini, Andrea Menin) [#2464]
  - fix: update administrative rule ids for consistent operation (950011, 950012, 950018) (Ervin Hegedus) [#3339]
  - feat: improve rule file 951xxx via the use of skipAfter instead of variable TX:sql_error_match (Jozef Sudolský) [#2754]
  - feat: extend data file to include additional SQL error messages (sql-errors.data, 951100 PL1) (Jitendra Patro) [#3214]
  - fix: avoid FP in MySQL data leakage rule (951230 PL1) (Jozef Sudolský) [#2490]
  - fix: avoid FP in PostgreSQL error messages (951240 PL1) (Jozef Sudolský, Franziska Bühler) [#1870, #2313]
  - fix: handle false positive in SQL error leakage detection (951240 PL1) (Jozef Sudolský) [#3169]
  - fix: avoid FP in Sybase error message (951260 PL1) (Jozef Sudolský) [#2307]
  - feat: extend rule to detect PHP errors better via new automation (953100 PL1) (Felipe Zipitría) [#2663]
  - feat: new rules to detect PHP error leakages with high false positive rates at paranoia level 2 instead of 1 (953100 PL1, 953101 PL2) (Andrea Menin) [#3119]
  - fix: solve false positive by shifting "Field cannot be empty" to PL2 (953100 PL1, 953101 PL2) (Esad Cetiner) [#3407]
  - fix: ignore case of PHP tag in response text (953210 PL1) (Felipe Zipitría) [#2664]
  - feat: extend rule to detect IIS errors via automation of pattern updates (954120 PL1) (Felipe Zipitría) [#2810]
  - fix: log response body to audit log only when full rule chain matches (954130 PL1) (Franziska Bühler) [#2202]
  - feat: added new webshells and tests (955100 PL1) (Jozef Sudolský) [#3405]
  - feat: extend data file to include additional web shells (web-shells-php.data, 955100 PL1) (Jitendra Patro) [#3215]
  - feat: extend data file to include additional web shells (web-shells-php.data, 955100 PL1) (Jozef Sudolský) [#2687]
  - fix: make regular expression more strict to reduce noise in logs (955120 PL1) (Jozef Sudolský) [#2315]
  - fix: use correct variable in chained condition for correlation rules (980120 PL0, 980150 PL0) (Simon Studer) [#1898]
  * Functionality that has been moved to plugins for this release
  - feat: add Google OAuth 2 exclusion plugin (Jozef Sudolský) [#2388]
  - feat: add phpBB exclusion rules (now a plugin) (Jozef Sudolský) [#1893]
  - feat: add phpMyAdmin exclusion rules (now a plugin) (Jozef Sudolský) [#1951]
  - feat: move IP reputation rules to plugins (Simon Studer) [#2482]
  - feat: move exclusion profiles and DOS rules to plugins (Andrew Howe) [#2469]
  - feat: ownCloud: Fix rule 9003001 to match both DAV and WebDAV (now a plugin) (Abu Dawud) [#2130]
  - fix: nextcloud: fix FPs (now a plugin) (kam821, Jozef Sudolský, ntimo, Felipe Zipitría, pyllyukko) [#1840, #1843, #1847, #1946]
  - fix: phpBB: Fix FPs (now a plugin) (Jozef Sudolský) [#2057, #2180, #2299, #2343]
  - fix: phpMyAdmin: Fix FPs (now a plugin) (Jozef Sudolský) [#2172, #2249, #2321, #2351]
  - fix: replace ARGS by ARGS_GET in rules in phase:1 (various rule exclusion rules) (Ervin Hegedus) [#2063]
  - fix: wordPress: fix FPs (now a plugin) (Jozef Sudolský) [#1899, #1971, #2320]
  - fix: wordPress: fix FPs and improve performance (now a plugin) (Walter Hop) [#1997, #2311]
  - fix: wordPress: fix FPs in Site Health page (now a plugin) (Robert de Boer, Fregf, Walter Hop) [#1895, #1920]
  - fix: xenForo: fix FPs (now a plugin) (Walter Hop, ThanhPT) [#1844, #1865, #1894, #1998, #2421]
- Version 3.3.6
  * Important changes:
  - fix: prevent using backslash in file names (v3) by @fzipi in #3800
  - feat: add new rule to catch invalid character in multipart headers (v3) by @airween (ported by @fzipi) in #3797</changelog>
  <changelog author="pgajdos@suse.com" date="1737633600">- package cleanup, coordinated with apache2-mod_security2
  cleanup
- version update to 4.10.0
  * New features and detections
  - feat: block CVE-2023-5003 by @azurit in https://github.com/coreruleset/coreruleset/pull/3955
  - feat: prevent accessing PHP variables by @azurit in https://github.com/coreruleset/coreruleset/pull/3965
  * Other Changes
  - fix: FP against `pattern` with `=` following at arbitrary position by @theseion in
    https://github.com/coreruleset/coreruleset/pull/3963</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1766404800">- version update to 4.41.0
  * feat(931100): add IPv6 support / XML scan and SSH scheme. by @touchweb-vincent in #4321
  * feat(920440): add new restricted file extensions by @touchweb-vincent in #4322
  * fix(942160): adding unit test for double comment by @touchweb-vincent in #4315
  * fix(920280, 920300, 920310, 920311, 920320, 920330): should be block by @touchweb-vincent in #4319
  * fix(942151,942152): wrong functions names by @touchweb-vincent in #4333
  * feat(942460): adding help for non-English folks by @touchweb-vincent in #4334
  * fix(932180): reduce substring false positives by @EsadCetiner in #4338
  * fix(942151,942152): wrong functions names by @touchweb-vincent in #4337
  * fix(920180): wrong unit test - content-type evasion bypass by @touchweb-vincent in #4339
  * fix(956110): move rule to pl-2 by @EsadCetiner in #4344
  * docs: comment on disabling Expect header in .Net by @theseion in #4348
  * fix: add missing capture action to affected rules by @airween in #4361
- for changelog for older releases see:
  https://github.com/coreruleset/coreruleset/blob/v4.21.0/CHANGES.md</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1773057600">- version update to 4.24.1
  * New features and detections
    + feat(930140): add AI coding assistant artifact protection by
    @etiennemunnich in #4519
    + feat: Expand Scanner Agents by @HackingRepo in #4532
  * Fixes
    + fix(942200): prevent matches against user agent strings by
    @theseion in #4537
    + fix(942480): don't inspect cookies twice by @touchweb-vincent
    in #4524
  * Other Changes
  + refactor: create 934130 .ra file by @Xhoenix in #4487
  + refactor: create 941330 .ra file by @fzipi in #4492
  + refactor: create 944300 .ra file by @fzipi in #4490
  + refactor: create 941320 .ra file by @fzipi in #4491
  + refactor: create 921160 .ra file by @fzipi in #4497
  + refactor: create 921120 .ra file by @fzipi in #4496
  + refactor: create 921110 .ra file by @fzipi in #4495
  + feat: move 930110 to regex-assembly by @fzipi in #4494
  + refactor: create 941190 .ra file by @fzipi in #4499
  + refactor: create 941400 .ra file by @fzipi in #4517
  + refactor: create 942250 .ra file by @fzipi in #4512
  + refactor: create 941370 .ra file by @fzipi in #4518
  + refactor: create 944260 .ra file by @fzipi in #4510
  + feat: move 943100 to regex-assembly by @fzipi in #4504
  + refactor: create 944120 .ra file by @fzipi in #4508
  + refactor: create 942450 .ra file by @fzipi in #4513
  + refactor: create 942510 and 942511 .ra files with shared
    include by @fzipi in #4516
  + refactor: create 944240 .ra file by @fzipi in #4509
  + docs: comment on threshold should be more alarming by
    @touchweb-vincent in #4330
  + chore: add missing regex-assembly comment blocks to rules by
    @fzipi in #4523
  + fix(913100): adding OWASP Nettacker to known scanners list
    by @securestep9 in #4529
  + refactor: create 941300 .ra file by @fzipi in #4521
- for changelog for older releases see:
  https://github.com/coreruleset/coreruleset/blob/v4.24.1/CHANGES.md</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1780315200">- version update to 4.27.0
  * fix(920240, 920400): don't rely on content-type header
- version update to 4.26.0
  * feat: Add WhatWAF to the scanner list
  * feat: Add ghauri to scanner list
  * feat: Expand Scanner User Agents List (v2)
  * feat: Expanded os files list
  * feat(933100): all HTTP headers should be checked
  * fix(lfi-os-files): add .dockerenv, .DS_Store, META-INF/, WEB-INF/
  * feat(934200): detect Server-Side Template Injection (SSTI) attacks
  * fix(lfi-os-files): require path prefix for .profile
  * fix(933150): remove is_int from PHP function names list
  * fix(932370): remove url from Windows LOLBIN command list
  * fix(920539): prefer a bypass on a named rule rather than n+1 bypass
  * fix(942290): add word boundary to MongoDB operator detection
  * fix: false positive with parameter name `.history`
  * fix(942410): use common exceptions instead of rule
  * fix(942200): reduce false positives on payloads with comments
  * fix(unix): exclude `pg` command from pl-1
  * fix(930130): comment out false positive prone entries
  * fix(920100): drop HTTP/0.9 GET support from request line validation
  * fix: Update restricted files to include Perl subdirectories
- version update to 4.25.0
  * feat(930130,930140): expand AI-based paths
  * feat: add aws security agent in scanners-user-agents.data
  * feat(932390): add shell fork bomb detection rule at PL2
  * refactor: create 941250 `.ra` file
  * refactor: create 942220 .ra file
  * refactor: create rule 931100 and 931110 `.ra` files
  * feat: Adding critical ai dirs that previously not exist
  * refactor: create 933140 and 933180 `.ra` files
  * fix(944110,944120,944130,944150,944151,944200,944210,..): don't inspect cookies twice
  * refactor: create 943120 `.ra` file
  * fix: false negative 932236
  * fix(933111): prevent whitespace padding bypass in PHP double-extension upload
  * fix(933110): prevent whitespace padding bypass in PHP upload detection
  * fix(944140): prevent whitespace padding bypass in JSP file upload detection
  * feat: update list of unix commands
  * fix(932180): prevent whitespace padding bypass in restricted file upload detection
  * fix: harden GitHub Actions workflows
  * refactor: create 941310 `.ra` files
  * docs: update README
  * refactor: create 941120 `.ra` file
  * fix(920540): allow rule exclusions for specific targets
  * fix(931130): ensure correct target is logged</changelog>
</package>
<package pkgid="3b2a11b89f0da61eb7cb6b1067c5af481c2ff43765775526e598289512ed4b5c0e3f63ca66d7c1be3e50e320dd2b5d0d0e37dcf09ab3d3f139f09ebca6e40003" name="owasp-modsecurity-crs" arch="src">
  <version epoch="0" ver="4.27.0" rel="32.3"/>
  <changelog author="Thomas.Worm@DATEV.de" date="1346328000">- Initial package version 2.2.5</changelog>
  <changelog author="Thomas.Worm@DATEV.de" date="1346932800">- Added README.SuSE</changelog>
  <changelog author="Thomas.Worm@DATEV.de" date="1346932801">- Package modification for factory submission:
  * Changed services to localonly mode
  * Added copyright information to spec file</changelog>
  <changelog author="Thomas.Worm@DATEV.de" date="1348056000">- Raised version to 2.2.6.
  * Resolves bnc#779076
  * Resolves CORERULES-87</changelog>
  <changelog author="p.drouand@gmail.com" date="1425816000">- Update to version 2.2.9
  * Updated the /util directory structure
  * fix 950901 - word boundary added
  * modsecurity_35_bad_robots.data - gecko/25 blocks Firefox Android
  https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/157
- Fix SuSE &gt; SUSE spelling
- Use download Url as source
- Do not explicitely depend on apache2; apache2-mod_security2
  depends on it
- Remove redundant %clean section
- Do not copy INSTALL file into the package
- ChangeLog has been replaced with CHANGES in upstream</changelog>
  <changelog author="bwiedemann@suse.com" date="1500897600">- sort conf file entries to fix build-compare (boo#1041090)</changelog>
  <changelog author="pgajdos@suse.com" date="1606824000">- use system apache rpm macros</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1684497600">- Version 3.3.4.
  * Important Notice: From CRS 3.2.2, 3.3.3 and up, ModSecurity 2.9.6 or 3.0.8 (or versions with backported patches) are required due to the addition of new protections. We recommend upgrading your ModSecurity as soon as possible. If your ModSecurity is too old, your webserver will refuse to start with an Unknown variable: &amp;MULTIPART_PART_HEADERS error. If you are in trouble, you can temporarily delete file rules/REQUEST-922-MULTIPART-ATTACK.conf as a workaround and get your server up, however, you will be missing some protections. Therefore we recommend to upgrade ModSecurity before deploying this release.</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1692187200">- Version 3.3.5.
  * This is the OWASP ModSecurity Core Rule Set version 3.3.5.
  * Important changes:
  - Backport fix for CVE-2023-38199 from CRS v4 via new rule 920620 (Andrea Menin, Felipe Zipitría)
  * Fixes:
  - Fix paranoia level-related scoring issue in rule 921422 (Walter Hop)
  - Move auditLogParts actions to the end of chained rules where used (Ervin Hegedus)
  * Chore:
  - Clean up redundant paranoia level tags (Ervin Hegedus)
  - Clean up YAML test files to support go-ftw testing framework (Felipe Zipitría)
  - Move testing framework from ftw to go-ftw (Felipe Zipitría)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1693569600">- use upstream archive for building the package, the base folder name in the
  archive changed</changelog>
  <changelog author="Flavio Castelli &lt;fcastelli@suse.com&gt;" date="1733227200">- Version 4.9.0
  * Important changes
  - feat: add variable to skip response rules by @fzipi in #3944
  * New features and detections
  - feat: add fish shell files to restricted-files.data by @OhMyVolk in #3915
  - feat: add quantitative testing to Git workflow by @airween in #3924
  * Other Changes
  - feat: added support for new web shells by @azurit in #3898
  - fix(security): remove double URL decode (921151 PL2, 932190 PL3, 942441 PL2, 942442 PL2, 942460 PL3) by @azurit in #3741
  - docs: extended rule documentation (900200) by @dune73 in #3934
- Version 4.8.0
  * Important changes:
  - fix: 9EA-241022 v4 by @RedXanadu in #3905
  * New features and detections
  - chore: set up nginx tests by @theseion in #3856
  * Other Changes
  - fix: remove unnecessary capture groups by @TimDiam0nd in #3849
  - fix(942120): update operators by @Xhoenix in #3841
  - fix(933120): do not match on base64 encoded strings by @fzipi in #3863
  - fix(refactor): 942130 and 942131 regex-assembly by @Xhoenix in #3862
  - fix(942520): SQL operators can be one or more characters by @Xhoenix in #3845
  - chore: remove verify id-range by @fzipi in #3885
  - chore: remove find-max-datalen-in-tests by @fzipi in #3891
  - chore: remove honeypot sensor by @fzipi in #3883
  - chore: remove browser tools by @fzipi in #3887
  - chore: remove send-payload-pls by @fzipi in #3879
  - chore: remove geo-location by @fzipi in #3875
  - chore: remove crs2 renumbering by @fzipi in #3873
  - chore: remove change-version script by @fzipi in #3869
  - chore: remove join multiline rules by @fzipi in #3877
  - chore: remove av-scanning by @fzipi in #3871
  - chore: remove util virtual patching by @fzipi in #3889
  - fix: include v3.3.6 release notes in latest by @fzipi in #3867
  - chore: remove fp-finder by @fzipi in #3893
- Version 4.7.0
  * New features and detections
  - feat: added sendgrid.env into restricted files by @azurit in #3823
  * Other Changes
  - fix: Changed regex (920470) to match multiple whitespaces after Content-Type parameters to avoid false-positives by @lostmann-owl-it in #3818
  - fix: fp with user-agent containing ; pg (932239 PL2) by @franbuehler in #3727
  - fix: update xss detection with onwebkitplaybacktargetavailabilitychanged event by @fzipi in #3822
  - feat: refactoring (944110 PL1) by @azurit in #3715
- Version 4.6.0
  * Important changes:
  - fix: prevent using backslash in file names by @fzipi in #3799
  - feat: add new rule to catch invalid character in multipart headers by @airween, @theseion, @fzipi in #3796
  * Other Changes
  - feat: rule to detect bash tilde expansion by @Xhoenix in #3765
  - fix: Update 932270's ver by @airween in #3786
  - perf: remove unnecessary chain rule and capture (921180 PL3) by @EsadCetiner in #3787
  - fix: add pem to restricted file extensions by @EsadCetiner in #3789
  - fix(942160): check REQUEST_FILENAME by @mat1010 in #3782
- Version 4.5.0
  * New features and detections
  - feat: added arithmetic expansion payload by @Xhoenix in #3756
  * Other Changes
  - fix(security): alias false negative by @Xhoenix in #3740
  - feat: add test overrides for nginx by @theseion in #3369
  - fix: use proper capture for log output of 932300 by @theseion in #3763
  - chore: use lowercase character class for 932320 by @theseion in #3772
  - fix: remove nonnecessary variable (932260 PL1) by @dune73 in #3773
- Version 4.4.0
  * New features and detections
  - feat: skip response rules if data are compressed by @azurit in #3742, #3712
  * Other Changes
  - fix(934140): update regex by @fzipi in #3731
  - fix: replacing t:UrlDecode with t:UrlDecodeUni (921240 PL1, 932170 PL1, 932171 PL1, 932190 PL3, 932190 PL1, 933211 PL3, 941310 PL1, 941350 PL1) by @azurit in #3713
- Version 4.3.0
  * New features and detections
  - feat: catch Java PostgreSQL errors (951240 PL1) by @azurit in #3686
  - feat: block The Mysterious Mozlila User Agent bot (913100 PL1) by @brentclark in #3646
  * Other Changes
  - fix: Oracle SQL database data leakage FP (951120 PL1) by @azurit in #3685
  - fix: typos in 920330 and 942280 tests by @TimDiam0nd in #3688
  - test: change pl-1 to pl1 to be inline with others by @TimDiam0nd in #3690
  - feat: use renovate to update docker-compose by @theseion in #3697
  - fix: FP for sched (932235 PL1, 932236 PL2, 932237 PL3, 932239 PL2, … by @theseion in #3701
  - fix: collections not being initialized without User-Agent header by @azurit in #3645
  - feat: refactoring of rule 941310 (PL1 941310) by @azurit in #3700
  - fix: resolving more FPs with Oracle error messages (951120 PL1) by @azurit in #3703
  - fix: removing double t:urlDecodeUni (920221 PL1, 920440 PL1, 932200 PL2, 932205 PL2, 932206 PL2) by @azurit in #3699
  - fix: false positives from PHP config directives and functions (933120 PL1, 933151 PL2) by @ssigwart in #3638
  - feat: prevent detection of web shells rules as malware by Windows Defender (955260 PL1) by @azurit in #3687
  - fix: fp with name axel by removing it from rce rule (932260 PL1) by @franbuehler in #3705
- Version 4.2.0
  * Changes with direct rule impact (sorted by lowest rule ID per change where available):
  - fix: increase length of Accept-Encoding header from 50 to 100 (920520 PL1) (Franziska Bühler) [#3661]
  - fix: add missing roundcube files (930120 PL1, 930121 PL2, 930130 PL1, 932180 PL1) (Esad Cetiner) [#3635]
  - fix: add visudo and cscli to unix-shell.data (932160 PL1, 932161 PL2) (Esad Cetiner) [#3663]
  - feat: block crowdsec cscli and visudo commands (932235 PL1, 932236 PL2, 932237 PL3, 932239 PL2, 932260 PL1) (Esad Cetiner) [#3649]
  - fix: add detection for php evasion attempt (933100 PL1) (Franziska Bühler) [#3667]
  * Changes without direct rule impact:
  - feat: disassemble php rule (933100 PL1) (Franziska Bühler) [#3662]
  - chore: remove references to nonexistant 942110 rule (Esad Cetiner) [#3648]
- Version 4.1.0.
  - feat: add check for combinations of t:lowercase and (?i) to lint (Franziska Bühler) [#3584]
  - feat: add support for additional ansible and chef commands (932160 PL1, 932161 PL2, 932235 PL1, 932260 PL1, 932236 PL2, 932239 PL2, 932237 PL3) (Esad Cetiner) [#3601]
  - feat: move HTTP header rules to phase 1 (932161 PL2, 932205 PL2, 932206 PL2, 932237 PL3) (Esad Cetiner) [#3570]
  - fix: prevent FPs against names due to "cron" (932260 PL1, 932236 PL2, 932237 PL3, 932239 PL2) (@superlgn) [#3578]
  - fix: add missing tags and ver action (various rules) (Jozef Sudolský) [#3571]
  - fix: adding more missing tags and ver actions (Jozef Sudolský) [#3593]
  - fix: do not check URL fragments in referer headers as part of the existing rule to prevent FPs (932205 PL2) (Max Leske) [#3485]
  - fix: range expressions must not start with \v (various rules) (Max Leske) [#3615]
  - fix: remove t:lowercase from rules that use '(?i)' modifier in their regex (942150 PL2, 942151 PL1, 942152 PL2) (Ervin Hegedus) [#3585]
  - test: change HTTP method to uppercase for test 932260-28 (Matteo Pace) [#3580]
  - chore(deps): update workflow actions (Max Leske) [#3613]
  - chore: add Esad Cetiner to list of developers (@EsadCetiner) [#3589]
- Version 4.0.0.
  * Important changes:
  - feat: introduce plugin architecture for extending CRS and minimizing attack surface. (Christian Folini, Max Leske, Jozef Sudolský, Andrew Howe) [#2038, #2448, #2404]
  - feat: migrate application exclusions and less-used functionality to plugins (Christian Folini, Max Leske, Jozef Sudolský, Andrew Howe)
  - feat: introduce early blocking option (Christian Folini) [#1955]
  - feat: introduce new rule file/category to detect use of common web shells in responses (955100-955340 PL1, 955350 PL2) (Jozef Sudolský, Andrea Menin) [#1962, #2039, #2116]
  - feat: rename 'Node.js' category to 'generic' (Felipe Zipitría) [#2340]
  - feat: make all formerly PCRE-only regular expressions compatible with RE2/Hyperscan regular expression engines (Max Leske, Felipe Zipitría, Allan Boll, Franziska Bühler) [#1868, #2356, #2425, #2426, #2371, #2372]
  - feat: add support for HTTP/3 (Jozef Sudolský) [#3218]
  - feat: add granular control over reporting levels in 9801xx rules (Simon Studer, Andrew Howe, Christian Folini) [#2482, #2488]
  - feat: add new rule to explicitly detect multiple Content-Type abuse (CVE-2023-38199) (920620 PL1) (Andrea Menin) [#3237]
  - feat: add enable_default_collections flag to not initialize collections by default (Matteo Pace) [#3141]
  - feat: extend definition of restricted headers to include Content-Encoding and Accept-Charset by default (920450 PL1, 920451 PL2) (Walter Hop) [#2780, #2782]
  - feat: drop HTTP/0.9 support to resolve FP (Federico G. Schwindt) [#1966]
  - fix: refactor and rename anomaly scoring variables and paranoia level definition (Simon Studer) [#2417]
  - tests: complete goal of 100% test coverage for rules (entire team, Juan-Pablo Tosso, NiceYouKnow)
  - feat: switch to using WordNet instead of spell for finding English words in spell.sh (Max Leske) [#3242]
  - feat: publish nightly packages regularly (Felipe Zipitría) [#2207]
  * Changes with direct rule impact (sorted by lowest rule ID per change where available):
  - feat: add placeholder files for new plugin architecture (Walter Hop) [#2515]
  - feat: check initialization and use for all TX variables (Ervin Hegedus) [#3043]
  - feat: extend rule to detect restricted method override headers (Mark Zeman / KramNamez) [#3056]
  - feat: extend rules to detect keyword time as prefix of *nix and Windows RCE rules (rules later replaced) (Franziska Bühler) [#2819]
  - feat: improve Unix shell evasion prefix (various rules) (Jitendra Patro, Max Leske) [#3518]
  - feat: improve performance by removing unnecessary lowercase transformations (various rules) (Jozef Sudolský) [#2106]
  - feat: add additional prefix commands to 'unix-shell-evasion-prefix' (various rules) (Jitendra Patro) [#3557
  - feat: consolidate 'unix-evasion-prefix*' files to ensure they don't diverge (various rules) (Franziska Bühler, Max Leske, Andrew Howe) [#3531]
  - feat: move regexp-assemble data files to root directory (Felipe Zipitría) [#3002]
  - feat: move rules to the earliest phase possible based on their inputs (various rules) (Ervin Hegedus) [#1941]
  - feat: remove superfluous 'urlDecodeUni' transformations (various rules) (Federico G. Schwindt) [#1845]
  - feat: rename 'tx.blocking_early' to 'tx.early_blocking' (various rules) (Christian Folini) [#2414]
  - feat: simplify regular expressions by replacing upper-case with lower-case matches if the expression is case-insensitive (various rules) (Felipe Zipitría) [#2485]
  - feat: remove SecCollectionTimeout from crs-setup.conf (Christian Folini) [#3559]
  - fix: do not log 'MATCHED_VAR' when the it contains the full response body (various rules) (Jozef Sudolský) [#1985]
  - fix: do not unnecessarily escape forward slashes in regular expressions (various rules) (Federico G. Schwindt) [#1842]
  - fix: reformat several initialization rules to follow project guidelines (Ervin Hegedus) [#3157]
  - fix: remove auditLogParts actions from all rules where present (Andrea Menin, Ervin Hegedus) [#3034, #3081]
  - fix: remove uncommon Content Types from default in crs-setup.conf.example (Andrea Menin) [#2768]
  - fix: update diverse rules to follow new naming convention with paranoia level TX variables (Christoph Hansen) [#2937]
  - fix: update various rules to consolidate use of backslashes to \x5c representation for better compatibility with known WAF engines (various rules) (Andrew Howe, Max Leske) [#2335, #2345, #2375, #2376, #2399, #2400, #2402, #2410, #2420, #2441, #2442, #2454, #2426]
  - fix: remove initialization rules for redundant IP reputation variables (901150, 901152) (Andrew Howe) [#2833]
  - fix: initialize all variables used properly (901169) (Ervin Hegedus) [#2802]
  - feat: improve sampling mode efficiency (901410, 901420, 901440) (Paul Beckett) [#2094]
  - fix: replace uses of 'ctl:ruleEngine=Off' with "ctl:ruleRemoveByTag=OWASP_CRS" to accomodate more than one ruleset (901450, 905100, 905110) (Jozef Sudolský) [#2156]
  - feat: remove old, commented-out IP reputation check rule (910110 PL1) (Paul Beckett) [#2148]
  - feat: detect 'burpcollaborator' scanner (913100 PL1) (Amir Hosein Aliakbarian) [#2152]
  - feat: detect 'httpx' scanner (913100 PL1) (Will Woodson) [#2045]
  - feat: detect 'LeakIX' scanner (913100 PL1) (Jozef Sudolský) [#1961]
  - feat: detect 'QQGameHall' malware (913100 PL1) (Walter Hop) [#2144]
  - feat: detect User-Agent of Tsunami Security Scanner (913100 PL1) (@hoexter) [#3480]
  - fix: avoid FP for YAM package manager (913100 PL1) (Jozef Sudolský) [#2022]
  - fix: move 'ecairn' from scanners to crawlers (913100 PL1) (Felipe Zipitría) [#2408]
  - feat: detect 'CensysInspect' and seoscanners.net crawlers (913102 PL2) (Andrew Howe) [#2155]
  - feat: detect 'ecairn' crawler (913102 PL2) (Jozef Sudolský) [#2024]
  - feat: detect 'Krzana' bot (913102 PL2) (Deepshikha Sinha) [#2432]
  - fix: remove rule to detect security scanner http headers (913110 PL1) (Christian Folini) [#3241]
  - feat: remove ineffective anti-scanner list scanners-urls.data and associated rule (913120 PL1) (Christian Folini) [#3235]
  - fix: correct the regular expression assembly (920120 PL1) (Max Leske) [#2333]
  - feat: increase rule score from warning to critial (920220 PL1) (Max Leske) [#3512]
  - fix: reduce FPs by handling the last path segment separately in new rule (920220 PL1, 920221 PL1) (Max Leske) [#3512]
  - fix: reduce FPs by matching on decoded variables (920220 PL1) (Max Leske) [#3512]
  - feat: prevent FPs by moving rule to higher PL (920240 PL2) (Max Leske) [#3506]
  - feat: valiadate 'SEC-CH-UA' and 'SEC-CH-UA-MOBILE' request headers (920274 PL4) (Chaim Sanders) [#1970]
  - fix: use the right kind of validation for 'Sec-CH-UA' and 'Sec-CH-UA-Mobile' request headers (920274 PL4, 920275 PL4) (somechris) [#2028]
  - fix: make validatioin of 'Sec-Fetch-User' header more strict (920275 PL4) (somechris) [#2020]
  - feat: move rule from PL2 to PL3 (920300 PL3) (Franziska Bühler) [#2013]
  - fix: amend rule to exclude CONNECT requests from requiring an Accept header (920300 PL3) (Andrew Howe) [#2297]
  - feat: add IPv6 to the 'Host header is a numeric IP address' check (920350 PL1) (itsTheFae, Ervin Hegedus, Jozef Sudolský) [#1929]
  - fix: avoid FP on '.axd' in restricted extensions, these are public (920440 PL1) (Jozef Sudolský) [#1925]
  - feat: rework restricted headers mechanism into two separate lists (920450 PL1, 920451 PL2) (Andrew Howe) [#3152]
  - fix: avoid FP in 'application/*+json' Content-Type (920470 PL1) (Mirko Dziadzka, Walter Hop) [#2455]
  - fix: avoid FP in CalDAV Content-Type (920470 PL1) (Vandan Rohatgi) [#2505]
  - fix: avoid FP in 'Content-Type' header with '#' character (920470 PL1) (Jozef Sudolský) [#1856]
  - fix: avoid FP on 'version' string in Content-Type header (920470 PL1) (Jozef Sudolský) [#1901]
  - fix: resolve false negative when matching against allowed charsets variable (920480 PL1) (katef, Federico G. Schwindt) [#1957]
  - fix: replace unnecessary capture groups in regular expressions with non-capturing groups (920510 PL3, 932200 PL2, 942510 PL2, 942511 PL3) (Federico G. Schwindt) [#1983]
  - feat: improve explanatory rule comments (920520 PL1) (Max Leske) [#2391]
  - feat: validate 'Accept-Encoding' header (920520 PL1, 920521 PL3) (Franziska Bühler) [#2357]
  - feat: new rule detect multiple occurrences of charset keyword in content type header (920530 PL1) (Jan Gora / terjanq) [#2571]
  - feat: new rule to detect Unicode character bypass check for non JSON requests (920540 PL1) (Franziska Bühler, 0SPwn) [#2512]
  - feat: new rule to detect # char in URIs (920610 PL1) (Karel Knibbe) [#2919]
  - fix: use correct anomaly scoring variables and paranoia level tags across several rules (921170 PL1, 921220 PL4, 932220 PL2, 932331 PL3, 933211 PL3, 934101 PL1, 942362 PL2, 951100) (Christoph Hansen) [#2931]
  - feat: new rules to detect HTTP parameter pollution bypasses (921210 PL3, 921220 PL4) (Christian Folini) [#2747]
  - fix: use correct anomaly scoring variables and paranoia level tags across several rules (921220 PL4, 932101 PL2, 932331 PL3, 933211 PL3, 942362 PL2) (Ervin Hegedus) [#2832]
  - feat: new rule to detect range header that is now forbidden on PL3 and up (921230 PL3) (Christian Folini) [#2760]
  - feat: new rule to detect mod_proxy attack (CVE-2021-40438) (921240 PL1) (Franziska Bühler) [#2818]
  - fix: add urlDecodeUni transformation rules with REQUEST_URI / REQUEST_BASENAME in phase 1 (921240 PL1, 920440 PL1, 920201 PL2, 920202 PL4) (Christian Folini) [#3411]
  - feat: new rules to detecting ModSecurity body processor confusion using the Content-Type HTTP header (921421 PL1, 921422 PL2) (Simon Studer, Ervin Hegedus) [#2763]
  - fix: handle false positives when detecting ModSecurity body processor confusion (921422 PL2) (Ervin Hegedus) [#2784]
  - feat: new rules detecting attacks on multipart headers (922100 PL1, 922110 PL1, 922120 PL1) (Felipe Zipitría) [#2769]
  - fix: prevent unintended match of character set substrings in multipart/form-data requests (922100 PL1) (Jozef Sudolský) [#3470]
  - feat: remove redundant t:lowercase for a little performance (922110 PL1) (Jozef Sudolský) [#3469]
  - fix: remove possessive quantifiers (922110 PL1) (Felipe Zipitría) [#2989]
  - fix: update comments (922110 PL1, 942440 PL2) (Jozef Sudolský) [#3468]
  - fix: add missing quotes at the end of action lists (930050) (Ervin Hegedus) [#2184]
  - feat: disassemble regular expression (930100 PL1) (Andrew Howe) [#2298]
  - fix: detect path traversal in uploaded file names (930100 PL1, 930110 PL1) (k4n5ha0, Franziska Bühler, Felipe Zipitría) [#2451]
  - fix: detect triple dot path traversal (930100 PL1, 930110 PL1) (Franziska Bühler) [#2309, #2310]
  - feat: extended rule to detect Tomcat specific path traversal attack (930110 PL1) (Christoph Hansen) [#2915]
  - fix: avoid FP for '..' without slashes (930110 PL1) (Tetrik, Walter Hop) [#2016]
  - feat: block access to AWS CLI files (930120 PL1, 930121 PL2) (Jozef Sudolský) [#2439]
  - feat: block access to extended list of sensitive files (930120 PL1, 930121 PL2, 930130 PL1) (Jozef Sudolský) [#1960]
  - feat: detect /proc and /sys access attempts (930120 PL1, 930130 PL1) (Andrew Howe) [#2154]
  - feat: extend rule to detect access attempts to /tmp/ (930120 PL1, 930121 PL2) (Max Leske) [#3131]
  - feat: extend rule to detect ECDSA type SSH identity files via list of sensitive *nix files (930120 PL1) (Pinaki Mondal / 0xInfection) [#2586]
  - fix: avoid detecting Google OAuth2 callback requests as malicious (930120 PL1, 930121 PL1) (Jozef Sudolský, Christian Folini) [#1958]
  - feat: extend rule to detect additional sensitive files on *nix systems (930121 PL2, 930130 PL1) (Gwendal Le Coguic / gwen001) [#2560]
  - feat: new rules to detect LFI and SQLi in user-agent and referer request headers (930121 PL2, 942152 PL2, 942321 PL2) (Franziska Bühler, Max Leske, Shivam Bathla) [#3102]
  - fix: extend rule to detect more LFI (930121 PL2) (Felipe Zipitría) [#2791]
  - feat: add BlockCypher.log to restricted-files.data (930130 PL1) (Jozef Sudolský) [#3501]
  - feat: add 'sslvpn_websession' to restricted-files.data (930130 PL1) (Jozef Sudolský) [#2338]
  - feat: add .vscode to restricted-files.data (930130 PL1) (Frederik Himpe) [#3471]
  - feat: extend data file to include additional restricted file names (restricted-files.data, 930130 PL1) (Jitendra Patro) [#3219]
  - feat: extend data file to include PrestaShop configuration file (restricted-files.data, 930130 PL1) (Jean-François Viguier) [#3192]
  - feat: extend rule to detect npm-shrinkwrap.json to restricted-files (930130 PL1) (Esa Jokinen / oh2fih) [#2627]
  - fix: block access to the Java-related WEB-INF directory (930130 PL1) (Jozef Sudolský) [#2092]
  - fix: remove duplicate keyword (930130 PL1) (Jozef Sudolský) [#3517]
  - feat: extend rules to detect additional protocols in RFI attacks (931130 PL2, 934120 PL2) (Karel Knibbe) [#2572]
  - feat: extend rule to detect url:file: schema in Java RFI attacks (931130 PL2) (Andrew Howe) [#2727]
  - fix: add local_file scheme from Python 2 (931130 PL2, 934120 PL2) (Felipe Zipitría) [#2809]
  - fix: close userinfo-based bypass (931130 PL2) (Andrea Menin) [#2479]
  - feat: new rule to detect path traversal attacks using URL encoded URL schemes in Java applications (931131 PL2) (Christoph Hansen) [#2902]
  - feat: extend rule to detect additional *nix shell commands (931160 PL1) (Gwendal Le Coguic / gwen001) [#2563]
  - feat: disassemble complex regexes for 932xxx rules that were subsequently replaced by other rules (Max Leske) [#2566]
  - feat: detect additional Unix RCE commands (932100 PL1, 932105 PL1) (Felipe Zipitría) [#2129]
  - feat: extend rule to detect additional entries to *nix command lists (932100 PL1, 932105 PL1) (Finn Westendorf / wfinn) [#2552]
  - feat: extend rule to detect additional *nix commands (932100 PL1) (Felipe Zipitría) [#2676]
  - feat: improve and extend cmdline processor to find more evasions (932100 PL1, 932105 PL1, 932230 PL1, 932150 PL1, 932175 PL1, 932220 PL2, 932240 PL1, 932106 PL3) (Felipe Zipitría) [#2907]
  - fix: avoid false positive with certain HTML character entities (932100 PL1) (Franziska Bühler) [#1954]
  - feat: move *nix command injection rule 932101, 932106 into the same range as the other *nix command injection rules (932231 PL2, 932232 PL3) (Felipe Zipitría, Max Leske) [#3092]
  - feat: extend rule to detect additional *nix commands (932105 PL1) (Felipe Zipitría) [#2677]
  - feat: extend rule to detect mshta in Windows shell commands (932110 PL1) (Somdev Sangwan / s0md3v) [#2588]
  - feat: new Windows commands rules based on lolbas-project replacing 932110, 932115 (932370 PL1, 932380 PL1) (Felipe Zipitría, Franziska Bühler, Max Leske) [#3059, 3170]
  - fix: avoid false positive on 'sort' (932115 PL1) (Franziska Bühler) [#2012]
  - feat: detect 'Invoke-WebRequest' command (932120 PL1) (Paul Beckett) [#2271]
  - feat: extend rule to detect additional PowerShell cmdlet on Windows (932120 PL1) (Pinaki Mondal / 0xInfection) [#2589]
  - feat: extend rule to detect PowerShell RCEs better via new automation (932120 PL1) (Felipe Zipitría) [#2669]
  - feat: new rule to detect Windows cmdlet aliases (932125 PL1) (Pinaki Mondal / 0xInfection) [#2589]
  - fix: extend rule to detect character class *nix expressions (932130 PL1) (Somdev Sangwan / s0md3v, Walter Hop) [#2594]
  - feat: new rules to detect Log4j / Log4Shell attacks (932131 PL2, 944150 PL1, 944151 PL2, 944152 PL4) (Christian Folini, Max Leske) [#2349]
  - fix: prevent false positives against brackets in User-Agent header (932131 PL2) (Max Leske) [#3486]
  - feat: extend rule to detect busybox, $SHELL, and ${SHELL} in *nix RCE attacks (932150 PL1) (Walter Hop) [#2728]
  - feat: extend rule to detect C99 and printf utilities (932150 PL1) (Karel Knibbe) [#2569]
  - feat: extend rule to detect ksh in *nix RCE attacks (932150 PL1) (Andrew Howe) [#2721]
  - feat: extend rule to detect RCE attacks using compression utilities (932150 PL1) (Andrew Howe) [#2712]
  - feat: extend rule to detect RCEs using Base64 evasions (932150 PL1) (Somdev Sangwan / s0md3v, Andrew Howe) [#2590]
  - feat: extend rule to detect RCEs using evasions quotes with python... commands (932150 PL1) (Somdev Sangwan / s0md3v, Andrew Howe) [#2590]
  - feat: new rule to detect generalised *nix RCE (932150 PL2) (Karel Knibbe) [#2583]
  - feat: replace *nix command injection rules 932150 PL1, 932151 PL1 with new rules for commands of less than 4 characters and commands of more than 4 characters in length respectively (932250 PL1, 932260 PL1) (Felipe Zipitría, Max Leske) [#3092]
  - fix: avoid FP on 'time' and 'ping' keywords (932150 PL1) (Walter Hop) [#2457]
  - feat: extend rule to detect RCE better via automation (932160 PL1) (Felipe Zipitría) [#2662]
  - fix: remove unnecessary prefixes from paths in unix-shell.data (932160 PL1) (Felipe Zipitría) [#2662]
  - feat: extend rule to detect expre in unix-shell list (932161 PL2) (Felipe Zipitría) [#2667]
  - feat: new rules to detect *nix commands in user-agent and referer request headers (932161 PL2, 932237 PL3) (Franziska Bühler, Max Leske, Shivam Bathla) [#3132]
  - feat: new rule detecting alias builtin (932175 PL1) (Felipe Zipitría) [#2796]
  - feat: use new automation to generate restricted-uploads.data from restricted-files.data (932180 PL1) (Max Leske) [#3282]
  - fix: use correct anomaly scoring variable (932180 PL1, 932200 PL2) (Jozef Sudolský) [#2324]
  - feat: detect RCE attempts with uninitialized shell vars (932200 PL2) (Andrea Menin) [#2151]
  - feat: extend rule to detect RCE in user-agent request header (932200 PL2) (Franziska Bühler, Shivam Bathla) [#3108]
  - feat: reduce FPs by removing User-Agent from individual target list (932200 PL2) (Max Leske) [#3489]
  - fix: generate correct log entries when using 'MATCHED_VAR_NAME' in conjunction with chain rules (932200 PL2, 933120 PL1, 933151 PL2) (Jozef Sudolský) [#2347]
  - fix: new rules to handle referer header and fix false positive (932205 PL2, 932206 PL2) (Max Leske) [#3300]
  - feat: extend rule to detect quote evasion (932210 PL2) (Max Leske) [#3120]
  - feat: extend rule to detect sh (932210 PL2) (Franziska Bühler) [#2816]
  - feat: extend rule to detect SQLi via automation of keyword list updates (932210 PL2) (Felipe Zipitría) [#2801]
  - feat: new rule to detect SQLite system command injection (932210 PL2) (flo405, Andrea Menin, Christian Folini) [#2032]
  - fix: add word boundaries for sh in RCE rules (932230 PL1, 932250 PL1) (Max Leske) [#3186]
  - fix: avoid FPs in RCE detections against words 'environment' and 'performance' (932230 PL1, 932235 PL1, 932260 PL1, 932236 PL2, 932237 PL3, 932239 PL2) (Esad Cetiner) [#3477]
  - fix: handle false positive against sh in *nix command injection attacks (932230 PL1, 932250 PL1, 932236 PL2) (Max Leske) [#3186]
  - feat: add unix commands pyversions and py3versions (932235 PL1, 932260 PL1, 932236 PL2, 932237 PL3, 932239 PL2) (Jitendra Patro) [#3465]
  - feat: replace *-with-params.ra files with suffix replacements (932235 PL1, 932236 PL2, 932239 PL2, 932237 PL3) (Max Leske) [#3331]
  - fix: prevent FP on keywords 'more' and 'time' in Unix RCE (932235 PL1) (Franziska Bühler) [#3488]
  - fix: reduce FPs at the start of strings by excluding 'as' and 'at' (932236 PL2) (Franziska Bühler, Max Leske, Andrew Howe) [#3531
  - fix: prevent FPs against names due to "axel" and "perl" (932235 PL1, 932260 PL1, 932236 PL2, 932239 PL2, 932237 PL3) (@superlgn) [#3492]
  - fix: add whitespace after keywords mail and task to solve false positives (932236 PL2) (Franziska Bühler) [#3274]
  - fix: align unix-shell-upto3* files (932236 PL2) (Max Leske) [#3128]
  - fix: handle false positives with word "settings" (932236 PL2, 932237 PL3, 932239 PL2) (Esad Cetiner) [#3394]
  - fix: prevent FP on keywords more and time in Unix RCE (932236 PL2) (Franziska Bühler) [#3487]
  - fix: solved false positives with creation of word boundaries for commonly used words used in *nix RCE rules (932236 PL2) (Max Leske) [#3187]
  - fix: use correct anomaly scoring variable (932236 PL2) (Ervin Hegedus) [#3112]
  - fix: improve rule by matching non-word-boundary of commands with options (932237 PL3) (Max Leske) [#3425]
  - feat: new rule to detect *nix commands in user-agent and referer request headers (932239 PL2) (Franziska Bühler, Shivam Bathla) [#3104, #3318]
  - fix: reduce FPs in generic quote evasion detection (932240 PL2) (Max Leske) [#3494]
  - fix: remove ARGS_NAME from target variables in (932240 PL2) (Andrea Menin) [#2960]
  - fix: use correct anomaly scoring variables and paranoia level tags across for rule (932240 PL2) (Ervin Hegedus) [#2963]
  - fix: false positives by requiring specific tokens to follow commands (932250 PL1) (Max Leske) [#3186]
  - fix: Added missing target name to logdata (932260 PL1, 932240 PL2) (Ervin Hegedus) [#3409]
  - fix: remove chained rule (932260 PL1) (Max Leske) [#3521]
  - feat: new rules to detect email protocol attacks (932300 PL2, 932310 PL2, 932320 PL2) (Felipe Zipitría) [#2322]
  - fix: remove additional range expression that cause parsing errors for RE2 (932311 PL3) (Felipe Zipitría) [#2484]
  - feat: new rules to detect detecting *nix shell history invocations (932330 PL1, 932331 PL3) (Karel Knibbe) [#2577]
  - fix: remove 'time' prefix from Windows RCE detection (932370 PL1, 932380 PL1) (Max Leske) [#3528]
  - feat: extend rule to detect additional file extensions via list of executable PHP files (933110) (Jan Gora / terjanq) [#2585]
  - feat: extend data file to add missing PHP config directives (php-config-directives.data, 933120 PL1) (Max Leske) [#3028]
  - feat: extend rule to detect additional sensitive PHP directives (933120 PL1) (Gwendal Le Coguic / gwen001) [#2561]
  - feat: extend rule to detect PHP config directives via automation of keyword list updates (933120 PL1) (Felipe Zipitría) [#2696]
  - feat: extend rule to detect sensitive PHP variables better (933130 PL1) (Felipe Zipitría) [#2668]
  - tests: clean test definitions and provide proper descriptions (933150 PL1, 933160 PL1) (Andrea Menin, Matteo Pace, Max Leske) [#3462]
  - feat: extend data file to include additional php function names (php-function-names-933151.data, 933151 PL2) (Jitendra Patro) [#3212]
  - feat: automate generation of PHP function dictionaries, revisited detection (933160 PL1, 933161 PL3, 933150 PL1, 933151 PL2) (Juan-Pablo Tosso, Christian Folini, Matteo Pace) [#3273]
  - feat: extend rule to detect document.domain XSS (933160 PL1, 941180 PL1) (Franziska Bühler, 0SPwn) [#2567]
  - feat: extend rule to detect evasions in PHP contexts with " (933160 PL1) (Somdev Sangwan / s0md3v) [#2596]
  - feat: rearrange keywords (933160 PL1, 941390 PL1) (Karel Knibbe) [#2905]
  - fix: handle false positive by fixing whitespace matching after PHP command (933160 PL1) (Max Leske) [#3432]
  - fix: solve ReDoS issue in rule (933161 PL3) (Andrea Menin) [#2302]
  - feat: extend rule to detect bzip2 wrapper in PHP injection attacks (933200 PL1) (Andrew Howe) [#2723]
  - feat: extend rule to detect ssh2.\* wrappers in PHP injection attacks (933200 PL1) (Andrew Howe) [#2731]
  - fix: avoid false positive when cookie contains slash (933210 PL1) (Ervin Hegedus) [#1996]
  - fix: close PHP whitespace bypass (933210 PL1) (Walter Hop) [#2033]
  - fix: prevent excessive backtracking (933210 PL1) (Andrea Menin) [#2214]
  - feat: new rule to detect PHP injection attacks without terminating semi-colon (933211 PL3) (Karel Knibbe) [#2581]
  - feat: extended rule to detect Node.js injection attacks using require and child_process (934100 PL1, 932101 PL2) (Andrea Menin) [#2893]
  - feat: extend rule to detect Node.js RCE better (934100 PL1) (rektor0) [#2578]
  - feat: improve transformation pipeline to detect Base64-encoded evasions (934100 PL1) (Andrew Howe) [#3203]
  - feat: new rule to detect Node.js RCE detection (934101 PL2) (rektor0) [#2578]
  - fix: improve js rule transformation pipelines (934101 PL1, 934130 PL1, 934169 PL1, 934131 PL2) (Andrew Howe) [#3312]
  - feat: extend data file to include additional indicators (ssrf.data, 934110 PL1) (Jitendra Patro) [#3213]
  - feat: extend rule to detect SSRF better (934110 PL1) (Felipe Zipitría) [#2660]
  - feat: new rules to detect common IP-based SSRF targets (934110 PL1, 934120 PL2) (Felipe Zipitría) [#2259]
  - feat: extend rule to detect additional schema and IP evasion techniques in SSRF (934120 PL2) (Felipe Zipitría, Max Leske) [#2599]
  - feat: extend rule to detect octal address of AWS metadata endpoints (934120 PL2) (Karel Knibbe) [#2555]
  - feat: extend rule to detect SSRF better by inspecting targets beyond just ARGS (934120 PL2) (Karel Knibbe) [#2555]
  - feat: new rules to detect JavaScript prototype pollution (934130 PL1, 934131 PL2) (Walter Hop) [#2411]
  - fix: remove base64 transformation due to limited effectiveness and to align behavior across ModSecurity v2.x and libModSecurity v3.x engines (934130 PL1) (Andrea Menin) [#3378]
  - fix: remove overly specific rule with limited benefits and lack of cross-engine compatibility (934131 PL2) (Andrea Menin) [#3378]
  - feat: new rules to detect detection of Perl and Ruby RCE signatures in a generic way (934140 PL2, 934150 PL1) (Karel Knibbe) [#2587]
  - feat: new rule to detect Node DoS attack via expressions resolving to true (934160 PL1) (Karel Knibbe) [#2917]
  - feat: new rule for PHP supporting data: scheme without using // before the content-type (934170 PL1) (Felipe Zipitría) [#3018]
  - feat: extend rules to detect path based XSS via new target REQUEST_FILENAME in 941xxx rules (Walter Hop) [#2894]
  - feat: run libinjection XSS detector on request filename in PL2 (941101 PL2) (Andrew Howe) [#2208]
  - feat: move rule from PL1 to PL2 (941120 PL2) (Christian Folini) [#2306]
  - fix: avoid false positive by adding character limit (941120 PL2) (Christian Folini) [#1872]
  - fix: avoid FP in Base64 content (941120 PL1) (Jozef Sudolský) [#2226]
  - fix: remove unnecessary character escape (941120 PL2) (Andrew Howe) [#2805]
  - fix: avoid FP in XMLNLS (941130 PL1) (Walter Hop) [#2192]
  - fix: solve ReDoS issue in rule (941140 PL1) (Andrea Menin) [#2050]
  - feat: detect 'dialog' tag in XSS no-script payloads (941160 PL1) (Jitendra Patro) [#3473]
  - feat: disassemble complex regex fully (941160 PL1) (Felipe Zipitría) [#2701]
  - fix: make regular expression more restrictive (941170 PL1) (Andrea Menin) [#2292]
  - fix: new rule at PL2 to move the detection of '--&gt;' out of PL1 due to false positives (941181 PL2) (Paul Beckett) [#2082]
  - feat: disassemble complex regex (941210 PL1) (Felipe Zipitría) [#3262]
  - feat: extend rule to detect XSS evasions using carriage return (\r) and new line (\n) characters (941210 PL1) (oct0pus7) [#2576]
  - feat: disassemble complex regex (941220 PL1) (Felipe Zipitría) [#3263]
  - fix: correct numerical values used for HTML entity evasion detection (941220 PL1) (Jitendra Patro) [#3479]
  - fix: avoid false positive with Russian characters (941310 PL1) (Max Leske) [#2107]
  - feat: improve detection by adding missing javascript prompt and confirm methods (941390 PL1) (Jitendra Patro) [#3395]
  - feat: new rule to detect JavaScript methods (941390 PL1) (Franziska Bühler) [#2702]
  - feat: extend rule and moved rule from PL3 to PL2 (942101 PL2) (Matteo Pace) [#2922]
  - feat: extended rule to detect common SQL injection probing in path segments (942110 PL2) (Andrea Menin) [#2914]
  - feat: prevent FPs by removing rule (942110 PL2) (Max Leske) [#3505]
  - feat: add target REQUEST_FILENAME to rule to detect path-based SQLi attacks (942120 PL2) (Andrew Howe) [#3057]
  - feat: extend rule to detect use of collate in SQLite injection attacks (942120 PL2) (Jan Gora / terjanq) [#2584]
  - fix: extend rule to detect more SQLi (942120 PL2) (Karel Knibbe) [#2556]
  - fix: resolve issue with regular expression and improve SQLi detection by detecting 'not between' (942120 PL2) (NiceYouKnow, Max Leske, Franziska Bühler) [#2115]
  - fix: update SQL reserved words (942120 PL2) (Felipe Zipitría) [#2798]
  - feat: extend rule to detect glob in list of SQLi tautologies (942130 PL2) (Franziska Bühler) [#2729]
  - fix: remove unneeded TX variables (942130 PL2, 942131 PL2, 942521 PL3) (Andrea Menin) [#3293]
  - feat: detect more error-based SQL injections (942150 PL2, 951230 PL1) (Jozef Sudolský) [#2429]
  - feat: extend rule to detect more SQL function names (942150 PL2) (Karel Knibbe) [#2895]
  - feat: extend rules to detect more SQL error messages and functions (942151 PL1, 942152 PL1, 951220 PL1, 951230 PL1, 951240 PL1) (Jitendra Patros) [#3336]
  - feat: extend rule to detect additional SQL function signatures (942151 PL1) (Karel Knibbe) [#2570]
  - feat: extend rule to detect endswith, startswith, unistr, pg_client_encoding and various JSON SQL functions (942151 PL1) (Franziska Bühler) [#2874]
  - feat: extend rule to detect various JSON functions (942151 PL1) (Franziska Bühler) [#3041]
  - fix: avoid FP in SQL function names by splitting between PL1/PL2 (942151 PL1, 942150 PL2) (Jozef Sudolský) [#2480]
  - feat: extend rule to detect sql_compileoption_get in SQLite injection attacks (942152 PL1) (Andrew Howe) [#2718]
  - fix: extend blind SQLi detection (942160 PL1) (Franziska Bühler, Christian Folini) [#1956]
  - feat: new regex-assembly file for rule (942170 PL1) (Andrea Menin) [#2939]
  - feat: extend rule to detect SQL injection authentication bypasses (942180 PL2) (rekter0) [#2575]
  - feat: improve SQLi detection with spaces (942190 PL1, 942390 PL2) (Manuel Spartan, Max Leske) [#2436]
  - fix: avoid FP in SQLi by adding word boundary checks (942190 PL1) (Jozef Sudolský) [#2078]
  - fix: avoid FP in SQLi with keyword 'union' (942190 PL1) (Franziska Bühler) [#2058]
  - fix: prevent comment-based SQL evasion (942190 PL1) (Andrea Menin) [#1910]
  - fix: resolve bug in regular expression and add test case (942190 PL1) (NiceYouKnow, Max Leske, Franziska Bühler) [#2112]
  - feat: disassemble complex regex (942200 PL2) (Franziska Bühler, Max Leske) [#2932]
  - feat: extend rule to detect SQLi in user-agent and referer request headers (942200 PL2, 942370 PL2) (Franziska Bühler, Shivam Bathla) [#3106]
  - feat: improve regex-assembly file for rule (942210 PL2) (Andrew Howe) [#2945]
  - fix: detect the correct magic numbers that crash old PHP versions (942220 PL1) (Kyzentun, Walter Hop) [#2010]
  - fix: avoid false positive with 'case' (942230 PL1) (Franziska Bühler) [#2035]
  - fix: detect SQL false negative (942230 PL1) (Max Leske) [#2348]
  - feat: disassemble complex regex (942240 PL1) (Franziska Bühler, Max Leske) [#2938]
  - fix: avoid FP in 'having' SQLi (942251 PL3) (Felipe Zipitría) [#2248]
  - feat: new regex-assembly file for rule (942280 PL1) (Andrea Menin) [#2933]
  - feat: extend rule to detect additional MongoDB operators via NoSQL commands list (942290 PL1) (rekter0) [#2579]
  - feat: new regex-assembly file for rule (942290 PL1) (Andrea Menin) [#2942]
  - feat: improve regex-assembly format (942300 PL2) (Felipe Zipitría) [#3296]
  - fix: avoid false positive by adding word boundary checks (942300 PL2) (Franziska Bühler) [#2099]
  - fix: remove unnecessary part of regular expression (942310 PL2) (NiceYouKnow) [#2189]
  - feat: extend rule to detect ::int and ::bool SQL data conversions (942320 PL1) (Franziska Bühler) [#2872]
  - feat: extend rule to detect lo_get and ::text via PostgreSQL functions list (942320 PL2) (Franziska Bühler, Walter Hop, Shivam Bathla) [#2925]
  - feat: extend rule to detect lo_import and div via PostgreSQL functions list (942320 PL2) (Franziska Bühler, Shivam Bathla) [#2916]
  - feat: extend rule to detect more PostgreSQL data types (942320 PL2) (Franziska Bühler, Shivam Bathla) [#3019]
  - fix: add word boundaries to keywords to solve false positives (942330 PL2) (Franziska Bühler) [#3207]
  - feat: extend rule to detect SQL injection better (942340 PL2) (Karel Knibbe) [#2557]
  - fix: extend rule to detect more SQLi (942340 PL2) (Jan Gora / terjanq) [#2559]
  - feat: detect SQLi using the 'drop' keyword (942350 PL1, 942360 PL1, 942200 PL2, 942362 PL2) (Jozef Sudolský) [#2218]
  - fix: solve ReDoS issue in rule (942350 PL1) (Andrea Menin) [#2300]
  - feat: new regex-assembly file for rule (942370 PL2) (Christoph Hansen, Max Leske) [#2954]
  - feat: detect SQLi with 'if exists' (942380 PL2) (NiceYouKnow) [#2121]
  - feat: optimize regex (942400 PL2) (Jozef Sudolský) [#2323]
  - feat: disassemble complex chained regex (942440 PL2) (Felipe Zipitría) [#3295]
  - feat: optimize regex (942440 PL2) (Felipe Zipitría) [#2459]
  - fix: adapt rule to work in all ModSecurity versions (942440 PL2) (Andrew Howe) [#2201]
  - fix: avoid FP in JWT tokens (942440 PL2) (Andrea Menin) [#2460]
  - fix: reformat rules to follow project guidelines (942440 PL2, 949959, 949159, 959059, 959159) (Ervin Hegedus) [#3206]
  - fix: solve errors in regex pattern (942440 PL2) (Andrea Menin) [#3290]
  - fix: prevent FPs for click identifiers in query string by placing arg specific rule exclusions in rule set (942441, 942442) (Max Leske) [#3500]
  - feat: extend rules to detect current_user and overlay (942470 PL1, 942480 PL2) (Franziska Bühler) [#2875]
  - feat: extended rule to detect detect SQL injection attacks using headers (942480 PL2) (Paul Beckett) [#2911]
  - feat: extend rule to detect newlines in overlay (942480 PL2) (Franziska Bühler, Shivam Bathla) [#3040]
  - fix: detect MySQL optimizer hints (942500 PL1) (Max Leske) [#3431]
  - feat: new rules to detect SQL authentication bypasses (942520 PL2, 942521 PL2, 942522 PL2) (Jan Gora / terjanq) [#2603]
  - feat: extend rule to detect SQLi in user-agent and referer request headers (942521 PL2) (Franziska Bühler, Shivam Bathla) [#3107]
  - fix: replace 'MATCHED_VAR' in 'logdata' argument with stable variable (942521 PL2, 943110 PL1, 943120 PL1) (Ervin Hegedus) [#3543]
  - feat: new rule to detect '; in SQLi (942530 PL3) (Franziska Bühler) [#2808]
  - feat: new rule to detect authentication bypass via SQL injection that abuses semi-colons to end the SQL query (942540 PL1) (Karel Knibbe) [#2904]
  - fix: update scoring variable (942540 PL2) (Walter Hop) [#2970]
  - feat: new rule to detect MySQL scientific notation attacks (942560 PL1) (Jitendra Patro) [#3316]
  - fix: remove unnessecary 'lowercase' transformation from chain rule (944120 PL1) (Federico G. Schwindt) [#1852]
  - feat: extend rule to detect JAVA exploits better via java-classes.data file (944130 PL1) (Dennis Brown) [#3048]
  - feat: new rule to deny uploading .jsp and .jspx files (944140 PL1) (Walter Hop) [#2456]
  - feat: new rule to detect Spring4Shell (944260 PL2) (Christian Folini, Andrea Menin) [#2464]
  - fix: update administrative rule ids for consistent operation (950011, 950012, 950018) (Ervin Hegedus) [#3339]
  - feat: improve rule file 951xxx via the use of skipAfter instead of variable TX:sql_error_match (Jozef Sudolský) [#2754]
  - feat: extend data file to include additional SQL error messages (sql-errors.data, 951100 PL1) (Jitendra Patro) [#3214]
  - fix: avoid FP in MySQL data leakage rule (951230 PL1) (Jozef Sudolský) [#2490]
  - fix: avoid FP in PostgreSQL error messages (951240 PL1) (Jozef Sudolský, Franziska Bühler) [#1870, #2313]
  - fix: handle false positive in SQL error leakage detection (951240 PL1) (Jozef Sudolský) [#3169]
  - fix: avoid FP in Sybase error message (951260 PL1) (Jozef Sudolský) [#2307]
  - feat: extend rule to detect PHP errors better via new automation (953100 PL1) (Felipe Zipitría) [#2663]
  - feat: new rules to detect PHP error leakages with high false positive rates at paranoia level 2 instead of 1 (953100 PL1, 953101 PL2) (Andrea Menin) [#3119]
  - fix: solve false positive by shifting "Field cannot be empty" to PL2 (953100 PL1, 953101 PL2) (Esad Cetiner) [#3407]
  - fix: ignore case of PHP tag in response text (953210 PL1) (Felipe Zipitría) [#2664]
  - feat: extend rule to detect IIS errors via automation of pattern updates (954120 PL1) (Felipe Zipitría) [#2810]
  - fix: log response body to audit log only when full rule chain matches (954130 PL1) (Franziska Bühler) [#2202]
  - feat: added new webshells and tests (955100 PL1) (Jozef Sudolský) [#3405]
  - feat: extend data file to include additional web shells (web-shells-php.data, 955100 PL1) (Jitendra Patro) [#3215]
  - feat: extend data file to include additional web shells (web-shells-php.data, 955100 PL1) (Jozef Sudolský) [#2687]
  - fix: make regular expression more strict to reduce noise in logs (955120 PL1) (Jozef Sudolský) [#2315]
  - fix: use correct variable in chained condition for correlation rules (980120 PL0, 980150 PL0) (Simon Studer) [#1898]
  * Functionality that has been moved to plugins for this release
  - feat: add Google OAuth 2 exclusion plugin (Jozef Sudolský) [#2388]
  - feat: add phpBB exclusion rules (now a plugin) (Jozef Sudolský) [#1893]
  - feat: add phpMyAdmin exclusion rules (now a plugin) (Jozef Sudolský) [#1951]
  - feat: move IP reputation rules to plugins (Simon Studer) [#2482]
  - feat: move exclusion profiles and DOS rules to plugins (Andrew Howe) [#2469]
  - feat: ownCloud: Fix rule 9003001 to match both DAV and WebDAV (now a plugin) (Abu Dawud) [#2130]
  - fix: nextcloud: fix FPs (now a plugin) (kam821, Jozef Sudolský, ntimo, Felipe Zipitría, pyllyukko) [#1840, #1843, #1847, #1946]
  - fix: phpBB: Fix FPs (now a plugin) (Jozef Sudolský) [#2057, #2180, #2299, #2343]
  - fix: phpMyAdmin: Fix FPs (now a plugin) (Jozef Sudolský) [#2172, #2249, #2321, #2351]
  - fix: replace ARGS by ARGS_GET in rules in phase:1 (various rule exclusion rules) (Ervin Hegedus) [#2063]
  - fix: wordPress: fix FPs (now a plugin) (Jozef Sudolský) [#1899, #1971, #2320]
  - fix: wordPress: fix FPs and improve performance (now a plugin) (Walter Hop) [#1997, #2311]
  - fix: wordPress: fix FPs in Site Health page (now a plugin) (Robert de Boer, Fregf, Walter Hop) [#1895, #1920]
  - fix: xenForo: fix FPs (now a plugin) (Walter Hop, ThanhPT) [#1844, #1865, #1894, #1998, #2421]
- Version 3.3.6
  * Important changes:
  - fix: prevent using backslash in file names (v3) by @fzipi in #3800
  - feat: add new rule to catch invalid character in multipart headers (v3) by @airween (ported by @fzipi) in #3797</changelog>
  <changelog author="pgajdos@suse.com" date="1737633600">- package cleanup, coordinated with apache2-mod_security2
  cleanup
- version update to 4.10.0
  * New features and detections
  - feat: block CVE-2023-5003 by @azurit in https://github.com/coreruleset/coreruleset/pull/3955
  - feat: prevent accessing PHP variables by @azurit in https://github.com/coreruleset/coreruleset/pull/3965
  * Other Changes
  - fix: FP against `pattern` with `=` following at arbitrary position by @theseion in
    https://github.com/coreruleset/coreruleset/pull/3963</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1766404800">- version update to 4.41.0
  * feat(931100): add IPv6 support / XML scan and SSH scheme. by @touchweb-vincent in #4321
  * feat(920440): add new restricted file extensions by @touchweb-vincent in #4322
  * fix(942160): adding unit test for double comment by @touchweb-vincent in #4315
  * fix(920280, 920300, 920310, 920311, 920320, 920330): should be block by @touchweb-vincent in #4319
  * fix(942151,942152): wrong functions names by @touchweb-vincent in #4333
  * feat(942460): adding help for non-English folks by @touchweb-vincent in #4334
  * fix(932180): reduce substring false positives by @EsadCetiner in #4338
  * fix(942151,942152): wrong functions names by @touchweb-vincent in #4337
  * fix(920180): wrong unit test - content-type evasion bypass by @touchweb-vincent in #4339
  * fix(956110): move rule to pl-2 by @EsadCetiner in #4344
  * docs: comment on disabling Expect header in .Net by @theseion in #4348
  * fix: add missing capture action to affected rules by @airween in #4361
- for changelog for older releases see:
  https://github.com/coreruleset/coreruleset/blob/v4.21.0/CHANGES.md</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1773057600">- version update to 4.24.1
  * New features and detections
    + feat(930140): add AI coding assistant artifact protection by
    @etiennemunnich in #4519
    + feat: Expand Scanner Agents by @HackingRepo in #4532
  * Fixes
    + fix(942200): prevent matches against user agent strings by
    @theseion in #4537
    + fix(942480): don't inspect cookies twice by @touchweb-vincent
    in #4524
  * Other Changes
  + refactor: create 934130 .ra file by @Xhoenix in #4487
  + refactor: create 941330 .ra file by @fzipi in #4492
  + refactor: create 944300 .ra file by @fzipi in #4490
  + refactor: create 941320 .ra file by @fzipi in #4491
  + refactor: create 921160 .ra file by @fzipi in #4497
  + refactor: create 921120 .ra file by @fzipi in #4496
  + refactor: create 921110 .ra file by @fzipi in #4495
  + feat: move 930110 to regex-assembly by @fzipi in #4494
  + refactor: create 941190 .ra file by @fzipi in #4499
  + refactor: create 941400 .ra file by @fzipi in #4517
  + refactor: create 942250 .ra file by @fzipi in #4512
  + refactor: create 941370 .ra file by @fzipi in #4518
  + refactor: create 944260 .ra file by @fzipi in #4510
  + feat: move 943100 to regex-assembly by @fzipi in #4504
  + refactor: create 944120 .ra file by @fzipi in #4508
  + refactor: create 942450 .ra file by @fzipi in #4513
  + refactor: create 942510 and 942511 .ra files with shared
    include by @fzipi in #4516
  + refactor: create 944240 .ra file by @fzipi in #4509
  + docs: comment on threshold should be more alarming by
    @touchweb-vincent in #4330
  + chore: add missing regex-assembly comment blocks to rules by
    @fzipi in #4523
  + fix(913100): adding OWASP Nettacker to known scanners list
    by @securestep9 in #4529
  + refactor: create 941300 .ra file by @fzipi in #4521
- for changelog for older releases see:
  https://github.com/coreruleset/coreruleset/blob/v4.24.1/CHANGES.md</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1780315200">- version update to 4.27.0
  * fix(920240, 920400): don't rely on content-type header
- version update to 4.26.0
  * feat: Add WhatWAF to the scanner list
  * feat: Add ghauri to scanner list
  * feat: Expand Scanner User Agents List (v2)
  * feat: Expanded os files list
  * feat(933100): all HTTP headers should be checked
  * fix(lfi-os-files): add .dockerenv, .DS_Store, META-INF/, WEB-INF/
  * feat(934200): detect Server-Side Template Injection (SSTI) attacks
  * fix(lfi-os-files): require path prefix for .profile
  * fix(933150): remove is_int from PHP function names list
  * fix(932370): remove url from Windows LOLBIN command list
  * fix(920539): prefer a bypass on a named rule rather than n+1 bypass
  * fix(942290): add word boundary to MongoDB operator detection
  * fix: false positive with parameter name `.history`
  * fix(942410): use common exceptions instead of rule
  * fix(942200): reduce false positives on payloads with comments
  * fix(unix): exclude `pg` command from pl-1
  * fix(930130): comment out false positive prone entries
  * fix(920100): drop HTTP/0.9 GET support from request line validation
  * fix: Update restricted files to include Perl subdirectories
- version update to 4.25.0
  * feat(930130,930140): expand AI-based paths
  * feat: add aws security agent in scanners-user-agents.data
  * feat(932390): add shell fork bomb detection rule at PL2
  * refactor: create 941250 `.ra` file
  * refactor: create 942220 .ra file
  * refactor: create rule 931100 and 931110 `.ra` files
  * feat: Adding critical ai dirs that previously not exist
  * refactor: create 933140 and 933180 `.ra` files
  * fix(944110,944120,944130,944150,944151,944200,944210,..): don't inspect cookies twice
  * refactor: create 943120 `.ra` file
  * fix: false negative 932236
  * fix(933111): prevent whitespace padding bypass in PHP double-extension upload
  * fix(933110): prevent whitespace padding bypass in PHP upload detection
  * fix(944140): prevent whitespace padding bypass in JSP file upload detection
  * feat: update list of unix commands
  * fix(932180): prevent whitespace padding bypass in restricted file upload detection
  * fix: harden GitHub Actions workflows
  * refactor: create 941310 `.ra` files
  * docs: update README
  * refactor: create 941120 `.ra` file
  * fix(920540): allow rule exclusions for specific targets
  * fix(931130): ensure correct target is logged</changelog>
</package>
<package pkgid="d8c10edd27fa294d5e49a70dc50939f4f9b92e5f1690639fb13fa86ccfc20fea13fe8d479ee38e98a4680e1055219557a00e2ca286546f537a2309cca987db91" name="owasp-modsecurity-crs-apache2" arch="noarch">
  <version epoch="0" ver="4.27.0" rel="32.3"/>
  <changelog author="bwiedemann@suse.com" date="1500897600">- sort conf file entries to fix build-compare (boo#1041090)</changelog>
  <changelog author="pgajdos@suse.com" date="1606824000">- use system apache rpm macros</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1684497600">- Version 3.3.4.
  * Important Notice: From CRS 3.2.2, 3.3.3 and up, ModSecurity 2.9.6 or 3.0.8 (or versions with backported patches) are required due to the addition of new protections. We recommend upgrading your ModSecurity as soon as possible. If your ModSecurity is too old, your webserver will refuse to start with an Unknown variable: &amp;MULTIPART_PART_HEADERS error. If you are in trouble, you can temporarily delete file rules/REQUEST-922-MULTIPART-ATTACK.conf as a workaround and get your server up, however, you will be missing some protections. Therefore we recommend to upgrade ModSecurity before deploying this release.</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1692187200">- Version 3.3.5.
  * This is the OWASP ModSecurity Core Rule Set version 3.3.5.
  * Important changes:
  - Backport fix for CVE-2023-38199 from CRS v4 via new rule 920620 (Andrea Menin, Felipe Zipitría)
  * Fixes:
  - Fix paranoia level-related scoring issue in rule 921422 (Walter Hop)
  - Move auditLogParts actions to the end of chained rules where used (Ervin Hegedus)
  * Chore:
  - Clean up redundant paranoia level tags (Ervin Hegedus)
  - Clean up YAML test files to support go-ftw testing framework (Felipe Zipitría)
  - Move testing framework from ftw to go-ftw (Felipe Zipitría)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1693569600">- use upstream archive for building the package, the base folder name in the
  archive changed</changelog>
  <changelog author="Flavio Castelli &lt;fcastelli@suse.com&gt;" date="1733227200">- Version 4.9.0
  * Important changes
  - feat: add variable to skip response rules by @fzipi in #3944
  * New features and detections
  - feat: add fish shell files to restricted-files.data by @OhMyVolk in #3915
  - feat: add quantitative testing to Git workflow by @airween in #3924
  * Other Changes
  - feat: added support for new web shells by @azurit in #3898
  - fix(security): remove double URL decode (921151 PL2, 932190 PL3, 942441 PL2, 942442 PL2, 942460 PL3) by @azurit in #3741
  - docs: extended rule documentation (900200) by @dune73 in #3934
- Version 4.8.0
  * Important changes:
  - fix: 9EA-241022 v4 by @RedXanadu in #3905
  * New features and detections
  - chore: set up nginx tests by @theseion in #3856
  * Other Changes
  - fix: remove unnecessary capture groups by @TimDiam0nd in #3849
  - fix(942120): update operators by @Xhoenix in #3841
  - fix(933120): do not match on base64 encoded strings by @fzipi in #3863
  - fix(refactor): 942130 and 942131 regex-assembly by @Xhoenix in #3862
  - fix(942520): SQL operators can be one or more characters by @Xhoenix in #3845
  - chore: remove verify id-range by @fzipi in #3885
  - chore: remove find-max-datalen-in-tests by @fzipi in #3891
  - chore: remove honeypot sensor by @fzipi in #3883
  - chore: remove browser tools by @fzipi in #3887
  - chore: remove send-payload-pls by @fzipi in #3879
  - chore: remove geo-location by @fzipi in #3875
  - chore: remove crs2 renumbering by @fzipi in #3873
  - chore: remove change-version script by @fzipi in #3869
  - chore: remove join multiline rules by @fzipi in #3877
  - chore: remove av-scanning by @fzipi in #3871
  - chore: remove util virtual patching by @fzipi in #3889
  - fix: include v3.3.6 release notes in latest by @fzipi in #3867
  - chore: remove fp-finder by @fzipi in #3893
- Version 4.7.0
  * New features and detections
  - feat: added sendgrid.env into restricted files by @azurit in #3823
  * Other Changes
  - fix: Changed regex (920470) to match multiple whitespaces after Content-Type parameters to avoid false-positives by @lostmann-owl-it in #3818
  - fix: fp with user-agent containing ; pg (932239 PL2) by @franbuehler in #3727
  - fix: update xss detection with onwebkitplaybacktargetavailabilitychanged event by @fzipi in #3822
  - feat: refactoring (944110 PL1) by @azurit in #3715
- Version 4.6.0
  * Important changes:
  - fix: prevent using backslash in file names by @fzipi in #3799
  - feat: add new rule to catch invalid character in multipart headers by @airween, @theseion, @fzipi in #3796
  * Other Changes
  - feat: rule to detect bash tilde expansion by @Xhoenix in #3765
  - fix: Update 932270's ver by @airween in #3786
  - perf: remove unnecessary chain rule and capture (921180 PL3) by @EsadCetiner in #3787
  - fix: add pem to restricted file extensions by @EsadCetiner in #3789
  - fix(942160): check REQUEST_FILENAME by @mat1010 in #3782
- Version 4.5.0
  * New features and detections
  - feat: added arithmetic expansion payload by @Xhoenix in #3756
  * Other Changes
  - fix(security): alias false negative by @Xhoenix in #3740
  - feat: add test overrides for nginx by @theseion in #3369
  - fix: use proper capture for log output of 932300 by @theseion in #3763
  - chore: use lowercase character class for 932320 by @theseion in #3772
  - fix: remove nonnecessary variable (932260 PL1) by @dune73 in #3773
- Version 4.4.0
  * New features and detections
  - feat: skip response rules if data are compressed by @azurit in #3742, #3712
  * Other Changes
  - fix(934140): update regex by @fzipi in #3731
  - fix: replacing t:UrlDecode with t:UrlDecodeUni (921240 PL1, 932170 PL1, 932171 PL1, 932190 PL3, 932190 PL1, 933211 PL3, 941310 PL1, 941350 PL1) by @azurit in #3713
- Version 4.3.0
  * New features and detections
  - feat: catch Java PostgreSQL errors (951240 PL1) by @azurit in #3686
  - feat: block The Mysterious Mozlila User Agent bot (913100 PL1) by @brentclark in #3646
  * Other Changes
  - fix: Oracle SQL database data leakage FP (951120 PL1) by @azurit in #3685
  - fix: typos in 920330 and 942280 tests by @TimDiam0nd in #3688
  - test: change pl-1 to pl1 to be inline with others by @TimDiam0nd in #3690
  - feat: use renovate to update docker-compose by @theseion in #3697
  - fix: FP for sched (932235 PL1, 932236 PL2, 932237 PL3, 932239 PL2, … by @theseion in #3701
  - fix: collections not being initialized without User-Agent header by @azurit in #3645
  - feat: refactoring of rule 941310 (PL1 941310) by @azurit in #3700
  - fix: resolving more FPs with Oracle error messages (951120 PL1) by @azurit in #3703
  - fix: removing double t:urlDecodeUni (920221 PL1, 920440 PL1, 932200 PL2, 932205 PL2, 932206 PL2) by @azurit in #3699
  - fix: false positives from PHP config directives and functions (933120 PL1, 933151 PL2) by @ssigwart in #3638
  - feat: prevent detection of web shells rules as malware by Windows Defender (955260 PL1) by @azurit in #3687
  - fix: fp with name axel by removing it from rce rule (932260 PL1) by @franbuehler in #3705
- Version 4.2.0
  * Changes with direct rule impact (sorted by lowest rule ID per change where available):
  - fix: increase length of Accept-Encoding header from 50 to 100 (920520 PL1) (Franziska Bühler) [#3661]
  - fix: add missing roundcube files (930120 PL1, 930121 PL2, 930130 PL1, 932180 PL1) (Esad Cetiner) [#3635]
  - fix: add visudo and cscli to unix-shell.data (932160 PL1, 932161 PL2) (Esad Cetiner) [#3663]
  - feat: block crowdsec cscli and visudo commands (932235 PL1, 932236 PL2, 932237 PL3, 932239 PL2, 932260 PL1) (Esad Cetiner) [#3649]
  - fix: add detection for php evasion attempt (933100 PL1) (Franziska Bühler) [#3667]
  * Changes without direct rule impact:
  - feat: disassemble php rule (933100 PL1) (Franziska Bühler) [#3662]
  - chore: remove references to nonexistant 942110 rule (Esad Cetiner) [#3648]
- Version 4.1.0.
  - feat: add check for combinations of t:lowercase and (?i) to lint (Franziska Bühler) [#3584]
  - feat: add support for additional ansible and chef commands (932160 PL1, 932161 PL2, 932235 PL1, 932260 PL1, 932236 PL2, 932239 PL2, 932237 PL3) (Esad Cetiner) [#3601]
  - feat: move HTTP header rules to phase 1 (932161 PL2, 932205 PL2, 932206 PL2, 932237 PL3) (Esad Cetiner) [#3570]
  - fix: prevent FPs against names due to "cron" (932260 PL1, 932236 PL2, 932237 PL3, 932239 PL2) (@superlgn) [#3578]
  - fix: add missing tags and ver action (various rules) (Jozef Sudolský) [#3571]
  - fix: adding more missing tags and ver actions (Jozef Sudolský) [#3593]
  - fix: do not check URL fragments in referer headers as part of the existing rule to prevent FPs (932205 PL2) (Max Leske) [#3485]
  - fix: range expressions must not start with \v (various rules) (Max Leske) [#3615]
  - fix: remove t:lowercase from rules that use '(?i)' modifier in their regex (942150 PL2, 942151 PL1, 942152 PL2) (Ervin Hegedus) [#3585]
  - test: change HTTP method to uppercase for test 932260-28 (Matteo Pace) [#3580]
  - chore(deps): update workflow actions (Max Leske) [#3613]
  - chore: add Esad Cetiner to list of developers (@EsadCetiner) [#3589]
- Version 4.0.0.
  * Important changes:
  - feat: introduce plugin architecture for extending CRS and minimizing attack surface. (Christian Folini, Max Leske, Jozef Sudolský, Andrew Howe) [#2038, #2448, #2404]
  - feat: migrate application exclusions and less-used functionality to plugins (Christian Folini, Max Leske, Jozef Sudolský, Andrew Howe)
  - feat: introduce early blocking option (Christian Folini) [#1955]
  - feat: introduce new rule file/category to detect use of common web shells in responses (955100-955340 PL1, 955350 PL2) (Jozef Sudolský, Andrea Menin) [#1962, #2039, #2116]
  - feat: rename 'Node.js' category to 'generic' (Felipe Zipitría) [#2340]
  - feat: make all formerly PCRE-only regular expressions compatible with RE2/Hyperscan regular expression engines (Max Leske, Felipe Zipitría, Allan Boll, Franziska Bühler) [#1868, #2356, #2425, #2426, #2371, #2372]
  - feat: add support for HTTP/3 (Jozef Sudolský) [#3218]
  - feat: add granular control over reporting levels in 9801xx rules (Simon Studer, Andrew Howe, Christian Folini) [#2482, #2488]
  - feat: add new rule to explicitly detect multiple Content-Type abuse (CVE-2023-38199) (920620 PL1) (Andrea Menin) [#3237]
  - feat: add enable_default_collections flag to not initialize collections by default (Matteo Pace) [#3141]
  - feat: extend definition of restricted headers to include Content-Encoding and Accept-Charset by default (920450 PL1, 920451 PL2) (Walter Hop) [#2780, #2782]
  - feat: drop HTTP/0.9 support to resolve FP (Federico G. Schwindt) [#1966]
  - fix: refactor and rename anomaly scoring variables and paranoia level definition (Simon Studer) [#2417]
  - tests: complete goal of 100% test coverage for rules (entire team, Juan-Pablo Tosso, NiceYouKnow)
  - feat: switch to using WordNet instead of spell for finding English words in spell.sh (Max Leske) [#3242]
  - feat: publish nightly packages regularly (Felipe Zipitría) [#2207]
  * Changes with direct rule impact (sorted by lowest rule ID per change where available):
  - feat: add placeholder files for new plugin architecture (Walter Hop) [#2515]
  - feat: check initialization and use for all TX variables (Ervin Hegedus) [#3043]
  - feat: extend rule to detect restricted method override headers (Mark Zeman / KramNamez) [#3056]
  - feat: extend rules to detect keyword time as prefix of *nix and Windows RCE rules (rules later replaced) (Franziska Bühler) [#2819]
  - feat: improve Unix shell evasion prefix (various rules) (Jitendra Patro, Max Leske) [#3518]
  - feat: improve performance by removing unnecessary lowercase transformations (various rules) (Jozef Sudolský) [#2106]
  - feat: add additional prefix commands to 'unix-shell-evasion-prefix' (various rules) (Jitendra Patro) [#3557
  - feat: consolidate 'unix-evasion-prefix*' files to ensure they don't diverge (various rules) (Franziska Bühler, Max Leske, Andrew Howe) [#3531]
  - feat: move regexp-assemble data files to root directory (Felipe Zipitría) [#3002]
  - feat: move rules to the earliest phase possible based on their inputs (various rules) (Ervin Hegedus) [#1941]
  - feat: remove superfluous 'urlDecodeUni' transformations (various rules) (Federico G. Schwindt) [#1845]
  - feat: rename 'tx.blocking_early' to 'tx.early_blocking' (various rules) (Christian Folini) [#2414]
  - feat: simplify regular expressions by replacing upper-case with lower-case matches if the expression is case-insensitive (various rules) (Felipe Zipitría) [#2485]
  - feat: remove SecCollectionTimeout from crs-setup.conf (Christian Folini) [#3559]
  - fix: do not log 'MATCHED_VAR' when the it contains the full response body (various rules) (Jozef Sudolský) [#1985]
  - fix: do not unnecessarily escape forward slashes in regular expressions (various rules) (Federico G. Schwindt) [#1842]
  - fix: reformat several initialization rules to follow project guidelines (Ervin Hegedus) [#3157]
  - fix: remove auditLogParts actions from all rules where present (Andrea Menin, Ervin Hegedus) [#3034, #3081]
  - fix: remove uncommon Content Types from default in crs-setup.conf.example (Andrea Menin) [#2768]
  - fix: update diverse rules to follow new naming convention with paranoia level TX variables (Christoph Hansen) [#2937]
  - fix: update various rules to consolidate use of backslashes to \x5c representation for better compatibility with known WAF engines (various rules) (Andrew Howe, Max Leske) [#2335, #2345, #2375, #2376, #2399, #2400, #2402, #2410, #2420, #2441, #2442, #2454, #2426]
  - fix: remove initialization rules for redundant IP reputation variables (901150, 901152) (Andrew Howe) [#2833]
  - fix: initialize all variables used properly (901169) (Ervin Hegedus) [#2802]
  - feat: improve sampling mode efficiency (901410, 901420, 901440) (Paul Beckett) [#2094]
  - fix: replace uses of 'ctl:ruleEngine=Off' with "ctl:ruleRemoveByTag=OWASP_CRS" to accomodate more than one ruleset (901450, 905100, 905110) (Jozef Sudolský) [#2156]
  - feat: remove old, commented-out IP reputation check rule (910110 PL1) (Paul Beckett) [#2148]
  - feat: detect 'burpcollaborator' scanner (913100 PL1) (Amir Hosein Aliakbarian) [#2152]
  - feat: detect 'httpx' scanner (913100 PL1) (Will Woodson) [#2045]
  - feat: detect 'LeakIX' scanner (913100 PL1) (Jozef Sudolský) [#1961]
  - feat: detect 'QQGameHall' malware (913100 PL1) (Walter Hop) [#2144]
  - feat: detect User-Agent of Tsunami Security Scanner (913100 PL1) (@hoexter) [#3480]
  - fix: avoid FP for YAM package manager (913100 PL1) (Jozef Sudolský) [#2022]
  - fix: move 'ecairn' from scanners to crawlers (913100 PL1) (Felipe Zipitría) [#2408]
  - feat: detect 'CensysInspect' and seoscanners.net crawlers (913102 PL2) (Andrew Howe) [#2155]
  - feat: detect 'ecairn' crawler (913102 PL2) (Jozef Sudolský) [#2024]
  - feat: detect 'Krzana' bot (913102 PL2) (Deepshikha Sinha) [#2432]
  - fix: remove rule to detect security scanner http headers (913110 PL1) (Christian Folini) [#3241]
  - feat: remove ineffective anti-scanner list scanners-urls.data and associated rule (913120 PL1) (Christian Folini) [#3235]
  - fix: correct the regular expression assembly (920120 PL1) (Max Leske) [#2333]
  - feat: increase rule score from warning to critial (920220 PL1) (Max Leske) [#3512]
  - fix: reduce FPs by handling the last path segment separately in new rule (920220 PL1, 920221 PL1) (Max Leske) [#3512]
  - fix: reduce FPs by matching on decoded variables (920220 PL1) (Max Leske) [#3512]
  - feat: prevent FPs by moving rule to higher PL (920240 PL2) (Max Leske) [#3506]
  - feat: valiadate 'SEC-CH-UA' and 'SEC-CH-UA-MOBILE' request headers (920274 PL4) (Chaim Sanders) [#1970]
  - fix: use the right kind of validation for 'Sec-CH-UA' and 'Sec-CH-UA-Mobile' request headers (920274 PL4, 920275 PL4) (somechris) [#2028]
  - fix: make validatioin of 'Sec-Fetch-User' header more strict (920275 PL4) (somechris) [#2020]
  - feat: move rule from PL2 to PL3 (920300 PL3) (Franziska Bühler) [#2013]
  - fix: amend rule to exclude CONNECT requests from requiring an Accept header (920300 PL3) (Andrew Howe) [#2297]
  - feat: add IPv6 to the 'Host header is a numeric IP address' check (920350 PL1) (itsTheFae, Ervin Hegedus, Jozef Sudolský) [#1929]
  - fix: avoid FP on '.axd' in restricted extensions, these are public (920440 PL1) (Jozef Sudolský) [#1925]
  - feat: rework restricted headers mechanism into two separate lists (920450 PL1, 920451 PL2) (Andrew Howe) [#3152]
  - fix: avoid FP in 'application/*+json' Content-Type (920470 PL1) (Mirko Dziadzka, Walter Hop) [#2455]
  - fix: avoid FP in CalDAV Content-Type (920470 PL1) (Vandan Rohatgi) [#2505]
  - fix: avoid FP in 'Content-Type' header with '#' character (920470 PL1) (Jozef Sudolský) [#1856]
  - fix: avoid FP on 'version' string in Content-Type header (920470 PL1) (Jozef Sudolský) [#1901]
  - fix: resolve false negative when matching against allowed charsets variable (920480 PL1) (katef, Federico G. Schwindt) [#1957]
  - fix: replace unnecessary capture groups in regular expressions with non-capturing groups (920510 PL3, 932200 PL2, 942510 PL2, 942511 PL3) (Federico G. Schwindt) [#1983]
  - feat: improve explanatory rule comments (920520 PL1) (Max Leske) [#2391]
  - feat: validate 'Accept-Encoding' header (920520 PL1, 920521 PL3) (Franziska Bühler) [#2357]
  - feat: new rule detect multiple occurrences of charset keyword in content type header (920530 PL1) (Jan Gora / terjanq) [#2571]
  - feat: new rule to detect Unicode character bypass check for non JSON requests (920540 PL1) (Franziska Bühler, 0SPwn) [#2512]
  - feat: new rule to detect # char in URIs (920610 PL1) (Karel Knibbe) [#2919]
  - fix: use correct anomaly scoring variables and paranoia level tags across several rules (921170 PL1, 921220 PL4, 932220 PL2, 932331 PL3, 933211 PL3, 934101 PL1, 942362 PL2, 951100) (Christoph Hansen) [#2931]
  - feat: new rules to detect HTTP parameter pollution bypasses (921210 PL3, 921220 PL4) (Christian Folini) [#2747]
  - fix: use correct anomaly scoring variables and paranoia level tags across several rules (921220 PL4, 932101 PL2, 932331 PL3, 933211 PL3, 942362 PL2) (Ervin Hegedus) [#2832]
  - feat: new rule to detect range header that is now forbidden on PL3 and up (921230 PL3) (Christian Folini) [#2760]
  - feat: new rule to detect mod_proxy attack (CVE-2021-40438) (921240 PL1) (Franziska Bühler) [#2818]
  - fix: add urlDecodeUni transformation rules with REQUEST_URI / REQUEST_BASENAME in phase 1 (921240 PL1, 920440 PL1, 920201 PL2, 920202 PL4) (Christian Folini) [#3411]
  - feat: new rules to detecting ModSecurity body processor confusion using the Content-Type HTTP header (921421 PL1, 921422 PL2) (Simon Studer, Ervin Hegedus) [#2763]
  - fix: handle false positives when detecting ModSecurity body processor confusion (921422 PL2) (Ervin Hegedus) [#2784]
  - feat: new rules detecting attacks on multipart headers (922100 PL1, 922110 PL1, 922120 PL1) (Felipe Zipitría) [#2769]
  - fix: prevent unintended match of character set substrings in multipart/form-data requests (922100 PL1) (Jozef Sudolský) [#3470]
  - feat: remove redundant t:lowercase for a little performance (922110 PL1) (Jozef Sudolský) [#3469]
  - fix: remove possessive quantifiers (922110 PL1) (Felipe Zipitría) [#2989]
  - fix: update comments (922110 PL1, 942440 PL2) (Jozef Sudolský) [#3468]
  - fix: add missing quotes at the end of action lists (930050) (Ervin Hegedus) [#2184]
  - feat: disassemble regular expression (930100 PL1) (Andrew Howe) [#2298]
  - fix: detect path traversal in uploaded file names (930100 PL1, 930110 PL1) (k4n5ha0, Franziska Bühler, Felipe Zipitría) [#2451]
  - fix: detect triple dot path traversal (930100 PL1, 930110 PL1) (Franziska Bühler) [#2309, #2310]
  - feat: extended rule to detect Tomcat specific path traversal attack (930110 PL1) (Christoph Hansen) [#2915]
  - fix: avoid FP for '..' without slashes (930110 PL1) (Tetrik, Walter Hop) [#2016]
  - feat: block access to AWS CLI files (930120 PL1, 930121 PL2) (Jozef Sudolský) [#2439]
  - feat: block access to extended list of sensitive files (930120 PL1, 930121 PL2, 930130 PL1) (Jozef Sudolský) [#1960]
  - feat: detect /proc and /sys access attempts (930120 PL1, 930130 PL1) (Andrew Howe) [#2154]
  - feat: extend rule to detect access attempts to /tmp/ (930120 PL1, 930121 PL2) (Max Leske) [#3131]
  - feat: extend rule to detect ECDSA type SSH identity files via list of sensitive *nix files (930120 PL1) (Pinaki Mondal / 0xInfection) [#2586]
  - fix: avoid detecting Google OAuth2 callback requests as malicious (930120 PL1, 930121 PL1) (Jozef Sudolský, Christian Folini) [#1958]
  - feat: extend rule to detect additional sensitive files on *nix systems (930121 PL2, 930130 PL1) (Gwendal Le Coguic / gwen001) [#2560]
  - feat: new rules to detect LFI and SQLi in user-agent and referer request headers (930121 PL2, 942152 PL2, 942321 PL2) (Franziska Bühler, Max Leske, Shivam Bathla) [#3102]
  - fix: extend rule to detect more LFI (930121 PL2) (Felipe Zipitría) [#2791]
  - feat: add BlockCypher.log to restricted-files.data (930130 PL1) (Jozef Sudolský) [#3501]
  - feat: add 'sslvpn_websession' to restricted-files.data (930130 PL1) (Jozef Sudolský) [#2338]
  - feat: add .vscode to restricted-files.data (930130 PL1) (Frederik Himpe) [#3471]
  - feat: extend data file to include additional restricted file names (restricted-files.data, 930130 PL1) (Jitendra Patro) [#3219]
  - feat: extend data file to include PrestaShop configuration file (restricted-files.data, 930130 PL1) (Jean-François Viguier) [#3192]
  - feat: extend rule to detect npm-shrinkwrap.json to restricted-files (930130 PL1) (Esa Jokinen / oh2fih) [#2627]
  - fix: block access to the Java-related WEB-INF directory (930130 PL1) (Jozef Sudolský) [#2092]
  - fix: remove duplicate keyword (930130 PL1) (Jozef Sudolský) [#3517]
  - feat: extend rules to detect additional protocols in RFI attacks (931130 PL2, 934120 PL2) (Karel Knibbe) [#2572]
  - feat: extend rule to detect url:file: schema in Java RFI attacks (931130 PL2) (Andrew Howe) [#2727]
  - fix: add local_file scheme from Python 2 (931130 PL2, 934120 PL2) (Felipe Zipitría) [#2809]
  - fix: close userinfo-based bypass (931130 PL2) (Andrea Menin) [#2479]
  - feat: new rule to detect path traversal attacks using URL encoded URL schemes in Java applications (931131 PL2) (Christoph Hansen) [#2902]
  - feat: extend rule to detect additional *nix shell commands (931160 PL1) (Gwendal Le Coguic / gwen001) [#2563]
  - feat: disassemble complex regexes for 932xxx rules that were subsequently replaced by other rules (Max Leske) [#2566]
  - feat: detect additional Unix RCE commands (932100 PL1, 932105 PL1) (Felipe Zipitría) [#2129]
  - feat: extend rule to detect additional entries to *nix command lists (932100 PL1, 932105 PL1) (Finn Westendorf / wfinn) [#2552]
  - feat: extend rule to detect additional *nix commands (932100 PL1) (Felipe Zipitría) [#2676]
  - feat: improve and extend cmdline processor to find more evasions (932100 PL1, 932105 PL1, 932230 PL1, 932150 PL1, 932175 PL1, 932220 PL2, 932240 PL1, 932106 PL3) (Felipe Zipitría) [#2907]
  - fix: avoid false positive with certain HTML character entities (932100 PL1) (Franziska Bühler) [#1954]
  - feat: move *nix command injection rule 932101, 932106 into the same range as the other *nix command injection rules (932231 PL2, 932232 PL3) (Felipe Zipitría, Max Leske) [#3092]
  - feat: extend rule to detect additional *nix commands (932105 PL1) (Felipe Zipitría) [#2677]
  - feat: extend rule to detect mshta in Windows shell commands (932110 PL1) (Somdev Sangwan / s0md3v) [#2588]
  - feat: new Windows commands rules based on lolbas-project replacing 932110, 932115 (932370 PL1, 932380 PL1) (Felipe Zipitría, Franziska Bühler, Max Leske) [#3059, 3170]
  - fix: avoid false positive on 'sort' (932115 PL1) (Franziska Bühler) [#2012]
  - feat: detect 'Invoke-WebRequest' command (932120 PL1) (Paul Beckett) [#2271]
  - feat: extend rule to detect additional PowerShell cmdlet on Windows (932120 PL1) (Pinaki Mondal / 0xInfection) [#2589]
  - feat: extend rule to detect PowerShell RCEs better via new automation (932120 PL1) (Felipe Zipitría) [#2669]
  - feat: new rule to detect Windows cmdlet aliases (932125 PL1) (Pinaki Mondal / 0xInfection) [#2589]
  - fix: extend rule to detect character class *nix expressions (932130 PL1) (Somdev Sangwan / s0md3v, Walter Hop) [#2594]
  - feat: new rules to detect Log4j / Log4Shell attacks (932131 PL2, 944150 PL1, 944151 PL2, 944152 PL4) (Christian Folini, Max Leske) [#2349]
  - fix: prevent false positives against brackets in User-Agent header (932131 PL2) (Max Leske) [#3486]
  - feat: extend rule to detect busybox, $SHELL, and ${SHELL} in *nix RCE attacks (932150 PL1) (Walter Hop) [#2728]
  - feat: extend rule to detect C99 and printf utilities (932150 PL1) (Karel Knibbe) [#2569]
  - feat: extend rule to detect ksh in *nix RCE attacks (932150 PL1) (Andrew Howe) [#2721]
  - feat: extend rule to detect RCE attacks using compression utilities (932150 PL1) (Andrew Howe) [#2712]
  - feat: extend rule to detect RCEs using Base64 evasions (932150 PL1) (Somdev Sangwan / s0md3v, Andrew Howe) [#2590]
  - feat: extend rule to detect RCEs using evasions quotes with python... commands (932150 PL1) (Somdev Sangwan / s0md3v, Andrew Howe) [#2590]
  - feat: new rule to detect generalised *nix RCE (932150 PL2) (Karel Knibbe) [#2583]
  - feat: replace *nix command injection rules 932150 PL1, 932151 PL1 with new rules for commands of less than 4 characters and commands of more than 4 characters in length respectively (932250 PL1, 932260 PL1) (Felipe Zipitría, Max Leske) [#3092]
  - fix: avoid FP on 'time' and 'ping' keywords (932150 PL1) (Walter Hop) [#2457]
  - feat: extend rule to detect RCE better via automation (932160 PL1) (Felipe Zipitría) [#2662]
  - fix: remove unnecessary prefixes from paths in unix-shell.data (932160 PL1) (Felipe Zipitría) [#2662]
  - feat: extend rule to detect expre in unix-shell list (932161 PL2) (Felipe Zipitría) [#2667]
  - feat: new rules to detect *nix commands in user-agent and referer request headers (932161 PL2, 932237 PL3) (Franziska Bühler, Max Leske, Shivam Bathla) [#3132]
  - feat: new rule detecting alias builtin (932175 PL1) (Felipe Zipitría) [#2796]
  - feat: use new automation to generate restricted-uploads.data from restricted-files.data (932180 PL1) (Max Leske) [#3282]
  - fix: use correct anomaly scoring variable (932180 PL1, 932200 PL2) (Jozef Sudolský) [#2324]
  - feat: detect RCE attempts with uninitialized shell vars (932200 PL2) (Andrea Menin) [#2151]
  - feat: extend rule to detect RCE in user-agent request header (932200 PL2) (Franziska Bühler, Shivam Bathla) [#3108]
  - feat: reduce FPs by removing User-Agent from individual target list (932200 PL2) (Max Leske) [#3489]
  - fix: generate correct log entries when using 'MATCHED_VAR_NAME' in conjunction with chain rules (932200 PL2, 933120 PL1, 933151 PL2) (Jozef Sudolský) [#2347]
  - fix: new rules to handle referer header and fix false positive (932205 PL2, 932206 PL2) (Max Leske) [#3300]
  - feat: extend rule to detect quote evasion (932210 PL2) (Max Leske) [#3120]
  - feat: extend rule to detect sh (932210 PL2) (Franziska Bühler) [#2816]
  - feat: extend rule to detect SQLi via automation of keyword list updates (932210 PL2) (Felipe Zipitría) [#2801]
  - feat: new rule to detect SQLite system command injection (932210 PL2) (flo405, Andrea Menin, Christian Folini) [#2032]
  - fix: add word boundaries for sh in RCE rules (932230 PL1, 932250 PL1) (Max Leske) [#3186]
  - fix: avoid FPs in RCE detections against words 'environment' and 'performance' (932230 PL1, 932235 PL1, 932260 PL1, 932236 PL2, 932237 PL3, 932239 PL2) (Esad Cetiner) [#3477]
  - fix: handle false positive against sh in *nix command injection attacks (932230 PL1, 932250 PL1, 932236 PL2) (Max Leske) [#3186]
  - feat: add unix commands pyversions and py3versions (932235 PL1, 932260 PL1, 932236 PL2, 932237 PL3, 932239 PL2) (Jitendra Patro) [#3465]
  - feat: replace *-with-params.ra files with suffix replacements (932235 PL1, 932236 PL2, 932239 PL2, 932237 PL3) (Max Leske) [#3331]
  - fix: prevent FP on keywords 'more' and 'time' in Unix RCE (932235 PL1) (Franziska Bühler) [#3488]
  - fix: reduce FPs at the start of strings by excluding 'as' and 'at' (932236 PL2) (Franziska Bühler, Max Leske, Andrew Howe) [#3531
  - fix: prevent FPs against names due to "axel" and "perl" (932235 PL1, 932260 PL1, 932236 PL2, 932239 PL2, 932237 PL3) (@superlgn) [#3492]
  - fix: add whitespace after keywords mail and task to solve false positives (932236 PL2) (Franziska Bühler) [#3274]
  - fix: align unix-shell-upto3* files (932236 PL2) (Max Leske) [#3128]
  - fix: handle false positives with word "settings" (932236 PL2, 932237 PL3, 932239 PL2) (Esad Cetiner) [#3394]
  - fix: prevent FP on keywords more and time in Unix RCE (932236 PL2) (Franziska Bühler) [#3487]
  - fix: solved false positives with creation of word boundaries for commonly used words used in *nix RCE rules (932236 PL2) (Max Leske) [#3187]
  - fix: use correct anomaly scoring variable (932236 PL2) (Ervin Hegedus) [#3112]
  - fix: improve rule by matching non-word-boundary of commands with options (932237 PL3) (Max Leske) [#3425]
  - feat: new rule to detect *nix commands in user-agent and referer request headers (932239 PL2) (Franziska Bühler, Shivam Bathla) [#3104, #3318]
  - fix: reduce FPs in generic quote evasion detection (932240 PL2) (Max Leske) [#3494]
  - fix: remove ARGS_NAME from target variables in (932240 PL2) (Andrea Menin) [#2960]
  - fix: use correct anomaly scoring variables and paranoia level tags across for rule (932240 PL2) (Ervin Hegedus) [#2963]
  - fix: false positives by requiring specific tokens to follow commands (932250 PL1) (Max Leske) [#3186]
  - fix: Added missing target name to logdata (932260 PL1, 932240 PL2) (Ervin Hegedus) [#3409]
  - fix: remove chained rule (932260 PL1) (Max Leske) [#3521]
  - feat: new rules to detect email protocol attacks (932300 PL2, 932310 PL2, 932320 PL2) (Felipe Zipitría) [#2322]
  - fix: remove additional range expression that cause parsing errors for RE2 (932311 PL3) (Felipe Zipitría) [#2484]
  - feat: new rules to detect detecting *nix shell history invocations (932330 PL1, 932331 PL3) (Karel Knibbe) [#2577]
  - fix: remove 'time' prefix from Windows RCE detection (932370 PL1, 932380 PL1) (Max Leske) [#3528]
  - feat: extend rule to detect additional file extensions via list of executable PHP files (933110) (Jan Gora / terjanq) [#2585]
  - feat: extend data file to add missing PHP config directives (php-config-directives.data, 933120 PL1) (Max Leske) [#3028]
  - feat: extend rule to detect additional sensitive PHP directives (933120 PL1) (Gwendal Le Coguic / gwen001) [#2561]
  - feat: extend rule to detect PHP config directives via automation of keyword list updates (933120 PL1) (Felipe Zipitría) [#2696]
  - feat: extend rule to detect sensitive PHP variables better (933130 PL1) (Felipe Zipitría) [#2668]
  - tests: clean test definitions and provide proper descriptions (933150 PL1, 933160 PL1) (Andrea Menin, Matteo Pace, Max Leske) [#3462]
  - feat: extend data file to include additional php function names (php-function-names-933151.data, 933151 PL2) (Jitendra Patro) [#3212]
  - feat: automate generation of PHP function dictionaries, revisited detection (933160 PL1, 933161 PL3, 933150 PL1, 933151 PL2) (Juan-Pablo Tosso, Christian Folini, Matteo Pace) [#3273]
  - feat: extend rule to detect document.domain XSS (933160 PL1, 941180 PL1) (Franziska Bühler, 0SPwn) [#2567]
  - feat: extend rule to detect evasions in PHP contexts with " (933160 PL1) (Somdev Sangwan / s0md3v) [#2596]
  - feat: rearrange keywords (933160 PL1, 941390 PL1) (Karel Knibbe) [#2905]
  - fix: handle false positive by fixing whitespace matching after PHP command (933160 PL1) (Max Leske) [#3432]
  - fix: solve ReDoS issue in rule (933161 PL3) (Andrea Menin) [#2302]
  - feat: extend rule to detect bzip2 wrapper in PHP injection attacks (933200 PL1) (Andrew Howe) [#2723]
  - feat: extend rule to detect ssh2.\* wrappers in PHP injection attacks (933200 PL1) (Andrew Howe) [#2731]
  - fix: avoid false positive when cookie contains slash (933210 PL1) (Ervin Hegedus) [#1996]
  - fix: close PHP whitespace bypass (933210 PL1) (Walter Hop) [#2033]
  - fix: prevent excessive backtracking (933210 PL1) (Andrea Menin) [#2214]
  - feat: new rule to detect PHP injection attacks without terminating semi-colon (933211 PL3) (Karel Knibbe) [#2581]
  - feat: extended rule to detect Node.js injection attacks using require and child_process (934100 PL1, 932101 PL2) (Andrea Menin) [#2893]
  - feat: extend rule to detect Node.js RCE better (934100 PL1) (rektor0) [#2578]
  - feat: improve transformation pipeline to detect Base64-encoded evasions (934100 PL1) (Andrew Howe) [#3203]
  - feat: new rule to detect Node.js RCE detection (934101 PL2) (rektor0) [#2578]
  - fix: improve js rule transformation pipelines (934101 PL1, 934130 PL1, 934169 PL1, 934131 PL2) (Andrew Howe) [#3312]
  - feat: extend data file to include additional indicators (ssrf.data, 934110 PL1) (Jitendra Patro) [#3213]
  - feat: extend rule to detect SSRF better (934110 PL1) (Felipe Zipitría) [#2660]
  - feat: new rules to detect common IP-based SSRF targets (934110 PL1, 934120 PL2) (Felipe Zipitría) [#2259]
  - feat: extend rule to detect additional schema and IP evasion techniques in SSRF (934120 PL2) (Felipe Zipitría, Max Leske) [#2599]
  - feat: extend rule to detect octal address of AWS metadata endpoints (934120 PL2) (Karel Knibbe) [#2555]
  - feat: extend rule to detect SSRF better by inspecting targets beyond just ARGS (934120 PL2) (Karel Knibbe) [#2555]
  - feat: new rules to detect JavaScript prototype pollution (934130 PL1, 934131 PL2) (Walter Hop) [#2411]
  - fix: remove base64 transformation due to limited effectiveness and to align behavior across ModSecurity v2.x and libModSecurity v3.x engines (934130 PL1) (Andrea Menin) [#3378]
  - fix: remove overly specific rule with limited benefits and lack of cross-engine compatibility (934131 PL2) (Andrea Menin) [#3378]
  - feat: new rules to detect detection of Perl and Ruby RCE signatures in a generic way (934140 PL2, 934150 PL1) (Karel Knibbe) [#2587]
  - feat: new rule to detect Node DoS attack via expressions resolving to true (934160 PL1) (Karel Knibbe) [#2917]
  - feat: new rule for PHP supporting data: scheme without using // before the content-type (934170 PL1) (Felipe Zipitría) [#3018]
  - feat: extend rules to detect path based XSS via new target REQUEST_FILENAME in 941xxx rules (Walter Hop) [#2894]
  - feat: run libinjection XSS detector on request filename in PL2 (941101 PL2) (Andrew Howe) [#2208]
  - feat: move rule from PL1 to PL2 (941120 PL2) (Christian Folini) [#2306]
  - fix: avoid false positive by adding character limit (941120 PL2) (Christian Folini) [#1872]
  - fix: avoid FP in Base64 content (941120 PL1) (Jozef Sudolský) [#2226]
  - fix: remove unnecessary character escape (941120 PL2) (Andrew Howe) [#2805]
  - fix: avoid FP in XMLNLS (941130 PL1) (Walter Hop) [#2192]
  - fix: solve ReDoS issue in rule (941140 PL1) (Andrea Menin) [#2050]
  - feat: detect 'dialog' tag in XSS no-script payloads (941160 PL1) (Jitendra Patro) [#3473]
  - feat: disassemble complex regex fully (941160 PL1) (Felipe Zipitría) [#2701]
  - fix: make regular expression more restrictive (941170 PL1) (Andrea Menin) [#2292]
  - fix: new rule at PL2 to move the detection of '--&gt;' out of PL1 due to false positives (941181 PL2) (Paul Beckett) [#2082]
  - feat: disassemble complex regex (941210 PL1) (Felipe Zipitría) [#3262]
  - feat: extend rule to detect XSS evasions using carriage return (\r) and new line (\n) characters (941210 PL1) (oct0pus7) [#2576]
  - feat: disassemble complex regex (941220 PL1) (Felipe Zipitría) [#3263]
  - fix: correct numerical values used for HTML entity evasion detection (941220 PL1) (Jitendra Patro) [#3479]
  - fix: avoid false positive with Russian characters (941310 PL1) (Max Leske) [#2107]
  - feat: improve detection by adding missing javascript prompt and confirm methods (941390 PL1) (Jitendra Patro) [#3395]
  - feat: new rule to detect JavaScript methods (941390 PL1) (Franziska Bühler) [#2702]
  - feat: extend rule and moved rule from PL3 to PL2 (942101 PL2) (Matteo Pace) [#2922]
  - feat: extended rule to detect common SQL injection probing in path segments (942110 PL2) (Andrea Menin) [#2914]
  - feat: prevent FPs by removing rule (942110 PL2) (Max Leske) [#3505]
  - feat: add target REQUEST_FILENAME to rule to detect path-based SQLi attacks (942120 PL2) (Andrew Howe) [#3057]
  - feat: extend rule to detect use of collate in SQLite injection attacks (942120 PL2) (Jan Gora / terjanq) [#2584]
  - fix: extend rule to detect more SQLi (942120 PL2) (Karel Knibbe) [#2556]
  - fix: resolve issue with regular expression and improve SQLi detection by detecting 'not between' (942120 PL2) (NiceYouKnow, Max Leske, Franziska Bühler) [#2115]
  - fix: update SQL reserved words (942120 PL2) (Felipe Zipitría) [#2798]
  - feat: extend rule to detect glob in list of SQLi tautologies (942130 PL2) (Franziska Bühler) [#2729]
  - fix: remove unneeded TX variables (942130 PL2, 942131 PL2, 942521 PL3) (Andrea Menin) [#3293]
  - feat: detect more error-based SQL injections (942150 PL2, 951230 PL1) (Jozef Sudolský) [#2429]
  - feat: extend rule to detect more SQL function names (942150 PL2) (Karel Knibbe) [#2895]
  - feat: extend rules to detect more SQL error messages and functions (942151 PL1, 942152 PL1, 951220 PL1, 951230 PL1, 951240 PL1) (Jitendra Patros) [#3336]
  - feat: extend rule to detect additional SQL function signatures (942151 PL1) (Karel Knibbe) [#2570]
  - feat: extend rule to detect endswith, startswith, unistr, pg_client_encoding and various JSON SQL functions (942151 PL1) (Franziska Bühler) [#2874]
  - feat: extend rule to detect various JSON functions (942151 PL1) (Franziska Bühler) [#3041]
  - fix: avoid FP in SQL function names by splitting between PL1/PL2 (942151 PL1, 942150 PL2) (Jozef Sudolský) [#2480]
  - feat: extend rule to detect sql_compileoption_get in SQLite injection attacks (942152 PL1) (Andrew Howe) [#2718]
  - fix: extend blind SQLi detection (942160 PL1) (Franziska Bühler, Christian Folini) [#1956]
  - feat: new regex-assembly file for rule (942170 PL1) (Andrea Menin) [#2939]
  - feat: extend rule to detect SQL injection authentication bypasses (942180 PL2) (rekter0) [#2575]
  - feat: improve SQLi detection with spaces (942190 PL1, 942390 PL2) (Manuel Spartan, Max Leske) [#2436]
  - fix: avoid FP in SQLi by adding word boundary checks (942190 PL1) (Jozef Sudolský) [#2078]
  - fix: avoid FP in SQLi with keyword 'union' (942190 PL1) (Franziska Bühler) [#2058]
  - fix: prevent comment-based SQL evasion (942190 PL1) (Andrea Menin) [#1910]
  - fix: resolve bug in regular expression and add test case (942190 PL1) (NiceYouKnow, Max Leske, Franziska Bühler) [#2112]
  - feat: disassemble complex regex (942200 PL2) (Franziska Bühler, Max Leske) [#2932]
  - feat: extend rule to detect SQLi in user-agent and referer request headers (942200 PL2, 942370 PL2) (Franziska Bühler, Shivam Bathla) [#3106]
  - feat: improve regex-assembly file for rule (942210 PL2) (Andrew Howe) [#2945]
  - fix: detect the correct magic numbers that crash old PHP versions (942220 PL1) (Kyzentun, Walter Hop) [#2010]
  - fix: avoid false positive with 'case' (942230 PL1) (Franziska Bühler) [#2035]
  - fix: detect SQL false negative (942230 PL1) (Max Leske) [#2348]
  - feat: disassemble complex regex (942240 PL1) (Franziska Bühler, Max Leske) [#2938]
  - fix: avoid FP in 'having' SQLi (942251 PL3) (Felipe Zipitría) [#2248]
  - feat: new regex-assembly file for rule (942280 PL1) (Andrea Menin) [#2933]
  - feat: extend rule to detect additional MongoDB operators via NoSQL commands list (942290 PL1) (rekter0) [#2579]
  - feat: new regex-assembly file for rule (942290 PL1) (Andrea Menin) [#2942]
  - feat: improve regex-assembly format (942300 PL2) (Felipe Zipitría) [#3296]
  - fix: avoid false positive by adding word boundary checks (942300 PL2) (Franziska Bühler) [#2099]
  - fix: remove unnecessary part of regular expression (942310 PL2) (NiceYouKnow) [#2189]
  - feat: extend rule to detect ::int and ::bool SQL data conversions (942320 PL1) (Franziska Bühler) [#2872]
  - feat: extend rule to detect lo_get and ::text via PostgreSQL functions list (942320 PL2) (Franziska Bühler, Walter Hop, Shivam Bathla) [#2925]
  - feat: extend rule to detect lo_import and div via PostgreSQL functions list (942320 PL2) (Franziska Bühler, Shivam Bathla) [#2916]
  - feat: extend rule to detect more PostgreSQL data types (942320 PL2) (Franziska Bühler, Shivam Bathla) [#3019]
  - fix: add word boundaries to keywords to solve false positives (942330 PL2) (Franziska Bühler) [#3207]
  - feat: extend rule to detect SQL injection better (942340 PL2) (Karel Knibbe) [#2557]
  - fix: extend rule to detect more SQLi (942340 PL2) (Jan Gora / terjanq) [#2559]
  - feat: detect SQLi using the 'drop' keyword (942350 PL1, 942360 PL1, 942200 PL2, 942362 PL2) (Jozef Sudolský) [#2218]
  - fix: solve ReDoS issue in rule (942350 PL1) (Andrea Menin) [#2300]
  - feat: new regex-assembly file for rule (942370 PL2) (Christoph Hansen, Max Leske) [#2954]
  - feat: detect SQLi with 'if exists' (942380 PL2) (NiceYouKnow) [#2121]
  - feat: optimize regex (942400 PL2) (Jozef Sudolský) [#2323]
  - feat: disassemble complex chained regex (942440 PL2) (Felipe Zipitría) [#3295]
  - feat: optimize regex (942440 PL2) (Felipe Zipitría) [#2459]
  - fix: adapt rule to work in all ModSecurity versions (942440 PL2) (Andrew Howe) [#2201]
  - fix: avoid FP in JWT tokens (942440 PL2) (Andrea Menin) [#2460]
  - fix: reformat rules to follow project guidelines (942440 PL2, 949959, 949159, 959059, 959159) (Ervin Hegedus) [#3206]
  - fix: solve errors in regex pattern (942440 PL2) (Andrea Menin) [#3290]
  - fix: prevent FPs for click identifiers in query string by placing arg specific rule exclusions in rule set (942441, 942442) (Max Leske) [#3500]
  - feat: extend rules to detect current_user and overlay (942470 PL1, 942480 PL2) (Franziska Bühler) [#2875]
  - feat: extended rule to detect detect SQL injection attacks using headers (942480 PL2) (Paul Beckett) [#2911]
  - feat: extend rule to detect newlines in overlay (942480 PL2) (Franziska Bühler, Shivam Bathla) [#3040]
  - fix: detect MySQL optimizer hints (942500 PL1) (Max Leske) [#3431]
  - feat: new rules to detect SQL authentication bypasses (942520 PL2, 942521 PL2, 942522 PL2) (Jan Gora / terjanq) [#2603]
  - feat: extend rule to detect SQLi in user-agent and referer request headers (942521 PL2) (Franziska Bühler, Shivam Bathla) [#3107]
  - fix: replace 'MATCHED_VAR' in 'logdata' argument with stable variable (942521 PL2, 943110 PL1, 943120 PL1) (Ervin Hegedus) [#3543]
  - feat: new rule to detect '; in SQLi (942530 PL3) (Franziska Bühler) [#2808]
  - feat: new rule to detect authentication bypass via SQL injection that abuses semi-colons to end the SQL query (942540 PL1) (Karel Knibbe) [#2904]
  - fix: update scoring variable (942540 PL2) (Walter Hop) [#2970]
  - feat: new rule to detect MySQL scientific notation attacks (942560 PL1) (Jitendra Patro) [#3316]
  - fix: remove unnessecary 'lowercase' transformation from chain rule (944120 PL1) (Federico G. Schwindt) [#1852]
  - feat: extend rule to detect JAVA exploits better via java-classes.data file (944130 PL1) (Dennis Brown) [#3048]
  - feat: new rule to deny uploading .jsp and .jspx files (944140 PL1) (Walter Hop) [#2456]
  - feat: new rule to detect Spring4Shell (944260 PL2) (Christian Folini, Andrea Menin) [#2464]
  - fix: update administrative rule ids for consistent operation (950011, 950012, 950018) (Ervin Hegedus) [#3339]
  - feat: improve rule file 951xxx via the use of skipAfter instead of variable TX:sql_error_match (Jozef Sudolský) [#2754]
  - feat: extend data file to include additional SQL error messages (sql-errors.data, 951100 PL1) (Jitendra Patro) [#3214]
  - fix: avoid FP in MySQL data leakage rule (951230 PL1) (Jozef Sudolský) [#2490]
  - fix: avoid FP in PostgreSQL error messages (951240 PL1) (Jozef Sudolský, Franziska Bühler) [#1870, #2313]
  - fix: handle false positive in SQL error leakage detection (951240 PL1) (Jozef Sudolský) [#3169]
  - fix: avoid FP in Sybase error message (951260 PL1) (Jozef Sudolský) [#2307]
  - feat: extend rule to detect PHP errors better via new automation (953100 PL1) (Felipe Zipitría) [#2663]
  - feat: new rules to detect PHP error leakages with high false positive rates at paranoia level 2 instead of 1 (953100 PL1, 953101 PL2) (Andrea Menin) [#3119]
  - fix: solve false positive by shifting "Field cannot be empty" to PL2 (953100 PL1, 953101 PL2) (Esad Cetiner) [#3407]
  - fix: ignore case of PHP tag in response text (953210 PL1) (Felipe Zipitría) [#2664]
  - feat: extend rule to detect IIS errors via automation of pattern updates (954120 PL1) (Felipe Zipitría) [#2810]
  - fix: log response body to audit log only when full rule chain matches (954130 PL1) (Franziska Bühler) [#2202]
  - feat: added new webshells and tests (955100 PL1) (Jozef Sudolský) [#3405]
  - feat: extend data file to include additional web shells (web-shells-php.data, 955100 PL1) (Jitendra Patro) [#3215]
  - feat: extend data file to include additional web shells (web-shells-php.data, 955100 PL1) (Jozef Sudolský) [#2687]
  - fix: make regular expression more strict to reduce noise in logs (955120 PL1) (Jozef Sudolský) [#2315]
  - fix: use correct variable in chained condition for correlation rules (980120 PL0, 980150 PL0) (Simon Studer) [#1898]
  * Functionality that has been moved to plugins for this release
  - feat: add Google OAuth 2 exclusion plugin (Jozef Sudolský) [#2388]
  - feat: add phpBB exclusion rules (now a plugin) (Jozef Sudolský) [#1893]
  - feat: add phpMyAdmin exclusion rules (now a plugin) (Jozef Sudolský) [#1951]
  - feat: move IP reputation rules to plugins (Simon Studer) [#2482]
  - feat: move exclusion profiles and DOS rules to plugins (Andrew Howe) [#2469]
  - feat: ownCloud: Fix rule 9003001 to match both DAV and WebDAV (now a plugin) (Abu Dawud) [#2130]
  - fix: nextcloud: fix FPs (now a plugin) (kam821, Jozef Sudolský, ntimo, Felipe Zipitría, pyllyukko) [#1840, #1843, #1847, #1946]
  - fix: phpBB: Fix FPs (now a plugin) (Jozef Sudolský) [#2057, #2180, #2299, #2343]
  - fix: phpMyAdmin: Fix FPs (now a plugin) (Jozef Sudolský) [#2172, #2249, #2321, #2351]
  - fix: replace ARGS by ARGS_GET in rules in phase:1 (various rule exclusion rules) (Ervin Hegedus) [#2063]
  - fix: wordPress: fix FPs (now a plugin) (Jozef Sudolský) [#1899, #1971, #2320]
  - fix: wordPress: fix FPs and improve performance (now a plugin) (Walter Hop) [#1997, #2311]
  - fix: wordPress: fix FPs in Site Health page (now a plugin) (Robert de Boer, Fregf, Walter Hop) [#1895, #1920]
  - fix: xenForo: fix FPs (now a plugin) (Walter Hop, ThanhPT) [#1844, #1865, #1894, #1998, #2421]
- Version 3.3.6
  * Important changes:
  - fix: prevent using backslash in file names (v3) by @fzipi in #3800
  - feat: add new rule to catch invalid character in multipart headers (v3) by @airween (ported by @fzipi) in #3797</changelog>
  <changelog author="pgajdos@suse.com" date="1737633600">- package cleanup, coordinated with apache2-mod_security2
  cleanup
- version update to 4.10.0
  * New features and detections
  - feat: block CVE-2023-5003 by @azurit in https://github.com/coreruleset/coreruleset/pull/3955
  - feat: prevent accessing PHP variables by @azurit in https://github.com/coreruleset/coreruleset/pull/3965
  * Other Changes
  - fix: FP against `pattern` with `=` following at arbitrary position by @theseion in
    https://github.com/coreruleset/coreruleset/pull/3963</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1766404800">- version update to 4.41.0
  * feat(931100): add IPv6 support / XML scan and SSH scheme. by @touchweb-vincent in #4321
  * feat(920440): add new restricted file extensions by @touchweb-vincent in #4322
  * fix(942160): adding unit test for double comment by @touchweb-vincent in #4315
  * fix(920280, 920300, 920310, 920311, 920320, 920330): should be block by @touchweb-vincent in #4319
  * fix(942151,942152): wrong functions names by @touchweb-vincent in #4333
  * feat(942460): adding help for non-English folks by @touchweb-vincent in #4334
  * fix(932180): reduce substring false positives by @EsadCetiner in #4338
  * fix(942151,942152): wrong functions names by @touchweb-vincent in #4337
  * fix(920180): wrong unit test - content-type evasion bypass by @touchweb-vincent in #4339
  * fix(956110): move rule to pl-2 by @EsadCetiner in #4344
  * docs: comment on disabling Expect header in .Net by @theseion in #4348
  * fix: add missing capture action to affected rules by @airween in #4361
- for changelog for older releases see:
  https://github.com/coreruleset/coreruleset/blob/v4.21.0/CHANGES.md</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1773057600">- version update to 4.24.1
  * New features and detections
    + feat(930140): add AI coding assistant artifact protection by
    @etiennemunnich in #4519
    + feat: Expand Scanner Agents by @HackingRepo in #4532
  * Fixes
    + fix(942200): prevent matches against user agent strings by
    @theseion in #4537
    + fix(942480): don't inspect cookies twice by @touchweb-vincent
    in #4524
  * Other Changes
  + refactor: create 934130 .ra file by @Xhoenix in #4487
  + refactor: create 941330 .ra file by @fzipi in #4492
  + refactor: create 944300 .ra file by @fzipi in #4490
  + refactor: create 941320 .ra file by @fzipi in #4491
  + refactor: create 921160 .ra file by @fzipi in #4497
  + refactor: create 921120 .ra file by @fzipi in #4496
  + refactor: create 921110 .ra file by @fzipi in #4495
  + feat: move 930110 to regex-assembly by @fzipi in #4494
  + refactor: create 941190 .ra file by @fzipi in #4499
  + refactor: create 941400 .ra file by @fzipi in #4517
  + refactor: create 942250 .ra file by @fzipi in #4512
  + refactor: create 941370 .ra file by @fzipi in #4518
  + refactor: create 944260 .ra file by @fzipi in #4510
  + feat: move 943100 to regex-assembly by @fzipi in #4504
  + refactor: create 944120 .ra file by @fzipi in #4508
  + refactor: create 942450 .ra file by @fzipi in #4513
  + refactor: create 942510 and 942511 .ra files with shared
    include by @fzipi in #4516
  + refactor: create 944240 .ra file by @fzipi in #4509
  + docs: comment on threshold should be more alarming by
    @touchweb-vincent in #4330
  + chore: add missing regex-assembly comment blocks to rules by
    @fzipi in #4523
  + fix(913100): adding OWASP Nettacker to known scanners list
    by @securestep9 in #4529
  + refactor: create 941300 .ra file by @fzipi in #4521
- for changelog for older releases see:
  https://github.com/coreruleset/coreruleset/blob/v4.24.1/CHANGES.md</changelog>
  <changelog author="Petr Gajdos &lt;pgajdos@suse.com&gt;" date="1780315200">- version update to 4.27.0
  * fix(920240, 920400): don't rely on content-type header
- version update to 4.26.0
  * feat: Add WhatWAF to the scanner list
  * feat: Add ghauri to scanner list
  * feat: Expand Scanner User Agents List (v2)
  * feat: Expanded os files list
  * feat(933100): all HTTP headers should be checked
  * fix(lfi-os-files): add .dockerenv, .DS_Store, META-INF/, WEB-INF/
  * feat(934200): detect Server-Side Template Injection (SSTI) attacks
  * fix(lfi-os-files): require path prefix for .profile
  * fix(933150): remove is_int from PHP function names list
  * fix(932370): remove url from Windows LOLBIN command list
  * fix(920539): prefer a bypass on a named rule rather than n+1 bypass
  * fix(942290): add word boundary to MongoDB operator detection
  * fix: false positive with parameter name `.history`
  * fix(942410): use common exceptions instead of rule
  * fix(942200): reduce false positives on payloads with comments
  * fix(unix): exclude `pg` command from pl-1
  * fix(930130): comment out false positive prone entries
  * fix(920100): drop HTTP/0.9 GET support from request line validation
  * fix: Update restricted files to include Perl subdirectories
- version update to 4.25.0
  * feat(930130,930140): expand AI-based paths
  * feat: add aws security agent in scanners-user-agents.data
  * feat(932390): add shell fork bomb detection rule at PL2
  * refactor: create 941250 `.ra` file
  * refactor: create 942220 .ra file
  * refactor: create rule 931100 and 931110 `.ra` files
  * feat: Adding critical ai dirs that previously not exist
  * refactor: create 933140 and 933180 `.ra` files
  * fix(944110,944120,944130,944150,944151,944200,944210,..): don't inspect cookies twice
  * refactor: create 943120 `.ra` file
  * fix: false negative 932236
  * fix(933111): prevent whitespace padding bypass in PHP double-extension upload
  * fix(933110): prevent whitespace padding bypass in PHP upload detection
  * fix(944140): prevent whitespace padding bypass in JSP file upload detection
  * feat: update list of unix commands
  * fix(932180): prevent whitespace padding bypass in restricted file upload detection
  * fix: harden GitHub Actions workflows
  * refactor: create 941310 `.ra` files
  * docs: update README
  * refactor: create 941120 `.ra` file
  * fix(920540): allow rule exclusions for specific targets
  * fix(931130): ensure correct target is logged</changelog>
</package>
<package pkgid="3c2bcd47a8d6904df504c6e9ea13e942765e00445baeb77593e14143b6a093a25aeefff99da72d6a0156ddcf144902fb7f49ad66a4e2d0052b477c7ee880fc72" name="owasp-zap" arch="noarch">
  <version epoch="0" ver="2.14.0" rel="4.3"/>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1666958400">- Update to version 2.12.0:
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.12.0/</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1689163200">- Update to version 2.13.0:
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.13.0/</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1697112000">- Update to version 2.14.0:
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.14.0/</changelog>
</package>
<package pkgid="5a161df999ea25dbdadd463be70ffb900b6ca475209a43d8654d59c09fcec5f2b3604ac59e8aaf963489b635afd6328c12db341640d9cc678eaa8e3982984175" name="owasp-zap" arch="src">
  <version epoch="0" ver="2.14.0" rel="4.3"/>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1666958400">- Update to version 2.12.0:
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.12.0/</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1689163200">- Update to version 2.13.0:
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.13.0/</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1697112000">- Update to version 2.14.0:
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.14.0/</changelog>
</package>
<package pkgid="d4adc89dfb4c772711dc7a54d72a053c3b89424c0771a0de52d8e52ea0d9dc6f88d889940086ea23d215fc86ec71d560774726237074f674a0ec95ff38e120ce" name="pam_fido-u2f" arch="s390x">
  <version epoch="0" ver="0.0.0+git1420732548.8af92a2" rel="2.242"/>
  <changelog author="mrueckert@suse.de" date="1421668800">- initial package</changelog>
  <changelog author="mrueckert@suse.de" date="1421668801">- split out the pam module in case we need a 32bit version of it</changelog>
</package>
<package pkgid="1371f5b01dcc3059dc32ef8bf044eea36a148bf7ab51a936c4542b91a4f095c871c8e5df51cb4b7b308c2ef0936ad3c64c296b0cb24c4546c0d29985d1ac2da2" name="pam_fido-u2f-debuginfo" arch="s390x">
  <version epoch="0" ver="0.0.0+git1420732548.8af92a2" rel="2.242"/>
  <changelog author="mrueckert@suse.de" date="1421668800">- initial package</changelog>
  <changelog author="mrueckert@suse.de" date="1421668801">- split out the pam module in case we need a 32bit version of it</changelog>
</package>
<package pkgid="ddd0ce98801e8f7b312c36cfa00a8554886fd8bd8d9ca4342782c3cf3928b28fa71022ddf30b2fd32109ba16b636fc1fb40587e47142b71e00a1216daa19d35d" name="pam_mobile_otp" arch="s390x">
  <version epoch="0" ver="0.6.2" rel="1.154"/>
  <changelog author="pascal.bleser@opensuse.org" date="1339934400">- initial version (0.6.2)</changelog>
</package>
<package pkgid="2f229af44d3b0a0ffe9d0e6b9c7fbf4f9cc26c0f3e14cfd3408d9a54954165fae264028f09a1bab94bc93aa24cdf26fc3ea564528b075666e5cd985165d44f75" name="pam_mobile_otp" arch="src">
  <version epoch="0" ver="0.6.2" rel="1.154"/>
  <changelog author="pascal.bleser@opensuse.org" date="1339934400">- initial version (0.6.2)</changelog>
</package>
<package pkgid="9c0bd40b68ba62962b8e9bb00a18aab99687434d9a659f87739ac3a008439cc1196441af5d1065a1b569586e966b7f05c5d3c2db40c602ffa3b498c8c9b8bfcf" name="pam_mobile_otp-debuginfo" arch="s390x">
  <version epoch="0" ver="0.6.2" rel="1.154"/>
  <changelog author="pascal.bleser@opensuse.org" date="1339934400">- initial version (0.6.2)</changelog>
</package>
<package pkgid="cf7539e8cf5616fb465bc45d664adee9f814184457bc48c2b06e71f3f19616c1a7742371712154e438ce3fcc6dbd919c897f8ecd20229c309acbcb663898be17" name="pam_mobile_otp-debugsource" arch="s390x">
  <version epoch="0" ver="0.6.2" rel="1.154"/>
  <changelog author="pascal.bleser@opensuse.org" date="1339934400">- initial version (0.6.2)</changelog>
</package>
<package pkgid="fad3d1579d966cbec1d0731a8fd0b5b7c199faca5efd931c51ece8131017aff5726a4be39b42db897a13cfa8ed0827f178792dbe172dfb0e3d81ae5fac0518f5" name="pam_oath" arch="s390x">
  <version epoch="0" ver="2.6.14" rel="41.9"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1609243200">- Update to version 2.6.5
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.
    KEY and OTP may now be given as '-' to mean stdin, or @FILE to
    read from a particular file.  This is recommended on multi-user
    systems, since secrets as command line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.
  * Doc fixes.
- Update to version 2.6.4
  * libpskc: New --with-xmlsec-crypto-engine to hard-code crypto
    engine.  Use it like --with-xmlsec-crypto-engine=gnutls or
  - -with-xmlsec-crypto-engine=openssl if the default dynamic
    loading fails because of runtime linker search path issues.
  * oathtool --totp --verbose now prints TOTP hash mode.
  * oathtool: Hash names (e.g., SHA256) for --totp are now upper
    case.  Lower/mixed case hash names are supported for
    compatibility.
  * pam_oath: Fail gracefully for missing users.
    This allows you to incrementally add support for OATH
    authentication instead of forcing it on all users.
  * Fix libpskc memory corruption bug.
  * Fix man pages.
  * Build fixes.
- Update to version 2.6.3
  * pam_oath: Fix self-tests.
- Drop not longer needed patches:
  * 0001-Fix-no-return-in-nonvoid-function-errors-reported-by.patch
  * 0003-pam_oath-assign-safe-default-to-alwaysok-config-memb.patch
  * 0002-update_gnulibs_files.patch
  * gnulib-libio.patch
- Use source verification
- Use proper source URLs</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1611144000">- Update to version 2.6.6
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.  KEY and OTP may now be given as '-' to mean
    stdin, or @FILE to read from a particular file.  This is
    recommended on multi-user systems, since secrets as command
    line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1619956800">- Update to version 2.6.7
  * pam_oath: Support variables in usersfile string parameter.
    These changes introduce the ${USER} and ${HOME} placeholder
    values for the usersfile string in the pam_oath configuration
    file. The placeholder values allow the user credentials file
    to be stored in a file path that is relative to the user, and
    mimics similar behavior found in google-authenticator-libpam.
    The motivation for these changes is to allow for
    non-privileged processes to use pam_oath (e.g., for 2FA with
    xscreensaver). Non-privileged and non-suid programs are
    unable to use pam_oath. These changes are a proposed
    alternative to a suid helper binary as well.
  * doc: Fix project URL in man pages.
  * build: Drop use of libxml's AM_PATH_XML2 in favor of pkg-config.
  * build: Modernize autotools usage.
    Most importantly, no longer use -Werror with AM_INIT_AUTOMAKE
    to make rebuilding from source more safe with future automake
    versions.
  * Updated gnulib files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url -&gt; https</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1659441600">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1688904000">- Update to version 2.6.8
  * libpskc: Fixes for recent libxmlsec releases.
  * pam_oath: Provide fallback pam_modutil_getpwnam implementation.
  * pam_oath: Don't fail authentication when pam_modutil_getpwnam
  doesn't ** know the user when usersfile don't include ${USER}
  or ${HOME}.
  * pam_oath: Self-test improvements.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.11
  * liboath: Handle invalid base32 encoded secrets.  Fixes: #41.
  * Various build fixes including updated gnulib files.
  * Improve compatibility with recent libxmlsec.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1726228800">- Fix security issue CVE-2024-47191 by adding
  0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch .
- Add patch to implement new null_usersfile_okay argument
  42-null_usersfile_okay.patch .
- Makes this version 2.6.11.12 to be able to depend on it.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1729080000">- Update 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  with bsc#1231699 improvements for security fix CVE-2024-47191</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1770120000">- Update to version 2.6.14
  * pam_oath: Support null_usersfile_okay parameter. The argument
    no_usersfile_okay forces the module to act as if the user is
    not present in the config, if the config file does not exist.
    This has security implications only use if you know what you
    are doing. E.g. if the file is in a mount like home and that
    fails to be mounted, then this will succeed even if the OTP if
    configured for that user. Patch by Luna, Jan Zerebecki, and
    Miika Alikirri; see
    https://codeberg.org/oath-toolkit/oath-toolkit/pulls/94.
  * pam_oath README: Suggest KbdInteractiveAuthentication. Instead
    of deprecated ChallengeResponseAuthentication.
    see https://codeberg.org/oath-toolkit/oath-toolkit/pulls/112.
  * Various build fixes including updated gnulib files. Fixes
    building with glibc 2.43.
- Update to version 2.6.13
  * liboath/libpskc: Fix _FORTIFY_SOURCE build problem and allow
    configuration.
  * liboath: Fix --with-openssl builds
  * Git hosting moved from gitlab.com to codeberg.org. The new URL
    is https://codeberg.org/oath-toolkit/oath-toolkit although the
    old GitLab project will continue to be used for pipelines.
    https://gitlab.com/oath-toolkit/oath-toolkit/-/pipelines
  * Various build fixes including updated gnulib files. Gnulib
    files are no longer stored in git version control. As a
    consequence, gnulib is a required build dependency when
    building from git, see CONTRIBUTING.md.
- Update to version 2.6.12
  * Reported by Fabian Vogt (SUSE), and associated with
    CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings,
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    Quoting a writeup in an alternate patch by Matthias Gerstner
    (SUSE): With the addition of the possibility to place a
    usersfile also into a the usersfile= path specification,
    security issues sneaked in. The PAM process usually runs with
    root privileges. The file operations in an unprivileged user’s
    home directory follow symlinks both when reading and creating
    files, allowing for a potential local root exploit, because of
    the fchown() performed on the newly created usersfile.
  * We drop privileges to the user that is being logged into,
    assuming it has the necessary permissions for the usersfile
    belonging in their home directory. This restricts the ability
    for non-root users to affect files beyond their control via
    liboath.
  * liboath: Don’t follow symbolic links for usersfile updates.
    Reported by Fabian Vogt (SUSE), and associated with CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings, see
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    The fix is to open files for writing in exclusive mode (i.e., fail
    if the file exists including if it is a symbolic link).
  * oathtool: Fix test suite on 32-bit big-endian platforms.
  * libpskc: Don’t call deprecated xmlMemoryDump.
  * Various build fixes including updated gnulib files.
- Drop not longer needed patches (fixed upstream):
  * 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  * 42-null_usersfile_okay.patch
- Use %ldconfig_scriptlets macro.</changelog>
</package>
<package pkgid="95bcc4a13e43cbb99908eb5ac4d6b72b91aaf06ab558d2516b9f01cd50c4d26f66fbb34484028d4f5f13e3e3f82839e291180601c1f9b6039fcf64496b6b287c" name="pam_oath-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.14" rel="41.9"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1609243200">- Update to version 2.6.5
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.
    KEY and OTP may now be given as '-' to mean stdin, or @FILE to
    read from a particular file.  This is recommended on multi-user
    systems, since secrets as command line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.
  * Doc fixes.
- Update to version 2.6.4
  * libpskc: New --with-xmlsec-crypto-engine to hard-code crypto
    engine.  Use it like --with-xmlsec-crypto-engine=gnutls or
  - -with-xmlsec-crypto-engine=openssl if the default dynamic
    loading fails because of runtime linker search path issues.
  * oathtool --totp --verbose now prints TOTP hash mode.
  * oathtool: Hash names (e.g., SHA256) for --totp are now upper
    case.  Lower/mixed case hash names are supported for
    compatibility.
  * pam_oath: Fail gracefully for missing users.
    This allows you to incrementally add support for OATH
    authentication instead of forcing it on all users.
  * Fix libpskc memory corruption bug.
  * Fix man pages.
  * Build fixes.
- Update to version 2.6.3
  * pam_oath: Fix self-tests.
- Drop not longer needed patches:
  * 0001-Fix-no-return-in-nonvoid-function-errors-reported-by.patch
  * 0003-pam_oath-assign-safe-default-to-alwaysok-config-memb.patch
  * 0002-update_gnulibs_files.patch
  * gnulib-libio.patch
- Use source verification
- Use proper source URLs</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1611144000">- Update to version 2.6.6
  * oathtool: Support for reading KEY and OTP from standard input
    or filename.  KEY and OTP may now be given as '-' to mean
    stdin, or @FILE to read from a particular file.  This is
    recommended on multi-user systems, since secrets as command
    line parameters leak.
  * pam_oath: Fix unlikely logic fail on out of memory conditions.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1619956800">- Update to version 2.6.7
  * pam_oath: Support variables in usersfile string parameter.
    These changes introduce the ${USER} and ${HOME} placeholder
    values for the usersfile string in the pam_oath configuration
    file. The placeholder values allow the user credentials file
    to be stored in a file path that is relative to the user, and
    mimics similar behavior found in google-authenticator-libpam.
    The motivation for these changes is to allow for
    non-privileged processes to use pam_oath (e.g., for 2FA with
    xscreensaver). Non-privileged and non-suid programs are
    unable to use pam_oath. These changes are a proposed
    alternative to a suid helper binary as well.
  * doc: Fix project URL in man pages.
  * build: Drop use of libxml's AM_PATH_XML2 in favor of pkg-config.
  * build: Modernize autotools usage.
    Most importantly, no longer use -Werror with AM_INIT_AUTOMAKE
    to make rebuilding from source more safe with future automake
    versions.
  * Updated gnulib files.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url -&gt; https</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1659441600">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1688904000">- Update to version 2.6.8
  * libpskc: Fixes for recent libxmlsec releases.
  * pam_oath: Provide fallback pam_modutil_getpwnam implementation.
  * pam_oath: Don't fail authentication when pam_modutil_getpwnam
  doesn't ** know the user when usersfile don't include ${USER}
  or ${HOME}.
  * pam_oath: Self-test improvements.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.11
  * liboath: Handle invalid base32 encoded secrets.  Fixes: #41.
  * Various build fixes including updated gnulib files.
  * Improve compatibility with recent libxmlsec.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1726228800">- Fix security issue CVE-2024-47191 by adding
  0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch .
- Add patch to implement new null_usersfile_okay argument
  42-null_usersfile_okay.patch .
- Makes this version 2.6.11.12 to be able to depend on it.</changelog>
  <changelog author="Jan Zerebecki &lt;jan.suse@zerebecki.de&gt;" date="1729080000">- Update 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  with bsc#1231699 improvements for security fix CVE-2024-47191</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1770120000">- Update to version 2.6.14
  * pam_oath: Support null_usersfile_okay parameter. The argument
    no_usersfile_okay forces the module to act as if the user is
    not present in the config, if the config file does not exist.
    This has security implications only use if you know what you
    are doing. E.g. if the file is in a mount like home and that
    fails to be mounted, then this will succeed even if the OTP if
    configured for that user. Patch by Luna, Jan Zerebecki, and
    Miika Alikirri; see
    https://codeberg.org/oath-toolkit/oath-toolkit/pulls/94.
  * pam_oath README: Suggest KbdInteractiveAuthentication. Instead
    of deprecated ChallengeResponseAuthentication.
    see https://codeberg.org/oath-toolkit/oath-toolkit/pulls/112.
  * Various build fixes including updated gnulib files. Fixes
    building with glibc 2.43.
- Update to version 2.6.13
  * liboath/libpskc: Fix _FORTIFY_SOURCE build problem and allow
    configuration.
  * liboath: Fix --with-openssl builds
  * Git hosting moved from gitlab.com to codeberg.org. The new URL
    is https://codeberg.org/oath-toolkit/oath-toolkit although the
    old GitLab project will continue to be used for pipelines.
    https://gitlab.com/oath-toolkit/oath-toolkit/-/pipelines
  * Various build fixes including updated gnulib files. Gnulib
    files are no longer stored in git version control. As a
    consequence, gnulib is a required build dependency when
    building from git, see CONTRIBUTING.md.
- Update to version 2.6.12
  * Reported by Fabian Vogt (SUSE), and associated with
    CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings,
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    Quoting a writeup in an alternate patch by Matthias Gerstner
    (SUSE): With the addition of the possibility to place a
    usersfile also into a the usersfile= path specification,
    security issues sneaked in. The PAM process usually runs with
    root privileges. The file operations in an unprivileged user’s
    home directory follow symlinks both when reading and creating
    files, allowing for a potential local root exploit, because of
    the fchown() performed on the newly created usersfile.
  * We drop privileges to the user that is being logged into,
    assuming it has the necessary permissions for the usersfile
    belonging in their home directory. This restricts the ability
    for non-root users to affect files beyond their control via
    liboath.
  * liboath: Don’t follow symbolic links for usersfile updates.
    Reported by Fabian Vogt (SUSE), and associated with CVE-2024-47191.
    See https://codeberg.org/oath-toolkit/oath-toolkit/issues/43.
    Security bug triggered by new feature in pam_oath v2.6.7
    released on 2021-05-01 with the USER/HOME placeholder strings, see
    https://gitlab.com/oath-toolkit/oath-toolkit/-/merge_requests/12.
    The fix is to open files for writing in exclusive mode (i.e., fail
    if the file exists including if it is a symbolic link).
  * oathtool: Fix test suite on 32-bit big-endian platforms.
  * libpskc: Don’t call deprecated xmlMemoryDump.
  * Various build fixes including updated gnulib files.
- Drop not longer needed patches (fixed upstream):
  * 0001-usersfile-fix-potential-security-issues-in-PAM-modul.patch
  * 42-null_usersfile_okay.patch
- Use %ldconfig_scriptlets macro.</changelog>
</package>
<package pkgid="fd26a10c47caab28bbed1a6770263997b2f992bd016c087f2502ef97900072f622a5d7a55805bddc6f5745a965181e0000387f6780de1cf73b6081ba6469168a" name="pam_schroedinger" arch="s390x">
  <version epoch="0" ver="0.2s" rel="2.191"/>
  <changelog author="mrueckert@suse.de" date="1421755200">- initial package</changelog>
</package>
<package pkgid="9b116a6c8e2ac2b2ee751244b95176aa5ed4357620c6a4a8c92df1aa973089d27b629e3b73a4d2e58eb198ccd3b7176341dbe9561418ddbeccc8e02642947020" name="pam_schroedinger" arch="src">
  <version epoch="0" ver="0.2s" rel="2.191"/>
  <changelog author="mrueckert@suse.de" date="1421755200">- initial package</changelog>
</package>
<package pkgid="ebf38d1fc41185e20c628e2414c6925e6fdb49bf67a98ca9ae02f512194629b415441c8bc0b35474abc4abeab95a993468b10da678131f7f7fc35b91280c4a20" name="pam_schroedinger-debuginfo" arch="s390x">
  <version epoch="0" ver="0.2s" rel="2.191"/>
  <changelog author="mrueckert@suse.de" date="1421755200">- initial package</changelog>
</package>
<package pkgid="379ea16a74e0ee992e0d9e29fb9405411e5e1f7252c3284a773c93b32f2327e4dd9a720b6d57a266159dfafa91834942a592a492de0d6987595277d484aaab7b" name="pam_schroedinger-debugsource" arch="s390x">
  <version epoch="0" ver="0.2s" rel="2.191"/>
  <changelog author="mrueckert@suse.de" date="1421755200">- initial package</changelog>
</package>
<package pkgid="bdc0a5ca87af7a4f0f6e7e17c8dbadc28f3b47fbf3020bade8c337de913f6946565227288fe6148b9d04867acb4406d365b94f1ee05935adc6f009333ce50094" name="pam_u2f" arch="s390x">
  <version epoch="0" ver="1.4.0" rel="31.7"/>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1559649600">- Version 1.0.8 (released 2019-06-04)
  * Fix insecure debug file handling CVE-2019-12209 (bsc#1135729).
  * Fix debug file descriptor leak CVE-2019-12210 (bsc#1135727).
  * Fix a non-critical buffer oob access.
- Applied spec-cleaner</changelog>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1602763200">- Update to version 1.1.0
  * Add support to FIDO2 (move from libu2f-host+libu2f-server to libfido2)
  * Add support to User Verification
  * Add support to PIN Verification
  * Add support to Resident Credentials
  * Add support to SSH credential format
- Drop libu2f-host and libu2f-server BuildRequires
- Add BuildRequires on pkgconfig(libfido2)
- Add explicit BuildRequires on pkgconfig(libcrypto), this was being
  pulled down implicitly before.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1621512000">- Update to version 1.1.1 (released 2021-05-19)
  * Fix an issue where PIN authentication could be bypassed (CVE-2021-31924).
  * Fix an issue with nodetect and non-resident credentials.
  * Fix build issues with musl libc.
  * Add support for self-attestation in pamu2fcfg.
  * Fix minor bugs found by fuzzing.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1634126400">- Update to version 1.2.0 (released 2021-09-22)
  * Added support for EdDSA keys.
  * Added support for SSH ed25519-sk keys.
  * Added authenticator filtering based on user verification options.
  * Fixed an issue with privilege restoration on MacOS.
  * Fixed an issue where credentials created with pamu2fcfg 1.0.8 or earlier were not handled correctly if their origin and appid differed.
  * Miscellaneous improvements to the documentation.
  * Miscellaneous minor bug fixes found by fuzzing.
- Fix for bsc#1190961 - Removed hardcoded library pathnames using %{_pam_moduledir}</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1634558400">- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1653825600">- update to 1.2.1:
  * Fixed an issue where native credentials could be truncated, resulting in
    failure to authenticate or successful authentication with missing options.
  * Stricter parsing of sshformat credentials.
  * pamu2fcfg now allows a combination of the --username and --nouser options.
  * Improved documentation on FIDO2 options.
- add keyring for validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1681560000">- update to 1.3.0:
  * Add sanity checking of UV options to pamu2fcfg.
  * Add support for username expansion in the authfile path.
  * Improvements to the documentation.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1736942400">- update to 1.3.1:
  * Fix incorrect usage of PAM_IGNORE (YSA-2025-01, CVE-2025-23013).
  * Changed return value when nouserok is enabled and the user has no
  credentials, PAM_IGNORE is used instead of PAM_SUCCESS.
  * Hardened checks of authfile permissions.
  * Hardened checks for nouserok.
  * Improved debug messages.
  * Improved documentation.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1737460800">- update to 1.3.2:
  * Relax authfile permission check to a warning instead of an error to prevent
    a breaking change locking existing users out of their systems.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757678400">- update to 1.4.0:
  * Add module configuration file support (default:
    /etc/security/pam_u2f.conf).
  * Add support for building in CMake. This deprecates the
    autotools build system which is scheduled to be removed
    in a future release.
  * Terminology updates to user prompts.
- update expected signing key</changelog>
</package>
<package pkgid="cc471bb5fe10d6b4b8d149b9ba4efa4dc9993be1bdbdb93bf45384050877cd7257cbd0f9f9d30b92cc285f1e2f95d1e0e31d034d1350890cedfdfb3b71885596" name="pam_u2f" arch="src">
  <version epoch="0" ver="1.4.0" rel="31.7"/>
  <changelog author="t.gruner@katodev.de" date="1421150400">- Version 0.0.0
  2014-12-16  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * Makefile.am: More fix to Makefile.am.
  2014-12-16  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * NEWS: Updated NEWS.
  2014-12-16  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * Makefile.am, pamu2fcfg/Makefile.am: Cleaned release target.
  2014-12-16  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * Makefile.am: Changed repo variable name.
  2014-12-16  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * pam-u2f.c, util.c: Indent.
  2014-12-16  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * README: Fixed link in AsciiDoc.
  2014-12-15  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * .travis.yml: Added more asciidoc related packets to Travis build.
  2014-12-15  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * build-aux/travis: Added more ldconfig.
  2014-12-15  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * .travis.yml: Added check to Travis build.
  2014-12-15  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * build-aux/travis: Permissions.
  2014-12-15  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * .travis.yml: Removed libhidapi from Travis build.
  2014-12-15  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * .travis.yml, build-aux/travis: Added travis build.
  2014-12-15  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * Makefile.am, pamu2fcfg/Makefile.am: Fixed Makefile.
  2014-12-12  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * configure.ac: Fixed typo in configure.ac.
  2014-12-12  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * README: Updated README.
  2014-12-12  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * pamu2fcfg/pamu2fcfg.c: Removed linebreak at the end of the final
  printout.
  2014-12-12  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * .gitignore, pamu2fcfg/cmdline.c, pamu2fcfg/cmdline.ggo,
  pamu2fcfg/cmdline.h, pamu2fcfg/pamu2fcfg.1.txt,
  pamu2fcfg/pamu2fcfg.c: Added man page.
  2014-12-12  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * pamu2fcfg/pamu2fcfg.c: Improved timout presentation.
  2014-12-12  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * Makefile.am, pamu2fcfg/cmdline.c, pamu2fcfg/cmdline.h,
  pamu2fcfg/pamu2fcfg.c: Indent.
  2014-12-12  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * .gitignore, Makefile.am, configure.ac, pamu2fcfg/Makefile.am,
  pamu2fcfg/cmdline.c, pamu2fcfg/cmdline.ggo, pamu2fcfg/cmdline.h,
  pamu2fcfg/pamu2fcfg.c: Added first version of the registration tool.
  2014-12-12  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * pam-u2f.c, util.c: Fixed some warnings.
  2014-12-12  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * README, pam-u2f.c, pam_u2f.8.txt, util.h: Changed default origin
  and appid to pam://$HOSTNAME.
  2014-12-10  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * README: Typo in README.
  2014-12-10  Alessio Di Mauro &lt;alessio@yubico.com&gt;
  * .gitignore, AUTHORS, BLURB, COPYING, Makefile.am, NEWS, README,
  README.adoc, README.md, configure.ac, m4/lib-ld.m4, m4/lib-link.m4,
  m4/lib-prefix.m4, m4/manywarnings.m4, m4/warnings.m4, pam-u2f.c,
  pam_u2f.8.txt, tests/Makefile.am, tests/basic.c, util.c, util.h:
  Added initial content.
  2014-12-10  Alessio Di Mauro &lt;a-dma@users.noreply.github.com&gt;
  * Initial commit</changelog>
  <changelog author="t.gruner@katodev.de" date="1421841600">- Version 0.0.1 (released 2015-01-16)
  - Changed failure mode after authentication error.
  - Added call to setcred.</changelog>
  <changelog author="t.gruner@katodev.de" date="1436356800">- Version 1.0.1 (released 2015-06-18)
  - Minor changes to man pages and install hooks.
- Version 1.0.0 (released 2015-06-17)
  - Use XDG_CONFIG_HOME as default for config files.
  - Added manual and interactive mode.
  - Added verbose mode.</changelog>
  <changelog author="t.gruner@katodev.de" date="1444132800">- Version 1.0.2 (released 2015-10-06)
  - Changes to automake flags.
  - Improve build on OS X.
- Cleanup .spec file
- Add baselib.conf</changelog>
  <changelog author="t.gruner@katodev.de" date="1446811200">- Version 1.0.3 (released 2015-11-02)
  - Bugfix in pamu2fcfg.
  - Minor improvements for verbose mode in pamu2fcfg.</changelog>
  <changelog author="t.gruner@katodev.de" date="1452168000">- Version 1.0.4 (released 2016-01-07)
  - Fixed possible permission escalation when using XDG_CONFIG_HOME.</changelog>
  <changelog author="kbabioch@suse.com" date="1523966400">- Update to version 1.0.5:
  - General bugfixes and quality-of-life improvements.</changelog>
  <changelog author="jengelh@inai.de" date="1524052800">- Update descriptions, trim bias and other-OS stuff.
- Remove extraneous --bindir.</changelog>
  <changelog author="kbabioch@suse.com" date="1524052801">- Update to version 1.0.6:
  - Fix an issue when using syslog as a debug facility.
  - Do not honor cue if no sutable device is found.</changelog>
  <changelog author="kbabioch@suse.com" date="1526385600">- Update to version 1.0.7:
  - Add authpending_file to signal authentication activity
  - Add nodetect to skip to avoid unnecessary cue messages</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1559649600">- Version 1.0.8 (released 2019-06-04)
  * Fix insecure debug file handling CVE-2019-12209 (bsc#1135729).
  * Fix debug file descriptor leak CVE-2019-12210 (bsc#1135727).
  * Fix a non-critical buffer oob access.
- Applied spec-cleaner</changelog>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1602763200">- Update to version 1.1.0
  * Add support to FIDO2 (move from libu2f-host+libu2f-server to libfido2)
  * Add support to User Verification
  * Add support to PIN Verification
  * Add support to Resident Credentials
  * Add support to SSH credential format
- Drop libu2f-host and libu2f-server BuildRequires
- Add BuildRequires on pkgconfig(libfido2)
- Add explicit BuildRequires on pkgconfig(libcrypto), this was being
  pulled down implicitly before.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1621512000">- Update to version 1.1.1 (released 2021-05-19)
  * Fix an issue where PIN authentication could be bypassed (CVE-2021-31924).
  * Fix an issue with nodetect and non-resident credentials.
  * Fix build issues with musl libc.
  * Add support for self-attestation in pamu2fcfg.
  * Fix minor bugs found by fuzzing.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1634126400">- Update to version 1.2.0 (released 2021-09-22)
  * Added support for EdDSA keys.
  * Added support for SSH ed25519-sk keys.
  * Added authenticator filtering based on user verification options.
  * Fixed an issue with privilege restoration on MacOS.
  * Fixed an issue where credentials created with pamu2fcfg 1.0.8 or earlier were not handled correctly if their origin and appid differed.
  * Miscellaneous improvements to the documentation.
  * Miscellaneous minor bug fixes found by fuzzing.
- Fix for bsc#1190961 - Removed hardcoded library pathnames using %{_pam_moduledir}</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1634558400">- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1653825600">- update to 1.2.1:
  * Fixed an issue where native credentials could be truncated, resulting in
    failure to authenticate or successful authentication with missing options.
  * Stricter parsing of sshformat credentials.
  * pamu2fcfg now allows a combination of the --username and --nouser options.
  * Improved documentation on FIDO2 options.
- add keyring for validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1681560000">- update to 1.3.0:
  * Add sanity checking of UV options to pamu2fcfg.
  * Add support for username expansion in the authfile path.
  * Improvements to the documentation.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1736942400">- update to 1.3.1:
  * Fix incorrect usage of PAM_IGNORE (YSA-2025-01, CVE-2025-23013).
  * Changed return value when nouserok is enabled and the user has no
  credentials, PAM_IGNORE is used instead of PAM_SUCCESS.
  * Hardened checks of authfile permissions.
  * Hardened checks for nouserok.
  * Improved debug messages.
  * Improved documentation.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1737460800">- update to 1.3.2:
  * Relax authfile permission check to a warning instead of an error to prevent
    a breaking change locking existing users out of their systems.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757678400">- update to 1.4.0:
  * Add module configuration file support (default:
    /etc/security/pam_u2f.conf).
  * Add support for building in CMake. This deprecates the
    autotools build system which is scheduled to be removed
    in a future release.
  * Terminology updates to user prompts.
- update expected signing key</changelog>
</package>
<package pkgid="455b4daa8388073e1a1950a72ef3f9b6ded207dad44ac9293c40d607fcf67c82afff5e3174515432957a27aff6a313b0f4918d0760426b1abddbaf251149d698" name="pam_u2f-debuginfo" arch="s390x">
  <version epoch="0" ver="1.4.0" rel="31.7"/>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1559649600">- Version 1.0.8 (released 2019-06-04)
  * Fix insecure debug file handling CVE-2019-12209 (bsc#1135729).
  * Fix debug file descriptor leak CVE-2019-12210 (bsc#1135727).
  * Fix a non-critical buffer oob access.
- Applied spec-cleaner</changelog>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1602763200">- Update to version 1.1.0
  * Add support to FIDO2 (move from libu2f-host+libu2f-server to libfido2)
  * Add support to User Verification
  * Add support to PIN Verification
  * Add support to Resident Credentials
  * Add support to SSH credential format
- Drop libu2f-host and libu2f-server BuildRequires
- Add BuildRequires on pkgconfig(libfido2)
- Add explicit BuildRequires on pkgconfig(libcrypto), this was being
  pulled down implicitly before.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1621512000">- Update to version 1.1.1 (released 2021-05-19)
  * Fix an issue where PIN authentication could be bypassed (CVE-2021-31924).
  * Fix an issue with nodetect and non-resident credentials.
  * Fix build issues with musl libc.
  * Add support for self-attestation in pamu2fcfg.
  * Fix minor bugs found by fuzzing.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1634126400">- Update to version 1.2.0 (released 2021-09-22)
  * Added support for EdDSA keys.
  * Added support for SSH ed25519-sk keys.
  * Added authenticator filtering based on user verification options.
  * Fixed an issue with privilege restoration on MacOS.
  * Fixed an issue where credentials created with pamu2fcfg 1.0.8 or earlier were not handled correctly if their origin and appid differed.
  * Miscellaneous improvements to the documentation.
  * Miscellaneous minor bug fixes found by fuzzing.
- Fix for bsc#1190961 - Removed hardcoded library pathnames using %{_pam_moduledir}</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1634558400">- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1653825600">- update to 1.2.1:
  * Fixed an issue where native credentials could be truncated, resulting in
    failure to authenticate or successful authentication with missing options.
  * Stricter parsing of sshformat credentials.
  * pamu2fcfg now allows a combination of the --username and --nouser options.
  * Improved documentation on FIDO2 options.
- add keyring for validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1681560000">- update to 1.3.0:
  * Add sanity checking of UV options to pamu2fcfg.
  * Add support for username expansion in the authfile path.
  * Improvements to the documentation.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1736942400">- update to 1.3.1:
  * Fix incorrect usage of PAM_IGNORE (YSA-2025-01, CVE-2025-23013).
  * Changed return value when nouserok is enabled and the user has no
  credentials, PAM_IGNORE is used instead of PAM_SUCCESS.
  * Hardened checks of authfile permissions.
  * Hardened checks for nouserok.
  * Improved debug messages.
  * Improved documentation.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1737460800">- update to 1.3.2:
  * Relax authfile permission check to a warning instead of an error to prevent
    a breaking change locking existing users out of their systems.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757678400">- update to 1.4.0:
  * Add module configuration file support (default:
    /etc/security/pam_u2f.conf).
  * Add support for building in CMake. This deprecates the
    autotools build system which is scheduled to be removed
    in a future release.
  * Terminology updates to user prompts.
- update expected signing key</changelog>
</package>
<package pkgid="cdd003f5ca459cadd7f896bab761c3dc2082af79dfddee09dd5817521c26fedab63db7a04abf7d752da9d1783c99b71be05b7ecc48ead0c72b2d36e1580ed8c7" name="pam_u2f-debugsource" arch="s390x">
  <version epoch="0" ver="1.4.0" rel="31.7"/>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1559649600">- Version 1.0.8 (released 2019-06-04)
  * Fix insecure debug file handling CVE-2019-12209 (bsc#1135729).
  * Fix debug file descriptor leak CVE-2019-12210 (bsc#1135727).
  * Fix a non-critical buffer oob access.
- Applied spec-cleaner</changelog>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1602763200">- Update to version 1.1.0
  * Add support to FIDO2 (move from libu2f-host+libu2f-server to libfido2)
  * Add support to User Verification
  * Add support to PIN Verification
  * Add support to Resident Credentials
  * Add support to SSH credential format
- Drop libu2f-host and libu2f-server BuildRequires
- Add BuildRequires on pkgconfig(libfido2)
- Add explicit BuildRequires on pkgconfig(libcrypto), this was being
  pulled down implicitly before.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1621512000">- Update to version 1.1.1 (released 2021-05-19)
  * Fix an issue where PIN authentication could be bypassed (CVE-2021-31924).
  * Fix an issue with nodetect and non-resident credentials.
  * Fix build issues with musl libc.
  * Add support for self-attestation in pamu2fcfg.
  * Fix minor bugs found by fuzzing.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1634126400">- Update to version 1.2.0 (released 2021-09-22)
  * Added support for EdDSA keys.
  * Added support for SSH ed25519-sk keys.
  * Added authenticator filtering based on user verification options.
  * Fixed an issue with privilege restoration on MacOS.
  * Fixed an issue where credentials created with pamu2fcfg 1.0.8 or earlier were not handled correctly if their origin and appid differed.
  * Miscellaneous improvements to the documentation.
  * Miscellaneous minor bug fixes found by fuzzing.
- Fix for bsc#1190961 - Removed hardcoded library pathnames using %{_pam_moduledir}</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1634558400">- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1653825600">- update to 1.2.1:
  * Fixed an issue where native credentials could be truncated, resulting in
    failure to authenticate or successful authentication with missing options.
  * Stricter parsing of sshformat credentials.
  * pamu2fcfg now allows a combination of the --username and --nouser options.
  * Improved documentation on FIDO2 options.
- add keyring for validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1681560000">- update to 1.3.0:
  * Add sanity checking of UV options to pamu2fcfg.
  * Add support for username expansion in the authfile path.
  * Improvements to the documentation.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1736942400">- update to 1.3.1:
  * Fix incorrect usage of PAM_IGNORE (YSA-2025-01, CVE-2025-23013).
  * Changed return value when nouserok is enabled and the user has no
  credentials, PAM_IGNORE is used instead of PAM_SUCCESS.
  * Hardened checks of authfile permissions.
  * Hardened checks for nouserok.
  * Improved debug messages.
  * Improved documentation.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1737460800">- update to 1.3.2:
  * Relax authfile permission check to a warning instead of an error to prevent
    a breaking change locking existing users out of their systems.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757678400">- update to 1.4.0:
  * Add module configuration file support (default:
    /etc/security/pam_u2f.conf).
  * Add support for building in CMake. This deprecates the
    autotools build system which is scheduled to be removed
    in a future release.
  * Terminology updates to user prompts.
- update expected signing key</changelog>
</package>
<package pkgid="b694f4001b0929e1112827a481cbb3cf45e84f6ea81f29c59d1a829ad035ae52ffafa28ac4a29229c83a747515544ac129ec0fed9f81a6e11a3bfb37231fd722" name="pam_yubico" arch="s390x">
  <version epoch="0" ver="2.27" rel="22.46"/>
  <changelog author="t.gruner@katodev.de" date="1444046400">- Version 2.20 (released 2015-09-22)
  - Add cainfo option to allow usage of a cabundle instead of path.
  - Support comments in authfile.
  - For challenge response with system-wide directory, write the files as root instead of the user.
- add baselib.conf</changelog>
  <changelog author="t.gruner@katodev.de" date="1461585600">- Version 2.21 (released 2016-02-19)
  - Add proxy support for yubico-c-client.
  - Check that conv is set before trying to use it fixes a crash bug with the osx loginwindow.
  - Add building of a mac installer.</changelog>
  <changelog author="t.gruner@katodev.de" date="1465473600">- Version 2.22 (released 2016-05-23)
  - Documentation improvements.
  - Retain ownership and permission of challenge files (issue #92).
  - Make dependency on yubico-c-client 2.15 clearer.</changelog>
  <changelog author="meissner@suse.com" date="1511784000">- Version 2.24 (released 2016-11-25) (bsc#1067191)
  - Debug mode changed, allows file output with debug_file.
  - Fixup returning user-unknown correctly.
- Version 2.23 (released 2016-06-15)
  - Fix an issue where a failure to set permissions was wrongly outputted.</changelog>
  <changelog author="kbabioch@suse.com" date="1522152000">- Version 2.25 (released 2018-03-27):
  - Security: Storage of challenges in path with restricted permissions
  - Perform OTP validation only if token is authorized
  - Return early if the user has no authorized tokens
  - Compare OTP IDs against `yubi_attr` only
  - Add nullok support to challenge-response mode
  - Several improvements to the documentation
  - Improved debugging output and test cases</changelog>
  <changelog author="kbabioch@suse.com" date="1522843200">- leaking-file-descriptor.patch: Close the authfile before returning
  to make sure no file descriptors are leaked (bsc#1088027).</changelog>
  <changelog author="kbabioch@suse.com" date="1523620800">- Added patches:
  - cloexec.patch: Harden file descriptor handling (boo#1089517)
  - compiler-warnings-pointer.patch: Fix compiler warnings due to wrong pointer
    casts (boo#1089518)
  - compiler-warnings-format-strings.patch: Fix compiler warnings due to wrong
    format string specifiers (boo#1089519)
  - util_test-mkdtemp.patch: Use mkdtemp() instead of tempnam() (boo#1089520)</changelog>
  <changelog author="kbabioch@suse.com" date="1524225600">- Version 2.26 (released 2018-04-20)
  - Make sure to close authfile (CVE-2018-9275 bsc#1088027).
  - Fix compiler warnings.
  - Open file descriptors with O_CLOEXEC.
  - Use mkostemp() instead of mkstemp().
- Dropped patches that are included upstream:
  - cloexec.patch
  - compiler-warnings-format-strings.patch
  - compiler-warnings-pointer.patch
  - leaking-file-descriptor.patch
  - util_test-mkdtemp.patch</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1621252800">- Version 2.27 (released 2021-04-09)
  - Add always_prompt configuration option.
  - Add client certificate support for ldap.
  - Add starttls support for ldap.
  - Add ldap_bind_as_user support.
  - Parsing, cleanliness and string fixes.
  - Documentation and spelling fixes.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1634558400">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
</package>
<package pkgid="9826d67fc1436d66d740d3865f282fd032d33f101dc1728e198d2c92bee096a2aceb8c6708750e7bd61111eeadda35c87391c5d880d116366fcf1530f928640b" name="pam_yubico" arch="src">
  <version epoch="0" ver="2.27" rel="22.46"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296388800">- Initial version</changelog>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296388801">- fix some wrong ldap calls</changelog>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296388802">- run make check</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1299153600">- Use an slightly newer git snapshot</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1299931200">- Update git snapshot</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1300363200">- Update GIT snapshot</changelog>
  <changelog author="mrueckert@suse.de" date="1420632000">- Version 2.17 (released 2014-08-26)
  - Fix a bug with the 'urllist' parameter where urls would be
    forgotten.
  - Manpages converted to asciidoc.
- Version 2.16 (released 2014-06-10)
  - Fix a crashbug with the new parameter 'urllist'
- Version 2.15 (released 2014-04-30)
  - Added new parameter 'urllist'
  - Added pam_yubico(8) man page.
  - Fix memory leak.
  - Bump yubico-c-client version requirement to 2.12.
- Version 2.14 (released 2013-09-27)
  - Don't install internal header files.
  - Don't print debug info when the "debug" parameter is not given.
  - Use PBKDF2 to process expected reply for challenge-response
    mode.
  - Fixup memory leaks and leaks of privilege.
  - Let return values reflect whether the user wasn't found or
    other error.
- Version 2.13 (released 2013-03-01)
  - Fix a bug in the version check to support major version &gt; 2
    (neo).  Patch from https://github.com/wwest4
  - Give ykpamcfg an option for specifying path.
- Version 2.12 (released 2012-06-15)
  - Only use libyubikey when --with-cr is used.
  - Set correct permissions on tempfile.
  - YubiKey 2.2 contains a bug in challenge-response that makes it
    output the same response to all challenges unless HMAC_LT64 is
    set. Add warnings to ykpamcfg and a warning through conversate
    in the pam module. Keys programmed like this should be
    reprogrammed with the HMAC_LT64 flag set.
- Version 2.11 (released 2012-02-10)
  - Fix crash-bug with challenge-response mode when button press is
    required, but button is never pressed. Reported and fixed by
    Lingzhu Xiang &lt;xianglingzhu@gmail.com&gt;.
  - Fix a memset() with wrong size as reported by clang, as well as
    some other problems/warnings when building on Mac OS X, thanks
    to Clemens Lang &lt;neverpanic@gmail.com&gt;.
  - Add prefix-matching of LDAP fetched values, so you can store
    the token-to-user mapping in a multi-value attribute with
    values like "yubikey:publicid", "other-token:something" etc.
    Patch by Remi Mollon &lt;remi.mollon@cern.ch&gt;.
- Version 2.10 (released 2011-12-14)
  - Drop permissions (to the user that is trying to authenticate)
    before accessing files in the users home directory. Largely
    based on a patch by Ricky Zhou &lt;ricky@fedoraproject.org&gt;.
    Thanks!
  - Restore challenge-response support - version 2.7 was supposed
    to make the dependency on libykpers optional, but in reality
    accidentally disabled challenge-response for all
    configurations. As before, use --without-cr to compile
    pam_yubico without the ykpers dependency.
- Version 2.9 (released 2011-11-17)
  - Security: Explicitly request ykclient to verify server
    signature.  ykclient &lt;= 2.5 strangely enough defaults to
    signing requests, but not verifying signatures in responses
    when it is supplied with a client key.  Reported and patched by
    Dominic Rutherford &lt;dominic@rutherfordfamily.co.uk&gt;.
- Version 2.8 (released 2011-08-26)
  - Fix big security hole: Authentication succeeded when no
    password was given, unless use_first_pass was being used.  This
    is fatal if pam_yubico is considered 'sufficient' in the PAM
    configuration.  Reported and patched by Nanakos Chrysostomos
    &lt;nanakos@wired-net.gr&gt;.
- Version 2.7 (released 2011-06-07)
  - Make dependency on libykpers optional.  Use --without-cr to
    force it.  Reported by Jussi Sallinen &lt;jussi@jus.si&gt;.
- Version 2.6 (released 2011-04-11)
  - This release includes lots of patches by members of our open
    source community. Thank you all!
  - Add Challenge-Response mode for offline validation (requires
    YubiKey 2.2). Patch by Tollef Fog Heen.
  - Eliminate all problems with pam_get_data by simply getting rid
    of that code completely. This seems to have caused problems for
    a lot of people.
  - Numerous LDAP bug fixes and improvements, including community
    patches by judas.iscariote and maxsanna81@gmail.com. Change to
    LDAPv3, since v2 has been declared historic for a looong time.
  - Support passing capath parameter to Yubico validation client.
    Patch by Remi Mollon.
  - Support public id's longer/shorter than 6 bytes. Patch by
    fraser.scott@gmail.com.
  - Convert documentation to Asciidoc format used in Github wiki.
  - Try to never log passwords in debug logs.
- new build requires:
  pkg-config
  libyubikey-devel
  libykpers-devel
- use correct license string: BSD-2-Clause
- remove autoreconf call: no longer needed with release tarball
- package more documentation</changelog>
  <changelog author="t.gruner@katodev.de" date="1421841600">- Move ykpamcfg from /usr/sbin to /usr/bin</changelog>
  <changelog author="t.gruner@katodev.de" date="1424088000">- Version 2.18 (released 2015-02-12)
  - Fix a memory leak of the pam response data.
  - Add more tests.
  - Add version flag to ykpamcfg.
- Remove "make check" in spec-file. ( BuildRequires: perl(Net::LDAP::Server) )</changelog>
  <changelog author="t.gruner@katodev.de" date="1427371200">- Version 2.19 (released 2015-03-23)
  - Add new ldap functionality ldap_bind_user and ldap_bind_password
    for authenticated binds ldap_filter for using subtree search and
    a filter ldap_cacertfile to use a specific cacert for ldaps</changelog>
  <changelog author="t.gruner@katodev.de" date="1444046400">- Version 2.20 (released 2015-09-22)
  - Add cainfo option to allow usage of a cabundle instead of path.
  - Support comments in authfile.
  - For challenge response with system-wide directory, write the files as root instead of the user.
- add baselib.conf</changelog>
  <changelog author="t.gruner@katodev.de" date="1461585600">- Version 2.21 (released 2016-02-19)
  - Add proxy support for yubico-c-client.
  - Check that conv is set before trying to use it fixes a crash bug with the osx loginwindow.
  - Add building of a mac installer.</changelog>
  <changelog author="t.gruner@katodev.de" date="1465473600">- Version 2.22 (released 2016-05-23)
  - Documentation improvements.
  - Retain ownership and permission of challenge files (issue #92).
  - Make dependency on yubico-c-client 2.15 clearer.</changelog>
  <changelog author="meissner@suse.com" date="1511784000">- Version 2.24 (released 2016-11-25) (bsc#1067191)
  - Debug mode changed, allows file output with debug_file.
  - Fixup returning user-unknown correctly.
- Version 2.23 (released 2016-06-15)
  - Fix an issue where a failure to set permissions was wrongly outputted.</changelog>
  <changelog author="kbabioch@suse.com" date="1522152000">- Version 2.25 (released 2018-03-27):
  - Security: Storage of challenges in path with restricted permissions
  - Perform OTP validation only if token is authorized
  - Return early if the user has no authorized tokens
  - Compare OTP IDs against `yubi_attr` only
  - Add nullok support to challenge-response mode
  - Several improvements to the documentation
  - Improved debugging output and test cases</changelog>
  <changelog author="kbabioch@suse.com" date="1522843200">- leaking-file-descriptor.patch: Close the authfile before returning
  to make sure no file descriptors are leaked (bsc#1088027).</changelog>
  <changelog author="kbabioch@suse.com" date="1523620800">- Added patches:
  - cloexec.patch: Harden file descriptor handling (boo#1089517)
  - compiler-warnings-pointer.patch: Fix compiler warnings due to wrong pointer
    casts (boo#1089518)
  - compiler-warnings-format-strings.patch: Fix compiler warnings due to wrong
    format string specifiers (boo#1089519)
  - util_test-mkdtemp.patch: Use mkdtemp() instead of tempnam() (boo#1089520)</changelog>
  <changelog author="kbabioch@suse.com" date="1524225600">- Version 2.26 (released 2018-04-20)
  - Make sure to close authfile (CVE-2018-9275 bsc#1088027).
  - Fix compiler warnings.
  - Open file descriptors with O_CLOEXEC.
  - Use mkostemp() instead of mkstemp().
- Dropped patches that are included upstream:
  - cloexec.patch
  - compiler-warnings-format-strings.patch
  - compiler-warnings-pointer.patch
  - leaking-file-descriptor.patch
  - util_test-mkdtemp.patch</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1621252800">- Version 2.27 (released 2021-04-09)
  - Add always_prompt configuration option.
  - Add client certificate support for ldap.
  - Add starttls support for ldap.
  - Add ldap_bind_as_user support.
  - Parsing, cleanliness and string fixes.
  - Documentation and spelling fixes.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1634558400">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
</package>
<package pkgid="6416a6052ddbc1706fed1bd47fa0e6b7873db11e66fc8eb92e6077b5229c8732ac9840ac454dac9e10954e6a7764ece787c0d3a84d2c6ea2ae485eefe2732f60" name="pam_yubico-debuginfo" arch="s390x">
  <version epoch="0" ver="2.27" rel="22.46"/>
  <changelog author="t.gruner@katodev.de" date="1444046400">- Version 2.20 (released 2015-09-22)
  - Add cainfo option to allow usage of a cabundle instead of path.
  - Support comments in authfile.
  - For challenge response with system-wide directory, write the files as root instead of the user.
- add baselib.conf</changelog>
  <changelog author="t.gruner@katodev.de" date="1461585600">- Version 2.21 (released 2016-02-19)
  - Add proxy support for yubico-c-client.
  - Check that conv is set before trying to use it fixes a crash bug with the osx loginwindow.
  - Add building of a mac installer.</changelog>
  <changelog author="t.gruner@katodev.de" date="1465473600">- Version 2.22 (released 2016-05-23)
  - Documentation improvements.
  - Retain ownership and permission of challenge files (issue #92).
  - Make dependency on yubico-c-client 2.15 clearer.</changelog>
  <changelog author="meissner@suse.com" date="1511784000">- Version 2.24 (released 2016-11-25) (bsc#1067191)
  - Debug mode changed, allows file output with debug_file.
  - Fixup returning user-unknown correctly.
- Version 2.23 (released 2016-06-15)
  - Fix an issue where a failure to set permissions was wrongly outputted.</changelog>
  <changelog author="kbabioch@suse.com" date="1522152000">- Version 2.25 (released 2018-03-27):
  - Security: Storage of challenges in path with restricted permissions
  - Perform OTP validation only if token is authorized
  - Return early if the user has no authorized tokens
  - Compare OTP IDs against `yubi_attr` only
  - Add nullok support to challenge-response mode
  - Several improvements to the documentation
  - Improved debugging output and test cases</changelog>
  <changelog author="kbabioch@suse.com" date="1522843200">- leaking-file-descriptor.patch: Close the authfile before returning
  to make sure no file descriptors are leaked (bsc#1088027).</changelog>
  <changelog author="kbabioch@suse.com" date="1523620800">- Added patches:
  - cloexec.patch: Harden file descriptor handling (boo#1089517)
  - compiler-warnings-pointer.patch: Fix compiler warnings due to wrong pointer
    casts (boo#1089518)
  - compiler-warnings-format-strings.patch: Fix compiler warnings due to wrong
    format string specifiers (boo#1089519)
  - util_test-mkdtemp.patch: Use mkdtemp() instead of tempnam() (boo#1089520)</changelog>
  <changelog author="kbabioch@suse.com" date="1524225600">- Version 2.26 (released 2018-04-20)
  - Make sure to close authfile (CVE-2018-9275 bsc#1088027).
  - Fix compiler warnings.
  - Open file descriptors with O_CLOEXEC.
  - Use mkostemp() instead of mkstemp().
- Dropped patches that are included upstream:
  - cloexec.patch
  - compiler-warnings-format-strings.patch
  - compiler-warnings-pointer.patch
  - leaking-file-descriptor.patch
  - util_test-mkdtemp.patch</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1621252800">- Version 2.27 (released 2021-04-09)
  - Add always_prompt configuration option.
  - Add client certificate support for ldap.
  - Add starttls support for ldap.
  - Add ldap_bind_as_user support.
  - Parsing, cleanliness and string fixes.
  - Documentation and spelling fixes.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1634558400">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
</package>
<package pkgid="9f59cef0a72d596f679c8c62c575fb6cbf4395b61fa77f0720657ac7bdadb8866ef69648d3c34bae458066793e03c69442b09ed2db826d34871b5181782a9971" name="pam_yubico-debugsource" arch="s390x">
  <version epoch="0" ver="2.27" rel="22.46"/>
  <changelog author="t.gruner@katodev.de" date="1444046400">- Version 2.20 (released 2015-09-22)
  - Add cainfo option to allow usage of a cabundle instead of path.
  - Support comments in authfile.
  - For challenge response with system-wide directory, write the files as root instead of the user.
- add baselib.conf</changelog>
  <changelog author="t.gruner@katodev.de" date="1461585600">- Version 2.21 (released 2016-02-19)
  - Add proxy support for yubico-c-client.
  - Check that conv is set before trying to use it fixes a crash bug with the osx loginwindow.
  - Add building of a mac installer.</changelog>
  <changelog author="t.gruner@katodev.de" date="1465473600">- Version 2.22 (released 2016-05-23)
  - Documentation improvements.
  - Retain ownership and permission of challenge files (issue #92).
  - Make dependency on yubico-c-client 2.15 clearer.</changelog>
  <changelog author="meissner@suse.com" date="1511784000">- Version 2.24 (released 2016-11-25) (bsc#1067191)
  - Debug mode changed, allows file output with debug_file.
  - Fixup returning user-unknown correctly.
- Version 2.23 (released 2016-06-15)
  - Fix an issue where a failure to set permissions was wrongly outputted.</changelog>
  <changelog author="kbabioch@suse.com" date="1522152000">- Version 2.25 (released 2018-03-27):
  - Security: Storage of challenges in path with restricted permissions
  - Perform OTP validation only if token is authorized
  - Return early if the user has no authorized tokens
  - Compare OTP IDs against `yubi_attr` only
  - Add nullok support to challenge-response mode
  - Several improvements to the documentation
  - Improved debugging output and test cases</changelog>
  <changelog author="kbabioch@suse.com" date="1522843200">- leaking-file-descriptor.patch: Close the authfile before returning
  to make sure no file descriptors are leaked (bsc#1088027).</changelog>
  <changelog author="kbabioch@suse.com" date="1523620800">- Added patches:
  - cloexec.patch: Harden file descriptor handling (boo#1089517)
  - compiler-warnings-pointer.patch: Fix compiler warnings due to wrong pointer
    casts (boo#1089518)
  - compiler-warnings-format-strings.patch: Fix compiler warnings due to wrong
    format string specifiers (boo#1089519)
  - util_test-mkdtemp.patch: Use mkdtemp() instead of tempnam() (boo#1089520)</changelog>
  <changelog author="kbabioch@suse.com" date="1524225600">- Version 2.26 (released 2018-04-20)
  - Make sure to close authfile (CVE-2018-9275 bsc#1088027).
  - Fix compiler warnings.
  - Open file descriptors with O_CLOEXEC.
  - Use mkostemp() instead of mkstemp().
- Dropped patches that are included upstream:
  - cloexec.patch
  - compiler-warnings-format-strings.patch
  - compiler-warnings-pointer.patch
  - leaking-file-descriptor.patch
  - util_test-mkdtemp.patch</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1621252800">- Version 2.27 (released 2021-04-09)
  - Add always_prompt configuration option.
  - Add client certificate support for ldap.
  - Add starttls support for ldap.
  - Add ldap_bind_as_user support.
  - Parsing, cleanliness and string fixes.
  - Documentation and spelling fixes.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1634558400">- Use %_pam_moduledir instead of hardcoding %{_lib}/security
- Define macro _pam_moduledir if not set to fix builds for Leap and SLE</changelog>
</package>
<package pkgid="3e8a4ed2693ce770d88dbd0882dfb809d650f9a9e0ae410270ac5e36fa9ebad5e4f1f130b02106bd47603c1dd0490b63b4887e63fee43a085797be2a27fae076" name="passwordsafe" arch="s390x">
  <version epoch="0" ver="1.22.0" rel="2.10"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1654603200">- update to 1.15.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.15.0
- no more sig file for tarball</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1673352000">- update to 1.16.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.16.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1688385600">- update to 1.17.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.17.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1688385601">- refreshed linking.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1696680000">- update to 1.18.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.18.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1706011200">- update to 1.18.2
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.18.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1719921600">- update to 1.19.1
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.19.0
  https://github.com/pwsafe/pwsafe/releases/tag/1.19.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1731067200">- update to 1.20.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.20.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1743163200">- update to 1.21.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.21.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752235200">- update to 1.22.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.22.0</changelog>
</package>
<package pkgid="15b22c9a6862ea27af912f88bccbe2b913bc19a15466e4b3a1f973bf1cb65d83e498b196f7483a0287306cb731508bb5ce9cf15976565916b3d7b8347a17bb43" name="passwordsafe" arch="src">
  <version epoch="0" ver="1.22.0" rel="2.10"/>
  <changelog author="mrueckert@suse.de" date="1455105600">- update to 0.98~beta
- drop patches which are included upstream:
  passwordsafe-use___BYTE_ORDER.patch
  pwsafe-optflags.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1489838400">- update to 1.01~beta
- replaced helpdir patch with pwsafe-1.01BETA_helpdir.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1514894400">- update to 1.03~beta
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
- refresh pwsafe-1.01BETA_helpdir.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1578139200">- update to 1.09.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
- drop pwsafe-1.01BETA_helpdir.patch: upstream has better default
  paths now and we will use them.
- add linking.patch: move linked libraries to the proper cmake
  targets and make sure binaries are linked as PIE.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1578139201">- split out cli package</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1587729600">- update to 1.10.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
- update linking patch to also apply the linker settings to the cli
  binary</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1592049600">- update to 1.11.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1604232000">- update to 1.12.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
- refreshed linking.patch
- track series file to make quilt easier</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1604923200">- limit to wxWidgets-3_0-devel, newer APIs are not supported yet</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1635681600">- update to 1.14.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
- refreshed linking.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1654603200">- update to 1.15.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.15.0
- no more sig file for tarball</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1673352000">- update to 1.16.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.16.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1688385600">- update to 1.17.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.17.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1688385601">- refreshed linking.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1696680000">- update to 1.18.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.18.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1706011200">- update to 1.18.2
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.18.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1719921600">- update to 1.19.1
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.19.0
  https://github.com/pwsafe/pwsafe/releases/tag/1.19.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1731067200">- update to 1.20.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.20.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1743163200">- update to 1.21.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.21.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752235200">- update to 1.22.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.22.0</changelog>
</package>
<package pkgid="426416d51d9c21679ff9cf75dd6ddc64b062ec8ac36286294dcb77cc0e448167f3fcd89cdf2a4e1bdef8e353dc0b8ea3b6a2d6fdd8441bb5eee58860b80f752e" name="passwordsafe-cli" arch="s390x">
  <version epoch="0" ver="1.22.0" rel="2.10"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1654603200">- update to 1.15.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.15.0
- no more sig file for tarball</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1673352000">- update to 1.16.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.16.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1688385600">- update to 1.17.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.17.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1688385601">- refreshed linking.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1696680000">- update to 1.18.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.18.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1706011200">- update to 1.18.2
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.18.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1719921600">- update to 1.19.1
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.19.0
  https://github.com/pwsafe/pwsafe/releases/tag/1.19.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1731067200">- update to 1.20.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.20.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1743163200">- update to 1.21.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.21.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752235200">- update to 1.22.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.22.0</changelog>
</package>
<package pkgid="843a027d3f10c25ea56ac299928aeaec8ee3aa073d6955216366113d6722a11c61bb7743cb6509f88741b5a108e3bb9645cb7a2eb4905f18bbdcda5e3f812280" name="passwordsafe-cli-debuginfo" arch="s390x">
  <version epoch="0" ver="1.22.0" rel="2.10"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1654603200">- update to 1.15.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.15.0
- no more sig file for tarball</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1673352000">- update to 1.16.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.16.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1688385600">- update to 1.17.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.17.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1688385601">- refreshed linking.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1696680000">- update to 1.18.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.18.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1706011200">- update to 1.18.2
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.18.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1719921600">- update to 1.19.1
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.19.0
  https://github.com/pwsafe/pwsafe/releases/tag/1.19.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1731067200">- update to 1.20.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.20.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1743163200">- update to 1.21.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.21.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752235200">- update to 1.22.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.22.0</changelog>
</package>
<package pkgid="ce0cbcd41176e5dcf1922802bc19bd3fccf470a593f496634f1bb25c47395d8b2f7238149bd5da13e31bebc025b1ba159f18f79e3506c2b04f9a125e3659bbc5" name="passwordsafe-debuginfo" arch="s390x">
  <version epoch="0" ver="1.22.0" rel="2.10"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1654603200">- update to 1.15.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.15.0
- no more sig file for tarball</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1673352000">- update to 1.16.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.16.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1688385600">- update to 1.17.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.17.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1688385601">- refreshed linking.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1696680000">- update to 1.18.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.18.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1706011200">- update to 1.18.2
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.18.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1719921600">- update to 1.19.1
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.19.0
  https://github.com/pwsafe/pwsafe/releases/tag/1.19.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1731067200">- update to 1.20.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.20.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1743163200">- update to 1.21.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.21.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752235200">- update to 1.22.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.22.0</changelog>
</package>
<package pkgid="c9ce1865949c61e2a6bf416177416de60ea54e68f72f747a4d992dab268ba6e61817f771fc8e7b9f14e03d6f8110eb83f4ba40c6b4b8fcaacdbff4c22cbe1c92" name="passwordsafe-debugsource" arch="s390x">
  <version epoch="0" ver="1.22.0" rel="2.10"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1654603200">- update to 1.15.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.15.0
- no more sig file for tarball</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1673352000">- update to 1.16.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.16.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1688385600">- update to 1.17.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.17.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1688385601">- refreshed linking.patch</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1696680000">- update to 1.18.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.18.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1706011200">- update to 1.18.2
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.18.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1719921600">- update to 1.19.1
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.19.0
  https://github.com/pwsafe/pwsafe/releases/tag/1.19.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1731067200">- update to 1.20.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.20.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1743163200">- update to 1.21.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.21.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752235200">- update to 1.22.0
  see installed /usr/share/doc/packages/passwordsafe/ChangeLog.txt
  https://github.com/pwsafe/pwsafe/releases/tag/1.22.0</changelog>
</package>
<package pkgid="809cf08373b3d3ea394844b8cdfc4c3bb8b39fd1866eb21a6d75f988958b3dbe329dbee37e18497ebdd3fc3a01b609603df724b1559b8098f3ee68e88635e589" name="pax-utils" arch="s390x">
  <version epoch="0" ver="1.3.8" rel="137.7"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1595332800">- Update to 1.2.6.
- Changes since 1.2.4:
  - Add RISC-V to the list of architectures in ELF
  - dumpelf.c: add missing break when decoding SHT_GNU_LIBLIST.
  - lddtree.py: resolve python location through PATH.
  - lddtree: Put ldso interpreter library path at end.  https://crbug.com/917193
  - scanelf.c: be more verbose at saying what all the addresses mean. https://bugs.gentoo.org/713082
  - scanelf.c: don't crash in -v mode on non-functions. https://bugs.gentoo.org/713082
  - security.c: allow 'semtimedop' in seccomp sandbox. https://bugs.gentoo.org/709794
  - security.c: allow 'statx' in seccomp sandbox. https://bugs.gentoo.org/717300</changelog>
  <changelog author="Gianluca Gabrielli &lt;gianluca.gabrielli@suse.com&gt;" date="1612180800">- Update to 1.2.8.
- Changes since 1.2.6:
  - Add support for arm64 arch.
  - Add flag -U/--uuid to dump the object's UUID.
    This is in particular useful when comparing against TextAPI stubs, .tbd files.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1643198400">- Update to 1.3.3:
  * seccomp: allow getrandom() call (glibc-2.34+)
  * seccomp-bpf: fix warnings by not using nexted open comments
  * seccomp: fix build failure on mips (use _MIP_SIM tests)
  * lddtree: respect (destination) root with --argv0 interp probing
  * security: restore syscalls accidentally dropped
  * security: pregen seccomp bpf programs
  * paxldso: fix pointer style
- Changes since 1.2.8:
  * dumpelf: constify elfobj in APIs
  * dumpelf: add libFuzzer support
  * fuzz: add basic framework for using libFuzzer
  * paxldso: add support for "new" glibc cache format
  * lddtree: add --cwd option
  * lddtree: handle relative ldpaths
  * lddtree: handle ${ORIGIN} like $ORIGIN
  * lddtree: use ldso's --argv0 when available
  * lddtree: apply functools cache to some repeated filesystem calls
  * lddtree: don't crash when interp is missing
  * lddtree: require Python 3.6+
  * lddtree: re-enable long line checks
  * pylintrc: adjust python code to 4 space indent
  * glob is used in paxldso.c for NetBSD too, but glob.h is not included in porting.h for NetBSD.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- updated url to https</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1651665600">- Update to 1.3.4
  * paxelf: add LoongArch to recognized ELF machine types
  * lddtree: add argcomplete support if available
  * lddtree: add --skip-missing
    Allow explicitly ignoring missing files.
  * seccomp: allow madvise() call (glibc 2.35+)
  * seccomp: mark arrays const+static
    This generates better code, although it doesn't super matter since
    this is only used at build time.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1673524800">- Update to 1.3.6
  * Build system changed to Meson
  * lddtree: specify utf-8 encoding with text files
  * lddtree: Add logging for ELFParseError
  * lddtree: avoid shadowing function args</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1675339200">- update to 1.3.7:
  * meson: fix installation of man pages w/o xmlto</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1692100800">- Fix lddtree to call python3 (boo#1213178)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1727179200">- Update to 1.3.8
  * ar: handle invalid ascii numbers better
  * ar: handle invalid extended filename offsets
  * ar: switch from alloca to malloc
  * dumpelf: check dyn pointer before DT_NULL check too
  * dumpelf: free elf after fuzzing it to avoid leaking
  * dumpelf: improve note memory check
  * dumpelf: limit note name display
  * lddtree: Add --wrapper-preload
  * lddtree: add LD_ARGV0_REL
  * lddtree: keep relativeness of invoked program in elf wrapper
  * lddtree: use readlink -f for absolute links
  * paxelf: reject ELFs with incomplete Ehdr structures
  * paxelf: use correct format string
  * pspax: fix buffer limiting in cmdline reading
  * pspax: fix error handling when reading attr or ipaddr fail
  * pspax: fix libcap memory leaks
  * pspax: replace proc_fopen with fopenat_r
  * pspax: rework &amp; document get_proc_name
  * pspax: switch from fgets to getline
  * scanelf: fix hashtable overflow checks
  * seccomp: make socket() fail with -ENOSYS
  * unify usage() output across all the tools</changelog>
  <changelog author="llyyr &lt;llyyr.public@gmail.com&gt;" date="1761566400">- Add python3-pyelftools as runtime dependency. This is required
  for lddtree.</changelog>
</package>
<package pkgid="62f44f097f872e2a3b0b877db1f4fd56e798c591d5b3a61e9fb5592d9c6d2caf30438c909f251d348718603a8e91ea19289db558711f8475774b8fbb8131f7b4" name="pax-utils" arch="src">
  <version epoch="0" ver="1.3.8" rel="137.7"/>
  <changelog author="lnussel@suse.de" date="1163505600">- new version 0.1.13
  * supports scanning archives and searching for specific sections</changelog>
  <changelog author="lnussel@suse.de" date="1169812800">- new version 0.1.15
  * Support added for displaying em_machine via %a format flag in scanelf
  * Make scanelf_file_bind() not output anything if quiet mode and the ELF is
    static or not setuid.
  * pspax: new options -u and -g</changelog>
  <changelog author="lnussel@suse.de" date="1207051200">- new version 0.1.16
  * mostly manpage and portability improvements</changelog>
  <changelog author="coolo@novell.com" date="1245412800">- disable as-needed for this package as it fails to build with it</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1376913600">- pax-utils-lib64.patch: scanelf -l does not scan lib64 as
  it should in x86_64</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1423483200">- Pax utils 0.9.2, no changelog found
- Update source URL.
- Switch to autoconf based build
- pax-utils-file-contains-date-and-time.patch: Do not
  include time stamps in binaries
- pax-utils-handle-lib64.patch replaces pax-utils-lib64.patch</changelog>
  <changelog author="aloisio@gmx.com" date="1478174400">- Update to 1.1.6 (no changelog found)
- Spec cleanup
- Dropped pax-utils-file-contains-date-and-time.patch</changelog>
  <changelog author="lnussel@suse.de" date="1488196800">- update to 1.2.2
  * misc fd and memory leak fixes
  Add patches from git (boo#1026959)
  0004-scanelf-check-range-of-hash-bucket.patch
  0003-dumpelf-check-for-invalid-notes.patch
  0001-dumpelf-check-for-invalid-section-entry-sizes.patch
  0002-dumpelf-check-for-invalid-program-headers.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1516276800">- Drop unknown parameter "-q" from autosetup.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1561982400">- Update to 1.2.4.
- Removed patches that have since been committed to upstream (1.2.3):
  - 0001-dumpelf-check-for-invalid-section-entry-sizes.patch
    https://github.com/gentoo/pax-utils/commit/4609f57a690b4a5670baeb93167dab5300d07d4e
  - 0002-dumpelf-check-for-invalid-program-headers.patch
    https://github.com/gentoo/pax-utils/commit/18ded0e30ee5a84260cceb80d818b9c21ade4c76
  - 0003-dumpelf-check-for-invalid-notes.patch
    https://github.com/gentoo/pax-utils/commit/10a9643d90a1ba6058a66066803fac6cf43f6917
  - 0004-scanelf-check-range-of-hash-bucket.patch
    https://github.com/gentoo/pax-utils/commit/e577c5b7e230c52e5fc4fa40e4e9014c634b3c1d
- Changes since 1.2.2:
  - paxldso: properly decode the flags bits in the cache
    This fixes handling of multiple ABIs for a single arch like x86/x86_64/x32
  or mips o32/n32/n64.  It also fixes decoding of arm float libs.
  - dumpelf: add support for dumping notes
  - dumpelf: add support for prelink sections
  - scanmacho: fix 126 byte limit on -E option
  - security fixes (mentioned above)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1595332800">- Update to 1.2.6.
- Changes since 1.2.4:
  - Add RISC-V to the list of architectures in ELF
  - dumpelf.c: add missing break when decoding SHT_GNU_LIBLIST.
  - lddtree.py: resolve python location through PATH.
  - lddtree: Put ldso interpreter library path at end.  https://crbug.com/917193
  - scanelf.c: be more verbose at saying what all the addresses mean. https://bugs.gentoo.org/713082
  - scanelf.c: don't crash in -v mode on non-functions. https://bugs.gentoo.org/713082
  - security.c: allow 'semtimedop' in seccomp sandbox. https://bugs.gentoo.org/709794
  - security.c: allow 'statx' in seccomp sandbox. https://bugs.gentoo.org/717300</changelog>
  <changelog author="Gianluca Gabrielli &lt;gianluca.gabrielli@suse.com&gt;" date="1612180800">- Update to 1.2.8.
- Changes since 1.2.6:
  - Add support for arm64 arch.
  - Add flag -U/--uuid to dump the object's UUID.
    This is in particular useful when comparing against TextAPI stubs, .tbd files.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1643198400">- Update to 1.3.3:
  * seccomp: allow getrandom() call (glibc-2.34+)
  * seccomp-bpf: fix warnings by not using nexted open comments
  * seccomp: fix build failure on mips (use _MIP_SIM tests)
  * lddtree: respect (destination) root with --argv0 interp probing
  * security: restore syscalls accidentally dropped
  * security: pregen seccomp bpf programs
  * paxldso: fix pointer style
- Changes since 1.2.8:
  * dumpelf: constify elfobj in APIs
  * dumpelf: add libFuzzer support
  * fuzz: add basic framework for using libFuzzer
  * paxldso: add support for "new" glibc cache format
  * lddtree: add --cwd option
  * lddtree: handle relative ldpaths
  * lddtree: handle ${ORIGIN} like $ORIGIN
  * lddtree: use ldso's --argv0 when available
  * lddtree: apply functools cache to some repeated filesystem calls
  * lddtree: don't crash when interp is missing
  * lddtree: require Python 3.6+
  * lddtree: re-enable long line checks
  * pylintrc: adjust python code to 4 space indent
  * glob is used in paxldso.c for NetBSD too, but glob.h is not included in porting.h for NetBSD.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- updated url to https</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1651665600">- Update to 1.3.4
  * paxelf: add LoongArch to recognized ELF machine types
  * lddtree: add argcomplete support if available
  * lddtree: add --skip-missing
    Allow explicitly ignoring missing files.
  * seccomp: allow madvise() call (glibc 2.35+)
  * seccomp: mark arrays const+static
    This generates better code, although it doesn't super matter since
    this is only used at build time.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1673524800">- Update to 1.3.6
  * Build system changed to Meson
  * lddtree: specify utf-8 encoding with text files
  * lddtree: Add logging for ELFParseError
  * lddtree: avoid shadowing function args</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1675339200">- update to 1.3.7:
  * meson: fix installation of man pages w/o xmlto</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1692100800">- Fix lddtree to call python3 (boo#1213178)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1727179200">- Update to 1.3.8
  * ar: handle invalid ascii numbers better
  * ar: handle invalid extended filename offsets
  * ar: switch from alloca to malloc
  * dumpelf: check dyn pointer before DT_NULL check too
  * dumpelf: free elf after fuzzing it to avoid leaking
  * dumpelf: improve note memory check
  * dumpelf: limit note name display
  * lddtree: Add --wrapper-preload
  * lddtree: add LD_ARGV0_REL
  * lddtree: keep relativeness of invoked program in elf wrapper
  * lddtree: use readlink -f for absolute links
  * paxelf: reject ELFs with incomplete Ehdr structures
  * paxelf: use correct format string
  * pspax: fix buffer limiting in cmdline reading
  * pspax: fix error handling when reading attr or ipaddr fail
  * pspax: fix libcap memory leaks
  * pspax: replace proc_fopen with fopenat_r
  * pspax: rework &amp; document get_proc_name
  * pspax: switch from fgets to getline
  * scanelf: fix hashtable overflow checks
  * seccomp: make socket() fail with -ENOSYS
  * unify usage() output across all the tools</changelog>
  <changelog author="llyyr &lt;llyyr.public@gmail.com&gt;" date="1761566400">- Add python3-pyelftools as runtime dependency. This is required
  for lddtree.</changelog>
</package>
<package pkgid="c3647da8110b7f1d75d318cacc8ebfefaca7df574d5bb7339dac68ed0b9a60fb6e02363fa82490d14f7057be4548bcdac89543c01b0b5bd3d840e4c4c6431fe2" name="pax-utils-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3.8" rel="137.7"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1595332800">- Update to 1.2.6.
- Changes since 1.2.4:
  - Add RISC-V to the list of architectures in ELF
  - dumpelf.c: add missing break when decoding SHT_GNU_LIBLIST.
  - lddtree.py: resolve python location through PATH.
  - lddtree: Put ldso interpreter library path at end.  https://crbug.com/917193
  - scanelf.c: be more verbose at saying what all the addresses mean. https://bugs.gentoo.org/713082
  - scanelf.c: don't crash in -v mode on non-functions. https://bugs.gentoo.org/713082
  - security.c: allow 'semtimedop' in seccomp sandbox. https://bugs.gentoo.org/709794
  - security.c: allow 'statx' in seccomp sandbox. https://bugs.gentoo.org/717300</changelog>
  <changelog author="Gianluca Gabrielli &lt;gianluca.gabrielli@suse.com&gt;" date="1612180800">- Update to 1.2.8.
- Changes since 1.2.6:
  - Add support for arm64 arch.
  - Add flag -U/--uuid to dump the object's UUID.
    This is in particular useful when comparing against TextAPI stubs, .tbd files.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1643198400">- Update to 1.3.3:
  * seccomp: allow getrandom() call (glibc-2.34+)
  * seccomp-bpf: fix warnings by not using nexted open comments
  * seccomp: fix build failure on mips (use _MIP_SIM tests)
  * lddtree: respect (destination) root with --argv0 interp probing
  * security: restore syscalls accidentally dropped
  * security: pregen seccomp bpf programs
  * paxldso: fix pointer style
- Changes since 1.2.8:
  * dumpelf: constify elfobj in APIs
  * dumpelf: add libFuzzer support
  * fuzz: add basic framework for using libFuzzer
  * paxldso: add support for "new" glibc cache format
  * lddtree: add --cwd option
  * lddtree: handle relative ldpaths
  * lddtree: handle ${ORIGIN} like $ORIGIN
  * lddtree: use ldso's --argv0 when available
  * lddtree: apply functools cache to some repeated filesystem calls
  * lddtree: don't crash when interp is missing
  * lddtree: require Python 3.6+
  * lddtree: re-enable long line checks
  * pylintrc: adjust python code to 4 space indent
  * glob is used in paxldso.c for NetBSD too, but glob.h is not included in porting.h for NetBSD.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- updated url to https</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1651665600">- Update to 1.3.4
  * paxelf: add LoongArch to recognized ELF machine types
  * lddtree: add argcomplete support if available
  * lddtree: add --skip-missing
    Allow explicitly ignoring missing files.
  * seccomp: allow madvise() call (glibc 2.35+)
  * seccomp: mark arrays const+static
    This generates better code, although it doesn't super matter since
    this is only used at build time.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1673524800">- Update to 1.3.6
  * Build system changed to Meson
  * lddtree: specify utf-8 encoding with text files
  * lddtree: Add logging for ELFParseError
  * lddtree: avoid shadowing function args</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1675339200">- update to 1.3.7:
  * meson: fix installation of man pages w/o xmlto</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1692100800">- Fix lddtree to call python3 (boo#1213178)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1727179200">- Update to 1.3.8
  * ar: handle invalid ascii numbers better
  * ar: handle invalid extended filename offsets
  * ar: switch from alloca to malloc
  * dumpelf: check dyn pointer before DT_NULL check too
  * dumpelf: free elf after fuzzing it to avoid leaking
  * dumpelf: improve note memory check
  * dumpelf: limit note name display
  * lddtree: Add --wrapper-preload
  * lddtree: add LD_ARGV0_REL
  * lddtree: keep relativeness of invoked program in elf wrapper
  * lddtree: use readlink -f for absolute links
  * paxelf: reject ELFs with incomplete Ehdr structures
  * paxelf: use correct format string
  * pspax: fix buffer limiting in cmdline reading
  * pspax: fix error handling when reading attr or ipaddr fail
  * pspax: fix libcap memory leaks
  * pspax: replace proc_fopen with fopenat_r
  * pspax: rework &amp; document get_proc_name
  * pspax: switch from fgets to getline
  * scanelf: fix hashtable overflow checks
  * seccomp: make socket() fail with -ENOSYS
  * unify usage() output across all the tools</changelog>
  <changelog author="llyyr &lt;llyyr.public@gmail.com&gt;" date="1761566400">- Add python3-pyelftools as runtime dependency. This is required
  for lddtree.</changelog>
</package>
<package pkgid="aa07ab440778a763a71760c52b60a8d2422338d081a03205fd0968afa3bcb21f0d7e8a81fe7b51f6b022b61a757908566f66c1dda5272aeeae6ffca320e7063d" name="pax-utils-debugsource" arch="s390x">
  <version epoch="0" ver="1.3.8" rel="137.7"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1595332800">- Update to 1.2.6.
- Changes since 1.2.4:
  - Add RISC-V to the list of architectures in ELF
  - dumpelf.c: add missing break when decoding SHT_GNU_LIBLIST.
  - lddtree.py: resolve python location through PATH.
  - lddtree: Put ldso interpreter library path at end.  https://crbug.com/917193
  - scanelf.c: be more verbose at saying what all the addresses mean. https://bugs.gentoo.org/713082
  - scanelf.c: don't crash in -v mode on non-functions. https://bugs.gentoo.org/713082
  - security.c: allow 'semtimedop' in seccomp sandbox. https://bugs.gentoo.org/709794
  - security.c: allow 'statx' in seccomp sandbox. https://bugs.gentoo.org/717300</changelog>
  <changelog author="Gianluca Gabrielli &lt;gianluca.gabrielli@suse.com&gt;" date="1612180800">- Update to 1.2.8.
- Changes since 1.2.6:
  - Add support for arm64 arch.
  - Add flag -U/--uuid to dump the object's UUID.
    This is in particular useful when comparing against TextAPI stubs, .tbd files.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1643198400">- Update to 1.3.3:
  * seccomp: allow getrandom() call (glibc-2.34+)
  * seccomp-bpf: fix warnings by not using nexted open comments
  * seccomp: fix build failure on mips (use _MIP_SIM tests)
  * lddtree: respect (destination) root with --argv0 interp probing
  * security: restore syscalls accidentally dropped
  * security: pregen seccomp bpf programs
  * paxldso: fix pointer style
- Changes since 1.2.8:
  * dumpelf: constify elfobj in APIs
  * dumpelf: add libFuzzer support
  * fuzz: add basic framework for using libFuzzer
  * paxldso: add support for "new" glibc cache format
  * lddtree: add --cwd option
  * lddtree: handle relative ldpaths
  * lddtree: handle ${ORIGIN} like $ORIGIN
  * lddtree: use ldso's --argv0 when available
  * lddtree: apply functools cache to some repeated filesystem calls
  * lddtree: don't crash when interp is missing
  * lddtree: require Python 3.6+
  * lddtree: re-enable long line checks
  * pylintrc: adjust python code to 4 space indent
  * glob is used in paxldso.c for NetBSD too, but glob.h is not included in porting.h for NetBSD.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- updated url to https</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1651665600">- Update to 1.3.4
  * paxelf: add LoongArch to recognized ELF machine types
  * lddtree: add argcomplete support if available
  * lddtree: add --skip-missing
    Allow explicitly ignoring missing files.
  * seccomp: allow madvise() call (glibc 2.35+)
  * seccomp: mark arrays const+static
    This generates better code, although it doesn't super matter since
    this is only used at build time.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1673524800">- Update to 1.3.6
  * Build system changed to Meson
  * lddtree: specify utf-8 encoding with text files
  * lddtree: Add logging for ELFParseError
  * lddtree: avoid shadowing function args</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1675339200">- update to 1.3.7:
  * meson: fix installation of man pages w/o xmlto</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1692100800">- Fix lddtree to call python3 (boo#1213178)</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1727179200">- Update to 1.3.8
  * ar: handle invalid ascii numbers better
  * ar: handle invalid extended filename offsets
  * ar: switch from alloca to malloc
  * dumpelf: check dyn pointer before DT_NULL check too
  * dumpelf: free elf after fuzzing it to avoid leaking
  * dumpelf: improve note memory check
  * dumpelf: limit note name display
  * lddtree: Add --wrapper-preload
  * lddtree: add LD_ARGV0_REL
  * lddtree: keep relativeness of invoked program in elf wrapper
  * lddtree: use readlink -f for absolute links
  * paxelf: reject ELFs with incomplete Ehdr structures
  * paxelf: use correct format string
  * pspax: fix buffer limiting in cmdline reading
  * pspax: fix error handling when reading attr or ipaddr fail
  * pspax: fix libcap memory leaks
  * pspax: replace proc_fopen with fopenat_r
  * pspax: rework &amp; document get_proc_name
  * pspax: switch from fgets to getline
  * scanelf: fix hashtable overflow checks
  * seccomp: make socket() fail with -ENOSYS
  * unify usage() output across all the tools</changelog>
  <changelog author="llyyr &lt;llyyr.public@gmail.com&gt;" date="1761566400">- Add python3-pyelftools as runtime dependency. This is required
  for lddtree.</changelog>
</package>
<package pkgid="dfa881c06b85dfcace68c507517c823fcbc81e0ea091b593dd5e9876459ad66f8680988d9a35949d59b4c5efe081208853b23de14ce9b6e718e8cdb578136776" name="pdfcrack" arch="s390x">
  <version epoch="0" ver="0.21" rel="1.6"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1228564800">- Initial RPM</changelog>
  <changelog author="lars@linux-schulserver.de" date="1395748800">- update to 0.13:
  * Skip strip and add debug symbols in Makefile
  * Bail out if encountering rev 5+ (Not supported)
  * Fix parsing of certain rev 4+ documents
  * Add initial support for rev 5 (SHA256)
  * Fix rev 3 owner password issues when other than 128 bit keylengths
  * Update copyright dates in header of files
  * Fix a gcc warning
  * Fix filemode when opening a file on unix to make it more portable
    Thanks to Shinobu Maehara for the notice
  * Fix a pdfparser logic bug, thanks to Shinobu Maehara for reporting
  * Print warning for odd key lengths
  * Add support for handling Rev 3 with other than 128 bit keylengths
  * Try parsing Encrypt object even when ID object is not found
  * Fix a few gcc-warnings
- adapted pdfcrack-makefile_optflags.patch
- specfile cleanup using spec-cleaner</changelog>
  <changelog author="aloisio@gmx.com" date="1478174400">- Update to 0.15
  * Fix a few crashes found by "american fuzzy lop"
  * Make the benchmark a bit more robust with volatile
  * Fix a couple of undefined behaviours with left shift on
    int-type
  * Fix GNU Make-isms in Makefile, thanks to Leonardo Taccari
  * Fix various clang and cppchecker issues and warnings
  0.14
  * Add man-page
  * s/CFLAGS=/CFLAGS +=/ in Makefile
  * s/gcc/($CC)/ in Makefile
  * Add support for wordlists and pdfs &gt; 2GB (thanks to Gary
    Dewey)
- Refreshed pdfcrack-makefile_optflags.patch
- Spec cleanup</changelog>
  <changelog author="mardnh@gmx.de" date="1512907200">- Update to version 0.16
  * Remove incorrectly used pure-attribute
  * Fix a possible overflow by one in the parser
  * Fix pdfcrack starting despite being unable to extract encryption info
  * Fix indention in man-page.
- Run spec-cleaner
- Install man-page</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1555588800">- Update to version 0.17
  * Ignore comments after obj in pdfparser.
  * Make loading save-state files a bit more robust
  * Fix incorrect fallthrough in pdfparser</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1587729600">- Update to version 0.19
  * Fix MD5-calculation for very short keylengths (impossible
    in PDF-files)
  * Do not allow longer RC5 than 128 bits due to undefined
    behavior in specs * Fix parsing issue for Encrypt object
  * Fix a few signedness issues
- Update to version 0.18
  * Relax the search for encrypt object a bit more
  * Tweak benchmark to make better comparison between md5_50
    slow and fast
  * Multiple inputfiles (-l) is not supported, so warn if used
  * Remove a bunch of unecessary if(ptr) before free(ptr)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- source url to https, add gpg signature and keyring
  https://pgp.mit.edu/pks/lookup?op=get&amp;search=0x43001F2E87BE0FD0</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1667649600">- Update to version 0.20
  * Fix a bunch of gcc signedness warnings.
  * Added OOM-checked on malloc/calloc to fix warnings.
  * We do not know how to handle PDF rev 1, so lets not try.
  * Fix cast from int to char confusion in pdfparser.
  * Handle some more variants of argument options.</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1727697600">- switch away from using %patchN</changelog>
  <changelog author="Libor Pechacek &lt;lpechacek@gmx.com&gt;" date="1762862400">- Update to version 0.21
  * Fix compile failures on GCC 15.
  * Fix buffer overflow in rare cases.
  * Abort early if we are unsure if user wants to load state
    or file.
- Add patch pdfcrack-0.21-fix-build.patch</changelog>
</package>
<package pkgid="c95cf74df0a274b94b7b7cdb6a741b631db577646eebe4f4766d0eb2fcf434ea39b62f6f2e05f5050f7dacf377c749496d18547e7ea9ec70210194375d15099d" name="pdfcrack" arch="src">
  <version epoch="0" ver="0.21" rel="1.6"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1228564800">- Initial RPM</changelog>
  <changelog author="lars@linux-schulserver.de" date="1395748800">- update to 0.13:
  * Skip strip and add debug symbols in Makefile
  * Bail out if encountering rev 5+ (Not supported)
  * Fix parsing of certain rev 4+ documents
  * Add initial support for rev 5 (SHA256)
  * Fix rev 3 owner password issues when other than 128 bit keylengths
  * Update copyright dates in header of files
  * Fix a gcc warning
  * Fix filemode when opening a file on unix to make it more portable
    Thanks to Shinobu Maehara for the notice
  * Fix a pdfparser logic bug, thanks to Shinobu Maehara for reporting
  * Print warning for odd key lengths
  * Add support for handling Rev 3 with other than 128 bit keylengths
  * Try parsing Encrypt object even when ID object is not found
  * Fix a few gcc-warnings
- adapted pdfcrack-makefile_optflags.patch
- specfile cleanup using spec-cleaner</changelog>
  <changelog author="aloisio@gmx.com" date="1478174400">- Update to 0.15
  * Fix a few crashes found by "american fuzzy lop"
  * Make the benchmark a bit more robust with volatile
  * Fix a couple of undefined behaviours with left shift on
    int-type
  * Fix GNU Make-isms in Makefile, thanks to Leonardo Taccari
  * Fix various clang and cppchecker issues and warnings
  0.14
  * Add man-page
  * s/CFLAGS=/CFLAGS +=/ in Makefile
  * s/gcc/($CC)/ in Makefile
  * Add support for wordlists and pdfs &gt; 2GB (thanks to Gary
    Dewey)
- Refreshed pdfcrack-makefile_optflags.patch
- Spec cleanup</changelog>
  <changelog author="mardnh@gmx.de" date="1512907200">- Update to version 0.16
  * Remove incorrectly used pure-attribute
  * Fix a possible overflow by one in the parser
  * Fix pdfcrack starting despite being unable to extract encryption info
  * Fix indention in man-page.
- Run spec-cleaner
- Install man-page</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1555588800">- Update to version 0.17
  * Ignore comments after obj in pdfparser.
  * Make loading save-state files a bit more robust
  * Fix incorrect fallthrough in pdfparser</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1587729600">- Update to version 0.19
  * Fix MD5-calculation for very short keylengths (impossible
    in PDF-files)
  * Do not allow longer RC5 than 128 bits due to undefined
    behavior in specs * Fix parsing issue for Encrypt object
  * Fix a few signedness issues
- Update to version 0.18
  * Relax the search for encrypt object a bit more
  * Tweak benchmark to make better comparison between md5_50
    slow and fast
  * Multiple inputfiles (-l) is not supported, so warn if used
  * Remove a bunch of unecessary if(ptr) before free(ptr)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- source url to https, add gpg signature and keyring
  https://pgp.mit.edu/pks/lookup?op=get&amp;search=0x43001F2E87BE0FD0</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1667649600">- Update to version 0.20
  * Fix a bunch of gcc signedness warnings.
  * Added OOM-checked on malloc/calloc to fix warnings.
  * We do not know how to handle PDF rev 1, so lets not try.
  * Fix cast from int to char confusion in pdfparser.
  * Handle some more variants of argument options.</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1727697600">- switch away from using %patchN</changelog>
  <changelog author="Libor Pechacek &lt;lpechacek@gmx.com&gt;" date="1762862400">- Update to version 0.21
  * Fix compile failures on GCC 15.
  * Fix buffer overflow in rare cases.
  * Abort early if we are unsure if user wants to load state
    or file.
- Add patch pdfcrack-0.21-fix-build.patch</changelog>
</package>
<package pkgid="7dfde8ef878898361aee1c289be9c2d433a5e67f8cfa61bdb0ef11dbac26d74a704e98ef073a9b9b6c1770ec4d937f330db756dfad3650604692b3aad6318f17" name="pdfcrack-debuginfo" arch="s390x">
  <version epoch="0" ver="0.21" rel="1.6"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1228564800">- Initial RPM</changelog>
  <changelog author="lars@linux-schulserver.de" date="1395748800">- update to 0.13:
  * Skip strip and add debug symbols in Makefile
  * Bail out if encountering rev 5+ (Not supported)
  * Fix parsing of certain rev 4+ documents
  * Add initial support for rev 5 (SHA256)
  * Fix rev 3 owner password issues when other than 128 bit keylengths
  * Update copyright dates in header of files
  * Fix a gcc warning
  * Fix filemode when opening a file on unix to make it more portable
    Thanks to Shinobu Maehara for the notice
  * Fix a pdfparser logic bug, thanks to Shinobu Maehara for reporting
  * Print warning for odd key lengths
  * Add support for handling Rev 3 with other than 128 bit keylengths
  * Try parsing Encrypt object even when ID object is not found
  * Fix a few gcc-warnings
- adapted pdfcrack-makefile_optflags.patch
- specfile cleanup using spec-cleaner</changelog>
  <changelog author="aloisio@gmx.com" date="1478174400">- Update to 0.15
  * Fix a few crashes found by "american fuzzy lop"
  * Make the benchmark a bit more robust with volatile
  * Fix a couple of undefined behaviours with left shift on
    int-type
  * Fix GNU Make-isms in Makefile, thanks to Leonardo Taccari
  * Fix various clang and cppchecker issues and warnings
  0.14
  * Add man-page
  * s/CFLAGS=/CFLAGS +=/ in Makefile
  * s/gcc/($CC)/ in Makefile
  * Add support for wordlists and pdfs &gt; 2GB (thanks to Gary
    Dewey)
- Refreshed pdfcrack-makefile_optflags.patch
- Spec cleanup</changelog>
  <changelog author="mardnh@gmx.de" date="1512907200">- Update to version 0.16
  * Remove incorrectly used pure-attribute
  * Fix a possible overflow by one in the parser
  * Fix pdfcrack starting despite being unable to extract encryption info
  * Fix indention in man-page.
- Run spec-cleaner
- Install man-page</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1555588800">- Update to version 0.17
  * Ignore comments after obj in pdfparser.
  * Make loading save-state files a bit more robust
  * Fix incorrect fallthrough in pdfparser</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1587729600">- Update to version 0.19
  * Fix MD5-calculation for very short keylengths (impossible
    in PDF-files)
  * Do not allow longer RC5 than 128 bits due to undefined
    behavior in specs * Fix parsing issue for Encrypt object
  * Fix a few signedness issues
- Update to version 0.18
  * Relax the search for encrypt object a bit more
  * Tweak benchmark to make better comparison between md5_50
    slow and fast
  * Multiple inputfiles (-l) is not supported, so warn if used
  * Remove a bunch of unecessary if(ptr) before free(ptr)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- source url to https, add gpg signature and keyring
  https://pgp.mit.edu/pks/lookup?op=get&amp;search=0x43001F2E87BE0FD0</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1667649600">- Update to version 0.20
  * Fix a bunch of gcc signedness warnings.
  * Added OOM-checked on malloc/calloc to fix warnings.
  * We do not know how to handle PDF rev 1, so lets not try.
  * Fix cast from int to char confusion in pdfparser.
  * Handle some more variants of argument options.</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1727697600">- switch away from using %patchN</changelog>
  <changelog author="Libor Pechacek &lt;lpechacek@gmx.com&gt;" date="1762862400">- Update to version 0.21
  * Fix compile failures on GCC 15.
  * Fix buffer overflow in rare cases.
  * Abort early if we are unsure if user wants to load state
    or file.
- Add patch pdfcrack-0.21-fix-build.patch</changelog>
</package>
<package pkgid="3c144b57d9633229b088d6fd788cbcd4c8c2b07e93ea8ee70155e0cf8a4cfe6577dd2a4d47a3f8b5839444439bc61c5f86bd14768bab6b4cfd737d94786f9898" name="pdfcrack-debugsource" arch="s390x">
  <version epoch="0" ver="0.21" rel="1.6"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1228564800">- Initial RPM</changelog>
  <changelog author="lars@linux-schulserver.de" date="1395748800">- update to 0.13:
  * Skip strip and add debug symbols in Makefile
  * Bail out if encountering rev 5+ (Not supported)
  * Fix parsing of certain rev 4+ documents
  * Add initial support for rev 5 (SHA256)
  * Fix rev 3 owner password issues when other than 128 bit keylengths
  * Update copyright dates in header of files
  * Fix a gcc warning
  * Fix filemode when opening a file on unix to make it more portable
    Thanks to Shinobu Maehara for the notice
  * Fix a pdfparser logic bug, thanks to Shinobu Maehara for reporting
  * Print warning for odd key lengths
  * Add support for handling Rev 3 with other than 128 bit keylengths
  * Try parsing Encrypt object even when ID object is not found
  * Fix a few gcc-warnings
- adapted pdfcrack-makefile_optflags.patch
- specfile cleanup using spec-cleaner</changelog>
  <changelog author="aloisio@gmx.com" date="1478174400">- Update to 0.15
  * Fix a few crashes found by "american fuzzy lop"
  * Make the benchmark a bit more robust with volatile
  * Fix a couple of undefined behaviours with left shift on
    int-type
  * Fix GNU Make-isms in Makefile, thanks to Leonardo Taccari
  * Fix various clang and cppchecker issues and warnings
  0.14
  * Add man-page
  * s/CFLAGS=/CFLAGS +=/ in Makefile
  * s/gcc/($CC)/ in Makefile
  * Add support for wordlists and pdfs &gt; 2GB (thanks to Gary
    Dewey)
- Refreshed pdfcrack-makefile_optflags.patch
- Spec cleanup</changelog>
  <changelog author="mardnh@gmx.de" date="1512907200">- Update to version 0.16
  * Remove incorrectly used pure-attribute
  * Fix a possible overflow by one in the parser
  * Fix pdfcrack starting despite being unable to extract encryption info
  * Fix indention in man-page.
- Run spec-cleaner
- Install man-page</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1555588800">- Update to version 0.17
  * Ignore comments after obj in pdfparser.
  * Make loading save-state files a bit more robust
  * Fix incorrect fallthrough in pdfparser</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1587729600">- Update to version 0.19
  * Fix MD5-calculation for very short keylengths (impossible
    in PDF-files)
  * Do not allow longer RC5 than 128 bits due to undefined
    behavior in specs * Fix parsing issue for Encrypt object
  * Fix a few signedness issues
- Update to version 0.18
  * Relax the search for encrypt object a bit more
  * Tweak benchmark to make better comparison between md5_50
    slow and fast
  * Multiple inputfiles (-l) is not supported, so warn if used
  * Remove a bunch of unecessary if(ptr) before free(ptr)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650888000">- source url to https, add gpg signature and keyring
  https://pgp.mit.edu/pks/lookup?op=get&amp;search=0x43001F2E87BE0FD0</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1667649600">- Update to version 0.20
  * Fix a bunch of gcc signedness warnings.
  * Added OOM-checked on malloc/calloc to fix warnings.
  * We do not know how to handle PDF rev 1, so lets not try.
  * Fix cast from int to char confusion in pdfparser.
  * Handle some more variants of argument options.</changelog>
  <changelog author="Jiri Slaby &lt;jslaby@suse.cz&gt;" date="1727697600">- switch away from using %patchN</changelog>
  <changelog author="Libor Pechacek &lt;lpechacek@gmx.com&gt;" date="1762862400">- Update to version 0.21
  * Fix compile failures on GCC 15.
  * Fix buffer overflow in rare cases.
  * Abort early if we are unsure if user wants to load state
    or file.
- Add patch pdfcrack-0.21-fix-build.patch</changelog>
</package>
<package pkgid="22fd68c57b1dd8e7e96bebf2d8b88bcb6bc7536fb7971e1b39ba58dc09bb0cd2ab0394aa7ef0e72b037e7e28da03cc18420a699235560140baebcf4708c5f3cd" name="perl-File-Find-Rule" arch="noarch">
  <version epoch="0" ver="0.350.0" rel="39.4"/>
  <changelog author="coolo@novell.com" date="1291032000">- called spec2changelog</changelog>
  <changelog author="coolo@novell.com" date="1291032001">- remove /var/adm/perl-modules</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="vcizek@novell.com" date="1294747200">- update to 0.32
  Rework the referencing of anyonymous subroutines internally,
    closes RT#46599 (Reported by Kevin Ryde)
  Move to Makefile.PL
    use Test::Differences in the testsuite if available.
  Rearrange the testsuite so you don't keep tripping over yourself.
  Dropped 5.00503 backwards compatibility, allows some 5.6isms and
    dropping the shonky Cwd code.
  All taint 'bugs' are now the same as the behaviour of File::Find,
    documentation has been added to describe this.
- bzipped tarball</changelog>
  <changelog author="vcizek@novell.com" date="1308312000">- license correction (same as Perl)</changelog>
  <changelog author="vcizek@suse.com" date="1316606400">- update to 0.33
    Fixes the case where name("foo(*") hits an error with mismatched
    parentheis.  Reported by Jan Engelhardt.</changelog>
  <changelog author="coolo@suse.com" date="1449316800">- updated to 0.34
  see /usr/share/doc/packages/perl-File-Find-Rule/Changes
  0.34 Thursday 4th December, 2015
    Add canonpath option to normalize file-path
    separators.  Work by Mithun Ayachit.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- URLs switched to https</changelog>
  <changelog author="Tina M&#xFC;ller &lt;tina.mueller@suse.com&gt;" date="1748088000">- Normalize CPAN version
  See https://github.com/openSUSE/cpanspec/issues/47 for details</changelog>
  <changelog author="Tina M&#xFC;ller &lt;timueller+perl@suse.de&gt;" date="1749643200">- updated to 0.350.0 (0.35)
  see /usr/share/doc/packages/perl-File-Find-Rule/Changes
  0.35 Thursday 5th June, 2025
    Fix for CVE-2011-10007 https://github.com/richardc/perl-file-find-rule/pull/4
    bsc#1244148</changelog>
</package>
<package pkgid="8d3716d042c791710fd0cd1f499de6208dfe2713b3c3d0cc9fdabe4d60175e4ffe1013d8482dca6d41683c7d7e4557fce5213bfba6ddbcfcc9f30e54cebe7b24" name="perl-File-Find-Rule" arch="src">
  <version epoch="0" ver="0.350.0" rel="39.4"/>
  <changelog author="gerrit.beine@gmx.de" date="1212926400">- first release 0.30</changelog>
  <changelog author="coolo@novell.com" date="1291032000">- called spec2changelog</changelog>
  <changelog author="coolo@novell.com" date="1291032001">- remove /var/adm/perl-modules</changelog>
  <changelog author="coolo@novell.com" date="1291204800">- switch to perl_requires macro</changelog>
  <changelog author="vcizek@novell.com" date="1294747200">- update to 0.32
  Rework the referencing of anyonymous subroutines internally,
    closes RT#46599 (Reported by Kevin Ryde)
  Move to Makefile.PL
    use Test::Differences in the testsuite if available.
  Rearrange the testsuite so you don't keep tripping over yourself.
  Dropped 5.00503 backwards compatibility, allows some 5.6isms and
    dropping the shonky Cwd code.
  All taint 'bugs' are now the same as the behaviour of File::Find,
    documentation has been added to describe this.
- bzipped tarball</changelog>
  <changelog author="vcizek@novell.com" date="1308312000">- license correction (same as Perl)</changelog>
  <changelog author="vcizek@suse.com" date="1316606400">- update to 0.33
    Fixes the case where name("foo(*") hits an error with mismatched
    parentheis.  Reported by Jan Engelhardt.</changelog>
  <changelog author="coolo@suse.com" date="1449316800">- updated to 0.34
  see /usr/share/doc/packages/perl-File-Find-Rule/Changes
  0.34 Thursday 4th December, 2015
    Add canonpath option to normalize file-path
    separators.  Work by Mithun Ayachit.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- URLs switched to https</changelog>
  <changelog author="Tina M&#xFC;ller &lt;tina.mueller@suse.com&gt;" date="1748088000">- Normalize CPAN version
  See https://github.com/openSUSE/cpanspec/issues/47 for details</changelog>
  <changelog author="Tina M&#xFC;ller &lt;timueller+perl@suse.de&gt;" date="1749643200">- updated to 0.350.0 (0.35)
  see /usr/share/doc/packages/perl-File-Find-Rule/Changes
  0.35 Thursday 5th June, 2025
    Fix for CVE-2011-10007 https://github.com/richardc/perl-file-find-rule/pull/4
    bsc#1244148</changelog>
</package>
<package pkgid="5b1cc4a40ed7afa77abc0b1ce4abe1758a295134c76864d1937b60f7ebb1c8432d2d64015d8e7d2f8b95c0a207b0bf963fef34391e61d7601b60436e56b94dc1" name="perl-Number-Compare" arch="noarch">
  <version epoch="0" ver="0.03" rel="23.4"/>
  <changelog author="gerrit.beine@gmx.de" date="1212926400">- first release 0.01</changelog>
  <changelog author="coolo@novell.com" date="1287489600">- add perl as explicit buildrequire</changelog>
  <changelog author="coolo@novell.com" date="1291032000">- remove /var/adm/perl-modules</changelog>
  <changelog author="coolo@novell.com" date="1291118400">- switch to perl_requires macro</changelog>
  <changelog author="vcizek@novell.com" date="1296648000">- bzipped source tarball</changelog>
  <changelog author="coolo@opensuse.org" date="1305115200">- regenerate with cpanspec</changelog>
  <changelog author="vcizek@suse.com" date="1315915200">- update to 0.02
  - apply warning-related fix -
    https://rt.cpan.org/Public/Bug/Display.html?id=58466</changelog>
  <changelog author="vcizek@suse.com" date="1316692800">- update to 0.03
    Generate a new tarball on linux.  Doing the C&lt;make dist&gt; on OSX
    generated a tarball that upset dumb tars
    tar: Ignoring unknown extended header keyword `SCHILY.dev'
    tar: Ignoring unknown extended header keyword `SCHILY.ino'
    tar: Ignoring unknown extended header keyword `SCHILY.nlink'</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- use https urls</changelog>
</package>
<package pkgid="2698d322c68c379705ea44c8bdb238d092ac96152219f5ef4a73cf174444be11b03ce84960dff4b5f7bad4f5b645889de277430cf5e81ea829091cd245a9a524" name="perl-Number-Compare" arch="src">
  <version epoch="0" ver="0.03" rel="23.4"/>
  <changelog author="gerrit.beine@gmx.de" date="1212926400">- first release 0.01</changelog>
  <changelog author="coolo@novell.com" date="1287489600">- add perl as explicit buildrequire</changelog>
  <changelog author="coolo@novell.com" date="1291032000">- remove /var/adm/perl-modules</changelog>
  <changelog author="coolo@novell.com" date="1291118400">- switch to perl_requires macro</changelog>
  <changelog author="vcizek@novell.com" date="1296648000">- bzipped source tarball</changelog>
  <changelog author="coolo@opensuse.org" date="1305115200">- regenerate with cpanspec</changelog>
  <changelog author="vcizek@suse.com" date="1315915200">- update to 0.02
  - apply warning-related fix -
    https://rt.cpan.org/Public/Bug/Display.html?id=58466</changelog>
  <changelog author="vcizek@suse.com" date="1316692800">- update to 0.03
    Generate a new tarball on linux.  Doing the C&lt;make dist&gt; on OSX
    generated a tarball that upset dumb tars
    tar: Ignoring unknown extended header keyword `SCHILY.dev'
    tar: Ignoring unknown extended header keyword `SCHILY.ino'
    tar: Ignoring unknown extended header keyword `SCHILY.nlink'</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- use https urls</changelog>
</package>
<package pkgid="8ac7576bdd241c710b28886b465ad54502c3ea1dd362b7ca06f8137e24df3ebd0c6fca3be9c5a9f303c5b9a113a14cca89f9390b152a8ffc0ce1b33db78da28f" name="perl-Text-Glob" arch="noarch">
  <version epoch="0" ver="0.110.0" rel="30.4"/>
  <changelog author="gerrit.beine@gmx.de" date="1212926400">- first release 0.08</changelog>
  <changelog author="coolo@novell.com" date="1287489600">- add perl as explicit buildrequire</changelog>
  <changelog author="coolo@novell.com" date="1291032000">- remove /var/adm/perl-modules</changelog>
  <changelog author="coolo@novell.com" date="1291118400">- switch to perl_requires macro</changelog>
  <changelog author="vcizek@novell.com" date="1296648000">- bzipped source tarball</changelog>
  <changelog author="vcizek@novell.com" date="1298635200">- update to 0.09
  * Compiled documentation fixes
    (collected by Tom Hukins from fixes on rt.cpan)</changelog>
  <changelog author="coolo@suse.com" date="1321617600">- use original .tar.gz</changelog>
  <changelog author="coolo@suse.com" date="1473940800">- updated to 0.10
  see /usr/share/doc/packages/perl-Text-Glob/Changes
  0.10    Wednesday 14th September, 2016
    Added ability to alter regex seperator (patch from Mark Fowler)
    Switch distribution packaging back to ExtUtils::MakeMaker (RT#104876)</changelog>
  <changelog author="coolo@suse.com" date="1489233600">- updated to 0.11
  see /usr/share/doc/packages/perl-Text-Glob/Changes
  0.11    Wednesday 8th March, 2016
    Regenerated tarball on a linux machine (0.10 was released from OSX
    which added non-standard extended header attributes to the tar)</changelog>
  <changelog author="Tina M&#xFC;ller &lt;tina.mueller@suse.com&gt;" date="1747742400">- Normalize CPAN version
  See https://github.com/openSUSE/cpanspec/issues/47 for details</changelog>
</package>
<package pkgid="7091f070ebcea2569c202edf7a8ff62505fc00fc1aded4ec02af6db5bde9e161fe50626f67af90ca03597c954118dba651ad400a563ae20e5b09f8370aab2a6c" name="perl-Text-Glob" arch="src">
  <version epoch="0" ver="0.110.0" rel="30.4"/>
  <changelog author="gerrit.beine@gmx.de" date="1212926400">- first release 0.08</changelog>
  <changelog author="coolo@novell.com" date="1287489600">- add perl as explicit buildrequire</changelog>
  <changelog author="coolo@novell.com" date="1291032000">- remove /var/adm/perl-modules</changelog>
  <changelog author="coolo@novell.com" date="1291118400">- switch to perl_requires macro</changelog>
  <changelog author="vcizek@novell.com" date="1296648000">- bzipped source tarball</changelog>
  <changelog author="vcizek@novell.com" date="1298635200">- update to 0.09
  * Compiled documentation fixes
    (collected by Tom Hukins from fixes on rt.cpan)</changelog>
  <changelog author="coolo@suse.com" date="1321617600">- use original .tar.gz</changelog>
  <changelog author="coolo@suse.com" date="1473940800">- updated to 0.10
  see /usr/share/doc/packages/perl-Text-Glob/Changes
  0.10    Wednesday 14th September, 2016
    Added ability to alter regex seperator (patch from Mark Fowler)
    Switch distribution packaging back to ExtUtils::MakeMaker (RT#104876)</changelog>
  <changelog author="coolo@suse.com" date="1489233600">- updated to 0.11
  see /usr/share/doc/packages/perl-Text-Glob/Changes
  0.11    Wednesday 8th March, 2016
    Regenerated tarball on a linux machine (0.10 was released from OSX
    which added non-standard extended header attributes to the tar)</changelog>
  <changelog author="Tina M&#xFC;ller &lt;tina.mueller@suse.com&gt;" date="1747742400">- Normalize CPAN version
  See https://github.com/openSUSE/cpanspec/issues/47 for details</changelog>
</package>
<package pkgid="020699a8d65e981ab10fc1c9605ec525d9fc4a2946d7beced1d46e5c2063c0b852b26b4a377d169a68b9844356e4cef798043a7d78ca8fd420cd38b190fceb51" name="phrasendrescher" arch="s390x">
  <version epoch="0" ver="1.2.2c" rel="4.34"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1264420800">- Initial RPM</changelog>
  <changelog author="cristian.rodriguez@opensuse.org" date="1292328000">- Fix compile fail in factory/i586</changelog>
  <changelog author="astieger@suse.com" date="1534161600">- 1.2.2c:
  * autoconfig fixes
  * fix build and modernize spec file</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- use https urls</changelog>
</package>
<package pkgid="58c239a12a766b95df190134f710ff4e7d2d742e4ee79fe8b08555e9009835f4fa557681d19a6ce786e3993d0f7d970bed41384a7f418f603d9774e81dae0cd5" name="phrasendrescher" arch="src">
  <version epoch="0" ver="1.2.2c" rel="4.34"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1264420800">- Initial RPM</changelog>
  <changelog author="cristian.rodriguez@opensuse.org" date="1292328000">- Fix compile fail in factory/i586</changelog>
  <changelog author="astieger@suse.com" date="1534161600">- 1.2.2c:
  * autoconfig fixes
  * fix build and modernize spec file</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- use https urls</changelog>
</package>
<package pkgid="ea0c3ce12eb6c0354cf72136301af79e5e6c4d0cd92d4251b72f157bb2d2a6173055e8cf33f02c73e38c15146f74a24ccfeb9f4cff00bc135e288d80866046ec" name="phrasendrescher-debuginfo" arch="s390x">
  <version epoch="0" ver="1.2.2c" rel="4.34"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1264420800">- Initial RPM</changelog>
  <changelog author="cristian.rodriguez@opensuse.org" date="1292328000">- Fix compile fail in factory/i586</changelog>
  <changelog author="astieger@suse.com" date="1534161600">- 1.2.2c:
  * autoconfig fixes
  * fix build and modernize spec file</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- use https urls</changelog>
</package>
<package pkgid="e4afca20337f49003dc3d90f1d7828e32bf1d10ff5abfc1a4d1975bb04043f076f4ca7a038326d18fd76c63ed73728af706aed5ac53834089ee2926b253ea638" name="phrasendrescher-debugsource" arch="s390x">
  <version epoch="0" ver="1.2.2c" rel="4.34"/>
  <changelog author="bitshuffler #suse@irc.freenode.org" date="1264420800">- Initial RPM</changelog>
  <changelog author="cristian.rodriguez@opensuse.org" date="1292328000">- Fix compile fail in factory/i586</changelog>
  <changelog author="astieger@suse.com" date="1534161600">- 1.2.2c:
  * autoconfig fixes
  * fix build and modernize spec file</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- use https urls</changelog>
</package>
<package pkgid="dfcfd28ce88a2e166a78446d793363ff0448d838c524093ce336d580115edfc53502b1b58603464122e6a0c2658577a058f23a18cfd5cc7ed78948cd5f3fa789" name="physlock" arch="s390x">
  <version epoch="0" ver="13" rel="15.22"/>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1598356800">- Initial package physlock with version 13</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1599048000">- Add upstream commit as patch nofreeze.patch to avoid freeze on
  combined off of vt switch and lock
- Only allow root and member of the group root to use physlock</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1600776000">- Switch over to new group trusted from permissions package</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1600776001">- Move pam configuration to _distconfdir</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1600776002">- Use throughout _distconfdir in spec file</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1660046400">- Use %_pam_vendordir</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1726056000">- Add patches found as pull requests on archived project
  * allow_cmd_before_and_after.patch
    Implements user command execution before and after locking
  * resume_hybernate.patch
    Allow to be waken via SIGUSR1 after hybernating
    https://github.com/xyb3rt/physlock/issues/97
  * set_PAM_TTY.patch
    Avoid pam_securetty message "cannot determine user's tty"
    https://github.com/xyb3rt/physlock/issues/110</changelog>
</package>
<package pkgid="7965516ab81917358d2645b04b98c0af7c4280671515234c99b959c4665ac763e217ba366c8803d851bb1ce86304f23782bba160226df757a258f2165f07ebdf" name="physlock" arch="src">
  <version epoch="0" ver="13" rel="15.22"/>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1598356800">- Initial package physlock with version 13</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1599048000">- Add upstream commit as patch nofreeze.patch to avoid freeze on
  combined off of vt switch and lock
- Only allow root and member of the group root to use physlock</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1600776000">- Switch over to new group trusted from permissions package</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1600776001">- Move pam configuration to _distconfdir</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1600776002">- Use throughout _distconfdir in spec file</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1660046400">- Use %_pam_vendordir</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1726056000">- Add patches found as pull requests on archived project
  * allow_cmd_before_and_after.patch
    Implements user command execution before and after locking
  * resume_hybernate.patch
    Allow to be waken via SIGUSR1 after hybernating
    https://github.com/xyb3rt/physlock/issues/97
  * set_PAM_TTY.patch
    Avoid pam_securetty message "cannot determine user's tty"
    https://github.com/xyb3rt/physlock/issues/110</changelog>
</package>
<package pkgid="a4059fadb330b0aa70bc6012dc8f31786db6b61196593a0932487994abe3b7e857c7083318cc65b5c9d82a0be9ec4de73dc8b8f76da3294f30a06ac4f57e8b5c" name="physlock-debuginfo" arch="s390x">
  <version epoch="0" ver="13" rel="15.22"/>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1598356800">- Initial package physlock with version 13</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1599048000">- Add upstream commit as patch nofreeze.patch to avoid freeze on
  combined off of vt switch and lock
- Only allow root and member of the group root to use physlock</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1600776000">- Switch over to new group trusted from permissions package</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1600776001">- Move pam configuration to _distconfdir</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1600776002">- Use throughout _distconfdir in spec file</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1660046400">- Use %_pam_vendordir</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1726056000">- Add patches found as pull requests on archived project
  * allow_cmd_before_and_after.patch
    Implements user command execution before and after locking
  * resume_hybernate.patch
    Allow to be waken via SIGUSR1 after hybernating
    https://github.com/xyb3rt/physlock/issues/97
  * set_PAM_TTY.patch
    Avoid pam_securetty message "cannot determine user's tty"
    https://github.com/xyb3rt/physlock/issues/110</changelog>
</package>
<package pkgid="2c9f643fcf7b649f39beb7952c047d6cfcd254b592bec095eccbedbc38c167d8c29ceb1d84f374bfc02fc959b481cd1af3f8f482b8a28b489631f821fa167627" name="physlock-debugsource" arch="s390x">
  <version epoch="0" ver="13" rel="15.22"/>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1598356800">- Initial package physlock with version 13</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1599048000">- Add upstream commit as patch nofreeze.patch to avoid freeze on
  combined off of vt switch and lock
- Only allow root and member of the group root to use physlock</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1600776000">- Switch over to new group trusted from permissions package</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1600776001">- Move pam configuration to _distconfdir</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1600776002">- Use throughout _distconfdir in spec file</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1660046400">- Use %_pam_vendordir</changelog>
  <changelog author="Dr. Werner Fink &lt;werner@suse.de&gt;" date="1726056000">- Add patches found as pull requests on archived project
  * allow_cmd_before_and_after.patch
    Implements user command execution before and after locking
  * resume_hybernate.patch
    Allow to be waken via SIGUSR1 after hybernating
    https://github.com/xyb3rt/physlock/issues/97
  * set_PAM_TTY.patch
    Avoid pam_securetty message "cannot determine user's tty"
    https://github.com/xyb3rt/physlock/issues/110</changelog>
</package>
<package pkgid="a4f5ec32553d303c28f54694ce91da757ce28722da0cdabd2ab75aeac017df014362082e498179400fe8815f07b86f7c5b71e10221ceceef73f5774f74f16b06" name="pinact" arch="s390x">
  <version epoch="0" ver="4.1.1" rel="30.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- new package pinact: CLI to edit GitHub Workflow and Composite
  action files and pin versions of Actions and Reusable Workflows.
  pinact can also update their versions and verify version
  annotations</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516801">- Update to version 3.4.2:
  * fix(casks): restrict quarantine removal to macOS only (#1103)
  * test: add comprehensive unit tests for version comparison
    functions (#1102)
  * feat: add Claude Code auto-formatting hooks (#1101)
  * docs: add comprehensive AI assistant guidelines with shared
    documentation (#1100)
  * docs: add CLAUDE.md with project guidelines for AI assistants
    (#1099)
  * docs: add comprehensive documentation comments to all packages
    (#1098)
  * chore(deps): update dependency anchore/syft to v1.31.0 (#1097)
  * ci: use go-test-full-workflow (#1094)
  * chore: use aqua lsp (#1093)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.403.0 (#1092)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380800">- Update to version 3.4.3:
  * Bug Fixes
  - #1201 Skip prereleases when current version is stable
    @mceachen
  - #1213 Fixed bugs of #1201
  * Dependencies
  - chore(deps): update actions/setup-go action to v6 (#1123)
  - chore(deps): update aquaproj/aqua-installer action to v4.0.3
    (#1113)
  - chore(deps): update aquaproj/aqua-installer action to v4.0.4
    (#1198)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.9.0
    (#1136)
  - chore(deps): update dependency anchore/syft to v1.32.0
    (#1110)
  - chore(deps): update dependency anchore/syft to v1.33.0
    (#1143)
  - chore(deps): update dependency anchore/syft to v1.34.1
    (#1182)
  - chore(deps): update dependency anchore/syft to v1.34.2
    (#1183)
  - chore(deps): update dependency anchore/syft to v1.36.0
    (#1192)
  - chore(deps): update dependency anchore/syft to v1.37.0
    (#1202)
  - chore(deps): update dependency aquaproj/aqua to v2.53.10
    (#1114)
  - chore(deps): update dependency aquaproj/aqua to v2.53.11
    (#1126)
  - chore(deps): update dependency aquaproj/aqua to v2.54.0
    (#1134)
  - chore(deps): update dependency aquaproj/aqua to v2.54.1
    (#1137)
  - chore(deps): update dependency aquaproj/aqua to v2.55.0
    (#1148)
  - chore(deps): update dependency aquaproj/aqua to v2.55.1
    (#1190)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.404.0 (#1106)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.405.0 (#1107)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.406.0 (#1108)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.407.0 (#1111)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.408.0 (#1116)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.409.0 (#1127)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.409.1 (#1128)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.410.0 (#1129)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.411.0 (#1131)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.411.1 (#1135)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.412.0 (#1142)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.413.0 (#1146)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.414.0 (#1149)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.415.0 (#1150)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.416.0 (#1153)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.417.0 (#1154)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.418.0 (#1157)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.419.0 (#1160)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.420.0 (#1163)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.421.0 (#1165)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.422.0 (#1167)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.423.0 (#1168)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.424.0 (#1169)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.425.0 (#1171)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.426.0 (#1173)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.427.0 (#1176)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.428.0 (#1181)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.429.0 (#1184)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.430.0 (#1187)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.430.1 (#1193)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.431.0 (#1195)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.432.0 (#1196)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.433.0 (#1199)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.434.0 (#1207)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.435.0 (#1209)
  - chore(deps): update dependency crate-ci/typos to v1.35.5
    (#1105)
  - chore(deps): update dependency crate-ci/typos to v1.35.6
    (#1112)
  - chore(deps): update dependency crate-ci/typos to v1.36.1
    (#1117)
  - chore(deps): update dependency crate-ci/typos to v1.36.2
    (#1125)
  - chore(deps): update dependency crate-ci/typos to v1.36.3
    (#1159)
  - chore(deps): update dependency go to v1.25.1 (#1141)
  - chore(deps): update dependency go to v1.25.2 (#1172)
  - chore(deps): update dependency go to v1.25.3 (#1179)
  - chore(deps): update dependency go to v1.25.4 (#1204)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.5.0 (#1152)
  - chore(deps): update dependency google/go-licenses to v2
    (#1122)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.0 (#1118)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.1 (#1145)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.2 (#1147)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.3 (#1158)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.4 (#1162)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.5 (#1164)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.6 (#1188)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.7 (#1194)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.0
    (#1119)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.1
    (#1130)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.2
    (#1186)
  - chore(deps): update dependency reviewdog/reviewdog to v0.21.0
    (#1120)
  - chore(deps): update dependency rhysd/actionlint to v1.7.8
    (#1177)
  - chore(deps): update dependency sigstore/cosign to v2.6.0
    (#1139)
  - chore(deps): update dependency sigstore/cosign to v2.6.1
    (#1166)
  - chore(deps): update dependency sigstore/cosign to v3 (#1175)
  - chore(deps): update dependency sigstore/cosign to v3.0.2
    (#1178)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.2 (#1104)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v6.0.2 (#1115)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v7 (#1189)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v4.0.1 (#1156)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5 (#1174)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5.0.1 (#1191)
  - chore(deps): update suzuki-shunsuke/renovate-config to v3.3.0
    (#1121)
  - chore(deps): update suzuki-shunsuke/renovate-config to v3.3.1
    (#1144)
  - fix(deps): update module github.com/google/go-github/v74 to
    v75 (#1155)
  - fix(deps): update module github.com/google/go-github/v75 to
    v76 (#1180)
  - fix(deps): update module github.com/google/go-github/v76 to
    v78 (#1206)
  - fix(deps): update module github.com/spf13/afero to v1.15.0
    (#1132)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.5.0
    (#1185)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.0
    (#1208)
  - fix(deps): update module golang.org/x/oauth2 to v0.31.0
    (#1124)
  - fix(deps): update module golang.org/x/oauth2 to v0.32.0
    (#1170)
  - fix(deps): update module golang.org/x/oauth2 to v0.33.0
    (#1205)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380801">- Update to version 3.4.4:
  * Bug Fixes
  - Skip prerelease tags when current version is stable
    @fredericlepied
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.436.0 (#1215)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.3 (#1214)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764244800">- Update to version 3.4.5:
  * Bug Fixes
  - fix: ignore draft releases (#1237)
  * Dependencies
  - chore(deps): update actions/checkout action to v6 (#1232)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.440.0 (#1235)
  - chore(deps): update dependency rhysd/actionlint to v1.7.9
    (#1234)
  - chore(deps): update dependency aquaproj/aqua to v2.55.2
    (#1233)
  - chore(deps): update actions/setup-go action to v6.1.0 (#1230)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.439.0 (#1229)
  - chore(deps): update dependency anchore/syft to v1.38.0
    (#1228)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.438.0 (#1227)
  - fix(deps): update module github.com/google/go-github/v78 to
    v79 (#1222)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.1
    (#1225)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.437.0 (#1224)
  - chore(deps): update actions/checkout action to v5.0.1 (#1223)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.4 (#1221)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765195200">- Update to version 3.4.6:
  * #1250 #1251 Replace logrus with slog
  * #1109 #1254 Refactoring
  * chore(deps): update dependency crate-ci/typos to v1.37.0
    (#1161)
  * chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.4 (#1253)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.444.0 (#1249)
  * chore(deps): update dependency go to v1.25.5 (#1248)
  * chore(deps): update actions/checkout action to v6.0.1 (#1247)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.443.0 (#1246)
  * chore(deps): update dependency goreleaser/goreleaser to v2.13.0
    (#1245)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.442.1 (#1244)
  * chore(deps): update suzuki-shunsuke/go-autofix-action action to
    v0.1.11 (#1243)
  * fix(deps): update module github.com/goccy/go-yaml to v1.19.0
    (#1242)
  * fix(deps): update module github.com/hashicorp/go-version to
    v1.8.0 (#1241)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.442.0 (#1240)
  * chore(deps): update dependency suzuki-shunsuke/pinact to v3.4.5
    (#1238)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.441.0 (#1239)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 3.5.0:
  * Features
  - #1266 #1267 Add --min-age (-m) option
    Skip recently released versions when updating actions with -u
    flag.
    pinact run -u --min-age 7
    [#] or using short alias
    pinact run -u -m 7
    This helps avoid updating to potentially unstable versions
    that haven't had time to prove their stability.
  - For GitHub Releases, the PublishedAt date is checked
  - For tags, the commit's Committer.Date is checked
  * Refactoring
  - #1259 Use Destination pattern for urfave/cli flags
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua to v2.55.3
    (#1264)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.444.2 (#1263)
  - fix(deps): update module golang.org/x/oauth2 to v0.34.0
    (#1262)
  - fix(deps): update module github.com/google/go-github/v79 to
    v80 (#1261)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.1.2
    (#1260)
  - chore(deps): update dependency suzuki-shunsuke/nllint to v1
    (#1258)
  - chore(deps): update dependency crate-ci/typos to v1.40.0
    (#1257)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.6 (#1256)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765886400">- Update to version 3.6.0:
  * Features
  - #1275 Support GitHub Enterprise
  - #1282 #1284 Support PINACT_MIN_AGE environment variable for
  - min-age option
  * Bug Fixes
  - #1283 Fix a bug that pinact token set can't be cancelled by
    ctrl-c
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.446.0 (#1281)
  - chore(deps): update dependency anchore/syft to v1.38.2
    (#1276)
  - chore(deps): update dependency sigstore/cosign to v3.0.3
    (#1277)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.1 (#1272)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.7.2 (#1270)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.445.0 (#1269)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.5.0 (#1268)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305600">- Update to version 3.7.4:
  * Bug Fixes
  - Ignore tags associated with releases #1313
- Update to version 3.7.3:
  * #1309 Fix some bugs
  - -verify is ignored if -u is used
  - versions aren't pinned and verified if version comments are
    semver
    Details see
    https://github.com/suzuki-shunsuke/pinact/releases/tag/v3.7.3
- Update to version 3.7.2:
  * Fixes
  - sarif: Add fixes field for reviewdog suggestion support
  * Dependencies
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.3 (#1310)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.449.0 (#1311)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.448.1 (#1307)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.2 (#1306)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.2 (#1305)
- Update to version 3.7.1:
  There is no change between v3.7.0 and v3.7.1.
  There was an issue during the release of v3.7.0, so we released
  v3.7.1.
- Update to version 3.7.0:
  * Features
  - #1294 SARIF Output Support
  - #1297 Support evironment variables PINACT_GITHUB_TOKEN and
    PINACT_GHES_TOKEN
  * SARIF Output Support
    [#1294]
    pinact can output the result in the SARIF format.
    pinact run --format sarif
    This format is useful to integration tools like reviewdog and
    GitHub SARIF Code Scanning.
    Reviewdog:
    pinact run --diff --format sarif |
    reviewdog -f sarif -name pinact -reporter github-pr-review
  * GitHub SARIF Code Scanning:
  - run: pinact run --diff --format sarif &gt; sarif.json || true
  - name: Upload SARIF file
    uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
    with:
    sarif_file: sarif.json
    category: pinact
  * Support evironment variables PINACT_GITHUB_TOKEN and
    PINACT_GHES_TOKEN
    [#1297] You can use different access tokens for pinact and
    other tools.
  * Dependencies
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.1 (#1302)
  - chore(deps): update dependency aquaproj/aqua to v2.56.1
    (#1296)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.448.0 (#1292)
  - chore(deps): update dependency anchore/syft to v1.39.0
    (#1291)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.447.1 (#1290)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.447.0 (#1289)
  - chore(deps): update dependency aquaproj/aqua to v2.56.0
    (#1288)
  - fix(deps): update module github.com/goccy/go-yaml to v1.19.1
    (#1287)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.6.0 (#1285)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305601">- Update to version 3.8.0:
  * Features
  - #1315 Support ghtkn integration
    You can create a GitHub App User Access Token by ghtkn
    integration.
    About ghtkn, please see the document of ghtkn.
    https://github.com/suzuki-shunsuke/ghtkn
    You need to set up ghtkn first.
    export PINACT_GHTKN=true
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.450.0 (#1316)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.4 (#1314)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770120000">- Update to version 3.9.0:
  * Features
  - #1365 Make version separator configurable via configuration
    file @ReenigneArcher
  - #1372 Make version separator configurable via command line
    option and environment variable
  * Bug Fixes
  - #1359 Fix a bug that -log-color doesn't work
  * Others
  - docs: fix readme for ignore_actions[].ref by @nasa9084 in
    [#1323]
  - docs: fix readme for correct GHES_API_URL by @maruloop in
    [#1324]
  - docs(INSTALL): add mise alternate installation documentation
    by @jylenhof in #1331
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.465.0 (#1371)
  - fix(deps): update module github.com/google/go-github/v81 to
    v82 (#1368)
  - chore(deps): update dependency aquaproj/aqua to v2.56.6
    (#1370)
  - chore(deps): update dependency anchore/syft to v1.41.1
    (#1369)
  - chore(deps): update dependency crate-ci/typos to v1.42.3
    (#1367)
  - chore(deps): update dependency anchore/syft to v1.41.0
    (#1366)
  - chore(deps): update dependency crate-ci/typos to v1.42.2
    (#1364)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.464.0 (#1362)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.463.0 (#1361)
  - fix(deps): update module github.com/suzuki-shunsuke/slog-util
    to v0.3.1 (#1359)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.462.0 (#1360)
  - chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.5 (#1358)
  - chore(deps): update dependency crate-ci/typos to v1.42.1
    (#1357)
  - chore(deps): update actions/checkout action to v6.0.2 (#1356)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.10.0
    (#1355)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.461.0 (#1354)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.460.1 (#1353)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.459.0 (#1352)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.2
    (#1351)
  - chore(deps): update dependency aquaproj/aqua to v2.56.5
    (#1350)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.458.0 (#1349)
  - chore(deps): update dependency anchore/syft to v1.40.1
    (#1348)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.457.0 (#1347)
  - chore(deps): update dependency aquaproj/aqua to v2.56.4
    (#1346)
  - chore(deps): update dependency go to v1.25.6 (#1345)
  - fix(deps): update module
    github.com/suzuki-shunsuke/slog-error to v0.2.2 (#1344)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.456.0 (#1343)
  - chore(deps): update actions/setup-go action to v6.2.0 (#1341)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.455.0 (#1340)
  - chore(deps): update dependency aquaproj/aqua to v2.56.3
    (#1339)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.3 (#1338)
  - chore(deps): update dependency sigstore/cosign to v3.0.4
    (#1337)
  - chore(deps): update dependency anchore/syft to v1.40.0
    (#1336)
  - fix(deps): update module github.com/goccy/go-yaml to v1.19.2
    (#1335)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.8.0 (#1334)
  - chore(deps): update dependency crate-ci/typos to v1.42.0
    (#1332)
  - fix(deps): update module github.com/google/go-github/v80 to
    v81 (#1329)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.454.0 (#1330)
  - chore(deps): update dependency aquaproj/aqua to v2.56.2
    (#1328)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.453.0 (#1327)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.452.0 (#1325)
  - chore(deps): update dependency crate-ci/typos to v1.41.0
    (#1322)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.451.1 (#1321)
  - chore(deps): update dependency rhysd/actionlint to v1.7.10
    (#1320)
  - chore(deps): update dependency crate-ci/typos to v1.40.1
    (#1319)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.451.0 (#1318)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.8.0 (#1317)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777550400">- Update to version 3.9.2:
  * Fixes
  - #1493 Preserve original line endings when updating workflows
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.500.0 (#1495)
  - chore(deps): update dependency anchore/syft to v1.43.0
    (#1489)
  - chore(deps): update dependency aquaproj/aqua to v2.57.2
    (#1487)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.499.0 (#1486)
  - fix(deps): update module github.com/google/go-github/v84 to
    v85 (#1484)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.498.0 (#1485)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.497.0 (#1482)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.496.0 (#1481)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.495.0 (#1480)
  - chore(deps): update dependency crate-ci/typos to v1.45.1
    (#1476)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.494.1 (#1475)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.493.0 (#1473)
  - chore(deps): update dependency anchore/syft to v1.42.4
    (#1471)
  - chore(deps): update dependency sigstore/cosign to v3.0.6
    (#1470)
  - chore(deps): update dependency go to v1.26.2 (#1469)
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#1468)
  - chore(deps): update dependency crate-ci/typos to v1.45.0
    (#1467)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.492.0 (#1466)
  - chore(deps): update dependency rhysd/actionlint to v1.7.12
    (#1465)
  - fix(deps): update module github.com/hashicorp/go-version to
    v1.9.0 (#1464)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.491.0 (#1461)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.490.0 (#1459)
  - chore(deps): update dependency aquaproj/aqua-renovate-config
    to v2.12.0 (#1460)
  - fix(deps): update module github.com/google/go-github/v83 to
    v84 (#1415)
  - chore(deps): update suzuki-shunsuke/renovate-config to v4
    (#1439)
  - chore(deps): update actions/setup-go action to v6.4.0 (#1456)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.489.0 (#1455)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.8.0
    (#1453)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.488.0 (#1452)
  - chore(deps): update dependency suzuki-shunsuke/nllint to
    v1.1.0 (#1451)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.4 (#1450)
  - fix(deps): update module github.com/fatih/color to v1.19.0
    (#1446)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.487.0 (#1445)
  - chore(deps): update dependency anchore/syft to v1.42.3
    (#1444)
  - chore(deps): update dependency aquaproj/aqua to v2.57.1
    (#1443)
  - chore(deps): update suzuki-shunsuke/actionlint-action action
    to v0.1.2 (#1442)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.486.0 (#1440)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.485.0 (#1438)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.484.0 (#1437)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.3 (#1436)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.483.0 (#1433)
  - chore(deps): update dependency anchore/syft to v1.42.2
    (#1432)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.482.0 (#1431)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.2.3
    (#1429)
  - chore(deps): update dependency aquaproj/aqua to v2.57.0
    (#1430)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.481.0 (#1426)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.2 (#1425)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.480.0 (#1424)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.1 (#1423)
  - fix(deps): update module golang.org/x/oauth2 to v0.36.0
    (#1422)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.479.0 (#1421)
  - chore(deps): update dependency go to v1.26.1 (#1420)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.11.0
    (#1419)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.478.0 (#1418)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.477.0 (#1417)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.7.0
    (#1416)
  - chore(deps): update dependency crate-ci/typos to v1.44.0
    (#1414)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.14.1 (#1412)
  - chore(deps): update actions/setup-go action to v6.3.0 (#1413)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.476.0 (#1410)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.14.0 (#1409)
  - chore(deps): update dependency aquaproj/aqua to v2.56.7
    (#1408)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.475.0 (#1407)
  - chore(deps): update dependency sigstore/cosign to v3.0.5
    (#1406)
  - chore(deps): update dependency anchore/syft to v1.42.1
    (#1405)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.474.0 (#1404)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.2.2
    (#1399)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.10.1 (#1402)
  - chore(deps): update dependency go to v1.26.0 (#1388)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.9.0 (#1392)
  - fix(deps): update module github.com/google/go-github/v82 to
    v83 (#1398)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.473.0 (#1400)
  - chore(deps): update dependency crate-ci/typos to v1.43.5
    (#1397)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.472.1 (#1396)
  - chore(deps): update dependency rhysd/actionlint to v1.7.11
    (#1395)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.472.0 (#1394)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.471.0 (#1393)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.470.0 (#1391)
  - chore(deps): update dependency anchore/syft to v1.42.0
    (#1389)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.469.0 (#1387)
  - chore(deps): update dependency crate-ci/typos to v1.43.4
    (#1386)
  - chore(deps): update dependency crate-ci/typos to v1.43.3
    (#1384)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.468.0 (#1385)
  - chore(deps): update dependency crate-ci/typos to v1.43.2
    (#1383)
  - fix(deps): update module golang.org/x/oauth2 to v0.35.0
    (#1382)
  - chore(deps): update dependency go to v1.25.7 (#1381)
  - chore(deps): update dependency crate-ci/typos to v1.43.1
    (#1379)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.467.0 (#1380)
  - chore(deps): update dependency anchore/syft to v1.41.2
    (#1378)
  - chore(deps): update dependency crate-ci/typos to v1.43.0
    (#1377)
  - fix(deps): update module github.com/lmittmann/tint to v1.1.3
    (#1376)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.466.1 (#1375)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.466.0 (#1374)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.9.0 (#1373)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778673600">- Update to version 3.10.0:
  * Features
  - #1530 Support pinning branches to latest stable tags by the
  - -branch-to-tag option
    The default behabiour isn't changed.
    By default, pinact doesn't pin branches such as main or
    master.
    If you want to pin specific branches, you can use the
  - -branch-to-tag option.
    e.g.
    pinact run --branch-to-tag '^main$' --branch-to-tag '^release/.*$'
  * Dependencies
  - fix(deps): update module github.com/urfave/cli/v3 to v3.9.0
    (#1528)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.511.1 (#1527)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.511.0 (#1526)
  - chore(deps): update dependency crate-ci/typos to v1.46.1
    (#1525)
  - fix(deps): update module github.com/google/go-github/v85 to
    v86 (#1524)
  - chore(deps): update go module directive to v1.26.3 (#1523)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.2 (#1522)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.510.0 (#1521)
  - chore(deps): update dependency aquaproj/aqua to v2.58.1
    (#1520)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.509.0 (#1519)
  - chore(deps): update dependency mvdan/gofumpt to v0.10.0
    (#1518)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.508.0 (#1517)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.15.4 (#1516)
  - chore(deps): update dependency aquaproj/aqua to v2.58.0
    (#1515)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.507.0 (#1514)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.1 (#1513)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.0 (#1510)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.506.0 (#1512)
  - chore(deps): update dependency anchore/syft to v1.44.0
    (#1511)
  - chore(deps): update dependency crate-ci/typos to v1.46.0
    (#1509)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.505.0 (#1506)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.504.0 (#1505)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v8 (#1504)
  - chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.6 (#1502)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5.0.2 (#1503)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.503.0 (#1501)
  - chore(deps): update dependency crate-ci/typos to v1.45.2
    (#1500)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.502.0 (#1499)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.501.0 (#1498)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.9.2 (#1497)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 3.10.1:
  * Bug Fixes
  - #1535 pin uses lines with multiple spaces after the YAML list
    dash
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.512.0 (#1533)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.10.0 (#1532)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 4.0.0:
  * Breaking Changes
  - #1540 Removed the -review option
    Output SARIF and pass it to reviewdog. This has been
    announced previously.
    pinact run -format sarif |
    reviewdog -f sarif -name pinact -reporter github-pr-review
  * #1540 Always output diff
    Even if you specify -diff=false, it is ignored.
  * #1540 -diff and -check are now aliases for -fix=false
    This simplifies the logic, making it easier to understand and
    less prone to bugs.
  * #1540 -verify is now an alias for --verify-comment
  - verify was unclear about what was being verified, so it has
    been renamed for clarity.
    However, -verify is kept as-is to maintain backward
    compatibility.
  * #1458 #1558 Version comments are now required @ManuelLerchnerQC
    For SHAs without a version comment, pinact automatically adds a
    version comment (validation error if -fix=false).
    $ pinact run test.yaml
    test.yaml:1
  - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
    + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    Specifying a version comment makes it easier to see which
    version is being used, and makes it easier for tools like
    Renovate and Dependabot to update.
    It also has security implications.
    For GitHub Actions versions, you can also specify the SHA of a
    commit in a fork.
    This means it could point to a malicious commit in a fork.
    If you specify only the SHA without a version comment, you
    cannot tell whether it is the SHA of a commit in a fork.
    By requiring version comments, you can verify that the version
    comment matches the SHA using the --verify-comment option.
    Even if a fake version comment is added to a fork's SHA, it can
    be detected by --verify-comment.
    An attacker could also create a tag pointing to a fork's SHA,
    but creating a tag requires write permission, which raises the
    bar for attacks, so this can be said to improve security.
    Of course, this is only meaningful if you verify with
  - -verify-comment, so it is recommended to run pinact with
  - -verify-comment in CI.
  * Features
  - -no-api: support for offline validation
    If you just want to check whether something is pinned, you
    don't really need to use the GitHub API, but previously the
    GitHub API was called.
    With the -no-api option, you can validate without calling the
    GitHub API.
    However, since API calls are currently essential for fixing
    code (this may change in the future if caching is supported),
    you need to specify either -fix=false or -format sarif.
    Implicitly treating it as -fix=false could cause behavior to
    change and become a breaking change when caching is
    supported, so it must currently be specified explicitly.
  - You can now check whether the version being used satisfies
    min age, not just newer versions
    For example, you can run it in CI against modified lines to
    check whether any dangerous versions that do not satisfy min
    age are being used.
    This is not checked by default, but is checked when you run
    pinact run --verify-min-age or pinact run -min-age &lt;min age&gt;.
  - More flexible min age support via rules
    min age can now be configured in the configuration file.
    Additionally, by using rules, you can apply settings such as
    min age to specific actions.
    min_age:
    value: 7 # default setting
    rules:
    [#] Allow latest for suzuki-shunsuke's actions
  - ignore: true
    conditions:
  - expr: |
    ActionRepoOwner == "suzuki-shunsuke" &amp;&amp; ActionVersion == "latest"
    [#] Set min age to 0 for actions/checkout
  - min_age: 0
    conditions:
  - expr: |
    ActionRepoFullName == "actions/checkout"
    For rules, conditions are evaluated per rule, and the
    settings are applied if matched.
    You can write multiple conditions, and the settings are
    applied if any one of the conditions matches.
    expr follows https://expr-lang.org/docs/language-definition.
    Please read the documentation for details.
    The settings of rules listed later in rules take precedence.
  - Support for a global configuration file
    Warning
    If you have set the PINACT_MIN_AGE environment variable in
    ~/.bashrc, ~/.zshrc, etc., it is recommended to remove it
    and use a global configuration file instead.
    PINACT_MIN_AGE takes precedence over the configuration
    file, so it overrides the project's settings.
    On the other hand, global settings are merged with lower
    priority than the project's settings.
    If you want to enforce the setting, PINACT_MIN_AGE is
    suitable, but for default settings, a global configuration
    file is more appropriate.
    Note also that environment variables do not allow flexible
    settings like rules.
    A global configuration file is now supported.
    The file path is searched in the following order of priority:
  - $PINACT_GLOBAL_CONFIG
  - ${XDG_CONFIG_HOME}/pinact/pinact.yaml
  - ${HOME}/.config/pinact/pinact.yaml
    rules are prepended before the rules in the project
    configuration file.
    So project settings take precedence over global settings.
  - Automatic correction of version comments via -verify-comment
    If the SHA and the version comment do not match, the version
    comment is automatically corrected to match the SHA.
    Previously, it would just return an error, but now it is
    automatically corrected.
  - -diff-file: limit pinact's targets to only the changed lines
    If you specify a file in Unified Diff Format via -diff-file,
    you can limit pinact's targets to only the changed lines.
    By passing the PR's diff file in PR CI, you can reduce
    unnecessary API calls and prevent corrections or errors from
    code unrelated to the PR's changes.
    This makes it easier to introduce pinact via Required
    Workflow across an entire GitHub Organization of a large
    development organization.
    To improve the overall health of a development organization,
    it is desirable to introduce pinact via Required Workflow.
    However, if you suddenly introduce pinact as a Required
    Workflow in an Organization that has a lot of originally
    unpinned code, errors and corrections unrelated to the PR's
    changes will occur everywhere, causing confusion.
    When errors occur in places unrelated to the PR's changes,
    the PR author thinks "what is this error?", "wait, do I have
    to fix this? It's unrelated to this PR so I want to split the
    PR, but creating a PR is a hassle."
    It is also possible that the same error occurs in multiple
    PRs, and each one independently performs redundant fixing
    work.
    Inquiries about errors come in from various teams, generating
    unnecessary costs.
    If you try to fix everything before introducing the Required
    Workflow, it takes time to introduce, and during that time
    the bad situation continues where new unpinned code keeps
    increasing.
    On the other hand, if you can fix and validate only the lines
    changed in a PR, the PR author can more easily accept making
    the fix, and there is no need to split the PR.
    However, this alone does not pin existing code, so in
    parallel with this, you still need to run pinact against each
    repository and create PRs.
    How do you generate the file specified by -diff-file? You can
    easily generate it using the action
    https://github.com/suzuki-shunsuke/pr-unified-diff-action.
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    with:
    persist-credentials: false
  - uses: suzuki-shunsuke/pr-unified-diff-action@c932c1df5f577028d8ca05d2d3c0c059072d8821 # v0.0.1
    id: diff
  - uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
    with:
    diff_file: ${{ steps.diff.outputs.diff_path }}
  * Changelog
  - fix(deps): update module github.com/google/go-github/v87 to
    v88 (#1564)
  - fix(run): filter --diff-file targets by workflow patterns
    (#1562)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.516.0 (#1559)
  - feat!: error when SHA-pinned action has no version comment
    (#1558)
  - fix(run): use --diff-file as the file source when no
    args/config (#1557)
  - feat(verify): auto-correct version comments to match actual
    SHA (#1435)
  - fix(run): normalize --diff-file paths to forward slashes for
    Windows (#1552)
  - feat: add version comment to pinned actions missing
    annotation (#1458)
  - fix: honor rules[].min_age in update-target cooldown filter
    (#1556)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.515.0 (#1555)
  - docs: fix a broken link (#1554)
  - fix(deps): update module github.com/google/go-github/v86 to
    v87 (#1550)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.514.0 (#1549)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.513.1 (#1548)
  - feat(run): add --diff-file to process only PR-changed lines
    (#1547)
  - chore(deps): update dependency aquaproj/aqua-renovate-config
    to v2.12.1 (#1546)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.513.0 (#1545)
  - feat(config): merge global and project configs field-by-field
    (#1543)
  - chore(deps): update suzuki-shunsuke/go-autofix-action action
    to v0.1.12 (#1544)
  - feat(config): PINACT_GLOBAL_CONFIG env var overrides the
    global config path (#1542)
  - v4 spec implementation (#1540)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.512.1 (#1541)
  - chore(deps): update dependency aquaproj/aqua to v2.59.0
    (#1539)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.10.1 (#1537)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781006400">- Update to version 4.1.0:
  * Features
  - #1578 Update ghtkn-go-sdk to v0.3.0 for backend and disable
    device flow support
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.523.0 (#1594)
  - chore(deps): update dependency anchore/syft to v1.45.1
    (#1593)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.522.0 (#1592)
  - chore(deps): update dependency crate-ci/typos to v1.47.2
    (#1587)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v8.1.0 (#1588)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.521.0 (#1586)
  - chore(deps): update dependency crate-ci/typos to v1.47.1
    (#1585)
  - chore(deps): update actions/checkout action to v6.0.3 (#1583)
  - chore(deps): update dependency anchore/syft to v1.45.0
    (#1584)
  - chore(deps): update go module directive to v1.26.4 (#1582)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.2 (#1580)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.1 (#1577)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.0 (#1576)
  - chore(deps): update dependency crate-ci/typos to v1.47.0
    (#1575)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.519.0 (#1574)
  - chore(deps): update suzuki-shunsuke/actionlint-action action
    to v0.1.4 (#1573)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.518.0 (#1572)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.16.0 (#1571)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.517.0 (#1570)
  - chore(deps): update dependency aquaproj/aqua to v2.59.1
    (#1569)
  - chore(deps): update dependency crate-ci/typos to v1.46.3
    (#1568)
  - chore(deps): update dependency suzuki-shunsuke/pinact to v4
    (#1565)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1785412800">- Update to version 4.1.1:
  * Dependency Updates
  - #1634 Update Go to v1.26.5
  - #1659 Update module github.com/suzuki-shunsuke/ghtkn-go-sdk
    to v0.5.0
  - #1622 Update module github.com/urfave/cli/v3 to v3.10.1
  - #1633 Update module github.com/google/go-github/v88 to v89
  - #1646 Update dependency sigstore/cosign to v3.1.2
  - #1653 Update dependency anchore/syft to v1.49.0
  - #1657 Update dependency goreleaser/goreleaser to v2.17.1</changelog>
</package>
<package pkgid="8ed67edbe5ec31e3b1f86f9fdbe674ca1b5d13d13f7d5073f614885283738d6740a3180a00db03e89a6ff05fcf2306d1ec3d8c1d97698e4abeed9a70490fb0e5" name="pinact" arch="src">
  <version epoch="0" ver="4.1.1" rel="30.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- new package pinact: CLI to edit GitHub Workflow and Composite
  action files and pin versions of Actions and Reusable Workflows.
  pinact can also update their versions and verify version
  annotations</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516801">- Update to version 3.4.2:
  * fix(casks): restrict quarantine removal to macOS only (#1103)
  * test: add comprehensive unit tests for version comparison
    functions (#1102)
  * feat: add Claude Code auto-formatting hooks (#1101)
  * docs: add comprehensive AI assistant guidelines with shared
    documentation (#1100)
  * docs: add CLAUDE.md with project guidelines for AI assistants
    (#1099)
  * docs: add comprehensive documentation comments to all packages
    (#1098)
  * chore(deps): update dependency anchore/syft to v1.31.0 (#1097)
  * ci: use go-test-full-workflow (#1094)
  * chore: use aqua lsp (#1093)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.403.0 (#1092)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380800">- Update to version 3.4.3:
  * Bug Fixes
  - #1201 Skip prereleases when current version is stable
    @mceachen
  - #1213 Fixed bugs of #1201
  * Dependencies
  - chore(deps): update actions/setup-go action to v6 (#1123)
  - chore(deps): update aquaproj/aqua-installer action to v4.0.3
    (#1113)
  - chore(deps): update aquaproj/aqua-installer action to v4.0.4
    (#1198)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.9.0
    (#1136)
  - chore(deps): update dependency anchore/syft to v1.32.0
    (#1110)
  - chore(deps): update dependency anchore/syft to v1.33.0
    (#1143)
  - chore(deps): update dependency anchore/syft to v1.34.1
    (#1182)
  - chore(deps): update dependency anchore/syft to v1.34.2
    (#1183)
  - chore(deps): update dependency anchore/syft to v1.36.0
    (#1192)
  - chore(deps): update dependency anchore/syft to v1.37.0
    (#1202)
  - chore(deps): update dependency aquaproj/aqua to v2.53.10
    (#1114)
  - chore(deps): update dependency aquaproj/aqua to v2.53.11
    (#1126)
  - chore(deps): update dependency aquaproj/aqua to v2.54.0
    (#1134)
  - chore(deps): update dependency aquaproj/aqua to v2.54.1
    (#1137)
  - chore(deps): update dependency aquaproj/aqua to v2.55.0
    (#1148)
  - chore(deps): update dependency aquaproj/aqua to v2.55.1
    (#1190)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.404.0 (#1106)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.405.0 (#1107)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.406.0 (#1108)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.407.0 (#1111)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.408.0 (#1116)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.409.0 (#1127)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.409.1 (#1128)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.410.0 (#1129)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.411.0 (#1131)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.411.1 (#1135)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.412.0 (#1142)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.413.0 (#1146)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.414.0 (#1149)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.415.0 (#1150)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.416.0 (#1153)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.417.0 (#1154)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.418.0 (#1157)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.419.0 (#1160)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.420.0 (#1163)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.421.0 (#1165)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.422.0 (#1167)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.423.0 (#1168)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.424.0 (#1169)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.425.0 (#1171)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.426.0 (#1173)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.427.0 (#1176)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.428.0 (#1181)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.429.0 (#1184)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.430.0 (#1187)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.430.1 (#1193)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.431.0 (#1195)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.432.0 (#1196)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.433.0 (#1199)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.434.0 (#1207)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.435.0 (#1209)
  - chore(deps): update dependency crate-ci/typos to v1.35.5
    (#1105)
  - chore(deps): update dependency crate-ci/typos to v1.35.6
    (#1112)
  - chore(deps): update dependency crate-ci/typos to v1.36.1
    (#1117)
  - chore(deps): update dependency crate-ci/typos to v1.36.2
    (#1125)
  - chore(deps): update dependency crate-ci/typos to v1.36.3
    (#1159)
  - chore(deps): update dependency go to v1.25.1 (#1141)
  - chore(deps): update dependency go to v1.25.2 (#1172)
  - chore(deps): update dependency go to v1.25.3 (#1179)
  - chore(deps): update dependency go to v1.25.4 (#1204)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.5.0 (#1152)
  - chore(deps): update dependency google/go-licenses to v2
    (#1122)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.0 (#1118)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.1 (#1145)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.2 (#1147)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.3 (#1158)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.4 (#1162)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.5 (#1164)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.6 (#1188)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.7 (#1194)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.0
    (#1119)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.1
    (#1130)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.2
    (#1186)
  - chore(deps): update dependency reviewdog/reviewdog to v0.21.0
    (#1120)
  - chore(deps): update dependency rhysd/actionlint to v1.7.8
    (#1177)
  - chore(deps): update dependency sigstore/cosign to v2.6.0
    (#1139)
  - chore(deps): update dependency sigstore/cosign to v2.6.1
    (#1166)
  - chore(deps): update dependency sigstore/cosign to v3 (#1175)
  - chore(deps): update dependency sigstore/cosign to v3.0.2
    (#1178)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.2 (#1104)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v6.0.2 (#1115)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v7 (#1189)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v4.0.1 (#1156)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5 (#1174)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5.0.1 (#1191)
  - chore(deps): update suzuki-shunsuke/renovate-config to v3.3.0
    (#1121)
  - chore(deps): update suzuki-shunsuke/renovate-config to v3.3.1
    (#1144)
  - fix(deps): update module github.com/google/go-github/v74 to
    v75 (#1155)
  - fix(deps): update module github.com/google/go-github/v75 to
    v76 (#1180)
  - fix(deps): update module github.com/google/go-github/v76 to
    v78 (#1206)
  - fix(deps): update module github.com/spf13/afero to v1.15.0
    (#1132)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.5.0
    (#1185)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.0
    (#1208)
  - fix(deps): update module golang.org/x/oauth2 to v0.31.0
    (#1124)
  - fix(deps): update module golang.org/x/oauth2 to v0.32.0
    (#1170)
  - fix(deps): update module golang.org/x/oauth2 to v0.33.0
    (#1205)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380801">- Update to version 3.4.4:
  * Bug Fixes
  - Skip prerelease tags when current version is stable
    @fredericlepied
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.436.0 (#1215)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.3 (#1214)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764244800">- Update to version 3.4.5:
  * Bug Fixes
  - fix: ignore draft releases (#1237)
  * Dependencies
  - chore(deps): update actions/checkout action to v6 (#1232)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.440.0 (#1235)
  - chore(deps): update dependency rhysd/actionlint to v1.7.9
    (#1234)
  - chore(deps): update dependency aquaproj/aqua to v2.55.2
    (#1233)
  - chore(deps): update actions/setup-go action to v6.1.0 (#1230)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.439.0 (#1229)
  - chore(deps): update dependency anchore/syft to v1.38.0
    (#1228)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.438.0 (#1227)
  - fix(deps): update module github.com/google/go-github/v78 to
    v79 (#1222)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.1
    (#1225)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.437.0 (#1224)
  - chore(deps): update actions/checkout action to v5.0.1 (#1223)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.4 (#1221)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765195200">- Update to version 3.4.6:
  * #1250 #1251 Replace logrus with slog
  * #1109 #1254 Refactoring
  * chore(deps): update dependency crate-ci/typos to v1.37.0
    (#1161)
  * chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.4 (#1253)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.444.0 (#1249)
  * chore(deps): update dependency go to v1.25.5 (#1248)
  * chore(deps): update actions/checkout action to v6.0.1 (#1247)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.443.0 (#1246)
  * chore(deps): update dependency goreleaser/goreleaser to v2.13.0
    (#1245)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.442.1 (#1244)
  * chore(deps): update suzuki-shunsuke/go-autofix-action action to
    v0.1.11 (#1243)
  * fix(deps): update module github.com/goccy/go-yaml to v1.19.0
    (#1242)
  * fix(deps): update module github.com/hashicorp/go-version to
    v1.8.0 (#1241)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.442.0 (#1240)
  * chore(deps): update dependency suzuki-shunsuke/pinact to v3.4.5
    (#1238)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.441.0 (#1239)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 3.5.0:
  * Features
  - #1266 #1267 Add --min-age (-m) option
    Skip recently released versions when updating actions with -u
    flag.
    pinact run -u --min-age 7
    [#] or using short alias
    pinact run -u -m 7
    This helps avoid updating to potentially unstable versions
    that haven't had time to prove their stability.
  - For GitHub Releases, the PublishedAt date is checked
  - For tags, the commit's Committer.Date is checked
  * Refactoring
  - #1259 Use Destination pattern for urfave/cli flags
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua to v2.55.3
    (#1264)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.444.2 (#1263)
  - fix(deps): update module golang.org/x/oauth2 to v0.34.0
    (#1262)
  - fix(deps): update module github.com/google/go-github/v79 to
    v80 (#1261)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.1.2
    (#1260)
  - chore(deps): update dependency suzuki-shunsuke/nllint to v1
    (#1258)
  - chore(deps): update dependency crate-ci/typos to v1.40.0
    (#1257)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.6 (#1256)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765886400">- Update to version 3.6.0:
  * Features
  - #1275 Support GitHub Enterprise
  - #1282 #1284 Support PINACT_MIN_AGE environment variable for
  - min-age option
  * Bug Fixes
  - #1283 Fix a bug that pinact token set can't be cancelled by
    ctrl-c
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.446.0 (#1281)
  - chore(deps): update dependency anchore/syft to v1.38.2
    (#1276)
  - chore(deps): update dependency sigstore/cosign to v3.0.3
    (#1277)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.1 (#1272)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.7.2 (#1270)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.445.0 (#1269)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.5.0 (#1268)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305600">- Update to version 3.7.4:
  * Bug Fixes
  - Ignore tags associated with releases #1313
- Update to version 3.7.3:
  * #1309 Fix some bugs
  - -verify is ignored if -u is used
  - versions aren't pinned and verified if version comments are
    semver
    Details see
    https://github.com/suzuki-shunsuke/pinact/releases/tag/v3.7.3
- Update to version 3.7.2:
  * Fixes
  - sarif: Add fixes field for reviewdog suggestion support
  * Dependencies
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.3 (#1310)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.449.0 (#1311)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.448.1 (#1307)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.2 (#1306)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.2 (#1305)
- Update to version 3.7.1:
  There is no change between v3.7.0 and v3.7.1.
  There was an issue during the release of v3.7.0, so we released
  v3.7.1.
- Update to version 3.7.0:
  * Features
  - #1294 SARIF Output Support
  - #1297 Support evironment variables PINACT_GITHUB_TOKEN and
    PINACT_GHES_TOKEN
  * SARIF Output Support
    [#1294]
    pinact can output the result in the SARIF format.
    pinact run --format sarif
    This format is useful to integration tools like reviewdog and
    GitHub SARIF Code Scanning.
    Reviewdog:
    pinact run --diff --format sarif |
    reviewdog -f sarif -name pinact -reporter github-pr-review
  * GitHub SARIF Code Scanning:
  - run: pinact run --diff --format sarif &gt; sarif.json || true
  - name: Upload SARIF file
    uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
    with:
    sarif_file: sarif.json
    category: pinact
  * Support evironment variables PINACT_GITHUB_TOKEN and
    PINACT_GHES_TOKEN
    [#1297] You can use different access tokens for pinact and
    other tools.
  * Dependencies
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.1 (#1302)
  - chore(deps): update dependency aquaproj/aqua to v2.56.1
    (#1296)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.448.0 (#1292)
  - chore(deps): update dependency anchore/syft to v1.39.0
    (#1291)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.447.1 (#1290)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.447.0 (#1289)
  - chore(deps): update dependency aquaproj/aqua to v2.56.0
    (#1288)
  - fix(deps): update module github.com/goccy/go-yaml to v1.19.1
    (#1287)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.6.0 (#1285)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305601">- Update to version 3.8.0:
  * Features
  - #1315 Support ghtkn integration
    You can create a GitHub App User Access Token by ghtkn
    integration.
    About ghtkn, please see the document of ghtkn.
    https://github.com/suzuki-shunsuke/ghtkn
    You need to set up ghtkn first.
    export PINACT_GHTKN=true
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.450.0 (#1316)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.4 (#1314)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770120000">- Update to version 3.9.0:
  * Features
  - #1365 Make version separator configurable via configuration
    file @ReenigneArcher
  - #1372 Make version separator configurable via command line
    option and environment variable
  * Bug Fixes
  - #1359 Fix a bug that -log-color doesn't work
  * Others
  - docs: fix readme for ignore_actions[].ref by @nasa9084 in
    [#1323]
  - docs: fix readme for correct GHES_API_URL by @maruloop in
    [#1324]
  - docs(INSTALL): add mise alternate installation documentation
    by @jylenhof in #1331
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.465.0 (#1371)
  - fix(deps): update module github.com/google/go-github/v81 to
    v82 (#1368)
  - chore(deps): update dependency aquaproj/aqua to v2.56.6
    (#1370)
  - chore(deps): update dependency anchore/syft to v1.41.1
    (#1369)
  - chore(deps): update dependency crate-ci/typos to v1.42.3
    (#1367)
  - chore(deps): update dependency anchore/syft to v1.41.0
    (#1366)
  - chore(deps): update dependency crate-ci/typos to v1.42.2
    (#1364)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.464.0 (#1362)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.463.0 (#1361)
  - fix(deps): update module github.com/suzuki-shunsuke/slog-util
    to v0.3.1 (#1359)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.462.0 (#1360)
  - chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.5 (#1358)
  - chore(deps): update dependency crate-ci/typos to v1.42.1
    (#1357)
  - chore(deps): update actions/checkout action to v6.0.2 (#1356)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.10.0
    (#1355)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.461.0 (#1354)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.460.1 (#1353)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.459.0 (#1352)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.2
    (#1351)
  - chore(deps): update dependency aquaproj/aqua to v2.56.5
    (#1350)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.458.0 (#1349)
  - chore(deps): update dependency anchore/syft to v1.40.1
    (#1348)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.457.0 (#1347)
  - chore(deps): update dependency aquaproj/aqua to v2.56.4
    (#1346)
  - chore(deps): update dependency go to v1.25.6 (#1345)
  - fix(deps): update module
    github.com/suzuki-shunsuke/slog-error to v0.2.2 (#1344)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.456.0 (#1343)
  - chore(deps): update actions/setup-go action to v6.2.0 (#1341)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.455.0 (#1340)
  - chore(deps): update dependency aquaproj/aqua to v2.56.3
    (#1339)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.3 (#1338)
  - chore(deps): update dependency sigstore/cosign to v3.0.4
    (#1337)
  - chore(deps): update dependency anchore/syft to v1.40.0
    (#1336)
  - fix(deps): update module github.com/goccy/go-yaml to v1.19.2
    (#1335)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.8.0 (#1334)
  - chore(deps): update dependency crate-ci/typos to v1.42.0
    (#1332)
  - fix(deps): update module github.com/google/go-github/v80 to
    v81 (#1329)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.454.0 (#1330)
  - chore(deps): update dependency aquaproj/aqua to v2.56.2
    (#1328)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.453.0 (#1327)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.452.0 (#1325)
  - chore(deps): update dependency crate-ci/typos to v1.41.0
    (#1322)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.451.1 (#1321)
  - chore(deps): update dependency rhysd/actionlint to v1.7.10
    (#1320)
  - chore(deps): update dependency crate-ci/typos to v1.40.1
    (#1319)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.451.0 (#1318)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.8.0 (#1317)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777550400">- Update to version 3.9.2:
  * Fixes
  - #1493 Preserve original line endings when updating workflows
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.500.0 (#1495)
  - chore(deps): update dependency anchore/syft to v1.43.0
    (#1489)
  - chore(deps): update dependency aquaproj/aqua to v2.57.2
    (#1487)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.499.0 (#1486)
  - fix(deps): update module github.com/google/go-github/v84 to
    v85 (#1484)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.498.0 (#1485)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.497.0 (#1482)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.496.0 (#1481)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.495.0 (#1480)
  - chore(deps): update dependency crate-ci/typos to v1.45.1
    (#1476)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.494.1 (#1475)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.493.0 (#1473)
  - chore(deps): update dependency anchore/syft to v1.42.4
    (#1471)
  - chore(deps): update dependency sigstore/cosign to v3.0.6
    (#1470)
  - chore(deps): update dependency go to v1.26.2 (#1469)
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#1468)
  - chore(deps): update dependency crate-ci/typos to v1.45.0
    (#1467)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.492.0 (#1466)
  - chore(deps): update dependency rhysd/actionlint to v1.7.12
    (#1465)
  - fix(deps): update module github.com/hashicorp/go-version to
    v1.9.0 (#1464)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.491.0 (#1461)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.490.0 (#1459)
  - chore(deps): update dependency aquaproj/aqua-renovate-config
    to v2.12.0 (#1460)
  - fix(deps): update module github.com/google/go-github/v83 to
    v84 (#1415)
  - chore(deps): update suzuki-shunsuke/renovate-config to v4
    (#1439)
  - chore(deps): update actions/setup-go action to v6.4.0 (#1456)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.489.0 (#1455)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.8.0
    (#1453)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.488.0 (#1452)
  - chore(deps): update dependency suzuki-shunsuke/nllint to
    v1.1.0 (#1451)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.4 (#1450)
  - fix(deps): update module github.com/fatih/color to v1.19.0
    (#1446)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.487.0 (#1445)
  - chore(deps): update dependency anchore/syft to v1.42.3
    (#1444)
  - chore(deps): update dependency aquaproj/aqua to v2.57.1
    (#1443)
  - chore(deps): update suzuki-shunsuke/actionlint-action action
    to v0.1.2 (#1442)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.486.0 (#1440)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.485.0 (#1438)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.484.0 (#1437)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.3 (#1436)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.483.0 (#1433)
  - chore(deps): update dependency anchore/syft to v1.42.2
    (#1432)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.482.0 (#1431)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.2.3
    (#1429)
  - chore(deps): update dependency aquaproj/aqua to v2.57.0
    (#1430)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.481.0 (#1426)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.2 (#1425)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.480.0 (#1424)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.1 (#1423)
  - fix(deps): update module golang.org/x/oauth2 to v0.36.0
    (#1422)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.479.0 (#1421)
  - chore(deps): update dependency go to v1.26.1 (#1420)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.11.0
    (#1419)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.478.0 (#1418)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.477.0 (#1417)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.7.0
    (#1416)
  - chore(deps): update dependency crate-ci/typos to v1.44.0
    (#1414)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.14.1 (#1412)
  - chore(deps): update actions/setup-go action to v6.3.0 (#1413)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.476.0 (#1410)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.14.0 (#1409)
  - chore(deps): update dependency aquaproj/aqua to v2.56.7
    (#1408)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.475.0 (#1407)
  - chore(deps): update dependency sigstore/cosign to v3.0.5
    (#1406)
  - chore(deps): update dependency anchore/syft to v1.42.1
    (#1405)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.474.0 (#1404)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.2.2
    (#1399)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.10.1 (#1402)
  - chore(deps): update dependency go to v1.26.0 (#1388)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.9.0 (#1392)
  - fix(deps): update module github.com/google/go-github/v82 to
    v83 (#1398)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.473.0 (#1400)
  - chore(deps): update dependency crate-ci/typos to v1.43.5
    (#1397)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.472.1 (#1396)
  - chore(deps): update dependency rhysd/actionlint to v1.7.11
    (#1395)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.472.0 (#1394)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.471.0 (#1393)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.470.0 (#1391)
  - chore(deps): update dependency anchore/syft to v1.42.0
    (#1389)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.469.0 (#1387)
  - chore(deps): update dependency crate-ci/typos to v1.43.4
    (#1386)
  - chore(deps): update dependency crate-ci/typos to v1.43.3
    (#1384)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.468.0 (#1385)
  - chore(deps): update dependency crate-ci/typos to v1.43.2
    (#1383)
  - fix(deps): update module golang.org/x/oauth2 to v0.35.0
    (#1382)
  - chore(deps): update dependency go to v1.25.7 (#1381)
  - chore(deps): update dependency crate-ci/typos to v1.43.1
    (#1379)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.467.0 (#1380)
  - chore(deps): update dependency anchore/syft to v1.41.2
    (#1378)
  - chore(deps): update dependency crate-ci/typos to v1.43.0
    (#1377)
  - fix(deps): update module github.com/lmittmann/tint to v1.1.3
    (#1376)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.466.1 (#1375)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.466.0 (#1374)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.9.0 (#1373)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778673600">- Update to version 3.10.0:
  * Features
  - #1530 Support pinning branches to latest stable tags by the
  - -branch-to-tag option
    The default behabiour isn't changed.
    By default, pinact doesn't pin branches such as main or
    master.
    If you want to pin specific branches, you can use the
  - -branch-to-tag option.
    e.g.
    pinact run --branch-to-tag '^main$' --branch-to-tag '^release/.*$'
  * Dependencies
  - fix(deps): update module github.com/urfave/cli/v3 to v3.9.0
    (#1528)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.511.1 (#1527)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.511.0 (#1526)
  - chore(deps): update dependency crate-ci/typos to v1.46.1
    (#1525)
  - fix(deps): update module github.com/google/go-github/v85 to
    v86 (#1524)
  - chore(deps): update go module directive to v1.26.3 (#1523)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.2 (#1522)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.510.0 (#1521)
  - chore(deps): update dependency aquaproj/aqua to v2.58.1
    (#1520)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.509.0 (#1519)
  - chore(deps): update dependency mvdan/gofumpt to v0.10.0
    (#1518)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.508.0 (#1517)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.15.4 (#1516)
  - chore(deps): update dependency aquaproj/aqua to v2.58.0
    (#1515)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.507.0 (#1514)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.1 (#1513)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.0 (#1510)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.506.0 (#1512)
  - chore(deps): update dependency anchore/syft to v1.44.0
    (#1511)
  - chore(deps): update dependency crate-ci/typos to v1.46.0
    (#1509)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.505.0 (#1506)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.504.0 (#1505)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v8 (#1504)
  - chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.6 (#1502)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5.0.2 (#1503)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.503.0 (#1501)
  - chore(deps): update dependency crate-ci/typos to v1.45.2
    (#1500)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.502.0 (#1499)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.501.0 (#1498)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.9.2 (#1497)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 3.10.1:
  * Bug Fixes
  - #1535 pin uses lines with multiple spaces after the YAML list
    dash
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.512.0 (#1533)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.10.0 (#1532)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 4.0.0:
  * Breaking Changes
  - #1540 Removed the -review option
    Output SARIF and pass it to reviewdog. This has been
    announced previously.
    pinact run -format sarif |
    reviewdog -f sarif -name pinact -reporter github-pr-review
  * #1540 Always output diff
    Even if you specify -diff=false, it is ignored.
  * #1540 -diff and -check are now aliases for -fix=false
    This simplifies the logic, making it easier to understand and
    less prone to bugs.
  * #1540 -verify is now an alias for --verify-comment
  - verify was unclear about what was being verified, so it has
    been renamed for clarity.
    However, -verify is kept as-is to maintain backward
    compatibility.
  * #1458 #1558 Version comments are now required @ManuelLerchnerQC
    For SHAs without a version comment, pinact automatically adds a
    version comment (validation error if -fix=false).
    $ pinact run test.yaml
    test.yaml:1
  - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
    + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    Specifying a version comment makes it easier to see which
    version is being used, and makes it easier for tools like
    Renovate and Dependabot to update.
    It also has security implications.
    For GitHub Actions versions, you can also specify the SHA of a
    commit in a fork.
    This means it could point to a malicious commit in a fork.
    If you specify only the SHA without a version comment, you
    cannot tell whether it is the SHA of a commit in a fork.
    By requiring version comments, you can verify that the version
    comment matches the SHA using the --verify-comment option.
    Even if a fake version comment is added to a fork's SHA, it can
    be detected by --verify-comment.
    An attacker could also create a tag pointing to a fork's SHA,
    but creating a tag requires write permission, which raises the
    bar for attacks, so this can be said to improve security.
    Of course, this is only meaningful if you verify with
  - -verify-comment, so it is recommended to run pinact with
  - -verify-comment in CI.
  * Features
  - -no-api: support for offline validation
    If you just want to check whether something is pinned, you
    don't really need to use the GitHub API, but previously the
    GitHub API was called.
    With the -no-api option, you can validate without calling the
    GitHub API.
    However, since API calls are currently essential for fixing
    code (this may change in the future if caching is supported),
    you need to specify either -fix=false or -format sarif.
    Implicitly treating it as -fix=false could cause behavior to
    change and become a breaking change when caching is
    supported, so it must currently be specified explicitly.
  - You can now check whether the version being used satisfies
    min age, not just newer versions
    For example, you can run it in CI against modified lines to
    check whether any dangerous versions that do not satisfy min
    age are being used.
    This is not checked by default, but is checked when you run
    pinact run --verify-min-age or pinact run -min-age &lt;min age&gt;.
  - More flexible min age support via rules
    min age can now be configured in the configuration file.
    Additionally, by using rules, you can apply settings such as
    min age to specific actions.
    min_age:
    value: 7 # default setting
    rules:
    [#] Allow latest for suzuki-shunsuke's actions
  - ignore: true
    conditions:
  - expr: |
    ActionRepoOwner == "suzuki-shunsuke" &amp;&amp; ActionVersion == "latest"
    [#] Set min age to 0 for actions/checkout
  - min_age: 0
    conditions:
  - expr: |
    ActionRepoFullName == "actions/checkout"
    For rules, conditions are evaluated per rule, and the
    settings are applied if matched.
    You can write multiple conditions, and the settings are
    applied if any one of the conditions matches.
    expr follows https://expr-lang.org/docs/language-definition.
    Please read the documentation for details.
    The settings of rules listed later in rules take precedence.
  - Support for a global configuration file
    Warning
    If you have set the PINACT_MIN_AGE environment variable in
    ~/.bashrc, ~/.zshrc, etc., it is recommended to remove it
    and use a global configuration file instead.
    PINACT_MIN_AGE takes precedence over the configuration
    file, so it overrides the project's settings.
    On the other hand, global settings are merged with lower
    priority than the project's settings.
    If you want to enforce the setting, PINACT_MIN_AGE is
    suitable, but for default settings, a global configuration
    file is more appropriate.
    Note also that environment variables do not allow flexible
    settings like rules.
    A global configuration file is now supported.
    The file path is searched in the following order of priority:
  - $PINACT_GLOBAL_CONFIG
  - ${XDG_CONFIG_HOME}/pinact/pinact.yaml
  - ${HOME}/.config/pinact/pinact.yaml
    rules are prepended before the rules in the project
    configuration file.
    So project settings take precedence over global settings.
  - Automatic correction of version comments via -verify-comment
    If the SHA and the version comment do not match, the version
    comment is automatically corrected to match the SHA.
    Previously, it would just return an error, but now it is
    automatically corrected.
  - -diff-file: limit pinact's targets to only the changed lines
    If you specify a file in Unified Diff Format via -diff-file,
    you can limit pinact's targets to only the changed lines.
    By passing the PR's diff file in PR CI, you can reduce
    unnecessary API calls and prevent corrections or errors from
    code unrelated to the PR's changes.
    This makes it easier to introduce pinact via Required
    Workflow across an entire GitHub Organization of a large
    development organization.
    To improve the overall health of a development organization,
    it is desirable to introduce pinact via Required Workflow.
    However, if you suddenly introduce pinact as a Required
    Workflow in an Organization that has a lot of originally
    unpinned code, errors and corrections unrelated to the PR's
    changes will occur everywhere, causing confusion.
    When errors occur in places unrelated to the PR's changes,
    the PR author thinks "what is this error?", "wait, do I have
    to fix this? It's unrelated to this PR so I want to split the
    PR, but creating a PR is a hassle."
    It is also possible that the same error occurs in multiple
    PRs, and each one independently performs redundant fixing
    work.
    Inquiries about errors come in from various teams, generating
    unnecessary costs.
    If you try to fix everything before introducing the Required
    Workflow, it takes time to introduce, and during that time
    the bad situation continues where new unpinned code keeps
    increasing.
    On the other hand, if you can fix and validate only the lines
    changed in a PR, the PR author can more easily accept making
    the fix, and there is no need to split the PR.
    However, this alone does not pin existing code, so in
    parallel with this, you still need to run pinact against each
    repository and create PRs.
    How do you generate the file specified by -diff-file? You can
    easily generate it using the action
    https://github.com/suzuki-shunsuke/pr-unified-diff-action.
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    with:
    persist-credentials: false
  - uses: suzuki-shunsuke/pr-unified-diff-action@c932c1df5f577028d8ca05d2d3c0c059072d8821 # v0.0.1
    id: diff
  - uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
    with:
    diff_file: ${{ steps.diff.outputs.diff_path }}
  * Changelog
  - fix(deps): update module github.com/google/go-github/v87 to
    v88 (#1564)
  - fix(run): filter --diff-file targets by workflow patterns
    (#1562)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.516.0 (#1559)
  - feat!: error when SHA-pinned action has no version comment
    (#1558)
  - fix(run): use --diff-file as the file source when no
    args/config (#1557)
  - feat(verify): auto-correct version comments to match actual
    SHA (#1435)
  - fix(run): normalize --diff-file paths to forward slashes for
    Windows (#1552)
  - feat: add version comment to pinned actions missing
    annotation (#1458)
  - fix: honor rules[].min_age in update-target cooldown filter
    (#1556)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.515.0 (#1555)
  - docs: fix a broken link (#1554)
  - fix(deps): update module github.com/google/go-github/v86 to
    v87 (#1550)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.514.0 (#1549)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.513.1 (#1548)
  - feat(run): add --diff-file to process only PR-changed lines
    (#1547)
  - chore(deps): update dependency aquaproj/aqua-renovate-config
    to v2.12.1 (#1546)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.513.0 (#1545)
  - feat(config): merge global and project configs field-by-field
    (#1543)
  - chore(deps): update suzuki-shunsuke/go-autofix-action action
    to v0.1.12 (#1544)
  - feat(config): PINACT_GLOBAL_CONFIG env var overrides the
    global config path (#1542)
  - v4 spec implementation (#1540)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.512.1 (#1541)
  - chore(deps): update dependency aquaproj/aqua to v2.59.0
    (#1539)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.10.1 (#1537)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781006400">- Update to version 4.1.0:
  * Features
  - #1578 Update ghtkn-go-sdk to v0.3.0 for backend and disable
    device flow support
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.523.0 (#1594)
  - chore(deps): update dependency anchore/syft to v1.45.1
    (#1593)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.522.0 (#1592)
  - chore(deps): update dependency crate-ci/typos to v1.47.2
    (#1587)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v8.1.0 (#1588)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.521.0 (#1586)
  - chore(deps): update dependency crate-ci/typos to v1.47.1
    (#1585)
  - chore(deps): update actions/checkout action to v6.0.3 (#1583)
  - chore(deps): update dependency anchore/syft to v1.45.0
    (#1584)
  - chore(deps): update go module directive to v1.26.4 (#1582)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.2 (#1580)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.1 (#1577)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.0 (#1576)
  - chore(deps): update dependency crate-ci/typos to v1.47.0
    (#1575)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.519.0 (#1574)
  - chore(deps): update suzuki-shunsuke/actionlint-action action
    to v0.1.4 (#1573)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.518.0 (#1572)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.16.0 (#1571)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.517.0 (#1570)
  - chore(deps): update dependency aquaproj/aqua to v2.59.1
    (#1569)
  - chore(deps): update dependency crate-ci/typos to v1.46.3
    (#1568)
  - chore(deps): update dependency suzuki-shunsuke/pinact to v4
    (#1565)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1785412800">- Update to version 4.1.1:
  * Dependency Updates
  - #1634 Update Go to v1.26.5
  - #1659 Update module github.com/suzuki-shunsuke/ghtkn-go-sdk
    to v0.5.0
  - #1622 Update module github.com/urfave/cli/v3 to v3.10.1
  - #1633 Update module github.com/google/go-github/v88 to v89
  - #1646 Update dependency sigstore/cosign to v3.1.2
  - #1653 Update dependency anchore/syft to v1.49.0
  - #1657 Update dependency goreleaser/goreleaser to v2.17.1</changelog>
</package>
<package pkgid="ff99f65849589ba7eaae7bf73d6e17b509fc8becbc163bd93a13984d6e1f73704bb1280c382f53e35afa5d1e326fdcfd7f9e9c628342a4395861bb11af7b5e56" name="pinact-bash-completion" arch="noarch">
  <version epoch="0" ver="4.1.1" rel="30.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- new package pinact: CLI to edit GitHub Workflow and Composite
  action files and pin versions of Actions and Reusable Workflows.
  pinact can also update their versions and verify version
  annotations</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516801">- Update to version 3.4.2:
  * fix(casks): restrict quarantine removal to macOS only (#1103)
  * test: add comprehensive unit tests for version comparison
    functions (#1102)
  * feat: add Claude Code auto-formatting hooks (#1101)
  * docs: add comprehensive AI assistant guidelines with shared
    documentation (#1100)
  * docs: add CLAUDE.md with project guidelines for AI assistants
    (#1099)
  * docs: add comprehensive documentation comments to all packages
    (#1098)
  * chore(deps): update dependency anchore/syft to v1.31.0 (#1097)
  * ci: use go-test-full-workflow (#1094)
  * chore: use aqua lsp (#1093)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.403.0 (#1092)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380800">- Update to version 3.4.3:
  * Bug Fixes
  - #1201 Skip prereleases when current version is stable
    @mceachen
  - #1213 Fixed bugs of #1201
  * Dependencies
  - chore(deps): update actions/setup-go action to v6 (#1123)
  - chore(deps): update aquaproj/aqua-installer action to v4.0.3
    (#1113)
  - chore(deps): update aquaproj/aqua-installer action to v4.0.4
    (#1198)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.9.0
    (#1136)
  - chore(deps): update dependency anchore/syft to v1.32.0
    (#1110)
  - chore(deps): update dependency anchore/syft to v1.33.0
    (#1143)
  - chore(deps): update dependency anchore/syft to v1.34.1
    (#1182)
  - chore(deps): update dependency anchore/syft to v1.34.2
    (#1183)
  - chore(deps): update dependency anchore/syft to v1.36.0
    (#1192)
  - chore(deps): update dependency anchore/syft to v1.37.0
    (#1202)
  - chore(deps): update dependency aquaproj/aqua to v2.53.10
    (#1114)
  - chore(deps): update dependency aquaproj/aqua to v2.53.11
    (#1126)
  - chore(deps): update dependency aquaproj/aqua to v2.54.0
    (#1134)
  - chore(deps): update dependency aquaproj/aqua to v2.54.1
    (#1137)
  - chore(deps): update dependency aquaproj/aqua to v2.55.0
    (#1148)
  - chore(deps): update dependency aquaproj/aqua to v2.55.1
    (#1190)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.404.0 (#1106)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.405.0 (#1107)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.406.0 (#1108)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.407.0 (#1111)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.408.0 (#1116)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.409.0 (#1127)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.409.1 (#1128)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.410.0 (#1129)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.411.0 (#1131)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.411.1 (#1135)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.412.0 (#1142)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.413.0 (#1146)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.414.0 (#1149)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.415.0 (#1150)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.416.0 (#1153)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.417.0 (#1154)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.418.0 (#1157)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.419.0 (#1160)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.420.0 (#1163)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.421.0 (#1165)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.422.0 (#1167)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.423.0 (#1168)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.424.0 (#1169)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.425.0 (#1171)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.426.0 (#1173)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.427.0 (#1176)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.428.0 (#1181)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.429.0 (#1184)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.430.0 (#1187)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.430.1 (#1193)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.431.0 (#1195)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.432.0 (#1196)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.433.0 (#1199)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.434.0 (#1207)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.435.0 (#1209)
  - chore(deps): update dependency crate-ci/typos to v1.35.5
    (#1105)
  - chore(deps): update dependency crate-ci/typos to v1.35.6
    (#1112)
  - chore(deps): update dependency crate-ci/typos to v1.36.1
    (#1117)
  - chore(deps): update dependency crate-ci/typos to v1.36.2
    (#1125)
  - chore(deps): update dependency crate-ci/typos to v1.36.3
    (#1159)
  - chore(deps): update dependency go to v1.25.1 (#1141)
  - chore(deps): update dependency go to v1.25.2 (#1172)
  - chore(deps): update dependency go to v1.25.3 (#1179)
  - chore(deps): update dependency go to v1.25.4 (#1204)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.5.0 (#1152)
  - chore(deps): update dependency google/go-licenses to v2
    (#1122)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.0 (#1118)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.1 (#1145)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.2 (#1147)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.3 (#1158)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.4 (#1162)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.5 (#1164)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.6 (#1188)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.7 (#1194)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.0
    (#1119)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.1
    (#1130)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.2
    (#1186)
  - chore(deps): update dependency reviewdog/reviewdog to v0.21.0
    (#1120)
  - chore(deps): update dependency rhysd/actionlint to v1.7.8
    (#1177)
  - chore(deps): update dependency sigstore/cosign to v2.6.0
    (#1139)
  - chore(deps): update dependency sigstore/cosign to v2.6.1
    (#1166)
  - chore(deps): update dependency sigstore/cosign to v3 (#1175)
  - chore(deps): update dependency sigstore/cosign to v3.0.2
    (#1178)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.2 (#1104)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v6.0.2 (#1115)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v7 (#1189)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v4.0.1 (#1156)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5 (#1174)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5.0.1 (#1191)
  - chore(deps): update suzuki-shunsuke/renovate-config to v3.3.0
    (#1121)
  - chore(deps): update suzuki-shunsuke/renovate-config to v3.3.1
    (#1144)
  - fix(deps): update module github.com/google/go-github/v74 to
    v75 (#1155)
  - fix(deps): update module github.com/google/go-github/v75 to
    v76 (#1180)
  - fix(deps): update module github.com/google/go-github/v76 to
    v78 (#1206)
  - fix(deps): update module github.com/spf13/afero to v1.15.0
    (#1132)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.5.0
    (#1185)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.0
    (#1208)
  - fix(deps): update module golang.org/x/oauth2 to v0.31.0
    (#1124)
  - fix(deps): update module golang.org/x/oauth2 to v0.32.0
    (#1170)
  - fix(deps): update module golang.org/x/oauth2 to v0.33.0
    (#1205)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380801">- Update to version 3.4.4:
  * Bug Fixes
  - Skip prerelease tags when current version is stable
    @fredericlepied
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.436.0 (#1215)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.3 (#1214)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764244800">- Update to version 3.4.5:
  * Bug Fixes
  - fix: ignore draft releases (#1237)
  * Dependencies
  - chore(deps): update actions/checkout action to v6 (#1232)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.440.0 (#1235)
  - chore(deps): update dependency rhysd/actionlint to v1.7.9
    (#1234)
  - chore(deps): update dependency aquaproj/aqua to v2.55.2
    (#1233)
  - chore(deps): update actions/setup-go action to v6.1.0 (#1230)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.439.0 (#1229)
  - chore(deps): update dependency anchore/syft to v1.38.0
    (#1228)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.438.0 (#1227)
  - fix(deps): update module github.com/google/go-github/v78 to
    v79 (#1222)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.1
    (#1225)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.437.0 (#1224)
  - chore(deps): update actions/checkout action to v5.0.1 (#1223)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.4 (#1221)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765195200">- Update to version 3.4.6:
  * #1250 #1251 Replace logrus with slog
  * #1109 #1254 Refactoring
  * chore(deps): update dependency crate-ci/typos to v1.37.0
    (#1161)
  * chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.4 (#1253)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.444.0 (#1249)
  * chore(deps): update dependency go to v1.25.5 (#1248)
  * chore(deps): update actions/checkout action to v6.0.1 (#1247)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.443.0 (#1246)
  * chore(deps): update dependency goreleaser/goreleaser to v2.13.0
    (#1245)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.442.1 (#1244)
  * chore(deps): update suzuki-shunsuke/go-autofix-action action to
    v0.1.11 (#1243)
  * fix(deps): update module github.com/goccy/go-yaml to v1.19.0
    (#1242)
  * fix(deps): update module github.com/hashicorp/go-version to
    v1.8.0 (#1241)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.442.0 (#1240)
  * chore(deps): update dependency suzuki-shunsuke/pinact to v3.4.5
    (#1238)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.441.0 (#1239)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 3.5.0:
  * Features
  - #1266 #1267 Add --min-age (-m) option
    Skip recently released versions when updating actions with -u
    flag.
    pinact run -u --min-age 7
    [#] or using short alias
    pinact run -u -m 7
    This helps avoid updating to potentially unstable versions
    that haven't had time to prove their stability.
  - For GitHub Releases, the PublishedAt date is checked
  - For tags, the commit's Committer.Date is checked
  * Refactoring
  - #1259 Use Destination pattern for urfave/cli flags
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua to v2.55.3
    (#1264)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.444.2 (#1263)
  - fix(deps): update module golang.org/x/oauth2 to v0.34.0
    (#1262)
  - fix(deps): update module github.com/google/go-github/v79 to
    v80 (#1261)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.1.2
    (#1260)
  - chore(deps): update dependency suzuki-shunsuke/nllint to v1
    (#1258)
  - chore(deps): update dependency crate-ci/typos to v1.40.0
    (#1257)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.6 (#1256)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765886400">- Update to version 3.6.0:
  * Features
  - #1275 Support GitHub Enterprise
  - #1282 #1284 Support PINACT_MIN_AGE environment variable for
  - min-age option
  * Bug Fixes
  - #1283 Fix a bug that pinact token set can't be cancelled by
    ctrl-c
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.446.0 (#1281)
  - chore(deps): update dependency anchore/syft to v1.38.2
    (#1276)
  - chore(deps): update dependency sigstore/cosign to v3.0.3
    (#1277)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.1 (#1272)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.7.2 (#1270)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.445.0 (#1269)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.5.0 (#1268)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305600">- Update to version 3.7.4:
  * Bug Fixes
  - Ignore tags associated with releases #1313
- Update to version 3.7.3:
  * #1309 Fix some bugs
  - -verify is ignored if -u is used
  - versions aren't pinned and verified if version comments are
    semver
    Details see
    https://github.com/suzuki-shunsuke/pinact/releases/tag/v3.7.3
- Update to version 3.7.2:
  * Fixes
  - sarif: Add fixes field for reviewdog suggestion support
  * Dependencies
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.3 (#1310)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.449.0 (#1311)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.448.1 (#1307)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.2 (#1306)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.2 (#1305)
- Update to version 3.7.1:
  There is no change between v3.7.0 and v3.7.1.
  There was an issue during the release of v3.7.0, so we released
  v3.7.1.
- Update to version 3.7.0:
  * Features
  - #1294 SARIF Output Support
  - #1297 Support evironment variables PINACT_GITHUB_TOKEN and
    PINACT_GHES_TOKEN
  * SARIF Output Support
    [#1294]
    pinact can output the result in the SARIF format.
    pinact run --format sarif
    This format is useful to integration tools like reviewdog and
    GitHub SARIF Code Scanning.
    Reviewdog:
    pinact run --diff --format sarif |
    reviewdog -f sarif -name pinact -reporter github-pr-review
  * GitHub SARIF Code Scanning:
  - run: pinact run --diff --format sarif &gt; sarif.json || true
  - name: Upload SARIF file
    uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
    with:
    sarif_file: sarif.json
    category: pinact
  * Support evironment variables PINACT_GITHUB_TOKEN and
    PINACT_GHES_TOKEN
    [#1297] You can use different access tokens for pinact and
    other tools.
  * Dependencies
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.1 (#1302)
  - chore(deps): update dependency aquaproj/aqua to v2.56.1
    (#1296)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.448.0 (#1292)
  - chore(deps): update dependency anchore/syft to v1.39.0
    (#1291)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.447.1 (#1290)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.447.0 (#1289)
  - chore(deps): update dependency aquaproj/aqua to v2.56.0
    (#1288)
  - fix(deps): update module github.com/goccy/go-yaml to v1.19.1
    (#1287)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.6.0 (#1285)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305601">- Update to version 3.8.0:
  * Features
  - #1315 Support ghtkn integration
    You can create a GitHub App User Access Token by ghtkn
    integration.
    About ghtkn, please see the document of ghtkn.
    https://github.com/suzuki-shunsuke/ghtkn
    You need to set up ghtkn first.
    export PINACT_GHTKN=true
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.450.0 (#1316)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.4 (#1314)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770120000">- Update to version 3.9.0:
  * Features
  - #1365 Make version separator configurable via configuration
    file @ReenigneArcher
  - #1372 Make version separator configurable via command line
    option and environment variable
  * Bug Fixes
  - #1359 Fix a bug that -log-color doesn't work
  * Others
  - docs: fix readme for ignore_actions[].ref by @nasa9084 in
    [#1323]
  - docs: fix readme for correct GHES_API_URL by @maruloop in
    [#1324]
  - docs(INSTALL): add mise alternate installation documentation
    by @jylenhof in #1331
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.465.0 (#1371)
  - fix(deps): update module github.com/google/go-github/v81 to
    v82 (#1368)
  - chore(deps): update dependency aquaproj/aqua to v2.56.6
    (#1370)
  - chore(deps): update dependency anchore/syft to v1.41.1
    (#1369)
  - chore(deps): update dependency crate-ci/typos to v1.42.3
    (#1367)
  - chore(deps): update dependency anchore/syft to v1.41.0
    (#1366)
  - chore(deps): update dependency crate-ci/typos to v1.42.2
    (#1364)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.464.0 (#1362)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.463.0 (#1361)
  - fix(deps): update module github.com/suzuki-shunsuke/slog-util
    to v0.3.1 (#1359)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.462.0 (#1360)
  - chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.5 (#1358)
  - chore(deps): update dependency crate-ci/typos to v1.42.1
    (#1357)
  - chore(deps): update actions/checkout action to v6.0.2 (#1356)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.10.0
    (#1355)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.461.0 (#1354)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.460.1 (#1353)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.459.0 (#1352)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.2
    (#1351)
  - chore(deps): update dependency aquaproj/aqua to v2.56.5
    (#1350)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.458.0 (#1349)
  - chore(deps): update dependency anchore/syft to v1.40.1
    (#1348)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.457.0 (#1347)
  - chore(deps): update dependency aquaproj/aqua to v2.56.4
    (#1346)
  - chore(deps): update dependency go to v1.25.6 (#1345)
  - fix(deps): update module
    github.com/suzuki-shunsuke/slog-error to v0.2.2 (#1344)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.456.0 (#1343)
  - chore(deps): update actions/setup-go action to v6.2.0 (#1341)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.455.0 (#1340)
  - chore(deps): update dependency aquaproj/aqua to v2.56.3
    (#1339)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.3 (#1338)
  - chore(deps): update dependency sigstore/cosign to v3.0.4
    (#1337)
  - chore(deps): update dependency anchore/syft to v1.40.0
    (#1336)
  - fix(deps): update module github.com/goccy/go-yaml to v1.19.2
    (#1335)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.8.0 (#1334)
  - chore(deps): update dependency crate-ci/typos to v1.42.0
    (#1332)
  - fix(deps): update module github.com/google/go-github/v80 to
    v81 (#1329)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.454.0 (#1330)
  - chore(deps): update dependency aquaproj/aqua to v2.56.2
    (#1328)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.453.0 (#1327)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.452.0 (#1325)
  - chore(deps): update dependency crate-ci/typos to v1.41.0
    (#1322)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.451.1 (#1321)
  - chore(deps): update dependency rhysd/actionlint to v1.7.10
    (#1320)
  - chore(deps): update dependency crate-ci/typos to v1.40.1
    (#1319)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.451.0 (#1318)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.8.0 (#1317)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777550400">- Update to version 3.9.2:
  * Fixes
  - #1493 Preserve original line endings when updating workflows
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.500.0 (#1495)
  - chore(deps): update dependency anchore/syft to v1.43.0
    (#1489)
  - chore(deps): update dependency aquaproj/aqua to v2.57.2
    (#1487)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.499.0 (#1486)
  - fix(deps): update module github.com/google/go-github/v84 to
    v85 (#1484)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.498.0 (#1485)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.497.0 (#1482)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.496.0 (#1481)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.495.0 (#1480)
  - chore(deps): update dependency crate-ci/typos to v1.45.1
    (#1476)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.494.1 (#1475)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.493.0 (#1473)
  - chore(deps): update dependency anchore/syft to v1.42.4
    (#1471)
  - chore(deps): update dependency sigstore/cosign to v3.0.6
    (#1470)
  - chore(deps): update dependency go to v1.26.2 (#1469)
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#1468)
  - chore(deps): update dependency crate-ci/typos to v1.45.0
    (#1467)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.492.0 (#1466)
  - chore(deps): update dependency rhysd/actionlint to v1.7.12
    (#1465)
  - fix(deps): update module github.com/hashicorp/go-version to
    v1.9.0 (#1464)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.491.0 (#1461)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.490.0 (#1459)
  - chore(deps): update dependency aquaproj/aqua-renovate-config
    to v2.12.0 (#1460)
  - fix(deps): update module github.com/google/go-github/v83 to
    v84 (#1415)
  - chore(deps): update suzuki-shunsuke/renovate-config to v4
    (#1439)
  - chore(deps): update actions/setup-go action to v6.4.0 (#1456)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.489.0 (#1455)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.8.0
    (#1453)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.488.0 (#1452)
  - chore(deps): update dependency suzuki-shunsuke/nllint to
    v1.1.0 (#1451)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.4 (#1450)
  - fix(deps): update module github.com/fatih/color to v1.19.0
    (#1446)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.487.0 (#1445)
  - chore(deps): update dependency anchore/syft to v1.42.3
    (#1444)
  - chore(deps): update dependency aquaproj/aqua to v2.57.1
    (#1443)
  - chore(deps): update suzuki-shunsuke/actionlint-action action
    to v0.1.2 (#1442)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.486.0 (#1440)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.485.0 (#1438)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.484.0 (#1437)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.3 (#1436)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.483.0 (#1433)
  - chore(deps): update dependency anchore/syft to v1.42.2
    (#1432)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.482.0 (#1431)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.2.3
    (#1429)
  - chore(deps): update dependency aquaproj/aqua to v2.57.0
    (#1430)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.481.0 (#1426)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.2 (#1425)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.480.0 (#1424)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.1 (#1423)
  - fix(deps): update module golang.org/x/oauth2 to v0.36.0
    (#1422)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.479.0 (#1421)
  - chore(deps): update dependency go to v1.26.1 (#1420)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.11.0
    (#1419)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.478.0 (#1418)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.477.0 (#1417)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.7.0
    (#1416)
  - chore(deps): update dependency crate-ci/typos to v1.44.0
    (#1414)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.14.1 (#1412)
  - chore(deps): update actions/setup-go action to v6.3.0 (#1413)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.476.0 (#1410)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.14.0 (#1409)
  - chore(deps): update dependency aquaproj/aqua to v2.56.7
    (#1408)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.475.0 (#1407)
  - chore(deps): update dependency sigstore/cosign to v3.0.5
    (#1406)
  - chore(deps): update dependency anchore/syft to v1.42.1
    (#1405)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.474.0 (#1404)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.2.2
    (#1399)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.10.1 (#1402)
  - chore(deps): update dependency go to v1.26.0 (#1388)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.9.0 (#1392)
  - fix(deps): update module github.com/google/go-github/v82 to
    v83 (#1398)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.473.0 (#1400)
  - chore(deps): update dependency crate-ci/typos to v1.43.5
    (#1397)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.472.1 (#1396)
  - chore(deps): update dependency rhysd/actionlint to v1.7.11
    (#1395)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.472.0 (#1394)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.471.0 (#1393)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.470.0 (#1391)
  - chore(deps): update dependency anchore/syft to v1.42.0
    (#1389)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.469.0 (#1387)
  - chore(deps): update dependency crate-ci/typos to v1.43.4
    (#1386)
  - chore(deps): update dependency crate-ci/typos to v1.43.3
    (#1384)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.468.0 (#1385)
  - chore(deps): update dependency crate-ci/typos to v1.43.2
    (#1383)
  - fix(deps): update module golang.org/x/oauth2 to v0.35.0
    (#1382)
  - chore(deps): update dependency go to v1.25.7 (#1381)
  - chore(deps): update dependency crate-ci/typos to v1.43.1
    (#1379)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.467.0 (#1380)
  - chore(deps): update dependency anchore/syft to v1.41.2
    (#1378)
  - chore(deps): update dependency crate-ci/typos to v1.43.0
    (#1377)
  - fix(deps): update module github.com/lmittmann/tint to v1.1.3
    (#1376)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.466.1 (#1375)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.466.0 (#1374)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.9.0 (#1373)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778673600">- Update to version 3.10.0:
  * Features
  - #1530 Support pinning branches to latest stable tags by the
  - -branch-to-tag option
    The default behabiour isn't changed.
    By default, pinact doesn't pin branches such as main or
    master.
    If you want to pin specific branches, you can use the
  - -branch-to-tag option.
    e.g.
    pinact run --branch-to-tag '^main$' --branch-to-tag '^release/.*$'
  * Dependencies
  - fix(deps): update module github.com/urfave/cli/v3 to v3.9.0
    (#1528)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.511.1 (#1527)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.511.0 (#1526)
  - chore(deps): update dependency crate-ci/typos to v1.46.1
    (#1525)
  - fix(deps): update module github.com/google/go-github/v85 to
    v86 (#1524)
  - chore(deps): update go module directive to v1.26.3 (#1523)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.2 (#1522)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.510.0 (#1521)
  - chore(deps): update dependency aquaproj/aqua to v2.58.1
    (#1520)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.509.0 (#1519)
  - chore(deps): update dependency mvdan/gofumpt to v0.10.0
    (#1518)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.508.0 (#1517)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.15.4 (#1516)
  - chore(deps): update dependency aquaproj/aqua to v2.58.0
    (#1515)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.507.0 (#1514)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.1 (#1513)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.0 (#1510)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.506.0 (#1512)
  - chore(deps): update dependency anchore/syft to v1.44.0
    (#1511)
  - chore(deps): update dependency crate-ci/typos to v1.46.0
    (#1509)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.505.0 (#1506)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.504.0 (#1505)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v8 (#1504)
  - chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.6 (#1502)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5.0.2 (#1503)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.503.0 (#1501)
  - chore(deps): update dependency crate-ci/typos to v1.45.2
    (#1500)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.502.0 (#1499)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.501.0 (#1498)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.9.2 (#1497)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 3.10.1:
  * Bug Fixes
  - #1535 pin uses lines with multiple spaces after the YAML list
    dash
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.512.0 (#1533)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.10.0 (#1532)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 4.0.0:
  * Breaking Changes
  - #1540 Removed the -review option
    Output SARIF and pass it to reviewdog. This has been
    announced previously.
    pinact run -format sarif |
    reviewdog -f sarif -name pinact -reporter github-pr-review
  * #1540 Always output diff
    Even if you specify -diff=false, it is ignored.
  * #1540 -diff and -check are now aliases for -fix=false
    This simplifies the logic, making it easier to understand and
    less prone to bugs.
  * #1540 -verify is now an alias for --verify-comment
  - verify was unclear about what was being verified, so it has
    been renamed for clarity.
    However, -verify is kept as-is to maintain backward
    compatibility.
  * #1458 #1558 Version comments are now required @ManuelLerchnerQC
    For SHAs without a version comment, pinact automatically adds a
    version comment (validation error if -fix=false).
    $ pinact run test.yaml
    test.yaml:1
  - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
    + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    Specifying a version comment makes it easier to see which
    version is being used, and makes it easier for tools like
    Renovate and Dependabot to update.
    It also has security implications.
    For GitHub Actions versions, you can also specify the SHA of a
    commit in a fork.
    This means it could point to a malicious commit in a fork.
    If you specify only the SHA without a version comment, you
    cannot tell whether it is the SHA of a commit in a fork.
    By requiring version comments, you can verify that the version
    comment matches the SHA using the --verify-comment option.
    Even if a fake version comment is added to a fork's SHA, it can
    be detected by --verify-comment.
    An attacker could also create a tag pointing to a fork's SHA,
    but creating a tag requires write permission, which raises the
    bar for attacks, so this can be said to improve security.
    Of course, this is only meaningful if you verify with
  - -verify-comment, so it is recommended to run pinact with
  - -verify-comment in CI.
  * Features
  - -no-api: support for offline validation
    If you just want to check whether something is pinned, you
    don't really need to use the GitHub API, but previously the
    GitHub API was called.
    With the -no-api option, you can validate without calling the
    GitHub API.
    However, since API calls are currently essential for fixing
    code (this may change in the future if caching is supported),
    you need to specify either -fix=false or -format sarif.
    Implicitly treating it as -fix=false could cause behavior to
    change and become a breaking change when caching is
    supported, so it must currently be specified explicitly.
  - You can now check whether the version being used satisfies
    min age, not just newer versions
    For example, you can run it in CI against modified lines to
    check whether any dangerous versions that do not satisfy min
    age are being used.
    This is not checked by default, but is checked when you run
    pinact run --verify-min-age or pinact run -min-age &lt;min age&gt;.
  - More flexible min age support via rules
    min age can now be configured in the configuration file.
    Additionally, by using rules, you can apply settings such as
    min age to specific actions.
    min_age:
    value: 7 # default setting
    rules:
    [#] Allow latest for suzuki-shunsuke's actions
  - ignore: true
    conditions:
  - expr: |
    ActionRepoOwner == "suzuki-shunsuke" &amp;&amp; ActionVersion == "latest"
    [#] Set min age to 0 for actions/checkout
  - min_age: 0
    conditions:
  - expr: |
    ActionRepoFullName == "actions/checkout"
    For rules, conditions are evaluated per rule, and the
    settings are applied if matched.
    You can write multiple conditions, and the settings are
    applied if any one of the conditions matches.
    expr follows https://expr-lang.org/docs/language-definition.
    Please read the documentation for details.
    The settings of rules listed later in rules take precedence.
  - Support for a global configuration file
    Warning
    If you have set the PINACT_MIN_AGE environment variable in
    ~/.bashrc, ~/.zshrc, etc., it is recommended to remove it
    and use a global configuration file instead.
    PINACT_MIN_AGE takes precedence over the configuration
    file, so it overrides the project's settings.
    On the other hand, global settings are merged with lower
    priority than the project's settings.
    If you want to enforce the setting, PINACT_MIN_AGE is
    suitable, but for default settings, a global configuration
    file is more appropriate.
    Note also that environment variables do not allow flexible
    settings like rules.
    A global configuration file is now supported.
    The file path is searched in the following order of priority:
  - $PINACT_GLOBAL_CONFIG
  - ${XDG_CONFIG_HOME}/pinact/pinact.yaml
  - ${HOME}/.config/pinact/pinact.yaml
    rules are prepended before the rules in the project
    configuration file.
    So project settings take precedence over global settings.
  - Automatic correction of version comments via -verify-comment
    If the SHA and the version comment do not match, the version
    comment is automatically corrected to match the SHA.
    Previously, it would just return an error, but now it is
    automatically corrected.
  - -diff-file: limit pinact's targets to only the changed lines
    If you specify a file in Unified Diff Format via -diff-file,
    you can limit pinact's targets to only the changed lines.
    By passing the PR's diff file in PR CI, you can reduce
    unnecessary API calls and prevent corrections or errors from
    code unrelated to the PR's changes.
    This makes it easier to introduce pinact via Required
    Workflow across an entire GitHub Organization of a large
    development organization.
    To improve the overall health of a development organization,
    it is desirable to introduce pinact via Required Workflow.
    However, if you suddenly introduce pinact as a Required
    Workflow in an Organization that has a lot of originally
    unpinned code, errors and corrections unrelated to the PR's
    changes will occur everywhere, causing confusion.
    When errors occur in places unrelated to the PR's changes,
    the PR author thinks "what is this error?", "wait, do I have
    to fix this? It's unrelated to this PR so I want to split the
    PR, but creating a PR is a hassle."
    It is also possible that the same error occurs in multiple
    PRs, and each one independently performs redundant fixing
    work.
    Inquiries about errors come in from various teams, generating
    unnecessary costs.
    If you try to fix everything before introducing the Required
    Workflow, it takes time to introduce, and during that time
    the bad situation continues where new unpinned code keeps
    increasing.
    On the other hand, if you can fix and validate only the lines
    changed in a PR, the PR author can more easily accept making
    the fix, and there is no need to split the PR.
    However, this alone does not pin existing code, so in
    parallel with this, you still need to run pinact against each
    repository and create PRs.
    How do you generate the file specified by -diff-file? You can
    easily generate it using the action
    https://github.com/suzuki-shunsuke/pr-unified-diff-action.
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    with:
    persist-credentials: false
  - uses: suzuki-shunsuke/pr-unified-diff-action@c932c1df5f577028d8ca05d2d3c0c059072d8821 # v0.0.1
    id: diff
  - uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
    with:
    diff_file: ${{ steps.diff.outputs.diff_path }}
  * Changelog
  - fix(deps): update module github.com/google/go-github/v87 to
    v88 (#1564)
  - fix(run): filter --diff-file targets by workflow patterns
    (#1562)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.516.0 (#1559)
  - feat!: error when SHA-pinned action has no version comment
    (#1558)
  - fix(run): use --diff-file as the file source when no
    args/config (#1557)
  - feat(verify): auto-correct version comments to match actual
    SHA (#1435)
  - fix(run): normalize --diff-file paths to forward slashes for
    Windows (#1552)
  - feat: add version comment to pinned actions missing
    annotation (#1458)
  - fix: honor rules[].min_age in update-target cooldown filter
    (#1556)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.515.0 (#1555)
  - docs: fix a broken link (#1554)
  - fix(deps): update module github.com/google/go-github/v86 to
    v87 (#1550)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.514.0 (#1549)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.513.1 (#1548)
  - feat(run): add --diff-file to process only PR-changed lines
    (#1547)
  - chore(deps): update dependency aquaproj/aqua-renovate-config
    to v2.12.1 (#1546)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.513.0 (#1545)
  - feat(config): merge global and project configs field-by-field
    (#1543)
  - chore(deps): update suzuki-shunsuke/go-autofix-action action
    to v0.1.12 (#1544)
  - feat(config): PINACT_GLOBAL_CONFIG env var overrides the
    global config path (#1542)
  - v4 spec implementation (#1540)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.512.1 (#1541)
  - chore(deps): update dependency aquaproj/aqua to v2.59.0
    (#1539)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.10.1 (#1537)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781006400">- Update to version 4.1.0:
  * Features
  - #1578 Update ghtkn-go-sdk to v0.3.0 for backend and disable
    device flow support
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.523.0 (#1594)
  - chore(deps): update dependency anchore/syft to v1.45.1
    (#1593)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.522.0 (#1592)
  - chore(deps): update dependency crate-ci/typos to v1.47.2
    (#1587)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v8.1.0 (#1588)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.521.0 (#1586)
  - chore(deps): update dependency crate-ci/typos to v1.47.1
    (#1585)
  - chore(deps): update actions/checkout action to v6.0.3 (#1583)
  - chore(deps): update dependency anchore/syft to v1.45.0
    (#1584)
  - chore(deps): update go module directive to v1.26.4 (#1582)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.2 (#1580)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.1 (#1577)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.0 (#1576)
  - chore(deps): update dependency crate-ci/typos to v1.47.0
    (#1575)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.519.0 (#1574)
  - chore(deps): update suzuki-shunsuke/actionlint-action action
    to v0.1.4 (#1573)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.518.0 (#1572)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.16.0 (#1571)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.517.0 (#1570)
  - chore(deps): update dependency aquaproj/aqua to v2.59.1
    (#1569)
  - chore(deps): update dependency crate-ci/typos to v1.46.3
    (#1568)
  - chore(deps): update dependency suzuki-shunsuke/pinact to v4
    (#1565)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1785412800">- Update to version 4.1.1:
  * Dependency Updates
  - #1634 Update Go to v1.26.5
  - #1659 Update module github.com/suzuki-shunsuke/ghtkn-go-sdk
    to v0.5.0
  - #1622 Update module github.com/urfave/cli/v3 to v3.10.1
  - #1633 Update module github.com/google/go-github/v88 to v89
  - #1646 Update dependency sigstore/cosign to v3.1.2
  - #1653 Update dependency anchore/syft to v1.49.0
  - #1657 Update dependency goreleaser/goreleaser to v2.17.1</changelog>
</package>
<package pkgid="2cb2571ae7f496186abf08d1e9c9fac4390e271f0671b64cd1cd13885792ec03c65abb9ef86fe889ff321543edf002e1578a948d1dabadb8718b21d2d413a4ef" name="pinact-debuginfo" arch="s390x">
  <version epoch="0" ver="4.1.1" rel="30.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- new package pinact: CLI to edit GitHub Workflow and Composite
  action files and pin versions of Actions and Reusable Workflows.
  pinact can also update their versions and verify version
  annotations</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516801">- Update to version 3.4.2:
  * fix(casks): restrict quarantine removal to macOS only (#1103)
  * test: add comprehensive unit tests for version comparison
    functions (#1102)
  * feat: add Claude Code auto-formatting hooks (#1101)
  * docs: add comprehensive AI assistant guidelines with shared
    documentation (#1100)
  * docs: add CLAUDE.md with project guidelines for AI assistants
    (#1099)
  * docs: add comprehensive documentation comments to all packages
    (#1098)
  * chore(deps): update dependency anchore/syft to v1.31.0 (#1097)
  * ci: use go-test-full-workflow (#1094)
  * chore: use aqua lsp (#1093)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.403.0 (#1092)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380800">- Update to version 3.4.3:
  * Bug Fixes
  - #1201 Skip prereleases when current version is stable
    @mceachen
  - #1213 Fixed bugs of #1201
  * Dependencies
  - chore(deps): update actions/setup-go action to v6 (#1123)
  - chore(deps): update aquaproj/aqua-installer action to v4.0.3
    (#1113)
  - chore(deps): update aquaproj/aqua-installer action to v4.0.4
    (#1198)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.9.0
    (#1136)
  - chore(deps): update dependency anchore/syft to v1.32.0
    (#1110)
  - chore(deps): update dependency anchore/syft to v1.33.0
    (#1143)
  - chore(deps): update dependency anchore/syft to v1.34.1
    (#1182)
  - chore(deps): update dependency anchore/syft to v1.34.2
    (#1183)
  - chore(deps): update dependency anchore/syft to v1.36.0
    (#1192)
  - chore(deps): update dependency anchore/syft to v1.37.0
    (#1202)
  - chore(deps): update dependency aquaproj/aqua to v2.53.10
    (#1114)
  - chore(deps): update dependency aquaproj/aqua to v2.53.11
    (#1126)
  - chore(deps): update dependency aquaproj/aqua to v2.54.0
    (#1134)
  - chore(deps): update dependency aquaproj/aqua to v2.54.1
    (#1137)
  - chore(deps): update dependency aquaproj/aqua to v2.55.0
    (#1148)
  - chore(deps): update dependency aquaproj/aqua to v2.55.1
    (#1190)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.404.0 (#1106)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.405.0 (#1107)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.406.0 (#1108)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.407.0 (#1111)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.408.0 (#1116)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.409.0 (#1127)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.409.1 (#1128)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.410.0 (#1129)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.411.0 (#1131)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.411.1 (#1135)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.412.0 (#1142)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.413.0 (#1146)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.414.0 (#1149)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.415.0 (#1150)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.416.0 (#1153)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.417.0 (#1154)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.418.0 (#1157)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.419.0 (#1160)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.420.0 (#1163)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.421.0 (#1165)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.422.0 (#1167)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.423.0 (#1168)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.424.0 (#1169)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.425.0 (#1171)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.426.0 (#1173)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.427.0 (#1176)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.428.0 (#1181)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.429.0 (#1184)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.430.0 (#1187)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.430.1 (#1193)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.431.0 (#1195)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.432.0 (#1196)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.433.0 (#1199)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.434.0 (#1207)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.435.0 (#1209)
  - chore(deps): update dependency crate-ci/typos to v1.35.5
    (#1105)
  - chore(deps): update dependency crate-ci/typos to v1.35.6
    (#1112)
  - chore(deps): update dependency crate-ci/typos to v1.36.1
    (#1117)
  - chore(deps): update dependency crate-ci/typos to v1.36.2
    (#1125)
  - chore(deps): update dependency crate-ci/typos to v1.36.3
    (#1159)
  - chore(deps): update dependency go to v1.25.1 (#1141)
  - chore(deps): update dependency go to v1.25.2 (#1172)
  - chore(deps): update dependency go to v1.25.3 (#1179)
  - chore(deps): update dependency go to v1.25.4 (#1204)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.5.0 (#1152)
  - chore(deps): update dependency google/go-licenses to v2
    (#1122)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.0 (#1118)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.1 (#1145)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.2 (#1147)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.3 (#1158)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.4 (#1162)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.5 (#1164)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.6 (#1188)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.7 (#1194)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.0
    (#1119)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.1
    (#1130)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.2
    (#1186)
  - chore(deps): update dependency reviewdog/reviewdog to v0.21.0
    (#1120)
  - chore(deps): update dependency rhysd/actionlint to v1.7.8
    (#1177)
  - chore(deps): update dependency sigstore/cosign to v2.6.0
    (#1139)
  - chore(deps): update dependency sigstore/cosign to v2.6.1
    (#1166)
  - chore(deps): update dependency sigstore/cosign to v3 (#1175)
  - chore(deps): update dependency sigstore/cosign to v3.0.2
    (#1178)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.2 (#1104)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v6.0.2 (#1115)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v7 (#1189)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v4.0.1 (#1156)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5 (#1174)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5.0.1 (#1191)
  - chore(deps): update suzuki-shunsuke/renovate-config to v3.3.0
    (#1121)
  - chore(deps): update suzuki-shunsuke/renovate-config to v3.3.1
    (#1144)
  - fix(deps): update module github.com/google/go-github/v74 to
    v75 (#1155)
  - fix(deps): update module github.com/google/go-github/v75 to
    v76 (#1180)
  - fix(deps): update module github.com/google/go-github/v76 to
    v78 (#1206)
  - fix(deps): update module github.com/spf13/afero to v1.15.0
    (#1132)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.5.0
    (#1185)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.0
    (#1208)
  - fix(deps): update module golang.org/x/oauth2 to v0.31.0
    (#1124)
  - fix(deps): update module golang.org/x/oauth2 to v0.32.0
    (#1170)
  - fix(deps): update module golang.org/x/oauth2 to v0.33.0
    (#1205)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380801">- Update to version 3.4.4:
  * Bug Fixes
  - Skip prerelease tags when current version is stable
    @fredericlepied
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.436.0 (#1215)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.3 (#1214)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764244800">- Update to version 3.4.5:
  * Bug Fixes
  - fix: ignore draft releases (#1237)
  * Dependencies
  - chore(deps): update actions/checkout action to v6 (#1232)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.440.0 (#1235)
  - chore(deps): update dependency rhysd/actionlint to v1.7.9
    (#1234)
  - chore(deps): update dependency aquaproj/aqua to v2.55.2
    (#1233)
  - chore(deps): update actions/setup-go action to v6.1.0 (#1230)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.439.0 (#1229)
  - chore(deps): update dependency anchore/syft to v1.38.0
    (#1228)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.438.0 (#1227)
  - fix(deps): update module github.com/google/go-github/v78 to
    v79 (#1222)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.1
    (#1225)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.437.0 (#1224)
  - chore(deps): update actions/checkout action to v5.0.1 (#1223)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.4 (#1221)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765195200">- Update to version 3.4.6:
  * #1250 #1251 Replace logrus with slog
  * #1109 #1254 Refactoring
  * chore(deps): update dependency crate-ci/typos to v1.37.0
    (#1161)
  * chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.4 (#1253)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.444.0 (#1249)
  * chore(deps): update dependency go to v1.25.5 (#1248)
  * chore(deps): update actions/checkout action to v6.0.1 (#1247)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.443.0 (#1246)
  * chore(deps): update dependency goreleaser/goreleaser to v2.13.0
    (#1245)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.442.1 (#1244)
  * chore(deps): update suzuki-shunsuke/go-autofix-action action to
    v0.1.11 (#1243)
  * fix(deps): update module github.com/goccy/go-yaml to v1.19.0
    (#1242)
  * fix(deps): update module github.com/hashicorp/go-version to
    v1.8.0 (#1241)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.442.0 (#1240)
  * chore(deps): update dependency suzuki-shunsuke/pinact to v3.4.5
    (#1238)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.441.0 (#1239)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 3.5.0:
  * Features
  - #1266 #1267 Add --min-age (-m) option
    Skip recently released versions when updating actions with -u
    flag.
    pinact run -u --min-age 7
    [#] or using short alias
    pinact run -u -m 7
    This helps avoid updating to potentially unstable versions
    that haven't had time to prove their stability.
  - For GitHub Releases, the PublishedAt date is checked
  - For tags, the commit's Committer.Date is checked
  * Refactoring
  - #1259 Use Destination pattern for urfave/cli flags
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua to v2.55.3
    (#1264)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.444.2 (#1263)
  - fix(deps): update module golang.org/x/oauth2 to v0.34.0
    (#1262)
  - fix(deps): update module github.com/google/go-github/v79 to
    v80 (#1261)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.1.2
    (#1260)
  - chore(deps): update dependency suzuki-shunsuke/nllint to v1
    (#1258)
  - chore(deps): update dependency crate-ci/typos to v1.40.0
    (#1257)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.6 (#1256)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765886400">- Update to version 3.6.0:
  * Features
  - #1275 Support GitHub Enterprise
  - #1282 #1284 Support PINACT_MIN_AGE environment variable for
  - min-age option
  * Bug Fixes
  - #1283 Fix a bug that pinact token set can't be cancelled by
    ctrl-c
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.446.0 (#1281)
  - chore(deps): update dependency anchore/syft to v1.38.2
    (#1276)
  - chore(deps): update dependency sigstore/cosign to v3.0.3
    (#1277)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.1 (#1272)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.7.2 (#1270)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.445.0 (#1269)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.5.0 (#1268)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305600">- Update to version 3.7.4:
  * Bug Fixes
  - Ignore tags associated with releases #1313
- Update to version 3.7.3:
  * #1309 Fix some bugs
  - -verify is ignored if -u is used
  - versions aren't pinned and verified if version comments are
    semver
    Details see
    https://github.com/suzuki-shunsuke/pinact/releases/tag/v3.7.3
- Update to version 3.7.2:
  * Fixes
  - sarif: Add fixes field for reviewdog suggestion support
  * Dependencies
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.3 (#1310)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.449.0 (#1311)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.448.1 (#1307)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.2 (#1306)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.2 (#1305)
- Update to version 3.7.1:
  There is no change between v3.7.0 and v3.7.1.
  There was an issue during the release of v3.7.0, so we released
  v3.7.1.
- Update to version 3.7.0:
  * Features
  - #1294 SARIF Output Support
  - #1297 Support evironment variables PINACT_GITHUB_TOKEN and
    PINACT_GHES_TOKEN
  * SARIF Output Support
    [#1294]
    pinact can output the result in the SARIF format.
    pinact run --format sarif
    This format is useful to integration tools like reviewdog and
    GitHub SARIF Code Scanning.
    Reviewdog:
    pinact run --diff --format sarif |
    reviewdog -f sarif -name pinact -reporter github-pr-review
  * GitHub SARIF Code Scanning:
  - run: pinact run --diff --format sarif &gt; sarif.json || true
  - name: Upload SARIF file
    uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
    with:
    sarif_file: sarif.json
    category: pinact
  * Support evironment variables PINACT_GITHUB_TOKEN and
    PINACT_GHES_TOKEN
    [#1297] You can use different access tokens for pinact and
    other tools.
  * Dependencies
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.1 (#1302)
  - chore(deps): update dependency aquaproj/aqua to v2.56.1
    (#1296)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.448.0 (#1292)
  - chore(deps): update dependency anchore/syft to v1.39.0
    (#1291)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.447.1 (#1290)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.447.0 (#1289)
  - chore(deps): update dependency aquaproj/aqua to v2.56.0
    (#1288)
  - fix(deps): update module github.com/goccy/go-yaml to v1.19.1
    (#1287)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.6.0 (#1285)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305601">- Update to version 3.8.0:
  * Features
  - #1315 Support ghtkn integration
    You can create a GitHub App User Access Token by ghtkn
    integration.
    About ghtkn, please see the document of ghtkn.
    https://github.com/suzuki-shunsuke/ghtkn
    You need to set up ghtkn first.
    export PINACT_GHTKN=true
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.450.0 (#1316)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.4 (#1314)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770120000">- Update to version 3.9.0:
  * Features
  - #1365 Make version separator configurable via configuration
    file @ReenigneArcher
  - #1372 Make version separator configurable via command line
    option and environment variable
  * Bug Fixes
  - #1359 Fix a bug that -log-color doesn't work
  * Others
  - docs: fix readme for ignore_actions[].ref by @nasa9084 in
    [#1323]
  - docs: fix readme for correct GHES_API_URL by @maruloop in
    [#1324]
  - docs(INSTALL): add mise alternate installation documentation
    by @jylenhof in #1331
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.465.0 (#1371)
  - fix(deps): update module github.com/google/go-github/v81 to
    v82 (#1368)
  - chore(deps): update dependency aquaproj/aqua to v2.56.6
    (#1370)
  - chore(deps): update dependency anchore/syft to v1.41.1
    (#1369)
  - chore(deps): update dependency crate-ci/typos to v1.42.3
    (#1367)
  - chore(deps): update dependency anchore/syft to v1.41.0
    (#1366)
  - chore(deps): update dependency crate-ci/typos to v1.42.2
    (#1364)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.464.0 (#1362)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.463.0 (#1361)
  - fix(deps): update module github.com/suzuki-shunsuke/slog-util
    to v0.3.1 (#1359)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.462.0 (#1360)
  - chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.5 (#1358)
  - chore(deps): update dependency crate-ci/typos to v1.42.1
    (#1357)
  - chore(deps): update actions/checkout action to v6.0.2 (#1356)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.10.0
    (#1355)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.461.0 (#1354)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.460.1 (#1353)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.459.0 (#1352)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.2
    (#1351)
  - chore(deps): update dependency aquaproj/aqua to v2.56.5
    (#1350)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.458.0 (#1349)
  - chore(deps): update dependency anchore/syft to v1.40.1
    (#1348)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.457.0 (#1347)
  - chore(deps): update dependency aquaproj/aqua to v2.56.4
    (#1346)
  - chore(deps): update dependency go to v1.25.6 (#1345)
  - fix(deps): update module
    github.com/suzuki-shunsuke/slog-error to v0.2.2 (#1344)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.456.0 (#1343)
  - chore(deps): update actions/setup-go action to v6.2.0 (#1341)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.455.0 (#1340)
  - chore(deps): update dependency aquaproj/aqua to v2.56.3
    (#1339)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.3 (#1338)
  - chore(deps): update dependency sigstore/cosign to v3.0.4
    (#1337)
  - chore(deps): update dependency anchore/syft to v1.40.0
    (#1336)
  - fix(deps): update module github.com/goccy/go-yaml to v1.19.2
    (#1335)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.8.0 (#1334)
  - chore(deps): update dependency crate-ci/typos to v1.42.0
    (#1332)
  - fix(deps): update module github.com/google/go-github/v80 to
    v81 (#1329)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.454.0 (#1330)
  - chore(deps): update dependency aquaproj/aqua to v2.56.2
    (#1328)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.453.0 (#1327)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.452.0 (#1325)
  - chore(deps): update dependency crate-ci/typos to v1.41.0
    (#1322)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.451.1 (#1321)
  - chore(deps): update dependency rhysd/actionlint to v1.7.10
    (#1320)
  - chore(deps): update dependency crate-ci/typos to v1.40.1
    (#1319)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.451.0 (#1318)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.8.0 (#1317)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777550400">- Update to version 3.9.2:
  * Fixes
  - #1493 Preserve original line endings when updating workflows
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.500.0 (#1495)
  - chore(deps): update dependency anchore/syft to v1.43.0
    (#1489)
  - chore(deps): update dependency aquaproj/aqua to v2.57.2
    (#1487)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.499.0 (#1486)
  - fix(deps): update module github.com/google/go-github/v84 to
    v85 (#1484)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.498.0 (#1485)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.497.0 (#1482)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.496.0 (#1481)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.495.0 (#1480)
  - chore(deps): update dependency crate-ci/typos to v1.45.1
    (#1476)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.494.1 (#1475)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.493.0 (#1473)
  - chore(deps): update dependency anchore/syft to v1.42.4
    (#1471)
  - chore(deps): update dependency sigstore/cosign to v3.0.6
    (#1470)
  - chore(deps): update dependency go to v1.26.2 (#1469)
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#1468)
  - chore(deps): update dependency crate-ci/typos to v1.45.0
    (#1467)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.492.0 (#1466)
  - chore(deps): update dependency rhysd/actionlint to v1.7.12
    (#1465)
  - fix(deps): update module github.com/hashicorp/go-version to
    v1.9.0 (#1464)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.491.0 (#1461)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.490.0 (#1459)
  - chore(deps): update dependency aquaproj/aqua-renovate-config
    to v2.12.0 (#1460)
  - fix(deps): update module github.com/google/go-github/v83 to
    v84 (#1415)
  - chore(deps): update suzuki-shunsuke/renovate-config to v4
    (#1439)
  - chore(deps): update actions/setup-go action to v6.4.0 (#1456)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.489.0 (#1455)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.8.0
    (#1453)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.488.0 (#1452)
  - chore(deps): update dependency suzuki-shunsuke/nllint to
    v1.1.0 (#1451)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.4 (#1450)
  - fix(deps): update module github.com/fatih/color to v1.19.0
    (#1446)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.487.0 (#1445)
  - chore(deps): update dependency anchore/syft to v1.42.3
    (#1444)
  - chore(deps): update dependency aquaproj/aqua to v2.57.1
    (#1443)
  - chore(deps): update suzuki-shunsuke/actionlint-action action
    to v0.1.2 (#1442)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.486.0 (#1440)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.485.0 (#1438)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.484.0 (#1437)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.3 (#1436)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.483.0 (#1433)
  - chore(deps): update dependency anchore/syft to v1.42.2
    (#1432)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.482.0 (#1431)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.2.3
    (#1429)
  - chore(deps): update dependency aquaproj/aqua to v2.57.0
    (#1430)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.481.0 (#1426)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.2 (#1425)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.480.0 (#1424)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.1 (#1423)
  - fix(deps): update module golang.org/x/oauth2 to v0.36.0
    (#1422)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.479.0 (#1421)
  - chore(deps): update dependency go to v1.26.1 (#1420)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.11.0
    (#1419)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.478.0 (#1418)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.477.0 (#1417)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.7.0
    (#1416)
  - chore(deps): update dependency crate-ci/typos to v1.44.0
    (#1414)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.14.1 (#1412)
  - chore(deps): update actions/setup-go action to v6.3.0 (#1413)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.476.0 (#1410)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.14.0 (#1409)
  - chore(deps): update dependency aquaproj/aqua to v2.56.7
    (#1408)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.475.0 (#1407)
  - chore(deps): update dependency sigstore/cosign to v3.0.5
    (#1406)
  - chore(deps): update dependency anchore/syft to v1.42.1
    (#1405)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.474.0 (#1404)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.2.2
    (#1399)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.10.1 (#1402)
  - chore(deps): update dependency go to v1.26.0 (#1388)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.9.0 (#1392)
  - fix(deps): update module github.com/google/go-github/v82 to
    v83 (#1398)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.473.0 (#1400)
  - chore(deps): update dependency crate-ci/typos to v1.43.5
    (#1397)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.472.1 (#1396)
  - chore(deps): update dependency rhysd/actionlint to v1.7.11
    (#1395)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.472.0 (#1394)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.471.0 (#1393)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.470.0 (#1391)
  - chore(deps): update dependency anchore/syft to v1.42.0
    (#1389)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.469.0 (#1387)
  - chore(deps): update dependency crate-ci/typos to v1.43.4
    (#1386)
  - chore(deps): update dependency crate-ci/typos to v1.43.3
    (#1384)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.468.0 (#1385)
  - chore(deps): update dependency crate-ci/typos to v1.43.2
    (#1383)
  - fix(deps): update module golang.org/x/oauth2 to v0.35.0
    (#1382)
  - chore(deps): update dependency go to v1.25.7 (#1381)
  - chore(deps): update dependency crate-ci/typos to v1.43.1
    (#1379)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.467.0 (#1380)
  - chore(deps): update dependency anchore/syft to v1.41.2
    (#1378)
  - chore(deps): update dependency crate-ci/typos to v1.43.0
    (#1377)
  - fix(deps): update module github.com/lmittmann/tint to v1.1.3
    (#1376)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.466.1 (#1375)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.466.0 (#1374)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.9.0 (#1373)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778673600">- Update to version 3.10.0:
  * Features
  - #1530 Support pinning branches to latest stable tags by the
  - -branch-to-tag option
    The default behabiour isn't changed.
    By default, pinact doesn't pin branches such as main or
    master.
    If you want to pin specific branches, you can use the
  - -branch-to-tag option.
    e.g.
    pinact run --branch-to-tag '^main$' --branch-to-tag '^release/.*$'
  * Dependencies
  - fix(deps): update module github.com/urfave/cli/v3 to v3.9.0
    (#1528)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.511.1 (#1527)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.511.0 (#1526)
  - chore(deps): update dependency crate-ci/typos to v1.46.1
    (#1525)
  - fix(deps): update module github.com/google/go-github/v85 to
    v86 (#1524)
  - chore(deps): update go module directive to v1.26.3 (#1523)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.2 (#1522)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.510.0 (#1521)
  - chore(deps): update dependency aquaproj/aqua to v2.58.1
    (#1520)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.509.0 (#1519)
  - chore(deps): update dependency mvdan/gofumpt to v0.10.0
    (#1518)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.508.0 (#1517)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.15.4 (#1516)
  - chore(deps): update dependency aquaproj/aqua to v2.58.0
    (#1515)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.507.0 (#1514)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.1 (#1513)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.0 (#1510)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.506.0 (#1512)
  - chore(deps): update dependency anchore/syft to v1.44.0
    (#1511)
  - chore(deps): update dependency crate-ci/typos to v1.46.0
    (#1509)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.505.0 (#1506)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.504.0 (#1505)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v8 (#1504)
  - chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.6 (#1502)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5.0.2 (#1503)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.503.0 (#1501)
  - chore(deps): update dependency crate-ci/typos to v1.45.2
    (#1500)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.502.0 (#1499)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.501.0 (#1498)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.9.2 (#1497)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 3.10.1:
  * Bug Fixes
  - #1535 pin uses lines with multiple spaces after the YAML list
    dash
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.512.0 (#1533)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.10.0 (#1532)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 4.0.0:
  * Breaking Changes
  - #1540 Removed the -review option
    Output SARIF and pass it to reviewdog. This has been
    announced previously.
    pinact run -format sarif |
    reviewdog -f sarif -name pinact -reporter github-pr-review
  * #1540 Always output diff
    Even if you specify -diff=false, it is ignored.
  * #1540 -diff and -check are now aliases for -fix=false
    This simplifies the logic, making it easier to understand and
    less prone to bugs.
  * #1540 -verify is now an alias for --verify-comment
  - verify was unclear about what was being verified, so it has
    been renamed for clarity.
    However, -verify is kept as-is to maintain backward
    compatibility.
  * #1458 #1558 Version comments are now required @ManuelLerchnerQC
    For SHAs without a version comment, pinact automatically adds a
    version comment (validation error if -fix=false).
    $ pinact run test.yaml
    test.yaml:1
  - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
    + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    Specifying a version comment makes it easier to see which
    version is being used, and makes it easier for tools like
    Renovate and Dependabot to update.
    It also has security implications.
    For GitHub Actions versions, you can also specify the SHA of a
    commit in a fork.
    This means it could point to a malicious commit in a fork.
    If you specify only the SHA without a version comment, you
    cannot tell whether it is the SHA of a commit in a fork.
    By requiring version comments, you can verify that the version
    comment matches the SHA using the --verify-comment option.
    Even if a fake version comment is added to a fork's SHA, it can
    be detected by --verify-comment.
    An attacker could also create a tag pointing to a fork's SHA,
    but creating a tag requires write permission, which raises the
    bar for attacks, so this can be said to improve security.
    Of course, this is only meaningful if you verify with
  - -verify-comment, so it is recommended to run pinact with
  - -verify-comment in CI.
  * Features
  - -no-api: support for offline validation
    If you just want to check whether something is pinned, you
    don't really need to use the GitHub API, but previously the
    GitHub API was called.
    With the -no-api option, you can validate without calling the
    GitHub API.
    However, since API calls are currently essential for fixing
    code (this may change in the future if caching is supported),
    you need to specify either -fix=false or -format sarif.
    Implicitly treating it as -fix=false could cause behavior to
    change and become a breaking change when caching is
    supported, so it must currently be specified explicitly.
  - You can now check whether the version being used satisfies
    min age, not just newer versions
    For example, you can run it in CI against modified lines to
    check whether any dangerous versions that do not satisfy min
    age are being used.
    This is not checked by default, but is checked when you run
    pinact run --verify-min-age or pinact run -min-age &lt;min age&gt;.
  - More flexible min age support via rules
    min age can now be configured in the configuration file.
    Additionally, by using rules, you can apply settings such as
    min age to specific actions.
    min_age:
    value: 7 # default setting
    rules:
    [#] Allow latest for suzuki-shunsuke's actions
  - ignore: true
    conditions:
  - expr: |
    ActionRepoOwner == "suzuki-shunsuke" &amp;&amp; ActionVersion == "latest"
    [#] Set min age to 0 for actions/checkout
  - min_age: 0
    conditions:
  - expr: |
    ActionRepoFullName == "actions/checkout"
    For rules, conditions are evaluated per rule, and the
    settings are applied if matched.
    You can write multiple conditions, and the settings are
    applied if any one of the conditions matches.
    expr follows https://expr-lang.org/docs/language-definition.
    Please read the documentation for details.
    The settings of rules listed later in rules take precedence.
  - Support for a global configuration file
    Warning
    If you have set the PINACT_MIN_AGE environment variable in
    ~/.bashrc, ~/.zshrc, etc., it is recommended to remove it
    and use a global configuration file instead.
    PINACT_MIN_AGE takes precedence over the configuration
    file, so it overrides the project's settings.
    On the other hand, global settings are merged with lower
    priority than the project's settings.
    If you want to enforce the setting, PINACT_MIN_AGE is
    suitable, but for default settings, a global configuration
    file is more appropriate.
    Note also that environment variables do not allow flexible
    settings like rules.
    A global configuration file is now supported.
    The file path is searched in the following order of priority:
  - $PINACT_GLOBAL_CONFIG
  - ${XDG_CONFIG_HOME}/pinact/pinact.yaml
  - ${HOME}/.config/pinact/pinact.yaml
    rules are prepended before the rules in the project
    configuration file.
    So project settings take precedence over global settings.
  - Automatic correction of version comments via -verify-comment
    If the SHA and the version comment do not match, the version
    comment is automatically corrected to match the SHA.
    Previously, it would just return an error, but now it is
    automatically corrected.
  - -diff-file: limit pinact's targets to only the changed lines
    If you specify a file in Unified Diff Format via -diff-file,
    you can limit pinact's targets to only the changed lines.
    By passing the PR's diff file in PR CI, you can reduce
    unnecessary API calls and prevent corrections or errors from
    code unrelated to the PR's changes.
    This makes it easier to introduce pinact via Required
    Workflow across an entire GitHub Organization of a large
    development organization.
    To improve the overall health of a development organization,
    it is desirable to introduce pinact via Required Workflow.
    However, if you suddenly introduce pinact as a Required
    Workflow in an Organization that has a lot of originally
    unpinned code, errors and corrections unrelated to the PR's
    changes will occur everywhere, causing confusion.
    When errors occur in places unrelated to the PR's changes,
    the PR author thinks "what is this error?", "wait, do I have
    to fix this? It's unrelated to this PR so I want to split the
    PR, but creating a PR is a hassle."
    It is also possible that the same error occurs in multiple
    PRs, and each one independently performs redundant fixing
    work.
    Inquiries about errors come in from various teams, generating
    unnecessary costs.
    If you try to fix everything before introducing the Required
    Workflow, it takes time to introduce, and during that time
    the bad situation continues where new unpinned code keeps
    increasing.
    On the other hand, if you can fix and validate only the lines
    changed in a PR, the PR author can more easily accept making
    the fix, and there is no need to split the PR.
    However, this alone does not pin existing code, so in
    parallel with this, you still need to run pinact against each
    repository and create PRs.
    How do you generate the file specified by -diff-file? You can
    easily generate it using the action
    https://github.com/suzuki-shunsuke/pr-unified-diff-action.
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    with:
    persist-credentials: false
  - uses: suzuki-shunsuke/pr-unified-diff-action@c932c1df5f577028d8ca05d2d3c0c059072d8821 # v0.0.1
    id: diff
  - uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
    with:
    diff_file: ${{ steps.diff.outputs.diff_path }}
  * Changelog
  - fix(deps): update module github.com/google/go-github/v87 to
    v88 (#1564)
  - fix(run): filter --diff-file targets by workflow patterns
    (#1562)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.516.0 (#1559)
  - feat!: error when SHA-pinned action has no version comment
    (#1558)
  - fix(run): use --diff-file as the file source when no
    args/config (#1557)
  - feat(verify): auto-correct version comments to match actual
    SHA (#1435)
  - fix(run): normalize --diff-file paths to forward slashes for
    Windows (#1552)
  - feat: add version comment to pinned actions missing
    annotation (#1458)
  - fix: honor rules[].min_age in update-target cooldown filter
    (#1556)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.515.0 (#1555)
  - docs: fix a broken link (#1554)
  - fix(deps): update module github.com/google/go-github/v86 to
    v87 (#1550)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.514.0 (#1549)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.513.1 (#1548)
  - feat(run): add --diff-file to process only PR-changed lines
    (#1547)
  - chore(deps): update dependency aquaproj/aqua-renovate-config
    to v2.12.1 (#1546)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.513.0 (#1545)
  - feat(config): merge global and project configs field-by-field
    (#1543)
  - chore(deps): update suzuki-shunsuke/go-autofix-action action
    to v0.1.12 (#1544)
  - feat(config): PINACT_GLOBAL_CONFIG env var overrides the
    global config path (#1542)
  - v4 spec implementation (#1540)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.512.1 (#1541)
  - chore(deps): update dependency aquaproj/aqua to v2.59.0
    (#1539)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.10.1 (#1537)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781006400">- Update to version 4.1.0:
  * Features
  - #1578 Update ghtkn-go-sdk to v0.3.0 for backend and disable
    device flow support
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.523.0 (#1594)
  - chore(deps): update dependency anchore/syft to v1.45.1
    (#1593)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.522.0 (#1592)
  - chore(deps): update dependency crate-ci/typos to v1.47.2
    (#1587)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v8.1.0 (#1588)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.521.0 (#1586)
  - chore(deps): update dependency crate-ci/typos to v1.47.1
    (#1585)
  - chore(deps): update actions/checkout action to v6.0.3 (#1583)
  - chore(deps): update dependency anchore/syft to v1.45.0
    (#1584)
  - chore(deps): update go module directive to v1.26.4 (#1582)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.2 (#1580)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.1 (#1577)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.0 (#1576)
  - chore(deps): update dependency crate-ci/typos to v1.47.0
    (#1575)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.519.0 (#1574)
  - chore(deps): update suzuki-shunsuke/actionlint-action action
    to v0.1.4 (#1573)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.518.0 (#1572)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.16.0 (#1571)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.517.0 (#1570)
  - chore(deps): update dependency aquaproj/aqua to v2.59.1
    (#1569)
  - chore(deps): update dependency crate-ci/typos to v1.46.3
    (#1568)
  - chore(deps): update dependency suzuki-shunsuke/pinact to v4
    (#1565)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1785412800">- Update to version 4.1.1:
  * Dependency Updates
  - #1634 Update Go to v1.26.5
  - #1659 Update module github.com/suzuki-shunsuke/ghtkn-go-sdk
    to v0.5.0
  - #1622 Update module github.com/urfave/cli/v3 to v3.10.1
  - #1633 Update module github.com/google/go-github/v88 to v89
  - #1646 Update dependency sigstore/cosign to v3.1.2
  - #1653 Update dependency anchore/syft to v1.49.0
  - #1657 Update dependency goreleaser/goreleaser to v2.17.1</changelog>
</package>
<package pkgid="f7571e369857f781b32640cb7c3ee5d2533a1ad38892c6edf5ea148a756c09617a26013042daba5e7cfdd82bc58bffe45deed052e869097697f83a9479a84881" name="pinact-fish-completion" arch="noarch">
  <version epoch="0" ver="4.1.1" rel="30.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- new package pinact: CLI to edit GitHub Workflow and Composite
  action files and pin versions of Actions and Reusable Workflows.
  pinact can also update their versions and verify version
  annotations</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516801">- Update to version 3.4.2:
  * fix(casks): restrict quarantine removal to macOS only (#1103)
  * test: add comprehensive unit tests for version comparison
    functions (#1102)
  * feat: add Claude Code auto-formatting hooks (#1101)
  * docs: add comprehensive AI assistant guidelines with shared
    documentation (#1100)
  * docs: add CLAUDE.md with project guidelines for AI assistants
    (#1099)
  * docs: add comprehensive documentation comments to all packages
    (#1098)
  * chore(deps): update dependency anchore/syft to v1.31.0 (#1097)
  * ci: use go-test-full-workflow (#1094)
  * chore: use aqua lsp (#1093)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.403.0 (#1092)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380800">- Update to version 3.4.3:
  * Bug Fixes
  - #1201 Skip prereleases when current version is stable
    @mceachen
  - #1213 Fixed bugs of #1201
  * Dependencies
  - chore(deps): update actions/setup-go action to v6 (#1123)
  - chore(deps): update aquaproj/aqua-installer action to v4.0.3
    (#1113)
  - chore(deps): update aquaproj/aqua-installer action to v4.0.4
    (#1198)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.9.0
    (#1136)
  - chore(deps): update dependency anchore/syft to v1.32.0
    (#1110)
  - chore(deps): update dependency anchore/syft to v1.33.0
    (#1143)
  - chore(deps): update dependency anchore/syft to v1.34.1
    (#1182)
  - chore(deps): update dependency anchore/syft to v1.34.2
    (#1183)
  - chore(deps): update dependency anchore/syft to v1.36.0
    (#1192)
  - chore(deps): update dependency anchore/syft to v1.37.0
    (#1202)
  - chore(deps): update dependency aquaproj/aqua to v2.53.10
    (#1114)
  - chore(deps): update dependency aquaproj/aqua to v2.53.11
    (#1126)
  - chore(deps): update dependency aquaproj/aqua to v2.54.0
    (#1134)
  - chore(deps): update dependency aquaproj/aqua to v2.54.1
    (#1137)
  - chore(deps): update dependency aquaproj/aqua to v2.55.0
    (#1148)
  - chore(deps): update dependency aquaproj/aqua to v2.55.1
    (#1190)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.404.0 (#1106)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.405.0 (#1107)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.406.0 (#1108)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.407.0 (#1111)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.408.0 (#1116)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.409.0 (#1127)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.409.1 (#1128)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.410.0 (#1129)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.411.0 (#1131)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.411.1 (#1135)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.412.0 (#1142)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.413.0 (#1146)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.414.0 (#1149)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.415.0 (#1150)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.416.0 (#1153)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.417.0 (#1154)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.418.0 (#1157)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.419.0 (#1160)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.420.0 (#1163)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.421.0 (#1165)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.422.0 (#1167)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.423.0 (#1168)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.424.0 (#1169)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.425.0 (#1171)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.426.0 (#1173)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.427.0 (#1176)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.428.0 (#1181)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.429.0 (#1184)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.430.0 (#1187)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.430.1 (#1193)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.431.0 (#1195)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.432.0 (#1196)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.433.0 (#1199)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.434.0 (#1207)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.435.0 (#1209)
  - chore(deps): update dependency crate-ci/typos to v1.35.5
    (#1105)
  - chore(deps): update dependency crate-ci/typos to v1.35.6
    (#1112)
  - chore(deps): update dependency crate-ci/typos to v1.36.1
    (#1117)
  - chore(deps): update dependency crate-ci/typos to v1.36.2
    (#1125)
  - chore(deps): update dependency crate-ci/typos to v1.36.3
    (#1159)
  - chore(deps): update dependency go to v1.25.1 (#1141)
  - chore(deps): update dependency go to v1.25.2 (#1172)
  - chore(deps): update dependency go to v1.25.3 (#1179)
  - chore(deps): update dependency go to v1.25.4 (#1204)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.5.0 (#1152)
  - chore(deps): update dependency google/go-licenses to v2
    (#1122)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.0 (#1118)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.1 (#1145)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.2 (#1147)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.3 (#1158)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.4 (#1162)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.5 (#1164)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.6 (#1188)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.7 (#1194)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.0
    (#1119)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.1
    (#1130)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.2
    (#1186)
  - chore(deps): update dependency reviewdog/reviewdog to v0.21.0
    (#1120)
  - chore(deps): update dependency rhysd/actionlint to v1.7.8
    (#1177)
  - chore(deps): update dependency sigstore/cosign to v2.6.0
    (#1139)
  - chore(deps): update dependency sigstore/cosign to v2.6.1
    (#1166)
  - chore(deps): update dependency sigstore/cosign to v3 (#1175)
  - chore(deps): update dependency sigstore/cosign to v3.0.2
    (#1178)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.2 (#1104)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v6.0.2 (#1115)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v7 (#1189)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v4.0.1 (#1156)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5 (#1174)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5.0.1 (#1191)
  - chore(deps): update suzuki-shunsuke/renovate-config to v3.3.0
    (#1121)
  - chore(deps): update suzuki-shunsuke/renovate-config to v3.3.1
    (#1144)
  - fix(deps): update module github.com/google/go-github/v74 to
    v75 (#1155)
  - fix(deps): update module github.com/google/go-github/v75 to
    v76 (#1180)
  - fix(deps): update module github.com/google/go-github/v76 to
    v78 (#1206)
  - fix(deps): update module github.com/spf13/afero to v1.15.0
    (#1132)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.5.0
    (#1185)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.0
    (#1208)
  - fix(deps): update module golang.org/x/oauth2 to v0.31.0
    (#1124)
  - fix(deps): update module golang.org/x/oauth2 to v0.32.0
    (#1170)
  - fix(deps): update module golang.org/x/oauth2 to v0.33.0
    (#1205)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380801">- Update to version 3.4.4:
  * Bug Fixes
  - Skip prerelease tags when current version is stable
    @fredericlepied
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.436.0 (#1215)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.3 (#1214)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764244800">- Update to version 3.4.5:
  * Bug Fixes
  - fix: ignore draft releases (#1237)
  * Dependencies
  - chore(deps): update actions/checkout action to v6 (#1232)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.440.0 (#1235)
  - chore(deps): update dependency rhysd/actionlint to v1.7.9
    (#1234)
  - chore(deps): update dependency aquaproj/aqua to v2.55.2
    (#1233)
  - chore(deps): update actions/setup-go action to v6.1.0 (#1230)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.439.0 (#1229)
  - chore(deps): update dependency anchore/syft to v1.38.0
    (#1228)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.438.0 (#1227)
  - fix(deps): update module github.com/google/go-github/v78 to
    v79 (#1222)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.1
    (#1225)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.437.0 (#1224)
  - chore(deps): update actions/checkout action to v5.0.1 (#1223)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.4 (#1221)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765195200">- Update to version 3.4.6:
  * #1250 #1251 Replace logrus with slog
  * #1109 #1254 Refactoring
  * chore(deps): update dependency crate-ci/typos to v1.37.0
    (#1161)
  * chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.4 (#1253)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.444.0 (#1249)
  * chore(deps): update dependency go to v1.25.5 (#1248)
  * chore(deps): update actions/checkout action to v6.0.1 (#1247)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.443.0 (#1246)
  * chore(deps): update dependency goreleaser/goreleaser to v2.13.0
    (#1245)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.442.1 (#1244)
  * chore(deps): update suzuki-shunsuke/go-autofix-action action to
    v0.1.11 (#1243)
  * fix(deps): update module github.com/goccy/go-yaml to v1.19.0
    (#1242)
  * fix(deps): update module github.com/hashicorp/go-version to
    v1.8.0 (#1241)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.442.0 (#1240)
  * chore(deps): update dependency suzuki-shunsuke/pinact to v3.4.5
    (#1238)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.441.0 (#1239)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 3.5.0:
  * Features
  - #1266 #1267 Add --min-age (-m) option
    Skip recently released versions when updating actions with -u
    flag.
    pinact run -u --min-age 7
    [#] or using short alias
    pinact run -u -m 7
    This helps avoid updating to potentially unstable versions
    that haven't had time to prove their stability.
  - For GitHub Releases, the PublishedAt date is checked
  - For tags, the commit's Committer.Date is checked
  * Refactoring
  - #1259 Use Destination pattern for urfave/cli flags
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua to v2.55.3
    (#1264)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.444.2 (#1263)
  - fix(deps): update module golang.org/x/oauth2 to v0.34.0
    (#1262)
  - fix(deps): update module github.com/google/go-github/v79 to
    v80 (#1261)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.1.2
    (#1260)
  - chore(deps): update dependency suzuki-shunsuke/nllint to v1
    (#1258)
  - chore(deps): update dependency crate-ci/typos to v1.40.0
    (#1257)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.6 (#1256)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765886400">- Update to version 3.6.0:
  * Features
  - #1275 Support GitHub Enterprise
  - #1282 #1284 Support PINACT_MIN_AGE environment variable for
  - min-age option
  * Bug Fixes
  - #1283 Fix a bug that pinact token set can't be cancelled by
    ctrl-c
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.446.0 (#1281)
  - chore(deps): update dependency anchore/syft to v1.38.2
    (#1276)
  - chore(deps): update dependency sigstore/cosign to v3.0.3
    (#1277)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.1 (#1272)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.7.2 (#1270)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.445.0 (#1269)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.5.0 (#1268)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305600">- Update to version 3.7.4:
  * Bug Fixes
  - Ignore tags associated with releases #1313
- Update to version 3.7.3:
  * #1309 Fix some bugs
  - -verify is ignored if -u is used
  - versions aren't pinned and verified if version comments are
    semver
    Details see
    https://github.com/suzuki-shunsuke/pinact/releases/tag/v3.7.3
- Update to version 3.7.2:
  * Fixes
  - sarif: Add fixes field for reviewdog suggestion support
  * Dependencies
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.3 (#1310)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.449.0 (#1311)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.448.1 (#1307)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.2 (#1306)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.2 (#1305)
- Update to version 3.7.1:
  There is no change between v3.7.0 and v3.7.1.
  There was an issue during the release of v3.7.0, so we released
  v3.7.1.
- Update to version 3.7.0:
  * Features
  - #1294 SARIF Output Support
  - #1297 Support evironment variables PINACT_GITHUB_TOKEN and
    PINACT_GHES_TOKEN
  * SARIF Output Support
    [#1294]
    pinact can output the result in the SARIF format.
    pinact run --format sarif
    This format is useful to integration tools like reviewdog and
    GitHub SARIF Code Scanning.
    Reviewdog:
    pinact run --diff --format sarif |
    reviewdog -f sarif -name pinact -reporter github-pr-review
  * GitHub SARIF Code Scanning:
  - run: pinact run --diff --format sarif &gt; sarif.json || true
  - name: Upload SARIF file
    uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
    with:
    sarif_file: sarif.json
    category: pinact
  * Support evironment variables PINACT_GITHUB_TOKEN and
    PINACT_GHES_TOKEN
    [#1297] You can use different access tokens for pinact and
    other tools.
  * Dependencies
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.1 (#1302)
  - chore(deps): update dependency aquaproj/aqua to v2.56.1
    (#1296)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.448.0 (#1292)
  - chore(deps): update dependency anchore/syft to v1.39.0
    (#1291)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.447.1 (#1290)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.447.0 (#1289)
  - chore(deps): update dependency aquaproj/aqua to v2.56.0
    (#1288)
  - fix(deps): update module github.com/goccy/go-yaml to v1.19.1
    (#1287)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.6.0 (#1285)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305601">- Update to version 3.8.0:
  * Features
  - #1315 Support ghtkn integration
    You can create a GitHub App User Access Token by ghtkn
    integration.
    About ghtkn, please see the document of ghtkn.
    https://github.com/suzuki-shunsuke/ghtkn
    You need to set up ghtkn first.
    export PINACT_GHTKN=true
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.450.0 (#1316)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.4 (#1314)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770120000">- Update to version 3.9.0:
  * Features
  - #1365 Make version separator configurable via configuration
    file @ReenigneArcher
  - #1372 Make version separator configurable via command line
    option and environment variable
  * Bug Fixes
  - #1359 Fix a bug that -log-color doesn't work
  * Others
  - docs: fix readme for ignore_actions[].ref by @nasa9084 in
    [#1323]
  - docs: fix readme for correct GHES_API_URL by @maruloop in
    [#1324]
  - docs(INSTALL): add mise alternate installation documentation
    by @jylenhof in #1331
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.465.0 (#1371)
  - fix(deps): update module github.com/google/go-github/v81 to
    v82 (#1368)
  - chore(deps): update dependency aquaproj/aqua to v2.56.6
    (#1370)
  - chore(deps): update dependency anchore/syft to v1.41.1
    (#1369)
  - chore(deps): update dependency crate-ci/typos to v1.42.3
    (#1367)
  - chore(deps): update dependency anchore/syft to v1.41.0
    (#1366)
  - chore(deps): update dependency crate-ci/typos to v1.42.2
    (#1364)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.464.0 (#1362)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.463.0 (#1361)
  - fix(deps): update module github.com/suzuki-shunsuke/slog-util
    to v0.3.1 (#1359)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.462.0 (#1360)
  - chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.5 (#1358)
  - chore(deps): update dependency crate-ci/typos to v1.42.1
    (#1357)
  - chore(deps): update actions/checkout action to v6.0.2 (#1356)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.10.0
    (#1355)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.461.0 (#1354)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.460.1 (#1353)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.459.0 (#1352)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.2
    (#1351)
  - chore(deps): update dependency aquaproj/aqua to v2.56.5
    (#1350)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.458.0 (#1349)
  - chore(deps): update dependency anchore/syft to v1.40.1
    (#1348)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.457.0 (#1347)
  - chore(deps): update dependency aquaproj/aqua to v2.56.4
    (#1346)
  - chore(deps): update dependency go to v1.25.6 (#1345)
  - fix(deps): update module
    github.com/suzuki-shunsuke/slog-error to v0.2.2 (#1344)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.456.0 (#1343)
  - chore(deps): update actions/setup-go action to v6.2.0 (#1341)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.455.0 (#1340)
  - chore(deps): update dependency aquaproj/aqua to v2.56.3
    (#1339)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.3 (#1338)
  - chore(deps): update dependency sigstore/cosign to v3.0.4
    (#1337)
  - chore(deps): update dependency anchore/syft to v1.40.0
    (#1336)
  - fix(deps): update module github.com/goccy/go-yaml to v1.19.2
    (#1335)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.8.0 (#1334)
  - chore(deps): update dependency crate-ci/typos to v1.42.0
    (#1332)
  - fix(deps): update module github.com/google/go-github/v80 to
    v81 (#1329)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.454.0 (#1330)
  - chore(deps): update dependency aquaproj/aqua to v2.56.2
    (#1328)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.453.0 (#1327)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.452.0 (#1325)
  - chore(deps): update dependency crate-ci/typos to v1.41.0
    (#1322)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.451.1 (#1321)
  - chore(deps): update dependency rhysd/actionlint to v1.7.10
    (#1320)
  - chore(deps): update dependency crate-ci/typos to v1.40.1
    (#1319)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.451.0 (#1318)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.8.0 (#1317)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777550400">- Update to version 3.9.2:
  * Fixes
  - #1493 Preserve original line endings when updating workflows
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.500.0 (#1495)
  - chore(deps): update dependency anchore/syft to v1.43.0
    (#1489)
  - chore(deps): update dependency aquaproj/aqua to v2.57.2
    (#1487)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.499.0 (#1486)
  - fix(deps): update module github.com/google/go-github/v84 to
    v85 (#1484)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.498.0 (#1485)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.497.0 (#1482)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.496.0 (#1481)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.495.0 (#1480)
  - chore(deps): update dependency crate-ci/typos to v1.45.1
    (#1476)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.494.1 (#1475)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.493.0 (#1473)
  - chore(deps): update dependency anchore/syft to v1.42.4
    (#1471)
  - chore(deps): update dependency sigstore/cosign to v3.0.6
    (#1470)
  - chore(deps): update dependency go to v1.26.2 (#1469)
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#1468)
  - chore(deps): update dependency crate-ci/typos to v1.45.0
    (#1467)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.492.0 (#1466)
  - chore(deps): update dependency rhysd/actionlint to v1.7.12
    (#1465)
  - fix(deps): update module github.com/hashicorp/go-version to
    v1.9.0 (#1464)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.491.0 (#1461)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.490.0 (#1459)
  - chore(deps): update dependency aquaproj/aqua-renovate-config
    to v2.12.0 (#1460)
  - fix(deps): update module github.com/google/go-github/v83 to
    v84 (#1415)
  - chore(deps): update suzuki-shunsuke/renovate-config to v4
    (#1439)
  - chore(deps): update actions/setup-go action to v6.4.0 (#1456)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.489.0 (#1455)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.8.0
    (#1453)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.488.0 (#1452)
  - chore(deps): update dependency suzuki-shunsuke/nllint to
    v1.1.0 (#1451)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.4 (#1450)
  - fix(deps): update module github.com/fatih/color to v1.19.0
    (#1446)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.487.0 (#1445)
  - chore(deps): update dependency anchore/syft to v1.42.3
    (#1444)
  - chore(deps): update dependency aquaproj/aqua to v2.57.1
    (#1443)
  - chore(deps): update suzuki-shunsuke/actionlint-action action
    to v0.1.2 (#1442)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.486.0 (#1440)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.485.0 (#1438)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.484.0 (#1437)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.3 (#1436)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.483.0 (#1433)
  - chore(deps): update dependency anchore/syft to v1.42.2
    (#1432)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.482.0 (#1431)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.2.3
    (#1429)
  - chore(deps): update dependency aquaproj/aqua to v2.57.0
    (#1430)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.481.0 (#1426)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.2 (#1425)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.480.0 (#1424)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.1 (#1423)
  - fix(deps): update module golang.org/x/oauth2 to v0.36.0
    (#1422)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.479.0 (#1421)
  - chore(deps): update dependency go to v1.26.1 (#1420)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.11.0
    (#1419)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.478.0 (#1418)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.477.0 (#1417)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.7.0
    (#1416)
  - chore(deps): update dependency crate-ci/typos to v1.44.0
    (#1414)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.14.1 (#1412)
  - chore(deps): update actions/setup-go action to v6.3.0 (#1413)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.476.0 (#1410)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.14.0 (#1409)
  - chore(deps): update dependency aquaproj/aqua to v2.56.7
    (#1408)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.475.0 (#1407)
  - chore(deps): update dependency sigstore/cosign to v3.0.5
    (#1406)
  - chore(deps): update dependency anchore/syft to v1.42.1
    (#1405)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.474.0 (#1404)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.2.2
    (#1399)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.10.1 (#1402)
  - chore(deps): update dependency go to v1.26.0 (#1388)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.9.0 (#1392)
  - fix(deps): update module github.com/google/go-github/v82 to
    v83 (#1398)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.473.0 (#1400)
  - chore(deps): update dependency crate-ci/typos to v1.43.5
    (#1397)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.472.1 (#1396)
  - chore(deps): update dependency rhysd/actionlint to v1.7.11
    (#1395)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.472.0 (#1394)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.471.0 (#1393)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.470.0 (#1391)
  - chore(deps): update dependency anchore/syft to v1.42.0
    (#1389)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.469.0 (#1387)
  - chore(deps): update dependency crate-ci/typos to v1.43.4
    (#1386)
  - chore(deps): update dependency crate-ci/typos to v1.43.3
    (#1384)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.468.0 (#1385)
  - chore(deps): update dependency crate-ci/typos to v1.43.2
    (#1383)
  - fix(deps): update module golang.org/x/oauth2 to v0.35.0
    (#1382)
  - chore(deps): update dependency go to v1.25.7 (#1381)
  - chore(deps): update dependency crate-ci/typos to v1.43.1
    (#1379)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.467.0 (#1380)
  - chore(deps): update dependency anchore/syft to v1.41.2
    (#1378)
  - chore(deps): update dependency crate-ci/typos to v1.43.0
    (#1377)
  - fix(deps): update module github.com/lmittmann/tint to v1.1.3
    (#1376)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.466.1 (#1375)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.466.0 (#1374)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.9.0 (#1373)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778673600">- Update to version 3.10.0:
  * Features
  - #1530 Support pinning branches to latest stable tags by the
  - -branch-to-tag option
    The default behabiour isn't changed.
    By default, pinact doesn't pin branches such as main or
    master.
    If you want to pin specific branches, you can use the
  - -branch-to-tag option.
    e.g.
    pinact run --branch-to-tag '^main$' --branch-to-tag '^release/.*$'
  * Dependencies
  - fix(deps): update module github.com/urfave/cli/v3 to v3.9.0
    (#1528)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.511.1 (#1527)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.511.0 (#1526)
  - chore(deps): update dependency crate-ci/typos to v1.46.1
    (#1525)
  - fix(deps): update module github.com/google/go-github/v85 to
    v86 (#1524)
  - chore(deps): update go module directive to v1.26.3 (#1523)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.2 (#1522)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.510.0 (#1521)
  - chore(deps): update dependency aquaproj/aqua to v2.58.1
    (#1520)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.509.0 (#1519)
  - chore(deps): update dependency mvdan/gofumpt to v0.10.0
    (#1518)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.508.0 (#1517)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.15.4 (#1516)
  - chore(deps): update dependency aquaproj/aqua to v2.58.0
    (#1515)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.507.0 (#1514)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.1 (#1513)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.0 (#1510)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.506.0 (#1512)
  - chore(deps): update dependency anchore/syft to v1.44.0
    (#1511)
  - chore(deps): update dependency crate-ci/typos to v1.46.0
    (#1509)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.505.0 (#1506)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.504.0 (#1505)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v8 (#1504)
  - chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.6 (#1502)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5.0.2 (#1503)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.503.0 (#1501)
  - chore(deps): update dependency crate-ci/typos to v1.45.2
    (#1500)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.502.0 (#1499)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.501.0 (#1498)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.9.2 (#1497)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 3.10.1:
  * Bug Fixes
  - #1535 pin uses lines with multiple spaces after the YAML list
    dash
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.512.0 (#1533)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.10.0 (#1532)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 4.0.0:
  * Breaking Changes
  - #1540 Removed the -review option
    Output SARIF and pass it to reviewdog. This has been
    announced previously.
    pinact run -format sarif |
    reviewdog -f sarif -name pinact -reporter github-pr-review
  * #1540 Always output diff
    Even if you specify -diff=false, it is ignored.
  * #1540 -diff and -check are now aliases for -fix=false
    This simplifies the logic, making it easier to understand and
    less prone to bugs.
  * #1540 -verify is now an alias for --verify-comment
  - verify was unclear about what was being verified, so it has
    been renamed for clarity.
    However, -verify is kept as-is to maintain backward
    compatibility.
  * #1458 #1558 Version comments are now required @ManuelLerchnerQC
    For SHAs without a version comment, pinact automatically adds a
    version comment (validation error if -fix=false).
    $ pinact run test.yaml
    test.yaml:1
  - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
    + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    Specifying a version comment makes it easier to see which
    version is being used, and makes it easier for tools like
    Renovate and Dependabot to update.
    It also has security implications.
    For GitHub Actions versions, you can also specify the SHA of a
    commit in a fork.
    This means it could point to a malicious commit in a fork.
    If you specify only the SHA without a version comment, you
    cannot tell whether it is the SHA of a commit in a fork.
    By requiring version comments, you can verify that the version
    comment matches the SHA using the --verify-comment option.
    Even if a fake version comment is added to a fork's SHA, it can
    be detected by --verify-comment.
    An attacker could also create a tag pointing to a fork's SHA,
    but creating a tag requires write permission, which raises the
    bar for attacks, so this can be said to improve security.
    Of course, this is only meaningful if you verify with
  - -verify-comment, so it is recommended to run pinact with
  - -verify-comment in CI.
  * Features
  - -no-api: support for offline validation
    If you just want to check whether something is pinned, you
    don't really need to use the GitHub API, but previously the
    GitHub API was called.
    With the -no-api option, you can validate without calling the
    GitHub API.
    However, since API calls are currently essential for fixing
    code (this may change in the future if caching is supported),
    you need to specify either -fix=false or -format sarif.
    Implicitly treating it as -fix=false could cause behavior to
    change and become a breaking change when caching is
    supported, so it must currently be specified explicitly.
  - You can now check whether the version being used satisfies
    min age, not just newer versions
    For example, you can run it in CI against modified lines to
    check whether any dangerous versions that do not satisfy min
    age are being used.
    This is not checked by default, but is checked when you run
    pinact run --verify-min-age or pinact run -min-age &lt;min age&gt;.
  - More flexible min age support via rules
    min age can now be configured in the configuration file.
    Additionally, by using rules, you can apply settings such as
    min age to specific actions.
    min_age:
    value: 7 # default setting
    rules:
    [#] Allow latest for suzuki-shunsuke's actions
  - ignore: true
    conditions:
  - expr: |
    ActionRepoOwner == "suzuki-shunsuke" &amp;&amp; ActionVersion == "latest"
    [#] Set min age to 0 for actions/checkout
  - min_age: 0
    conditions:
  - expr: |
    ActionRepoFullName == "actions/checkout"
    For rules, conditions are evaluated per rule, and the
    settings are applied if matched.
    You can write multiple conditions, and the settings are
    applied if any one of the conditions matches.
    expr follows https://expr-lang.org/docs/language-definition.
    Please read the documentation for details.
    The settings of rules listed later in rules take precedence.
  - Support for a global configuration file
    Warning
    If you have set the PINACT_MIN_AGE environment variable in
    ~/.bashrc, ~/.zshrc, etc., it is recommended to remove it
    and use a global configuration file instead.
    PINACT_MIN_AGE takes precedence over the configuration
    file, so it overrides the project's settings.
    On the other hand, global settings are merged with lower
    priority than the project's settings.
    If you want to enforce the setting, PINACT_MIN_AGE is
    suitable, but for default settings, a global configuration
    file is more appropriate.
    Note also that environment variables do not allow flexible
    settings like rules.
    A global configuration file is now supported.
    The file path is searched in the following order of priority:
  - $PINACT_GLOBAL_CONFIG
  - ${XDG_CONFIG_HOME}/pinact/pinact.yaml
  - ${HOME}/.config/pinact/pinact.yaml
    rules are prepended before the rules in the project
    configuration file.
    So project settings take precedence over global settings.
  - Automatic correction of version comments via -verify-comment
    If the SHA and the version comment do not match, the version
    comment is automatically corrected to match the SHA.
    Previously, it would just return an error, but now it is
    automatically corrected.
  - -diff-file: limit pinact's targets to only the changed lines
    If you specify a file in Unified Diff Format via -diff-file,
    you can limit pinact's targets to only the changed lines.
    By passing the PR's diff file in PR CI, you can reduce
    unnecessary API calls and prevent corrections or errors from
    code unrelated to the PR's changes.
    This makes it easier to introduce pinact via Required
    Workflow across an entire GitHub Organization of a large
    development organization.
    To improve the overall health of a development organization,
    it is desirable to introduce pinact via Required Workflow.
    However, if you suddenly introduce pinact as a Required
    Workflow in an Organization that has a lot of originally
    unpinned code, errors and corrections unrelated to the PR's
    changes will occur everywhere, causing confusion.
    When errors occur in places unrelated to the PR's changes,
    the PR author thinks "what is this error?", "wait, do I have
    to fix this? It's unrelated to this PR so I want to split the
    PR, but creating a PR is a hassle."
    It is also possible that the same error occurs in multiple
    PRs, and each one independently performs redundant fixing
    work.
    Inquiries about errors come in from various teams, generating
    unnecessary costs.
    If you try to fix everything before introducing the Required
    Workflow, it takes time to introduce, and during that time
    the bad situation continues where new unpinned code keeps
    increasing.
    On the other hand, if you can fix and validate only the lines
    changed in a PR, the PR author can more easily accept making
    the fix, and there is no need to split the PR.
    However, this alone does not pin existing code, so in
    parallel with this, you still need to run pinact against each
    repository and create PRs.
    How do you generate the file specified by -diff-file? You can
    easily generate it using the action
    https://github.com/suzuki-shunsuke/pr-unified-diff-action.
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    with:
    persist-credentials: false
  - uses: suzuki-shunsuke/pr-unified-diff-action@c932c1df5f577028d8ca05d2d3c0c059072d8821 # v0.0.1
    id: diff
  - uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
    with:
    diff_file: ${{ steps.diff.outputs.diff_path }}
  * Changelog
  - fix(deps): update module github.com/google/go-github/v87 to
    v88 (#1564)
  - fix(run): filter --diff-file targets by workflow patterns
    (#1562)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.516.0 (#1559)
  - feat!: error when SHA-pinned action has no version comment
    (#1558)
  - fix(run): use --diff-file as the file source when no
    args/config (#1557)
  - feat(verify): auto-correct version comments to match actual
    SHA (#1435)
  - fix(run): normalize --diff-file paths to forward slashes for
    Windows (#1552)
  - feat: add version comment to pinned actions missing
    annotation (#1458)
  - fix: honor rules[].min_age in update-target cooldown filter
    (#1556)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.515.0 (#1555)
  - docs: fix a broken link (#1554)
  - fix(deps): update module github.com/google/go-github/v86 to
    v87 (#1550)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.514.0 (#1549)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.513.1 (#1548)
  - feat(run): add --diff-file to process only PR-changed lines
    (#1547)
  - chore(deps): update dependency aquaproj/aqua-renovate-config
    to v2.12.1 (#1546)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.513.0 (#1545)
  - feat(config): merge global and project configs field-by-field
    (#1543)
  - chore(deps): update suzuki-shunsuke/go-autofix-action action
    to v0.1.12 (#1544)
  - feat(config): PINACT_GLOBAL_CONFIG env var overrides the
    global config path (#1542)
  - v4 spec implementation (#1540)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.512.1 (#1541)
  - chore(deps): update dependency aquaproj/aqua to v2.59.0
    (#1539)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.10.1 (#1537)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781006400">- Update to version 4.1.0:
  * Features
  - #1578 Update ghtkn-go-sdk to v0.3.0 for backend and disable
    device flow support
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.523.0 (#1594)
  - chore(deps): update dependency anchore/syft to v1.45.1
    (#1593)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.522.0 (#1592)
  - chore(deps): update dependency crate-ci/typos to v1.47.2
    (#1587)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v8.1.0 (#1588)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.521.0 (#1586)
  - chore(deps): update dependency crate-ci/typos to v1.47.1
    (#1585)
  - chore(deps): update actions/checkout action to v6.0.3 (#1583)
  - chore(deps): update dependency anchore/syft to v1.45.0
    (#1584)
  - chore(deps): update go module directive to v1.26.4 (#1582)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.2 (#1580)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.1 (#1577)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.0 (#1576)
  - chore(deps): update dependency crate-ci/typos to v1.47.0
    (#1575)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.519.0 (#1574)
  - chore(deps): update suzuki-shunsuke/actionlint-action action
    to v0.1.4 (#1573)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.518.0 (#1572)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.16.0 (#1571)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.517.0 (#1570)
  - chore(deps): update dependency aquaproj/aqua to v2.59.1
    (#1569)
  - chore(deps): update dependency crate-ci/typos to v1.46.3
    (#1568)
  - chore(deps): update dependency suzuki-shunsuke/pinact to v4
    (#1565)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1785412800">- Update to version 4.1.1:
  * Dependency Updates
  - #1634 Update Go to v1.26.5
  - #1659 Update module github.com/suzuki-shunsuke/ghtkn-go-sdk
    to v0.5.0
  - #1622 Update module github.com/urfave/cli/v3 to v3.10.1
  - #1633 Update module github.com/google/go-github/v88 to v89
  - #1646 Update dependency sigstore/cosign to v3.1.2
  - #1653 Update dependency anchore/syft to v1.49.0
  - #1657 Update dependency goreleaser/goreleaser to v2.17.1</changelog>
</package>
<package pkgid="4d0701debc04a43efbebb48ab297644fa9a31b4659ef5e1f59b1710b66d1665d3ab818f5ec584272910ae55619bb37bc993bbc8c8b4a47bb0b107b2301db736e" name="pinact-zsh-completion" arch="noarch">
  <version epoch="0" ver="4.1.1" rel="30.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- new package pinact: CLI to edit GitHub Workflow and Composite
  action files and pin versions of Actions and Reusable Workflows.
  pinact can also update their versions and verify version
  annotations</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516801">- Update to version 3.4.2:
  * fix(casks): restrict quarantine removal to macOS only (#1103)
  * test: add comprehensive unit tests for version comparison
    functions (#1102)
  * feat: add Claude Code auto-formatting hooks (#1101)
  * docs: add comprehensive AI assistant guidelines with shared
    documentation (#1100)
  * docs: add CLAUDE.md with project guidelines for AI assistants
    (#1099)
  * docs: add comprehensive documentation comments to all packages
    (#1098)
  * chore(deps): update dependency anchore/syft to v1.31.0 (#1097)
  * ci: use go-test-full-workflow (#1094)
  * chore: use aqua lsp (#1093)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.403.0 (#1092)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380800">- Update to version 3.4.3:
  * Bug Fixes
  - #1201 Skip prereleases when current version is stable
    @mceachen
  - #1213 Fixed bugs of #1201
  * Dependencies
  - chore(deps): update actions/setup-go action to v6 (#1123)
  - chore(deps): update aquaproj/aqua-installer action to v4.0.3
    (#1113)
  - chore(deps): update aquaproj/aqua-installer action to v4.0.4
    (#1198)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.9.0
    (#1136)
  - chore(deps): update dependency anchore/syft to v1.32.0
    (#1110)
  - chore(deps): update dependency anchore/syft to v1.33.0
    (#1143)
  - chore(deps): update dependency anchore/syft to v1.34.1
    (#1182)
  - chore(deps): update dependency anchore/syft to v1.34.2
    (#1183)
  - chore(deps): update dependency anchore/syft to v1.36.0
    (#1192)
  - chore(deps): update dependency anchore/syft to v1.37.0
    (#1202)
  - chore(deps): update dependency aquaproj/aqua to v2.53.10
    (#1114)
  - chore(deps): update dependency aquaproj/aqua to v2.53.11
    (#1126)
  - chore(deps): update dependency aquaproj/aqua to v2.54.0
    (#1134)
  - chore(deps): update dependency aquaproj/aqua to v2.54.1
    (#1137)
  - chore(deps): update dependency aquaproj/aqua to v2.55.0
    (#1148)
  - chore(deps): update dependency aquaproj/aqua to v2.55.1
    (#1190)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.404.0 (#1106)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.405.0 (#1107)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.406.0 (#1108)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.407.0 (#1111)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.408.0 (#1116)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.409.0 (#1127)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.409.1 (#1128)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.410.0 (#1129)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.411.0 (#1131)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.411.1 (#1135)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.412.0 (#1142)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.413.0 (#1146)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.414.0 (#1149)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.415.0 (#1150)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.416.0 (#1153)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.417.0 (#1154)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.418.0 (#1157)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.419.0 (#1160)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.420.0 (#1163)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.421.0 (#1165)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.422.0 (#1167)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.423.0 (#1168)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.424.0 (#1169)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.425.0 (#1171)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.426.0 (#1173)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.427.0 (#1176)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.428.0 (#1181)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.429.0 (#1184)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.430.0 (#1187)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.430.1 (#1193)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.431.0 (#1195)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.432.0 (#1196)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.433.0 (#1199)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.434.0 (#1207)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.435.0 (#1209)
  - chore(deps): update dependency crate-ci/typos to v1.35.5
    (#1105)
  - chore(deps): update dependency crate-ci/typos to v1.35.6
    (#1112)
  - chore(deps): update dependency crate-ci/typos to v1.36.1
    (#1117)
  - chore(deps): update dependency crate-ci/typos to v1.36.2
    (#1125)
  - chore(deps): update dependency crate-ci/typos to v1.36.3
    (#1159)
  - chore(deps): update dependency go to v1.25.1 (#1141)
  - chore(deps): update dependency go to v1.25.2 (#1172)
  - chore(deps): update dependency go to v1.25.3 (#1179)
  - chore(deps): update dependency go to v1.25.4 (#1204)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.5.0 (#1152)
  - chore(deps): update dependency google/go-licenses to v2
    (#1122)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.0 (#1118)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.1 (#1145)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.2 (#1147)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.3 (#1158)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.4 (#1162)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.5 (#1164)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.6 (#1188)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.12.7 (#1194)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.0
    (#1119)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.1
    (#1130)
  - chore(deps): update dependency mvdan/gofumpt to v0.9.2
    (#1186)
  - chore(deps): update dependency reviewdog/reviewdog to v0.21.0
    (#1120)
  - chore(deps): update dependency rhysd/actionlint to v1.7.8
    (#1177)
  - chore(deps): update dependency sigstore/cosign to v2.6.0
    (#1139)
  - chore(deps): update dependency sigstore/cosign to v2.6.1
    (#1166)
  - chore(deps): update dependency sigstore/cosign to v3 (#1175)
  - chore(deps): update dependency sigstore/cosign to v3.0.2
    (#1178)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.2 (#1104)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v6.0.2 (#1115)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v7 (#1189)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v4.0.1 (#1156)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5 (#1174)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5.0.1 (#1191)
  - chore(deps): update suzuki-shunsuke/renovate-config to v3.3.0
    (#1121)
  - chore(deps): update suzuki-shunsuke/renovate-config to v3.3.1
    (#1144)
  - fix(deps): update module github.com/google/go-github/v74 to
    v75 (#1155)
  - fix(deps): update module github.com/google/go-github/v75 to
    v76 (#1180)
  - fix(deps): update module github.com/google/go-github/v76 to
    v78 (#1206)
  - fix(deps): update module github.com/spf13/afero to v1.15.0
    (#1132)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.5.0
    (#1185)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.0
    (#1208)
  - fix(deps): update module golang.org/x/oauth2 to v0.31.0
    (#1124)
  - fix(deps): update module golang.org/x/oauth2 to v0.32.0
    (#1170)
  - fix(deps): update module golang.org/x/oauth2 to v0.33.0
    (#1205)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380801">- Update to version 3.4.4:
  * Bug Fixes
  - Skip prerelease tags when current version is stable
    @fredericlepied
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.436.0 (#1215)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.3 (#1214)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764244800">- Update to version 3.4.5:
  * Bug Fixes
  - fix: ignore draft releases (#1237)
  * Dependencies
  - chore(deps): update actions/checkout action to v6 (#1232)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.440.0 (#1235)
  - chore(deps): update dependency rhysd/actionlint to v1.7.9
    (#1234)
  - chore(deps): update dependency aquaproj/aqua to v2.55.2
    (#1233)
  - chore(deps): update actions/setup-go action to v6.1.0 (#1230)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.439.0 (#1229)
  - chore(deps): update dependency anchore/syft to v1.38.0
    (#1228)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.438.0 (#1227)
  - fix(deps): update module github.com/google/go-github/v78 to
    v79 (#1222)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.1
    (#1225)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.437.0 (#1224)
  - chore(deps): update actions/checkout action to v5.0.1 (#1223)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.4 (#1221)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765195200">- Update to version 3.4.6:
  * #1250 #1251 Replace logrus with slog
  * #1109 #1254 Refactoring
  * chore(deps): update dependency crate-ci/typos to v1.37.0
    (#1161)
  * chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.4 (#1253)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.444.0 (#1249)
  * chore(deps): update dependency go to v1.25.5 (#1248)
  * chore(deps): update actions/checkout action to v6.0.1 (#1247)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.443.0 (#1246)
  * chore(deps): update dependency goreleaser/goreleaser to v2.13.0
    (#1245)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.442.1 (#1244)
  * chore(deps): update suzuki-shunsuke/go-autofix-action action to
    v0.1.11 (#1243)
  * fix(deps): update module github.com/goccy/go-yaml to v1.19.0
    (#1242)
  * fix(deps): update module github.com/hashicorp/go-version to
    v1.8.0 (#1241)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.442.0 (#1240)
  * chore(deps): update dependency suzuki-shunsuke/pinact to v3.4.5
    (#1238)
  * chore(deps): update dependency aquaproj/aqua-registry to
    v4.441.0 (#1239)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765454400">- Update to version 3.5.0:
  * Features
  - #1266 #1267 Add --min-age (-m) option
    Skip recently released versions when updating actions with -u
    flag.
    pinact run -u --min-age 7
    [#] or using short alias
    pinact run -u -m 7
    This helps avoid updating to potentially unstable versions
    that haven't had time to prove their stability.
  - For GitHub Releases, the PublishedAt date is checked
  - For tags, the commit's Committer.Date is checked
  * Refactoring
  - #1259 Use Destination pattern for urfave/cli flags
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua to v2.55.3
    (#1264)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.444.2 (#1263)
  - fix(deps): update module golang.org/x/oauth2 to v0.34.0
    (#1262)
  - fix(deps): update module github.com/google/go-github/v79 to
    v80 (#1261)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.1.2
    (#1260)
  - chore(deps): update dependency suzuki-shunsuke/nllint to v1
    (#1258)
  - chore(deps): update dependency crate-ci/typos to v1.40.0
    (#1257)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.4.6 (#1256)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765886400">- Update to version 3.6.0:
  * Features
  - #1275 Support GitHub Enterprise
  - #1282 #1284 Support PINACT_MIN_AGE environment variable for
  - min-age option
  * Bug Fixes
  - #1283 Fix a bug that pinact token set can't be cancelled by
    ctrl-c
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.446.0 (#1281)
  - chore(deps): update dependency anchore/syft to v1.38.2
    (#1276)
  - chore(deps): update dependency sigstore/cosign to v3.0.3
    (#1277)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.1 (#1272)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.7.2 (#1270)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.445.0 (#1269)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.5.0 (#1268)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305600">- Update to version 3.7.4:
  * Bug Fixes
  - Ignore tags associated with releases #1313
- Update to version 3.7.3:
  * #1309 Fix some bugs
  - -verify is ignored if -u is used
  - versions aren't pinned and verified if version comments are
    semver
    Details see
    https://github.com/suzuki-shunsuke/pinact/releases/tag/v3.7.3
- Update to version 3.7.2:
  * Fixes
  - sarif: Add fixes field for reviewdog suggestion support
  * Dependencies
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.3 (#1310)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.449.0 (#1311)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.448.1 (#1307)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.2 (#1306)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.2 (#1305)
- Update to version 3.7.1:
  There is no change between v3.7.0 and v3.7.1.
  There was an issue during the release of v3.7.0, so we released
  v3.7.1.
- Update to version 3.7.0:
  * Features
  - #1294 SARIF Output Support
  - #1297 Support evironment variables PINACT_GITHUB_TOKEN and
    PINACT_GHES_TOKEN
  * SARIF Output Support
    [#1294]
    pinact can output the result in the SARIF format.
    pinact run --format sarif
    This format is useful to integration tools like reviewdog and
    GitHub SARIF Code Scanning.
    Reviewdog:
    pinact run --diff --format sarif |
    reviewdog -f sarif -name pinact -reporter github-pr-review
  * GitHub SARIF Code Scanning:
  - run: pinact run --diff --format sarif &gt; sarif.json || true
  - name: Upload SARIF file
    uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
    with:
    sarif_file: sarif.json
    category: pinact
  * Support evironment variables PINACT_GITHUB_TOKEN and
    PINACT_GHES_TOKEN
    [#1297] You can use different access tokens for pinact and
    other tools.
  * Dependencies
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.1 (#1302)
  - chore(deps): update dependency aquaproj/aqua to v2.56.1
    (#1296)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.448.0 (#1292)
  - chore(deps): update dependency anchore/syft to v1.39.0
    (#1291)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.447.1 (#1290)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.447.0 (#1289)
  - chore(deps): update dependency aquaproj/aqua to v2.56.0
    (#1288)
  - fix(deps): update module github.com/goccy/go-yaml to v1.19.1
    (#1287)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.6.0 (#1285)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305601">- Update to version 3.8.0:
  * Features
  - #1315 Support ghtkn integration
    You can create a GitHub App User Access Token by ghtkn
    integration.
    About ghtkn, please see the document of ghtkn.
    https://github.com/suzuki-shunsuke/ghtkn
    You need to set up ghtkn first.
    export PINACT_GHTKN=true
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.450.0 (#1316)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.7.4 (#1314)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1770120000">- Update to version 3.9.0:
  * Features
  - #1365 Make version separator configurable via configuration
    file @ReenigneArcher
  - #1372 Make version separator configurable via command line
    option and environment variable
  * Bug Fixes
  - #1359 Fix a bug that -log-color doesn't work
  * Others
  - docs: fix readme for ignore_actions[].ref by @nasa9084 in
    [#1323]
  - docs: fix readme for correct GHES_API_URL by @maruloop in
    [#1324]
  - docs(INSTALL): add mise alternate installation documentation
    by @jylenhof in #1331
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.465.0 (#1371)
  - fix(deps): update module github.com/google/go-github/v81 to
    v82 (#1368)
  - chore(deps): update dependency aquaproj/aqua to v2.56.6
    (#1370)
  - chore(deps): update dependency anchore/syft to v1.41.1
    (#1369)
  - chore(deps): update dependency crate-ci/typos to v1.42.3
    (#1367)
  - chore(deps): update dependency anchore/syft to v1.41.0
    (#1366)
  - chore(deps): update dependency crate-ci/typos to v1.42.2
    (#1364)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.464.0 (#1362)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.463.0 (#1361)
  - fix(deps): update module github.com/suzuki-shunsuke/slog-util
    to v0.3.1 (#1359)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.462.0 (#1360)
  - chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.5 (#1358)
  - chore(deps): update dependency crate-ci/typos to v1.42.1
    (#1357)
  - chore(deps): update actions/checkout action to v6.0.2 (#1356)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.10.0
    (#1355)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.461.0 (#1354)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.460.1 (#1353)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.459.0 (#1352)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.6.2
    (#1351)
  - chore(deps): update dependency aquaproj/aqua to v2.56.5
    (#1350)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.458.0 (#1349)
  - chore(deps): update dependency anchore/syft to v1.40.1
    (#1348)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.457.0 (#1347)
  - chore(deps): update dependency aquaproj/aqua to v2.56.4
    (#1346)
  - chore(deps): update dependency go to v1.25.6 (#1345)
  - fix(deps): update module
    github.com/suzuki-shunsuke/slog-error to v0.2.2 (#1344)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.456.0 (#1343)
  - chore(deps): update actions/setup-go action to v6.2.0 (#1341)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.455.0 (#1340)
  - chore(deps): update dependency aquaproj/aqua to v2.56.3
    (#1339)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.13.3 (#1338)
  - chore(deps): update dependency sigstore/cosign to v3.0.4
    (#1337)
  - chore(deps): update dependency anchore/syft to v1.40.0
    (#1336)
  - fix(deps): update module github.com/goccy/go-yaml to v1.19.2
    (#1335)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.8.0 (#1334)
  - chore(deps): update dependency crate-ci/typos to v1.42.0
    (#1332)
  - fix(deps): update module github.com/google/go-github/v80 to
    v81 (#1329)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.454.0 (#1330)
  - chore(deps): update dependency aquaproj/aqua to v2.56.2
    (#1328)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.453.0 (#1327)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.452.0 (#1325)
  - chore(deps): update dependency crate-ci/typos to v1.41.0
    (#1322)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.451.1 (#1321)
  - chore(deps): update dependency rhysd/actionlint to v1.7.10
    (#1320)
  - chore(deps): update dependency crate-ci/typos to v1.40.1
    (#1319)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.451.0 (#1318)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.8.0 (#1317)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1777550400">- Update to version 3.9.2:
  * Fixes
  - #1493 Preserve original line endings when updating workflows
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.500.0 (#1495)
  - chore(deps): update dependency anchore/syft to v1.43.0
    (#1489)
  - chore(deps): update dependency aquaproj/aqua to v2.57.2
    (#1487)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.499.0 (#1486)
  - fix(deps): update module github.com/google/go-github/v84 to
    v85 (#1484)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.498.0 (#1485)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.497.0 (#1482)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.496.0 (#1481)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.495.0 (#1480)
  - chore(deps): update dependency crate-ci/typos to v1.45.1
    (#1476)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.494.1 (#1475)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.493.0 (#1473)
  - chore(deps): update dependency anchore/syft to v1.42.4
    (#1471)
  - chore(deps): update dependency sigstore/cosign to v3.0.6
    (#1470)
  - chore(deps): update dependency go to v1.26.2 (#1469)
  - build(deps): bump github.com/buger/jsonparser from 1.1.1 to
    1.1.2 (#1468)
  - chore(deps): update dependency crate-ci/typos to v1.45.0
    (#1467)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.492.0 (#1466)
  - chore(deps): update dependency rhysd/actionlint to v1.7.12
    (#1465)
  - fix(deps): update module github.com/hashicorp/go-version to
    v1.9.0 (#1464)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.491.0 (#1461)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.490.0 (#1459)
  - chore(deps): update dependency aquaproj/aqua-renovate-config
    to v2.12.0 (#1460)
  - fix(deps): update module github.com/google/go-github/v83 to
    v84 (#1415)
  - chore(deps): update suzuki-shunsuke/renovate-config to v4
    (#1439)
  - chore(deps): update actions/setup-go action to v6.4.0 (#1456)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.489.0 (#1455)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.8.0
    (#1453)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.488.0 (#1452)
  - chore(deps): update dependency suzuki-shunsuke/nllint to
    v1.1.0 (#1451)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.4 (#1450)
  - fix(deps): update module github.com/fatih/color to v1.19.0
    (#1446)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.487.0 (#1445)
  - chore(deps): update dependency anchore/syft to v1.42.3
    (#1444)
  - chore(deps): update dependency aquaproj/aqua to v2.57.1
    (#1443)
  - chore(deps): update suzuki-shunsuke/actionlint-action action
    to v0.1.2 (#1442)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.486.0 (#1440)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.485.0 (#1438)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.484.0 (#1437)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.3 (#1436)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.483.0 (#1433)
  - chore(deps): update dependency anchore/syft to v1.42.2
    (#1432)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.482.0 (#1431)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.2.3
    (#1429)
  - chore(deps): update dependency aquaproj/aqua to v2.57.0
    (#1430)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.481.0 (#1426)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.2 (#1425)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.480.0 (#1424)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.11.1 (#1423)
  - fix(deps): update module golang.org/x/oauth2 to v0.36.0
    (#1422)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.479.0 (#1421)
  - chore(deps): update dependency go to v1.26.1 (#1420)
  - chore(deps): update aquaproj/aqua-renovate-config to v2.11.0
    (#1419)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.478.0 (#1418)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.477.0 (#1417)
  - fix(deps): update module github.com/urfave/cli/v3 to v3.7.0
    (#1416)
  - chore(deps): update dependency crate-ci/typos to v1.44.0
    (#1414)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.14.1 (#1412)
  - chore(deps): update actions/setup-go action to v6.3.0 (#1413)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.476.0 (#1410)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.14.0 (#1409)
  - chore(deps): update dependency aquaproj/aqua to v2.56.7
    (#1408)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.475.0 (#1407)
  - chore(deps): update dependency sigstore/cosign to v3.0.5
    (#1406)
  - chore(deps): update dependency anchore/syft to v1.42.1
    (#1405)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.474.0 (#1404)
  - fix(deps): update module
    github.com/suzuki-shunsuke/urfave-cli-v3-util to v0.2.2
    (#1399)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.10.1 (#1402)
  - chore(deps): update dependency go to v1.26.0 (#1388)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.9.0 (#1392)
  - fix(deps): update module github.com/google/go-github/v82 to
    v83 (#1398)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.473.0 (#1400)
  - chore(deps): update dependency crate-ci/typos to v1.43.5
    (#1397)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.472.1 (#1396)
  - chore(deps): update dependency rhysd/actionlint to v1.7.11
    (#1395)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.472.0 (#1394)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.471.0 (#1393)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.470.0 (#1391)
  - chore(deps): update dependency anchore/syft to v1.42.0
    (#1389)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.469.0 (#1387)
  - chore(deps): update dependency crate-ci/typos to v1.43.4
    (#1386)
  - chore(deps): update dependency crate-ci/typos to v1.43.3
    (#1384)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.468.0 (#1385)
  - chore(deps): update dependency crate-ci/typos to v1.43.2
    (#1383)
  - fix(deps): update module golang.org/x/oauth2 to v0.35.0
    (#1382)
  - chore(deps): update dependency go to v1.25.7 (#1381)
  - chore(deps): update dependency crate-ci/typos to v1.43.1
    (#1379)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.467.0 (#1380)
  - chore(deps): update dependency anchore/syft to v1.41.2
    (#1378)
  - chore(deps): update dependency crate-ci/typos to v1.43.0
    (#1377)
  - fix(deps): update module github.com/lmittmann/tint to v1.1.3
    (#1376)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.466.1 (#1375)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.466.0 (#1374)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.9.0 (#1373)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778673600">- Update to version 3.10.0:
  * Features
  - #1530 Support pinning branches to latest stable tags by the
  - -branch-to-tag option
    The default behabiour isn't changed.
    By default, pinact doesn't pin branches such as main or
    master.
    If you want to pin specific branches, you can use the
  - -branch-to-tag option.
    e.g.
    pinact run --branch-to-tag '^main$' --branch-to-tag '^release/.*$'
  * Dependencies
  - fix(deps): update module github.com/urfave/cli/v3 to v3.9.0
    (#1528)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.511.1 (#1527)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.511.0 (#1526)
  - chore(deps): update dependency crate-ci/typos to v1.46.1
    (#1525)
  - fix(deps): update module github.com/google/go-github/v85 to
    v86 (#1524)
  - chore(deps): update go module directive to v1.26.3 (#1523)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.2 (#1522)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.510.0 (#1521)
  - chore(deps): update dependency aquaproj/aqua to v2.58.1
    (#1520)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.509.0 (#1519)
  - chore(deps): update dependency mvdan/gofumpt to v0.10.0
    (#1518)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.508.0 (#1517)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.15.4 (#1516)
  - chore(deps): update dependency aquaproj/aqua to v2.58.0
    (#1515)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.507.0 (#1514)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.1 (#1513)
  - chore(deps): update dependency golangci/golangci-lint to
    v2.12.0 (#1510)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.506.0 (#1512)
  - chore(deps): update dependency anchore/syft to v1.44.0
    (#1511)
  - chore(deps): update dependency crate-ci/typos to v1.46.0
    (#1509)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.505.0 (#1506)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.504.0 (#1505)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v8 (#1504)
  - chore(deps): update dependency suzuki-shunsuke/ghalint to
    v1.5.6 (#1502)
  - chore(deps): update suzuki-shunsuke/go-test-full-workflow
    action to v5.0.2 (#1503)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.503.0 (#1501)
  - chore(deps): update dependency crate-ci/typos to v1.45.2
    (#1500)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.502.0 (#1499)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.501.0 (#1498)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.9.2 (#1497)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 3.10.1:
  * Bug Fixes
  - #1535 pin uses lines with multiple spaces after the YAML list
    dash
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.512.0 (#1533)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.10.0 (#1532)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 4.0.0:
  * Breaking Changes
  - #1540 Removed the -review option
    Output SARIF and pass it to reviewdog. This has been
    announced previously.
    pinact run -format sarif |
    reviewdog -f sarif -name pinact -reporter github-pr-review
  * #1540 Always output diff
    Even if you specify -diff=false, it is ignored.
  * #1540 -diff and -check are now aliases for -fix=false
    This simplifies the logic, making it easier to understand and
    less prone to bugs.
  * #1540 -verify is now an alias for --verify-comment
  - verify was unclear about what was being verified, so it has
    been renamed for clarity.
    However, -verify is kept as-is to maintain backward
    compatibility.
  * #1458 #1558 Version comments are now required @ManuelLerchnerQC
    For SHAs without a version comment, pinact automatically adds a
    version comment (validation error if -fix=false).
    $ pinact run test.yaml
    test.yaml:1
  - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
    + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    Specifying a version comment makes it easier to see which
    version is being used, and makes it easier for tools like
    Renovate and Dependabot to update.
    It also has security implications.
    For GitHub Actions versions, you can also specify the SHA of a
    commit in a fork.
    This means it could point to a malicious commit in a fork.
    If you specify only the SHA without a version comment, you
    cannot tell whether it is the SHA of a commit in a fork.
    By requiring version comments, you can verify that the version
    comment matches the SHA using the --verify-comment option.
    Even if a fake version comment is added to a fork's SHA, it can
    be detected by --verify-comment.
    An attacker could also create a tag pointing to a fork's SHA,
    but creating a tag requires write permission, which raises the
    bar for attacks, so this can be said to improve security.
    Of course, this is only meaningful if you verify with
  - -verify-comment, so it is recommended to run pinact with
  - -verify-comment in CI.
  * Features
  - -no-api: support for offline validation
    If you just want to check whether something is pinned, you
    don't really need to use the GitHub API, but previously the
    GitHub API was called.
    With the -no-api option, you can validate without calling the
    GitHub API.
    However, since API calls are currently essential for fixing
    code (this may change in the future if caching is supported),
    you need to specify either -fix=false or -format sarif.
    Implicitly treating it as -fix=false could cause behavior to
    change and become a breaking change when caching is
    supported, so it must currently be specified explicitly.
  - You can now check whether the version being used satisfies
    min age, not just newer versions
    For example, you can run it in CI against modified lines to
    check whether any dangerous versions that do not satisfy min
    age are being used.
    This is not checked by default, but is checked when you run
    pinact run --verify-min-age or pinact run -min-age &lt;min age&gt;.
  - More flexible min age support via rules
    min age can now be configured in the configuration file.
    Additionally, by using rules, you can apply settings such as
    min age to specific actions.
    min_age:
    value: 7 # default setting
    rules:
    [#] Allow latest for suzuki-shunsuke's actions
  - ignore: true
    conditions:
  - expr: |
    ActionRepoOwner == "suzuki-shunsuke" &amp;&amp; ActionVersion == "latest"
    [#] Set min age to 0 for actions/checkout
  - min_age: 0
    conditions:
  - expr: |
    ActionRepoFullName == "actions/checkout"
    For rules, conditions are evaluated per rule, and the
    settings are applied if matched.
    You can write multiple conditions, and the settings are
    applied if any one of the conditions matches.
    expr follows https://expr-lang.org/docs/language-definition.
    Please read the documentation for details.
    The settings of rules listed later in rules take precedence.
  - Support for a global configuration file
    Warning
    If you have set the PINACT_MIN_AGE environment variable in
    ~/.bashrc, ~/.zshrc, etc., it is recommended to remove it
    and use a global configuration file instead.
    PINACT_MIN_AGE takes precedence over the configuration
    file, so it overrides the project's settings.
    On the other hand, global settings are merged with lower
    priority than the project's settings.
    If you want to enforce the setting, PINACT_MIN_AGE is
    suitable, but for default settings, a global configuration
    file is more appropriate.
    Note also that environment variables do not allow flexible
    settings like rules.
    A global configuration file is now supported.
    The file path is searched in the following order of priority:
  - $PINACT_GLOBAL_CONFIG
  - ${XDG_CONFIG_HOME}/pinact/pinact.yaml
  - ${HOME}/.config/pinact/pinact.yaml
    rules are prepended before the rules in the project
    configuration file.
    So project settings take precedence over global settings.
  - Automatic correction of version comments via -verify-comment
    If the SHA and the version comment do not match, the version
    comment is automatically corrected to match the SHA.
    Previously, it would just return an error, but now it is
    automatically corrected.
  - -diff-file: limit pinact's targets to only the changed lines
    If you specify a file in Unified Diff Format via -diff-file,
    you can limit pinact's targets to only the changed lines.
    By passing the PR's diff file in PR CI, you can reduce
    unnecessary API calls and prevent corrections or errors from
    code unrelated to the PR's changes.
    This makes it easier to introduce pinact via Required
    Workflow across an entire GitHub Organization of a large
    development organization.
    To improve the overall health of a development organization,
    it is desirable to introduce pinact via Required Workflow.
    However, if you suddenly introduce pinact as a Required
    Workflow in an Organization that has a lot of originally
    unpinned code, errors and corrections unrelated to the PR's
    changes will occur everywhere, causing confusion.
    When errors occur in places unrelated to the PR's changes,
    the PR author thinks "what is this error?", "wait, do I have
    to fix this? It's unrelated to this PR so I want to split the
    PR, but creating a PR is a hassle."
    It is also possible that the same error occurs in multiple
    PRs, and each one independently performs redundant fixing
    work.
    Inquiries about errors come in from various teams, generating
    unnecessary costs.
    If you try to fix everything before introducing the Required
    Workflow, it takes time to introduce, and during that time
    the bad situation continues where new unpinned code keeps
    increasing.
    On the other hand, if you can fix and validate only the lines
    changed in a PR, the PR author can more easily accept making
    the fix, and there is no need to split the PR.
    However, this alone does not pin existing code, so in
    parallel with this, you still need to run pinact against each
    repository and create PRs.
    How do you generate the file specified by -diff-file? You can
    easily generate it using the action
    https://github.com/suzuki-shunsuke/pr-unified-diff-action.
  - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
    with:
    persist-credentials: false
  - uses: suzuki-shunsuke/pr-unified-diff-action@c932c1df5f577028d8ca05d2d3c0c059072d8821 # v0.0.1
    id: diff
  - uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
    with:
    diff_file: ${{ steps.diff.outputs.diff_path }}
  * Changelog
  - fix(deps): update module github.com/google/go-github/v87 to
    v88 (#1564)
  - fix(run): filter --diff-file targets by workflow patterns
    (#1562)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.516.0 (#1559)
  - feat!: error when SHA-pinned action has no version comment
    (#1558)
  - fix(run): use --diff-file as the file source when no
    args/config (#1557)
  - feat(verify): auto-correct version comments to match actual
    SHA (#1435)
  - fix(run): normalize --diff-file paths to forward slashes for
    Windows (#1552)
  - feat: add version comment to pinned actions missing
    annotation (#1458)
  - fix: honor rules[].min_age in update-target cooldown filter
    (#1556)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.515.0 (#1555)
  - docs: fix a broken link (#1554)
  - fix(deps): update module github.com/google/go-github/v86 to
    v87 (#1550)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.514.0 (#1549)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.513.1 (#1548)
  - feat(run): add --diff-file to process only PR-changed lines
    (#1547)
  - chore(deps): update dependency aquaproj/aqua-renovate-config
    to v2.12.1 (#1546)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.513.0 (#1545)
  - feat(config): merge global and project configs field-by-field
    (#1543)
  - chore(deps): update suzuki-shunsuke/go-autofix-action action
    to v0.1.12 (#1544)
  - feat(config): PINACT_GLOBAL_CONFIG env var overrides the
    global config path (#1542)
  - v4 spec implementation (#1540)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.512.1 (#1541)
  - chore(deps): update dependency aquaproj/aqua to v2.59.0
    (#1539)
  - chore(deps): update dependency suzuki-shunsuke/pinact to
    v3.10.1 (#1537)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1781006400">- Update to version 4.1.0:
  * Features
  - #1578 Update ghtkn-go-sdk to v0.3.0 for backend and disable
    device flow support
  * Dependencies
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.523.0 (#1594)
  - chore(deps): update dependency anchore/syft to v1.45.1
    (#1593)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.522.0 (#1592)
  - chore(deps): update dependency crate-ci/typos to v1.47.2
    (#1587)
  - chore(deps): update suzuki-shunsuke/go-release-workflow
    action to v8.1.0 (#1588)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.521.0 (#1586)
  - chore(deps): update dependency crate-ci/typos to v1.47.1
    (#1585)
  - chore(deps): update actions/checkout action to v6.0.3 (#1583)
  - chore(deps): update dependency anchore/syft to v1.45.0
    (#1584)
  - chore(deps): update go module directive to v1.26.4 (#1582)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.2 (#1580)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.1 (#1577)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.520.0 (#1576)
  - chore(deps): update dependency crate-ci/typos to v1.47.0
    (#1575)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.519.0 (#1574)
  - chore(deps): update suzuki-shunsuke/actionlint-action action
    to v0.1.4 (#1573)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.518.0 (#1572)
  - chore(deps): update dependency goreleaser/goreleaser to
    v2.16.0 (#1571)
  - chore(deps): update dependency aquaproj/aqua-registry to
    v4.517.0 (#1570)
  - chore(deps): update dependency aquaproj/aqua to v2.59.1
    (#1569)
  - chore(deps): update dependency crate-ci/typos to v1.46.3
    (#1568)
  - chore(deps): update dependency suzuki-shunsuke/pinact to v4
    (#1565)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1785412800">- Update to version 4.1.1:
  * Dependency Updates
  - #1634 Update Go to v1.26.5
  - #1659 Update module github.com/suzuki-shunsuke/ghtkn-go-sdk
    to v0.5.0
  - #1622 Update module github.com/urfave/cli/v3 to v3.10.1
  - #1633 Update module github.com/google/go-github/v88 to v89
  - #1646 Update dependency sigstore/cosign to v3.1.2
  - #1653 Update dependency anchore/syft to v1.49.0
  - #1657 Update dependency goreleaser/goreleaser to v2.17.1</changelog>
</package>
<package pkgid="249dabbd7b89505867bbf9cbba8ae87e3dfaff5df6943085cbf4c2b3a43c2d5a330c820e460f206deb3075b94aeb5ccd5a34bdef83ba01264babb194340aeb29" name="pkcs11-provider" arch="s390x">
  <version epoch="0" ver="1.1" rel="14.3"/>
  <changelog author="Luca Boccassi &lt;bluca@debian.org&gt;" date="1697025600">- Initial packaging of pkcs11-provider version 0.2</changelog>
  <changelog author="Luca Boccassi &lt;bluca@debian.org&gt;" date="1707480000">- New upstream version version 0.3. For a full list of changes, see
  https://github.com/latchset/pkcs11-provider/releases/tag/v0.3</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734436800">- Update to 0.6:
  * TLS 1.3 is now supported via token handling (KDFs etc..)
  * A new feature to prevent PIN lockouts when the token correctly signals
    authentication attempts depletion via token info.
  * Several issues with handling keys related to run a full end-to-end TLS
    connection on the token have been fixed
  * Most cases when early loading was needed have been resolved, HTTP and Bind
    for example work without specifying early loading for the provider
  * Several memory leaks have been resolved
  * Several new tests including a whole new token (kryoptic) are tested now, as
    well as tlsfuzzer against a TLS server deferring all operations to the
    tokens.
  * For a full list of changes see: https://github.com/latchset/pkcs11-provider/releases/tag/v0.6
- Includes changes from 0.5 and 0.4
  * We moved the build system to Meson
  * A feature to embed pkcs11- URIs into "fake" PEM files has been added which
    makes it possible to transparently use the provider with many tools that
    accept keys only as PEM files.
  * For a full list of changes see:
    https://github.com/latchset/pkcs11-provider/releases/tag/v0.5
    https://github.com/latchset/pkcs11-provider/releases/tag/v0.4
- Add pkcs11-provider.keyring
- Enable unit testing for softokn and softhsm
- Add patch
  * explicit-EC-test-option.patch</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1739448000">- Update to 1.0:
  * Improved compatibility with PKCS#11 spec and historical module behavior in
    interpreting CKA_EC_POINT, thie handled incompatibilities in ECDSA/ECDH
    keys.
  * Added full RSA-PSS support
  * Fixed several issues with using keypairs after generation and loading of
    related public keys, espcially with the way OpenSSL handles ECDH peer key
    creation.
  * Fixed issues with EdDSA signatures
  * Expanded CI/testsuite with tlsfuzzer and more teting for Ed448 and other
    key types/operations
  * We test three different software tokens with 4 different test
    configurations
  * For a full list of changes see: https://github.com/latchset/pkcs11-provider/releases/tag/v1.0
- Remove patch explicit-EC-test-option.patch</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1740484800">- Don't run tests outside of Factory</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1758110400">- Update to 1.1:
  * EVP_SKEY support for AES ciphers and HKDF key derivation
  * PKCS#11 3.2 support
  * Support for the ML-DSA Quantum Resistant algorithm
  * For a full list of changes see: https://github.com/latchset/pkcs11-provider/releases/tag/v1.1.0</changelog>
</package>
<package pkgid="3eed8f0e050614f7a30c539c277cf7038f099881d4e72b329569b5487cd49243df36a45ae417cb24a220f2023fa146115993880bb879b100897d41049ceeda8c" name="pkcs11-provider" arch="src">
  <version epoch="0" ver="1.1" rel="14.3"/>
  <changelog author="Luca Boccassi &lt;bluca@debian.org&gt;" date="1697025600">- Initial packaging of pkcs11-provider version 0.2</changelog>
  <changelog author="Luca Boccassi &lt;bluca@debian.org&gt;" date="1707480000">- New upstream version version 0.3. For a full list of changes, see
  https://github.com/latchset/pkcs11-provider/releases/tag/v0.3</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734436800">- Update to 0.6:
  * TLS 1.3 is now supported via token handling (KDFs etc..)
  * A new feature to prevent PIN lockouts when the token correctly signals
    authentication attempts depletion via token info.
  * Several issues with handling keys related to run a full end-to-end TLS
    connection on the token have been fixed
  * Most cases when early loading was needed have been resolved, HTTP and Bind
    for example work without specifying early loading for the provider
  * Several memory leaks have been resolved
  * Several new tests including a whole new token (kryoptic) are tested now, as
    well as tlsfuzzer against a TLS server deferring all operations to the
    tokens.
  * For a full list of changes see: https://github.com/latchset/pkcs11-provider/releases/tag/v0.6
- Includes changes from 0.5 and 0.4
  * We moved the build system to Meson
  * A feature to embed pkcs11- URIs into "fake" PEM files has been added which
    makes it possible to transparently use the provider with many tools that
    accept keys only as PEM files.
  * For a full list of changes see:
    https://github.com/latchset/pkcs11-provider/releases/tag/v0.5
    https://github.com/latchset/pkcs11-provider/releases/tag/v0.4
- Add pkcs11-provider.keyring
- Enable unit testing for softokn and softhsm
- Add patch
  * explicit-EC-test-option.patch</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1739448000">- Update to 1.0:
  * Improved compatibility with PKCS#11 spec and historical module behavior in
    interpreting CKA_EC_POINT, thie handled incompatibilities in ECDSA/ECDH
    keys.
  * Added full RSA-PSS support
  * Fixed several issues with using keypairs after generation and loading of
    related public keys, espcially with the way OpenSSL handles ECDH peer key
    creation.
  * Fixed issues with EdDSA signatures
  * Expanded CI/testsuite with tlsfuzzer and more teting for Ed448 and other
    key types/operations
  * We test three different software tokens with 4 different test
    configurations
  * For a full list of changes see: https://github.com/latchset/pkcs11-provider/releases/tag/v1.0
- Remove patch explicit-EC-test-option.patch</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1740484800">- Don't run tests outside of Factory</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1758110400">- Update to 1.1:
  * EVP_SKEY support for AES ciphers and HKDF key derivation
  * PKCS#11 3.2 support
  * Support for the ML-DSA Quantum Resistant algorithm
  * For a full list of changes see: https://github.com/latchset/pkcs11-provider/releases/tag/v1.1.0</changelog>
</package>
<package pkgid="e3c49955ac8f1d0378dd36f7af420038d24e77af5f5adda9eca0b3705c5dea89d14437c3a5dcabc3d8c2b619cb73ed472d17313a14c724d62e4469fba828f6b3" name="pkcs11-provider-debuginfo" arch="s390x">
  <version epoch="0" ver="1.1" rel="14.3"/>
  <changelog author="Luca Boccassi &lt;bluca@debian.org&gt;" date="1697025600">- Initial packaging of pkcs11-provider version 0.2</changelog>
  <changelog author="Luca Boccassi &lt;bluca@debian.org&gt;" date="1707480000">- New upstream version version 0.3. For a full list of changes, see
  https://github.com/latchset/pkcs11-provider/releases/tag/v0.3</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734436800">- Update to 0.6:
  * TLS 1.3 is now supported via token handling (KDFs etc..)
  * A new feature to prevent PIN lockouts when the token correctly signals
    authentication attempts depletion via token info.
  * Several issues with handling keys related to run a full end-to-end TLS
    connection on the token have been fixed
  * Most cases when early loading was needed have been resolved, HTTP and Bind
    for example work without specifying early loading for the provider
  * Several memory leaks have been resolved
  * Several new tests including a whole new token (kryoptic) are tested now, as
    well as tlsfuzzer against a TLS server deferring all operations to the
    tokens.
  * For a full list of changes see: https://github.com/latchset/pkcs11-provider/releases/tag/v0.6
- Includes changes from 0.5 and 0.4
  * We moved the build system to Meson
  * A feature to embed pkcs11- URIs into "fake" PEM files has been added which
    makes it possible to transparently use the provider with many tools that
    accept keys only as PEM files.
  * For a full list of changes see:
    https://github.com/latchset/pkcs11-provider/releases/tag/v0.5
    https://github.com/latchset/pkcs11-provider/releases/tag/v0.4
- Add pkcs11-provider.keyring
- Enable unit testing for softokn and softhsm
- Add patch
  * explicit-EC-test-option.patch</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1739448000">- Update to 1.0:
  * Improved compatibility with PKCS#11 spec and historical module behavior in
    interpreting CKA_EC_POINT, thie handled incompatibilities in ECDSA/ECDH
    keys.
  * Added full RSA-PSS support
  * Fixed several issues with using keypairs after generation and loading of
    related public keys, espcially with the way OpenSSL handles ECDH peer key
    creation.
  * Fixed issues with EdDSA signatures
  * Expanded CI/testsuite with tlsfuzzer and more teting for Ed448 and other
    key types/operations
  * We test three different software tokens with 4 different test
    configurations
  * For a full list of changes see: https://github.com/latchset/pkcs11-provider/releases/tag/v1.0
- Remove patch explicit-EC-test-option.patch</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1740484800">- Don't run tests outside of Factory</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1758110400">- Update to 1.1:
  * EVP_SKEY support for AES ciphers and HKDF key derivation
  * PKCS#11 3.2 support
  * Support for the ML-DSA Quantum Resistant algorithm
  * For a full list of changes see: https://github.com/latchset/pkcs11-provider/releases/tag/v1.1.0</changelog>
</package>
<package pkgid="4919f07902ee8f4add798afe52593dda309798e763336f679b61b4895bdc6e0314534291325acb71097412ee174b2b1a9c26d4de81c158f88fbcd4c503bd78f0" name="pkcs11-provider-debugsource" arch="s390x">
  <version epoch="0" ver="1.1" rel="14.3"/>
  <changelog author="Luca Boccassi &lt;bluca@debian.org&gt;" date="1697025600">- Initial packaging of pkcs11-provider version 0.2</changelog>
  <changelog author="Luca Boccassi &lt;bluca@debian.org&gt;" date="1707480000">- New upstream version version 0.3. For a full list of changes, see
  https://github.com/latchset/pkcs11-provider/releases/tag/v0.3</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734436800">- Update to 0.6:
  * TLS 1.3 is now supported via token handling (KDFs etc..)
  * A new feature to prevent PIN lockouts when the token correctly signals
    authentication attempts depletion via token info.
  * Several issues with handling keys related to run a full end-to-end TLS
    connection on the token have been fixed
  * Most cases when early loading was needed have been resolved, HTTP and Bind
    for example work without specifying early loading for the provider
  * Several memory leaks have been resolved
  * Several new tests including a whole new token (kryoptic) are tested now, as
    well as tlsfuzzer against a TLS server deferring all operations to the
    tokens.
  * For a full list of changes see: https://github.com/latchset/pkcs11-provider/releases/tag/v0.6
- Includes changes from 0.5 and 0.4
  * We moved the build system to Meson
  * A feature to embed pkcs11- URIs into "fake" PEM files has been added which
    makes it possible to transparently use the provider with many tools that
    accept keys only as PEM files.
  * For a full list of changes see:
    https://github.com/latchset/pkcs11-provider/releases/tag/v0.5
    https://github.com/latchset/pkcs11-provider/releases/tag/v0.4
- Add pkcs11-provider.keyring
- Enable unit testing for softokn and softhsm
- Add patch
  * explicit-EC-test-option.patch</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1739448000">- Update to 1.0:
  * Improved compatibility with PKCS#11 spec and historical module behavior in
    interpreting CKA_EC_POINT, thie handled incompatibilities in ECDSA/ECDH
    keys.
  * Added full RSA-PSS support
  * Fixed several issues with using keypairs after generation and loading of
    related public keys, espcially with the way OpenSSL handles ECDH peer key
    creation.
  * Fixed issues with EdDSA signatures
  * Expanded CI/testsuite with tlsfuzzer and more teting for Ed448 and other
    key types/operations
  * We test three different software tokens with 4 different test
    configurations
  * For a full list of changes see: https://github.com/latchset/pkcs11-provider/releases/tag/v1.0
- Remove patch explicit-EC-test-option.patch</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1740484800">- Don't run tests outside of Factory</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1758110400">- Update to 1.1:
  * EVP_SKEY support for AES ciphers and HKDF key derivation
  * PKCS#11 3.2 support
  * Support for the ML-DSA Quantum Resistant algorithm
  * For a full list of changes see: https://github.com/latchset/pkcs11-provider/releases/tag/v1.1.0</changelog>
</package>
<package pkgid="c0a368dab25b70539dfe20f81a9af1a66cd8f8c1724d3bbf7c40c4ab9b8e8bb28a6c2a30040266a4b1f3e7227efb1bda513aab77658e08625e0886f2145a7e9b" name="post-build-checks-containers" arch="s390x">
  <version epoch="0" ver="0.1" rel="12.1"/>
  <changelog author="Marcos Bjoerkelund &lt;marcos.bjoerkelund@suse.com&gt;" date="1709035200">- Initial release: Adds hooks to execute clamav and trivy scans after builds</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1759665600">- Updated from Orchid usecase to be more generic.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1761480000">- added use of neuvector scanner, only on x86_64 and aarch64 for now</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1762344000">- on openSUSE make it an empty package for now, but provide the
  sources for review</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1763121600">- rename clamav output to clamav_vuln.intoto.json</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1763899200">- scan the generated container, not base containers
- unpack container before scanning with ClamAV
- various indentation/linting fixes</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1782043200">- update for new NeuVector code (bsc#1268574)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1784116800">- do not use neuvector on 16.0 and newer</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1784548800">- do not require neuvector-scanner on 16.0 or newer either</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1784808000">- add a VEX injector</changelog>
</package>
<package pkgid="34adddea6496db28963f8148d12a81de831b3a4782116c4ca5a17fff68ce5a37166caf271d324c2ea8cec80cb9a539176173ec128735116e65f187fee17618eb" name="post-build-checks-containers" arch="src">
  <version epoch="0" ver="0.1" rel="12.1"/>
  <changelog author="Marcos Bjoerkelund &lt;marcos.bjoerkelund@suse.com&gt;" date="1709035200">- Initial release: Adds hooks to execute clamav and trivy scans after builds</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1759665600">- Updated from Orchid usecase to be more generic.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1761480000">- added use of neuvector scanner, only on x86_64 and aarch64 for now</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1762344000">- on openSUSE make it an empty package for now, but provide the
  sources for review</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1763121600">- rename clamav output to clamav_vuln.intoto.json</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1763899200">- scan the generated container, not base containers
- unpack container before scanning with ClamAV
- various indentation/linting fixes</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1782043200">- update for new NeuVector code (bsc#1268574)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1784116800">- do not use neuvector on 16.0 and newer</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1784548800">- do not require neuvector-scanner on 16.0 or newer either</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1784808000">- add a VEX injector</changelog>
</package>
<package pkgid="cbf8b49415e5688823b4faebcc1386e2d18b2c55657a376b43a699d687a507541d460a17678d484c18e2c1758fe94ee34c0bb0446622b712ea3ac2ec497feba3" name="prey" arch="noarch">
  <version epoch="0" ver="0.6.4" rel="2.17"/>
  <changelog author="malcolmlewis@opensuse.org" date="1285848000">- Fix webcam_functions patch</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1285848001">- Dropped webcam_functions patch further testing shows
  streamer working</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1289476800">- Spec clean up before submitting to Security</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1293019200">- Updated to 0.5
  * Change the delay to give wifi time to work when using autoconnect
    (thanks Drew!)
  * When using autoconnect mode in the config, Prey will use the network
    with the strongest signal available (again, thanks Drew!)
  * Fixed file sending in SCP mode (screenshot, picture). (#76)
  * Removed rubbish on Mac/Linux log files
  * Fixed Wifi device getting (using iwconfig now)
  * Lock module should work on distros with Python 3 installed
- Fixed permissions on version files (RPMLINT Report)
- Dropped removal of old language files</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1296216000">- Spec file clean up and dropped obsolete code
- Updated to 0.5.2
- Changes from 0.5.1 to 0.5.2
  * Added SMTP verification. MD5sum Mac updater bug fixed (issue #84)
  * Remove unneeded brackets.
  * Only set SMTP user/pass if they're set indeed. From issue #89 on Gi.
  * Debugging info for Linux configurator. Better SMTP user/pass settin.
  * Support for encrypted responses from the Control Panel, to avoid po.
  * Exit if the decryption doesn't work. Make sure offline actions use.
  * Dont use the full path to openssl so it works in Windows
  * Removed encrypt_response from config file as the option should be s.
  * Run as logged user when current user is different, not necessarily.
  * Make tempdir readable when creator is not logged user, not root
  * Small code cleanup, slightly better logic for decryption. Always re.
  * $status is now $response_status
  * Using AES encryption for responses. Make sure On Demand is connecte.
  * Fixes for header/body parsing in Mac, md5sum and added a term_proce.
  * Fixed key verification
  * Code cleanup. Removed unused content-type functions.
  * Small improvements to On-demand check
  * Replaced backticks with '' in updater.
  * Wait time for On-Demand pipe is 10, that was just for testing
  * Code cleanup. Added send_request function for code reutilization
  * Moved get_pid function from Windows to framework, where it belongs.
  * Better detection of encrypted response
  * Better way of checking if auto_update download worked
  * More code cleanup, less backticks, simpler get_attribute function
  * Added missing cleanup to stop spawning temp folders
  * error_exit function to handle better ungraceful exits
  - Changes from 0.5 to 0.5.1
  * Using PID as method of verifying if On Demand is still active
  * Stronger method of checking, as PID's can overlap
  * Added timestamp to pings
  * Simply check if openssl is running. Only Windows is giving us this ...
  * Fixed Email Pass Decryption bug. Once again. :(
  * Make sure we're getting the timestamp from pings
  * Send pings back when requested. Better way of knowing if device is,...
  * Disable NB I/O as it seems to causeing some issues</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1296216001">- Fix modules/geo/version permissions as per rpmlint report</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1299585600">- Updated to 0.5.3
  * Small code cleanup
  * Clearer messages when patching
  * Moved HTTP functions out of the pull file. Clearer naming for curl
    options/argument variables, as we also have a curl_options global
    setting in the config file.
  * Format adjustments for readme file
  * Merge remote branch 'drewreece/master'
  * Updated self-setup routine to use the new send_request method.</changelog>
  <changelog author="infroma@gmail.com" date="1374580800">- Updated to 0.6.0</changelog>
  <changelog author="mailaender@opensuse.org" date="1394798400">- Update to 0.6.2
- spec file cleanup
- Added .desktop update macros
- SPDX license strings</changelog>
  <changelog author="mailaender@opensuse.org" date="1430654400">- Update to 0.6.4
  * [FIX] Handle situation in geo module, when a long list of access points provokes a "Request too long" error.
  * [FIX] Improved distro name and version detection in Linux.
  * Added new platform upgrade script (lib/install-node-client.sh).
  * Include OS and Bash version in User-Agent, for easier debugging.
  * Added exception notification system, to keep better track of errors.
  * Increased (low) HTTP request timeouts to reduce connection errors.
  * Better detection and cleanup of existing (old) versions.
  * Better error handling and output redirection so we can find out what is going on.
  * The upgrade process is only performed if the device is not flagged missing.</changelog>
</package>
<package pkgid="0c07073db186db8d4c8391786e4206031fb70d7045b2cb8a77fb1181fc86b8892ad45a3c70301b7285266a71a77b645a1ca0411dfe3caac39e38fc4709870856" name="prey" arch="src">
  <version epoch="0" ver="0.6.4" rel="2.17"/>
  <changelog author="malcolmlewis@opensuse.org" date="1281268800">- Version bump
- new path patch</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1281528000">- Added webcam patch for use of grabby instead of streamer</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1283947200">- Version bump</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1283947201">- set config file to noreplace on update</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1283947202">- add patch to fix iwlist command path</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1283947203">- add patch to use xwd for screenshot capture
- remove scrot requirement</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1284033600">- spec clean up
- add links to upstream patch requests</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1284120000">- updated prey configurator start script</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1284120001">- tighten files permissions on prey.sh and config so only root can
  use</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1285848000">- New version
- see here http://github.com/tomas/prey/compare/v0.4.3...v0.4.4
  for full list</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1285848001">- Fix webcam_functions patch</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1285848002">- Dropped webcam_functions patch further testing shows
  streamer working</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1289476800">- Spec clean up before submitting to Security</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1293019200">- Updated to 0.5
  * Change the delay to give wifi time to work when using autoconnect
    (thanks Drew!)
  * When using autoconnect mode in the config, Prey will use the network
    with the strongest signal available (again, thanks Drew!)
  * Fixed file sending in SCP mode (screenshot, picture). (#76)
  * Removed rubbish on Mac/Linux log files
  * Fixed Wifi device getting (using iwconfig now)
  * Lock module should work on distros with Python 3 installed
- Fixed permissions on version files (RPMLINT Report)
- Dropped removal of old language files</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1296216000">- Spec file clean up and dropped obsolete code
- Updated to 0.5.2
- Changes from 0.5.1 to 0.5.2
  * Added SMTP verification. MD5sum Mac updater bug fixed (issue #84)
  * Remove unneeded brackets.
  * Only set SMTP user/pass if they're set indeed. From issue #89 on Gi.
  * Debugging info for Linux configurator. Better SMTP user/pass settin.
  * Support for encrypted responses from the Control Panel, to avoid po.
  * Exit if the decryption doesn't work. Make sure offline actions use.
  * Dont use the full path to openssl so it works in Windows
  * Removed encrypt_response from config file as the option should be s.
  * Run as logged user when current user is different, not necessarily.
  * Make tempdir readable when creator is not logged user, not root
  * Small code cleanup, slightly better logic for decryption. Always re.
  * $status is now $response_status
  * Using AES encryption for responses. Make sure On Demand is connecte.
  * Fixes for header/body parsing in Mac, md5sum and added a term_proce.
  * Fixed key verification
  * Code cleanup. Removed unused content-type functions.
  * Small improvements to On-demand check
  * Replaced backticks with '' in updater.
  * Wait time for On-Demand pipe is 10, that was just for testing
  * Code cleanup. Added send_request function for code reutilization
  * Moved get_pid function from Windows to framework, where it belongs.
  * Better detection of encrypted response
  * Better way of checking if auto_update download worked
  * More code cleanup, less backticks, simpler get_attribute function
  * Added missing cleanup to stop spawning temp folders
  * error_exit function to handle better ungraceful exits
  - Changes from 0.5 to 0.5.1
  * Using PID as method of verifying if On Demand is still active
  * Stronger method of checking, as PID's can overlap
  * Added timestamp to pings
  * Simply check if openssl is running. Only Windows is giving us this ...
  * Fixed Email Pass Decryption bug. Once again. :(
  * Make sure we're getting the timestamp from pings
  * Send pings back when requested. Better way of knowing if device is,...
  * Disable NB I/O as it seems to causeing some issues</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1296216001">- Fix modules/geo/version permissions as per rpmlint report</changelog>
  <changelog author="malcolmlewis@opensuse.org" date="1299585600">- Updated to 0.5.3
  * Small code cleanup
  * Clearer messages when patching
  * Moved HTTP functions out of the pull file. Clearer naming for curl
    options/argument variables, as we also have a curl_options global
    setting in the config file.
  * Format adjustments for readme file
  * Merge remote branch 'drewreece/master'
  * Updated self-setup routine to use the new send_request method.</changelog>
  <changelog author="infroma@gmail.com" date="1374580800">- Updated to 0.6.0</changelog>
  <changelog author="mailaender@opensuse.org" date="1394798400">- Update to 0.6.2
- spec file cleanup
- Added .desktop update macros
- SPDX license strings</changelog>
  <changelog author="mailaender@opensuse.org" date="1430654400">- Update to 0.6.4
  * [FIX] Handle situation in geo module, when a long list of access points provokes a "Request too long" error.
  * [FIX] Improved distro name and version detection in Linux.
  * Added new platform upgrade script (lib/install-node-client.sh).
  * Include OS and Bash version in User-Agent, for easier debugging.
  * Added exception notification system, to keep better track of errors.
  * Increased (low) HTTP request timeouts to reduce connection errors.
  * Better detection and cleanup of existing (old) versions.
  * Better error handling and output redirection so we can find out what is going on.
  * The upgrade process is only performed if the device is not flagged missing.</changelog>
</package>
<package pkgid="be38ff522fa664799773ead500e3dd9b0fae8998441ffbc001df866f9d631cab24e412d580017b6999ac7dad8bd81093ebe9e7b15d38485e1f459f6c8b755fdd" name="python-bencode" arch="src">
  <version epoch="0" ver="4.0.0" rel="4.10"/>
  <changelog author="mardnh@gmx.de" date="1408795200">- Initial package release, version 1.0</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1493726400">- update to match bencode v1.2.0
  * See bencode v.2.0 for history.  This package is a simple fork of the metadata decode logic.
- add buildrequires: python-pbr which is used to provide reasonable defaults python's setup tool
- convert to python singlespec</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="pgajdos@suse.com" date="1559649600">- version update to 2.0.0
  * Support for bytes
  * File read/write functions: bread(fp), bwrite(data, fp)
  * Improved support for unicode strings
- added sources
  https://github.com/fuzeman/bencode.py/issues/12
  + BitTorrent-1.1.txt</changelog>
  <changelog author="pgajdos@suse.com" date="1560168000">- version update to 2.1.0
  * added: Type information
  * fixed: Inconsistent return behavior
- deleted sources
  - BitTorrent-1.1.txt (not needed)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1571054400">- Replace %fdupes -s with plain %fdupes; hardlinks are better.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678104000">- update to 4.0.0:
  * Improved API has been moved to the `bencodepy` package
  * Implemented backwards-compatible `bencode` package (#16)
  * Exception raised while attempting to decode strings on
    Python 3+
  * Improvements to the handling of binary values (#14)
  * Dropped support for Python 2.6, 3.4</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1747224000">- Convert to pip-based build</changelog>
</package>
<package pkgid="fbe10e0279eb137521aee37618621d072740a2c096e9cc060a6c4fcd3310044cd8124ed45c780baacfa72c3cac2f4dde88dece4d356d46d439b4f742be629d35" name="python-github-secrets" arch="src">
  <version epoch="0" ver="0.0.1~1740749736.7819a4a" rel="1.6"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741608000">- new package python-github-secrets: analyzes a given Github
  repository and searches for dangling or force-pushed commits
  containing potential secret or interesting information</changelog>
</package>
<package pkgid="1a766727e935528ced1f19f5998c9313aad8f47f26f599de7c3eb395ab73560b28640b2becf06b23ce964b0c8068a090b02befde57bbd917bbbe5ddea40c59f0" name="python-gitlabcis" arch="src">
  <version epoch="0" ver="1.19.1" rel="21.5"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742558400">- update to 1.13.2:
  * Fix
  - fix: add dependency sbom to version control (#124) (d890086)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744113600">- update to 1.14.0:
  * Documentation
  - docs: add statement for benchmark contributions (3693222)
  * Feature
  - feat: Add group controls for source_code code_changes (&amp;2),
    (#125), (#118) (dac4b1e)
  * Fix
  - fix: Hardpin release dependencies (079c94a)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744286400">- update to 1.15.0:
  * Feature
  - feat: Add Group input type controls in build pipelines (&amp;2) &amp;
    (#125) (a5bca5d)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744804800">- update to 1.15.1:
  * Fix
  - fix: remove non-required detect cmd (#127) (14ff8da)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1752667200">- update to 1.15.3:
  * Fix
  - fix: Bundled renovate dependency bumps &amp; docs typo fixes
    (f04fd86)
- update to 1.15.2:
  * Fix
  - fix: Add verify arg to gql client (#128) (c50cec0)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754222400">- update to 1.15.4:
  * Fix
  - fix: Update dependency python-gitlab to v6.2.0 (b74b2d4)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755777600">- update to 1.15.8:
  * Fix
  - fix(deps): update dependency pre-commit to ~=4.3.0 (15dc9d0)
- update to 1.15.7:
  * Fix
  - fix(deps): update dependency coverage to v7.10.4 (64a0b87)
- update to 1.15.6:
  * Fix
  - fix(deps): update dependency setuptools-scm to v9 (673e173)
- update to 1.15.5:
  * Fix
  - fix(deps): update dependency coverage to v7.10.3 (18b3b42)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756123200">- update to 1.15.9:
  * Fix
  - fix(deps): update dependency coverage to v7.10.5 (1b3d1d0)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756382400">- update to 1.15.10:
  * Fix
  - fix(deps): update dependency python-gitlab to v6.3.0
    (88572b9)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756814400">- update to 1.15.12:
  * Fix
  - fix(deps): update dependency tox to ~=4.29.0 (20972ea)
- update to 1.15.11:
  * Fix
  - fix(deps): update dependency coverage to v7.10.6 (0289a97)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765800000">- update to 1.15.15 (.14 was not released):
  * Fix
  - fix: Remove support for python3.9 (2f51051)
- update to 1.15.13:
  * Fix
  - fix(deps): update dependency tox to ~=4.30.1 (f83a657)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765972800">- update to 1.15.16:
  * Fix
  - fix(deps): update dependency bandit to v1.9.2 (9075bc1)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766059200">- update to 1.15.17:
  * Fix
  - fix(deps): update dependency pipdeptree to v2.30.0 (97a5fa7)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766318400">- update to 1.15.19:
  * Fix
  - fix(deps): update dependency pytest-cov to v6.3.0 (5e2433a)
- update to 1.15.18:
  * Fix
  - fix(deps): update dependency pre-commit to ~=4.5.1 (c118b8c)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305600">- update to 1.15.21:
  * Fix
  - fix(deps): update dependency coverage to v7.13.1 (7296411)
- update to 1.15.20:
  * Fix
  - fix(deps): update dependency python-gitlab to v6.5.0
  (7596ae6)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- update to 1.15.22:
  * Fix
  - fix(deps): update dependency tox to ~=4.34.1 (f84ff07)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773662400">- update to 1.17.1:
  * Fix
  - fix: Remove instance error statements (37e7d3a)
- update to 1.17.0:
  * Feature
  - feat: Group support for artifacts checks (#125) (f1a5ed0)
- update to 1.16.0:
  * Feature
  - feat: Support GitLab inputs (#133 (closed)) (0c4b790)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773748800">- update to 1.18.0:
  * Feature
  - feat: Group support for dependency checks (#125) (92d4fbb)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773835200">- update to 1.19.0:
  * Feature
  - feat: Add protected branches at the group level (#125) (cbfb1f0)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775736000">- update to 1.19.1:
  * Documentation
  - docs: Update deployment group support statements (#125 (closed))
    (c236e5e)
  * Fix
  - fix: Object access in 5.1.3 secret_scan_deployment_config (#135
    (closed)) (7941c95)</changelog>
</package>
<package pkgid="78f36cac193cbdb98182f20b2cbad33cbd4487fe757ed16bceea2c0b09ebf8506fc34d6b8915311a7664eb593f68db69c2853c4f1080a9c9f6a6b889e5036c90" name="python-hidapi" arch="src">
  <version epoch="0" ver="0.14.0.post2" rel="2.30"/>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1648296000">- Initial version 0.11.0.post2 from upstream via py2pack</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1649073600">- Updating to upstream version 0.11.2</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1660737600">- Updating to upstream version 0.12.0.post2</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1674043200">- Updating to upstream version 0.13.1
  * expose version of bindings as hid.__version__
  * expose hid_version_str
  * Update cibuildwheel action to 2.11.2
  * bump hidapi to 0.13.1
  * bump github actions versions</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1705665600">- Updating to upstream version 0.14.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726574400">- Update to 0.14.0.post2</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1752840000">- drop BuildRequires on flit-core and poetry, build-backend is setuptools
- drop duplicate BuildRequires</changelog>
</package>
<package pkgid="e30914340db43cb257ef90b7bca5759dc1fe035ea0c76dc2b82b493a1727f9dfbce72990810c8d6fc3b6463c4ad20a7b36e646f61bb53b8d941ba49bea3ed77b" name="python-hidapi-debuginfo" arch="s390x">
  <version epoch="0" ver="0.14.0.post2" rel="2.30"/>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1648296000">- Initial version 0.11.0.post2 from upstream via py2pack</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1649073600">- Updating to upstream version 0.11.2</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1660737600">- Updating to upstream version 0.12.0.post2</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1674043200">- Updating to upstream version 0.13.1
  * expose version of bindings as hid.__version__
  * expose hid_version_str
  * Update cibuildwheel action to 2.11.2
  * bump hidapi to 0.13.1
  * bump github actions versions</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1705665600">- Updating to upstream version 0.14.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726574400">- Update to 0.14.0.post2</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1752840000">- drop BuildRequires on flit-core and poetry, build-backend is setuptools
- drop duplicate BuildRequires</changelog>
</package>
<package pkgid="a59b0ee2ce2fddff6e66575ff15d1484ede9436dd422fe087329858bbbd6a5e60768e4d6fa9b7096c836471a8044f0bc2d95351b9e1a966a9175892abeaf2f5f" name="python-hidapi-debugsource" arch="s390x">
  <version epoch="0" ver="0.14.0.post2" rel="2.30"/>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1648296000">- Initial version 0.11.0.post2 from upstream via py2pack</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1649073600">- Updating to upstream version 0.11.2</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1660737600">- Updating to upstream version 0.12.0.post2</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1674043200">- Updating to upstream version 0.13.1
  * expose version of bindings as hid.__version__
  * expose hid_version_str
  * Update cibuildwheel action to 2.11.2
  * bump hidapi to 0.13.1
  * bump github actions versions</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1705665600">- Updating to upstream version 0.14.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726574400">- Update to 0.14.0.post2</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1752840000">- drop BuildRequires on flit-core and poetry, build-backend is setuptools
- drop duplicate BuildRequires</changelog>
</package>
<package pkgid="7ad8cedf18837c7a6356f1a44dccf98eb4ea6e2acbd78941fa0b6ce1e01bf0cc2f55149e6814815c379c244bbed0c25ba895f95e89e2b6e4b3350e2f08336ad5" name="python-nethsm" arch="src">
  <version epoch="0" ver="2.1.2" rel="25.2"/>
  <changelog author="Johannes Kastl &lt;kastl@b1-systems.de&gt;" date="1701086400">- new package python-nethsm, required by pynitrokey</changelog>
  <changelog author="Johannes Kastl &lt;kastl@b1-systems.de&gt;" date="1701172800">- update to 1.0.0:
  * Introduce custom type for Base64-encoded data by
    @robin-nitrokey in #104
  * Make system time optional in provision and restore by
    @robin-nitrokey in #105</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1714737600">- update to 1.1.0:
  * Support key import from PEM files (#99)
  * Add ignore_whitespace option to Base64.from_encoded (#108)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1721217600">- update to 1.2.0:
  * Features
  - Add support for namespaces (#110)
  * Bugfixes
  - Fix authentication for partial restore, i. e. on an
    operational instance (#120)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1722513600">- update to 1.2.1:
  * Bugfixes
  - Fix authentication for partial restore, i.e. on an
    operational instance (#124)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741953600">- update to 1.3.0:
  * Features
  - Add TPM attestation keys and platform configuration registers
    to SystemInfo (#128)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745582400">- update to 1.4.0:
  * Features
  - Add support for custom CA certificates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1750766400">- update to 1.4.1:
  Relax urllib3 version requirement to &gt;= 2, &lt;3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- update to 2.0.0:
  All changes:
  https://github.com/Nitrokey/nethsm-sdk-py/compare/v1.4.1...v2.0.0
  * Breaking Changes
  - Remove KeyType.EC_P224
  - Change arguments for NetHSM.csr and NetHSM.key_csr:
  - Require common_name argument
  - Require using keywords for all arguments (except for
    key_id)
  * Features
  - Add new enum values (requires NetHSM v3.0):
  - KeyType: EC_P256K1, BrainpoolP256, BrainpoolP384,
    BrainpoolP512
  - KeyMechanism: BIP340_Signature
  - SignMode: BIP340
  - TlsKeyType: BrainpoolP256, BrainpoolP384, BrainpoolP512
  - Add support for dots, dashes and underscores in user and key
    IDs (requires NetHSM v3.0)
  - Add NetHSM.move_key function for changing key IDs (requires
    NetHSM v3.0)
  - Add optional subject_alt_names argument for NetHSM.csr and
    NetHSM.key_csr (requires NetHSM v3.0)
  - Add optional prefix argument for NetHSM.list_keys (requires
    NetHSM v3.0)
  - Always show the message returned by the NetHSM as part of the
    error message</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- update to 2.0.1:
  * Add support for unauthenticated shutdown.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774612800">- update to 2.1.0:
  * Features
  - Add support for backup format v1.
  - Add support for clustering (requires NetHSM v4):
  - Add ClusterMember, InitialClusterMember and ClusterJoinData
    classes
  - Add add_cluster_member, list_cluster_members,
    set_cluster_member_urls, remove_cluster_member,
    join_cluster, get_cluster_ca_certificate,
    set_cluster_ca_certificate functions to NetHSM
  - Add support for IPv6 configuration (requires NetHSM v4):
  - Add Ipv6Config class
  - NetworkConfig: Add optional ipv6 field
  - NetHSM.set_network_config: Add optional ipv6 argument
  * Changes
  - Improve backup parsing speed
  - Use poetry as build backend</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778673600">- update to 2.1.1:
  * Bugfixes
  - Fix endpoint path in NetHSM.set_cluster_ca_certificate</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782216000">- update to 2.1.2:
  * Changes
  - Patch generated client to remove the python-dateutil dependency.</changelog>
</package>
<package pkgid="f15d238620af28a49f6c529fd4b8cc122f246f8ab02317d6f44cec4cb5b06121a807848694b3e43dec2dcd6a282e49921aa74599172e85fbf1b63c609f09aafd" name="python-nitrokey" arch="src">
  <version epoch="0" ver="0.4.2" rel="24.7"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1731240000">- Initial package (0.2.3)</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1739880000">- Update to 0.2.4
  * The list methods of `NK3` and `NKPK` now only open the
    respective device, based on the USB vendor and product ID.
  * Use trusted publishing for PyPI.
  * Add support for `poetry-core` v2.
- Use Python 3.11 on SLE-15 by default</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742990400">- update to 0.3.0:
  * Bump minimum Python version from 3.9 to 3.9.2.
  * nitrokey.nk3.updates:
  - Remove UpdatePath, get_extra_information and
    get_finalization_wait_retries from public API.
  - Remove obsolete UpdateUi.request_repeated_update method.
  - Show warning when updating from bootloader mode and if the
    status command is not available.
  - Reboot devices in firmware mode before the update to make
    sure that the status is up to date.
  - Add Warning enum, show_warning and raise_warning methods to
    UpdateUi and ignore_warnings argument to UpdateUi.__init__.
  * Add support for updates to Nitrokey 3 firmware v1.8.2.
  * Add support for setting a minimum SDK version in firmware
    update containers.
  - Add an sdk field to nitrokey.trussed.FirmwareContainer.
  - Check SDK version in nitrokey.nk3.updates.Updater.update.
  - Add nitrokey.nk3.updates.Warning.SDK_VERSION variant.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743163200">- update to 0.3.1:
  * nitropy.nk3.updates: Remove reboot during update</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1743163201">- Add *.rpmlintrc to make rpmlint output useful.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1752062400">- update to 0.3.2:
  Add support fido2 v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754308800">- update to 0.4.0:
  * nitrokey.trussed.admin_app.InitStatus: add support for
    EXT_FLASH_NEED_REFORMAT
  * Use poetry-core v2 as build backend.
  * Bump minimum Python version to 3.10.
  * nitrokey.trussed.Model: Remove firmware_repository and
    firmware_pattern properties.
  * nitrokey.nk3.updates:
  - Move to nitrokey.trussed.updates and prepare adding NKPK
    support.
  - Return device status after an update.
  - Add model argument to get_firmware_update.
  - Add get_firmware_repository method.
  - Replace connection callbacks in Updater with DeviceHandler
    class.
- add version constraints for dependencies
- relax constraint on protobuf, see
  https://github.com/Nitrokey/nitrokey-sdk-py/issues/84#issuecomment-3158310783</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755777600">- update to 0.4.1:
  * Add support for protobuf v6.
  * nitrokey.trussed.admin_app: Fix validation of ConfigFieldType.U8
    values.
  * nitrokey.trussed: Add list and open functions.
  * nitrokey.trussed.updates:
  - Add default values for the image and update_version arguments
    for Updater.update.
  - Only call UpdateUi.confirm_extra_information if the passed list
    is not empty.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765281600">- update to 0.4.2:
  * nitrokey.trussed: Add optional model argument for list and open
    functions.</changelog>
</package>
<package pkgid="549e664c349b7bf1ec90808dc4f0bb2e227145fc8aca8c9e0557a5259aabac93987c04e38de74268962f0ffa3899dbc07c818bbff0fee5253d3e9c970fe91614" name="python-pwntools" arch="src">
  <version epoch="0" ver="4.15.0" rel="1.3"/>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1744804800">- Initial packaging at version 4.14.1</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1780142400">- Update to version 4.15.0:
  * Added context.gdb_binary to specify which gdb command to use.
  Useful to specify e.g. pwndbg.
  * Added tube.upload_manually to upload data to a shell using
  shell commands.
  * Improved libcdb handling of a local libc-database without
  relying on external services.
  * Cache the output of asm() to speed up subsequent exploit runs.
  (Disable the cache using context.cache_dir = None)
  * Removal of some CLI command scripts:
    Many of the CLI utilities coming with pwntools had ambiguous
  names and caused problems while packaging in different
  distributions. Most of the commands are deprecated now and
  print a warning suggesting to use pwn &lt;thecommand&gt; instead.</changelog>
</package>
<package pkgid="23d886a7b0c1c4dca453caf8024f381e9e92b038cc61616ae159ccbd11bfc49732ed7136706d4aba7bedd69323541ace2176d383d8b460c4a47ea737b85ccd64" name="python-pycrowdsec" arch="src">
  <version epoch="0" ver="0.0.5" rel="1.11"/>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742731200">- initial packaging</changelog>
</package>
<package pkgid="65151ac71fdb958f2e0ffe0fbe5619e0005974a04d4040630407db0ec004202f24475a1d70fc5c54fff8f3ec1f9330b94d12d783edf09b35fb5b218ac6e99f18" name="python-pykeepass" arch="src">
  <version epoch="0" ver="4.1.1.post1" rel="34.11"/>
  <changelog author="badshah400@gmail.com" date="1534939200">- Initial package.</changelog>
  <changelog author="badshah400@gmail.com" date="1536753600">- Update to version 3.0.2:
  * Exclude tests from pypi package.
- Changes from version 3.0.1:
  * Fix installation (gh#pschmitt/pykeepass#98).
- Changes from version 3.0.0:
  * Update lxml from 4.2.1 to 4.2.3 (gh#pschmitt/pykeepass#86).
  * KDBX4 support (gh#pschmitt/pykeepass#84).
  * Update argon2-cffi from 18.1.0 to 18.3.0
    (gh#pschmitt/pykeepass#92).
  * Update pycryptodome from 3.6.3 to 3.6.6
    (gh#pschmitt/pykeepass#91).
  * Fix baseelement logic (gh#pschmitt/pykeepass#94).
  * Make pykeepass usable as a context manager
    (gh#pschmitt/pykeepass#87).
  * Strip out non-ASCII characters on decrypt
    (gh#pschmitt/pykeepass#97).
- Drop dependency on python-libkeepass, python-pykeepass no longer
  requires this since version 3.0.0; python-libkeepass is now
  deprecated.
- Recompile .pyc files from sources modified after install script
  to prevent inconsistent mtimes between object files and sources.</changelog>
  <changelog author="John Vandenberg &lt;jayvdb@gmail.com&gt;" date="1552996800">- Activate test suite on Python 3 using GitHub archive.
  Currently failing on Python 2
- Add missing runtime dependencies
- Add %license
- Update to v3.0.3
  * Python 3.7 support
  * Autotype support
  * Fix "object has no attribute" issue in save_history
  * Fix datetime comparison when there is no tzinfo and autotype sequence
  * Added new Attachment object (see README.rst for usage)
  * Moved the xpath strings into xpath.py
  * Added exceptions.py
  * Fix entry.parentgroup doesn't work for history entries
  * Move first and history into _xpath
  * Use UUID instead of (name, title, password, ...) when comparing objects
  * Notes is a reserved key</changelog>
  <changelog author="John Vandenberg &lt;jayvdb@gmail.com&gt;" date="1552996801">- Add minimum version python-construct &gt;= 2.9.31</changelog>
  <changelog author="Tom&#xE1;&#x161; Chv&#xE1;tal &lt;tchvatal@suse.com&gt;" date="1554206400">- Fix argon2_cffi -&gt; argon2-cffi dependency name</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1588075200">- Update to version 3.2.0:
  * Added PyKeePass.xml().
  * Added create_database().
  * Added tag searching - gh#libkeepass/pykeepass#182.
  * Binary attachments missing Compressed attribute unparseable
    [gh#libkeepass/pykeepass#181].
  * Protected multiline fields missing newline
    [gh#libkeepass/pykeepass#129].
  * Fixed problem where entries are protected after save.
- Changes from version 3.1.0:
  * Removed context manager.
  * Added autotype string support.
  * Added attachments.
  * Fixed find_entries(path=xxx) behavior.
  * Entry.uuid, Group.uuid now return uuid.UUID object instead of
    string.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1596283200">- Update to version 3.2.1:
  * Pin construct version to last supporting python2
  * Hard dependency on pycryptodomex
  * Fixed kp.groups, kp.entries not returning elements with
    name/title None [gh#libkeepass/pykeepass#193].
- Replace pycryptodome in BuildRequires and Requires, with
  pycryptodomex.
- Update version of python-construct in BuildRequires and
  Requires.
- Update %check section to run tests directly as recommended by
  upstream.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1613390400">- Update to version 4.0.0:
  * Paths changed from strings to lists.
  * Added PyKeePass.recyclebin_group.
  * Added PyKeePass.trash_group().
  * Added PyKeePass.trash_entry().
  * Added PyKeePass.empty_group().
  * Support reading/saving from streams.
  * Fixed PyKeePass.dump_xml() pretty printing.
  * Fixed gh#libkeepass/pykeepass#212 - properly pad encrypted
    payload.
  * Fixed gh#libkeepass/pykeepass#222 - corrected transform_rounds
    field length.
- Add python-pykeepass-fix-version.patch: Fix version so that
  egg-infos don't end up with the wrong version; patch taken from
  upstream commit.
- Update URL and Source URL to new github repository.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1621771200">- Update to version 4.0.1:
  * No release notes.
- Drop python-pykeepass-fix-version.patch: incorporated upstream.
- Update dependency versions in keeping with upstream.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1653825600">- Update to version 4.0.2:
  * Added support for argon2id key derivation function.
  * Added credential expiry functions.
  * Fixes gh#libkeepass/pykeepass#223 - safe saving.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1655812800">- Update to version 4.0.3:
  * Add otp support.
  * Add debug_setup() function.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1685275200">- Update to version 4.0.4:
  * [gh#libkeepass/pykeepass#314] correctly handle binaries with
    no data.
  * [gh#libkeepass/pykeepass#265] check for keepass signature.
  * [gh#libkeepass/pykeepass#319] support pathlib for
    filename/keyfile.
  * [gh#libkeepass/pykeepass#194] added 'protected' arg to
    _set_string_field.
  * [gh#libkeepass/pykeepass#338] allow comma entry tag separator.
  * use official icon names from KeePass source and deprecate old
    icons.
  * added Entry.is_custom_property_protected().</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1686398400">- Update to version 4.0.5:
  * [gh#libkeepass/pykeepass#344] AttributeError when accessing
    Times with None value
  * use __hash__ when evaluating equality
  * use mtime/uuid for HistoryEntry hashing</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1693915200">- Update to 4.0.6:
  * fixed #350 - fixed all Python 2 deprecation FIXMEs (e.g. future, )
- Switch to pyproject macros.</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@proton.me&gt;" date="1711540800">- Update to 4.0.7:
  * PyKeePass has decrypt kwarg for accessing header info
  * added Entry.index and Entry.move for moving entries
  * added Entry.autotype_window setter
  * allow filename/keyfile to be file-like objects
  * drop dateutil dependency
  * switch to pyproject.toml
- add fix-upstream-test-case.patch for fixing an issue with
  missing pykeepass.kdbx_parsing</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1713096000">- Update to version 4.0.7.post1:
  * Fix gnome secrets crashes on expiration date check with
    missmatch of date format (gh#libkeepass/pykeepass#382).
  * Fix missing pykeepass.kdbx_parsing when built with modern
    tools (gh#libkeepass/pykeepass#378).
  * Remove shebang line from pykeepass/deprecated.py
    (gh#libkeepass/pykeepass#377).
- Drop fix-upstream-test-case.patch: upstream committed.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1722600000">- Update to version 4.1.0.post1:
  * [gh#libkeepass/pykeepass#389] add PyKeePassdatabase_name and
    database_description
  * [gh#libkeepass/pykeepass#390] fix pkg_resources dependency
    issue
  * [gh#libkeepass/pykeepass#391] Entry.tags returns empty list
    instead of None
  * [gh#libkeepass/pykeepass#395] set 'encoding' attribute when
    exporting as XML
  * [gh#libkeepass/pykeepass#383] parse datetimes using isoformat
    instead of strptime</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1744286400">- update to 4.1.1.post1:
  * [gh#libkeepass/pykeepass410] - support empty string as password</changelog>
</package>
<package pkgid="d18ceec46110b00a1126110ab208d7f1510862428ef7ddb584dd6382c43f0756b1e64bee6d9050b9c20d4d9f7a5e597d23f4a01d131e8c1bb4d05b58a4c7d5c1" name="python-pynitrokey" arch="src">
  <version epoch="0" ver="0.11.4" rel="66.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1721217600">- update to 0.4.49:
  * nethsm: Add support for namespaces by @robin-nitrokey in #535</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1722513600">- update to 0.4.50:
  * nethsm: Improve namespace handling in add-user by
    @robin-nitrokey in #555
  * And random generator and config failures to init status bytes
    by @sosthene-nitrokey in #556
  * Require authentication for partial restore by @mmerklinger in
    [#554]</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1731240000">- update to 0.6.0:
  * Add PIV commands
  * Update prompt to more meaningful texts
- update to 0.5.0:
  * Use Nitrokey Python SDK
  * Remove spsdk from module list for version logging</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1736424000">- update to 0.7.2:
  - Update click and click-aliases dependencies by @robin-nitrokey
    in #597
  - Update cryptography dependency by @robin-nitrokey in #596
  - fido2: Limit VID/PID for Nitrokey FIDO2 commands by
    @robin-nitrokey in #604
  - Support Python 3.13 by @mmerklinger in #607
  - fido2 verify: Add support for Nitrokey Passkey by
    @robin-nitrokey in #603
- update to 0.7.1:
  - Restrict hidapi dependency and release v0.7.1 by
    @robin-nitrokey in #602
- update to 0.7.0:
  - Add confirm option to allow automated updates on nk3 devices by
    @anotherbridge in #575
  - Use config field availability information from the sdk by
    @sosthene-nitrokey in #577
  - Remove asn1crypto by @sosthene-nitrokey in #582
  - fixed URL for Nitrokey3/Linux/udev rules troubleshooting by
    @hardcodes in #586
  - Make pyscard dependency optional by @sosthene-nitrokey in #580
  - Fix deprecation warning with TripleDES by @sosthene-nitrokey in
    [#589]
  - remove unused .gitlab-ci.yml by @daringer in #590
  - Remove unused dependencies by @robin-nitrokey in #591</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1736510400">- update to 0.7.3:
  - Fix type hints for Python 3.11 and older by @robin-nitrokey in
    [#611]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1740484800">- update to 0.7.4:
  * Nethsm: Read host from NETHSM_HOST if not set on the command
    line (#617)
  * Nethsm: Fix add-key command (#627)
  * PIV: fix admin authentication with 1.8.1 (#625)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742990400">- update to 0.8.0:
  This release adds support for Nitrokey 3 firmware updates to
  v1.8.2, adds TPM information to the NetHSM system status and
  improves the FIDO2 tests in nitropy nk3 test and nitropy fido2
  verify.
  Changelog
  * Check attestation signature after FIDO2 makeCredential by
    @robin-nitrokey in #626
  * Add TPM information to system information by @mmerklinger in
    [#628]
  * Bump minimum nethsm sdk version to 1.3.0 by @mmerklinger in
    [#629]
  * Update Nitrokey SDK to v0.3.0 and release v0.8.0 by
    @robin-nitrokey in #632</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743163200">- update to 0.8.1:
  * Update Nitrokey SDK to v0.3.1 and release v0.8.1 by
    @robin-nitrokey in #633</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746619200">- update to 0.8.2:
  This release improves handling of base32 strings in the nk3
  secrets subcommand, improves the PIV subcommand and adds support
  for custom CAs to the nethsm subcommand.
  Changelog
  * Fix typo in delete_credential documentation string. by @uzb-dev
    in #622
  * Piv cli improvements by @mmerklinger in #630
  * fix: append required base32 padding when handling unpadded otp
    secrets by @deheisenbug in #639
  * fix: allow lowercase base32 secrets input by @deheisenbug in
    [#641]
  * nethsm: Add --ca-certs option by @robin-nitrokey in #637</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746619201">- update to 0.8.3:
  This release changes the piv command to ignore unsupported
  smartcards and fixes the build of the release binaries for Linux
  and Windows.
  Changelog
  * Filter cards for NK3 ATR in PIV app by @mmerklinger in #642
  * Fix CI and release v0.8.3 by @robin-nitrokey in #646</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1747828800">- update to 0.8.4:
  * PIV certificate list properties by @mmerklinger in #648
  * Windows certificate mapping for PIV by @mmerklinger in #649</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748865600">- update to 0.8.5:
  This release fixes a bug in nk3 secrets when handling base32
  secrets if the length is a multiple of 8.
  * Changelog
  - helpers.b32padding: avoid adding 8 pads when none needed by
    @AmitAronovitch in #654</changelog>
  <changelog author="Felix Stegmeier &lt;felix.stegmeier@suse.com&gt;" date="1753185600">- update to 0.9.3:
  * nk3: Fix fido2 test case by @robin-nitrokey in #666
- update to 0.9.2:
  * Fix version subcommand by @robin-nitrokey in #665
- update to 0.9.1:
  * ci: Use bash for version check and release v0.9.1 by
    @robin-nitrokey in #663
- update to 0.9.0:
  * This release drops support for Python 3.9.
  * Migrate from flit to poetry by @robin-nitrokey in #651
  * Improve log file naming scheme by @robin-nitrokey in #659
  * Update fido2 and release v0.9.0 by @robin-nitrokey in #662</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754481600">- update to 0.10.0:
  * Remove obsolete nkfido2 commands by @robin-nitrokey in #670
  * Remove ecdsa dependency by @robin-nitrokey in #671
  * PIV: validate PINs to be 6 to 8 numbers by @sosthene-nitrokey
    in #675
  * Update Nitrokey SDK by @robin-nitrokey in #672
  * nk3: Deprecate secrets get and register aliases by
    @robin-nitrokey in #673</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- update to 0.11.0:
  * nk3 secrets: Print timestamp to stderr by @robin-nitrokey in #680
  * nk3: Add list-config-fields command by @robin-nitrokey in #681
  * fido2: Handle wrong PIN errors by @robin-nitrokey in #682
  * fido2 reset: Improve wording by @robin-nitrokey in #683
  * nk3 test: Support credential creation without PIN by @robin-nitrokey in #679
  * Log SDK versions by @robin-nitrokey in #689
  * nethsm: Add --debug flag by @robin-nitrokey in #690
  * Update for NetHSM v3 and release v0.11.0 by @robin-nitrokey in #691</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760788800">- update to 0.11.1:
  * Handle missing packages when logging package versions and release
    v0.11.1 by @robin-nitrokey in #693</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760961600">- add patches allow_cffi_v2_dependency.patch and
  allow_cryptography_v46.patch</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- update to 0.11.2:
  * Allow cffi v2 dependency by @robin-nitrokey in #695
  * Allow cryptography v46 by @robin-nitrokey in #697
  * PIV: Fix 9C key generation by @sosthene-nitrokey in #702
  * Update pyscard in lock file by @mmerklinger in #704
  * Add support for unauthenticated NetHSM shutdown by @mmerklinger
    in #703
- remove patches allow_cffi_v2_dependency.patch and
  allow_cryptography_v46.patch</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769428800">- update to 0.11.3:
  * chore(deps): pin hidapi to 0.14.0.post2 on linux by @LtdSauce
    in #708
  * nkpk: Add admin-app commands by @robin-nitrokey in #709
  * Update urllib3 to v2.6.0 by @robin-nitrokey in #713
  * nk3: Only allow factory-reset-app for opcard by @robin-nitrokey
    in #714
  * add RSA 3072 and 4096 for PIV by @n0xena in #715
  * nkpk: Add support for firmware updates by @robin-nitrokey in
    [#710]
  * Add test command to NetHSM cli by @mmerklinger in #718
  * Release v0.11.3 by @mmerklinger in #719</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773748800">- update to 0.11.4:
  * Add maintainer keys and check tag signatures in CI by
    @robin-nitrokey in #723
  * ci: Fetch tags for signature verification by @robin-nitrokey in
    [#725]
  * Update maintainers file by @robin-nitrokey in #724
  * Update signature key by @robin-nitrokey in #726
  * Update locked dependencies by @robin-nitrokey in #727
  * Update developer and packaging docs by @robin-nitrokey in #729
  * Add CODEOWNERS file by @robin-nitrokey in #732
  * Feat/better log file handling by @james-knippes in #733</changelog>
</package>
<package pkgid="e56266b99544373602d1698924536bd1926bd5b8ba1abe64d4246a34efd5da649d1071631b878969901a102a06a04ec35666b0aec1a4ee4e52e7392e759087b6" name="python-pyrage" arch="src">
  <version epoch="0" ver="1.2.3" rel="5.213"/>
  <changelog author="Robert Munteanu &lt;rombert@apache.org&gt;" date="1715169600">- Initial package with version 1.1.2</changelog>
  <changelog author="Robert Munteanu &lt;rombert@apache.org&gt;" date="1734955200">- Update to version 1.2.3 (boo#1234744)</changelog>
</package>
<package pkgid="28dcc451db02b5447c3414cdd0ba63cc2e7b0b2f7e2ffcdb0eeb00eba5eecafd928f778e9f0a663bf57c274f97518b9e69e67c94dea3896317282aa7c6f16efd" name="python-pyscard" arch="src">
  <version epoch="0" ver="2.3.1" rel="51.23"/>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1554379200">- Fix Exception test on 32-bits CPU. Issue #72</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1574596800">- Update to version 1.9.9
  * test: fix Exception test on 32-bits CPU</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1610193600">- Update to version 2.0.0
  * SCardStatus(): Fix a crash in case of PC/SC error
  * toASCIIString(): replace non-ASCII char by '.'</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1629374400">- Update to version 2.0.1
  * Add .reconnect() method to high-level API
  * Use Python3 by default
  * Handle bogus ACS ACR122U PICC reader</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1632312000">- Update to version 2.0.2
  * Restrict MAX_BUFFER_SIZE_EXTENDED to 65535 and fix an issue
    on Lenovo laptops with NXP NFC readers
  * SmartcardException: display a positive PCSC error code</changelog>
  <changelog author="pgajdos@suse.com" date="1635940800">- %check: use %pyunittest rpm macro</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650369600">- use https url</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1664452800">- Update to version 2.0.5
  * no functional changes
- Update to version 2.0.4
  * Fix a problem on PCSCCardConnection.disconnect
  * Add support of BaseSCardException(hresult) format
  * Do not use deprecated distutils anymore
- Update to version 2.0.3
  * PCSCExceptions: include error code in the message</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1680868800">- Update to version 2.0.7
  * do not include the generated HTML documentation in the archive
- Update to version 2.0.6
  * handle SCARD_E_NO_SERVICE on Windows (on last reader removal)
  * add support of MSYS2/mingw environment on Windows
  * improve documentation
  * minor changes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707307200">- Add patch:
  * 0001-Remove-use-of-imp-module-for-wx-GUI.patch
    Fix build for python &gt;= 3.12</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1709985600">- Update to version 2.0.8
  * Make CardMonitor() thread safe on Python 3.12
  * Add hresult value in exceptions
  * Improve documentation
  * Check swig is installed on build
  * Remove use of imp module for wx (GUI)
  * Makefile: modernize use of setup.py
- Drop not longer needed patch:
  * 0001-Remove-use-of-imp-module-for-wx-GUI.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1712404800">- Update to version 2.0.9
  * fix a bug with CardRequestTimeoutException introduced in 2.0.8
  * Minor changes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1717416000">- Update to version 2.0.10
  * CardMonitoringThread(): do not catch unexpected exceptions</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1725883200">- Update to version 2.1.1
  * Fix a regression introduced in 2.1.0
- Update to version 2.1.0
  * PCSCCardRequest: fix active polling (was a 0.1 sec loop)
  * Fix use of undefined variable 'hresult' in exceptions
  * Fix print() use in pyscard user’s guide
  * Fix deprecation warnings
  * Minor changes
  * some more pylint-detected fixes.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1729425600">- Update to version 2.2.0
  * PCSCCardRequest:
  - handle KeyboardInterrupt in waitforcard() &amp; waitforcardevent()
  - use a local PC/SC context to avoid locks
  * smartcard.util.padd(): do NOT modify the input parameter
  * CardMonitoring: a timeout exception IS expected
  * Fix pydoctor documentation
  * wx: fix module and examples
  * Remove Python 2 conditional code
  * Test and improve the synchronization code
  * Test and update the `Observer.py` code
  * Remove `ClassLoader.py`
  * Migrate a `src/` layout
  * Migrate test/* from unittest to pytest
  * Add missing GSM 03.38 symbols for decoding
  * Support only Python 3.9 and higher
  * Remove the Python 2.x-only Pyro dependency
  * Migrate CI to use the official Coveralls action
  * Standardize local and CI testing to use tox
  * Build wheels in CI for all supported Python versions
  * Build the docs as a part of the test suite
  * Begin to add type annotations to the package
  * Deprecate the `HexListToBinString`, `BinStringToHexList`,
    `hl2bs`, and `bs2hl` utility functions
  * Support "64" as an ATR baud rate adjustment integer
    (ISO 7816-3 2006)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1736856000">- Update to version 2.2.1
  * waitforcardevent(): do not miss events between 2 calls.
  * Test, fix, and simplify ATR parsing.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1749729600">- Use pyproject macros to build and install.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1750248000">- Update to version 2.2.2
  * add .release() method to CardConnection &amp; PCSCCardRequest
  * add context manager protocol to CardRequest &amp; CardService
  * fix some parallel execution issues
  * PCSCCardRequest: correctly initialize waitforcardevent()
  * user-guide: Update documentation</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1757678400">- Update to version 2.3.0
  * PCSCCardRequest: fix waitforcardevent() initialization.
  * PCSCCardConnection: raise exception for .connect() after
    .release()
  * Fix race issue in SCardListReaders() and
    SCardListReaderGroups().
  * Use SCARD_AUTOALLOCATE where defined.
  * Use SCardFreeMemory() on Unix.
  * CardMonitoringThread: Fix a thread safeness issue.
  * fix/ignore all pylint warnings.
  * Minor changes.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1761739200">- Update to version 2.3.1
  * Add support of SWIG 4.4.0
  * Minor changes</changelog>
</package>
<package pkgid="9382ace262d64e753f45523c6fba8d4fe0de05bc3f2c05f940ad3f09ab33dc24431f1e568d5d011e32bc10bfbf92feb073d13df1164d497402786c5f355bd08e" name="python-pyscard-debuginfo" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="51.23"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1680868800">- Update to version 2.0.7
  * do not include the generated HTML documentation in the archive
- Update to version 2.0.6
  * handle SCARD_E_NO_SERVICE on Windows (on last reader removal)
  * add support of MSYS2/mingw environment on Windows
  * improve documentation
  * minor changes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707307200">- Add patch:
  * 0001-Remove-use-of-imp-module-for-wx-GUI.patch
    Fix build for python &gt;= 3.12</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1709985600">- Update to version 2.0.8
  * Make CardMonitor() thread safe on Python 3.12
  * Add hresult value in exceptions
  * Improve documentation
  * Check swig is installed on build
  * Remove use of imp module for wx (GUI)
  * Makefile: modernize use of setup.py
- Drop not longer needed patch:
  * 0001-Remove-use-of-imp-module-for-wx-GUI.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1712404800">- Update to version 2.0.9
  * fix a bug with CardRequestTimeoutException introduced in 2.0.8
  * Minor changes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1717416000">- Update to version 2.0.10
  * CardMonitoringThread(): do not catch unexpected exceptions</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1725883200">- Update to version 2.1.1
  * Fix a regression introduced in 2.1.0
- Update to version 2.1.0
  * PCSCCardRequest: fix active polling (was a 0.1 sec loop)
  * Fix use of undefined variable 'hresult' in exceptions
  * Fix print() use in pyscard user’s guide
  * Fix deprecation warnings
  * Minor changes
  * some more pylint-detected fixes.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1729425600">- Update to version 2.2.0
  * PCSCCardRequest:
  - handle KeyboardInterrupt in waitforcard() &amp; waitforcardevent()
  - use a local PC/SC context to avoid locks
  * smartcard.util.padd(): do NOT modify the input parameter
  * CardMonitoring: a timeout exception IS expected
  * Fix pydoctor documentation
  * wx: fix module and examples
  * Remove Python 2 conditional code
  * Test and improve the synchronization code
  * Test and update the `Observer.py` code
  * Remove `ClassLoader.py`
  * Migrate a `src/` layout
  * Migrate test/* from unittest to pytest
  * Add missing GSM 03.38 symbols for decoding
  * Support only Python 3.9 and higher
  * Remove the Python 2.x-only Pyro dependency
  * Migrate CI to use the official Coveralls action
  * Standardize local and CI testing to use tox
  * Build wheels in CI for all supported Python versions
  * Build the docs as a part of the test suite
  * Begin to add type annotations to the package
  * Deprecate the `HexListToBinString`, `BinStringToHexList`,
    `hl2bs`, and `bs2hl` utility functions
  * Support "64" as an ATR baud rate adjustment integer
    (ISO 7816-3 2006)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1736856000">- Update to version 2.2.1
  * waitforcardevent(): do not miss events between 2 calls.
  * Test, fix, and simplify ATR parsing.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1749729600">- Use pyproject macros to build and install.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1750248000">- Update to version 2.2.2
  * add .release() method to CardConnection &amp; PCSCCardRequest
  * add context manager protocol to CardRequest &amp; CardService
  * fix some parallel execution issues
  * PCSCCardRequest: correctly initialize waitforcardevent()
  * user-guide: Update documentation</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1757678400">- Update to version 2.3.0
  * PCSCCardRequest: fix waitforcardevent() initialization.
  * PCSCCardConnection: raise exception for .connect() after
    .release()
  * Fix race issue in SCardListReaders() and
    SCardListReaderGroups().
  * Use SCARD_AUTOALLOCATE where defined.
  * Use SCardFreeMemory() on Unix.
  * CardMonitoringThread: Fix a thread safeness issue.
  * fix/ignore all pylint warnings.
  * Minor changes.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1761739200">- Update to version 2.3.1
  * Add support of SWIG 4.4.0
  * Minor changes</changelog>
</package>
<package pkgid="8fd2cb0959428820c1e6767dee4ce565e73ec882586b06e89048495d863ea300d82bb5e225e647c43171c4b89f4b4c2e62838fe5e4acdef5b77d9f8b333885f0" name="python-pyscard-debugsource" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="51.23"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1680868800">- Update to version 2.0.7
  * do not include the generated HTML documentation in the archive
- Update to version 2.0.6
  * handle SCARD_E_NO_SERVICE on Windows (on last reader removal)
  * add support of MSYS2/mingw environment on Windows
  * improve documentation
  * minor changes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707307200">- Add patch:
  * 0001-Remove-use-of-imp-module-for-wx-GUI.patch
    Fix build for python &gt;= 3.12</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1709985600">- Update to version 2.0.8
  * Make CardMonitor() thread safe on Python 3.12
  * Add hresult value in exceptions
  * Improve documentation
  * Check swig is installed on build
  * Remove use of imp module for wx (GUI)
  * Makefile: modernize use of setup.py
- Drop not longer needed patch:
  * 0001-Remove-use-of-imp-module-for-wx-GUI.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1712404800">- Update to version 2.0.9
  * fix a bug with CardRequestTimeoutException introduced in 2.0.8
  * Minor changes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1717416000">- Update to version 2.0.10
  * CardMonitoringThread(): do not catch unexpected exceptions</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1725883200">- Update to version 2.1.1
  * Fix a regression introduced in 2.1.0
- Update to version 2.1.0
  * PCSCCardRequest: fix active polling (was a 0.1 sec loop)
  * Fix use of undefined variable 'hresult' in exceptions
  * Fix print() use in pyscard user’s guide
  * Fix deprecation warnings
  * Minor changes
  * some more pylint-detected fixes.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1729425600">- Update to version 2.2.0
  * PCSCCardRequest:
  - handle KeyboardInterrupt in waitforcard() &amp; waitforcardevent()
  - use a local PC/SC context to avoid locks
  * smartcard.util.padd(): do NOT modify the input parameter
  * CardMonitoring: a timeout exception IS expected
  * Fix pydoctor documentation
  * wx: fix module and examples
  * Remove Python 2 conditional code
  * Test and improve the synchronization code
  * Test and update the `Observer.py` code
  * Remove `ClassLoader.py`
  * Migrate a `src/` layout
  * Migrate test/* from unittest to pytest
  * Add missing GSM 03.38 symbols for decoding
  * Support only Python 3.9 and higher
  * Remove the Python 2.x-only Pyro dependency
  * Migrate CI to use the official Coveralls action
  * Standardize local and CI testing to use tox
  * Build wheels in CI for all supported Python versions
  * Build the docs as a part of the test suite
  * Begin to add type annotations to the package
  * Deprecate the `HexListToBinString`, `BinStringToHexList`,
    `hl2bs`, and `bs2hl` utility functions
  * Support "64" as an ATR baud rate adjustment integer
    (ISO 7816-3 2006)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1736856000">- Update to version 2.2.1
  * waitforcardevent(): do not miss events between 2 calls.
  * Test, fix, and simplify ATR parsing.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1749729600">- Use pyproject macros to build and install.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1750248000">- Update to version 2.2.2
  * add .release() method to CardConnection &amp; PCSCCardRequest
  * add context manager protocol to CardRequest &amp; CardService
  * fix some parallel execution issues
  * PCSCCardRequest: correctly initialize waitforcardevent()
  * user-guide: Update documentation</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1757678400">- Update to version 2.3.0
  * PCSCCardRequest: fix waitforcardevent() initialization.
  * PCSCCardConnection: raise exception for .connect() after
    .release()
  * Fix race issue in SCardListReaders() and
    SCardListReaderGroups().
  * Use SCARD_AUTOALLOCATE where defined.
  * Use SCardFreeMemory() on Unix.
  * CardMonitoringThread: Fix a thread safeness issue.
  * fix/ignore all pylint warnings.
  * Minor changes.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1761739200">- Update to version 2.3.1
  * Add support of SWIG 4.4.0
  * Minor changes</changelog>
</package>
<package pkgid="c26af09617d6bb93f37fa2bf220a85b9f3cdf9b666758832aaa272904c8c353c59fc9e52364c461a76ddde165070c2e87434f53cd8c3b04bc5a07f47fdcd5178" name="python-qt-material" arch="src">
  <version epoch="0" ver="2.17" rel="12.5"/>
  <changelog author="munix9@googlemail.com" date="1772193600">- update to version 2.17</changelog>
</package>
<package pkgid="6242ed9a7b3018bb90001c2333e8e0003ec440b0c6f3997b23c28065ceccdb25db46ab872432ece30862ed24ae3ccba4a5d9afc8c5d00e4d125545904fcdc24b" name="python-ropgadget" arch="src">
  <version epoch="0" ver="7.7" rel="3.5"/>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1745323200">- Initial packaging at version 7.6</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1773316800">- Update to version 7.7:
  * Wrap disassembly in try/except to handle invalid instruction
  bytes
  * Fix callPreceded filtering
  * Fix sintax warnings for python 3.13</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1778414400">- Update .spec to use libalternatives in recent openSUSE versions</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1778932800">- Replace placeholder with actual name</changelog>
</package>
<package pkgid="aa56c6d24aa9222ca053666a1e09ac7dbf88742684f22c5aa6d3309c6018c98921486b73a0508481cea6f1c3ad55ce684ece64477e11ef0e83f9122c66dc6159" name="python-sbommage" arch="src">
  <version epoch="0" ver="1.0.2" rel="7.11"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1739361600">- new package python-sbommage: interactive terminal frontend for
  viewing Software Bill of Materials (SBOM) files in various
  formats</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1739448000">- use %python3_fix_shebang to fix the shebang properly</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755691200">- Update to version 1.0.1:
  * Bump version to 1.0.1
  * Update sbommage.py
  * Let's go packaging!
  * Update sbommage
  * Remove older sboms
  * Replace sboms with newer examples
  * Add support for github sbom
  * Fix encoding when reading file</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755691201">- Update to version 1.0.2:
  * Bump version to 1.0.2
  * Bump textual
  * Bump version to 1.0.1
  * Delete Formula directory</changelog>
</package>
<package pkgid="44fe6ee318168e833ec8405f624b2a9fd32b49a431e0832b320fcb163806622a7c9133a98b677f5b68294ccedb26ec7c54eb086a388ccf8fe9ee86041ba7e073" name="python-solo-python" arch="noarch">
  <version epoch="0" ver="0.0.27" rel="4.4"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1617364800">- Initial packaging of solo 0.0.27</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1620820800">- We don't actually need single-spec, this is just one command,
  so we can use just primary_python.
- Use already existing intelhex package, not develop new one.</changelog>
</package>
<package pkgid="99ee0ee1c832c485d49096f96e028cbb01c9a781bb29cf7a31cc81feec3b5ef622729ea3a6deafa031f45242153e46aca54f106472101a5467e47bfb9be4b67f" name="python-solo-python" arch="src">
  <version epoch="0" ver="0.0.27" rel="4.4"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1617364800">- Initial packaging of solo 0.0.27</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1620820800">- We don't actually need single-spec, this is just one command,
  so we can use just primary_python.
- Use already existing intelhex package, not develop new one.</changelog>
</package>
<package pkgid="4626a22d356341cfe27ef99099e5f1e774b321804b7e77886b8b65d04e0889cab81c514d9859e493518a576a2fa70d2210bec99a9b330a47fb69047bcd903ccb" name="python-systemd" arch="src">
  <version epoch="0" ver="235" rel="41.64"/>
  <changelog author="jweberhofer@weberhofer.at" date="1445256000">- Initial release 230
- This package is needed to resolve
  bnc#917818 - fail2ban can not use systemd-journal to ban ips</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1445515200">- python-systemd-libraries-for-opensuse-1310.patch allows compilation
  on openSUSE 13.1</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1446292800">- Upgrade to release 231
  * Various build fixes and cleanups: documentation can be generated with 'make
    sphinx-html', pip install works out of the box.
  * Tests that cover most of the python code were added. As a result, a bug in
    sd_is_mq was fixed in systemd 227.
  * Functions sd_pid_notify and sd_pid_notify_with_fds are now wrapped as
    optional arguments to notify(), when compiled against a new-enough
    libsystemd.
- Run tests
- Removed obsolete python-systemd-libraries-for-opensuse-1310.patch patch
- New build dependencies had been added</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1483358400">- add doc package</changelog>
  <changelog author="fbui@suse.com" date="1497268800">- Upgrade to release 233:
  + Tests are fixed and should pass on various old and new systems
    alike.
  + journal.stream() can be used without arguments and defaults to
    LOG_LEVEL.
- Changes from version 232:
  + Wrappers for sd_journal_enumerate_unique, has_runtime_files,
    has_peristent_files.
  + sd_journal_open_directory_fd, sd_journal_open_files_fd can be
    used by passing file descriptors to the initializer as the path
    or files arguments.</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1498478400">- exclude-tests-on-obs.patch: Exclude test which fail because of
  a bug in the OBS: https://github.com/openSUSE/obs-build/pull/351
- Upgrade to release 234
  * _daemon,_reader: return ENOSYS instead of NotImplemented
  * _daemon: allow specifying flowinfo
  * Added section for installation on openSUSE &amp; SLE
  * Adjust import order, spacing, operators as recommended by pylint
  * build-sys: add sign and upload targets
  * daemon: add basic support for sd_is_socket_sockaddr
  * daemon: add wrapper for sd_is_socket_sockaddr and tests
  * daemon: properly skip sd_is_socket_sockaddr calls if not available
  * Fix handling of addresses without port and add tests
  * Fix styling to match PEP8 in most places
  * Improve test skipping on old systems
  * Include all fields from record
  * journal: do not convert extra args to string in JournalHandler
  * journal: fix repr of JournalHandler to match python3.6
  * journal: improve docstring formatting a bit
  * journal: rename SENDER_FUNCTION to sender_function
  * Makefile: add "doc" target for convenience
  * Makefile: add convenience "shell" target to start python shell
  * Makefile: remove unneeded -I/usr/include from flags
  * Makefile: use $(INCLUDE_DIR) also for compilation
  * Prevent non-str values from being concatenated with +
  * Python 3.6 invalid escape sequence deprecation fixes
  * Remove mid from JournalHandler
  * replace dict.iteritems() with dict.items() to support py3
  * setup.py: allow LIBSYSTEMD_VERSION to be overridden
  * test_daemon: xfail test_notify_with_socket if bind() fails
  * test_journal: add tests for MESSAGE_ID passing
  * tests: move login tests from doctest to separate file
  * tests: skip journal.stream tests on ENOENT error
  * Update to constants from systemd-233
  * util: add compatibility for old glibc</changelog>
  <changelog author="sebix+novell.com@sebix.at" date="1507377600">- singlespec</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1509969600">- iso-c-90.patch added to fix building on SLE12-SP3</changelog>
  <changelog author="mpluskal@suse.com" date="1510660800">- Use more of python building macros
- Do not build documentation (build is broken if /usr/bin/python is
  not present anyways)
- Run spec-cleaner</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580644800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1656849600">- 0002-reader-make-PY_SSIZE_T_CLEAN.patch added to fix boo#1200686
  reader: make PY_SSIZE_T_CLEAN</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1656849601">- Remove exclude-tests-on-obs.patch, this is not the way how to
  do it, besides %python_exec setup.py check doesn't the test
  suite.
- Make tests running properly again</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1660737600">- Update to version 235:
  * Adapt the rename of systemd-activate to
    systemd-socket-activate performed in systemd 230.
  * Support for sd_listen_fds_with_names added in systemd 227.
  * Support for sd_journal_get_cutoff_realtime_usec added in
    systemd 186.
  * Make the Reader PY_SSIZE_T_CLEAN for py3.10 compatibility.
  * id128: update for systemd-243 compatibility and other fixes.
  * C syntax modernization. A minimum of C99 is assumed.
  * Fix seek_realtime to work with timezone aware date on Python 3.
  * journal: add namespace support.
  * Fixes for memory leaks and documentation.
  * Support for Python 2 will be removed after this release.
- Remove upstreamed 0002-reader-make-PY_SSIZE_T_CLEAN.patch.
- Skip two failing tests (gh#systemd/python-systemd#118)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1660737601">- Add OBS_missing_etc_machine_id.patch to partially fix
  gh#systemd/python-systemd#118.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1686484800">- Add %{?sle15_python_module_pythons}</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715601600">- Add fix_test_reader_this_machine.patch to make
  test_reader_this_machine pass in the limited build environment.
- Do not pull in whole systemd, when just libsystemd0 is enough
  (bsc#1215538).</changelog>
</package>
<package pkgid="b99218ef02be3e55e826564bc88c716732d01403cada2398a26338853694759cd70bf1868e4a1d6cf0220c19df2d94dfd0f95e85966d60ee7d60663c643de4d1" name="python-systemd-debuginfo" arch="s390x">
  <version epoch="0" ver="235" rel="41.64"/>
  <changelog author="sebix+novell.com@sebix.at" date="1507377600">- singlespec</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1509969600">- iso-c-90.patch added to fix building on SLE12-SP3</changelog>
  <changelog author="mpluskal@suse.com" date="1510660800">- Use more of python building macros
- Do not build documentation (build is broken if /usr/bin/python is
  not present anyways)
- Run spec-cleaner</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580644800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1656849600">- 0002-reader-make-PY_SSIZE_T_CLEAN.patch added to fix boo#1200686
  reader: make PY_SSIZE_T_CLEAN</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1656849601">- Remove exclude-tests-on-obs.patch, this is not the way how to
  do it, besides %python_exec setup.py check doesn't the test
  suite.
- Make tests running properly again</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1660737600">- Update to version 235:
  * Adapt the rename of systemd-activate to
    systemd-socket-activate performed in systemd 230.
  * Support for sd_listen_fds_with_names added in systemd 227.
  * Support for sd_journal_get_cutoff_realtime_usec added in
    systemd 186.
  * Make the Reader PY_SSIZE_T_CLEAN for py3.10 compatibility.
  * id128: update for systemd-243 compatibility and other fixes.
  * C syntax modernization. A minimum of C99 is assumed.
  * Fix seek_realtime to work with timezone aware date on Python 3.
  * journal: add namespace support.
  * Fixes for memory leaks and documentation.
  * Support for Python 2 will be removed after this release.
- Remove upstreamed 0002-reader-make-PY_SSIZE_T_CLEAN.patch.
- Skip two failing tests (gh#systemd/python-systemd#118)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1660737601">- Add OBS_missing_etc_machine_id.patch to partially fix
  gh#systemd/python-systemd#118.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1686484800">- Add %{?sle15_python_module_pythons}</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715601600">- Add fix_test_reader_this_machine.patch to make
  test_reader_this_machine pass in the limited build environment.
- Do not pull in whole systemd, when just libsystemd0 is enough
  (bsc#1215538).</changelog>
</package>
<package pkgid="622a5b89487d6428338a6c7403c8315433ae1938546bdda33c75562a03e5c766320ef7620c9a9b827469e99a45c4cb3987f0e18a85c482dc85b2f32296426a49" name="python-systemd-debugsource" arch="s390x">
  <version epoch="0" ver="235" rel="41.64"/>
  <changelog author="sebix+novell.com@sebix.at" date="1507377600">- singlespec</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1509969600">- iso-c-90.patch added to fix building on SLE12-SP3</changelog>
  <changelog author="mpluskal@suse.com" date="1510660800">- Use more of python building macros
- Do not build documentation (build is broken if /usr/bin/python is
  not present anyways)
- Run spec-cleaner</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580644800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1656849600">- 0002-reader-make-PY_SSIZE_T_CLEAN.patch added to fix boo#1200686
  reader: make PY_SSIZE_T_CLEAN</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1656849601">- Remove exclude-tests-on-obs.patch, this is not the way how to
  do it, besides %python_exec setup.py check doesn't the test
  suite.
- Make tests running properly again</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1660737600">- Update to version 235:
  * Adapt the rename of systemd-activate to
    systemd-socket-activate performed in systemd 230.
  * Support for sd_listen_fds_with_names added in systemd 227.
  * Support for sd_journal_get_cutoff_realtime_usec added in
    systemd 186.
  * Make the Reader PY_SSIZE_T_CLEAN for py3.10 compatibility.
  * id128: update for systemd-243 compatibility and other fixes.
  * C syntax modernization. A minimum of C99 is assumed.
  * Fix seek_realtime to work with timezone aware date on Python 3.
  * journal: add namespace support.
  * Fixes for memory leaks and documentation.
  * Support for Python 2 will be removed after this release.
- Remove upstreamed 0002-reader-make-PY_SSIZE_T_CLEAN.patch.
- Skip two failing tests (gh#systemd/python-systemd#118)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1660737601">- Add OBS_missing_etc_machine_id.patch to partially fix
  gh#systemd/python-systemd#118.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1686484800">- Add %{?sle15_python_module_pythons}</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715601600">- Add fix_test_reader_this_machine.patch to make
  test_reader_this_machine pass in the limited build environment.
- Do not pull in whole systemd, when just libsystemd0 is enough
  (bsc#1215538).</changelog>
</package>
<package pkgid="9c4585405d66b01caf2ff93af832a6b6ac906e88f4345ecd15eee8d2952e0024ccba313a18a21b9a8bfb14929c378286c6b36a1f8504aa2d28de53f911c771da" name="python3-audit" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.7"/>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1722859200">- Remove rcaudit symlink [jsc#PED-266]</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Move rules-related files into new subpackage `audit-rules':
  * Files moved:
  - /sbin/auditctl, /sbin/augenrules,
  /etc/audit/{audit.rules,rules.d/audit.rules,audit-stop.rules}
  - manpages for auditctl, augenrules, and audit.rules
  - /etc/audit is now owned by `audit-rules' as well
  * Add new file /usr/lib/systemd/system/audit-rules.service
  * Remove in-house create-augenrules-service.patch that generated
    augenrules.service systemd unit service
  * Remove ownership of /usr/share/audit
  * Create /usr/share/audit-rules directory on %install
  * Remove audit-userspace-517-compat.patch (fixed upstream)
  * Remove libev-werror.patch (fixed upstream)
  * Remove audit-allow-manual-stop.patch (fixed upstream)
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Remove autrace and auvirt references (upstream)
  * Replace README with README.md
- Drop `--enable-systemd' from %configure as SysV-style scripts
  aren't supported in upstream since
  113ae191758c ("Drop support for SysVinit")</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727352000">- Update audit-secondary.spec:
  * Add "Requires: audit-rules" for audit package
  * Remove preun/postun handling of audit-rules.service</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727784000">- Fix plugin termination when using systemd service units (bsc#1215377)
  * add auditd.service-fix-plugin-termination.patch</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727870400">- Readd audit-allow-manual-stop.patch (removed by mistake)</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec (bsc#1231236):
  * add requirement for 'awk' package
  * move some %post logic from audit to audit-rules</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1769428800">- Move all /var/spool, /var/log directories to systemd-tmpfiles</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="49cdcb6fd35c0d96bd354be63380ae8878ea576d50ffd2ca92167884c0d5b1efa813c5c0c354fec44c7d1639fe62e0bd3a1c2c6219e5073ef85081f8e0b85bff" name="python3-audit-debuginfo" arch="s390x">
  <version epoch="0" ver="4.0.2" rel="186.7"/>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1722859200">- Remove rcaudit symlink [jsc#PED-266]</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Move rules-related files into new subpackage `audit-rules':
  * Files moved:
  - /sbin/auditctl, /sbin/augenrules,
  /etc/audit/{audit.rules,rules.d/audit.rules,audit-stop.rules}
  - manpages for auditctl, augenrules, and audit.rules
  - /etc/audit is now owned by `audit-rules' as well
  * Add new file /usr/lib/systemd/system/audit-rules.service
  * Remove in-house create-augenrules-service.patch that generated
    augenrules.service systemd unit service
  * Remove ownership of /usr/share/audit
  * Create /usr/share/audit-rules directory on %install
  * Remove audit-userspace-517-compat.patch (fixed upstream)
  * Remove libev-werror.patch (fixed upstream)
  * Remove audit-allow-manual-stop.patch (fixed upstream)
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Remove autrace and auvirt references (upstream)
  * Replace README with README.md
- Drop `--enable-systemd' from %configure as SysV-style scripts
  aren't supported in upstream since
  113ae191758c ("Drop support for SysVinit")</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727352000">- Update audit-secondary.spec:
  * Add "Requires: audit-rules" for audit package
  * Remove preun/postun handling of audit-rules.service</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727784000">- Fix plugin termination when using systemd service units (bsc#1215377)
  * add auditd.service-fix-plugin-termination.patch</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727870400">- Readd audit-allow-manual-stop.patch (removed by mistake)</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec (bsc#1231236):
  * add requirement for 'awk' package
  * move some %post logic from audit to audit-rules</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1769428800">- Move all /var/spool, /var/log directories to systemd-tmpfiles</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="97d5fd1a6ff0342392f7d2fdaa71e21de9c39a86598e507f5217cecbc0a515c8b97f8f4867cdeb164edfbebf13bc9ebe4a6e38e13a48bd31ace0d56673a98d58" name="python3-capng" arch="s390x">
  <version epoch="0" ver="0.8.5" rel="54.21"/>
  <changelog author="tchvatal@suse.com" date="1449489600">- Fix build by passing --without-python3 argument. For now we are
  fine with py2 bindings only</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1495022400">- Update to version 0.7.8:
  * Improve Python3 support
  * Fix the thread separation test
  * Correct typo in cap_pacct text
  * Update man page for captest
  * Fix sscanf string lengths in netcap
  * Correct linking of python3 module</changelog>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to version 0.7.9:
  * Fix byte compiling python3 bindings
  * Rework spec file to show new python2/3 separation
- cleanup with spec-cleaner
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1518955201">- Remove ineffective --with-pic. Fix SRPM group. Redo descriptions.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Switch to singlespec approach to allow building of python3
  bindings</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1589284800">- Update to 0.7.10:
  * Update capng_change_id man page
  * Add capng_have_permitted_capabilities function
  * Update filecap to output which set the capabilities are in
  * Fix filecap to not output an error when a file has no capabilities
  * Add udplite support to netcap
  * Fix usage of pthread_atfork (Joe Orton)
  * Mark processes in child user namespaces with * (Danila Kiver)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to 0.7.11
  * Really clear bounding set if asked in capng_change_id
  * Add CAP_PERFMON, CAP_BPF, &amp; CAP_CHECKPOINT_RESTORE
  * Avoid malloc/free in capng_apply (Natanael Copa)
  * If procfs is not available, get bounding set via prctl</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1652097600">- Update to 0.8.3:
  * Add vararg support to python bindings for capng_updatev
  * Add support for ambient capabilities
  * Add support for V3 filesystem capabilities
  * If procfs is not available, leave last_cap as CAP_LAST_CAP
  * If bounding and ambient not found in status, try prctl method
  * In capng_apply, move ambient caps to the end of the transaction
  * In capng_apply, return errors more aggressively.
  * In capng_apply, if the action includes the bounding set,resync with the kernel
  * Fix signed/unsigned warning in cap-ng.c
  * In capng_apply, return a unique error code to diagnose any failure
  * In capng_have_capability, return 0 for failure
  * Add the libdrop_ambient admin tool
  * In capng_apply, if we blew up in bounding set, allow setting capabilities
  * If PR_CAP_AMBIENT is not available, do not build libdrop_ambient
  * Improve last_cap check
  * Fix parameters to capng_updatev python bindings to be signed
  * Detect capability options at runtime to make containerization easier (ntkme)
  * Initialize the library when linked statically
  * Add gcc function attributes for deallocation</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1704196800">- Update to version 0.8.4
  * In capng_change_id, clear PR_SET_KEEPCAPS if returning an error
  * pscap: add -p option for reporting a specified process
  * Annotate function prototypes to warn if results are unused
  * Drop python2 support</changelog>
</package>
<package pkgid="8fc247b415005ec5e84403e1ff6a81ecc7ce958c4ef2a1ab7931e786cd4d94f619088c22dd386841a46df7be34772b5e3184546af57e91f8535aa6d48069f099" name="python3-capng-debuginfo" arch="s390x">
  <version epoch="0" ver="0.8.5" rel="54.21"/>
  <changelog author="tchvatal@suse.com" date="1449489600">- Fix build by passing --without-python3 argument. For now we are
  fine with py2 bindings only</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1495022400">- Update to version 0.7.8:
  * Improve Python3 support
  * Fix the thread separation test
  * Correct typo in cap_pacct text
  * Update man page for captest
  * Fix sscanf string lengths in netcap
  * Correct linking of python3 module</changelog>
  <changelog author="avindra@opensuse.org" date="1518955200">- Update to version 0.7.9:
  * Fix byte compiling python3 bindings
  * Rework spec file to show new python2/3 separation
- cleanup with spec-cleaner
- use https urls</changelog>
  <changelog author="jengelh@inai.de" date="1518955201">- Remove ineffective --with-pic. Fix SRPM group. Redo descriptions.
- Rename %soname to %sover to better reflect its use.</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Switch to singlespec approach to allow building of python3
  bindings</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1589284800">- Update to 0.7.10:
  * Update capng_change_id man page
  * Add capng_have_permitted_capabilities function
  * Update filecap to output which set the capabilities are in
  * Fix filecap to not output an error when a file has no capabilities
  * Add udplite support to netcap
  * Fix usage of pthread_atfork (Joe Orton)
  * Mark processes in child user namespaces with * (Danila Kiver)</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1639051200">- Update to 0.7.11
  * Really clear bounding set if asked in capng_change_id
  * Add CAP_PERFMON, CAP_BPF, &amp; CAP_CHECKPOINT_RESTORE
  * Avoid malloc/free in capng_apply (Natanael Copa)
  * If procfs is not available, get bounding set via prctl</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1652097600">- Update to 0.8.3:
  * Add vararg support to python bindings for capng_updatev
  * Add support for ambient capabilities
  * Add support for V3 filesystem capabilities
  * If procfs is not available, leave last_cap as CAP_LAST_CAP
  * If bounding and ambient not found in status, try prctl method
  * In capng_apply, move ambient caps to the end of the transaction
  * In capng_apply, return errors more aggressively.
  * In capng_apply, if the action includes the bounding set,resync with the kernel
  * Fix signed/unsigned warning in cap-ng.c
  * In capng_apply, return a unique error code to diagnose any failure
  * In capng_have_capability, return 0 for failure
  * Add the libdrop_ambient admin tool
  * In capng_apply, if we blew up in bounding set, allow setting capabilities
  * If PR_CAP_AMBIENT is not available, do not build libdrop_ambient
  * Improve last_cap check
  * Fix parameters to capng_updatev python bindings to be signed
  * Detect capability options at runtime to make containerization easier (ntkme)
  * Initialize the library when linked statically
  * Add gcc function attributes for deallocation</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="jun wang &lt;jgwang@suse.com&gt;" date="1704196800">- Update to version 0.8.4
  * In capng_change_id, clear PR_SET_KEEPCAPS if returning an error
  * pscap: add -p option for reporting a specified process
  * Annotate function prototypes to warn if results are unused
  * Drop python2 support</changelog>
</package>
<package pkgid="eb8156240dd74a6a7154d041f61f7eda0f280d848c6b1350d429bb2cf2d067d72b554cd5fcf1c4cd99c4dc90f1aa3de344dde930c4f24eeb630e846cd91e3e97" name="python3-github-secrets" arch="noarch">
  <version epoch="0" ver="0.0.1~1740749736.7819a4a" rel="1.6"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741608000">- new package python-github-secrets: analyzes a given Github
  repository and searches for dangling or force-pushed commits
  containing potential secret or interesting information</changelog>
</package>
<package pkgid="6a219213b7594538d1cff08a1d10cfd5c4001ffb000d5cbfff6c25c2a63b7e36723199f69bf5a158813a7fe22f8efae8eb09b305171895cb20f0dfef964e9a31" name="python3-sbommage" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="7.11"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1739361600">- new package python-sbommage: interactive terminal frontend for
  viewing Software Bill of Materials (SBOM) files in various
  formats</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1739448000">- use %python3_fix_shebang to fix the shebang properly</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755691200">- Update to version 1.0.1:
  * Bump version to 1.0.1
  * Update sbommage.py
  * Let's go packaging!
  * Update sbommage
  * Remove older sboms
  * Replace sboms with newer examples
  * Add support for github sbom
  * Fix encoding when reading file</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755691201">- Update to version 1.0.2:
  * Bump version to 1.0.2
  * Bump textual
  * Bump version to 1.0.1
  * Delete Formula directory</changelog>
</package>
<package pkgid="e21e40eaef1f005eb1e656cf790bf59d4137beed0c91aa77e9a9ba066e0b8f49ee9513298e3e899d8cc9b349a0b225b3d06155ae571020b4422530629bb3dbb8" name="python311-nitrokey" arch="noarch">
  <version epoch="0" ver="0.4.2" rel="24.7"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1731240000">- Initial package (0.2.3)</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1739880000">- Update to 0.2.4
  * The list methods of `NK3` and `NKPK` now only open the
    respective device, based on the USB vendor and product ID.
  * Use trusted publishing for PyPI.
  * Add support for `poetry-core` v2.
- Use Python 3.11 on SLE-15 by default</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742990400">- update to 0.3.0:
  * Bump minimum Python version from 3.9 to 3.9.2.
  * nitrokey.nk3.updates:
  - Remove UpdatePath, get_extra_information and
    get_finalization_wait_retries from public API.
  - Remove obsolete UpdateUi.request_repeated_update method.
  - Show warning when updating from bootloader mode and if the
    status command is not available.
  - Reboot devices in firmware mode before the update to make
    sure that the status is up to date.
  - Add Warning enum, show_warning and raise_warning methods to
    UpdateUi and ignore_warnings argument to UpdateUi.__init__.
  * Add support for updates to Nitrokey 3 firmware v1.8.2.
  * Add support for setting a minimum SDK version in firmware
    update containers.
  - Add an sdk field to nitrokey.trussed.FirmwareContainer.
  - Check SDK version in nitrokey.nk3.updates.Updater.update.
  - Add nitrokey.nk3.updates.Warning.SDK_VERSION variant.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743163200">- update to 0.3.1:
  * nitropy.nk3.updates: Remove reboot during update</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1743163201">- Add *.rpmlintrc to make rpmlint output useful.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1752062400">- update to 0.3.2:
  Add support fido2 v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754308800">- update to 0.4.0:
  * nitrokey.trussed.admin_app.InitStatus: add support for
    EXT_FLASH_NEED_REFORMAT
  * Use poetry-core v2 as build backend.
  * Bump minimum Python version to 3.10.
  * nitrokey.trussed.Model: Remove firmware_repository and
    firmware_pattern properties.
  * nitrokey.nk3.updates:
  - Move to nitrokey.trussed.updates and prepare adding NKPK
    support.
  - Return device status after an update.
  - Add model argument to get_firmware_update.
  - Add get_firmware_repository method.
  - Replace connection callbacks in Updater with DeviceHandler
    class.
- add version constraints for dependencies
- relax constraint on protobuf, see
  https://github.com/Nitrokey/nitrokey-sdk-py/issues/84#issuecomment-3158310783</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755777600">- update to 0.4.1:
  * Add support for protobuf v6.
  * nitrokey.trussed.admin_app: Fix validation of ConfigFieldType.U8
    values.
  * nitrokey.trussed: Add list and open functions.
  * nitrokey.trussed.updates:
  - Add default values for the image and update_version arguments
    for Updater.update.
  - Only call UpdateUi.confirm_extra_information if the passed list
    is not empty.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765281600">- update to 0.4.2:
  * nitrokey.trussed: Add optional model argument for list and open
    functions.</changelog>
</package>
<package pkgid="fe9c0862354af1bb1883cec5ff6e0a314bb4c3a37146938c1b805cb82c19c1704726fc8d89ebbb9acdc7220816067aeec27699d7360fba32f4b4d0a700d97f94" name="python311-pynitrokey" arch="noarch">
  <version epoch="0" ver="0.11.4" rel="66.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1721217600">- update to 0.4.49:
  * nethsm: Add support for namespaces by @robin-nitrokey in #535</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1722513600">- update to 0.4.50:
  * nethsm: Improve namespace handling in add-user by
    @robin-nitrokey in #555
  * And random generator and config failures to init status bytes
    by @sosthene-nitrokey in #556
  * Require authentication for partial restore by @mmerklinger in
    [#554]</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1731240000">- update to 0.6.0:
  * Add PIV commands
  * Update prompt to more meaningful texts
- update to 0.5.0:
  * Use Nitrokey Python SDK
  * Remove spsdk from module list for version logging</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1736424000">- update to 0.7.2:
  - Update click and click-aliases dependencies by @robin-nitrokey
    in #597
  - Update cryptography dependency by @robin-nitrokey in #596
  - fido2: Limit VID/PID for Nitrokey FIDO2 commands by
    @robin-nitrokey in #604
  - Support Python 3.13 by @mmerklinger in #607
  - fido2 verify: Add support for Nitrokey Passkey by
    @robin-nitrokey in #603
- update to 0.7.1:
  - Restrict hidapi dependency and release v0.7.1 by
    @robin-nitrokey in #602
- update to 0.7.0:
  - Add confirm option to allow automated updates on nk3 devices by
    @anotherbridge in #575
  - Use config field availability information from the sdk by
    @sosthene-nitrokey in #577
  - Remove asn1crypto by @sosthene-nitrokey in #582
  - fixed URL for Nitrokey3/Linux/udev rules troubleshooting by
    @hardcodes in #586
  - Make pyscard dependency optional by @sosthene-nitrokey in #580
  - Fix deprecation warning with TripleDES by @sosthene-nitrokey in
    [#589]
  - remove unused .gitlab-ci.yml by @daringer in #590
  - Remove unused dependencies by @robin-nitrokey in #591</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1736510400">- update to 0.7.3:
  - Fix type hints for Python 3.11 and older by @robin-nitrokey in
    [#611]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1740484800">- update to 0.7.4:
  * Nethsm: Read host from NETHSM_HOST if not set on the command
    line (#617)
  * Nethsm: Fix add-key command (#627)
  * PIV: fix admin authentication with 1.8.1 (#625)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742990400">- update to 0.8.0:
  This release adds support for Nitrokey 3 firmware updates to
  v1.8.2, adds TPM information to the NetHSM system status and
  improves the FIDO2 tests in nitropy nk3 test and nitropy fido2
  verify.
  Changelog
  * Check attestation signature after FIDO2 makeCredential by
    @robin-nitrokey in #626
  * Add TPM information to system information by @mmerklinger in
    [#628]
  * Bump minimum nethsm sdk version to 1.3.0 by @mmerklinger in
    [#629]
  * Update Nitrokey SDK to v0.3.0 and release v0.8.0 by
    @robin-nitrokey in #632</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743163200">- update to 0.8.1:
  * Update Nitrokey SDK to v0.3.1 and release v0.8.1 by
    @robin-nitrokey in #633</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746619200">- update to 0.8.2:
  This release improves handling of base32 strings in the nk3
  secrets subcommand, improves the PIV subcommand and adds support
  for custom CAs to the nethsm subcommand.
  Changelog
  * Fix typo in delete_credential documentation string. by @uzb-dev
    in #622
  * Piv cli improvements by @mmerklinger in #630
  * fix: append required base32 padding when handling unpadded otp
    secrets by @deheisenbug in #639
  * fix: allow lowercase base32 secrets input by @deheisenbug in
    [#641]
  * nethsm: Add --ca-certs option by @robin-nitrokey in #637</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746619201">- update to 0.8.3:
  This release changes the piv command to ignore unsupported
  smartcards and fixes the build of the release binaries for Linux
  and Windows.
  Changelog
  * Filter cards for NK3 ATR in PIV app by @mmerklinger in #642
  * Fix CI and release v0.8.3 by @robin-nitrokey in #646</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1747828800">- update to 0.8.4:
  * PIV certificate list properties by @mmerklinger in #648
  * Windows certificate mapping for PIV by @mmerklinger in #649</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748865600">- update to 0.8.5:
  This release fixes a bug in nk3 secrets when handling base32
  secrets if the length is a multiple of 8.
  * Changelog
  - helpers.b32padding: avoid adding 8 pads when none needed by
    @AmitAronovitch in #654</changelog>
  <changelog author="Felix Stegmeier &lt;felix.stegmeier@suse.com&gt;" date="1753185600">- update to 0.9.3:
  * nk3: Fix fido2 test case by @robin-nitrokey in #666
- update to 0.9.2:
  * Fix version subcommand by @robin-nitrokey in #665
- update to 0.9.1:
  * ci: Use bash for version check and release v0.9.1 by
    @robin-nitrokey in #663
- update to 0.9.0:
  * This release drops support for Python 3.9.
  * Migrate from flit to poetry by @robin-nitrokey in #651
  * Improve log file naming scheme by @robin-nitrokey in #659
  * Update fido2 and release v0.9.0 by @robin-nitrokey in #662</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754481600">- update to 0.10.0:
  * Remove obsolete nkfido2 commands by @robin-nitrokey in #670
  * Remove ecdsa dependency by @robin-nitrokey in #671
  * PIV: validate PINs to be 6 to 8 numbers by @sosthene-nitrokey
    in #675
  * Update Nitrokey SDK by @robin-nitrokey in #672
  * nk3: Deprecate secrets get and register aliases by
    @robin-nitrokey in #673</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- update to 0.11.0:
  * nk3 secrets: Print timestamp to stderr by @robin-nitrokey in #680
  * nk3: Add list-config-fields command by @robin-nitrokey in #681
  * fido2: Handle wrong PIN errors by @robin-nitrokey in #682
  * fido2 reset: Improve wording by @robin-nitrokey in #683
  * nk3 test: Support credential creation without PIN by @robin-nitrokey in #679
  * Log SDK versions by @robin-nitrokey in #689
  * nethsm: Add --debug flag by @robin-nitrokey in #690
  * Update for NetHSM v3 and release v0.11.0 by @robin-nitrokey in #691</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760788800">- update to 0.11.1:
  * Handle missing packages when logging package versions and release
    v0.11.1 by @robin-nitrokey in #693</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760961600">- add patches allow_cffi_v2_dependency.patch and
  allow_cryptography_v46.patch</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- update to 0.11.2:
  * Allow cffi v2 dependency by @robin-nitrokey in #695
  * Allow cryptography v46 by @robin-nitrokey in #697
  * PIV: Fix 9C key generation by @sosthene-nitrokey in #702
  * Update pyscard in lock file by @mmerklinger in #704
  * Add support for unauthenticated NetHSM shutdown by @mmerklinger
    in #703
- remove patches allow_cffi_v2_dependency.patch and
  allow_cryptography_v46.patch</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769428800">- update to 0.11.3:
  * chore(deps): pin hidapi to 0.14.0.post2 on linux by @LtdSauce
    in #708
  * nkpk: Add admin-app commands by @robin-nitrokey in #709
  * Update urllib3 to v2.6.0 by @robin-nitrokey in #713
  * nk3: Only allow factory-reset-app for opcard by @robin-nitrokey
    in #714
  * add RSA 3072 and 4096 for PIV by @n0xena in #715
  * nkpk: Add support for firmware updates by @robin-nitrokey in
    [#710]
  * Add test command to NetHSM cli by @mmerklinger in #718
  * Release v0.11.3 by @mmerklinger in #719</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773748800">- update to 0.11.4:
  * Add maintainer keys and check tag signatures in CI by
    @robin-nitrokey in #723
  * ci: Fetch tags for signature verification by @robin-nitrokey in
    [#725]
  * Update maintainers file by @robin-nitrokey in #724
  * Update signature key by @robin-nitrokey in #726
  * Update locked dependencies by @robin-nitrokey in #727
  * Update developer and packaging docs by @robin-nitrokey in #729
  * Add CODEOWNERS file by @robin-nitrokey in #732
  * Feat/better log file handling by @james-knippes in #733</changelog>
</package>
<package pkgid="d4830811e6448de1dc376b528dbe716687e13ddc177c5525c63d87fee8e21103b8bf6692f7187c1fec7112530d8b0ea75507ead4ae837a1dc3175333d4dd41b9" name="python313-bencode" arch="noarch">
  <version epoch="0" ver="4.0.0" rel="4.10"/>
  <changelog author="mardnh@gmx.de" date="1408795200">- Initial package release, version 1.0</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1493726400">- update to match bencode v1.2.0
  * See bencode v.2.0 for history.  This package is a simple fork of the metadata decode logic.
- add buildrequires: python-pbr which is used to provide reasonable defaults python's setup tool
- convert to python singlespec</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="pgajdos@suse.com" date="1559649600">- version update to 2.0.0
  * Support for bytes
  * File read/write functions: bread(fp), bwrite(data, fp)
  * Improved support for unicode strings
- added sources
  https://github.com/fuzeman/bencode.py/issues/12
  + BitTorrent-1.1.txt</changelog>
  <changelog author="pgajdos@suse.com" date="1560168000">- version update to 2.1.0
  * added: Type information
  * fixed: Inconsistent return behavior
- deleted sources
  - BitTorrent-1.1.txt (not needed)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1571054400">- Replace %fdupes -s with plain %fdupes; hardlinks are better.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678104000">- update to 4.0.0:
  * Improved API has been moved to the `bencodepy` package
  * Implemented backwards-compatible `bencode` package (#16)
  * Exception raised while attempting to decode strings on
    Python 3+
  * Improvements to the handling of binary values (#14)
  * Dropped support for Python 2.6, 3.4</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1747224000">- Convert to pip-based build</changelog>
</package>
<package pkgid="47dc1d5708aba062f92bc665a3df9a1673af01bd149e045e778481ca24a09441b35bd1ba912335b1524085790319f9ae13c4c56b0644df4b6b18c0a8bb231bb3" name="python313-gitlabcis" arch="noarch">
  <version epoch="0" ver="1.19.1" rel="21.5"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742558400">- update to 1.13.2:
  * Fix
  - fix: add dependency sbom to version control (#124) (d890086)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744113600">- update to 1.14.0:
  * Documentation
  - docs: add statement for benchmark contributions (3693222)
  * Feature
  - feat: Add group controls for source_code code_changes (&amp;2),
    (#125), (#118) (dac4b1e)
  * Fix
  - fix: Hardpin release dependencies (079c94a)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744286400">- update to 1.15.0:
  * Feature
  - feat: Add Group input type controls in build pipelines (&amp;2) &amp;
    (#125) (a5bca5d)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744804800">- update to 1.15.1:
  * Fix
  - fix: remove non-required detect cmd (#127) (14ff8da)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1752667200">- update to 1.15.3:
  * Fix
  - fix: Bundled renovate dependency bumps &amp; docs typo fixes
    (f04fd86)
- update to 1.15.2:
  * Fix
  - fix: Add verify arg to gql client (#128) (c50cec0)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754222400">- update to 1.15.4:
  * Fix
  - fix: Update dependency python-gitlab to v6.2.0 (b74b2d4)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755777600">- update to 1.15.8:
  * Fix
  - fix(deps): update dependency pre-commit to ~=4.3.0 (15dc9d0)
- update to 1.15.7:
  * Fix
  - fix(deps): update dependency coverage to v7.10.4 (64a0b87)
- update to 1.15.6:
  * Fix
  - fix(deps): update dependency setuptools-scm to v9 (673e173)
- update to 1.15.5:
  * Fix
  - fix(deps): update dependency coverage to v7.10.3 (18b3b42)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756123200">- update to 1.15.9:
  * Fix
  - fix(deps): update dependency coverage to v7.10.5 (1b3d1d0)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756382400">- update to 1.15.10:
  * Fix
  - fix(deps): update dependency python-gitlab to v6.3.0
    (88572b9)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756814400">- update to 1.15.12:
  * Fix
  - fix(deps): update dependency tox to ~=4.29.0 (20972ea)
- update to 1.15.11:
  * Fix
  - fix(deps): update dependency coverage to v7.10.6 (0289a97)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765800000">- update to 1.15.15 (.14 was not released):
  * Fix
  - fix: Remove support for python3.9 (2f51051)
- update to 1.15.13:
  * Fix
  - fix(deps): update dependency tox to ~=4.30.1 (f83a657)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765972800">- update to 1.15.16:
  * Fix
  - fix(deps): update dependency bandit to v1.9.2 (9075bc1)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766059200">- update to 1.15.17:
  * Fix
  - fix(deps): update dependency pipdeptree to v2.30.0 (97a5fa7)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766318400">- update to 1.15.19:
  * Fix
  - fix(deps): update dependency pytest-cov to v6.3.0 (5e2433a)
- update to 1.15.18:
  * Fix
  - fix(deps): update dependency pre-commit to ~=4.5.1 (c118b8c)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305600">- update to 1.15.21:
  * Fix
  - fix(deps): update dependency coverage to v7.13.1 (7296411)
- update to 1.15.20:
  * Fix
  - fix(deps): update dependency python-gitlab to v6.5.0
  (7596ae6)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- update to 1.15.22:
  * Fix
  - fix(deps): update dependency tox to ~=4.34.1 (f84ff07)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773662400">- update to 1.17.1:
  * Fix
  - fix: Remove instance error statements (37e7d3a)
- update to 1.17.0:
  * Feature
  - feat: Group support for artifacts checks (#125) (f1a5ed0)
- update to 1.16.0:
  * Feature
  - feat: Support GitLab inputs (#133 (closed)) (0c4b790)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773748800">- update to 1.18.0:
  * Feature
  - feat: Group support for dependency checks (#125) (92d4fbb)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773835200">- update to 1.19.0:
  * Feature
  - feat: Add protected branches at the group level (#125) (cbfb1f0)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775736000">- update to 1.19.1:
  * Documentation
  - docs: Update deployment group support statements (#125 (closed))
    (c236e5e)
  * Fix
  - fix: Object access in 5.1.3 secret_scan_deployment_config (#135
    (closed)) (7941c95)</changelog>
</package>
<package pkgid="75e7abace3f693b9ce5764c19438eba734401d05d55abb380a10e95083d964d5b9d59465507906f46477137931c86ba55dcfd0c430d78e55a7647d4203214a8b" name="python313-hidapi" arch="s390x">
  <version epoch="0" ver="0.14.0.post2" rel="2.30"/>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1648296000">- Initial version 0.11.0.post2 from upstream via py2pack</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1649073600">- Updating to upstream version 0.11.2</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1660737600">- Updating to upstream version 0.12.0.post2</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1674043200">- Updating to upstream version 0.13.1
  * expose version of bindings as hid.__version__
  * expose hid_version_str
  * Update cibuildwheel action to 2.11.2
  * bump hidapi to 0.13.1
  * bump github actions versions</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1705665600">- Updating to upstream version 0.14.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726574400">- Update to 0.14.0.post2</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1752840000">- drop BuildRequires on flit-core and poetry, build-backend is setuptools
- drop duplicate BuildRequires</changelog>
</package>
<package pkgid="f128a46380ff86c86d2bfa71303f2cbb86bb5d1dd4752bed0681c1c8ca52df2dcf9874056acbf076311914e5b1a4e78d8225aa0660d638cafd8c3aae962848ac" name="python313-hidapi-debuginfo" arch="s390x">
  <version epoch="0" ver="0.14.0.post2" rel="2.30"/>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1648296000">- Initial version 0.11.0.post2 from upstream via py2pack</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1649073600">- Updating to upstream version 0.11.2</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1660737600">- Updating to upstream version 0.12.0.post2</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1674043200">- Updating to upstream version 0.13.1
  * expose version of bindings as hid.__version__
  * expose hid_version_str
  * Update cibuildwheel action to 2.11.2
  * bump hidapi to 0.13.1
  * bump github actions versions</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1705665600">- Updating to upstream version 0.14.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726574400">- Update to 0.14.0.post2</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1752840000">- drop BuildRequires on flit-core and poetry, build-backend is setuptools
- drop duplicate BuildRequires</changelog>
</package>
<package pkgid="0e7ddf34e3479a0ab268614da7cb97831bd04c25465986b6fc991c80ae62bea0da59be68f5897d206b9ff2b0249d8d95c6f633f49ab96ce5f0f5fc1cde8b08d9" name="python313-keylime" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="121.3"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="71841a8c45b4399d4b6dd08ca50afc7b8ca6de0714a1159400bb61fc0d96fa59d1d96f2600588b22e1286f69951f9e0a62e4a7df888db9f2cd4dfc65426e8630" name="python313-nethsm" arch="noarch">
  <version epoch="0" ver="2.1.2" rel="25.2"/>
  <changelog author="Johannes Kastl &lt;kastl@b1-systems.de&gt;" date="1701086400">- new package python-nethsm, required by pynitrokey</changelog>
  <changelog author="Johannes Kastl &lt;kastl@b1-systems.de&gt;" date="1701172800">- update to 1.0.0:
  * Introduce custom type for Base64-encoded data by
    @robin-nitrokey in #104
  * Make system time optional in provision and restore by
    @robin-nitrokey in #105</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1714737600">- update to 1.1.0:
  * Support key import from PEM files (#99)
  * Add ignore_whitespace option to Base64.from_encoded (#108)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1721217600">- update to 1.2.0:
  * Features
  - Add support for namespaces (#110)
  * Bugfixes
  - Fix authentication for partial restore, i. e. on an
    operational instance (#120)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1722513600">- update to 1.2.1:
  * Bugfixes
  - Fix authentication for partial restore, i.e. on an
    operational instance (#124)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741953600">- update to 1.3.0:
  * Features
  - Add TPM attestation keys and platform configuration registers
    to SystemInfo (#128)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745582400">- update to 1.4.0:
  * Features
  - Add support for custom CA certificates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1750766400">- update to 1.4.1:
  Relax urllib3 version requirement to &gt;= 2, &lt;3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- update to 2.0.0:
  All changes:
  https://github.com/Nitrokey/nethsm-sdk-py/compare/v1.4.1...v2.0.0
  * Breaking Changes
  - Remove KeyType.EC_P224
  - Change arguments for NetHSM.csr and NetHSM.key_csr:
  - Require common_name argument
  - Require using keywords for all arguments (except for
    key_id)
  * Features
  - Add new enum values (requires NetHSM v3.0):
  - KeyType: EC_P256K1, BrainpoolP256, BrainpoolP384,
    BrainpoolP512
  - KeyMechanism: BIP340_Signature
  - SignMode: BIP340
  - TlsKeyType: BrainpoolP256, BrainpoolP384, BrainpoolP512
  - Add support for dots, dashes and underscores in user and key
    IDs (requires NetHSM v3.0)
  - Add NetHSM.move_key function for changing key IDs (requires
    NetHSM v3.0)
  - Add optional subject_alt_names argument for NetHSM.csr and
    NetHSM.key_csr (requires NetHSM v3.0)
  - Add optional prefix argument for NetHSM.list_keys (requires
    NetHSM v3.0)
  - Always show the message returned by the NetHSM as part of the
    error message</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- update to 2.0.1:
  * Add support for unauthenticated shutdown.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774612800">- update to 2.1.0:
  * Features
  - Add support for backup format v1.
  - Add support for clustering (requires NetHSM v4):
  - Add ClusterMember, InitialClusterMember and ClusterJoinData
    classes
  - Add add_cluster_member, list_cluster_members,
    set_cluster_member_urls, remove_cluster_member,
    join_cluster, get_cluster_ca_certificate,
    set_cluster_ca_certificate functions to NetHSM
  - Add support for IPv6 configuration (requires NetHSM v4):
  - Add Ipv6Config class
  - NetworkConfig: Add optional ipv6 field
  - NetHSM.set_network_config: Add optional ipv6 argument
  * Changes
  - Improve backup parsing speed
  - Use poetry as build backend</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778673600">- update to 2.1.1:
  * Bugfixes
  - Fix endpoint path in NetHSM.set_cluster_ca_certificate</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782216000">- update to 2.1.2:
  * Changes
  - Patch generated client to remove the python-dateutil dependency.</changelog>
</package>
<package pkgid="b5228c33fe17847887fa7cb8e2c34ceaa6776a3708f3c07b13206c1dfa589aac509cc4e04952501d77712862b74afa879e60e3ec417b461b6ac0f7381e0f2e72" name="python313-nitrokey" arch="noarch">
  <version epoch="0" ver="0.4.2" rel="24.7"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1731240000">- Initial package (0.2.3)</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1739880000">- Update to 0.2.4
  * The list methods of `NK3` and `NKPK` now only open the
    respective device, based on the USB vendor and product ID.
  * Use trusted publishing for PyPI.
  * Add support for `poetry-core` v2.
- Use Python 3.11 on SLE-15 by default</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742990400">- update to 0.3.0:
  * Bump minimum Python version from 3.9 to 3.9.2.
  * nitrokey.nk3.updates:
  - Remove UpdatePath, get_extra_information and
    get_finalization_wait_retries from public API.
  - Remove obsolete UpdateUi.request_repeated_update method.
  - Show warning when updating from bootloader mode and if the
    status command is not available.
  - Reboot devices in firmware mode before the update to make
    sure that the status is up to date.
  - Add Warning enum, show_warning and raise_warning methods to
    UpdateUi and ignore_warnings argument to UpdateUi.__init__.
  * Add support for updates to Nitrokey 3 firmware v1.8.2.
  * Add support for setting a minimum SDK version in firmware
    update containers.
  - Add an sdk field to nitrokey.trussed.FirmwareContainer.
  - Check SDK version in nitrokey.nk3.updates.Updater.update.
  - Add nitrokey.nk3.updates.Warning.SDK_VERSION variant.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743163200">- update to 0.3.1:
  * nitropy.nk3.updates: Remove reboot during update</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1743163201">- Add *.rpmlintrc to make rpmlint output useful.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1752062400">- update to 0.3.2:
  Add support fido2 v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754308800">- update to 0.4.0:
  * nitrokey.trussed.admin_app.InitStatus: add support for
    EXT_FLASH_NEED_REFORMAT
  * Use poetry-core v2 as build backend.
  * Bump minimum Python version to 3.10.
  * nitrokey.trussed.Model: Remove firmware_repository and
    firmware_pattern properties.
  * nitrokey.nk3.updates:
  - Move to nitrokey.trussed.updates and prepare adding NKPK
    support.
  - Return device status after an update.
  - Add model argument to get_firmware_update.
  - Add get_firmware_repository method.
  - Replace connection callbacks in Updater with DeviceHandler
    class.
- add version constraints for dependencies
- relax constraint on protobuf, see
  https://github.com/Nitrokey/nitrokey-sdk-py/issues/84#issuecomment-3158310783</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755777600">- update to 0.4.1:
  * Add support for protobuf v6.
  * nitrokey.trussed.admin_app: Fix validation of ConfigFieldType.U8
    values.
  * nitrokey.trussed: Add list and open functions.
  * nitrokey.trussed.updates:
  - Add default values for the image and update_version arguments
    for Updater.update.
  - Only call UpdateUi.confirm_extra_information if the passed list
    is not empty.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765281600">- update to 0.4.2:
  * nitrokey.trussed: Add optional model argument for list and open
    functions.</changelog>
</package>
<package pkgid="765667b9f1294b395739f0e659f50a20252b48f2582f57b2e1330d996eb80fe628bacf3edc10a46b21e746a9b2ff896b695b0a7fe78d09e8b0efa0da0b8c2699" name="python313-pwntools" arch="noarch">
  <version epoch="0" ver="4.15.0" rel="1.3"/>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1744804800">- Initial packaging at version 4.14.1</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1780142400">- Update to version 4.15.0:
  * Added context.gdb_binary to specify which gdb command to use.
  Useful to specify e.g. pwndbg.
  * Added tube.upload_manually to upload data to a shell using
  shell commands.
  * Improved libcdb handling of a local libc-database without
  relying on external services.
  * Cache the output of asm() to speed up subsequent exploit runs.
  (Disable the cache using context.cache_dir = None)
  * Removal of some CLI command scripts:
    Many of the CLI utilities coming with pwntools had ambiguous
  names and caused problems while packaging in different
  distributions. Most of the commands are deprecated now and
  print a warning suggesting to use pwn &lt;thecommand&gt; instead.</changelog>
</package>
<package pkgid="33b3b01bfdafe8b7cc53093836c380340dd9adacc66fd96c40852c9006f1caa50ce6b1666512769c858bfc6d626640dfee58a2d1fee68615cd5a186fb3ff660d" name="python313-pycrowdsec" arch="noarch">
  <version epoch="0" ver="0.0.5" rel="1.11"/>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742731200">- initial packaging</changelog>
</package>
<package pkgid="5454a58fd452494639ffc7824f3e5ab7e254e81e122bc575eb49c21fb2d238372535cfaa61b53d622c8339199f4ae69064835f18dfde2cd49f1bd13790e29bc0" name="python313-pykeepass" arch="noarch">
  <version epoch="0" ver="4.1.1.post1" rel="34.11"/>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1621771200">- Update to version 4.0.1:
  * No release notes.
- Drop python-pykeepass-fix-version.patch: incorporated upstream.
- Update dependency versions in keeping with upstream.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1653825600">- Update to version 4.0.2:
  * Added support for argon2id key derivation function.
  * Added credential expiry functions.
  * Fixes gh#libkeepass/pykeepass#223 - safe saving.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1655812800">- Update to version 4.0.3:
  * Add otp support.
  * Add debug_setup() function.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1685275200">- Update to version 4.0.4:
  * [gh#libkeepass/pykeepass#314] correctly handle binaries with
    no data.
  * [gh#libkeepass/pykeepass#265] check for keepass signature.
  * [gh#libkeepass/pykeepass#319] support pathlib for
    filename/keyfile.
  * [gh#libkeepass/pykeepass#194] added 'protected' arg to
    _set_string_field.
  * [gh#libkeepass/pykeepass#338] allow comma entry tag separator.
  * use official icon names from KeePass source and deprecate old
    icons.
  * added Entry.is_custom_property_protected().</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1686398400">- Update to version 4.0.5:
  * [gh#libkeepass/pykeepass#344] AttributeError when accessing
    Times with None value
  * use __hash__ when evaluating equality
  * use mtime/uuid for HistoryEntry hashing</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1693915200">- Update to 4.0.6:
  * fixed #350 - fixed all Python 2 deprecation FIXMEs (e.g. future, )
- Switch to pyproject macros.</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@proton.me&gt;" date="1711540800">- Update to 4.0.7:
  * PyKeePass has decrypt kwarg for accessing header info
  * added Entry.index and Entry.move for moving entries
  * added Entry.autotype_window setter
  * allow filename/keyfile to be file-like objects
  * drop dateutil dependency
  * switch to pyproject.toml
- add fix-upstream-test-case.patch for fixing an issue with
  missing pykeepass.kdbx_parsing</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1713096000">- Update to version 4.0.7.post1:
  * Fix gnome secrets crashes on expiration date check with
    missmatch of date format (gh#libkeepass/pykeepass#382).
  * Fix missing pykeepass.kdbx_parsing when built with modern
    tools (gh#libkeepass/pykeepass#378).
  * Remove shebang line from pykeepass/deprecated.py
    (gh#libkeepass/pykeepass#377).
- Drop fix-upstream-test-case.patch: upstream committed.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1722600000">- Update to version 4.1.0.post1:
  * [gh#libkeepass/pykeepass#389] add PyKeePassdatabase_name and
    database_description
  * [gh#libkeepass/pykeepass#390] fix pkg_resources dependency
    issue
  * [gh#libkeepass/pykeepass#391] Entry.tags returns empty list
    instead of None
  * [gh#libkeepass/pykeepass#395] set 'encoding' attribute when
    exporting as XML
  * [gh#libkeepass/pykeepass#383] parse datetimes using isoformat
    instead of strptime</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1744286400">- update to 4.1.1.post1:
  * [gh#libkeepass/pykeepass410] - support empty string as password</changelog>
</package>
<package pkgid="c7c411711d60f69178a68963f0471614fb90ba1f6f3bc99966c0dfae3f6fbde6743c1121128443655f86ef87bd01325bfdae963a82d0916a0ca06dc10978c742" name="python313-pynitrokey" arch="noarch">
  <version epoch="0" ver="0.11.4" rel="66.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1721217600">- update to 0.4.49:
  * nethsm: Add support for namespaces by @robin-nitrokey in #535</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1722513600">- update to 0.4.50:
  * nethsm: Improve namespace handling in add-user by
    @robin-nitrokey in #555
  * And random generator and config failures to init status bytes
    by @sosthene-nitrokey in #556
  * Require authentication for partial restore by @mmerklinger in
    [#554]</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1731240000">- update to 0.6.0:
  * Add PIV commands
  * Update prompt to more meaningful texts
- update to 0.5.0:
  * Use Nitrokey Python SDK
  * Remove spsdk from module list for version logging</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1736424000">- update to 0.7.2:
  - Update click and click-aliases dependencies by @robin-nitrokey
    in #597
  - Update cryptography dependency by @robin-nitrokey in #596
  - fido2: Limit VID/PID for Nitrokey FIDO2 commands by
    @robin-nitrokey in #604
  - Support Python 3.13 by @mmerklinger in #607
  - fido2 verify: Add support for Nitrokey Passkey by
    @robin-nitrokey in #603
- update to 0.7.1:
  - Restrict hidapi dependency and release v0.7.1 by
    @robin-nitrokey in #602
- update to 0.7.0:
  - Add confirm option to allow automated updates on nk3 devices by
    @anotherbridge in #575
  - Use config field availability information from the sdk by
    @sosthene-nitrokey in #577
  - Remove asn1crypto by @sosthene-nitrokey in #582
  - fixed URL for Nitrokey3/Linux/udev rules troubleshooting by
    @hardcodes in #586
  - Make pyscard dependency optional by @sosthene-nitrokey in #580
  - Fix deprecation warning with TripleDES by @sosthene-nitrokey in
    [#589]
  - remove unused .gitlab-ci.yml by @daringer in #590
  - Remove unused dependencies by @robin-nitrokey in #591</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1736510400">- update to 0.7.3:
  - Fix type hints for Python 3.11 and older by @robin-nitrokey in
    [#611]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1740484800">- update to 0.7.4:
  * Nethsm: Read host from NETHSM_HOST if not set on the command
    line (#617)
  * Nethsm: Fix add-key command (#627)
  * PIV: fix admin authentication with 1.8.1 (#625)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742990400">- update to 0.8.0:
  This release adds support for Nitrokey 3 firmware updates to
  v1.8.2, adds TPM information to the NetHSM system status and
  improves the FIDO2 tests in nitropy nk3 test and nitropy fido2
  verify.
  Changelog
  * Check attestation signature after FIDO2 makeCredential by
    @robin-nitrokey in #626
  * Add TPM information to system information by @mmerklinger in
    [#628]
  * Bump minimum nethsm sdk version to 1.3.0 by @mmerklinger in
    [#629]
  * Update Nitrokey SDK to v0.3.0 and release v0.8.0 by
    @robin-nitrokey in #632</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743163200">- update to 0.8.1:
  * Update Nitrokey SDK to v0.3.1 and release v0.8.1 by
    @robin-nitrokey in #633</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746619200">- update to 0.8.2:
  This release improves handling of base32 strings in the nk3
  secrets subcommand, improves the PIV subcommand and adds support
  for custom CAs to the nethsm subcommand.
  Changelog
  * Fix typo in delete_credential documentation string. by @uzb-dev
    in #622
  * Piv cli improvements by @mmerklinger in #630
  * fix: append required base32 padding when handling unpadded otp
    secrets by @deheisenbug in #639
  * fix: allow lowercase base32 secrets input by @deheisenbug in
    [#641]
  * nethsm: Add --ca-certs option by @robin-nitrokey in #637</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746619201">- update to 0.8.3:
  This release changes the piv command to ignore unsupported
  smartcards and fixes the build of the release binaries for Linux
  and Windows.
  Changelog
  * Filter cards for NK3 ATR in PIV app by @mmerklinger in #642
  * Fix CI and release v0.8.3 by @robin-nitrokey in #646</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1747828800">- update to 0.8.4:
  * PIV certificate list properties by @mmerklinger in #648
  * Windows certificate mapping for PIV by @mmerklinger in #649</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748865600">- update to 0.8.5:
  This release fixes a bug in nk3 secrets when handling base32
  secrets if the length is a multiple of 8.
  * Changelog
  - helpers.b32padding: avoid adding 8 pads when none needed by
    @AmitAronovitch in #654</changelog>
  <changelog author="Felix Stegmeier &lt;felix.stegmeier@suse.com&gt;" date="1753185600">- update to 0.9.3:
  * nk3: Fix fido2 test case by @robin-nitrokey in #666
- update to 0.9.2:
  * Fix version subcommand by @robin-nitrokey in #665
- update to 0.9.1:
  * ci: Use bash for version check and release v0.9.1 by
    @robin-nitrokey in #663
- update to 0.9.0:
  * This release drops support for Python 3.9.
  * Migrate from flit to poetry by @robin-nitrokey in #651
  * Improve log file naming scheme by @robin-nitrokey in #659
  * Update fido2 and release v0.9.0 by @robin-nitrokey in #662</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754481600">- update to 0.10.0:
  * Remove obsolete nkfido2 commands by @robin-nitrokey in #670
  * Remove ecdsa dependency by @robin-nitrokey in #671
  * PIV: validate PINs to be 6 to 8 numbers by @sosthene-nitrokey
    in #675
  * Update Nitrokey SDK by @robin-nitrokey in #672
  * nk3: Deprecate secrets get and register aliases by
    @robin-nitrokey in #673</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- update to 0.11.0:
  * nk3 secrets: Print timestamp to stderr by @robin-nitrokey in #680
  * nk3: Add list-config-fields command by @robin-nitrokey in #681
  * fido2: Handle wrong PIN errors by @robin-nitrokey in #682
  * fido2 reset: Improve wording by @robin-nitrokey in #683
  * nk3 test: Support credential creation without PIN by @robin-nitrokey in #679
  * Log SDK versions by @robin-nitrokey in #689
  * nethsm: Add --debug flag by @robin-nitrokey in #690
  * Update for NetHSM v3 and release v0.11.0 by @robin-nitrokey in #691</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760788800">- update to 0.11.1:
  * Handle missing packages when logging package versions and release
    v0.11.1 by @robin-nitrokey in #693</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760961600">- add patches allow_cffi_v2_dependency.patch and
  allow_cryptography_v46.patch</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763467200">- update to 0.11.2:
  * Allow cffi v2 dependency by @robin-nitrokey in #695
  * Allow cryptography v46 by @robin-nitrokey in #697
  * PIV: Fix 9C key generation by @sosthene-nitrokey in #702
  * Update pyscard in lock file by @mmerklinger in #704
  * Add support for unauthenticated NetHSM shutdown by @mmerklinger
    in #703
- remove patches allow_cffi_v2_dependency.patch and
  allow_cryptography_v46.patch</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769428800">- update to 0.11.3:
  * chore(deps): pin hidapi to 0.14.0.post2 on linux by @LtdSauce
    in #708
  * nkpk: Add admin-app commands by @robin-nitrokey in #709
  * Update urllib3 to v2.6.0 by @robin-nitrokey in #713
  * nk3: Only allow factory-reset-app for opcard by @robin-nitrokey
    in #714
  * add RSA 3072 and 4096 for PIV by @n0xena in #715
  * nkpk: Add support for firmware updates by @robin-nitrokey in
    [#710]
  * Add test command to NetHSM cli by @mmerklinger in #718
  * Release v0.11.3 by @mmerklinger in #719</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773748800">- update to 0.11.4:
  * Add maintainer keys and check tag signatures in CI by
    @robin-nitrokey in #723
  * ci: Fetch tags for signature verification by @robin-nitrokey in
    [#725]
  * Update maintainers file by @robin-nitrokey in #724
  * Update signature key by @robin-nitrokey in #726
  * Update locked dependencies by @robin-nitrokey in #727
  * Update developer and packaging docs by @robin-nitrokey in #729
  * Add CODEOWNERS file by @robin-nitrokey in #732
  * Feat/better log file handling by @james-knippes in #733</changelog>
</package>
<package pkgid="1196d0b5e77dd1056f0e1fa964304f17f1b5c1a6932afe3fdf6db6a0e4a2f8400ee602e73e104e214c6aea0c6cce39518510aa9b9f801a603c69cb0a1ad73a80" name="python313-pyrage" arch="s390x">
  <version epoch="0" ver="1.2.3" rel="5.213"/>
  <changelog author="Robert Munteanu &lt;rombert@apache.org&gt;" date="1715169600">- Initial package with version 1.1.2</changelog>
  <changelog author="Robert Munteanu &lt;rombert@apache.org&gt;" date="1734955200">- Update to version 1.2.3 (boo#1234744)</changelog>
</package>
<package pkgid="ef20b9c8f70074dc70244b734c0b54649c5f597636c39e6480fa5db3663549471a6823e97d9981dc5c16b71d6c734832f0a6cfcaf312dd83fbec6bebc2c0795e" name="python313-pyscard" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="51.23"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1680868800">- Update to version 2.0.7
  * do not include the generated HTML documentation in the archive
- Update to version 2.0.6
  * handle SCARD_E_NO_SERVICE on Windows (on last reader removal)
  * add support of MSYS2/mingw environment on Windows
  * improve documentation
  * minor changes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707307200">- Add patch:
  * 0001-Remove-use-of-imp-module-for-wx-GUI.patch
    Fix build for python &gt;= 3.12</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1709985600">- Update to version 2.0.8
  * Make CardMonitor() thread safe on Python 3.12
  * Add hresult value in exceptions
  * Improve documentation
  * Check swig is installed on build
  * Remove use of imp module for wx (GUI)
  * Makefile: modernize use of setup.py
- Drop not longer needed patch:
  * 0001-Remove-use-of-imp-module-for-wx-GUI.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1712404800">- Update to version 2.0.9
  * fix a bug with CardRequestTimeoutException introduced in 2.0.8
  * Minor changes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1717416000">- Update to version 2.0.10
  * CardMonitoringThread(): do not catch unexpected exceptions</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1725883200">- Update to version 2.1.1
  * Fix a regression introduced in 2.1.0
- Update to version 2.1.0
  * PCSCCardRequest: fix active polling (was a 0.1 sec loop)
  * Fix use of undefined variable 'hresult' in exceptions
  * Fix print() use in pyscard user’s guide
  * Fix deprecation warnings
  * Minor changes
  * some more pylint-detected fixes.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1729425600">- Update to version 2.2.0
  * PCSCCardRequest:
  - handle KeyboardInterrupt in waitforcard() &amp; waitforcardevent()
  - use a local PC/SC context to avoid locks
  * smartcard.util.padd(): do NOT modify the input parameter
  * CardMonitoring: a timeout exception IS expected
  * Fix pydoctor documentation
  * wx: fix module and examples
  * Remove Python 2 conditional code
  * Test and improve the synchronization code
  * Test and update the `Observer.py` code
  * Remove `ClassLoader.py`
  * Migrate a `src/` layout
  * Migrate test/* from unittest to pytest
  * Add missing GSM 03.38 symbols for decoding
  * Support only Python 3.9 and higher
  * Remove the Python 2.x-only Pyro dependency
  * Migrate CI to use the official Coveralls action
  * Standardize local and CI testing to use tox
  * Build wheels in CI for all supported Python versions
  * Build the docs as a part of the test suite
  * Begin to add type annotations to the package
  * Deprecate the `HexListToBinString`, `BinStringToHexList`,
    `hl2bs`, and `bs2hl` utility functions
  * Support "64" as an ATR baud rate adjustment integer
    (ISO 7816-3 2006)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1736856000">- Update to version 2.2.1
  * waitforcardevent(): do not miss events between 2 calls.
  * Test, fix, and simplify ATR parsing.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1749729600">- Use pyproject macros to build and install.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1750248000">- Update to version 2.2.2
  * add .release() method to CardConnection &amp; PCSCCardRequest
  * add context manager protocol to CardRequest &amp; CardService
  * fix some parallel execution issues
  * PCSCCardRequest: correctly initialize waitforcardevent()
  * user-guide: Update documentation</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1757678400">- Update to version 2.3.0
  * PCSCCardRequest: fix waitforcardevent() initialization.
  * PCSCCardConnection: raise exception for .connect() after
    .release()
  * Fix race issue in SCardListReaders() and
    SCardListReaderGroups().
  * Use SCARD_AUTOALLOCATE where defined.
  * Use SCardFreeMemory() on Unix.
  * CardMonitoringThread: Fix a thread safeness issue.
  * fix/ignore all pylint warnings.
  * Minor changes.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1761739200">- Update to version 2.3.1
  * Add support of SWIG 4.4.0
  * Minor changes</changelog>
</package>
<package pkgid="7d90a3a462aee417e7d174a116214195c1d862bcc14510006de480b485f2e5d4923d037a52e640a42bf76039ab1e079d860fb7a308cc7121ca58c27237477bef" name="python313-pyscard-debuginfo" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="51.23"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1680868800">- Update to version 2.0.7
  * do not include the generated HTML documentation in the archive
- Update to version 2.0.6
  * handle SCARD_E_NO_SERVICE on Windows (on last reader removal)
  * add support of MSYS2/mingw environment on Windows
  * improve documentation
  * minor changes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707307200">- Add patch:
  * 0001-Remove-use-of-imp-module-for-wx-GUI.patch
    Fix build for python &gt;= 3.12</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1709985600">- Update to version 2.0.8
  * Make CardMonitor() thread safe on Python 3.12
  * Add hresult value in exceptions
  * Improve documentation
  * Check swig is installed on build
  * Remove use of imp module for wx (GUI)
  * Makefile: modernize use of setup.py
- Drop not longer needed patch:
  * 0001-Remove-use-of-imp-module-for-wx-GUI.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1712404800">- Update to version 2.0.9
  * fix a bug with CardRequestTimeoutException introduced in 2.0.8
  * Minor changes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1717416000">- Update to version 2.0.10
  * CardMonitoringThread(): do not catch unexpected exceptions</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1725883200">- Update to version 2.1.1
  * Fix a regression introduced in 2.1.0
- Update to version 2.1.0
  * PCSCCardRequest: fix active polling (was a 0.1 sec loop)
  * Fix use of undefined variable 'hresult' in exceptions
  * Fix print() use in pyscard user’s guide
  * Fix deprecation warnings
  * Minor changes
  * some more pylint-detected fixes.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1729425600">- Update to version 2.2.0
  * PCSCCardRequest:
  - handle KeyboardInterrupt in waitforcard() &amp; waitforcardevent()
  - use a local PC/SC context to avoid locks
  * smartcard.util.padd(): do NOT modify the input parameter
  * CardMonitoring: a timeout exception IS expected
  * Fix pydoctor documentation
  * wx: fix module and examples
  * Remove Python 2 conditional code
  * Test and improve the synchronization code
  * Test and update the `Observer.py` code
  * Remove `ClassLoader.py`
  * Migrate a `src/` layout
  * Migrate test/* from unittest to pytest
  * Add missing GSM 03.38 symbols for decoding
  * Support only Python 3.9 and higher
  * Remove the Python 2.x-only Pyro dependency
  * Migrate CI to use the official Coveralls action
  * Standardize local and CI testing to use tox
  * Build wheels in CI for all supported Python versions
  * Build the docs as a part of the test suite
  * Begin to add type annotations to the package
  * Deprecate the `HexListToBinString`, `BinStringToHexList`,
    `hl2bs`, and `bs2hl` utility functions
  * Support "64" as an ATR baud rate adjustment integer
    (ISO 7816-3 2006)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1736856000">- Update to version 2.2.1
  * waitforcardevent(): do not miss events between 2 calls.
  * Test, fix, and simplify ATR parsing.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1749729600">- Use pyproject macros to build and install.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1750248000">- Update to version 2.2.2
  * add .release() method to CardConnection &amp; PCSCCardRequest
  * add context manager protocol to CardRequest &amp; CardService
  * fix some parallel execution issues
  * PCSCCardRequest: correctly initialize waitforcardevent()
  * user-guide: Update documentation</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1757678400">- Update to version 2.3.0
  * PCSCCardRequest: fix waitforcardevent() initialization.
  * PCSCCardConnection: raise exception for .connect() after
    .release()
  * Fix race issue in SCardListReaders() and
    SCardListReaderGroups().
  * Use SCARD_AUTOALLOCATE where defined.
  * Use SCardFreeMemory() on Unix.
  * CardMonitoringThread: Fix a thread safeness issue.
  * fix/ignore all pylint warnings.
  * Minor changes.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1761739200">- Update to version 2.3.1
  * Add support of SWIG 4.4.0
  * Minor changes</changelog>
</package>
<package pkgid="d3d8eb284a482e92d1c7751797ee6bfe5e946e460da6be1c7a77a805cc62ba531cf20aa039582b75af28ce3c20cf44b7fecbeb08ae38b49e4d3a96ebbfd17568" name="python313-qt-material" arch="noarch">
  <version epoch="0" ver="2.17" rel="12.5"/>
  <changelog author="munix9@googlemail.com" date="1772193600">- update to version 2.17</changelog>
</package>
<package pkgid="e52ad16f9297641318df239d1d78d9931e6fe54a2f9b8d7986032d082693077c38352ec4983e563fb3729730c3d39887439874a38d4193190436613d7bca0083" name="python313-ropgadget" arch="noarch">
  <version epoch="0" ver="7.7" rel="3.5"/>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1745323200">- Initial packaging at version 7.6</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1773316800">- Update to version 7.7:
  * Wrap disassembly in try/except to handle invalid instruction
  bytes
  * Fix callPreceded filtering
  * Fix sintax warnings for python 3.13</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1778414400">- Update .spec to use libalternatives in recent openSUSE versions</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1778932800">- Replace placeholder with actual name</changelog>
</package>
<package pkgid="5c4f41386380a4815ef8733fc02962a6588d1c25bb9cc60b86dada22fca61355c27e96acfef13c6522486c18bc9bcdf9dcde22a26dd64c97dae66b6ababbb317" name="python313-systemd" arch="s390x">
  <version epoch="0" ver="235" rel="41.64"/>
  <changelog author="sebix+novell.com@sebix.at" date="1507377600">- singlespec</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1509969600">- iso-c-90.patch added to fix building on SLE12-SP3</changelog>
  <changelog author="mpluskal@suse.com" date="1510660800">- Use more of python building macros
- Do not build documentation (build is broken if /usr/bin/python is
  not present anyways)
- Run spec-cleaner</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580644800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1656849600">- 0002-reader-make-PY_SSIZE_T_CLEAN.patch added to fix boo#1200686
  reader: make PY_SSIZE_T_CLEAN</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1656849601">- Remove exclude-tests-on-obs.patch, this is not the way how to
  do it, besides %python_exec setup.py check doesn't the test
  suite.
- Make tests running properly again</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1660737600">- Update to version 235:
  * Adapt the rename of systemd-activate to
    systemd-socket-activate performed in systemd 230.
  * Support for sd_listen_fds_with_names added in systemd 227.
  * Support for sd_journal_get_cutoff_realtime_usec added in
    systemd 186.
  * Make the Reader PY_SSIZE_T_CLEAN for py3.10 compatibility.
  * id128: update for systemd-243 compatibility and other fixes.
  * C syntax modernization. A minimum of C99 is assumed.
  * Fix seek_realtime to work with timezone aware date on Python 3.
  * journal: add namespace support.
  * Fixes for memory leaks and documentation.
  * Support for Python 2 will be removed after this release.
- Remove upstreamed 0002-reader-make-PY_SSIZE_T_CLEAN.patch.
- Skip two failing tests (gh#systemd/python-systemd#118)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1660737601">- Add OBS_missing_etc_machine_id.patch to partially fix
  gh#systemd/python-systemd#118.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1686484800">- Add %{?sle15_python_module_pythons}</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715601600">- Add fix_test_reader_this_machine.patch to make
  test_reader_this_machine pass in the limited build environment.
- Do not pull in whole systemd, when just libsystemd0 is enough
  (bsc#1215538).</changelog>
</package>
<package pkgid="ff96565a4b630f786a40b5b281e3881bba80c6ede6813517d118475f2ce64b2dd4f18707b584b90a77e57ececec7f73baa3a625796b37a4710c8c71ad063113a" name="python313-systemd-debuginfo" arch="s390x">
  <version epoch="0" ver="235" rel="41.64"/>
  <changelog author="sebix+novell.com@sebix.at" date="1507377600">- singlespec</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1509969600">- iso-c-90.patch added to fix building on SLE12-SP3</changelog>
  <changelog author="mpluskal@suse.com" date="1510660800">- Use more of python building macros
- Do not build documentation (build is broken if /usr/bin/python is
  not present anyways)
- Run spec-cleaner</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580644800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1656849600">- 0002-reader-make-PY_SSIZE_T_CLEAN.patch added to fix boo#1200686
  reader: make PY_SSIZE_T_CLEAN</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1656849601">- Remove exclude-tests-on-obs.patch, this is not the way how to
  do it, besides %python_exec setup.py check doesn't the test
  suite.
- Make tests running properly again</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1660737600">- Update to version 235:
  * Adapt the rename of systemd-activate to
    systemd-socket-activate performed in systemd 230.
  * Support for sd_listen_fds_with_names added in systemd 227.
  * Support for sd_journal_get_cutoff_realtime_usec added in
    systemd 186.
  * Make the Reader PY_SSIZE_T_CLEAN for py3.10 compatibility.
  * id128: update for systemd-243 compatibility and other fixes.
  * C syntax modernization. A minimum of C99 is assumed.
  * Fix seek_realtime to work with timezone aware date on Python 3.
  * journal: add namespace support.
  * Fixes for memory leaks and documentation.
  * Support for Python 2 will be removed after this release.
- Remove upstreamed 0002-reader-make-PY_SSIZE_T_CLEAN.patch.
- Skip two failing tests (gh#systemd/python-systemd#118)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1660737601">- Add OBS_missing_etc_machine_id.patch to partially fix
  gh#systemd/python-systemd#118.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1686484800">- Add %{?sle15_python_module_pythons}</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715601600">- Add fix_test_reader_this_machine.patch to make
  test_reader_this_machine pass in the limited build environment.
- Do not pull in whole systemd, when just libsystemd0 is enough
  (bsc#1215538).</changelog>
</package>
<package pkgid="6250f6dfdfe42de5a5e292a7222b9904b74188ecca5d51b0b58f32056d287eb5491d62d573d3be561634af6ebc2397462a575447bb8d0c28a9251e595465bce5" name="python313-wafw00f" arch="noarch">
  <version epoch="0" ver="2.4.2" rel="9.4"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1625486400">- First import from upstream</changelog>
  <changelog author="Matthias Eliasson &lt;elimat@opensuse.org&gt;" date="1661342400">- Update to version 2.2.0
  * New features like docker support and output format fixes.
  * Several new bug fixes and stability to the existing code.
  * Few new WAF detections.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1767355200">- update to 2.3.2:
  * New WAF detections:
  * Baffin Bay
  * Link11 WAAP
  * A10 Networks WAF
  * PanYun WAF
  * More specific cookie matching for F5 ASM
- update to 2.3.1:
  * setup.py installs wafw00f binary twice
- update to 2.3.0:
  * We dropped support for Python 2 completely.
  * PIP 24.3 compatibility.
  * Couple of new interesting WAFs detections!</changelog>
  <changelog author="munix9@googlemail.com" date="1780401600">- Update to version 2.4.2:
  * Removes setup.py to fix tool installations when building locally.
  * Updated the latest supported versions of Python (≥3.10)
  * New WAF signature updates:
  - Vercel WAF
  - Reflected Networks WAF
  * Improvements to existing signatures:
  - Tencent WAF
- Update to version 2.4.1:
  * Fix timeout enforcement during response body reading to properly
    handle slow streaming servers.
  * Timeout enforcement: The --timeout parameter is now properly
    enforced during response body reading, not just during connection
    establishment. This fixes the issue where slow-streaming servers
    could cause scans to take over 2 minutes instead of respecting
    the user-specified timeout.
  * Track elapsed time during chunk reading loop
  * Break out of reading loop if timeout is exceeded during reading
  * Add test documenting timeout enforcement behavior
- Update to version 2.4.0:
  * New WAF detections
  - Anubis (Techaro)
  - Scutum (Secure Sky Technology)
  - 360PanYun (360 Technologies)
  - ThreatX (A10 Networks)
  - Link11 WAAP
  * Improvements
  - Fastly detection improvements (tighter regex for X-Served-By)
  - Added pytest test framework with 45 tests
  - Added pyproject.toml for modern Python packaging
  - Removed pluginbase dependency (use stdlib importlib)
  * Fixes
  - Fixed infinite hang on streaming responses (#246)
  - Improved -t option help text (#243)
  * Other
  - Updated copyright years to 2026
  - Updated Python requirement to 3.8+
- Add fix-request-path.patch based on commit af3eca1:
  Noticed that path attacks like LFI were being ignored. Changed
  the way requests were done to ensure that the path is not normalized
  by creating a prepared request and overwrite the url.
- Use source from github to get complete tests
- Switch to wheel/pip build
- Add %check/%pytest
- Clean up spec file</changelog>
</package>
<package pkgid="279d2ef5868acb6e105290d25c8dc42514c68e9005cf3b07c3dc78b511f3e4a8f223295ebba967ad847e648a776a59c24087be7d837d4b03362f0da53f7f3956" name="python313-wfuzz" arch="noarch">
  <version epoch="0" ver="3.1.0" rel="14.12"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1624449600">- First version of wfuzz package.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1624622400">- Removed shebang to fix rpmlint warning</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1639656000">- Fixed URL in spec file</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1675252800">- Fixed a problem preventing this package to build in Factory</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1751025600">- Use pyproject macros to build and install.
- List directories under sitelib explicitly.</changelog>
</package>
<package pkgid="795411de8a6bb067868c6e16a62d8012f5b3ee4f1dd4f90e1658688250e07ecf8b6fada9ecbfbf5fbbc9a317895466f15d2a82fd6139d54b15b5611860ac2109" name="python314-bencode" arch="noarch">
  <version epoch="0" ver="4.0.0" rel="4.10"/>
  <changelog author="mardnh@gmx.de" date="1408795200">- Initial package release, version 1.0</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1493726400">- update to match bencode v1.2.0
  * See bencode v.2.0 for history.  This package is a simple fork of the metadata decode logic.
- add buildrequires: python-pbr which is used to provide reasonable defaults python's setup tool
- convert to python singlespec</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="pgajdos@suse.com" date="1559649600">- version update to 2.0.0
  * Support for bytes
  * File read/write functions: bread(fp), bwrite(data, fp)
  * Improved support for unicode strings
- added sources
  https://github.com/fuzeman/bencode.py/issues/12
  + BitTorrent-1.1.txt</changelog>
  <changelog author="pgajdos@suse.com" date="1560168000">- version update to 2.1.0
  * added: Type information
  * fixed: Inconsistent return behavior
- deleted sources
  - BitTorrent-1.1.txt (not needed)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1571054400">- Replace %fdupes -s with plain %fdupes; hardlinks are better.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678104000">- update to 4.0.0:
  * Improved API has been moved to the `bencodepy` package
  * Implemented backwards-compatible `bencode` package (#16)
  * Exception raised while attempting to decode strings on
    Python 3+
  * Improvements to the handling of binary values (#14)
  * Dropped support for Python 2.6, 3.4</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1747224000">- Convert to pip-based build</changelog>
</package>
<package pkgid="6af50bd6646d77950b89aef3f662b2c25c0ddef2e3b11b034d5304269f510492a1471027a5e714a9b36436db57f21416840004d521f273ef0e78f9e3ac356010" name="python314-gitlabcis" arch="noarch">
  <version epoch="0" ver="1.19.1" rel="21.5"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742558400">- update to 1.13.2:
  * Fix
  - fix: add dependency sbom to version control (#124) (d890086)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744113600">- update to 1.14.0:
  * Documentation
  - docs: add statement for benchmark contributions (3693222)
  * Feature
  - feat: Add group controls for source_code code_changes (&amp;2),
    (#125), (#118) (dac4b1e)
  * Fix
  - fix: Hardpin release dependencies (079c94a)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744286400">- update to 1.15.0:
  * Feature
  - feat: Add Group input type controls in build pipelines (&amp;2) &amp;
    (#125) (a5bca5d)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744804800">- update to 1.15.1:
  * Fix
  - fix: remove non-required detect cmd (#127) (14ff8da)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1752667200">- update to 1.15.3:
  * Fix
  - fix: Bundled renovate dependency bumps &amp; docs typo fixes
    (f04fd86)
- update to 1.15.2:
  * Fix
  - fix: Add verify arg to gql client (#128) (c50cec0)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754222400">- update to 1.15.4:
  * Fix
  - fix: Update dependency python-gitlab to v6.2.0 (b74b2d4)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755777600">- update to 1.15.8:
  * Fix
  - fix(deps): update dependency pre-commit to ~=4.3.0 (15dc9d0)
- update to 1.15.7:
  * Fix
  - fix(deps): update dependency coverage to v7.10.4 (64a0b87)
- update to 1.15.6:
  * Fix
  - fix(deps): update dependency setuptools-scm to v9 (673e173)
- update to 1.15.5:
  * Fix
  - fix(deps): update dependency coverage to v7.10.3 (18b3b42)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756123200">- update to 1.15.9:
  * Fix
  - fix(deps): update dependency coverage to v7.10.5 (1b3d1d0)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756382400">- update to 1.15.10:
  * Fix
  - fix(deps): update dependency python-gitlab to v6.3.0
    (88572b9)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1756814400">- update to 1.15.12:
  * Fix
  - fix(deps): update dependency tox to ~=4.29.0 (20972ea)
- update to 1.15.11:
  * Fix
  - fix(deps): update dependency coverage to v7.10.6 (0289a97)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765800000">- update to 1.15.15 (.14 was not released):
  * Fix
  - fix: Remove support for python3.9 (2f51051)
- update to 1.15.13:
  * Fix
  - fix(deps): update dependency tox to ~=4.30.1 (f83a657)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765972800">- update to 1.15.16:
  * Fix
  - fix(deps): update dependency bandit to v1.9.2 (9075bc1)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766059200">- update to 1.15.17:
  * Fix
  - fix(deps): update dependency pipdeptree to v2.30.0 (97a5fa7)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766318400">- update to 1.15.19:
  * Fix
  - fix(deps): update dependency pytest-cov to v6.3.0 (5e2433a)
- update to 1.15.18:
  * Fix
  - fix(deps): update dependency pre-commit to ~=4.5.1 (c118b8c)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768305600">- update to 1.15.21:
  * Fix
  - fix(deps): update dependency coverage to v7.13.1 (7296411)
- update to 1.15.20:
  * Fix
  - fix(deps): update dependency python-gitlab to v6.5.0
  (7596ae6)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769515200">- update to 1.15.22:
  * Fix
  - fix(deps): update dependency tox to ~=4.34.1 (f84ff07)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773662400">- update to 1.17.1:
  * Fix
  - fix: Remove instance error statements (37e7d3a)
- update to 1.17.0:
  * Feature
  - feat: Group support for artifacts checks (#125) (f1a5ed0)
- update to 1.16.0:
  * Feature
  - feat: Support GitLab inputs (#133 (closed)) (0c4b790)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773748800">- update to 1.18.0:
  * Feature
  - feat: Group support for dependency checks (#125) (92d4fbb)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773835200">- update to 1.19.0:
  * Feature
  - feat: Add protected branches at the group level (#125) (cbfb1f0)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1775736000">- update to 1.19.1:
  * Documentation
  - docs: Update deployment group support statements (#125 (closed))
    (c236e5e)
  * Fix
  - fix: Object access in 5.1.3 secret_scan_deployment_config (#135
    (closed)) (7941c95)</changelog>
</package>
<package pkgid="1794592c5b1a962cb30112487f1f3b27ef785741e188f34f9646300073c5cd039effe395a572213326eb6cf6aac504ff91975833e41195d2a6b712eb89f966ea" name="python314-hidapi" arch="s390x">
  <version epoch="0" ver="0.14.0.post2" rel="2.30"/>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1648296000">- Initial version 0.11.0.post2 from upstream via py2pack</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1649073600">- Updating to upstream version 0.11.2</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1660737600">- Updating to upstream version 0.12.0.post2</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1674043200">- Updating to upstream version 0.13.1
  * expose version of bindings as hid.__version__
  * expose hid_version_str
  * Update cibuildwheel action to 2.11.2
  * bump hidapi to 0.13.1
  * bump github actions versions</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1705665600">- Updating to upstream version 0.14.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726574400">- Update to 0.14.0.post2</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1752840000">- drop BuildRequires on flit-core and poetry, build-backend is setuptools
- drop duplicate BuildRequires</changelog>
</package>
<package pkgid="4900260761b9de9adc341837333936a7b022d1eebbb9514a94a3fee03fea945a3400624006198b70b5a19be5c5310197c6444ed2d1b420678e5910d407543dcb" name="python314-hidapi-debuginfo" arch="s390x">
  <version epoch="0" ver="0.14.0.post2" rel="2.30"/>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1648296000">- Initial version 0.11.0.post2 from upstream via py2pack</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1649073600">- Updating to upstream version 0.11.2</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1660737600">- Updating to upstream version 0.12.0.post2</changelog>
  <changelog author="Scott Bradnick &lt;scott.bradnick@suse.com&gt;" date="1674043200">- Updating to upstream version 0.13.1
  * expose version of bindings as hid.__version__
  * expose hid_version_str
  * Update cibuildwheel action to 2.11.2
  * bump hidapi to 0.13.1
  * bump github actions versions</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1705665600">- Updating to upstream version 0.14.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726574400">- Update to 0.14.0.post2</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1752840000">- drop BuildRequires on flit-core and poetry, build-backend is setuptools
- drop duplicate BuildRequires</changelog>
</package>
<package pkgid="33a6cc9eb1f4a2ae3e92db3c8f5b8109b940bab7f84c292bfd6184ecab3a2d24a11b4ddf044911ecd8a40e9dc749c9c082533d42413a8668f4e1c0c7ddf2819a" name="python314-keylime" arch="noarch">
  <version epoch="0" ver="7.14.3" rel="121.3"/>
  <changelog author="aplanas@suse.com" date="1692878400">- Update to version v7.5.0 (CVE-2023-38201, bsc#1213314):
  * Monthly release (7.5.0)
  * Fix for CVE-2023-38201 (Security Advisory GHSA-f4r5-q63f-gcww)
  * verifier: should read parameters from verifier.conf only
  * tests: Correctly configure kernel IMA
  * Handle session close using a session manager
  * requirements.txt: update the need sqlalchemy version to 1.3.12 and above.
  * elchecking/example: add ignores for EV_PLATFORM_CONFIG_FLAGS
  * tpm_cert_store: add the Alibaba Cloud vTPM EK x509 cert
  * installer.sh: use the -i parameter to set the default binding and listening IP about the agent, verifier, and registrar server is 127.0.0.1  or 0.0.0.0
  * installer.sh: remove the unused command line params
  * Update container build workflow actions
  * mba: Manage the number of times measure boot attestation is done.
  * codestyle: Fix access to possibly not available package 'rpm' (pyright)
  * templates/2.0/mapping.json: fix the default registrar_port error in the verifier config</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1695988800">- M2Crypto is not used anymore.
- Clean up SPEC file.</changelog>
  <changelog author="aplanas@suse.com" date="1696248000">- Update to version v7.6.0:
  * Monthly release (7.6.0)
  * test-requirements: remove types-atomicwrites
  * Fixed an inappropriate test expression to remove a logical short circuit
  * remove prov_db_filename from config
  * Fix for key parse error in tpm2_objects
  * Fix mapping.json path in the comments
  * ima: Emit a warning when a file signature could not be parsed
  * Initial PR to add support for IDevID and IAK
  * Implement automatic agent API version bump
  * tests: avoid fail when epel-release is installed</changelog>
  <changelog author="aplanas@suse.com" date="1699012800">- Update to version v7.7.0:
  * Monthly release (7.7.0)
  * tpm_cert_store: add the Nationz TPM EK x509 cert
  * codestyle: Have mypy ignore import of PoolManager
  * codestyle: Suppress pyright errors on methods that do exist
  * codestyle: Annotate some string constances (pyright)
  * types: Fix a deprecation warning from recent cryptography
  * create_policy: Set the generator value to LegacyAllowList
  * verifier: Compare generator against enum rather than magic '1'
  * Fix pylint C0103 (naming) errors in some files
  * crypto: Fix a pyright issue
  * test: Fix a pyright issue</changelog>
  <changelog author="aplanas@suse.com" date="1701777600">- Update to version v7.8.0:
  * Monthly release (7.8.0)
  * address marcio and stefan comments
  * Add documentation for IAK and IDevID
  * templates/2.1: Fix enable_iak_idevid in agent template
  * support for user mode in run-test.sh
  * docs: fix small typo in threat model
  * ca_impl_openssl: support CRL distribution point from config
  * ca_util: add import functions for private keys
  * Enable test functional/iak-idevid-register-with-certificates
  * Replace mailing list address with Slack channel
  * docs: Add configuration documentation
  * tests: Add tests for exception cases in configuration update
  * tests: Add test for update mapping corner cases
  * convert_config: Add support for update mappings
  * convert_config: Do not require keylime modules
  * convert_config: Make the config upgrade less verbose
  * ima: Report an error if no quote forward-progress was made
  * codestyle: Modify list generator to avoid annotation issue (pyright)
  * codestyle: Remove unnecessary type check ignore statement (mypy)
  * codestyle: Add missing type parameter to generic type 'Pattern' (mypy)
  * Update packit plan with new tests
  * Fix typo in Secure Payloads docs
  * incorrect boolean expression causing ECs to be disallowed
  * codestyle: Create explicit sighandler with type annotation (pyright)
  * cert_utils: Ignore malformed certificate files
  * unit test for cert utils
  * Add certificates and certificate checking for IDevID and IAK keys</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version v7.9.0:
  * templates: Add version 2.2, with event log location options
  * Monthly release (7.9.0)
  * update roadmap for 2024
  * Extended the length of `verifier_ip` column to String(255)
  * mba/e/elchecking: add workaround for non spec compliant firmware
  * mba/e/example: ignore EV_CPU_MICROCODE, EV_EFI_HANDOFF_TABLES2 and MokListRT
  * mba/e/example: Allow db entries to be also hashes
  * mba/elchecking: load imports first
  * codestyle: Have pyright ignore ffi.NULL
  * codestyle: Use cast() to set type after splitlines()
  * codestyle: Replace _ with variable name in abstract method (pyright)
  * codestyle: Address some issues detected by pyright
  * codestyle: Remove a 'type: ignore' comment (mypy)
  * detect template changes - docs
  * detect template changes - mappings
  * Tests: Switch code coverage measurement to Fedora 39
  * Correcting paths in userguide documentation
  * docs: fix conf.py
  * Add build os and python version to readthedocs
  * Fix readthedocs config file location
  * docs: add additional reading section</changelog>
  <changelog author="aplanas@suse.com" date="1710504000">- Update to version v7.10.0:
  * Monthly Release (7.10.0)
  * mba: Add a separate table for measured boot policies. In the next PR, similar to named runtime policies, this table will be used to provide support for named measured boot policies and thier management.
  * user_guide: Add section about 'Key Learning to Verify Files'
  * docs: fix rendering in PCR example
  * docs: update PCR monitoring example
  * templates: Fix typo on default measured boot log location
  * packit: re-enable tests against Rawhide
  * elparser: add different escaping required for tpm2-tools &gt;= 5.6
  * requirements: bump pyasn1-modules to 0.2.5</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version v7.11.0:
  * "Monthly" Release (7.11.0)
  * template mapping change for persisted idevids
  * add config options for the persisted idevid and iak handles and passwords
  * templates: Restore the default values
  * templates: Add version 2.3
  * convert_config: Use the latest default value for --default
  * Add new /verify/identity API
  * PSS padding fix - salt length changed to byte length of digest from length of signature
  * sign_runtime_policy: Display error message if non-EC key is provided
  * packit: enable /regression/CVE-2023-3674 (suggested by Karel Srot)
  * Fix durable attestation in absence of mb_policy
  * tests: Fix coverage download by supporting new webdrives
  * templates: verifier: Add require_allow_list_signatures to config file
  * runtime policy: Raise error on missing key if signature required
  * runtime policy: Raise error on unsigned policy if signature required
  * dsse: Remove unused type: ignore comment (mypy)</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version v7.12.0:
  * Bump version to 7.12.0
  * API: Add /version endpoint to registrar
  * Remove unused registrar_common.py file
  * scripts: Download coverage data directly from Testing Farm
  * docs: Add separate documentation for each API version
  * scripts/create_runtime_policy.sh: fix path for the exclude list
  * docs: add documentation for keylime-policy
  * [Automatic] Update Keylime base image 2025-01-02
  * templates: Add the new agent.conf option 'api_versions'
  * Enable autocompletion using argcomplete
  * build(deps): bump codecov/codecov-action from 5.1.1 to 5.1.2
  * test: remove typed-ast from test-requirements.txt
  * tests: fix rpm tests to account for older createrepo_c versions
  * Configure EPEL-10 repo in packit-ci.fmf
  * packit: Fix typo to run keylime-policy-commands test
  * build(deps): bump codecov/codecov-action from 5.0.2 to 5.1.1
  * build(deps): bump pypa/gh-action-pypi-publish from 1.12.0 to 1.12.3
  * docker/ci: Add xxd to the CI image
  * docker/ci: Fix CI image build for dnf5
  * build(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
  * build(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
  * keylime-policy: improve error handling when provided a bad key (sign)
  * keylime-policy: exit with status 1 when the commands failed
  * keylime-policy: use Certificate() from models.base to validate certs
  * keylime-policy: check for valid cert file when using x509 backend (sign)
  * keylime-policy: fix help for "keylime-policy sign" verb
  * tenant: Correctly log number of tries when deleting
  * tests: Use Fedora 41 to generate code coverage
  * [Automatic] Update Keylime base image 2024-12-02
  * update TCTI environment variable usage
  * build(deps): bump codecov/codecov-action from 4.6.0 to 5.0.2
  * keylime-policy: add `create measured-boot' subcommand
  * keylime-policy: add `sign runtime' subcommand
  * keylime-policy: add logger to use with the policy tool
  * docker/release/build_locally.sh: Fail if skopeo is not installed
  * installer.sh: Restore execution permission
  * installer: Fix string comparison
  * build(deps): bump docker/build-push-action from 6.7.0 to 6.9.0
  * build(deps): bump codecov/codecov-action from 4.5.0 to 4.6.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.0
  * build(deps): bump actions/setup-python from 5.2.0 to 5.3.0
  * installer.sh: updated EPEL, PEP668 Fix, logic fix
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0
  * build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * postgresql support for docker using psycopg2
  * [Automatic] Update Keylime base image 2024-11-04
  * End of term for @maugustosilva + propose @ansasaki
  * installer.sh: update package list, add workaround for PEP 668
  * build(deps): bump actions/checkout from 4.2.0 to 4.2.1
  * keylime.conf: full removal
  * Drop pending SPDX-License-Identifier headers
  * create_runtime_policy: Validate algorithm from IMA measurement log
  * test_create_runtime_policy: Add test for mismatching algorithms
  * create-runtime-policy: Deal with SHA-256 and SM3_256 ambiguity
  * create_runtime_policy: drop commment with test data
  * create_runtime_policy: Use a common method to guess algorithm
  * keylime-policy: rename tool to keylime-policy instead of keylime_policy
  * keylime_policy: create runtime: remove --use-ima-measurement-list
  * keylime_policy: use consistent arg names for create_runtime_policy
  * tests: Add more tests to Packit CI
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3
  * build(deps): bump actions/checkout from 4.1.7 to 4.2.0
  * [Automatic] Update Keylime base image 2024-10-01
  * elchecking/example: workaround empty PK, KEK, db and dbx
  * elchecking: add handling for EV_EFI_PLATFORM_FIRMWARE_BLOB2
  * create_runtime_policy: Fix log level for debug messages
  * build(deps): bump pypa/gh-action-pypi-publish from 1.10.1 to 1.10.2
  * build(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.5
  * pylintrc: Ignore too-many-positional-arguments check
  * keylime/web/base/controller: Move TypeAlias definition out of class
  * test_create_runtime_policy: Add tests for algorithm priority
  * test_create_runtime_policy: Add test case for symbolic links
  * create_runtime_policy: Calculate digests in multiple threads
  * create_runtime_policy: Allow rootfs to be in any directory
  * keylime_policy: Calculate digests from each source separately
  * create_runtime_policy: Simplify boot_aggregate parsing
  * ima: Validate JSON when loading IMA Keyring from string
  * docs: include IDevID page also in the sidebar
  * docs: point to installation guide from RHEL and SLE Micro
  * build(deps): bump actions/setup-python from 5.1.1 to 5.2.0
  * build(deps): bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1
  * change check_tpm_origin_check to a warning that does not prevent registration
  * docs: Fix Runtime Policy JSON schema to reflect the reality
  * README: update meeting time to 16:00 UK time
  * [Automatic] Update Keylime base image 2024-09-11
  * Sets absolute path for files inside a rootfs dir
  * policy/create_runtime_policy: fix handling of empty lines in exclude list
  * keylime_policy: setting 'log_hash_alg' to 'sha1' (template-hash algo)
  * tests: apply workarounds to known bugs
  * codestyle: Assign CERTIFICATE_PRIVATE_KEY_TYPES directly (pyright)
  * codestyle: convert bytearrays to bytes to get expected type (pyright)
  * codestyle: Use new variables after changing datatype (pyright)
  * Revert "DO NOT MERGE, TEMPORARY COMMIT"
  * [Automatic] Update Keylime base image 2024-08-16
  * Lint: ignore reportArgumentType and reportInvalidTypeForm errors
  * docker: Install latest Keylime during image build
  * cert_utils: add description why loading using cryptography might fail
  * Enable test functional/iak-idevid-persisted-and-protected
  * ima: list names of the runtime policies
  * tests: Enable test /sanity/opened-conf-files
  * build(deps): bump docker/build-push-action from 6.6.1 to 6.7.0
  * DO NOT MERGE, TEMPORARY COMMIT
  * tox: Use python 3.10 instead of 3.6
  * revocation_notifier: Use web_util to generate TLS context
  * mba: Add a skip custom policies option when loading mba.
  * build(deps): bump docker/build-push-action from 6.5.0 to 6.6.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/base-image: Add latest tag to the CI image build
  * test: add setuptools to test-requirements.txt
  * keylime/models/registrar: attempt to make pylint happy
  * test: update green version in test/test-requirements.txt
  * test/run_tests.sh: take into account non-zero exit status from pytest
  * cmd/keylime_policy: add tool to handle keylime policies
  * cert_utils: add is_x509_cert()
  * common/algorithms: transform Encrypt and Sign class into enums
  * common/algorithms: add method to calculate digest of a file
  * [Automatic] Update Keylime base image 2024-08-02
  * workflows/base-image: Fix CI image build context
  * docker/ci: Add test dependency needed for PR#1568
  * workflow/base-image: Drop duplicated job ID
  * [Automatic] Update Keylime base image 2024-07-31
  * docker: Build CI image together with the base image
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.5.0
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * workflows/update-base-image: Add a signoff to the automatic PR
  * workflows/container: Fix typo on sed command
  * docker: Build base image separately
  * build(deps): bump docker/login-action from 3.2.0 to 3.3.0
  * build(deps): bump docker/build-push-action from 6.4.1 to 6.5.0
  * build(deps): bump docker/build-push-action from 4.2.1 to 6.4.1
  * build(deps): bump docker/metadata-action from 4.6.0 to 5.5.1
  * build(deps): bump pre-commit/action from 3.0.0 to 3.0.1
  * tpm: Replace KDFs and ECDH implementations with python-cryptography
  * build(deps): bump codecov/codecov-action from 2.1.0 to 4.5.0
  * build(deps): bump docker/login-action from 2.2.0 to 3.2.0
  * Update .github/workflows/pypi-release.yml
  * Update .github/workflows/test.yml
  * build(deps): bump actions/setup-python from 2.3.4 to 5.1.1
  * ci: disable Packit testing for Rawhide
  * docker/release/base: Explicitly add the registry for base
  * ci: use CODECOV_TOKEN for coverage file upload
  * build(deps): bump actions/first-interaction
  * build(deps): bump actions/checkout from 2.7.0 to 4.1.7
  * docker/ci: Add test dependencies from #1568
  * docker: Update images to use Fedora 40
  * Added limit by mistake for dependabot
  * Adds dependabot
  * Add Frizbee Action
  * Change Docker and Action Tags to Digests
  * revocation_notifier: Explicitly add CA certificate bundle
  * Introduce new REST API framework and refactor registrar implementation
  * mba: Support named measured boot policies
  * tenant: add friendlier error message if mTLS CA is wrongly configured
  * ca_impl_openssl: Mark extensions as critical following RFC 5280
  * Include Authority Key Identifier in KL-generated certs
  * verifier, tenant: make payload for agent completely optional</changelog>
  <changelog author="aplanas@suse.com" date="1739534400">- Update to version v7.12.1 (CVE-2025-1057, bsc#1237153):
  * Bump version to 7.12.1
  * models: Add Base64Bytes type to read and write from the database
  * Simplify response check from registrar
  * [Automatic] Update Keylime base image 2025-02-01</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1755000000">- Switch to pyproject macros</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1755777600">- Convert to libalternatives on SLE-16-based and newer systems</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1765281600">- Update to version v7.13.0:
  * Bump version to 7.13.0
  * Avoid re-encoding certificate stored in DB
  * Revert "models: Do not re-encode certificate stored in DB"
  * Revert "registrar_agent: Use pyasn1 to parse PEM"
  * CI: Enable test add-agent-with-malformed-ek-cert
  * [Automatic] Update Keylime base image 2025-09-01
  * policy/sign: use print() when writing to /dev/stdout
  * registrar_agent: Use pyasn1 to parse PEM
  * models: Do not re-encode certificate stored in DB
  * mba: normalize vendor_db in EV_EFI_VARIABLE_AUTHORITY events
  * Fix minor typo (exponantial-&gt;exponential)
  * mb: support vendor_db as logged by newer shim versions
  * mb: support EV_EFI_HANDOFF_TABLES events on PCR1
  * Remove unnecessary configuration values
  * cloud_verifier_tornado: handle exception in notify_error()
  * requests_client: close the session at the end of the resource manager
  * Manpage for keylime_tenant (#1786)
  * Add 2.5 templates including Push Model changes
  * [Automatic] Update Keylime base image 2025-08-01
  * Initial version of verify evidence API
  * packit: Enable connection leak test in CI
  * db: Do not read pool size and max overflow for sqlite
  * Use context managers to close DB sessions
  * revocations: Try to send notifications on shutdown
  * verifier: Gracefully shutdown on signal
  * [Automatic] Update Keylime base image 2025-07-01
  * Use `fork` as `multiprocessing` start method
  * Fix inaccuracy in threat model and add reference to SBAT
  * Explain TPM properties and expand vTPM discussion
  * Misc formatting fixes
  * Add diagrams and tweak formatting
  * Fix formatting issues
  * Fix invalid RST and update TOC
  * Expand threat model page to include adversarial model
  * CI: Enable CONTAINER_ENGINE to allow other engines
  * Add --push-model option to avoid requests to agents
  * [Automatic] Update Keylime base image 2025-06-04
  * docker: Remove tpm2-tools compilation from base image
  * tests: fix rpm repo tests from create-runtime-policy
  * tests: skip measured-boot related tests for s390x and ppc64le
  * templates: duplicate str_to_version() in the adjust script
  * policy: fix mypy issues with rpm_repo
  * revocation_notifier: fix mypy issue by replacing deprecated call
  * Fix create_runtime_policy in python &lt; 3.12
  * [Automatic] Update Keylime base image 2025-06-02
  * Fix after review
  * fixed CONSTANT names C0103 errors
  * [Automatic] Update Keylime base image 2025-05-02
  * [Automatic] Update Keylime base image 2025-04-04
  * [Automatic] Update Keylime base image 2025-04-01
  * Extend meta_data field in verifierdb
  * docs: update issue templates
  * docs: add GitHub PR template with documentation reminders
  * [Automatic] Update Keylime base image 2025-03-10
  * tpm_util: fix quote signature extraction for ECDSA
  * packit: Add compatibility/api_version_compatibility test
  * registrar: Log API versions during startup
  * lint: Fix mypy warnings
  * Remove excessive logging on exception
  * tests: change test_mba_parsing to not need keylime installed
  * scripts: Fix coverage information downloading script</changelog>
  <changelog author="aplanas@suse.com" date="1765281601">- Update to version 7.13.0+40 (CVE-2025-13609, bsc#1254199):
  * Fix registrar duplicate UUID vulnerability (#1825)
  * [Automatic] Update Keylime base image 2025-12-01
  * Include new attestation information fields (#1818)
  * Fix Database race conditions and SQLAlchemy 2.0 compatibility (#1823)
  * ci: add push model tests to the packit plan
  * push-model: require HTTPS for authentication and attestation endpoints
  * Fix operational_state tracking in push mode attestations
  * templates: add push model authentication config options to 2.5 templates
  * Improve test coverage for authentication components
  * Security: Hash authentication tokens in logs
  * Fix stale IMA policy cache in verification
  * Fix authentication behavior on failed attestations for push mode
  * Add shared memory infrastructure for multiprocess communication
  * Add agent authentication (challenge/response) protocol for push mode
  * Convert CRLF to LF line endings in attestation_controller.py
  * Add agent-driven (push) attestation protocol with PULL mode regression fixes (#1814)
  * [Automatic] Update Keylime base image (2025-11-01) (#1816)
  * docs: Fix man page RST formatting for rst2man compatibility (#1813)
  * tests: Enable more tests in CI
  * Apply limit on keylime-policy workers
  * tpm: fix ECC signature parsing to support variable-length coordinates
  * tpm: fix ECC P-521 credential activation with consistent marshaling
  * tpm: fix ECC P-521 coordinate validation
  * tests: Test keylime-policy both for filelist-ext.xml match and mismatch (#1806)
  * [Automatic] Update Keylime base image 2025-10-01
  * Remove deprecated disabled_signing_algorithms configuration option (#1804)
  * algorithms: add support for specific RSA algorithms
  * algorithms: add support for specific ECC curve algorithms
  * Update manages based on review feedback
  * Created manpage for keylime-policy and edited manpages for keylime verifier, registrar, agent
  * Manpage for keylime agent
  * Manpage for keylime verifier
  * Manpage for keylime registrar
  * Use constants for timeout and max retries defaults
  * tests: Add unit tests for the timeout configuration
  * verifier: Use timeout from `request_timeout` config option
  * revocation_notifier: Use timeout setting from config file
  * tenant: Set timeout when getting version from agent
  * verify/evidence: SEV-SNP evidence type/verifier
  * verify/evidence: Add evidence type to request JSON</changelog>
  <changelog author="aplanas@suse.com" date="1767873600">- Use tmpfiles.d for /var directories (PED-14735)
- Update to version 7.13.0+55:
  * [Automatic] Update Keylime base image 2026-01-05
  * docs: Document claims response from /verify/evidence
  * verify/evidence: Use tee label for TEE verification
  * verify/evidence: Change valid response to boolean
  * tee/snp: Return SEV-SNP claims upon successful verification
  * verify/evidence: Return TPM claims in response
  * verify/evidence: Define empty response fields
  * [Automatic] Update Keylime base image 2025-12-14
  * Fix TypeError when using -m flag without IMA measurement list path
  * Increase maximum_attestation_interval
  * Do not require wheel for building
  * Add session.refresh() before process_get_status()
  * Fix PUSH mode attestation status race condition
  * Add consecutive_attestation_failures column to legacy VerfierMain model
  * Remove operational_state field from status response in push mode</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1767960000">- Add missing pyasn1 dependency</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update to version 7.14.0+0 (CVE-2026-1709, bsc#1257895):
  * Bump version to 7.14.0
  * verifier: Delete sessions from the DB and then from the cache
  * authentication: Do not persist plaintext tokens
  * crypto: Add operation to calculate the hash of a token
  * Fix session management bugs and improve security
  * authorization: Add documentation explaining authorization framework
  * authorization: Add unit tests
  * authorization: Add metadata to routes with auth requirement
  * authorization: Integrate authorization to action_handler
  * authorization: Add access requirement metadata to all routes
  * authorization: Add authorization provider manager
  * authorization: Add pluggable authorization provider framework
  * keylime_oneshot_attestation: Fix measured boot log encoding
  * tenant: Log the API version used to communicate with the agent
  * tenant: Negotiate API version with the registrar
  * scripts: Do not take TPM ownership
  * scripts: Remove verifier key parameters from keylime_oneshot_attestation
  * /verify/evidence: Return error 400 if no policy is provided
  * tpm: handle policies provided as empty strings
  * /verify/evidence: Require a policy for TPM evidence type
  * ima: Fix deserialization of empty runtime policy
  * scripts: Fix keylime_oneshot_attestation for API v2.5
  * [Automatic] Update Keylime base image 2026-02-03
  * tpm_engine: Fix evidence_class filtering for ima_log
  * tpm_engine: Move _add_error() calls to self.attestation
  * tpm_engine: Validate that available_subjects is a dict
  * verifier: Add missing identity controller and fix routing mixup
  * templates: Remove unused agent options, fixed incorrect ones
  * templates: Add missing options to the templates
  * templates: Fix values to be TOML compatible
  * tests: Add unit tests for negotiate_version
  * verifier: Only check for version downgrade after first attestation
  * docs: Fix documentation regarding behavior of /verify/evidence
  * docs: Update v2.5 doc with new agent /version behavior
  * tenant, verifier: Implement API version negotiation
  * Introduce new API version v2.5
  * Fix HTTP 500 error when accessing attestations for agents with no records
  * Remove @Controller.require_json_api from GET attestations endpoints
  * mba: Fix linting warnings on measured boot code
  * CI: Update e2e test plan with new tests
  * CI: Switch code coverage measurement to Fedora43
  * workflows: Separate upstream test suite from e2e coverage</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1771416000">- Fix version rewrite to show the exact tag when there is no
  offset. 'Downgrades' version to 7.14.0.
- Add set_Version to _service definitions: one more automated step</changelog>
  <changelog author="aplanas@suse.com" date="1778673600">- Update to version 7.14.2 (CVE-2026-6420, bsc#1264265):
  * Bump to version 7.14.2
  * verifier: Fix hardcoded attestation challenge nonce (CVE-2026-6420)
  * verifier: Extend TOCTOU race guard to TENANT_FAILED state
  * test: Add unit tests for _complete_deletion_if_terminated
  * verifier: Fix pyright reportArgumentType for mtls_cert
  * verifier: Fix TOCTOU race in process_agent state writes
  * docs: address wildcard bind feedback, document 0.0.0.0 / :: instead of *
  * Document verifier wildcard bind address
  * Place attestation fields in correct API version docs
  * Add attestation_status, attestation_period, maximum_attestation_interval
  * verifier: Fix type error in mtls_cert guard
  * ci: Replace /var/run/dbus with /run/dbus in test wrapper
  * installer: Replace /var/run/keylime with /run/keylime
  * Replace /var/run/keylime with /run/keylime in Python code
  * shared_data: Remove log calls from cleanup
  * shared_data: Use temp dir when /var/run/keylime/ is not usable
  * [Automatic] Update Keylime base image 2026-05-04
  * [Automatic] Update Keylime base image 2026-05-01
  * installer: Add tmpfiles.d config for all keylime directories
  * shared_data: Move SyncManager socket to /var/run/keylime/
  * test: Support test execution for installed package
  * timestamp: Fix timezone handling in Unix timestamp conversion
  * shared_data: Ignore SIGTERM and SIGINT on Manager and parent processes
  * verifier: Cancel pending poll timer on agent stop
  * test: Add tests for pending-event and attestation storage
  * verifier: Prevent race condition when deleting agent
  * verifier: Replace assert with proper error handling
  * json: Suppress mypy call-overload false positive
  * Switch from CA organization of MITLL to Keylime
  * [Automatic] Update Keylime base image 2026-04-01
  * Add unit tests for shutdown coordination and drain logic
  * Add graceful shutdown and lifecycle hooks to new Server architecture
  * Cancel pending retries and drain in-flight work on verifier shutdown
  * Add shutdown coordination module
  * Fix SharedDataManager cleanup crash in forked worker processes
  * docs: Add tables with push-attestation configuration options
  * templates: Sync agent config options with keylime-agent.conf
  * templates: Remove unused ima_ml_count_file option
  * Remove enable_authentication agent config option
  * fix(mem leak) - remove unbounded functools.cache from latest_attestation
  * fix: Add fork-safety to DBManager via dispose()
  * fix: Check active flag in _extract_identity and guard receive_pop
  * db: Clean up scoped session after each request
  * refactor: Remove dead code AuthSession.authenticate_agent()
  * Align black configuration between tox and pre-commit
  * Fix linter errors in PersistableModel.get() and .all()
  * Fix race condition on in SessionManager
  * Address some improvements from code review
  * Include thread-safe session management
  * Close DB sessions to prevent connection exhaustion
  * docs: Add v3.0 registrar API reference and changelog entry
  * tests: Add unit tests for v3 registrar routes and VersionController
  * registrar: Add routes for API version 3.0
  * [Automatic] Update Keylime base image 2026-03-02
  * [Automatic] Update Keylime base image 2026-03-01
  * Document agent-driven (push) attestation
  * fix misspelling of overridden (#1856)
  * web: fix typo in base/route.py
  * Bump to version 7.14.1
  * ca: Add Subject Alternative Names to the certificates
  * config: move push-mode options to [verifier] section in template
  * packit: Add missing tests
  * Fix session_lifetime default to prevent immediate token expiry
  * migrations: Fix migration to drop invalid sessions
  * tenant: Only negotiate API version v2.x
  * Fix leftover formatting issues
  * tests: fix measured boot tests to skip when efivarlibs is missing
  * tests: fix setup-rpm-tests to define _topdir</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Update to version 7.14.3:
  * Bump to version 7.14.3
  * tests: verify GET handler race condition fix with unit tests
  * fix: handle concurrent agent deletion in verifier GET handler
  * DB: increase evidence_items.agent_id column length
  * [Automatic] Update Keylime base image 2026-07-02
  * fix: suppress type checker errors for compatibility import in types.py
  * fix: correct [A-z] regex in DM-IMA grammar STRING token
  * docs: empty refstate skips PCR replay and policy evaluation
  * tpm: use only policy's relevant PCRs for event log verification
  * tests: accept both error messages for invalid ECC points
  * tests: fix asyncio.Event() usage in shutdown tests
  * CI: Use PR label to disable e2e tests through Packit
  * [CI] Split e2e CI testing to fast and full
  * elparsing: harden stderr decoding for tpm2_eventlog
  * elparsing: check tpm2_eventlog exit code instead of stderr
  * [Automatic] Update Keylime base image 2026-06-01
  * tpm: Parse TPM2B_NAME with _unpackv instead of fixed-size slice
  * fix: Update pre-commit isort to 8.0.1 to match tox
  * docs: Document qualifying data change for IAK certification in v2.6
  * api: Bump pull-mode API version to 2.6
  * tpm: Refactor verify_aik_with_iak to use proper TPMS_ATTEST parsing
  * registrar: Fix missing return after error in _bind_ak_to_iak
  * Fix mypy error and include runtime deps in test-requirements
  * Preserve FAIL status when timeout fires
  * Block PUSH mode FAIL to PASS auto-recovery
  * Fix PUSH mode agent status tracking across restarts and recovery
  * server: Add max_workers config to cap worker process count</changelog>
</package>
<package pkgid="558a72ed54b1a61f6495cbfd51158a17b69a7031a4bcfd0ece60964f845e2501e5145f76dcbc92523cdc90ec3b0a9f614fa11f21e027e53fbc85f488c03f748e" name="python314-nethsm" arch="noarch">
  <version epoch="0" ver="2.1.2" rel="25.2"/>
  <changelog author="Johannes Kastl &lt;kastl@b1-systems.de&gt;" date="1701086400">- new package python-nethsm, required by pynitrokey</changelog>
  <changelog author="Johannes Kastl &lt;kastl@b1-systems.de&gt;" date="1701172800">- update to 1.0.0:
  * Introduce custom type for Base64-encoded data by
    @robin-nitrokey in #104
  * Make system time optional in provision and restore by
    @robin-nitrokey in #105</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1714737600">- update to 1.1.0:
  * Support key import from PEM files (#99)
  * Add ignore_whitespace option to Base64.from_encoded (#108)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1721217600">- update to 1.2.0:
  * Features
  - Add support for namespaces (#110)
  * Bugfixes
  - Fix authentication for partial restore, i. e. on an
    operational instance (#120)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1722513600">- update to 1.2.1:
  * Bugfixes
  - Fix authentication for partial restore, i.e. on an
    operational instance (#124)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741953600">- update to 1.3.0:
  * Features
  - Add TPM attestation keys and platform configuration registers
    to SystemInfo (#128)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745582400">- update to 1.4.0:
  * Features
  - Add support for custom CA certificates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1750766400">- update to 1.4.1:
  Relax urllib3 version requirement to &gt;= 2, &lt;3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- update to 2.0.0:
  All changes:
  https://github.com/Nitrokey/nethsm-sdk-py/compare/v1.4.1...v2.0.0
  * Breaking Changes
  - Remove KeyType.EC_P224
  - Change arguments for NetHSM.csr and NetHSM.key_csr:
  - Require common_name argument
  - Require using keywords for all arguments (except for
    key_id)
  * Features
  - Add new enum values (requires NetHSM v3.0):
  - KeyType: EC_P256K1, BrainpoolP256, BrainpoolP384,
    BrainpoolP512
  - KeyMechanism: BIP340_Signature
  - SignMode: BIP340
  - TlsKeyType: BrainpoolP256, BrainpoolP384, BrainpoolP512
  - Add support for dots, dashes and underscores in user and key
    IDs (requires NetHSM v3.0)
  - Add NetHSM.move_key function for changing key IDs (requires
    NetHSM v3.0)
  - Add optional subject_alt_names argument for NetHSM.csr and
    NetHSM.key_csr (requires NetHSM v3.0)
  - Add optional prefix argument for NetHSM.list_keys (requires
    NetHSM v3.0)
  - Always show the message returned by the NetHSM as part of the
    error message</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- update to 2.0.1:
  * Add support for unauthenticated shutdown.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1774612800">- update to 2.1.0:
  * Features
  - Add support for backup format v1.
  - Add support for clustering (requires NetHSM v4):
  - Add ClusterMember, InitialClusterMember and ClusterJoinData
    classes
  - Add add_cluster_member, list_cluster_members,
    set_cluster_member_urls, remove_cluster_member,
    join_cluster, get_cluster_ca_certificate,
    set_cluster_ca_certificate functions to NetHSM
  - Add support for IPv6 configuration (requires NetHSM v4):
  - Add Ipv6Config class
  - NetworkConfig: Add optional ipv6 field
  - NetHSM.set_network_config: Add optional ipv6 argument
  * Changes
  - Improve backup parsing speed
  - Use poetry as build backend</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778673600">- update to 2.1.1:
  * Bugfixes
  - Fix endpoint path in NetHSM.set_cluster_ca_certificate</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782216000">- update to 2.1.2:
  * Changes
  - Patch generated client to remove the python-dateutil dependency.</changelog>
</package>
<package pkgid="7825629a130907e0ed95f4446b979a3cdba6b17cf1245d278729b6773d4ee3b94eac6ada75adb22371de803db52831620af04b90bd83a3074b4408dcb851bf01" name="python314-nitrokey" arch="noarch">
  <version epoch="0" ver="0.4.2" rel="24.7"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1731240000">- Initial package (0.2.3)</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1739880000">- Update to 0.2.4
  * The list methods of `NK3` and `NKPK` now only open the
    respective device, based on the USB vendor and product ID.
  * Use trusted publishing for PyPI.
  * Add support for `poetry-core` v2.
- Use Python 3.11 on SLE-15 by default</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1742990400">- update to 0.3.0:
  * Bump minimum Python version from 3.9 to 3.9.2.
  * nitrokey.nk3.updates:
  - Remove UpdatePath, get_extra_information and
    get_finalization_wait_retries from public API.
  - Remove obsolete UpdateUi.request_repeated_update method.
  - Show warning when updating from bootloader mode and if the
    status command is not available.
  - Reboot devices in firmware mode before the update to make
    sure that the status is up to date.
  - Add Warning enum, show_warning and raise_warning methods to
    UpdateUi and ignore_warnings argument to UpdateUi.__init__.
  * Add support for updates to Nitrokey 3 firmware v1.8.2.
  * Add support for setting a minimum SDK version in firmware
    update containers.
  - Add an sdk field to nitrokey.trussed.FirmwareContainer.
  - Check SDK version in nitrokey.nk3.updates.Updater.update.
  - Add nitrokey.nk3.updates.Warning.SDK_VERSION variant.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743163200">- update to 0.3.1:
  * nitropy.nk3.updates: Remove reboot during update</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1743163201">- Add *.rpmlintrc to make rpmlint output useful.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1752062400">- update to 0.3.2:
  Add support fido2 v2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754308800">- update to 0.4.0:
  * nitrokey.trussed.admin_app.InitStatus: add support for
    EXT_FLASH_NEED_REFORMAT
  * Use poetry-core v2 as build backend.
  * Bump minimum Python version to 3.10.
  * nitrokey.trussed.Model: Remove firmware_repository and
    firmware_pattern properties.
  * nitrokey.nk3.updates:
  - Move to nitrokey.trussed.updates and prepare adding NKPK
    support.
  - Return device status after an update.
  - Add model argument to get_firmware_update.
  - Add get_firmware_repository method.
  - Replace connection callbacks in Updater with DeviceHandler
    class.
- add version constraints for dependencies
- relax constraint on protobuf, see
  https://github.com/Nitrokey/nitrokey-sdk-py/issues/84#issuecomment-3158310783</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1755777600">- update to 0.4.1:
  * Add support for protobuf v6.
  * nitrokey.trussed.admin_app: Fix validation of ConfigFieldType.U8
    values.
  * nitrokey.trussed: Add list and open functions.
  * nitrokey.trussed.updates:
  - Add default values for the image and update_version arguments
    for Updater.update.
  - Only call UpdateUi.confirm_extra_information if the passed list
    is not empty.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1765281600">- update to 0.4.2:
  * nitrokey.trussed: Add optional model argument for list and open
    functions.</changelog>
</package>
<package pkgid="be46950b062b2bcdd0c4833a3b544849be74d7e513b6a3585522c7b329f863ae4b2b3d2db7a222fb5281e7194d6725e918106a9ffaebd7b561680596fff9e877" name="python314-pwntools" arch="noarch">
  <version epoch="0" ver="4.15.0" rel="1.3"/>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1744804800">- Initial packaging at version 4.14.1</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1780142400">- Update to version 4.15.0:
  * Added context.gdb_binary to specify which gdb command to use.
  Useful to specify e.g. pwndbg.
  * Added tube.upload_manually to upload data to a shell using
  shell commands.
  * Improved libcdb handling of a local libc-database without
  relying on external services.
  * Cache the output of asm() to speed up subsequent exploit runs.
  (Disable the cache using context.cache_dir = None)
  * Removal of some CLI command scripts:
    Many of the CLI utilities coming with pwntools had ambiguous
  names and caused problems while packaging in different
  distributions. Most of the commands are deprecated now and
  print a warning suggesting to use pwn &lt;thecommand&gt; instead.</changelog>
</package>
<package pkgid="39e3552012eddc0ba570ca36300d0d29346b271a0e5d1c5668d8eece418d00cfdb99bbdfc27d87e1953d01c1c294d653606905f40cc88227904498e594f081de" name="python314-pycrowdsec" arch="noarch">
  <version epoch="0" ver="0.0.5" rel="1.11"/>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1742731200">- initial packaging</changelog>
</package>
<package pkgid="51126c3431fde9c20ebb260993bde0e3d9b57ddd1e981fa5b0778e2ec0a9fb71125f4da30c88c1fc982a1fcf233f0a8be6fe255202701bdd2b1a7d0bd3a56829" name="python314-pykeepass" arch="noarch">
  <version epoch="0" ver="4.1.1.post1" rel="34.11"/>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1621771200">- Update to version 4.0.1:
  * No release notes.
- Drop python-pykeepass-fix-version.patch: incorporated upstream.
- Update dependency versions in keeping with upstream.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1653825600">- Update to version 4.0.2:
  * Added support for argon2id key derivation function.
  * Added credential expiry functions.
  * Fixes gh#libkeepass/pykeepass#223 - safe saving.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1655812800">- Update to version 4.0.3:
  * Add otp support.
  * Add debug_setup() function.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1685275200">- Update to version 4.0.4:
  * [gh#libkeepass/pykeepass#314] correctly handle binaries with
    no data.
  * [gh#libkeepass/pykeepass#265] check for keepass signature.
  * [gh#libkeepass/pykeepass#319] support pathlib for
    filename/keyfile.
  * [gh#libkeepass/pykeepass#194] added 'protected' arg to
    _set_string_field.
  * [gh#libkeepass/pykeepass#338] allow comma entry tag separator.
  * use official icon names from KeePass source and deprecate old
    icons.
  * added Entry.is_custom_property_protected().</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1686398400">- Update to version 4.0.5:
  * [gh#libkeepass/pykeepass#344] AttributeError when accessing
    Times with None value
  * use __hash__ when evaluating equality
  * use mtime/uuid for HistoryEntry hashing</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1693915200">- Update to 4.0.6:
  * fixed #350 - fixed all Python 2 deprecation FIXMEs (e.g. future, )
- Switch to pyproject macros.</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@proton.me&gt;" date="1711540800">- Update to 4.0.7:
  * PyKeePass has decrypt kwarg for accessing header info
  * added Entry.index and Entry.move for moving entries
  * added Entry.autotype_window setter
  * allow filename/keyfile to be file-like objects
  * drop dateutil dependency
  * switch to pyproject.toml
- add fix-upstream-test-case.patch for fixing an issue with
  missing pykeepass.kdbx_parsing</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1713096000">- Update to version 4.0.7.post1:
  * Fix gnome secrets crashes on expiration date check with
    missmatch of date format (gh#libkeepass/pykeepass#382).
  * Fix missing pykeepass.kdbx_parsing when built with modern
    tools (gh#libkeepass/pykeepass#378).
  * Remove shebang line from pykeepass/deprecated.py
    (gh#libkeepass/pykeepass#377).
- Drop fix-upstream-test-case.patch: upstream committed.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1722600000">- Update to version 4.1.0.post1:
  * [gh#libkeepass/pykeepass#389] add PyKeePassdatabase_name and
    database_description
  * [gh#libkeepass/pykeepass#390] fix pkg_resources dependency
    issue
  * [gh#libkeepass/pykeepass#391] Entry.tags returns empty list
    instead of None
  * [gh#libkeepass/pykeepass#395] set 'encoding' attribute when
    exporting as XML
  * [gh#libkeepass/pykeepass#383] parse datetimes using isoformat
    instead of strptime</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1744286400">- update to 4.1.1.post1:
  * [gh#libkeepass/pykeepass410] - support empty string as password</changelog>
</package>
<package pkgid="11963bdf20bfe75604df8381ee5b824b9dbabc66d6a31f18f92adcc91630da7d458472f6cdf9126e8374d149c8108a1b1ade6c1d40b42405bb8531443a78bd46" name="python314-pyrage" arch="s390x">
  <version epoch="0" ver="1.2.3" rel="5.213"/>
  <changelog author="Robert Munteanu &lt;rombert@apache.org&gt;" date="1715169600">- Initial package with version 1.1.2</changelog>
  <changelog author="Robert Munteanu &lt;rombert@apache.org&gt;" date="1734955200">- Update to version 1.2.3 (boo#1234744)</changelog>
</package>
<package pkgid="d0e6e2587810d254bbec79657f84c89b9803ce0fb77052b1635118cbf98256e327bb5ae90ba22cf20d294b3cc8e2394713f9b7d757ffa95796c455c87a0cbe9b" name="python314-pyscard" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="51.23"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1680868800">- Update to version 2.0.7
  * do not include the generated HTML documentation in the archive
- Update to version 2.0.6
  * handle SCARD_E_NO_SERVICE on Windows (on last reader removal)
  * add support of MSYS2/mingw environment on Windows
  * improve documentation
  * minor changes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707307200">- Add patch:
  * 0001-Remove-use-of-imp-module-for-wx-GUI.patch
    Fix build for python &gt;= 3.12</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1709985600">- Update to version 2.0.8
  * Make CardMonitor() thread safe on Python 3.12
  * Add hresult value in exceptions
  * Improve documentation
  * Check swig is installed on build
  * Remove use of imp module for wx (GUI)
  * Makefile: modernize use of setup.py
- Drop not longer needed patch:
  * 0001-Remove-use-of-imp-module-for-wx-GUI.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1712404800">- Update to version 2.0.9
  * fix a bug with CardRequestTimeoutException introduced in 2.0.8
  * Minor changes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1717416000">- Update to version 2.0.10
  * CardMonitoringThread(): do not catch unexpected exceptions</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1725883200">- Update to version 2.1.1
  * Fix a regression introduced in 2.1.0
- Update to version 2.1.0
  * PCSCCardRequest: fix active polling (was a 0.1 sec loop)
  * Fix use of undefined variable 'hresult' in exceptions
  * Fix print() use in pyscard user’s guide
  * Fix deprecation warnings
  * Minor changes
  * some more pylint-detected fixes.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1729425600">- Update to version 2.2.0
  * PCSCCardRequest:
  - handle KeyboardInterrupt in waitforcard() &amp; waitforcardevent()
  - use a local PC/SC context to avoid locks
  * smartcard.util.padd(): do NOT modify the input parameter
  * CardMonitoring: a timeout exception IS expected
  * Fix pydoctor documentation
  * wx: fix module and examples
  * Remove Python 2 conditional code
  * Test and improve the synchronization code
  * Test and update the `Observer.py` code
  * Remove `ClassLoader.py`
  * Migrate a `src/` layout
  * Migrate test/* from unittest to pytest
  * Add missing GSM 03.38 symbols for decoding
  * Support only Python 3.9 and higher
  * Remove the Python 2.x-only Pyro dependency
  * Migrate CI to use the official Coveralls action
  * Standardize local and CI testing to use tox
  * Build wheels in CI for all supported Python versions
  * Build the docs as a part of the test suite
  * Begin to add type annotations to the package
  * Deprecate the `HexListToBinString`, `BinStringToHexList`,
    `hl2bs`, and `bs2hl` utility functions
  * Support "64" as an ATR baud rate adjustment integer
    (ISO 7816-3 2006)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1736856000">- Update to version 2.2.1
  * waitforcardevent(): do not miss events between 2 calls.
  * Test, fix, and simplify ATR parsing.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1749729600">- Use pyproject macros to build and install.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1750248000">- Update to version 2.2.2
  * add .release() method to CardConnection &amp; PCSCCardRequest
  * add context manager protocol to CardRequest &amp; CardService
  * fix some parallel execution issues
  * PCSCCardRequest: correctly initialize waitforcardevent()
  * user-guide: Update documentation</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1757678400">- Update to version 2.3.0
  * PCSCCardRequest: fix waitforcardevent() initialization.
  * PCSCCardConnection: raise exception for .connect() after
    .release()
  * Fix race issue in SCardListReaders() and
    SCardListReaderGroups().
  * Use SCARD_AUTOALLOCATE where defined.
  * Use SCardFreeMemory() on Unix.
  * CardMonitoringThread: Fix a thread safeness issue.
  * fix/ignore all pylint warnings.
  * Minor changes.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1761739200">- Update to version 2.3.1
  * Add support of SWIG 4.4.0
  * Minor changes</changelog>
</package>
<package pkgid="57bacfc69f166f75f3d56b152e99934adc764e10594256a22f6c182cad1ddb7c9ed483b16a4bf35dd065979edd96cbc7eb14923d313ec7f1f13f14a9efb26cf0" name="python314-pyscard-debuginfo" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="51.23"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1680868800">- Update to version 2.0.7
  * do not include the generated HTML documentation in the archive
- Update to version 2.0.6
  * handle SCARD_E_NO_SERVICE on Windows (on last reader removal)
  * add support of MSYS2/mingw environment on Windows
  * improve documentation
  * minor changes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707307200">- Add patch:
  * 0001-Remove-use-of-imp-module-for-wx-GUI.patch
    Fix build for python &gt;= 3.12</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1709985600">- Update to version 2.0.8
  * Make CardMonitor() thread safe on Python 3.12
  * Add hresult value in exceptions
  * Improve documentation
  * Check swig is installed on build
  * Remove use of imp module for wx (GUI)
  * Makefile: modernize use of setup.py
- Drop not longer needed patch:
  * 0001-Remove-use-of-imp-module-for-wx-GUI.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1712404800">- Update to version 2.0.9
  * fix a bug with CardRequestTimeoutException introduced in 2.0.8
  * Minor changes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1717416000">- Update to version 2.0.10
  * CardMonitoringThread(): do not catch unexpected exceptions</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1725883200">- Update to version 2.1.1
  * Fix a regression introduced in 2.1.0
- Update to version 2.1.0
  * PCSCCardRequest: fix active polling (was a 0.1 sec loop)
  * Fix use of undefined variable 'hresult' in exceptions
  * Fix print() use in pyscard user’s guide
  * Fix deprecation warnings
  * Minor changes
  * some more pylint-detected fixes.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1729425600">- Update to version 2.2.0
  * PCSCCardRequest:
  - handle KeyboardInterrupt in waitforcard() &amp; waitforcardevent()
  - use a local PC/SC context to avoid locks
  * smartcard.util.padd(): do NOT modify the input parameter
  * CardMonitoring: a timeout exception IS expected
  * Fix pydoctor documentation
  * wx: fix module and examples
  * Remove Python 2 conditional code
  * Test and improve the synchronization code
  * Test and update the `Observer.py` code
  * Remove `ClassLoader.py`
  * Migrate a `src/` layout
  * Migrate test/* from unittest to pytest
  * Add missing GSM 03.38 symbols for decoding
  * Support only Python 3.9 and higher
  * Remove the Python 2.x-only Pyro dependency
  * Migrate CI to use the official Coveralls action
  * Standardize local and CI testing to use tox
  * Build wheels in CI for all supported Python versions
  * Build the docs as a part of the test suite
  * Begin to add type annotations to the package
  * Deprecate the `HexListToBinString`, `BinStringToHexList`,
    `hl2bs`, and `bs2hl` utility functions
  * Support "64" as an ATR baud rate adjustment integer
    (ISO 7816-3 2006)</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1736856000">- Update to version 2.2.1
  * waitforcardevent(): do not miss events between 2 calls.
  * Test, fix, and simplify ATR parsing.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1749729600">- Use pyproject macros to build and install.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1750248000">- Update to version 2.2.2
  * add .release() method to CardConnection &amp; PCSCCardRequest
  * add context manager protocol to CardRequest &amp; CardService
  * fix some parallel execution issues
  * PCSCCardRequest: correctly initialize waitforcardevent()
  * user-guide: Update documentation</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1757678400">- Update to version 2.3.0
  * PCSCCardRequest: fix waitforcardevent() initialization.
  * PCSCCardConnection: raise exception for .connect() after
    .release()
  * Fix race issue in SCardListReaders() and
    SCardListReaderGroups().
  * Use SCARD_AUTOALLOCATE where defined.
  * Use SCardFreeMemory() on Unix.
  * CardMonitoringThread: Fix a thread safeness issue.
  * fix/ignore all pylint warnings.
  * Minor changes.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1761739200">- Update to version 2.3.1
  * Add support of SWIG 4.4.0
  * Minor changes</changelog>
</package>
<package pkgid="e129216a771a9b260fb1ac049c4a35626c0efc3c72e5d9cec03eb70a887d86e54d76cec5c1f7b12a2f55c67a9b747d0c3601a2d488113f84951fc6ee89541883" name="python314-qt-material" arch="noarch">
  <version epoch="0" ver="2.17" rel="12.5"/>
  <changelog author="munix9@googlemail.com" date="1772193600">- update to version 2.17</changelog>
</package>
<package pkgid="c9924298bfbd02e56b720fbbc19e0c4c503a42fea0e30e33974e25c095617553e94fa18b8c4b6abc1d1438aa79c0b3d175c163797eeee6d0d8d3e016731a087c" name="python314-ropgadget" arch="noarch">
  <version epoch="0" ver="7.7" rel="3.5"/>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1745323200">- Initial packaging at version 7.6</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1773316800">- Update to version 7.7:
  * Wrap disassembly in try/except to handle invalid instruction
  bytes
  * Fix callPreceded filtering
  * Fix sintax warnings for python 3.13</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1778414400">- Update .spec to use libalternatives in recent openSUSE versions</changelog>
  <changelog author="Eyad Issa &lt;eyadlorenzo@gmail.com&gt;" date="1778932800">- Replace placeholder with actual name</changelog>
</package>
<package pkgid="7b9f5ec08cfdbf0914b6dac47620703f9b42563ba676e8948c84c0ca569535ce46778f63f317423cb6330b20b3de10436c775f40627655bec697919345fef3f4" name="python314-systemd" arch="s390x">
  <version epoch="0" ver="235" rel="41.64"/>
  <changelog author="sebix+novell.com@sebix.at" date="1507377600">- singlespec</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1509969600">- iso-c-90.patch added to fix building on SLE12-SP3</changelog>
  <changelog author="mpluskal@suse.com" date="1510660800">- Use more of python building macros
- Do not build documentation (build is broken if /usr/bin/python is
  not present anyways)
- Run spec-cleaner</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580644800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1656849600">- 0002-reader-make-PY_SSIZE_T_CLEAN.patch added to fix boo#1200686
  reader: make PY_SSIZE_T_CLEAN</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1656849601">- Remove exclude-tests-on-obs.patch, this is not the way how to
  do it, besides %python_exec setup.py check doesn't the test
  suite.
- Make tests running properly again</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1660737600">- Update to version 235:
  * Adapt the rename of systemd-activate to
    systemd-socket-activate performed in systemd 230.
  * Support for sd_listen_fds_with_names added in systemd 227.
  * Support for sd_journal_get_cutoff_realtime_usec added in
    systemd 186.
  * Make the Reader PY_SSIZE_T_CLEAN for py3.10 compatibility.
  * id128: update for systemd-243 compatibility and other fixes.
  * C syntax modernization. A minimum of C99 is assumed.
  * Fix seek_realtime to work with timezone aware date on Python 3.
  * journal: add namespace support.
  * Fixes for memory leaks and documentation.
  * Support for Python 2 will be removed after this release.
- Remove upstreamed 0002-reader-make-PY_SSIZE_T_CLEAN.patch.
- Skip two failing tests (gh#systemd/python-systemd#118)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1660737601">- Add OBS_missing_etc_machine_id.patch to partially fix
  gh#systemd/python-systemd#118.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1686484800">- Add %{?sle15_python_module_pythons}</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715601600">- Add fix_test_reader_this_machine.patch to make
  test_reader_this_machine pass in the limited build environment.
- Do not pull in whole systemd, when just libsystemd0 is enough
  (bsc#1215538).</changelog>
</package>
<package pkgid="2a3157e44f170deee2ed11b5423585139ecba86aa1dbe97cee34d9ee4500a33fc2f37b948200405b3ebaf4fb9e76facf067eaad77cf457c2089c0903e99e88c7" name="python314-systemd-debuginfo" arch="s390x">
  <version epoch="0" ver="235" rel="41.64"/>
  <changelog author="sebix+novell.com@sebix.at" date="1507377600">- singlespec</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1509969600">- iso-c-90.patch added to fix building on SLE12-SP3</changelog>
  <changelog author="mpluskal@suse.com" date="1510660800">- Use more of python building macros
- Do not build documentation (build is broken if /usr/bin/python is
  not present anyways)
- Run spec-cleaner</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580644800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="Arjen de Korte &lt;suse+build@de-korte.org&gt;" date="1656849600">- 0002-reader-make-PY_SSIZE_T_CLEAN.patch added to fix boo#1200686
  reader: make PY_SSIZE_T_CLEAN</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1656849601">- Remove exclude-tests-on-obs.patch, this is not the way how to
  do it, besides %python_exec setup.py check doesn't the test
  suite.
- Make tests running properly again</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1660737600">- Update to version 235:
  * Adapt the rename of systemd-activate to
    systemd-socket-activate performed in systemd 230.
  * Support for sd_listen_fds_with_names added in systemd 227.
  * Support for sd_journal_get_cutoff_realtime_usec added in
    systemd 186.
  * Make the Reader PY_SSIZE_T_CLEAN for py3.10 compatibility.
  * id128: update for systemd-243 compatibility and other fixes.
  * C syntax modernization. A minimum of C99 is assumed.
  * Fix seek_realtime to work with timezone aware date on Python 3.
  * journal: add namespace support.
  * Fixes for memory leaks and documentation.
  * Support for Python 2 will be removed after this release.
- Remove upstreamed 0002-reader-make-PY_SSIZE_T_CLEAN.patch.
- Skip two failing tests (gh#systemd/python-systemd#118)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1660737601">- Add OBS_missing_etc_machine_id.patch to partially fix
  gh#systemd/python-systemd#118.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1686484800">- Add %{?sle15_python_module_pythons}</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715601600">- Add fix_test_reader_this_machine.patch to make
  test_reader_this_machine pass in the limited build environment.
- Do not pull in whole systemd, when just libsystemd0 is enough
  (bsc#1215538).</changelog>
</package>
<package pkgid="90aa9aa349dabc9d717af5769ff165fc1d9d732e3217b6f82fe0f6469f042500490d1da9dc79b2f34286196eb57612db46701fd651187154cd2191927dafb817" name="python314-wafw00f" arch="noarch">
  <version epoch="0" ver="2.4.2" rel="9.4"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1625486400">- First import from upstream</changelog>
  <changelog author="Matthias Eliasson &lt;elimat@opensuse.org&gt;" date="1661342400">- Update to version 2.2.0
  * New features like docker support and output format fixes.
  * Several new bug fixes and stability to the existing code.
  * Few new WAF detections.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1767355200">- update to 2.3.2:
  * New WAF detections:
  * Baffin Bay
  * Link11 WAAP
  * A10 Networks WAF
  * PanYun WAF
  * More specific cookie matching for F5 ASM
- update to 2.3.1:
  * setup.py installs wafw00f binary twice
- update to 2.3.0:
  * We dropped support for Python 2 completely.
  * PIP 24.3 compatibility.
  * Couple of new interesting WAFs detections!</changelog>
  <changelog author="munix9@googlemail.com" date="1780401600">- Update to version 2.4.2:
  * Removes setup.py to fix tool installations when building locally.
  * Updated the latest supported versions of Python (≥3.10)
  * New WAF signature updates:
  - Vercel WAF
  - Reflected Networks WAF
  * Improvements to existing signatures:
  - Tencent WAF
- Update to version 2.4.1:
  * Fix timeout enforcement during response body reading to properly
    handle slow streaming servers.
  * Timeout enforcement: The --timeout parameter is now properly
    enforced during response body reading, not just during connection
    establishment. This fixes the issue where slow-streaming servers
    could cause scans to take over 2 minutes instead of respecting
    the user-specified timeout.
  * Track elapsed time during chunk reading loop
  * Break out of reading loop if timeout is exceeded during reading
  * Add test documenting timeout enforcement behavior
- Update to version 2.4.0:
  * New WAF detections
  - Anubis (Techaro)
  - Scutum (Secure Sky Technology)
  - 360PanYun (360 Technologies)
  - ThreatX (A10 Networks)
  - Link11 WAAP
  * Improvements
  - Fastly detection improvements (tighter regex for X-Served-By)
  - Added pytest test framework with 45 tests
  - Added pyproject.toml for modern Python packaging
  - Removed pluginbase dependency (use stdlib importlib)
  * Fixes
  - Fixed infinite hang on streaming responses (#246)
  - Improved -t option help text (#243)
  * Other
  - Updated copyright years to 2026
  - Updated Python requirement to 3.8+
- Add fix-request-path.patch based on commit af3eca1:
  Noticed that path attacks like LFI were being ignored. Changed
  the way requests were done to ensure that the path is not normalized
  by creating a prepared request and overwrite the url.
- Use source from github to get complete tests
- Switch to wheel/pip build
- Add %check/%pytest
- Clean up spec file</changelog>
</package>
<package pkgid="17d25af44f1a8cac9e86be34defbf7777b1b847050b47ff6eeb4fc6fb396ad92599da955c31c3dbae6509e7a663671b58163d3ab29e1d9a1ca1426891e60fee9" name="python314-wfuzz" arch="noarch">
  <version epoch="0" ver="3.1.0" rel="14.12"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1624449600">- First version of wfuzz package.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1624622400">- Removed shebang to fix rpmlint warning</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1639656000">- Fixed URL in spec file</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1675252800">- Fixed a problem preventing this package to build in Factory</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1751025600">- Use pyproject macros to build and install.
- List directories under sitelib explicitly.</changelog>
</package>
<package pkgid="e6c9b2dc5c6308509d26b37802025cc973b54599c2fd2f7c9548d4445165ab766f75fab73af47d46db6d0b9a54e95425ea99efb9c104bf6fa1b5053f38ce3573" name="rats" arch="s390x">
  <version epoch="0" ver="2.4" rel="4.41"/>
  <changelog author="vpereira@novell.com" date="1403956800">- Initial import</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649851200">- added project URL, removed no longer working source url</changelog>
</package>
<package pkgid="7425a07e0d31be5b42d064db8f4ff7e2ac635fd525e8a6c2e60256c0065f35a4b7939f0add59a4a061f56c2bf2ecd8ffd6a435dc282c450043ad7e89ba265a0c" name="rats" arch="src">
  <version epoch="0" ver="2.4" rel="4.41"/>
  <changelog author="vpereira@novell.com" date="1403956800">- Initial import</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649851200">- added project URL, removed no longer working source url</changelog>
</package>
<package pkgid="fc1cc31c6c1ca7bc8ccb5b0e812ba6eb0128f099dd3e9ec91cdf95fea347d4405990a09d7840675c333c20dc008515ea9aba3781f3f24dbb2330de89c959b88f" name="rats-debuginfo" arch="s390x">
  <version epoch="0" ver="2.4" rel="4.41"/>
  <changelog author="vpereira@novell.com" date="1403956800">- Initial import</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649851200">- added project URL, removed no longer working source url</changelog>
</package>
<package pkgid="b70f34ac3f1d4fb1d9708bb0e907279d0d0cf961503133e3649458658d793a41308477689d40be12543edfb8e55df5d65412f92a7d5ba98d5af7546e8d2427dc" name="rats-debugsource" arch="s390x">
  <version epoch="0" ver="2.4" rel="4.41"/>
  <changelog author="vpereira@novell.com" date="1403956800">- Initial import</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649851200">- added project URL, removed no longer working source url</changelog>
</package>
<package pkgid="cb2b2421f21fe00df549da6e61e7a7dbce8e904a23be490bbfffa15899d4a0207ca8b09f2f723b2a446644fa2f1b3246e6ad1a275e0cb815ab625835199dc7c7" name="recaf" arch="noarch">
  <version epoch="0" ver="2.21.14" rel="1.12"/>
  <changelog author="&#x130;smail Efe Acabey &lt;ismailefeacabey@gmail.com&gt;" date="1721044800">Initial commit</changelog>
</package>
<package pkgid="95bfa66ff136403b4f94ba4921733a0fe86a9f7c257ed436a36347087c4daf20926261cccf6baf6434025616fb87529ac087ad46f48ebcf2c57519200bb169db" name="recaf" arch="src">
  <version epoch="0" ver="2.21.14" rel="1.12"/>
  <changelog author="&#x130;smail Efe Acabey &lt;ismailefeacabey@gmail.com&gt;" date="1721044800">Initial commit</changelog>
</package>
<package pkgid="5cd7f17e5f8abeaf75a987d32e986dc5e7479fde5f0c90657827739aefb6db8ba74737780948bd3a591f49d8dfe0641ddcd307de788ce3f096085cdd48b54cbb" name="regal" arch="s390x">
  <version epoch="0" ver="0.42.0" rel="11.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743163200">- new package regal: linter and language server for Rego, bringing
  your policy development experience to the next level</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 0.33.1:
  This release is the same tag as v0.33.1, please see that release
  for the release notes.
  Another v0.33.1 was released to trigger the rebuilding of some
  assets that were deleted in a draft release.
  * New Rule: in-wildcard-key
    Using a wildcard variable (_) for the key in the key-value form
    of iteration (some _, value in collection) is never needed, and
    can be replaced by the simple some value in … form . This rule
    flags cases where the key iteration is redundant. (Read more)
  * New Rule: confusing-alias
    While import aliases can improve readability, aliasing an
    import reference that is also imported without an alias is
    confusing, as both names point to the same resource. This rule
    catches such cases. (Read more)
  * New Rule: mixed-iteration
    Rego supports different styles of collection iteration. While
    "reference style" iteration (collection[_]) can be concise for
    deeply nested structures, mixing it with the some .. in style
    within a single iteration expression makes for code that’s more
    difficult to follow. This rule encourages consistency within a
    single iteration statement. (Read more)
  * New Rule: narrow-argument
    This new rule analyzes function arguments to suggest narrowing
    them down to the minimal value the function depends on. This
    can improve clarity and reusability. The rule considers
    incrementally defined functions across all their definitions.
    This is a powerful but opinionated rule and is thus in the
    custom category and is not on by default. See the documentation
    for how to enable it if you’re curious to try it out! (Read
    more)
  * Performance Improvements
    Several improvements have been made to reduce memory
    allocations and improve overall linting performance. Numbers
    below refer to Regal’s benchmark for linting its own policies.
  - Optimized config loading and parsing, saving around 2.7
    million allocations (#1491).
  - Reduced allocations by approximately 2 million (#1494).
  - Improved the performance of the use-strings-count rule,
    saving almost 1 million allocations (#1465).
  - Optimized reference comparisons and small iteration patterns,
    saving around 300k allocations (#1472).
  - Included performance enhancements alongside an update to the
    external-reference rule to make it more configurable (#1496).
  * OPA v1.3.0
    Regal has been upgraded to use OPA v1.3.0. This brings several
    upstream improvements, including support for the new one-liner
    grouping in formatting (see OPA#6760). (#1459)
  * Bug Fixes
  - Fixed a bug in the handling of Rego input from stdin. Thanks
    @tokyowizard for the report! (#1474)
  - Fixed a panic that could occur in FindConfigRoots when
    supplied with unexpected arguments. (#1487)
  * Other Rule Updates
  - The external-reference rule can now be configured with a
    maximum number of allowed external references, instead of
    solely flagging all external uses within a function. If you
    previously had this rule disabled, you might want to try
    enabling it now, and possibly tweak its configuration to your
    liking. (#1496)
  - The rule-length rule now has a separate setting
    (max-test-rule-length) with a higher default value (60 vs 30)
    for test rules, acknowledging that tests often include
    substantial data. (#1476)
  - Updated documentation for the rule-named-if rule based on
    community feedback received via the page feedback form
    (please let us know if you see issues! &amp; thanks for the
    report!) (#1463)
  * Dependencies
    This release also updates Regals dependencies as follows.
  - github.com/open-policy-agent/opa v1.2.0 -&gt; v1.3.0
  - github.com/prometheus/client_golang v1.21.0 -&gt; v1.21.1
  - go.opentelemetry.io/otel v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/metric v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/sdk v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/trace v1.34.0 -&gt; v1.35.0
  - golang.org/x/crypto v0.35.0 -&gt; v0.36.0
  - golang.org/x/net v0.36.0 -&gt; v0.38.0
  - golang.org/x/sync v0.11.0 -&gt; v0.12.0
  - golang.org/x/sys v0.30.0 -&gt; v0.31.0
  - golang.org/x/text v0.22.0 -&gt; v0.23.0
  - google.golang.org/protobuf v1.36.4 -&gt; v1.36.5
  * Changelog
  - automated: update capabilities by @github-actions in #1458
  - OPA 1.3.0 by @anderseknert in #1459
  - Parameterize some tests by @anderseknert in #1460
  - automated: update capabilities by @github-actions in #1461
  - build(deps): bump the dependencies group with 2 updates by
    @dependabot in #1462
  - docs: rule-named-if by @charlieegan3 in #1463
  - Some perf fixes by @anderseknert in #1465
  - Rule: in-wildcard-key by @anderseknert in #1466
  - Increase coverage by @anderseknert in #1467
  - build(deps): bump github/codeql-action from 3.28.13 to
    3.28.14 in the dependencies group by @dependabot in #1468
  - perf: various improvements by @anderseknert in #1472
  - Rule: confusing-alias by @anderseknert in #1470
  - Add benchmark for testing all rules individually by
    @anderseknert in #1469
  - Rule: mixed-iteration by @anderseknert in #1475
  - Add max-test-rule-length setting to rule-length rule by
    @anderseknert in #1476
  - fix: ensure policy from stdin is enumerated correctly by
    @anderseknert in #1474
  - automated: update capabilities by @github-actions in #1477
  - builtins.RegalIsFormatted: recover from formatter panics by
    @srenatus in #1481
  - automated: update capabilities by @github-actions in #1482
  - build(deps): bump github/codeql-action from 3.28.14 to
    3.28.15 in the dependencies group by @dependabot in #1484
  - Fix unnecessary-some rule not working after OPA 1.0+ by
    @anderseknert in #1485
  - FindConfigRoots: return error, not panic by @srenatus in
    [#1487]
  - perf: Improve how config is parsed, and when by @anderseknert
    in #1491
  - Rule: narrow-argument by @anderseknert in #1488
  - build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 by
    @dependabot in #1490
  - build(deps): bump codecov/codecov-action from 5.4.0 to 5.4.2
    in the dependencies group by @dependabot in #1495
  - Make external-reference rule less annoying by @anderseknert
    in #1496
  - docs: fix docs that still used v0 syntax by @anderseknert in
    [#1494]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 0.34.0:
  After a month of development, we're happy to announce Regal
  v0.34. This version of the OPA community's favorite linter and
  language server brings you new 3 linter rules, performance
  improvements and much more.
  With the v0.34.0 release, Regal now ships with more than 100
  linter rules!
  Which is pretty close to one new week per rule since the project
  started.
  * New rules
  - unresolved-reference
    This one is particularly exciting! The new
    unresolved-reference rule reports any references (like
    data.users.permissions) that cannot be resolved (i.e. found)
    anywhere in the project. Some projects will have valid
    references that can't be resolved at the time Regal lints the
    project, and the rule provides configuration options to mark
    certain references, or entire paths (like data.users.*) as
    resolved. See the docs for the rule for more details.
  - pointless-import
    Category: imports
    The new pointless-import rule will flags imports of the same
    package, and other import forms where the import has no real
    effect.
  - single-item-in
    Category: idiomatic
    The single-item-in rule reports cases of in being used on a
    single item collection, and suggests using an equality check
    instead.
  * Performance
  - Use OPA v1.5.0, which brings performance improvements to walk
    reducing linting time by about 10%.
  - Faster linting by avoiding walk in a few locations where
    possible.
  - Improve performance of aggregate rules.
  - Several performance optimizations to Regal's linter rules.
  * API
  - The linter API now has a new Prepare method that can be used
    to prepare the linter before reusing it across several runs.
  * Various
  - Some rules that would previously only scan the topmost level
    of a rule body will now recursively scan the whole rule.
  - The input completions provider has been rewritten in Rego
    (previously Go).
  - The automatic version check has been rewritten in Rego
    (previously Go).
  * Bugs
  - Fix false positive in custom one-liner-rule.
  * Docs
  - Updated roadmap. Go check it out!
  - Move rules table from README and into a more interactive form
    on the Styra docs. Take a look!
  - Add link to Renovating Rego blog.
  - README: add link to KubeCon London talk, which prominently
    featured Regal.
  - Update links to adapt to OPA's new documentation.
  - Update outdated information in README.
  * Dependencies
  - build(deps): bump the dependencies group with 2 updates
    (#1551)
  - build(deps): bump the dependencies group with 2 updates
    (#1544)
  - build(deps): bump the dependencies group with 2 updates
    (#1521)
  - build(deps): bump github/codeql-action in the dependencies
    group (#1507)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1749038400">- Update to version 0.34.1:
  This patch release fixes a bug found since v0.34.0 as well as it
  bumps the OPA dependency to the v1.5.1 patch also released today.
  While Regal's own policies were not affected by the regression in
  walk, custom linter rules could very well be.
  * Highlights
  - OPA v1.5.0 -&gt; v1.5.1
  - Go 1.23 -&gt; 1.24
  - Fix false positive in sprintf-arguments-mismatch when the
    %-*s pattern was used for padding.
  * Changelog
  - OPA v1.5.1 and some perf tweaks (#1580)
  - docs: Update typo in link (#1581)
  - deps: Revert 47c70f0 tablewriter changes (#1579)
  - docs: Update to allow better regal docs generation (#1578)
  - [create-pull-request] automated change (#1577)
  - fix: consider padding pattern in sprintf-arguments-mismatch
    (#1575)
  - build(deps): bump ossf/scorecard-action in the dependencies
    group (#1576)
  - Fix deprecated notices in .goreleaser.yaml (#1570)
  - Go 1.23 -&gt; 1.24 (#1573)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751371200">- Update to version 0.35.1 (0.35.0 was not released):
  We're happy to release v0.35.1, the mid-summer release of Regal
  for the 🏖️ ! This release updates to OPA v1.6.0 bringing a number
  of performance improvements as well as other improvements and bug
  fixes.
  * Improved Schema Loading This PR replaces Regal's custom schema
    loader with one that matches OPA's behavior, enabling the same
    schemas to work across opa check, opa eval, and other OPA
    commands. PR #1605
  * Performance Improvements
  - Thanks to a PR in OPA, Regal's memory use is now much reduced
    due to a change conditionally supplying built-in contexts
    only when needed.
  - This PR optimizes Rego evaluation by directly mapping source
    data to ast.Value objects instead of going through
    intermediate map[string]any or JSON representations,
    eliminating ~2.9 million allocations in benchmarks. PR #1606
  - Regal contributors will be happy with
    open-policy-agent/opa#7442 which makes running Regal's tests
    around 2.5x as fast!
  * Code Actions Rewrite
  - Code actions are LSP features that provide automated fixes or
    refactoring suggestions (like "quick fix" options), and this
    PR implements them for Regal with server-side filtering to
    reduce data transfer and ensure consistent editor behavior.
    This is also now implemented in Rego! PR #1604
  * Docs
  - PR #1584 refactors a number of Regal's pages including
    breaking down the previously large README into separate
    files. Browse the new structure on the Regal Website.
  - The Code Lens documentation has been updated to better
    explain supported configurations. Thanks @Shinzu for the
    report here. #1596
  * Changelog
  - 92d1ba9: deps: Update OPA to v1.6.0 (#1617) (@charlieegan3)
  - 2bbe76e: [create-pull-request] automated change (#1582)
    (@github-actions[bot])
  - 6e5e6bb: e2e: add frankenstein test build (@srenatus)
  - 5bf607d: build(deps): bump github/codeql-action in the
    dependencies group (#1585) (@dependabot[bot])
  - 6f45a9f: build(deps): bump brace-expansion from 2.0.1 to
    2.0.2 in /build (#1587) (@dependabot[bot])
  - e85b878: docs: Update config cli docs (#1584) (@charlieegan3)
  - 30c73fe: build(deps): bump github/codeql-action in the
    dependencies group (#1595) (@dependabot[bot])
  - b8f3e8f: fix: improve snippets suggestion condition (#1597)
    (@anderseknert)
  - eb48984: Fix issue with handling big numbers (#1599)
    (@anderseknert)
  - 1ee1cf4: fix: Correct end location in unresolved-reference
    (#1600) (@anderseknert)
  - e50c9af: Bump Roast -&gt; v0.12.0 (#1601) (@anderseknert)
  - 981d8d2: docs: Update Evaluation Code Lens docs (#1602)
    (@charlieegan3)
  - 3577efe: lsp/completion/input: don't suggest 'input'
    following dot (#1603) (@srenatus)
  - 02d1546: lsp: Code Action feature rewritten in Rego (#1604)
    (@anderseknert)
  - 25b1072: More robust loading of schemas (#1605)
    (@anderseknert)
  - 112dc87: perf: avoid JSON/map roundtrips in ast.Value
    transforms (#1606) (@anderseknert)
  - d87fd2f: docs: Tone down "obsolete" description for
    use-rego-v1 (#1610) (@anderseknert)
  - a939219: lsp: Roll over load file failures (#1611)
    (@charlieegan3)
  - 1d771ca: interning: bump opa+roast, replace call to
    ast.InternedBoolTerm() (#1613) (@srenatus)
  - ed0ead4: build(deps): bump
    github.com/go-viper/mapstructure/v2 in /e2e/testbuild (#1615)
    (@dependabot[bot])
  - 0d65ef0: build(deps): bump
    github.com/go-viper/mapstructure/v2 (#1614)
    (@dependabot[bot])</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1757851200">- Update to version 0.36.1 (0.36.0 was not released):
  This is Regal v0.36! The first Regal release since becoming a
  part of the OPA project last month. This release mostly delivers
  a number of new language server features as well as wider
  improvements under the hood and to the developer experience.
  * A note about Regal's documentation
    Our documentation is now displayed as part of the main OPA
    website!
    https://www.openpolicyagent.org/projects/regal
    From this release, links generated from Regal in output to
    rules will point to this location. You might find links to the
    old location as we get things updated. Please feel free to open
    any issues for link problems you find just so we don't miss
    anything.
  * Get contextual documentation when calling built-in functions
  - Following PR #1654, the Regal language server will now offer
    signatureHelp to compatible clients. This shows the current
    argument type and description in the help text for built-in
    functions. This is in addition to the other general function
    documentation displayed here.
  * Quickly see related fields in when editing METADATA
  - PR #1657 implements support for the documentHighlight request
    from clients. This is currently only used to show signal
    other related METADATA keys when working with Rego metadata.
    In future, this same functionality could be used to highlight
    other related items currently in the viewport.
  * Jump directly from ignore directives to documentation
  - documentLink is another request from clients which allow the
    server to respond with link ranges. We have used this to make
    regal ignore directives clickable, helping users quickly
    learn what they mean when encountered in policies PR #1657.
  * Get live diagnostics from custom rules as you type
  - PR #1631 ensures that users of custom linter rules are also
    able to access these for live diagnostics in language server
    clients. Previously these were not evaluated in the server,
    only in the Regal CLI.
  * Notable Refactors &amp; Development Changes
  - Rego Language Server Routing: PR #1675 makes some notable
    changes to how Rego is used within the Regal’s language
    server. The Language Server Protocol (LSP), which Regal
    implements to support LSP clients, is based on JSON message
    passing. This lends itself to Rego evaluation which is JSON
    in, JSON out. This PR updates the handling of different LSP
    messages sent from clients to route them in Rego, handling
    Rego backed rules first, and falling back to Golang
    implementations that still remain otherwise. This sets the
    direction for more Rego LSP functionality in the language
    server in future.
  - Development bundle loading from disk: PR #1646 gives those
    working on Regal in development the option of using the
    current source for the Regal bundle without rebuilding the
    binary. This improves the experience when working on Rego
    based language server functionality by reducing the time of a
    feedback loop. Set REGAL_BUNDLE_PATH to use this feature.
  * Changelog
  - 1f1044f: build: Remove tap key (#1687) (@charlieegan3)
  - build(deps): bump github/codeql-action from 3.29.0 to 3.29.1
    in the dependencies group by @dependabot[bot] in #1616
  - Add Regal bundle compilation benchmark by @anderseknert in
    [#1618]
  - Remove quotes from keywords in refs by @anderseknert in #1619
  - lsp: Skip loading files on disk when in cache by
    @charlieegan3 in #1620
  - build(deps): bump the dependencies group with 2 updates by
    @dependabot[bot] in #1621
  - automated: update capabilities by @github-actions[bot] in
    [#1622]
  - add experimental lsp package for websocket communication by
    @srenatus in #1623
  - internal/io: add FindInputPath when the content isn't needed
    by @srenatus in #1624
  - build(deps): bump github/codeql-action from 3.29.2 to 3.29.3
    in the dependencies group by @dependabot[bot] in #1626
  - lsp/completions: Handle hyphenated package names by
    @charlieegan3 in #1625
  - lsp: fix didOpen templating race by @charlieegan3 in #1627
  - build/lsp: add web client demo by @srenatus in #1629
  - lsp: Fix stale diagnostics after deletion by @charlieegan3 in
    [#1628]
  - Some doc updates by @anderseknert in #1632
  - lsp: Add support for custom rules by @charlieegan3 in #1631
  - Vendor roast dependency by @anderseknert in #1634
  - lsp: Address windows goto definition URI issue by
    @charlieegan3 in #1633
  - Fix regal new rule issues + refactor io code by @anderseknert
    in #1636
  - lsp: Use full text replacement for Intellij fmt by
    @charlieegan3 in #1637
  - test: refactor e2e test, add new regal command runner by
    @anderseknert in #1640
  - build(deps): bump github/codeql-action from 3.29.3 to 3.29.5
    in the dependencies group by @dependabot[bot] in #1641
  - Fix missing source.explore code action by @anderseknert in
    [#1643]
  - lsp: Present filename relative to root in errors by
    @charlieegan3 in #1638
  - refactor: Improve code quality throughout the codebase by
    @anderseknert in #1642
  - lsp/uri: Refactor URI handling by @charlieegan3 in #1644
  - Tidying up more code by @anderseknert in #1645
  - Provide development option to load bundle from disk by
    @anderseknert in #1646
  - lsp/eval: Ensure filenames use URI in print output by
    @charlieegan3 in #1647
  - Rewrite more completion providers in Rego. Resolve schemas at
    runtime. by @anderseknert in #1652
  - lsp: Add signature help by @charlieegan3 in #1654
  - lsp: Fix server signature race in test by @charlieegan3 in
    [#1655]
  - build(deps): bump the dependencies group with 5 updates by
    @dependabot[bot] in #1639
  - build(deps): bump the dependencies group with 3 updates by
    @dependabot[bot] in #1653
  - docs: update README badges for OPA 1.7.1 release by
    @charlieegan3 in #1656
  - New LSP features and internal improvements by @anderseknert
    in #1657
  - lsp/documenthighlight: Add tests by @charlieegan3 in #1659
  - Add tests for textDocument/documentLink handler by
    @anderseknert in #1658
  - Styra URLs -&gt; OPA URLs by @anderseknert in #1662
  - docs: Update README re: move to open-policy-agent by
    @charlieegan3 in #1664
  - internal/io: explicitly disable lazy loading of regal bundle
    by @srenatus in #1666
  - build(deps): bump the dependencies group across 1 directory
    with 4 updates by @dependabot[bot] in #1663
  - Enable pprof endpoint only with env var set by @anderseknert
    in #1667
  - docs: Remove update workflow &amp; minor adjustments by
    @charlieegan3 in #1668
  - Disable Codecov PR comments by @anderseknert in #1670
  - deps: OPA v1.8.0 by @anderseknert in #1669
  - docs: Changes needed in docs for opa site deploy by
    @charlieegan3 in #1673
  - build(deps): bump github/codeql-action from 3.29.11 to 3.30.0
    in the dependencies group by @dependabot[bot] in #1674
  - Rego-based routing of Rego handlers + refactor by
    @anderseknert in #1675
  - Just one more.. refactor by @anderseknert in #1677
  - docs: Updates in preparation for OPA site deploy by
    @charlieegan3 in #1676
  - lsp: GTD use URI for location by @charlieegan3 in #1680
  - fix: Don't use OS path separator when walking FS by
    @anderseknert in #1681
  - build(deps): bump the dependencies group with 3 updates by
    @dependabot[bot] in #1678
  - build: Add windows runners to build workflow by @charlieegan3
    in #1682
  - Weekend refactor by @anderseknert in #1684
  - Fix documentLink issue when no user config provided by
    @anderseknert in #1686
  - build: Remove tap key by @charlieegan3 in #1687</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- Update to version 0.37.0:
  This release features a new linter rule, several new language
  server features, and many improvements and fixes. The two major
  OPA versions bumped since the last release additionally contains
  several performance improvements that were contributed as part of
  developing Regal!
  * New Rule: prefer-equals-comparison
    The prefer-equals-comparison linter rule recommends using the
    == operator for equality comparison over the unification
    operator =. The rule helps improve code clarity by using
    operators for their intended purposes: := for assignment, ==
    for equality comparison, and = for unification. The linter
    identifies when = is used for comparison by checking if both
    sides of the operator are "unassignable".
    Avoid
    input.request.method = "GET"
    Prefer
    input.request.method == "GET"
    There are some certainly valid use cases for the unification
    operator! But simple equality comparison is not one. For more
    information, see the documentation for the rule. As an amusing
    aside, this fixes one of the first issues created in the
    project!
  * Language server: Document highlighting to help show where
    function args are referenced
    Document highlighting is one of the more subtle features of the
    LSP specification, but a really helpful one when implemented
    well. The experimental first implementation that shipped with
    Regal v0.36.0 is no longer experimental, and has also been
    extended to highlight usage of function argument variables
    inside of a function head or body.
    (Please find the screencast in the release notes)
  * Language server: Selection ranges
    Selection ranges provide smart selection of code that can
    expand and shrink based on knowledge of the code rather than
    simple text properties, like hyphens or whitespace. This makes
    moving code around extremely fast, and without leaving the
    keyboard. Consult the language server docs for how to enable
    this in your editor
    (Please find the screencast in the release notes)
  * Improvements
  - The pointless-reassignment rule would previously only flag
    reassignment at the top level of a rule body. Now it flags
    pointless reassignments also in nested bodies, like
    comprehensions, every statements, and so on.
  - All completion providers are now implemented purely in Rego
  - Remove the go-semver dependency in favor of a custom, much
    faster implementation
  - Build: Reduce permissions granted in update-caps top-level
    workflow, by @timothyklee
  - Docs: Update language server page to demonstrate recently
    added features
  - Docs: Add kakoune LSP configuration example
  * Windows compatibility improvements
    In this release we have fixed various Windows bugs (Language
    Server Init, Goto Definition, Error Popups) in #1740, #1737,
    [#1736], following #1633, and #1642 last release.
    These fixes have also made it possible to run our test suites
    on Windows runners to catch issues sooner in future. A huge
    thanks to @charlieegan3 for his tireless work on this!
  * Bugs fixed
  - Fix false positive in use-some-for-output-vars triggered by
    nested variables in rule ref heads, like rule[input[i]].allow
    if ....
  - Fix false positive in redundant-existence-check when a not
    check made an existence check necessary, reported by @gusega
  - Fix false positive in narrow-argument rule, which would
    incorrectly flag some arrays passed as arguments
  - Ensure that the language server InitOptions is never nil and
    don't cause issues with clients that don't provide those
  * Dependency Updates:
  - github.com/open-policy-agent/opa: v1.8.0 → v1.10.1
  - github.com/arl/statsviz: v0.7.1 → v0.7.2
  - github.com/go-git/go-git/v5: v5.16.2 → v5.16.3
  - github.com/olekukonko/tablewriter: v0.0.5 → v1.1.0
  - github.com/spf13/cobra: v1.9.1 → v1.10.1
  - github.com/spf13/pflag: v1.0.7 → v1.0.10
  - Removed: github.com/coreos/go-semver: v0.3.1
  * Changelog
  - 244459c: docs: Remove some old references (#1689)
    (@anderseknert)
  - 4212b5c: build(deps): bump the dependencies group with 2
    updates (#1690) (@dependabot[bot])
  - e149c6d: build: reduce update-caps top-level workflow
    permission to read (#1691) (@timothyklee)
  - 819bbec: lsp: Fix missing initial root (#1692)
    (@charlieegan3)
  - be8b020: docs: Update style guide links to new repo (#1693)
    (@charlieegan3)
  - ceb890b: Builtin function completion in Rego (#1694)
    (@anderseknert)
  - d36555e: Package ref import suggestions in Rego (#1698)
    (@anderseknert)
  - 4e44131: build(deps): bump the dependencies group with 2
    updates (#1703) (@dependabot[bot])
  - 14166e9: Avoid multi-line highlighting of issues (#1702)
    (@anderseknert)
  - 1685bb8: Move completion handler into Rego router (#1699)
    (@anderseknert)
  - 0da5eaa: build(deps): bump the dependencies group with 2
    updates (#1708) (@dependabot[bot])
  - e792757: Bump OPA -&gt; v1.9.0, golangci-lint 2.5.0 (#1709)
    (@anderseknert)
  - 3092d1d: docs: Address some broken links from OPA report
    (#1704) (@charlieegan3)
  - bebfd06: util: use Partial2 for IsAnyError (@srenatus)
  - f22a570: Fix false positive in redundant-existence-check
    (#1716) (@anderseknert)
  - 2703715: Various fixes (#1715) (@anderseknert)
  - 87981f2: build(deps): bump the dependencies group with 2
    updates (#1713) (@dependabot[bot])
  - a6487b6: lsp: document highlighting supporting function args
    (#1718) (@anderseknert)
  - fe8cbd3: Rule: prefer-equals-comparison (#1726)
    (@anderseknert)
  - f3722ea: Fix false positive in narrow-argument (#1724)
    (@anderseknert)
  - 73b8c65: Improve pointless-reassignment to cover nested cases
    (#1727) (@anderseknert)
  - 9cf180c: lsp: Implement selection ranges and linked editing
    range (#1722) (@anderseknert)
  - bf632d0: build(deps): bump the dependencies group with 2
    updates (#1725) (@dependabot[bot])
  - a373ae3: lsp: Use filename path for current buffer for defns
    (#1732) (@charlieegan3)
  - d758eaf: lsp: Refactor range utilities (#1729)
    (@anderseknert)
  - 13de8a9: Fix incorrect behavior in pointless-import (#1733)
    (@anderseknert)
  - fb560c1: Fix false positive in use-some-for-output-vars
    (#1731) (@anderseknert)
  - 70449b7: Various small fixes (#1736) (@anderseknert)
  - 2594719: windows: Better use of slash paths (#1737)
    (@charlieegan3)
  - 499125f: Get FindClosestMatchingRoot working on windows
    (#1740) (@charlieegan3)
  - 3715085: OPA v1.10.0 (#1742) (@anderseknert)
  - 781f809: deps: stick to
    github.com/vektah/gqlparser/v2@v2.5.30 (#1744) (@srenatus)
  - bbb03db: Use generic client identifier in tests (#1741)
    (@charlieegan3)
  - c42ce08: build(deps): bump github/codeql-action in the
    dependencies group (#1745) (@dependabot[bot])
  - 4384b0d: Remove go-semver dependency, plus various fixes
    (#1746) (@anderseknert)
  - 97dfbd4: docs: update LSP page to show new features (#1748)
    (@charlieegan3)
  - 818b33a: docs: Minor fixes to docs typos and links (#1747)
    (@charlieegan3)
  - 4138270: Update to OPA v1.10.1 (@charlieegan3)
  - 55cf029: lsp: ensure that InitOptions is never nil (#1752)
    (@srenatus)
  - 8ffa270: docs: add kakoune LSP config snippet (#1751)
    (@srenatus)
  - 216341a: reporter,lsp: update URLs for help links (#1750)
    (@srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 0.38.0:
  * Feature: String Interpolation Support
    v0.38.0 of your favorite Rego linter, debugger and language
    server brings full support for OPA's new string interpolation
    feature. This means not only that Regal lints code found inside
    interpolated strings, but that you'll have access to all your
    favorite language server features within them too — like code
    completions, tooltips on hover, or document highlighting. You
    can even use the debugger to step through interpolated
    expressions! If you haven't yet tried it out, grab OPA v1.12.2,
    Regal v0.38.0 and enjoy an absolutely awesome addition to the
    Rego language!
    In addition to this, we have a number of fun new features and
    performance improvements.
  * New Rule: disallow-rego-v1
    Category: custom
    This optional new rule flags the use of import rego.v1 in Rego
    policies (#1778). Since OPA v1.0 (December 2024), this import
    is a no-op and no longer needed. The rule helps users maintain
    clean code by preventing this outdated import from appearing in
    new policies. Teams standardizing on OPA 1.0+ can enable this
    rule to enforce modern Rego standards.
    package example
    import rego.v1 # &lt;-- Happy 2026! Time to stop doing this!
  * New Fixers
    @SeanLedford has also done some great work to help expand
    Regal's auto-fixing capabilities by having regal fixers added
    for three more rules.
  - prefer-equals-comparison
  - redundant-existence-check
  - constant-condition
    See (#1790) and (#1794) for more details.
  * Performance
    The fixer saw a 12% performance improvement by reusing the
    linter, reducing allocations from 2.3M to 2.0M operations
    (#1783). Additional optimizations include:
  - faster file filtering by avoiding recompiled ignore patterns
    (#1758),
  - better built-in function handling by registering Regal's
    functions globally only once (#1788),
  - and more efficient AST location serialization (#1758)
    To track ongoing performance work, a new post-merge
    benchmark-recording workflow was added (#1793).
  * LSP: New Ignore Code Action
    The language server now supports a code action to quickly add
    regal ignore configuration for specific rules directly from the
    editor (#1777).
  * Changelog
  - ac35695: Various performance improvements (#1758)
    (@anderseknert)
  - 48cd03d: docs: Add custom head for regal index page (#1761)
    (@charlieegan3)
  - 728ae28: build(deps): bump golangci/golangci-lint-action
    (#1762) (@dependabot[bot])
  - 92cf6ca: explorer: allow hiding stages without an effect
    (+misc) (#1760) (@srenatus)
  - c000994: docs: Correct sidebar labels (#1763) (@charlieegan3)
  - bf0b621: build(deps): bump
    github.com/containerd/containerd/v2 in /e2e/testbuild (#1753)
    (@dependabot[bot])
  - 18e7a89: build(deps): bump
    github.com/containerd/containerd/v2 (#1754)
    (@dependabot[bot])
  - ccab7bd: Rename: encoding/util -&gt; encoding/write (#1764)
    (@anderseknert)
  - 54f7625: build: run windows in matrix with other jobs (#1770)
    (@charlieegan3)
  - 5c9e6f0: update: Update version checking logic (#1772)
    (@charlieegan3)
  - 5034776: build: Add badge update to readme script (#1773)
    (@charlieegan3)
  - 95e8220: Added OPA installation as a Regal prerequisite, and
    fixed golangci-lint link. (#1774) (@SeanLedford)
  - 149f71d: build(deps): bump js-yaml from 4.1.0 to 4.1.1 in
    /build (#1775) (@dependabot[bot])
  - b8f8b7f: Enable more golangci-lint linters (@anderseknert)
  - e092627: build: Update mac runner (@charlieegan3)
  - 877884c: lsp: Add code action and command to ignore rule
    (#1777) (@charlieegan3)
  - ece9ca2: build(deps): bump the dependencies group with 5
    updates (@dependabot[bot])
  - bd37bbd: build(deps): bump golang.org/x/crypto in /build/lsp
    (@dependabot[bot])
  - 17cc429: build(deps): bump golang.org/x/crypto in
    /e2e/testbuild (@dependabot[bot])
  - 415b05f: build(deps): bump golang.org/x/crypto from 0.43.0 to
    0.45.0 (@dependabot[bot])
  - e1bb975: Improve fixer performance (@anderseknert)
  - 1b083ff: Added Rule: Disallow import rego.v1 (#1778)
    (@SeanLedford)
  - 9e43c50: Optimize and improve code for built-in functions
    (@anderseknert)
  - 64ce2aa: build(deps): bump glob and markdownlint-cli in
    /build (#1779) (@dependabot[bot])
  - 48fddeb: build(deps): bump github/codeql-action in the
    dependencies group (#1787) (@dependabot[bot])
  - bc41f63: pkg/linter: use errgroup, set limits + context on it
    (@srenatus)
  - f22c2aa: Add fixer for prefer-equals-comparison rule (#1790)
    (@SeanLedford)
  - cf88eb9: Fixers for redundant-existence-check and
    constant-condition rules (#1794) (@SeanLedford)
  - 36401a2: build(deps): bump the dependencies group across 1
    directory with 7 updates (#1796) (@dependabot[bot])
  - ecb23d3: version: Add OPA version to version output (#1798)
    (@charlieegan3)
  - 94ce038: build(deps): bump golang.org/x/crypto from 0.43.0 to
    0.45.0 in /build/ws (#1791) (@dependabot[bot])
  - 9ce1ddd: workflows: add post-merge benchmark-recording
    workflow (@srenatus)
  - e111443: workflows/benchmark: fix golang setup (@srenatus)
  - 4bb2d5a: docs: Update messy rule docs (@charlieegan3)
  - dec83ea: docs: Updates from opa website link scanner
    (@charlieegan3)
  - 8f544a6: fix typo in fix.go help message (#1807) (@gusega)
  - 941b02e: build(deps): bump the dependencies group with 3
    updates (#1804) (@dependabot[bot])
  - 9f09e6e: build(deps): bump the dependencies group with 4
    updates (#1808) (@dependabot[bot])
  - 476ef89: OPA v1.12.2 and full string interpolation support
    (#1811) (@anderseknert)
  - a9843ab: Move chained-rule-body to custom category (#1812)
    (@anderseknert)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768392000">- Update to version 0.38.1:
  This patch release fixes several bugs including some found in the
  recent v0.38.0 release, as well some other improvements.
  * Bug Fixes
  - Fix for prefer-equals-comparison fixer failing to parse
    policies with multiple "=" in expressions (#1824, fixes #1818
    reported by @gusega)
  - Fix for incorrect fixable violation count display in lint
    output (#1825, fixes #1813 reported by @gusega)
  - Fix for false positive in prefer-equals-comparison rule with
    comprehension term vars (#1828, fixes #1826 reported by
    @SeanLedford)
  - bundle: Surface configured rule notices as messages in lint
    output (#1827, fixes #1795 reported by @ghmer)
  * Improvements
  - Code action for prefer-equals-comparison fixer now available
    in the language server (#1810)
  - New option for prefer-value-in-head rule to count
    interpolated strings as scalars (#1817)
  - Minor performance improvement for any_set_item, used for
    selecting items from sets (#1815)
  * Changelog
  - f1c5f74: bundle: Improve performance of any_set_item (#1815)
    (@charlieegan3)
  - 9300420: Implemented Code action for prefer-equals-comparison
    fixer (#1810) (@SeanLedford)
  - 28121f0: build(deps): bump github/codeql-action in the
    dependencies group (#1823) (@dependabot[bot])
  - 54cdcb6: Add prefer-value-in-head option to count
    interpolated string as scalar (#1817) (@anderseknert)
  - e68184d: Fix false positivie in prefer-equals-comparison
    (#1828) (@anderseknert)
  - 593e221: fix: Prefer-Equals-Comparison Edge Case With
    Multiple "=" (#1824) (@SeanLedford)
  - 3dc28bb: bundle: Surface configured rule notices (#1827)
    (@charlieegan3)
  - aac9618: Updated lint reporter to track fixable violation
    count separate from fixable violation Set (#1825)
    (@SeanLedford)
  - fd6dd4d: Updated example for prefer-equals-comparison edge
    case to not include false positive (#1829) (@SeanLedford)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772193600">- Update to version 0.39.0:
  We're happy to announce Regal v0.39.0, featuring 3 new linter
  rules, many language server improvements, and much faster
  linting!
  * New Rule: use-array-flatten
    Category: idiomatic
    The use-array-flatten rule recommends using array.flatten
    instead of nested array.concatenation (#1873).
    Avoid
    package policy
    flat1 := array.concat(arr1, array.concat(arr2, arr3))
    flat2 := array.concat(arr1, array.concat(arr2, array.concat(arr3, arr4)))
    Prefer
    package policy
    flat1 := array.flatten([arr1, arr2, arr3])
    flat2 := array.flatten([arr1, arr2, arr3, arr4])
  * New Rule: use-object-union-n
    Category: idiomatic
    The use-object-union-n rule recommends using object.union_n
    over nested calls to object.union (#1873).
    Avoid
    package policy
    obj := object.union(obj1, object.union(obj2, obj3))
    Prefer
    package policy
    obj := object.union_n([obj1, obj2, obj3])
  * New Rule: equals-over-count
    Category: performance
    The new optional equals-over-count rule suggests using direct
    equality comparisons rather than count when checking collection
    membership or emptiness (#1878). This is a micro-optimization
    and not a general recommendation. Must be manually enabled.
  * Performance
    This release brings an approximate 25% reduction in linting
    time through aggregate remodeling and Rego prepare stage
    optimizations (#1838). Additional performance work includes
    Rego refactoring (#1857, #1884), AST transform improvements
    (#1892), and various micro-optimizations (#1866, #1879).
  * Language Server Improvements
    The language server now includes a semantic token framework for
    improved syntax highlighting (#1845, #1865, #1870), code
    actions for the constant-condition and
    redundant-existence-check fixers (#1830).  and an
    opaTestProvider feature for test discovery (#1888, #1889,
    [#1898]),
    Completion performance is improved with a
    completionItem/resolve handler (#1831), and server capabilities
    are now properly exposed and consistent with the clients
    (#1867, #1880).
    Note: Semantic token support is feature flagged and will be
    available in the next release.
  * Compiler Explorer
    Regal now supports the VSCode-based OPA Explorer extension,
    providing a rich GUI to compare compiler stages directly in VS
    Code (#1862) - thanks @srenatus! A new "Format stages" option
    has also been added to the compiler explorer (#1854) - thanks
    @johanfylling!
  * Experimental: rq Engine Support
    Initial support for the rq engine has been added (#1872)
  * Various Improvements
  - Improved redundant-existence-check rule (#1897, fixes #1805)
  - Disabled zero-arity-function rule as opa-fmt now covers that
    (#1885)
  * Bug Fixes
  - Fix nil dereference on compiler errors in explorer (#1837)
  - Fix broken links to fixer page (#1852)
  - Fix false positive in use-some-for-output-vars (#1886)
  - Fix broken input.json completion provider (#1891)
  * Dependency Updates
  - Regal has been upgraded to use OPA v1.14.0 and Go 1.26.
  * Documentation
  - Added mise as an alternative installation method (#1849)
  - Updated installation documentation (#1861)
  - Updated note about eval and debug roots (#1894)
  - Show release badge when using pre-release versions (#1899)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 0.40.0:
  Today we celebrate Regal who turns v0.40.0 just in time for the
  GitHub download tracker to report 1 million total downloads.
  Quite the milestone! Thank you all for the encouragement, support
  and contributions during these past 3 years. Together we're
  redefining the policy development experience, and we have a lot
  more of that planned for the future. Stay tuned!
  This release includes 2 new linter rules, and many new features
  and improvements to both the linter and language server.
  * Linter
  - New Rule: invalid-regexp
    Category: bugs
    The new invalid-regexp rule scans regular expressions found
    in policies and reports invalid patterns that would otherwise
    fail at runtime.
    Avoid
    package policy
    invalid if regexp.match("[a-z", "test")
    Prefer
    package policy
    valid if regexp.match("[a-z]", "test")
  - New Rule: superflous-object-get
    Category: idiomatic
    The superflous-object-get rule flags calls to object.get
    where using the built-in function provides no benefit
    compared to using a reference directly, and without the call.
    Avoid
    package policy
    superfluous if {
    [#] the default value (`""`) isn't used in the expression,
    [#] so object.get provides no benefit here
    object.get(input, ["user", "department"], "") == "engineering"
    }
    Prefer
    package policy
    much_better if {
    input.user.department == "engineering"
    }
    More cases of superfluous object.get will be added to this
    rule as we encounter them.
  * Improvements
  - The naming-convention rule now accepts a list of allowed
    names in addition to regex patterns
  - The non-loop-expression rule now identifies more types of
    expressions that could be moved out of iteration
  - All rules now contain a related_resources item in their
    metadata pointing to the docs for the rule
  - The regal new rule command now generates a Related Resources
    section in the new rule's documentation template
  * Bugs Fixed
  - Fixed two false positives reported in the non-loop-expression
    rule
  - The server now exits with an error if the --profile flag is
    used without --format json (thanks @mvanhorn!)
  * Language Server
  * Evaluate and Debug Actions
    Any input.json or input.yaml file found in the workspace will
    be used for input during evaluation and debugging sessions,
    but this wasn't obvious without reading the docs. The
    Evaluate and Debug code lenses / commands will now present a
    dialog option asking to create an input.json file in the
    project workspace in case one isn't found. This file is
    populated with dummy JSON data based on references to input
    found in the policy, and should be edited by the user to
    provide more relevant data.
  * Hover Provider Improvements
    The hover provider showing tooltips for built-in functions
    and keywords has been rewritten in Rego, and additionally saw
    a few improvements land as part of that process:
  - Links to examples for built-in functions now point to the
    correct location in the OPA docs
  - The print function now shows up in hover results as well
  - Hover provider now less resource intensive, and all
    information rendered just in time for display
  * Inlay Hints Improvements
    The inlay hint provider (that provides names of function
    arguments to be displayed at call sites) has also been
    rewritten in Rego, and the server now implements also the
    inlayHint/resolve handler, which improves performance by only
    calculating inlay hint details when the client requests them
    for display.
    Additionally, the inlay hint provider now properly takes the
    range of the active editor view into account, and will only
    spend resources calculating hints for code that the user can
    actually can see.
  * Semantic Tokens in Comprehensions and every Expressions
    The language server's semantic token provider (providing
    context-based syntax highlighting) now provides semantic
    tokens inside of comprehensions and every expressions in
    addition to previously supported contexts. Additionally, most
    of the semantic token logic is now implemented entirely in
    Rego.
  * Improved Language Server Initialization
    This release contains a number of fixes and improvements
    related to the language server's initialization routine,
    which should now be both more robust and faster.
  * Bugs Fixed
  - Two potential nil dereferences identified and fixed
  - Fix a potential out of bounds panic in slice access
  - The bundled web server now shows a link to Regal's editor
    integration documentation on its index page
  * Finally
    Extra thanks goes out to @charlieegan3 this release, who worked
    tirelessly to fix some really complex race conditions and
    concurrency issues in the language server. A thankless job, but
    extremely important, and he pulled it off like a true Viking!
  * Changelog
  - 691afe1: Replace some Styra references (#1904)
    (@anderseknert)
  - 975ae72: build(deps): bump github.com/go-git/go-git/v5 in the
    dependencies group (#1903) (@dependabot[bot])
  - c85d88f: build(deps): bump go.opentelemetry.io/otel/sdk in
    /build/lsp (#1906) (@dependabot[bot])
  - 5ff449b: build(deps): bump the dependencies group with 3
    updates (#1907) (@dependabot[bot])
  - 9900522: lsp: Wait for client to send initialized at boot
    (#1909) (@charlieegan3)
  - d661b5a: build(deps): bump github/codeql-action in the
    dependencies group (#1912) (@dependabot[bot])
  - fd85e2d: Allow naming-convention rule to take list of names
    (not only a pattern) (#1911) (@anderseknert)
  - 299d3fc: Semantic Token Support for Comprehensions and
    Constructs (#1883) (@SeanLedford)
  - 422a9ef: build(deps): bump github/codeql-action in the
    dependencies group (#1915) (@dependabot[bot])
  - 02a9dc8: Fail with error when --profile used without JSON
    format (#1918) (@mvanhorn)
  - 1716e13: lsp/webserver: Add links to the index page (#1914)
    (@charlieegan3)
  - 1ab360f: lsp/testing: Nested test implementation (#1913)
    (@charlieegan3)
  - 53e5bf2: build(deps): bump google.golang.org/grpc in
    /e2e/testbuild (#1916) (@dependabot[bot])
  - 45841bf: build(deps): bump smol-toml and markdownlint-cli in
    /build (#1919) (@dependabot[bot])
  - 371bf1f: build(deps): bump picomatch from 4.0.3 to 4.0.4 in
    /build (#1920) (@dependabot[bot])
  - 62852fc: build(deps): bump the dependencies group across 1
    directory with 4 updates (#1921) (@dependabot[bot])
  - d32408d: build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#1922) (@dependabot[bot])
  - 8b9bcf0: build(deps): bump github.com/go-git/go-git/v5 from
    5.17.0 to 5.17.1 (#1923) (@dependabot[bot])
  - f2251f2: [create-pull-request] automated change (#1908)
    (@github-actions[bot])
  - 820d3f0: OPA v1.15.1 (#1925) (@anderseknert)
  - a155b62: Add popup prompt for creating input.json if it
    doesnt exist when Evaluate is run (#1929) (@SeanLedford)
  - 27067af: build(deps): bump the dependencies group with 2
    updates (#1931) (@dependabot[bot])
  - 2179ae4: Fix non-loop-expression false positives (#1930)
    (@anderseknert)
  - 33282ba: Rule: superflous-object-get (#1932) (@anderseknert)
  - 6fd115a: Include rule docs links in metadata (#1935)
    (@anderseknert)
  - 6a364fb: Fix aggregate test loop initialization (#1936)
    (@charlieegan3)
  - 61ab730: Rule: invalid-regexp (#1937) (@anderseknert)
  - 752ca7e: Cover more non-loop-expressions (#1938)
    (@anderseknert)
  - cb9a9c8: Add convenience functions for working with lines and
    uints (#1944) (@anderseknert)
  - 85171b8: build(deps): bump go.opentelemetry.io/otel/sdk in
    /e2e/testbuild (#1942) (@dependabot[bot])
  - 7fd6d66: [feature] Create input.json Skeleton if User Would
    Like When One Doesn't Exist (#1934) (@SeanLedford)
  - e4e326b: OPA v1.15.2 (#1945) (@anderseknert)
  - e8f1469: build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
    (#1941) (@dependabot[bot])
  - 7a1235c: Fix potential nil deref in language server (#1947)
    (@anderseknert)
  - d6d2bf0: Fix index out of bounds in parital inlay hint
    (#1948) (@anderseknert)
  - 0a0f1f8: build(deps): bump the dependencies group with 2
    updates (#1946) (@dependabot[bot])
  - d0e99b5: Rewrite hover provider in Rego (#1951)
    (@anderseknert)
  - cc35d48: Fix possible nil deref in ogre (#1954)
    (@anderseknert)
  - 44ceabe: Rewrite inlay hint provider in Rego (#1953)
    (@anderseknert)
  - 5c62c72: testing: Improve lsp shutdown logic &amp; address test
    race conditions (#1943) (@charlieegan3)
  - 12cc776: Semantic package tokens in Rego (#1956)
    (@anderseknert)
  - b4ccafc: feat(new): add Related Resources source link to
    builtin rule doc template (#1957) (@mvanhorn)
  - 543d3fa: linter/lsp: Tidy use of aggregates and store in ls
    (#1962) (@charlieegan3)
  - 1442904: build(deps): bump github.com/go-git/go-git/v5 from
    5.17.2 to 5.18.0 (#1958) (@dependabot[bot])
  - 293cd7f: build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#1959) (@dependabot[bot])
  - 344a389: build(deps): bump the dependencies group with 3
    updates (#1963) (@dependabot[bot])
  - 784fa86: Semantic import tokens Rego rewrite (#1960)
    (@anderseknert)
  - 0a00617: Refactor: Sending Variable Semantic Tokens Data from
    Rego (#1961) (@SeanLedford)
  - 9016d3d: Minor fixes (#1965) (@anderseknert)
  - 0ddd70f: docs: Update setup-regal in docs (#1964)
    (@charlieegan3)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780488000">- update to 0.41.1:
  NOTE this is the same code as that of v0.41.0 — just that the
  combination of a release deployment issue and immutable releases
  just had that one end up without any downloadable artifacts. That
  is now corrected!
- Update to version 0.41.0:
  This release brings automatic Rego test generation, as well as
  squashing a bunch of issues under the hood with sweeping
  enhancements to the core language server code.
  * New Feature: Automatic Test Generation
    A first pass at automatic test generation has landed in the
    language server (#1982), thanks to @SeanLedford! With a new
    code action available when working in a policy file, Regal can
    generate a test stub based on the current state of the
    workspace. This uses the values found in input.json to populate
    the with statements in the generated test.
  * Language Server Improvements
    This release includes significant internal improvements to the
    language server.
    Completion performance has seen a major improvement: for
    clients like VS Code that support a default replacement range,
    the completion payload is now roughly half the size it was
    before, and clients generally do no longer need to send
    continuous requests to the server for more suggestions once you
    start typing (#1992).
    The folding range provider has been rewritten in Rego (#1979),
    and now additionally honours client capabilities like
    lineFoldingOnly and rangeLimit.
    The handling of input.json and input.yaml files has been
    overhauled (#2002). These files are now tracked as first-class
    workspace state: they are parsed and cached when saved, and the
    server now requests update notifications for them from the
    client, rather than re-parsing the file on each evaluation, or
    debug sessions started.
  * OPA v1.17.0
    Regal has been updated to OPA v1.17.0 (#2014). This OPA release
    notably introduces future.keywords.not, which improves the
    semantics of the not keyword by wrapping composite-expression
    negation in an implicit body. Thanks @johanfylling for making
    sure this also works in Regal now!
    Regal's RoAST representation (and docs) have been updated to
    support the new ast.Not form introduced alongside this feature
    (#1985).
  * RoAST module.comments Representation
    The RoAST representation of module.comments has changed
    (#1987). Comments are now represented as plain locations rather
    than base64-encoded text, allowing Regal to retrieve the
    original text from the source file directly with less bytes to
    transfer and parse. Note: this is a breaking change for custom
    rules that reference input.comments directly. Users should
    instead prefer to reference data.regal.ast.comments_decoded,
    which provides comment locations in the usual form and which
    will remain stable even through future format changes.
  * Bug Fixes
  - Addressed a panic in regal fix caused by fixes being applied
    in non-deterministic order; opa-fmt could reduce line count
    such that use-assignment-operator would then access
    out-of-bounds row numbers (#2003) as reported by @erazemk
  - The unassigned-return-value rule now correctly flags
    namespaced builtins like json.match_schema(...) in addition
    to flat builtins like lower(...) (#2005) — thanks @mvanhorn
    for the fix and @anderseknert for the report
  - Nicer formatting of with sequences (#1969)
  - regal/ast: metadata labels field is now recognized as a valid
    metadata key, aligned with OPA v1.17.0 (#1983, #1988) —
    thanks @srenatus
  - Regal fix now works regardless of local git state (#2011).
    Thanks @seiyab for the report in #2006
  * What's Changed
  - Use common aggregate data in circular-import (#2019)
  - build(deps): bump github/codeql-action in the dependencies
    group (#2017)
  - debug: Determine abs debugging path for input.json (#2018)
  - Unify common aggregation and aggregated data (#2016)
  - build(deps): bump the dependencies group with 3 updates
    (#2008)
  - build(deps): bump github.com/containerd/containerd/v2 in
    /e2e/testbuild (#2007)
  - Add capabilities verification to build check (#2015)
  - Use logger in Rego router (#2012)
  - deps: Update opa to 1.17.0 (#2014)
  - Extract file polling into waitForFile helper (#2013)
  - Remove git validation from fix command (#2011)
  - lsp: Introduce workspace abstraction (#2009)
  - Remove the settings.json change that was introduced in my
    previous PR (#2010)
  - fix(rules): unassigned-return-value now covers namespaced
    builtins (#2005)
  - [feature] First Pass at Automatic Test Generation in Regal
    (#1982)
  - fixer: Apply linter fixes in deterministic order (#2003)
  - build(deps): bump the dependencies group across 1 directory
    with 2 updates (#1998)
  - build(deps): bump brace-expansion from 5.0.5 to 5.0.6 in
    /build (#1997)
  - Improved handling of input.(json|yaml) files (#2002)
  - build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#2000)
  - build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.1 (#2001)
  - Move location of LSP storage helpers (#1993)
  - New framework for testing language server handlers (#1992)
  - Breaking: new RoAST representation of module.comments (#1987)
  - regal/ast: update metadata fields (#1988)
  - roast: Add marshaling support for `ast.Not` (#1985)
  - Introduce passthrough handler type (#1984)
  - regal/ast: add 'id' to valid metadata keys (#1983)
  - build(deps): bump github/codeql-action in the dependencies
    group (#1981)
  - Move folding range provider to Rego handlers (#1979)
  - Cleanup (#1978)
  - feat(pre-commit): add regal-fix hooks for auto-fixing rules
    (#1847) (#1976)
  - build(deps): bump the dependencies group with 2 updates
    (#1975)
  - Move initialize handler to Rego router (#1977)
  - Various code quality improvements (#1970)
  - Nicer formatting of `with` test sequences (#1969)
  - Update ast.json else to use "#/$defs/rule" (#1967)
  - Use OPA main until next OPA release (#1968)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784289600">- Update to version 0.42.0:
  * Language Server
  - Find References and Rename
    This release brings initial support for finding references
    and renaming symbols in the workspace. This first version is
    limited to function arguments and some bindings, but we plan
    to expand this in future releases.
    Video see
    https://github.com/open-policy-agent/regal/releases/tag/v0.42.0
    References are checked across the whole workspace, and
    renames work even when for example, a function is
    incrementally defined in several different files.
  - New future.keywords completion provider
    The language server will now suggest future.keywords in
    completions for import lines — notably the new import
    future.keywords.not for now, with a few more to follow soon
    in OPA.
  * Debug Adapter
  - Evaluate
    Regal's debug adapter protocol (DAP) implementation now
    supports evaluating variables and expressions inside of stack
    frames in debugging sessions! This also allows setting up
    watch expressions in clients like VS Code.
    Video see
    https://github.com/open-policy-agent/regal/releases/tag/v0.42.0
    Make sure to download the latest version of the OPA VS Code
    extension to try it out. More clients hopefully supported
    soon!
  * Various Improvements
  - Add --aggregate flag to regal new rule command to create
    aggregate rules. Thanks @mvanhorn!
  - Allocate less memory while linting with this one simple trick
  - Make common rule name provider provide suggestions for
    default rules
  - Make input.json completion provider provide suggestion for
    imports
  - Have boolean value completion provider provide suggestions in
    many more locations
  - Add inline docs to import provider
  - Add label details to built-in function completion provider
  - Bump OPA dependency to v1.18.2
  * Bugs Fixed
  - Override return type of object.subset while waiting for the
    next OPA release to fix this. Thanks @mvanhorn!
  - Fix wrong end location of reported for unresolved functions
  - Fix wrong end location reported by rule-shadows-builtin
  * Documentation
  - Update defunct styra.com links to point to archived copies
    until we find a better home for them
  - Documentation added for how GitHub Copilot breaks
    autocomplete in VS Code and a recommendation not to use it.
  * Changelog
  - 22365a3: docs: Document Copilot breaking language servers in
    VS Code (#2021) (@anderseknert)
  - b842742: docs: Archive some styra.com references (#2022)
    (@charlieegan3)
  - a2539ef: roast: adjust not test locations (#2023) (@srenatus)
  - 81d6485: feat: add --aggregate flag to regal new rule (#341)
    (#1966) (@mvanhorn)
  - 75ce34c: lsp: first implementation of find references and
    rename (#2029) (@anderseknert)
  - efa9106: perf: remove a million allocations with this one
    simple trick (#2024) (@anderseknert)
  - c64b3a3: build(deps): bump the dependencies group with 3
    updates (#2027) (@dependabot[bot])
  - b3594a4: docs: Small updates to address some inconsistencies
    (#2030) (@charlieegan3)
  - dd92373: [lsp] Update find references and rename request to
    support "some" variables (#2031) (@SeanLedford)
  - a107bea: build(deps): bump markdown-it and markdownlint-cli
    in /build (#2032) (@dependabot[bot])
  - 656cb56: [feature] Extending find references variable support
    (#2035) (@SeanLedford)
  - c78887b: build(deps): bump the dependencies group across 1
    directory with 4 updates (#2037) (@dependabot[bot])
  - 4e5e4a2: build(deps): bump the dependencies group with 5
    updates (#2043) (@dependabot[bot])
  - 9b380f4: build(deps): bump golang.org/x/net from 0.53.0 to
    0.55.0 in /build/lsp (#2041) (@dependabot[bot])
  - ce12d08: OPA v1.18.2 (#2040) (@anderseknert)
  - 4f5d1dc: fix: override object.subset return type to boolean
    (#2048) (@mvanhorn)
  - 75fd9d3: build(deps): bump golang.org/x/crypto from 0.50.0 to
    0.52.0 in /build/ws (#2044) (@dependabot[bot])
  - c2328a5: build(deps): bump the dependencies group with 4
    updates (#2049) (@dependabot[bot])
  - 758630a: Fix wrong end location of reported unresolved
    functions (#2053) (@anderseknert)
  - 9a74766: Fix wrong end location reported by
    rule-shadows-builtin (#2054) (@anderseknert)
  - 2bb3592: dap: Implement Evaluate feature (#2051)
    (@anderseknert)
  - 76ed1f0: Raise test timeout threshold to 3 seconds (#2058)
    (@anderseknert)
  - d7aaf8f: Use new inmem.NewFromASTObject to set up Regal store
    (#2056) (@anderseknert)
  - 98fc359: Add import future.keywords completion provider
    (#2055) (@anderseknert)
  - bcdaa1d: Various completion provider improvements (#2057)
    (@anderseknert)</changelog>
</package>
<package pkgid="c0e1d38f6d125b602724d2eb8a58ef8685727e29cc7fcc9b2f4bcee11a50fec33288395df86ad5a3027139703e568c094b520a5faf73f79cf8e10aaec1fa8ac5" name="regal" arch="src">
  <version epoch="0" ver="0.42.0" rel="11.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743163200">- new package regal: linter and language server for Rego, bringing
  your policy development experience to the next level</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 0.33.1:
  This release is the same tag as v0.33.1, please see that release
  for the release notes.
  Another v0.33.1 was released to trigger the rebuilding of some
  assets that were deleted in a draft release.
  * New Rule: in-wildcard-key
    Using a wildcard variable (_) for the key in the key-value form
    of iteration (some _, value in collection) is never needed, and
    can be replaced by the simple some value in … form . This rule
    flags cases where the key iteration is redundant. (Read more)
  * New Rule: confusing-alias
    While import aliases can improve readability, aliasing an
    import reference that is also imported without an alias is
    confusing, as both names point to the same resource. This rule
    catches such cases. (Read more)
  * New Rule: mixed-iteration
    Rego supports different styles of collection iteration. While
    "reference style" iteration (collection[_]) can be concise for
    deeply nested structures, mixing it with the some .. in style
    within a single iteration expression makes for code that’s more
    difficult to follow. This rule encourages consistency within a
    single iteration statement. (Read more)
  * New Rule: narrow-argument
    This new rule analyzes function arguments to suggest narrowing
    them down to the minimal value the function depends on. This
    can improve clarity and reusability. The rule considers
    incrementally defined functions across all their definitions.
    This is a powerful but opinionated rule and is thus in the
    custom category and is not on by default. See the documentation
    for how to enable it if you’re curious to try it out! (Read
    more)
  * Performance Improvements
    Several improvements have been made to reduce memory
    allocations and improve overall linting performance. Numbers
    below refer to Regal’s benchmark for linting its own policies.
  - Optimized config loading and parsing, saving around 2.7
    million allocations (#1491).
  - Reduced allocations by approximately 2 million (#1494).
  - Improved the performance of the use-strings-count rule,
    saving almost 1 million allocations (#1465).
  - Optimized reference comparisons and small iteration patterns,
    saving around 300k allocations (#1472).
  - Included performance enhancements alongside an update to the
    external-reference rule to make it more configurable (#1496).
  * OPA v1.3.0
    Regal has been upgraded to use OPA v1.3.0. This brings several
    upstream improvements, including support for the new one-liner
    grouping in formatting (see OPA#6760). (#1459)
  * Bug Fixes
  - Fixed a bug in the handling of Rego input from stdin. Thanks
    @tokyowizard for the report! (#1474)
  - Fixed a panic that could occur in FindConfigRoots when
    supplied with unexpected arguments. (#1487)
  * Other Rule Updates
  - The external-reference rule can now be configured with a
    maximum number of allowed external references, instead of
    solely flagging all external uses within a function. If you
    previously had this rule disabled, you might want to try
    enabling it now, and possibly tweak its configuration to your
    liking. (#1496)
  - The rule-length rule now has a separate setting
    (max-test-rule-length) with a higher default value (60 vs 30)
    for test rules, acknowledging that tests often include
    substantial data. (#1476)
  - Updated documentation for the rule-named-if rule based on
    community feedback received via the page feedback form
    (please let us know if you see issues! &amp; thanks for the
    report!) (#1463)
  * Dependencies
    This release also updates Regals dependencies as follows.
  - github.com/open-policy-agent/opa v1.2.0 -&gt; v1.3.0
  - github.com/prometheus/client_golang v1.21.0 -&gt; v1.21.1
  - go.opentelemetry.io/otel v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/metric v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/sdk v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/trace v1.34.0 -&gt; v1.35.0
  - golang.org/x/crypto v0.35.0 -&gt; v0.36.0
  - golang.org/x/net v0.36.0 -&gt; v0.38.0
  - golang.org/x/sync v0.11.0 -&gt; v0.12.0
  - golang.org/x/sys v0.30.0 -&gt; v0.31.0
  - golang.org/x/text v0.22.0 -&gt; v0.23.0
  - google.golang.org/protobuf v1.36.4 -&gt; v1.36.5
  * Changelog
  - automated: update capabilities by @github-actions in #1458
  - OPA 1.3.0 by @anderseknert in #1459
  - Parameterize some tests by @anderseknert in #1460
  - automated: update capabilities by @github-actions in #1461
  - build(deps): bump the dependencies group with 2 updates by
    @dependabot in #1462
  - docs: rule-named-if by @charlieegan3 in #1463
  - Some perf fixes by @anderseknert in #1465
  - Rule: in-wildcard-key by @anderseknert in #1466
  - Increase coverage by @anderseknert in #1467
  - build(deps): bump github/codeql-action from 3.28.13 to
    3.28.14 in the dependencies group by @dependabot in #1468
  - perf: various improvements by @anderseknert in #1472
  - Rule: confusing-alias by @anderseknert in #1470
  - Add benchmark for testing all rules individually by
    @anderseknert in #1469
  - Rule: mixed-iteration by @anderseknert in #1475
  - Add max-test-rule-length setting to rule-length rule by
    @anderseknert in #1476
  - fix: ensure policy from stdin is enumerated correctly by
    @anderseknert in #1474
  - automated: update capabilities by @github-actions in #1477
  - builtins.RegalIsFormatted: recover from formatter panics by
    @srenatus in #1481
  - automated: update capabilities by @github-actions in #1482
  - build(deps): bump github/codeql-action from 3.28.14 to
    3.28.15 in the dependencies group by @dependabot in #1484
  - Fix unnecessary-some rule not working after OPA 1.0+ by
    @anderseknert in #1485
  - FindConfigRoots: return error, not panic by @srenatus in
    [#1487]
  - perf: Improve how config is parsed, and when by @anderseknert
    in #1491
  - Rule: narrow-argument by @anderseknert in #1488
  - build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 by
    @dependabot in #1490
  - build(deps): bump codecov/codecov-action from 5.4.0 to 5.4.2
    in the dependencies group by @dependabot in #1495
  - Make external-reference rule less annoying by @anderseknert
    in #1496
  - docs: fix docs that still used v0 syntax by @anderseknert in
    [#1494]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 0.34.0:
  After a month of development, we're happy to announce Regal
  v0.34. This version of the OPA community's favorite linter and
  language server brings you new 3 linter rules, performance
  improvements and much more.
  With the v0.34.0 release, Regal now ships with more than 100
  linter rules!
  Which is pretty close to one new week per rule since the project
  started.
  * New rules
  - unresolved-reference
    This one is particularly exciting! The new
    unresolved-reference rule reports any references (like
    data.users.permissions) that cannot be resolved (i.e. found)
    anywhere in the project. Some projects will have valid
    references that can't be resolved at the time Regal lints the
    project, and the rule provides configuration options to mark
    certain references, or entire paths (like data.users.*) as
    resolved. See the docs for the rule for more details.
  - pointless-import
    Category: imports
    The new pointless-import rule will flags imports of the same
    package, and other import forms where the import has no real
    effect.
  - single-item-in
    Category: idiomatic
    The single-item-in rule reports cases of in being used on a
    single item collection, and suggests using an equality check
    instead.
  * Performance
  - Use OPA v1.5.0, which brings performance improvements to walk
    reducing linting time by about 10%.
  - Faster linting by avoiding walk in a few locations where
    possible.
  - Improve performance of aggregate rules.
  - Several performance optimizations to Regal's linter rules.
  * API
  - The linter API now has a new Prepare method that can be used
    to prepare the linter before reusing it across several runs.
  * Various
  - Some rules that would previously only scan the topmost level
    of a rule body will now recursively scan the whole rule.
  - The input completions provider has been rewritten in Rego
    (previously Go).
  - The automatic version check has been rewritten in Rego
    (previously Go).
  * Bugs
  - Fix false positive in custom one-liner-rule.
  * Docs
  - Updated roadmap. Go check it out!
  - Move rules table from README and into a more interactive form
    on the Styra docs. Take a look!
  - Add link to Renovating Rego blog.
  - README: add link to KubeCon London talk, which prominently
    featured Regal.
  - Update links to adapt to OPA's new documentation.
  - Update outdated information in README.
  * Dependencies
  - build(deps): bump the dependencies group with 2 updates
    (#1551)
  - build(deps): bump the dependencies group with 2 updates
    (#1544)
  - build(deps): bump the dependencies group with 2 updates
    (#1521)
  - build(deps): bump github/codeql-action in the dependencies
    group (#1507)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1749038400">- Update to version 0.34.1:
  This patch release fixes a bug found since v0.34.0 as well as it
  bumps the OPA dependency to the v1.5.1 patch also released today.
  While Regal's own policies were not affected by the regression in
  walk, custom linter rules could very well be.
  * Highlights
  - OPA v1.5.0 -&gt; v1.5.1
  - Go 1.23 -&gt; 1.24
  - Fix false positive in sprintf-arguments-mismatch when the
    %-*s pattern was used for padding.
  * Changelog
  - OPA v1.5.1 and some perf tweaks (#1580)
  - docs: Update typo in link (#1581)
  - deps: Revert 47c70f0 tablewriter changes (#1579)
  - docs: Update to allow better regal docs generation (#1578)
  - [create-pull-request] automated change (#1577)
  - fix: consider padding pattern in sprintf-arguments-mismatch
    (#1575)
  - build(deps): bump ossf/scorecard-action in the dependencies
    group (#1576)
  - Fix deprecated notices in .goreleaser.yaml (#1570)
  - Go 1.23 -&gt; 1.24 (#1573)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751371200">- Update to version 0.35.1 (0.35.0 was not released):
  We're happy to release v0.35.1, the mid-summer release of Regal
  for the 🏖️ ! This release updates to OPA v1.6.0 bringing a number
  of performance improvements as well as other improvements and bug
  fixes.
  * Improved Schema Loading This PR replaces Regal's custom schema
    loader with one that matches OPA's behavior, enabling the same
    schemas to work across opa check, opa eval, and other OPA
    commands. PR #1605
  * Performance Improvements
  - Thanks to a PR in OPA, Regal's memory use is now much reduced
    due to a change conditionally supplying built-in contexts
    only when needed.
  - This PR optimizes Rego evaluation by directly mapping source
    data to ast.Value objects instead of going through
    intermediate map[string]any or JSON representations,
    eliminating ~2.9 million allocations in benchmarks. PR #1606
  - Regal contributors will be happy with
    open-policy-agent/opa#7442 which makes running Regal's tests
    around 2.5x as fast!
  * Code Actions Rewrite
  - Code actions are LSP features that provide automated fixes or
    refactoring suggestions (like "quick fix" options), and this
    PR implements them for Regal with server-side filtering to
    reduce data transfer and ensure consistent editor behavior.
    This is also now implemented in Rego! PR #1604
  * Docs
  - PR #1584 refactors a number of Regal's pages including
    breaking down the previously large README into separate
    files. Browse the new structure on the Regal Website.
  - The Code Lens documentation has been updated to better
    explain supported configurations. Thanks @Shinzu for the
    report here. #1596
  * Changelog
  - 92d1ba9: deps: Update OPA to v1.6.0 (#1617) (@charlieegan3)
  - 2bbe76e: [create-pull-request] automated change (#1582)
    (@github-actions[bot])
  - 6e5e6bb: e2e: add frankenstein test build (@srenatus)
  - 5bf607d: build(deps): bump github/codeql-action in the
    dependencies group (#1585) (@dependabot[bot])
  - 6f45a9f: build(deps): bump brace-expansion from 2.0.1 to
    2.0.2 in /build (#1587) (@dependabot[bot])
  - e85b878: docs: Update config cli docs (#1584) (@charlieegan3)
  - 30c73fe: build(deps): bump github/codeql-action in the
    dependencies group (#1595) (@dependabot[bot])
  - b8f3e8f: fix: improve snippets suggestion condition (#1597)
    (@anderseknert)
  - eb48984: Fix issue with handling big numbers (#1599)
    (@anderseknert)
  - 1ee1cf4: fix: Correct end location in unresolved-reference
    (#1600) (@anderseknert)
  - e50c9af: Bump Roast -&gt; v0.12.0 (#1601) (@anderseknert)
  - 981d8d2: docs: Update Evaluation Code Lens docs (#1602)
    (@charlieegan3)
  - 3577efe: lsp/completion/input: don't suggest 'input'
    following dot (#1603) (@srenatus)
  - 02d1546: lsp: Code Action feature rewritten in Rego (#1604)
    (@anderseknert)
  - 25b1072: More robust loading of schemas (#1605)
    (@anderseknert)
  - 112dc87: perf: avoid JSON/map roundtrips in ast.Value
    transforms (#1606) (@anderseknert)
  - d87fd2f: docs: Tone down "obsolete" description for
    use-rego-v1 (#1610) (@anderseknert)
  - a939219: lsp: Roll over load file failures (#1611)
    (@charlieegan3)
  - 1d771ca: interning: bump opa+roast, replace call to
    ast.InternedBoolTerm() (#1613) (@srenatus)
  - ed0ead4: build(deps): bump
    github.com/go-viper/mapstructure/v2 in /e2e/testbuild (#1615)
    (@dependabot[bot])
  - 0d65ef0: build(deps): bump
    github.com/go-viper/mapstructure/v2 (#1614)
    (@dependabot[bot])</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1757851200">- Update to version 0.36.1 (0.36.0 was not released):
  This is Regal v0.36! The first Regal release since becoming a
  part of the OPA project last month. This release mostly delivers
  a number of new language server features as well as wider
  improvements under the hood and to the developer experience.
  * A note about Regal's documentation
    Our documentation is now displayed as part of the main OPA
    website!
    https://www.openpolicyagent.org/projects/regal
    From this release, links generated from Regal in output to
    rules will point to this location. You might find links to the
    old location as we get things updated. Please feel free to open
    any issues for link problems you find just so we don't miss
    anything.
  * Get contextual documentation when calling built-in functions
  - Following PR #1654, the Regal language server will now offer
    signatureHelp to compatible clients. This shows the current
    argument type and description in the help text for built-in
    functions. This is in addition to the other general function
    documentation displayed here.
  * Quickly see related fields in when editing METADATA
  - PR #1657 implements support for the documentHighlight request
    from clients. This is currently only used to show signal
    other related METADATA keys when working with Rego metadata.
    In future, this same functionality could be used to highlight
    other related items currently in the viewport.
  * Jump directly from ignore directives to documentation
  - documentLink is another request from clients which allow the
    server to respond with link ranges. We have used this to make
    regal ignore directives clickable, helping users quickly
    learn what they mean when encountered in policies PR #1657.
  * Get live diagnostics from custom rules as you type
  - PR #1631 ensures that users of custom linter rules are also
    able to access these for live diagnostics in language server
    clients. Previously these were not evaluated in the server,
    only in the Regal CLI.
  * Notable Refactors &amp; Development Changes
  - Rego Language Server Routing: PR #1675 makes some notable
    changes to how Rego is used within the Regal’s language
    server. The Language Server Protocol (LSP), which Regal
    implements to support LSP clients, is based on JSON message
    passing. This lends itself to Rego evaluation which is JSON
    in, JSON out. This PR updates the handling of different LSP
    messages sent from clients to route them in Rego, handling
    Rego backed rules first, and falling back to Golang
    implementations that still remain otherwise. This sets the
    direction for more Rego LSP functionality in the language
    server in future.
  - Development bundle loading from disk: PR #1646 gives those
    working on Regal in development the option of using the
    current source for the Regal bundle without rebuilding the
    binary. This improves the experience when working on Rego
    based language server functionality by reducing the time of a
    feedback loop. Set REGAL_BUNDLE_PATH to use this feature.
  * Changelog
  - 1f1044f: build: Remove tap key (#1687) (@charlieegan3)
  - build(deps): bump github/codeql-action from 3.29.0 to 3.29.1
    in the dependencies group by @dependabot[bot] in #1616
  - Add Regal bundle compilation benchmark by @anderseknert in
    [#1618]
  - Remove quotes from keywords in refs by @anderseknert in #1619
  - lsp: Skip loading files on disk when in cache by
    @charlieegan3 in #1620
  - build(deps): bump the dependencies group with 2 updates by
    @dependabot[bot] in #1621
  - automated: update capabilities by @github-actions[bot] in
    [#1622]
  - add experimental lsp package for websocket communication by
    @srenatus in #1623
  - internal/io: add FindInputPath when the content isn't needed
    by @srenatus in #1624
  - build(deps): bump github/codeql-action from 3.29.2 to 3.29.3
    in the dependencies group by @dependabot[bot] in #1626
  - lsp/completions: Handle hyphenated package names by
    @charlieegan3 in #1625
  - lsp: fix didOpen templating race by @charlieegan3 in #1627
  - build/lsp: add web client demo by @srenatus in #1629
  - lsp: Fix stale diagnostics after deletion by @charlieegan3 in
    [#1628]
  - Some doc updates by @anderseknert in #1632
  - lsp: Add support for custom rules by @charlieegan3 in #1631
  - Vendor roast dependency by @anderseknert in #1634
  - lsp: Address windows goto definition URI issue by
    @charlieegan3 in #1633
  - Fix regal new rule issues + refactor io code by @anderseknert
    in #1636
  - lsp: Use full text replacement for Intellij fmt by
    @charlieegan3 in #1637
  - test: refactor e2e test, add new regal command runner by
    @anderseknert in #1640
  - build(deps): bump github/codeql-action from 3.29.3 to 3.29.5
    in the dependencies group by @dependabot[bot] in #1641
  - Fix missing source.explore code action by @anderseknert in
    [#1643]
  - lsp: Present filename relative to root in errors by
    @charlieegan3 in #1638
  - refactor: Improve code quality throughout the codebase by
    @anderseknert in #1642
  - lsp/uri: Refactor URI handling by @charlieegan3 in #1644
  - Tidying up more code by @anderseknert in #1645
  - Provide development option to load bundle from disk by
    @anderseknert in #1646
  - lsp/eval: Ensure filenames use URI in print output by
    @charlieegan3 in #1647
  - Rewrite more completion providers in Rego. Resolve schemas at
    runtime. by @anderseknert in #1652
  - lsp: Add signature help by @charlieegan3 in #1654
  - lsp: Fix server signature race in test by @charlieegan3 in
    [#1655]
  - build(deps): bump the dependencies group with 5 updates by
    @dependabot[bot] in #1639
  - build(deps): bump the dependencies group with 3 updates by
    @dependabot[bot] in #1653
  - docs: update README badges for OPA 1.7.1 release by
    @charlieegan3 in #1656
  - New LSP features and internal improvements by @anderseknert
    in #1657
  - lsp/documenthighlight: Add tests by @charlieegan3 in #1659
  - Add tests for textDocument/documentLink handler by
    @anderseknert in #1658
  - Styra URLs -&gt; OPA URLs by @anderseknert in #1662
  - docs: Update README re: move to open-policy-agent by
    @charlieegan3 in #1664
  - internal/io: explicitly disable lazy loading of regal bundle
    by @srenatus in #1666
  - build(deps): bump the dependencies group across 1 directory
    with 4 updates by @dependabot[bot] in #1663
  - Enable pprof endpoint only with env var set by @anderseknert
    in #1667
  - docs: Remove update workflow &amp; minor adjustments by
    @charlieegan3 in #1668
  - Disable Codecov PR comments by @anderseknert in #1670
  - deps: OPA v1.8.0 by @anderseknert in #1669
  - docs: Changes needed in docs for opa site deploy by
    @charlieegan3 in #1673
  - build(deps): bump github/codeql-action from 3.29.11 to 3.30.0
    in the dependencies group by @dependabot[bot] in #1674
  - Rego-based routing of Rego handlers + refactor by
    @anderseknert in #1675
  - Just one more.. refactor by @anderseknert in #1677
  - docs: Updates in preparation for OPA site deploy by
    @charlieegan3 in #1676
  - lsp: GTD use URI for location by @charlieegan3 in #1680
  - fix: Don't use OS path separator when walking FS by
    @anderseknert in #1681
  - build(deps): bump the dependencies group with 3 updates by
    @dependabot[bot] in #1678
  - build: Add windows runners to build workflow by @charlieegan3
    in #1682
  - Weekend refactor by @anderseknert in #1684
  - Fix documentLink issue when no user config provided by
    @anderseknert in #1686
  - build: Remove tap key by @charlieegan3 in #1687</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- Update to version 0.37.0:
  This release features a new linter rule, several new language
  server features, and many improvements and fixes. The two major
  OPA versions bumped since the last release additionally contains
  several performance improvements that were contributed as part of
  developing Regal!
  * New Rule: prefer-equals-comparison
    The prefer-equals-comparison linter rule recommends using the
    == operator for equality comparison over the unification
    operator =. The rule helps improve code clarity by using
    operators for their intended purposes: := for assignment, ==
    for equality comparison, and = for unification. The linter
    identifies when = is used for comparison by checking if both
    sides of the operator are "unassignable".
    Avoid
    input.request.method = "GET"
    Prefer
    input.request.method == "GET"
    There are some certainly valid use cases for the unification
    operator! But simple equality comparison is not one. For more
    information, see the documentation for the rule. As an amusing
    aside, this fixes one of the first issues created in the
    project!
  * Language server: Document highlighting to help show where
    function args are referenced
    Document highlighting is one of the more subtle features of the
    LSP specification, but a really helpful one when implemented
    well. The experimental first implementation that shipped with
    Regal v0.36.0 is no longer experimental, and has also been
    extended to highlight usage of function argument variables
    inside of a function head or body.
    (Please find the screencast in the release notes)
  * Language server: Selection ranges
    Selection ranges provide smart selection of code that can
    expand and shrink based on knowledge of the code rather than
    simple text properties, like hyphens or whitespace. This makes
    moving code around extremely fast, and without leaving the
    keyboard. Consult the language server docs for how to enable
    this in your editor
    (Please find the screencast in the release notes)
  * Improvements
  - The pointless-reassignment rule would previously only flag
    reassignment at the top level of a rule body. Now it flags
    pointless reassignments also in nested bodies, like
    comprehensions, every statements, and so on.
  - All completion providers are now implemented purely in Rego
  - Remove the go-semver dependency in favor of a custom, much
    faster implementation
  - Build: Reduce permissions granted in update-caps top-level
    workflow, by @timothyklee
  - Docs: Update language server page to demonstrate recently
    added features
  - Docs: Add kakoune LSP configuration example
  * Windows compatibility improvements
    In this release we have fixed various Windows bugs (Language
    Server Init, Goto Definition, Error Popups) in #1740, #1737,
    [#1736], following #1633, and #1642 last release.
    These fixes have also made it possible to run our test suites
    on Windows runners to catch issues sooner in future. A huge
    thanks to @charlieegan3 for his tireless work on this!
  * Bugs fixed
  - Fix false positive in use-some-for-output-vars triggered by
    nested variables in rule ref heads, like rule[input[i]].allow
    if ....
  - Fix false positive in redundant-existence-check when a not
    check made an existence check necessary, reported by @gusega
  - Fix false positive in narrow-argument rule, which would
    incorrectly flag some arrays passed as arguments
  - Ensure that the language server InitOptions is never nil and
    don't cause issues with clients that don't provide those
  * Dependency Updates:
  - github.com/open-policy-agent/opa: v1.8.0 → v1.10.1
  - github.com/arl/statsviz: v0.7.1 → v0.7.2
  - github.com/go-git/go-git/v5: v5.16.2 → v5.16.3
  - github.com/olekukonko/tablewriter: v0.0.5 → v1.1.0
  - github.com/spf13/cobra: v1.9.1 → v1.10.1
  - github.com/spf13/pflag: v1.0.7 → v1.0.10
  - Removed: github.com/coreos/go-semver: v0.3.1
  * Changelog
  - 244459c: docs: Remove some old references (#1689)
    (@anderseknert)
  - 4212b5c: build(deps): bump the dependencies group with 2
    updates (#1690) (@dependabot[bot])
  - e149c6d: build: reduce update-caps top-level workflow
    permission to read (#1691) (@timothyklee)
  - 819bbec: lsp: Fix missing initial root (#1692)
    (@charlieegan3)
  - be8b020: docs: Update style guide links to new repo (#1693)
    (@charlieegan3)
  - ceb890b: Builtin function completion in Rego (#1694)
    (@anderseknert)
  - d36555e: Package ref import suggestions in Rego (#1698)
    (@anderseknert)
  - 4e44131: build(deps): bump the dependencies group with 2
    updates (#1703) (@dependabot[bot])
  - 14166e9: Avoid multi-line highlighting of issues (#1702)
    (@anderseknert)
  - 1685bb8: Move completion handler into Rego router (#1699)
    (@anderseknert)
  - 0da5eaa: build(deps): bump the dependencies group with 2
    updates (#1708) (@dependabot[bot])
  - e792757: Bump OPA -&gt; v1.9.0, golangci-lint 2.5.0 (#1709)
    (@anderseknert)
  - 3092d1d: docs: Address some broken links from OPA report
    (#1704) (@charlieegan3)
  - bebfd06: util: use Partial2 for IsAnyError (@srenatus)
  - f22a570: Fix false positive in redundant-existence-check
    (#1716) (@anderseknert)
  - 2703715: Various fixes (#1715) (@anderseknert)
  - 87981f2: build(deps): bump the dependencies group with 2
    updates (#1713) (@dependabot[bot])
  - a6487b6: lsp: document highlighting supporting function args
    (#1718) (@anderseknert)
  - fe8cbd3: Rule: prefer-equals-comparison (#1726)
    (@anderseknert)
  - f3722ea: Fix false positive in narrow-argument (#1724)
    (@anderseknert)
  - 73b8c65: Improve pointless-reassignment to cover nested cases
    (#1727) (@anderseknert)
  - 9cf180c: lsp: Implement selection ranges and linked editing
    range (#1722) (@anderseknert)
  - bf632d0: build(deps): bump the dependencies group with 2
    updates (#1725) (@dependabot[bot])
  - a373ae3: lsp: Use filename path for current buffer for defns
    (#1732) (@charlieegan3)
  - d758eaf: lsp: Refactor range utilities (#1729)
    (@anderseknert)
  - 13de8a9: Fix incorrect behavior in pointless-import (#1733)
    (@anderseknert)
  - fb560c1: Fix false positive in use-some-for-output-vars
    (#1731) (@anderseknert)
  - 70449b7: Various small fixes (#1736) (@anderseknert)
  - 2594719: windows: Better use of slash paths (#1737)
    (@charlieegan3)
  - 499125f: Get FindClosestMatchingRoot working on windows
    (#1740) (@charlieegan3)
  - 3715085: OPA v1.10.0 (#1742) (@anderseknert)
  - 781f809: deps: stick to
    github.com/vektah/gqlparser/v2@v2.5.30 (#1744) (@srenatus)
  - bbb03db: Use generic client identifier in tests (#1741)
    (@charlieegan3)
  - c42ce08: build(deps): bump github/codeql-action in the
    dependencies group (#1745) (@dependabot[bot])
  - 4384b0d: Remove go-semver dependency, plus various fixes
    (#1746) (@anderseknert)
  - 97dfbd4: docs: update LSP page to show new features (#1748)
    (@charlieegan3)
  - 818b33a: docs: Minor fixes to docs typos and links (#1747)
    (@charlieegan3)
  - 4138270: Update to OPA v1.10.1 (@charlieegan3)
  - 55cf029: lsp: ensure that InitOptions is never nil (#1752)
    (@srenatus)
  - 8ffa270: docs: add kakoune LSP config snippet (#1751)
    (@srenatus)
  - 216341a: reporter,lsp: update URLs for help links (#1750)
    (@srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 0.38.0:
  * Feature: String Interpolation Support
    v0.38.0 of your favorite Rego linter, debugger and language
    server brings full support for OPA's new string interpolation
    feature. This means not only that Regal lints code found inside
    interpolated strings, but that you'll have access to all your
    favorite language server features within them too — like code
    completions, tooltips on hover, or document highlighting. You
    can even use the debugger to step through interpolated
    expressions! If you haven't yet tried it out, grab OPA v1.12.2,
    Regal v0.38.0 and enjoy an absolutely awesome addition to the
    Rego language!
    In addition to this, we have a number of fun new features and
    performance improvements.
  * New Rule: disallow-rego-v1
    Category: custom
    This optional new rule flags the use of import rego.v1 in Rego
    policies (#1778). Since OPA v1.0 (December 2024), this import
    is a no-op and no longer needed. The rule helps users maintain
    clean code by preventing this outdated import from appearing in
    new policies. Teams standardizing on OPA 1.0+ can enable this
    rule to enforce modern Rego standards.
    package example
    import rego.v1 # &lt;-- Happy 2026! Time to stop doing this!
  * New Fixers
    @SeanLedford has also done some great work to help expand
    Regal's auto-fixing capabilities by having regal fixers added
    for three more rules.
  - prefer-equals-comparison
  - redundant-existence-check
  - constant-condition
    See (#1790) and (#1794) for more details.
  * Performance
    The fixer saw a 12% performance improvement by reusing the
    linter, reducing allocations from 2.3M to 2.0M operations
    (#1783). Additional optimizations include:
  - faster file filtering by avoiding recompiled ignore patterns
    (#1758),
  - better built-in function handling by registering Regal's
    functions globally only once (#1788),
  - and more efficient AST location serialization (#1758)
    To track ongoing performance work, a new post-merge
    benchmark-recording workflow was added (#1793).
  * LSP: New Ignore Code Action
    The language server now supports a code action to quickly add
    regal ignore configuration for specific rules directly from the
    editor (#1777).
  * Changelog
  - ac35695: Various performance improvements (#1758)
    (@anderseknert)
  - 48cd03d: docs: Add custom head for regal index page (#1761)
    (@charlieegan3)
  - 728ae28: build(deps): bump golangci/golangci-lint-action
    (#1762) (@dependabot[bot])
  - 92cf6ca: explorer: allow hiding stages without an effect
    (+misc) (#1760) (@srenatus)
  - c000994: docs: Correct sidebar labels (#1763) (@charlieegan3)
  - bf0b621: build(deps): bump
    github.com/containerd/containerd/v2 in /e2e/testbuild (#1753)
    (@dependabot[bot])
  - 18e7a89: build(deps): bump
    github.com/containerd/containerd/v2 (#1754)
    (@dependabot[bot])
  - ccab7bd: Rename: encoding/util -&gt; encoding/write (#1764)
    (@anderseknert)
  - 54f7625: build: run windows in matrix with other jobs (#1770)
    (@charlieegan3)
  - 5c9e6f0: update: Update version checking logic (#1772)
    (@charlieegan3)
  - 5034776: build: Add badge update to readme script (#1773)
    (@charlieegan3)
  - 95e8220: Added OPA installation as a Regal prerequisite, and
    fixed golangci-lint link. (#1774) (@SeanLedford)
  - 149f71d: build(deps): bump js-yaml from 4.1.0 to 4.1.1 in
    /build (#1775) (@dependabot[bot])
  - b8f8b7f: Enable more golangci-lint linters (@anderseknert)
  - e092627: build: Update mac runner (@charlieegan3)
  - 877884c: lsp: Add code action and command to ignore rule
    (#1777) (@charlieegan3)
  - ece9ca2: build(deps): bump the dependencies group with 5
    updates (@dependabot[bot])
  - bd37bbd: build(deps): bump golang.org/x/crypto in /build/lsp
    (@dependabot[bot])
  - 17cc429: build(deps): bump golang.org/x/crypto in
    /e2e/testbuild (@dependabot[bot])
  - 415b05f: build(deps): bump golang.org/x/crypto from 0.43.0 to
    0.45.0 (@dependabot[bot])
  - e1bb975: Improve fixer performance (@anderseknert)
  - 1b083ff: Added Rule: Disallow import rego.v1 (#1778)
    (@SeanLedford)
  - 9e43c50: Optimize and improve code for built-in functions
    (@anderseknert)
  - 64ce2aa: build(deps): bump glob and markdownlint-cli in
    /build (#1779) (@dependabot[bot])
  - 48fddeb: build(deps): bump github/codeql-action in the
    dependencies group (#1787) (@dependabot[bot])
  - bc41f63: pkg/linter: use errgroup, set limits + context on it
    (@srenatus)
  - f22c2aa: Add fixer for prefer-equals-comparison rule (#1790)
    (@SeanLedford)
  - cf88eb9: Fixers for redundant-existence-check and
    constant-condition rules (#1794) (@SeanLedford)
  - 36401a2: build(deps): bump the dependencies group across 1
    directory with 7 updates (#1796) (@dependabot[bot])
  - ecb23d3: version: Add OPA version to version output (#1798)
    (@charlieegan3)
  - 94ce038: build(deps): bump golang.org/x/crypto from 0.43.0 to
    0.45.0 in /build/ws (#1791) (@dependabot[bot])
  - 9ce1ddd: workflows: add post-merge benchmark-recording
    workflow (@srenatus)
  - e111443: workflows/benchmark: fix golang setup (@srenatus)
  - 4bb2d5a: docs: Update messy rule docs (@charlieegan3)
  - dec83ea: docs: Updates from opa website link scanner
    (@charlieegan3)
  - 8f544a6: fix typo in fix.go help message (#1807) (@gusega)
  - 941b02e: build(deps): bump the dependencies group with 3
    updates (#1804) (@dependabot[bot])
  - 9f09e6e: build(deps): bump the dependencies group with 4
    updates (#1808) (@dependabot[bot])
  - 476ef89: OPA v1.12.2 and full string interpolation support
    (#1811) (@anderseknert)
  - a9843ab: Move chained-rule-body to custom category (#1812)
    (@anderseknert)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768392000">- Update to version 0.38.1:
  This patch release fixes several bugs including some found in the
  recent v0.38.0 release, as well some other improvements.
  * Bug Fixes
  - Fix for prefer-equals-comparison fixer failing to parse
    policies with multiple "=" in expressions (#1824, fixes #1818
    reported by @gusega)
  - Fix for incorrect fixable violation count display in lint
    output (#1825, fixes #1813 reported by @gusega)
  - Fix for false positive in prefer-equals-comparison rule with
    comprehension term vars (#1828, fixes #1826 reported by
    @SeanLedford)
  - bundle: Surface configured rule notices as messages in lint
    output (#1827, fixes #1795 reported by @ghmer)
  * Improvements
  - Code action for prefer-equals-comparison fixer now available
    in the language server (#1810)
  - New option for prefer-value-in-head rule to count
    interpolated strings as scalars (#1817)
  - Minor performance improvement for any_set_item, used for
    selecting items from sets (#1815)
  * Changelog
  - f1c5f74: bundle: Improve performance of any_set_item (#1815)
    (@charlieegan3)
  - 9300420: Implemented Code action for prefer-equals-comparison
    fixer (#1810) (@SeanLedford)
  - 28121f0: build(deps): bump github/codeql-action in the
    dependencies group (#1823) (@dependabot[bot])
  - 54cdcb6: Add prefer-value-in-head option to count
    interpolated string as scalar (#1817) (@anderseknert)
  - e68184d: Fix false positivie in prefer-equals-comparison
    (#1828) (@anderseknert)
  - 593e221: fix: Prefer-Equals-Comparison Edge Case With
    Multiple "=" (#1824) (@SeanLedford)
  - 3dc28bb: bundle: Surface configured rule notices (#1827)
    (@charlieegan3)
  - aac9618: Updated lint reporter to track fixable violation
    count separate from fixable violation Set (#1825)
    (@SeanLedford)
  - fd6dd4d: Updated example for prefer-equals-comparison edge
    case to not include false positive (#1829) (@SeanLedford)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772193600">- Update to version 0.39.0:
  We're happy to announce Regal v0.39.0, featuring 3 new linter
  rules, many language server improvements, and much faster
  linting!
  * New Rule: use-array-flatten
    Category: idiomatic
    The use-array-flatten rule recommends using array.flatten
    instead of nested array.concatenation (#1873).
    Avoid
    package policy
    flat1 := array.concat(arr1, array.concat(arr2, arr3))
    flat2 := array.concat(arr1, array.concat(arr2, array.concat(arr3, arr4)))
    Prefer
    package policy
    flat1 := array.flatten([arr1, arr2, arr3])
    flat2 := array.flatten([arr1, arr2, arr3, arr4])
  * New Rule: use-object-union-n
    Category: idiomatic
    The use-object-union-n rule recommends using object.union_n
    over nested calls to object.union (#1873).
    Avoid
    package policy
    obj := object.union(obj1, object.union(obj2, obj3))
    Prefer
    package policy
    obj := object.union_n([obj1, obj2, obj3])
  * New Rule: equals-over-count
    Category: performance
    The new optional equals-over-count rule suggests using direct
    equality comparisons rather than count when checking collection
    membership or emptiness (#1878). This is a micro-optimization
    and not a general recommendation. Must be manually enabled.
  * Performance
    This release brings an approximate 25% reduction in linting
    time through aggregate remodeling and Rego prepare stage
    optimizations (#1838). Additional performance work includes
    Rego refactoring (#1857, #1884), AST transform improvements
    (#1892), and various micro-optimizations (#1866, #1879).
  * Language Server Improvements
    The language server now includes a semantic token framework for
    improved syntax highlighting (#1845, #1865, #1870), code
    actions for the constant-condition and
    redundant-existence-check fixers (#1830).  and an
    opaTestProvider feature for test discovery (#1888, #1889,
    [#1898]),
    Completion performance is improved with a
    completionItem/resolve handler (#1831), and server capabilities
    are now properly exposed and consistent with the clients
    (#1867, #1880).
    Note: Semantic token support is feature flagged and will be
    available in the next release.
  * Compiler Explorer
    Regal now supports the VSCode-based OPA Explorer extension,
    providing a rich GUI to compare compiler stages directly in VS
    Code (#1862) - thanks @srenatus! A new "Format stages" option
    has also been added to the compiler explorer (#1854) - thanks
    @johanfylling!
  * Experimental: rq Engine Support
    Initial support for the rq engine has been added (#1872)
  * Various Improvements
  - Improved redundant-existence-check rule (#1897, fixes #1805)
  - Disabled zero-arity-function rule as opa-fmt now covers that
    (#1885)
  * Bug Fixes
  - Fix nil dereference on compiler errors in explorer (#1837)
  - Fix broken links to fixer page (#1852)
  - Fix false positive in use-some-for-output-vars (#1886)
  - Fix broken input.json completion provider (#1891)
  * Dependency Updates
  - Regal has been upgraded to use OPA v1.14.0 and Go 1.26.
  * Documentation
  - Added mise as an alternative installation method (#1849)
  - Updated installation documentation (#1861)
  - Updated note about eval and debug roots (#1894)
  - Show release badge when using pre-release versions (#1899)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 0.40.0:
  Today we celebrate Regal who turns v0.40.0 just in time for the
  GitHub download tracker to report 1 million total downloads.
  Quite the milestone! Thank you all for the encouragement, support
  and contributions during these past 3 years. Together we're
  redefining the policy development experience, and we have a lot
  more of that planned for the future. Stay tuned!
  This release includes 2 new linter rules, and many new features
  and improvements to both the linter and language server.
  * Linter
  - New Rule: invalid-regexp
    Category: bugs
    The new invalid-regexp rule scans regular expressions found
    in policies and reports invalid patterns that would otherwise
    fail at runtime.
    Avoid
    package policy
    invalid if regexp.match("[a-z", "test")
    Prefer
    package policy
    valid if regexp.match("[a-z]", "test")
  - New Rule: superflous-object-get
    Category: idiomatic
    The superflous-object-get rule flags calls to object.get
    where using the built-in function provides no benefit
    compared to using a reference directly, and without the call.
    Avoid
    package policy
    superfluous if {
    [#] the default value (`""`) isn't used in the expression,
    [#] so object.get provides no benefit here
    object.get(input, ["user", "department"], "") == "engineering"
    }
    Prefer
    package policy
    much_better if {
    input.user.department == "engineering"
    }
    More cases of superfluous object.get will be added to this
    rule as we encounter them.
  * Improvements
  - The naming-convention rule now accepts a list of allowed
    names in addition to regex patterns
  - The non-loop-expression rule now identifies more types of
    expressions that could be moved out of iteration
  - All rules now contain a related_resources item in their
    metadata pointing to the docs for the rule
  - The regal new rule command now generates a Related Resources
    section in the new rule's documentation template
  * Bugs Fixed
  - Fixed two false positives reported in the non-loop-expression
    rule
  - The server now exits with an error if the --profile flag is
    used without --format json (thanks @mvanhorn!)
  * Language Server
  * Evaluate and Debug Actions
    Any input.json or input.yaml file found in the workspace will
    be used for input during evaluation and debugging sessions,
    but this wasn't obvious without reading the docs. The
    Evaluate and Debug code lenses / commands will now present a
    dialog option asking to create an input.json file in the
    project workspace in case one isn't found. This file is
    populated with dummy JSON data based on references to input
    found in the policy, and should be edited by the user to
    provide more relevant data.
  * Hover Provider Improvements
    The hover provider showing tooltips for built-in functions
    and keywords has been rewritten in Rego, and additionally saw
    a few improvements land as part of that process:
  - Links to examples for built-in functions now point to the
    correct location in the OPA docs
  - The print function now shows up in hover results as well
  - Hover provider now less resource intensive, and all
    information rendered just in time for display
  * Inlay Hints Improvements
    The inlay hint provider (that provides names of function
    arguments to be displayed at call sites) has also been
    rewritten in Rego, and the server now implements also the
    inlayHint/resolve handler, which improves performance by only
    calculating inlay hint details when the client requests them
    for display.
    Additionally, the inlay hint provider now properly takes the
    range of the active editor view into account, and will only
    spend resources calculating hints for code that the user can
    actually can see.
  * Semantic Tokens in Comprehensions and every Expressions
    The language server's semantic token provider (providing
    context-based syntax highlighting) now provides semantic
    tokens inside of comprehensions and every expressions in
    addition to previously supported contexts. Additionally, most
    of the semantic token logic is now implemented entirely in
    Rego.
  * Improved Language Server Initialization
    This release contains a number of fixes and improvements
    related to the language server's initialization routine,
    which should now be both more robust and faster.
  * Bugs Fixed
  - Two potential nil dereferences identified and fixed
  - Fix a potential out of bounds panic in slice access
  - The bundled web server now shows a link to Regal's editor
    integration documentation on its index page
  * Finally
    Extra thanks goes out to @charlieegan3 this release, who worked
    tirelessly to fix some really complex race conditions and
    concurrency issues in the language server. A thankless job, but
    extremely important, and he pulled it off like a true Viking!
  * Changelog
  - 691afe1: Replace some Styra references (#1904)
    (@anderseknert)
  - 975ae72: build(deps): bump github.com/go-git/go-git/v5 in the
    dependencies group (#1903) (@dependabot[bot])
  - c85d88f: build(deps): bump go.opentelemetry.io/otel/sdk in
    /build/lsp (#1906) (@dependabot[bot])
  - 5ff449b: build(deps): bump the dependencies group with 3
    updates (#1907) (@dependabot[bot])
  - 9900522: lsp: Wait for client to send initialized at boot
    (#1909) (@charlieegan3)
  - d661b5a: build(deps): bump github/codeql-action in the
    dependencies group (#1912) (@dependabot[bot])
  - fd85e2d: Allow naming-convention rule to take list of names
    (not only a pattern) (#1911) (@anderseknert)
  - 299d3fc: Semantic Token Support for Comprehensions and
    Constructs (#1883) (@SeanLedford)
  - 422a9ef: build(deps): bump github/codeql-action in the
    dependencies group (#1915) (@dependabot[bot])
  - 02a9dc8: Fail with error when --profile used without JSON
    format (#1918) (@mvanhorn)
  - 1716e13: lsp/webserver: Add links to the index page (#1914)
    (@charlieegan3)
  - 1ab360f: lsp/testing: Nested test implementation (#1913)
    (@charlieegan3)
  - 53e5bf2: build(deps): bump google.golang.org/grpc in
    /e2e/testbuild (#1916) (@dependabot[bot])
  - 45841bf: build(deps): bump smol-toml and markdownlint-cli in
    /build (#1919) (@dependabot[bot])
  - 371bf1f: build(deps): bump picomatch from 4.0.3 to 4.0.4 in
    /build (#1920) (@dependabot[bot])
  - 62852fc: build(deps): bump the dependencies group across 1
    directory with 4 updates (#1921) (@dependabot[bot])
  - d32408d: build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#1922) (@dependabot[bot])
  - 8b9bcf0: build(deps): bump github.com/go-git/go-git/v5 from
    5.17.0 to 5.17.1 (#1923) (@dependabot[bot])
  - f2251f2: [create-pull-request] automated change (#1908)
    (@github-actions[bot])
  - 820d3f0: OPA v1.15.1 (#1925) (@anderseknert)
  - a155b62: Add popup prompt for creating input.json if it
    doesnt exist when Evaluate is run (#1929) (@SeanLedford)
  - 27067af: build(deps): bump the dependencies group with 2
    updates (#1931) (@dependabot[bot])
  - 2179ae4: Fix non-loop-expression false positives (#1930)
    (@anderseknert)
  - 33282ba: Rule: superflous-object-get (#1932) (@anderseknert)
  - 6fd115a: Include rule docs links in metadata (#1935)
    (@anderseknert)
  - 6a364fb: Fix aggregate test loop initialization (#1936)
    (@charlieegan3)
  - 61ab730: Rule: invalid-regexp (#1937) (@anderseknert)
  - 752ca7e: Cover more non-loop-expressions (#1938)
    (@anderseknert)
  - cb9a9c8: Add convenience functions for working with lines and
    uints (#1944) (@anderseknert)
  - 85171b8: build(deps): bump go.opentelemetry.io/otel/sdk in
    /e2e/testbuild (#1942) (@dependabot[bot])
  - 7fd6d66: [feature] Create input.json Skeleton if User Would
    Like When One Doesn't Exist (#1934) (@SeanLedford)
  - e4e326b: OPA v1.15.2 (#1945) (@anderseknert)
  - e8f1469: build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
    (#1941) (@dependabot[bot])
  - 7a1235c: Fix potential nil deref in language server (#1947)
    (@anderseknert)
  - d6d2bf0: Fix index out of bounds in parital inlay hint
    (#1948) (@anderseknert)
  - 0a0f1f8: build(deps): bump the dependencies group with 2
    updates (#1946) (@dependabot[bot])
  - d0e99b5: Rewrite hover provider in Rego (#1951)
    (@anderseknert)
  - cc35d48: Fix possible nil deref in ogre (#1954)
    (@anderseknert)
  - 44ceabe: Rewrite inlay hint provider in Rego (#1953)
    (@anderseknert)
  - 5c62c72: testing: Improve lsp shutdown logic &amp; address test
    race conditions (#1943) (@charlieegan3)
  - 12cc776: Semantic package tokens in Rego (#1956)
    (@anderseknert)
  - b4ccafc: feat(new): add Related Resources source link to
    builtin rule doc template (#1957) (@mvanhorn)
  - 543d3fa: linter/lsp: Tidy use of aggregates and store in ls
    (#1962) (@charlieegan3)
  - 1442904: build(deps): bump github.com/go-git/go-git/v5 from
    5.17.2 to 5.18.0 (#1958) (@dependabot[bot])
  - 293cd7f: build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#1959) (@dependabot[bot])
  - 344a389: build(deps): bump the dependencies group with 3
    updates (#1963) (@dependabot[bot])
  - 784fa86: Semantic import tokens Rego rewrite (#1960)
    (@anderseknert)
  - 0a00617: Refactor: Sending Variable Semantic Tokens Data from
    Rego (#1961) (@SeanLedford)
  - 9016d3d: Minor fixes (#1965) (@anderseknert)
  - 0ddd70f: docs: Update setup-regal in docs (#1964)
    (@charlieegan3)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780488000">- update to 0.41.1:
  NOTE this is the same code as that of v0.41.0 — just that the
  combination of a release deployment issue and immutable releases
  just had that one end up without any downloadable artifacts. That
  is now corrected!
- Update to version 0.41.0:
  This release brings automatic Rego test generation, as well as
  squashing a bunch of issues under the hood with sweeping
  enhancements to the core language server code.
  * New Feature: Automatic Test Generation
    A first pass at automatic test generation has landed in the
    language server (#1982), thanks to @SeanLedford! With a new
    code action available when working in a policy file, Regal can
    generate a test stub based on the current state of the
    workspace. This uses the values found in input.json to populate
    the with statements in the generated test.
  * Language Server Improvements
    This release includes significant internal improvements to the
    language server.
    Completion performance has seen a major improvement: for
    clients like VS Code that support a default replacement range,
    the completion payload is now roughly half the size it was
    before, and clients generally do no longer need to send
    continuous requests to the server for more suggestions once you
    start typing (#1992).
    The folding range provider has been rewritten in Rego (#1979),
    and now additionally honours client capabilities like
    lineFoldingOnly and rangeLimit.
    The handling of input.json and input.yaml files has been
    overhauled (#2002). These files are now tracked as first-class
    workspace state: they are parsed and cached when saved, and the
    server now requests update notifications for them from the
    client, rather than re-parsing the file on each evaluation, or
    debug sessions started.
  * OPA v1.17.0
    Regal has been updated to OPA v1.17.0 (#2014). This OPA release
    notably introduces future.keywords.not, which improves the
    semantics of the not keyword by wrapping composite-expression
    negation in an implicit body. Thanks @johanfylling for making
    sure this also works in Regal now!
    Regal's RoAST representation (and docs) have been updated to
    support the new ast.Not form introduced alongside this feature
    (#1985).
  * RoAST module.comments Representation
    The RoAST representation of module.comments has changed
    (#1987). Comments are now represented as plain locations rather
    than base64-encoded text, allowing Regal to retrieve the
    original text from the source file directly with less bytes to
    transfer and parse. Note: this is a breaking change for custom
    rules that reference input.comments directly. Users should
    instead prefer to reference data.regal.ast.comments_decoded,
    which provides comment locations in the usual form and which
    will remain stable even through future format changes.
  * Bug Fixes
  - Addressed a panic in regal fix caused by fixes being applied
    in non-deterministic order; opa-fmt could reduce line count
    such that use-assignment-operator would then access
    out-of-bounds row numbers (#2003) as reported by @erazemk
  - The unassigned-return-value rule now correctly flags
    namespaced builtins like json.match_schema(...) in addition
    to flat builtins like lower(...) (#2005) — thanks @mvanhorn
    for the fix and @anderseknert for the report
  - Nicer formatting of with sequences (#1969)
  - regal/ast: metadata labels field is now recognized as a valid
    metadata key, aligned with OPA v1.17.0 (#1983, #1988) —
    thanks @srenatus
  - Regal fix now works regardless of local git state (#2011).
    Thanks @seiyab for the report in #2006
  * What's Changed
  - Use common aggregate data in circular-import (#2019)
  - build(deps): bump github/codeql-action in the dependencies
    group (#2017)
  - debug: Determine abs debugging path for input.json (#2018)
  - Unify common aggregation and aggregated data (#2016)
  - build(deps): bump the dependencies group with 3 updates
    (#2008)
  - build(deps): bump github.com/containerd/containerd/v2 in
    /e2e/testbuild (#2007)
  - Add capabilities verification to build check (#2015)
  - Use logger in Rego router (#2012)
  - deps: Update opa to 1.17.0 (#2014)
  - Extract file polling into waitForFile helper (#2013)
  - Remove git validation from fix command (#2011)
  - lsp: Introduce workspace abstraction (#2009)
  - Remove the settings.json change that was introduced in my
    previous PR (#2010)
  - fix(rules): unassigned-return-value now covers namespaced
    builtins (#2005)
  - [feature] First Pass at Automatic Test Generation in Regal
    (#1982)
  - fixer: Apply linter fixes in deterministic order (#2003)
  - build(deps): bump the dependencies group across 1 directory
    with 2 updates (#1998)
  - build(deps): bump brace-expansion from 5.0.5 to 5.0.6 in
    /build (#1997)
  - Improved handling of input.(json|yaml) files (#2002)
  - build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#2000)
  - build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.1 (#2001)
  - Move location of LSP storage helpers (#1993)
  - New framework for testing language server handlers (#1992)
  - Breaking: new RoAST representation of module.comments (#1987)
  - regal/ast: update metadata fields (#1988)
  - roast: Add marshaling support for `ast.Not` (#1985)
  - Introduce passthrough handler type (#1984)
  - regal/ast: add 'id' to valid metadata keys (#1983)
  - build(deps): bump github/codeql-action in the dependencies
    group (#1981)
  - Move folding range provider to Rego handlers (#1979)
  - Cleanup (#1978)
  - feat(pre-commit): add regal-fix hooks for auto-fixing rules
    (#1847) (#1976)
  - build(deps): bump the dependencies group with 2 updates
    (#1975)
  - Move initialize handler to Rego router (#1977)
  - Various code quality improvements (#1970)
  - Nicer formatting of `with` test sequences (#1969)
  - Update ast.json else to use "#/$defs/rule" (#1967)
  - Use OPA main until next OPA release (#1968)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784289600">- Update to version 0.42.0:
  * Language Server
  - Find References and Rename
    This release brings initial support for finding references
    and renaming symbols in the workspace. This first version is
    limited to function arguments and some bindings, but we plan
    to expand this in future releases.
    Video see
    https://github.com/open-policy-agent/regal/releases/tag/v0.42.0
    References are checked across the whole workspace, and
    renames work even when for example, a function is
    incrementally defined in several different files.
  - New future.keywords completion provider
    The language server will now suggest future.keywords in
    completions for import lines — notably the new import
    future.keywords.not for now, with a few more to follow soon
    in OPA.
  * Debug Adapter
  - Evaluate
    Regal's debug adapter protocol (DAP) implementation now
    supports evaluating variables and expressions inside of stack
    frames in debugging sessions! This also allows setting up
    watch expressions in clients like VS Code.
    Video see
    https://github.com/open-policy-agent/regal/releases/tag/v0.42.0
    Make sure to download the latest version of the OPA VS Code
    extension to try it out. More clients hopefully supported
    soon!
  * Various Improvements
  - Add --aggregate flag to regal new rule command to create
    aggregate rules. Thanks @mvanhorn!
  - Allocate less memory while linting with this one simple trick
  - Make common rule name provider provide suggestions for
    default rules
  - Make input.json completion provider provide suggestion for
    imports
  - Have boolean value completion provider provide suggestions in
    many more locations
  - Add inline docs to import provider
  - Add label details to built-in function completion provider
  - Bump OPA dependency to v1.18.2
  * Bugs Fixed
  - Override return type of object.subset while waiting for the
    next OPA release to fix this. Thanks @mvanhorn!
  - Fix wrong end location of reported for unresolved functions
  - Fix wrong end location reported by rule-shadows-builtin
  * Documentation
  - Update defunct styra.com links to point to archived copies
    until we find a better home for them
  - Documentation added for how GitHub Copilot breaks
    autocomplete in VS Code and a recommendation not to use it.
  * Changelog
  - 22365a3: docs: Document Copilot breaking language servers in
    VS Code (#2021) (@anderseknert)
  - b842742: docs: Archive some styra.com references (#2022)
    (@charlieegan3)
  - a2539ef: roast: adjust not test locations (#2023) (@srenatus)
  - 81d6485: feat: add --aggregate flag to regal new rule (#341)
    (#1966) (@mvanhorn)
  - 75ce34c: lsp: first implementation of find references and
    rename (#2029) (@anderseknert)
  - efa9106: perf: remove a million allocations with this one
    simple trick (#2024) (@anderseknert)
  - c64b3a3: build(deps): bump the dependencies group with 3
    updates (#2027) (@dependabot[bot])
  - b3594a4: docs: Small updates to address some inconsistencies
    (#2030) (@charlieegan3)
  - dd92373: [lsp] Update find references and rename request to
    support "some" variables (#2031) (@SeanLedford)
  - a107bea: build(deps): bump markdown-it and markdownlint-cli
    in /build (#2032) (@dependabot[bot])
  - 656cb56: [feature] Extending find references variable support
    (#2035) (@SeanLedford)
  - c78887b: build(deps): bump the dependencies group across 1
    directory with 4 updates (#2037) (@dependabot[bot])
  - 4e5e4a2: build(deps): bump the dependencies group with 5
    updates (#2043) (@dependabot[bot])
  - 9b380f4: build(deps): bump golang.org/x/net from 0.53.0 to
    0.55.0 in /build/lsp (#2041) (@dependabot[bot])
  - ce12d08: OPA v1.18.2 (#2040) (@anderseknert)
  - 4f5d1dc: fix: override object.subset return type to boolean
    (#2048) (@mvanhorn)
  - 75fd9d3: build(deps): bump golang.org/x/crypto from 0.50.0 to
    0.52.0 in /build/ws (#2044) (@dependabot[bot])
  - c2328a5: build(deps): bump the dependencies group with 4
    updates (#2049) (@dependabot[bot])
  - 758630a: Fix wrong end location of reported unresolved
    functions (#2053) (@anderseknert)
  - 9a74766: Fix wrong end location reported by
    rule-shadows-builtin (#2054) (@anderseknert)
  - 2bb3592: dap: Implement Evaluate feature (#2051)
    (@anderseknert)
  - 76ed1f0: Raise test timeout threshold to 3 seconds (#2058)
    (@anderseknert)
  - d7aaf8f: Use new inmem.NewFromASTObject to set up Regal store
    (#2056) (@anderseknert)
  - 98fc359: Add import future.keywords completion provider
    (#2055) (@anderseknert)
  - bcdaa1d: Various completion provider improvements (#2057)
    (@anderseknert)</changelog>
</package>
<package pkgid="073b5477c094e79ad4d383b88f38e4870cd3e56719d3f3e874915b9808e83ec37bb67250d4529542a2ec0e692d6b901cb48c0b12734c3e393cfe6b4edefd3904" name="regal-bash-completion" arch="noarch">
  <version epoch="0" ver="0.42.0" rel="11.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743163200">- new package regal: linter and language server for Rego, bringing
  your policy development experience to the next level</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 0.33.1:
  This release is the same tag as v0.33.1, please see that release
  for the release notes.
  Another v0.33.1 was released to trigger the rebuilding of some
  assets that were deleted in a draft release.
  * New Rule: in-wildcard-key
    Using a wildcard variable (_) for the key in the key-value form
    of iteration (some _, value in collection) is never needed, and
    can be replaced by the simple some value in … form . This rule
    flags cases where the key iteration is redundant. (Read more)
  * New Rule: confusing-alias
    While import aliases can improve readability, aliasing an
    import reference that is also imported without an alias is
    confusing, as both names point to the same resource. This rule
    catches such cases. (Read more)
  * New Rule: mixed-iteration
    Rego supports different styles of collection iteration. While
    "reference style" iteration (collection[_]) can be concise for
    deeply nested structures, mixing it with the some .. in style
    within a single iteration expression makes for code that’s more
    difficult to follow. This rule encourages consistency within a
    single iteration statement. (Read more)
  * New Rule: narrow-argument
    This new rule analyzes function arguments to suggest narrowing
    them down to the minimal value the function depends on. This
    can improve clarity and reusability. The rule considers
    incrementally defined functions across all their definitions.
    This is a powerful but opinionated rule and is thus in the
    custom category and is not on by default. See the documentation
    for how to enable it if you’re curious to try it out! (Read
    more)
  * Performance Improvements
    Several improvements have been made to reduce memory
    allocations and improve overall linting performance. Numbers
    below refer to Regal’s benchmark for linting its own policies.
  - Optimized config loading and parsing, saving around 2.7
    million allocations (#1491).
  - Reduced allocations by approximately 2 million (#1494).
  - Improved the performance of the use-strings-count rule,
    saving almost 1 million allocations (#1465).
  - Optimized reference comparisons and small iteration patterns,
    saving around 300k allocations (#1472).
  - Included performance enhancements alongside an update to the
    external-reference rule to make it more configurable (#1496).
  * OPA v1.3.0
    Regal has been upgraded to use OPA v1.3.0. This brings several
    upstream improvements, including support for the new one-liner
    grouping in formatting (see OPA#6760). (#1459)
  * Bug Fixes
  - Fixed a bug in the handling of Rego input from stdin. Thanks
    @tokyowizard for the report! (#1474)
  - Fixed a panic that could occur in FindConfigRoots when
    supplied with unexpected arguments. (#1487)
  * Other Rule Updates
  - The external-reference rule can now be configured with a
    maximum number of allowed external references, instead of
    solely flagging all external uses within a function. If you
    previously had this rule disabled, you might want to try
    enabling it now, and possibly tweak its configuration to your
    liking. (#1496)
  - The rule-length rule now has a separate setting
    (max-test-rule-length) with a higher default value (60 vs 30)
    for test rules, acknowledging that tests often include
    substantial data. (#1476)
  - Updated documentation for the rule-named-if rule based on
    community feedback received via the page feedback form
    (please let us know if you see issues! &amp; thanks for the
    report!) (#1463)
  * Dependencies
    This release also updates Regals dependencies as follows.
  - github.com/open-policy-agent/opa v1.2.0 -&gt; v1.3.0
  - github.com/prometheus/client_golang v1.21.0 -&gt; v1.21.1
  - go.opentelemetry.io/otel v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/metric v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/sdk v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/trace v1.34.0 -&gt; v1.35.0
  - golang.org/x/crypto v0.35.0 -&gt; v0.36.0
  - golang.org/x/net v0.36.0 -&gt; v0.38.0
  - golang.org/x/sync v0.11.0 -&gt; v0.12.0
  - golang.org/x/sys v0.30.0 -&gt; v0.31.0
  - golang.org/x/text v0.22.0 -&gt; v0.23.0
  - google.golang.org/protobuf v1.36.4 -&gt; v1.36.5
  * Changelog
  - automated: update capabilities by @github-actions in #1458
  - OPA 1.3.0 by @anderseknert in #1459
  - Parameterize some tests by @anderseknert in #1460
  - automated: update capabilities by @github-actions in #1461
  - build(deps): bump the dependencies group with 2 updates by
    @dependabot in #1462
  - docs: rule-named-if by @charlieegan3 in #1463
  - Some perf fixes by @anderseknert in #1465
  - Rule: in-wildcard-key by @anderseknert in #1466
  - Increase coverage by @anderseknert in #1467
  - build(deps): bump github/codeql-action from 3.28.13 to
    3.28.14 in the dependencies group by @dependabot in #1468
  - perf: various improvements by @anderseknert in #1472
  - Rule: confusing-alias by @anderseknert in #1470
  - Add benchmark for testing all rules individually by
    @anderseknert in #1469
  - Rule: mixed-iteration by @anderseknert in #1475
  - Add max-test-rule-length setting to rule-length rule by
    @anderseknert in #1476
  - fix: ensure policy from stdin is enumerated correctly by
    @anderseknert in #1474
  - automated: update capabilities by @github-actions in #1477
  - builtins.RegalIsFormatted: recover from formatter panics by
    @srenatus in #1481
  - automated: update capabilities by @github-actions in #1482
  - build(deps): bump github/codeql-action from 3.28.14 to
    3.28.15 in the dependencies group by @dependabot in #1484
  - Fix unnecessary-some rule not working after OPA 1.0+ by
    @anderseknert in #1485
  - FindConfigRoots: return error, not panic by @srenatus in
    [#1487]
  - perf: Improve how config is parsed, and when by @anderseknert
    in #1491
  - Rule: narrow-argument by @anderseknert in #1488
  - build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 by
    @dependabot in #1490
  - build(deps): bump codecov/codecov-action from 5.4.0 to 5.4.2
    in the dependencies group by @dependabot in #1495
  - Make external-reference rule less annoying by @anderseknert
    in #1496
  - docs: fix docs that still used v0 syntax by @anderseknert in
    [#1494]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 0.34.0:
  After a month of development, we're happy to announce Regal
  v0.34. This version of the OPA community's favorite linter and
  language server brings you new 3 linter rules, performance
  improvements and much more.
  With the v0.34.0 release, Regal now ships with more than 100
  linter rules!
  Which is pretty close to one new week per rule since the project
  started.
  * New rules
  - unresolved-reference
    This one is particularly exciting! The new
    unresolved-reference rule reports any references (like
    data.users.permissions) that cannot be resolved (i.e. found)
    anywhere in the project. Some projects will have valid
    references that can't be resolved at the time Regal lints the
    project, and the rule provides configuration options to mark
    certain references, or entire paths (like data.users.*) as
    resolved. See the docs for the rule for more details.
  - pointless-import
    Category: imports
    The new pointless-import rule will flags imports of the same
    package, and other import forms where the import has no real
    effect.
  - single-item-in
    Category: idiomatic
    The single-item-in rule reports cases of in being used on a
    single item collection, and suggests using an equality check
    instead.
  * Performance
  - Use OPA v1.5.0, which brings performance improvements to walk
    reducing linting time by about 10%.
  - Faster linting by avoiding walk in a few locations where
    possible.
  - Improve performance of aggregate rules.
  - Several performance optimizations to Regal's linter rules.
  * API
  - The linter API now has a new Prepare method that can be used
    to prepare the linter before reusing it across several runs.
  * Various
  - Some rules that would previously only scan the topmost level
    of a rule body will now recursively scan the whole rule.
  - The input completions provider has been rewritten in Rego
    (previously Go).
  - The automatic version check has been rewritten in Rego
    (previously Go).
  * Bugs
  - Fix false positive in custom one-liner-rule.
  * Docs
  - Updated roadmap. Go check it out!
  - Move rules table from README and into a more interactive form
    on the Styra docs. Take a look!
  - Add link to Renovating Rego blog.
  - README: add link to KubeCon London talk, which prominently
    featured Regal.
  - Update links to adapt to OPA's new documentation.
  - Update outdated information in README.
  * Dependencies
  - build(deps): bump the dependencies group with 2 updates
    (#1551)
  - build(deps): bump the dependencies group with 2 updates
    (#1544)
  - build(deps): bump the dependencies group with 2 updates
    (#1521)
  - build(deps): bump github/codeql-action in the dependencies
    group (#1507)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1749038400">- Update to version 0.34.1:
  This patch release fixes a bug found since v0.34.0 as well as it
  bumps the OPA dependency to the v1.5.1 patch also released today.
  While Regal's own policies were not affected by the regression in
  walk, custom linter rules could very well be.
  * Highlights
  - OPA v1.5.0 -&gt; v1.5.1
  - Go 1.23 -&gt; 1.24
  - Fix false positive in sprintf-arguments-mismatch when the
    %-*s pattern was used for padding.
  * Changelog
  - OPA v1.5.1 and some perf tweaks (#1580)
  - docs: Update typo in link (#1581)
  - deps: Revert 47c70f0 tablewriter changes (#1579)
  - docs: Update to allow better regal docs generation (#1578)
  - [create-pull-request] automated change (#1577)
  - fix: consider padding pattern in sprintf-arguments-mismatch
    (#1575)
  - build(deps): bump ossf/scorecard-action in the dependencies
    group (#1576)
  - Fix deprecated notices in .goreleaser.yaml (#1570)
  - Go 1.23 -&gt; 1.24 (#1573)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751371200">- Update to version 0.35.1 (0.35.0 was not released):
  We're happy to release v0.35.1, the mid-summer release of Regal
  for the 🏖️ ! This release updates to OPA v1.6.0 bringing a number
  of performance improvements as well as other improvements and bug
  fixes.
  * Improved Schema Loading This PR replaces Regal's custom schema
    loader with one that matches OPA's behavior, enabling the same
    schemas to work across opa check, opa eval, and other OPA
    commands. PR #1605
  * Performance Improvements
  - Thanks to a PR in OPA, Regal's memory use is now much reduced
    due to a change conditionally supplying built-in contexts
    only when needed.
  - This PR optimizes Rego evaluation by directly mapping source
    data to ast.Value objects instead of going through
    intermediate map[string]any or JSON representations,
    eliminating ~2.9 million allocations in benchmarks. PR #1606
  - Regal contributors will be happy with
    open-policy-agent/opa#7442 which makes running Regal's tests
    around 2.5x as fast!
  * Code Actions Rewrite
  - Code actions are LSP features that provide automated fixes or
    refactoring suggestions (like "quick fix" options), and this
    PR implements them for Regal with server-side filtering to
    reduce data transfer and ensure consistent editor behavior.
    This is also now implemented in Rego! PR #1604
  * Docs
  - PR #1584 refactors a number of Regal's pages including
    breaking down the previously large README into separate
    files. Browse the new structure on the Regal Website.
  - The Code Lens documentation has been updated to better
    explain supported configurations. Thanks @Shinzu for the
    report here. #1596
  * Changelog
  - 92d1ba9: deps: Update OPA to v1.6.0 (#1617) (@charlieegan3)
  - 2bbe76e: [create-pull-request] automated change (#1582)
    (@github-actions[bot])
  - 6e5e6bb: e2e: add frankenstein test build (@srenatus)
  - 5bf607d: build(deps): bump github/codeql-action in the
    dependencies group (#1585) (@dependabot[bot])
  - 6f45a9f: build(deps): bump brace-expansion from 2.0.1 to
    2.0.2 in /build (#1587) (@dependabot[bot])
  - e85b878: docs: Update config cli docs (#1584) (@charlieegan3)
  - 30c73fe: build(deps): bump github/codeql-action in the
    dependencies group (#1595) (@dependabot[bot])
  - b8f3e8f: fix: improve snippets suggestion condition (#1597)
    (@anderseknert)
  - eb48984: Fix issue with handling big numbers (#1599)
    (@anderseknert)
  - 1ee1cf4: fix: Correct end location in unresolved-reference
    (#1600) (@anderseknert)
  - e50c9af: Bump Roast -&gt; v0.12.0 (#1601) (@anderseknert)
  - 981d8d2: docs: Update Evaluation Code Lens docs (#1602)
    (@charlieegan3)
  - 3577efe: lsp/completion/input: don't suggest 'input'
    following dot (#1603) (@srenatus)
  - 02d1546: lsp: Code Action feature rewritten in Rego (#1604)
    (@anderseknert)
  - 25b1072: More robust loading of schemas (#1605)
    (@anderseknert)
  - 112dc87: perf: avoid JSON/map roundtrips in ast.Value
    transforms (#1606) (@anderseknert)
  - d87fd2f: docs: Tone down "obsolete" description for
    use-rego-v1 (#1610) (@anderseknert)
  - a939219: lsp: Roll over load file failures (#1611)
    (@charlieegan3)
  - 1d771ca: interning: bump opa+roast, replace call to
    ast.InternedBoolTerm() (#1613) (@srenatus)
  - ed0ead4: build(deps): bump
    github.com/go-viper/mapstructure/v2 in /e2e/testbuild (#1615)
    (@dependabot[bot])
  - 0d65ef0: build(deps): bump
    github.com/go-viper/mapstructure/v2 (#1614)
    (@dependabot[bot])</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1757851200">- Update to version 0.36.1 (0.36.0 was not released):
  This is Regal v0.36! The first Regal release since becoming a
  part of the OPA project last month. This release mostly delivers
  a number of new language server features as well as wider
  improvements under the hood and to the developer experience.
  * A note about Regal's documentation
    Our documentation is now displayed as part of the main OPA
    website!
    https://www.openpolicyagent.org/projects/regal
    From this release, links generated from Regal in output to
    rules will point to this location. You might find links to the
    old location as we get things updated. Please feel free to open
    any issues for link problems you find just so we don't miss
    anything.
  * Get contextual documentation when calling built-in functions
  - Following PR #1654, the Regal language server will now offer
    signatureHelp to compatible clients. This shows the current
    argument type and description in the help text for built-in
    functions. This is in addition to the other general function
    documentation displayed here.
  * Quickly see related fields in when editing METADATA
  - PR #1657 implements support for the documentHighlight request
    from clients. This is currently only used to show signal
    other related METADATA keys when working with Rego metadata.
    In future, this same functionality could be used to highlight
    other related items currently in the viewport.
  * Jump directly from ignore directives to documentation
  - documentLink is another request from clients which allow the
    server to respond with link ranges. We have used this to make
    regal ignore directives clickable, helping users quickly
    learn what they mean when encountered in policies PR #1657.
  * Get live diagnostics from custom rules as you type
  - PR #1631 ensures that users of custom linter rules are also
    able to access these for live diagnostics in language server
    clients. Previously these were not evaluated in the server,
    only in the Regal CLI.
  * Notable Refactors &amp; Development Changes
  - Rego Language Server Routing: PR #1675 makes some notable
    changes to how Rego is used within the Regal’s language
    server. The Language Server Protocol (LSP), which Regal
    implements to support LSP clients, is based on JSON message
    passing. This lends itself to Rego evaluation which is JSON
    in, JSON out. This PR updates the handling of different LSP
    messages sent from clients to route them in Rego, handling
    Rego backed rules first, and falling back to Golang
    implementations that still remain otherwise. This sets the
    direction for more Rego LSP functionality in the language
    server in future.
  - Development bundle loading from disk: PR #1646 gives those
    working on Regal in development the option of using the
    current source for the Regal bundle without rebuilding the
    binary. This improves the experience when working on Rego
    based language server functionality by reducing the time of a
    feedback loop. Set REGAL_BUNDLE_PATH to use this feature.
  * Changelog
  - 1f1044f: build: Remove tap key (#1687) (@charlieegan3)
  - build(deps): bump github/codeql-action from 3.29.0 to 3.29.1
    in the dependencies group by @dependabot[bot] in #1616
  - Add Regal bundle compilation benchmark by @anderseknert in
    [#1618]
  - Remove quotes from keywords in refs by @anderseknert in #1619
  - lsp: Skip loading files on disk when in cache by
    @charlieegan3 in #1620
  - build(deps): bump the dependencies group with 2 updates by
    @dependabot[bot] in #1621
  - automated: update capabilities by @github-actions[bot] in
    [#1622]
  - add experimental lsp package for websocket communication by
    @srenatus in #1623
  - internal/io: add FindInputPath when the content isn't needed
    by @srenatus in #1624
  - build(deps): bump github/codeql-action from 3.29.2 to 3.29.3
    in the dependencies group by @dependabot[bot] in #1626
  - lsp/completions: Handle hyphenated package names by
    @charlieegan3 in #1625
  - lsp: fix didOpen templating race by @charlieegan3 in #1627
  - build/lsp: add web client demo by @srenatus in #1629
  - lsp: Fix stale diagnostics after deletion by @charlieegan3 in
    [#1628]
  - Some doc updates by @anderseknert in #1632
  - lsp: Add support for custom rules by @charlieegan3 in #1631
  - Vendor roast dependency by @anderseknert in #1634
  - lsp: Address windows goto definition URI issue by
    @charlieegan3 in #1633
  - Fix regal new rule issues + refactor io code by @anderseknert
    in #1636
  - lsp: Use full text replacement for Intellij fmt by
    @charlieegan3 in #1637
  - test: refactor e2e test, add new regal command runner by
    @anderseknert in #1640
  - build(deps): bump github/codeql-action from 3.29.3 to 3.29.5
    in the dependencies group by @dependabot[bot] in #1641
  - Fix missing source.explore code action by @anderseknert in
    [#1643]
  - lsp: Present filename relative to root in errors by
    @charlieegan3 in #1638
  - refactor: Improve code quality throughout the codebase by
    @anderseknert in #1642
  - lsp/uri: Refactor URI handling by @charlieegan3 in #1644
  - Tidying up more code by @anderseknert in #1645
  - Provide development option to load bundle from disk by
    @anderseknert in #1646
  - lsp/eval: Ensure filenames use URI in print output by
    @charlieegan3 in #1647
  - Rewrite more completion providers in Rego. Resolve schemas at
    runtime. by @anderseknert in #1652
  - lsp: Add signature help by @charlieegan3 in #1654
  - lsp: Fix server signature race in test by @charlieegan3 in
    [#1655]
  - build(deps): bump the dependencies group with 5 updates by
    @dependabot[bot] in #1639
  - build(deps): bump the dependencies group with 3 updates by
    @dependabot[bot] in #1653
  - docs: update README badges for OPA 1.7.1 release by
    @charlieegan3 in #1656
  - New LSP features and internal improvements by @anderseknert
    in #1657
  - lsp/documenthighlight: Add tests by @charlieegan3 in #1659
  - Add tests for textDocument/documentLink handler by
    @anderseknert in #1658
  - Styra URLs -&gt; OPA URLs by @anderseknert in #1662
  - docs: Update README re: move to open-policy-agent by
    @charlieegan3 in #1664
  - internal/io: explicitly disable lazy loading of regal bundle
    by @srenatus in #1666
  - build(deps): bump the dependencies group across 1 directory
    with 4 updates by @dependabot[bot] in #1663
  - Enable pprof endpoint only with env var set by @anderseknert
    in #1667
  - docs: Remove update workflow &amp; minor adjustments by
    @charlieegan3 in #1668
  - Disable Codecov PR comments by @anderseknert in #1670
  - deps: OPA v1.8.0 by @anderseknert in #1669
  - docs: Changes needed in docs for opa site deploy by
    @charlieegan3 in #1673
  - build(deps): bump github/codeql-action from 3.29.11 to 3.30.0
    in the dependencies group by @dependabot[bot] in #1674
  - Rego-based routing of Rego handlers + refactor by
    @anderseknert in #1675
  - Just one more.. refactor by @anderseknert in #1677
  - docs: Updates in preparation for OPA site deploy by
    @charlieegan3 in #1676
  - lsp: GTD use URI for location by @charlieegan3 in #1680
  - fix: Don't use OS path separator when walking FS by
    @anderseknert in #1681
  - build(deps): bump the dependencies group with 3 updates by
    @dependabot[bot] in #1678
  - build: Add windows runners to build workflow by @charlieegan3
    in #1682
  - Weekend refactor by @anderseknert in #1684
  - Fix documentLink issue when no user config provided by
    @anderseknert in #1686
  - build: Remove tap key by @charlieegan3 in #1687</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- Update to version 0.37.0:
  This release features a new linter rule, several new language
  server features, and many improvements and fixes. The two major
  OPA versions bumped since the last release additionally contains
  several performance improvements that were contributed as part of
  developing Regal!
  * New Rule: prefer-equals-comparison
    The prefer-equals-comparison linter rule recommends using the
    == operator for equality comparison over the unification
    operator =. The rule helps improve code clarity by using
    operators for their intended purposes: := for assignment, ==
    for equality comparison, and = for unification. The linter
    identifies when = is used for comparison by checking if both
    sides of the operator are "unassignable".
    Avoid
    input.request.method = "GET"
    Prefer
    input.request.method == "GET"
    There are some certainly valid use cases for the unification
    operator! But simple equality comparison is not one. For more
    information, see the documentation for the rule. As an amusing
    aside, this fixes one of the first issues created in the
    project!
  * Language server: Document highlighting to help show where
    function args are referenced
    Document highlighting is one of the more subtle features of the
    LSP specification, but a really helpful one when implemented
    well. The experimental first implementation that shipped with
    Regal v0.36.0 is no longer experimental, and has also been
    extended to highlight usage of function argument variables
    inside of a function head or body.
    (Please find the screencast in the release notes)
  * Language server: Selection ranges
    Selection ranges provide smart selection of code that can
    expand and shrink based on knowledge of the code rather than
    simple text properties, like hyphens or whitespace. This makes
    moving code around extremely fast, and without leaving the
    keyboard. Consult the language server docs for how to enable
    this in your editor
    (Please find the screencast in the release notes)
  * Improvements
  - The pointless-reassignment rule would previously only flag
    reassignment at the top level of a rule body. Now it flags
    pointless reassignments also in nested bodies, like
    comprehensions, every statements, and so on.
  - All completion providers are now implemented purely in Rego
  - Remove the go-semver dependency in favor of a custom, much
    faster implementation
  - Build: Reduce permissions granted in update-caps top-level
    workflow, by @timothyklee
  - Docs: Update language server page to demonstrate recently
    added features
  - Docs: Add kakoune LSP configuration example
  * Windows compatibility improvements
    In this release we have fixed various Windows bugs (Language
    Server Init, Goto Definition, Error Popups) in #1740, #1737,
    [#1736], following #1633, and #1642 last release.
    These fixes have also made it possible to run our test suites
    on Windows runners to catch issues sooner in future. A huge
    thanks to @charlieegan3 for his tireless work on this!
  * Bugs fixed
  - Fix false positive in use-some-for-output-vars triggered by
    nested variables in rule ref heads, like rule[input[i]].allow
    if ....
  - Fix false positive in redundant-existence-check when a not
    check made an existence check necessary, reported by @gusega
  - Fix false positive in narrow-argument rule, which would
    incorrectly flag some arrays passed as arguments
  - Ensure that the language server InitOptions is never nil and
    don't cause issues with clients that don't provide those
  * Dependency Updates:
  - github.com/open-policy-agent/opa: v1.8.0 → v1.10.1
  - github.com/arl/statsviz: v0.7.1 → v0.7.2
  - github.com/go-git/go-git/v5: v5.16.2 → v5.16.3
  - github.com/olekukonko/tablewriter: v0.0.5 → v1.1.0
  - github.com/spf13/cobra: v1.9.1 → v1.10.1
  - github.com/spf13/pflag: v1.0.7 → v1.0.10
  - Removed: github.com/coreos/go-semver: v0.3.1
  * Changelog
  - 244459c: docs: Remove some old references (#1689)
    (@anderseknert)
  - 4212b5c: build(deps): bump the dependencies group with 2
    updates (#1690) (@dependabot[bot])
  - e149c6d: build: reduce update-caps top-level workflow
    permission to read (#1691) (@timothyklee)
  - 819bbec: lsp: Fix missing initial root (#1692)
    (@charlieegan3)
  - be8b020: docs: Update style guide links to new repo (#1693)
    (@charlieegan3)
  - ceb890b: Builtin function completion in Rego (#1694)
    (@anderseknert)
  - d36555e: Package ref import suggestions in Rego (#1698)
    (@anderseknert)
  - 4e44131: build(deps): bump the dependencies group with 2
    updates (#1703) (@dependabot[bot])
  - 14166e9: Avoid multi-line highlighting of issues (#1702)
    (@anderseknert)
  - 1685bb8: Move completion handler into Rego router (#1699)
    (@anderseknert)
  - 0da5eaa: build(deps): bump the dependencies group with 2
    updates (#1708) (@dependabot[bot])
  - e792757: Bump OPA -&gt; v1.9.0, golangci-lint 2.5.0 (#1709)
    (@anderseknert)
  - 3092d1d: docs: Address some broken links from OPA report
    (#1704) (@charlieegan3)
  - bebfd06: util: use Partial2 for IsAnyError (@srenatus)
  - f22a570: Fix false positive in redundant-existence-check
    (#1716) (@anderseknert)
  - 2703715: Various fixes (#1715) (@anderseknert)
  - 87981f2: build(deps): bump the dependencies group with 2
    updates (#1713) (@dependabot[bot])
  - a6487b6: lsp: document highlighting supporting function args
    (#1718) (@anderseknert)
  - fe8cbd3: Rule: prefer-equals-comparison (#1726)
    (@anderseknert)
  - f3722ea: Fix false positive in narrow-argument (#1724)
    (@anderseknert)
  - 73b8c65: Improve pointless-reassignment to cover nested cases
    (#1727) (@anderseknert)
  - 9cf180c: lsp: Implement selection ranges and linked editing
    range (#1722) (@anderseknert)
  - bf632d0: build(deps): bump the dependencies group with 2
    updates (#1725) (@dependabot[bot])
  - a373ae3: lsp: Use filename path for current buffer for defns
    (#1732) (@charlieegan3)
  - d758eaf: lsp: Refactor range utilities (#1729)
    (@anderseknert)
  - 13de8a9: Fix incorrect behavior in pointless-import (#1733)
    (@anderseknert)
  - fb560c1: Fix false positive in use-some-for-output-vars
    (#1731) (@anderseknert)
  - 70449b7: Various small fixes (#1736) (@anderseknert)
  - 2594719: windows: Better use of slash paths (#1737)
    (@charlieegan3)
  - 499125f: Get FindClosestMatchingRoot working on windows
    (#1740) (@charlieegan3)
  - 3715085: OPA v1.10.0 (#1742) (@anderseknert)
  - 781f809: deps: stick to
    github.com/vektah/gqlparser/v2@v2.5.30 (#1744) (@srenatus)
  - bbb03db: Use generic client identifier in tests (#1741)
    (@charlieegan3)
  - c42ce08: build(deps): bump github/codeql-action in the
    dependencies group (#1745) (@dependabot[bot])
  - 4384b0d: Remove go-semver dependency, plus various fixes
    (#1746) (@anderseknert)
  - 97dfbd4: docs: update LSP page to show new features (#1748)
    (@charlieegan3)
  - 818b33a: docs: Minor fixes to docs typos and links (#1747)
    (@charlieegan3)
  - 4138270: Update to OPA v1.10.1 (@charlieegan3)
  - 55cf029: lsp: ensure that InitOptions is never nil (#1752)
    (@srenatus)
  - 8ffa270: docs: add kakoune LSP config snippet (#1751)
    (@srenatus)
  - 216341a: reporter,lsp: update URLs for help links (#1750)
    (@srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 0.38.0:
  * Feature: String Interpolation Support
    v0.38.0 of your favorite Rego linter, debugger and language
    server brings full support for OPA's new string interpolation
    feature. This means not only that Regal lints code found inside
    interpolated strings, but that you'll have access to all your
    favorite language server features within them too — like code
    completions, tooltips on hover, or document highlighting. You
    can even use the debugger to step through interpolated
    expressions! If you haven't yet tried it out, grab OPA v1.12.2,
    Regal v0.38.0 and enjoy an absolutely awesome addition to the
    Rego language!
    In addition to this, we have a number of fun new features and
    performance improvements.
  * New Rule: disallow-rego-v1
    Category: custom
    This optional new rule flags the use of import rego.v1 in Rego
    policies (#1778). Since OPA v1.0 (December 2024), this import
    is a no-op and no longer needed. The rule helps users maintain
    clean code by preventing this outdated import from appearing in
    new policies. Teams standardizing on OPA 1.0+ can enable this
    rule to enforce modern Rego standards.
    package example
    import rego.v1 # &lt;-- Happy 2026! Time to stop doing this!
  * New Fixers
    @SeanLedford has also done some great work to help expand
    Regal's auto-fixing capabilities by having regal fixers added
    for three more rules.
  - prefer-equals-comparison
  - redundant-existence-check
  - constant-condition
    See (#1790) and (#1794) for more details.
  * Performance
    The fixer saw a 12% performance improvement by reusing the
    linter, reducing allocations from 2.3M to 2.0M operations
    (#1783). Additional optimizations include:
  - faster file filtering by avoiding recompiled ignore patterns
    (#1758),
  - better built-in function handling by registering Regal's
    functions globally only once (#1788),
  - and more efficient AST location serialization (#1758)
    To track ongoing performance work, a new post-merge
    benchmark-recording workflow was added (#1793).
  * LSP: New Ignore Code Action
    The language server now supports a code action to quickly add
    regal ignore configuration for specific rules directly from the
    editor (#1777).
  * Changelog
  - ac35695: Various performance improvements (#1758)
    (@anderseknert)
  - 48cd03d: docs: Add custom head for regal index page (#1761)
    (@charlieegan3)
  - 728ae28: build(deps): bump golangci/golangci-lint-action
    (#1762) (@dependabot[bot])
  - 92cf6ca: explorer: allow hiding stages without an effect
    (+misc) (#1760) (@srenatus)
  - c000994: docs: Correct sidebar labels (#1763) (@charlieegan3)
  - bf0b621: build(deps): bump
    github.com/containerd/containerd/v2 in /e2e/testbuild (#1753)
    (@dependabot[bot])
  - 18e7a89: build(deps): bump
    github.com/containerd/containerd/v2 (#1754)
    (@dependabot[bot])
  - ccab7bd: Rename: encoding/util -&gt; encoding/write (#1764)
    (@anderseknert)
  - 54f7625: build: run windows in matrix with other jobs (#1770)
    (@charlieegan3)
  - 5c9e6f0: update: Update version checking logic (#1772)
    (@charlieegan3)
  - 5034776: build: Add badge update to readme script (#1773)
    (@charlieegan3)
  - 95e8220: Added OPA installation as a Regal prerequisite, and
    fixed golangci-lint link. (#1774) (@SeanLedford)
  - 149f71d: build(deps): bump js-yaml from 4.1.0 to 4.1.1 in
    /build (#1775) (@dependabot[bot])
  - b8f8b7f: Enable more golangci-lint linters (@anderseknert)
  - e092627: build: Update mac runner (@charlieegan3)
  - 877884c: lsp: Add code action and command to ignore rule
    (#1777) (@charlieegan3)
  - ece9ca2: build(deps): bump the dependencies group with 5
    updates (@dependabot[bot])
  - bd37bbd: build(deps): bump golang.org/x/crypto in /build/lsp
    (@dependabot[bot])
  - 17cc429: build(deps): bump golang.org/x/crypto in
    /e2e/testbuild (@dependabot[bot])
  - 415b05f: build(deps): bump golang.org/x/crypto from 0.43.0 to
    0.45.0 (@dependabot[bot])
  - e1bb975: Improve fixer performance (@anderseknert)
  - 1b083ff: Added Rule: Disallow import rego.v1 (#1778)
    (@SeanLedford)
  - 9e43c50: Optimize and improve code for built-in functions
    (@anderseknert)
  - 64ce2aa: build(deps): bump glob and markdownlint-cli in
    /build (#1779) (@dependabot[bot])
  - 48fddeb: build(deps): bump github/codeql-action in the
    dependencies group (#1787) (@dependabot[bot])
  - bc41f63: pkg/linter: use errgroup, set limits + context on it
    (@srenatus)
  - f22c2aa: Add fixer for prefer-equals-comparison rule (#1790)
    (@SeanLedford)
  - cf88eb9: Fixers for redundant-existence-check and
    constant-condition rules (#1794) (@SeanLedford)
  - 36401a2: build(deps): bump the dependencies group across 1
    directory with 7 updates (#1796) (@dependabot[bot])
  - ecb23d3: version: Add OPA version to version output (#1798)
    (@charlieegan3)
  - 94ce038: build(deps): bump golang.org/x/crypto from 0.43.0 to
    0.45.0 in /build/ws (#1791) (@dependabot[bot])
  - 9ce1ddd: workflows: add post-merge benchmark-recording
    workflow (@srenatus)
  - e111443: workflows/benchmark: fix golang setup (@srenatus)
  - 4bb2d5a: docs: Update messy rule docs (@charlieegan3)
  - dec83ea: docs: Updates from opa website link scanner
    (@charlieegan3)
  - 8f544a6: fix typo in fix.go help message (#1807) (@gusega)
  - 941b02e: build(deps): bump the dependencies group with 3
    updates (#1804) (@dependabot[bot])
  - 9f09e6e: build(deps): bump the dependencies group with 4
    updates (#1808) (@dependabot[bot])
  - 476ef89: OPA v1.12.2 and full string interpolation support
    (#1811) (@anderseknert)
  - a9843ab: Move chained-rule-body to custom category (#1812)
    (@anderseknert)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768392000">- Update to version 0.38.1:
  This patch release fixes several bugs including some found in the
  recent v0.38.0 release, as well some other improvements.
  * Bug Fixes
  - Fix for prefer-equals-comparison fixer failing to parse
    policies with multiple "=" in expressions (#1824, fixes #1818
    reported by @gusega)
  - Fix for incorrect fixable violation count display in lint
    output (#1825, fixes #1813 reported by @gusega)
  - Fix for false positive in prefer-equals-comparison rule with
    comprehension term vars (#1828, fixes #1826 reported by
    @SeanLedford)
  - bundle: Surface configured rule notices as messages in lint
    output (#1827, fixes #1795 reported by @ghmer)
  * Improvements
  - Code action for prefer-equals-comparison fixer now available
    in the language server (#1810)
  - New option for prefer-value-in-head rule to count
    interpolated strings as scalars (#1817)
  - Minor performance improvement for any_set_item, used for
    selecting items from sets (#1815)
  * Changelog
  - f1c5f74: bundle: Improve performance of any_set_item (#1815)
    (@charlieegan3)
  - 9300420: Implemented Code action for prefer-equals-comparison
    fixer (#1810) (@SeanLedford)
  - 28121f0: build(deps): bump github/codeql-action in the
    dependencies group (#1823) (@dependabot[bot])
  - 54cdcb6: Add prefer-value-in-head option to count
    interpolated string as scalar (#1817) (@anderseknert)
  - e68184d: Fix false positivie in prefer-equals-comparison
    (#1828) (@anderseknert)
  - 593e221: fix: Prefer-Equals-Comparison Edge Case With
    Multiple "=" (#1824) (@SeanLedford)
  - 3dc28bb: bundle: Surface configured rule notices (#1827)
    (@charlieegan3)
  - aac9618: Updated lint reporter to track fixable violation
    count separate from fixable violation Set (#1825)
    (@SeanLedford)
  - fd6dd4d: Updated example for prefer-equals-comparison edge
    case to not include false positive (#1829) (@SeanLedford)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772193600">- Update to version 0.39.0:
  We're happy to announce Regal v0.39.0, featuring 3 new linter
  rules, many language server improvements, and much faster
  linting!
  * New Rule: use-array-flatten
    Category: idiomatic
    The use-array-flatten rule recommends using array.flatten
    instead of nested array.concatenation (#1873).
    Avoid
    package policy
    flat1 := array.concat(arr1, array.concat(arr2, arr3))
    flat2 := array.concat(arr1, array.concat(arr2, array.concat(arr3, arr4)))
    Prefer
    package policy
    flat1 := array.flatten([arr1, arr2, arr3])
    flat2 := array.flatten([arr1, arr2, arr3, arr4])
  * New Rule: use-object-union-n
    Category: idiomatic
    The use-object-union-n rule recommends using object.union_n
    over nested calls to object.union (#1873).
    Avoid
    package policy
    obj := object.union(obj1, object.union(obj2, obj3))
    Prefer
    package policy
    obj := object.union_n([obj1, obj2, obj3])
  * New Rule: equals-over-count
    Category: performance
    The new optional equals-over-count rule suggests using direct
    equality comparisons rather than count when checking collection
    membership or emptiness (#1878). This is a micro-optimization
    and not a general recommendation. Must be manually enabled.
  * Performance
    This release brings an approximate 25% reduction in linting
    time through aggregate remodeling and Rego prepare stage
    optimizations (#1838). Additional performance work includes
    Rego refactoring (#1857, #1884), AST transform improvements
    (#1892), and various micro-optimizations (#1866, #1879).
  * Language Server Improvements
    The language server now includes a semantic token framework for
    improved syntax highlighting (#1845, #1865, #1870), code
    actions for the constant-condition and
    redundant-existence-check fixers (#1830).  and an
    opaTestProvider feature for test discovery (#1888, #1889,
    [#1898]),
    Completion performance is improved with a
    completionItem/resolve handler (#1831), and server capabilities
    are now properly exposed and consistent with the clients
    (#1867, #1880).
    Note: Semantic token support is feature flagged and will be
    available in the next release.
  * Compiler Explorer
    Regal now supports the VSCode-based OPA Explorer extension,
    providing a rich GUI to compare compiler stages directly in VS
    Code (#1862) - thanks @srenatus! A new "Format stages" option
    has also been added to the compiler explorer (#1854) - thanks
    @johanfylling!
  * Experimental: rq Engine Support
    Initial support for the rq engine has been added (#1872)
  * Various Improvements
  - Improved redundant-existence-check rule (#1897, fixes #1805)
  - Disabled zero-arity-function rule as opa-fmt now covers that
    (#1885)
  * Bug Fixes
  - Fix nil dereference on compiler errors in explorer (#1837)
  - Fix broken links to fixer page (#1852)
  - Fix false positive in use-some-for-output-vars (#1886)
  - Fix broken input.json completion provider (#1891)
  * Dependency Updates
  - Regal has been upgraded to use OPA v1.14.0 and Go 1.26.
  * Documentation
  - Added mise as an alternative installation method (#1849)
  - Updated installation documentation (#1861)
  - Updated note about eval and debug roots (#1894)
  - Show release badge when using pre-release versions (#1899)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 0.40.0:
  Today we celebrate Regal who turns v0.40.0 just in time for the
  GitHub download tracker to report 1 million total downloads.
  Quite the milestone! Thank you all for the encouragement, support
  and contributions during these past 3 years. Together we're
  redefining the policy development experience, and we have a lot
  more of that planned for the future. Stay tuned!
  This release includes 2 new linter rules, and many new features
  and improvements to both the linter and language server.
  * Linter
  - New Rule: invalid-regexp
    Category: bugs
    The new invalid-regexp rule scans regular expressions found
    in policies and reports invalid patterns that would otherwise
    fail at runtime.
    Avoid
    package policy
    invalid if regexp.match("[a-z", "test")
    Prefer
    package policy
    valid if regexp.match("[a-z]", "test")
  - New Rule: superflous-object-get
    Category: idiomatic
    The superflous-object-get rule flags calls to object.get
    where using the built-in function provides no benefit
    compared to using a reference directly, and without the call.
    Avoid
    package policy
    superfluous if {
    [#] the default value (`""`) isn't used in the expression,
    [#] so object.get provides no benefit here
    object.get(input, ["user", "department"], "") == "engineering"
    }
    Prefer
    package policy
    much_better if {
    input.user.department == "engineering"
    }
    More cases of superfluous object.get will be added to this
    rule as we encounter them.
  * Improvements
  - The naming-convention rule now accepts a list of allowed
    names in addition to regex patterns
  - The non-loop-expression rule now identifies more types of
    expressions that could be moved out of iteration
  - All rules now contain a related_resources item in their
    metadata pointing to the docs for the rule
  - The regal new rule command now generates a Related Resources
    section in the new rule's documentation template
  * Bugs Fixed
  - Fixed two false positives reported in the non-loop-expression
    rule
  - The server now exits with an error if the --profile flag is
    used without --format json (thanks @mvanhorn!)
  * Language Server
  * Evaluate and Debug Actions
    Any input.json or input.yaml file found in the workspace will
    be used for input during evaluation and debugging sessions,
    but this wasn't obvious without reading the docs. The
    Evaluate and Debug code lenses / commands will now present a
    dialog option asking to create an input.json file in the
    project workspace in case one isn't found. This file is
    populated with dummy JSON data based on references to input
    found in the policy, and should be edited by the user to
    provide more relevant data.
  * Hover Provider Improvements
    The hover provider showing tooltips for built-in functions
    and keywords has been rewritten in Rego, and additionally saw
    a few improvements land as part of that process:
  - Links to examples for built-in functions now point to the
    correct location in the OPA docs
  - The print function now shows up in hover results as well
  - Hover provider now less resource intensive, and all
    information rendered just in time for display
  * Inlay Hints Improvements
    The inlay hint provider (that provides names of function
    arguments to be displayed at call sites) has also been
    rewritten in Rego, and the server now implements also the
    inlayHint/resolve handler, which improves performance by only
    calculating inlay hint details when the client requests them
    for display.
    Additionally, the inlay hint provider now properly takes the
    range of the active editor view into account, and will only
    spend resources calculating hints for code that the user can
    actually can see.
  * Semantic Tokens in Comprehensions and every Expressions
    The language server's semantic token provider (providing
    context-based syntax highlighting) now provides semantic
    tokens inside of comprehensions and every expressions in
    addition to previously supported contexts. Additionally, most
    of the semantic token logic is now implemented entirely in
    Rego.
  * Improved Language Server Initialization
    This release contains a number of fixes and improvements
    related to the language server's initialization routine,
    which should now be both more robust and faster.
  * Bugs Fixed
  - Two potential nil dereferences identified and fixed
  - Fix a potential out of bounds panic in slice access
  - The bundled web server now shows a link to Regal's editor
    integration documentation on its index page
  * Finally
    Extra thanks goes out to @charlieegan3 this release, who worked
    tirelessly to fix some really complex race conditions and
    concurrency issues in the language server. A thankless job, but
    extremely important, and he pulled it off like a true Viking!
  * Changelog
  - 691afe1: Replace some Styra references (#1904)
    (@anderseknert)
  - 975ae72: build(deps): bump github.com/go-git/go-git/v5 in the
    dependencies group (#1903) (@dependabot[bot])
  - c85d88f: build(deps): bump go.opentelemetry.io/otel/sdk in
    /build/lsp (#1906) (@dependabot[bot])
  - 5ff449b: build(deps): bump the dependencies group with 3
    updates (#1907) (@dependabot[bot])
  - 9900522: lsp: Wait for client to send initialized at boot
    (#1909) (@charlieegan3)
  - d661b5a: build(deps): bump github/codeql-action in the
    dependencies group (#1912) (@dependabot[bot])
  - fd85e2d: Allow naming-convention rule to take list of names
    (not only a pattern) (#1911) (@anderseknert)
  - 299d3fc: Semantic Token Support for Comprehensions and
    Constructs (#1883) (@SeanLedford)
  - 422a9ef: build(deps): bump github/codeql-action in the
    dependencies group (#1915) (@dependabot[bot])
  - 02a9dc8: Fail with error when --profile used without JSON
    format (#1918) (@mvanhorn)
  - 1716e13: lsp/webserver: Add links to the index page (#1914)
    (@charlieegan3)
  - 1ab360f: lsp/testing: Nested test implementation (#1913)
    (@charlieegan3)
  - 53e5bf2: build(deps): bump google.golang.org/grpc in
    /e2e/testbuild (#1916) (@dependabot[bot])
  - 45841bf: build(deps): bump smol-toml and markdownlint-cli in
    /build (#1919) (@dependabot[bot])
  - 371bf1f: build(deps): bump picomatch from 4.0.3 to 4.0.4 in
    /build (#1920) (@dependabot[bot])
  - 62852fc: build(deps): bump the dependencies group across 1
    directory with 4 updates (#1921) (@dependabot[bot])
  - d32408d: build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#1922) (@dependabot[bot])
  - 8b9bcf0: build(deps): bump github.com/go-git/go-git/v5 from
    5.17.0 to 5.17.1 (#1923) (@dependabot[bot])
  - f2251f2: [create-pull-request] automated change (#1908)
    (@github-actions[bot])
  - 820d3f0: OPA v1.15.1 (#1925) (@anderseknert)
  - a155b62: Add popup prompt for creating input.json if it
    doesnt exist when Evaluate is run (#1929) (@SeanLedford)
  - 27067af: build(deps): bump the dependencies group with 2
    updates (#1931) (@dependabot[bot])
  - 2179ae4: Fix non-loop-expression false positives (#1930)
    (@anderseknert)
  - 33282ba: Rule: superflous-object-get (#1932) (@anderseknert)
  - 6fd115a: Include rule docs links in metadata (#1935)
    (@anderseknert)
  - 6a364fb: Fix aggregate test loop initialization (#1936)
    (@charlieegan3)
  - 61ab730: Rule: invalid-regexp (#1937) (@anderseknert)
  - 752ca7e: Cover more non-loop-expressions (#1938)
    (@anderseknert)
  - cb9a9c8: Add convenience functions for working with lines and
    uints (#1944) (@anderseknert)
  - 85171b8: build(deps): bump go.opentelemetry.io/otel/sdk in
    /e2e/testbuild (#1942) (@dependabot[bot])
  - 7fd6d66: [feature] Create input.json Skeleton if User Would
    Like When One Doesn't Exist (#1934) (@SeanLedford)
  - e4e326b: OPA v1.15.2 (#1945) (@anderseknert)
  - e8f1469: build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
    (#1941) (@dependabot[bot])
  - 7a1235c: Fix potential nil deref in language server (#1947)
    (@anderseknert)
  - d6d2bf0: Fix index out of bounds in parital inlay hint
    (#1948) (@anderseknert)
  - 0a0f1f8: build(deps): bump the dependencies group with 2
    updates (#1946) (@dependabot[bot])
  - d0e99b5: Rewrite hover provider in Rego (#1951)
    (@anderseknert)
  - cc35d48: Fix possible nil deref in ogre (#1954)
    (@anderseknert)
  - 44ceabe: Rewrite inlay hint provider in Rego (#1953)
    (@anderseknert)
  - 5c62c72: testing: Improve lsp shutdown logic &amp; address test
    race conditions (#1943) (@charlieegan3)
  - 12cc776: Semantic package tokens in Rego (#1956)
    (@anderseknert)
  - b4ccafc: feat(new): add Related Resources source link to
    builtin rule doc template (#1957) (@mvanhorn)
  - 543d3fa: linter/lsp: Tidy use of aggregates and store in ls
    (#1962) (@charlieegan3)
  - 1442904: build(deps): bump github.com/go-git/go-git/v5 from
    5.17.2 to 5.18.0 (#1958) (@dependabot[bot])
  - 293cd7f: build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#1959) (@dependabot[bot])
  - 344a389: build(deps): bump the dependencies group with 3
    updates (#1963) (@dependabot[bot])
  - 784fa86: Semantic import tokens Rego rewrite (#1960)
    (@anderseknert)
  - 0a00617: Refactor: Sending Variable Semantic Tokens Data from
    Rego (#1961) (@SeanLedford)
  - 9016d3d: Minor fixes (#1965) (@anderseknert)
  - 0ddd70f: docs: Update setup-regal in docs (#1964)
    (@charlieegan3)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780488000">- update to 0.41.1:
  NOTE this is the same code as that of v0.41.0 — just that the
  combination of a release deployment issue and immutable releases
  just had that one end up without any downloadable artifacts. That
  is now corrected!
- Update to version 0.41.0:
  This release brings automatic Rego test generation, as well as
  squashing a bunch of issues under the hood with sweeping
  enhancements to the core language server code.
  * New Feature: Automatic Test Generation
    A first pass at automatic test generation has landed in the
    language server (#1982), thanks to @SeanLedford! With a new
    code action available when working in a policy file, Regal can
    generate a test stub based on the current state of the
    workspace. This uses the values found in input.json to populate
    the with statements in the generated test.
  * Language Server Improvements
    This release includes significant internal improvements to the
    language server.
    Completion performance has seen a major improvement: for
    clients like VS Code that support a default replacement range,
    the completion payload is now roughly half the size it was
    before, and clients generally do no longer need to send
    continuous requests to the server for more suggestions once you
    start typing (#1992).
    The folding range provider has been rewritten in Rego (#1979),
    and now additionally honours client capabilities like
    lineFoldingOnly and rangeLimit.
    The handling of input.json and input.yaml files has been
    overhauled (#2002). These files are now tracked as first-class
    workspace state: they are parsed and cached when saved, and the
    server now requests update notifications for them from the
    client, rather than re-parsing the file on each evaluation, or
    debug sessions started.
  * OPA v1.17.0
    Regal has been updated to OPA v1.17.0 (#2014). This OPA release
    notably introduces future.keywords.not, which improves the
    semantics of the not keyword by wrapping composite-expression
    negation in an implicit body. Thanks @johanfylling for making
    sure this also works in Regal now!
    Regal's RoAST representation (and docs) have been updated to
    support the new ast.Not form introduced alongside this feature
    (#1985).
  * RoAST module.comments Representation
    The RoAST representation of module.comments has changed
    (#1987). Comments are now represented as plain locations rather
    than base64-encoded text, allowing Regal to retrieve the
    original text from the source file directly with less bytes to
    transfer and parse. Note: this is a breaking change for custom
    rules that reference input.comments directly. Users should
    instead prefer to reference data.regal.ast.comments_decoded,
    which provides comment locations in the usual form and which
    will remain stable even through future format changes.
  * Bug Fixes
  - Addressed a panic in regal fix caused by fixes being applied
    in non-deterministic order; opa-fmt could reduce line count
    such that use-assignment-operator would then access
    out-of-bounds row numbers (#2003) as reported by @erazemk
  - The unassigned-return-value rule now correctly flags
    namespaced builtins like json.match_schema(...) in addition
    to flat builtins like lower(...) (#2005) — thanks @mvanhorn
    for the fix and @anderseknert for the report
  - Nicer formatting of with sequences (#1969)
  - regal/ast: metadata labels field is now recognized as a valid
    metadata key, aligned with OPA v1.17.0 (#1983, #1988) —
    thanks @srenatus
  - Regal fix now works regardless of local git state (#2011).
    Thanks @seiyab for the report in #2006
  * What's Changed
  - Use common aggregate data in circular-import (#2019)
  - build(deps): bump github/codeql-action in the dependencies
    group (#2017)
  - debug: Determine abs debugging path for input.json (#2018)
  - Unify common aggregation and aggregated data (#2016)
  - build(deps): bump the dependencies group with 3 updates
    (#2008)
  - build(deps): bump github.com/containerd/containerd/v2 in
    /e2e/testbuild (#2007)
  - Add capabilities verification to build check (#2015)
  - Use logger in Rego router (#2012)
  - deps: Update opa to 1.17.0 (#2014)
  - Extract file polling into waitForFile helper (#2013)
  - Remove git validation from fix command (#2011)
  - lsp: Introduce workspace abstraction (#2009)
  - Remove the settings.json change that was introduced in my
    previous PR (#2010)
  - fix(rules): unassigned-return-value now covers namespaced
    builtins (#2005)
  - [feature] First Pass at Automatic Test Generation in Regal
    (#1982)
  - fixer: Apply linter fixes in deterministic order (#2003)
  - build(deps): bump the dependencies group across 1 directory
    with 2 updates (#1998)
  - build(deps): bump brace-expansion from 5.0.5 to 5.0.6 in
    /build (#1997)
  - Improved handling of input.(json|yaml) files (#2002)
  - build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#2000)
  - build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.1 (#2001)
  - Move location of LSP storage helpers (#1993)
  - New framework for testing language server handlers (#1992)
  - Breaking: new RoAST representation of module.comments (#1987)
  - regal/ast: update metadata fields (#1988)
  - roast: Add marshaling support for `ast.Not` (#1985)
  - Introduce passthrough handler type (#1984)
  - regal/ast: add 'id' to valid metadata keys (#1983)
  - build(deps): bump github/codeql-action in the dependencies
    group (#1981)
  - Move folding range provider to Rego handlers (#1979)
  - Cleanup (#1978)
  - feat(pre-commit): add regal-fix hooks for auto-fixing rules
    (#1847) (#1976)
  - build(deps): bump the dependencies group with 2 updates
    (#1975)
  - Move initialize handler to Rego router (#1977)
  - Various code quality improvements (#1970)
  - Nicer formatting of `with` test sequences (#1969)
  - Update ast.json else to use "#/$defs/rule" (#1967)
  - Use OPA main until next OPA release (#1968)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784289600">- Update to version 0.42.0:
  * Language Server
  - Find References and Rename
    This release brings initial support for finding references
    and renaming symbols in the workspace. This first version is
    limited to function arguments and some bindings, but we plan
    to expand this in future releases.
    Video see
    https://github.com/open-policy-agent/regal/releases/tag/v0.42.0
    References are checked across the whole workspace, and
    renames work even when for example, a function is
    incrementally defined in several different files.
  - New future.keywords completion provider
    The language server will now suggest future.keywords in
    completions for import lines — notably the new import
    future.keywords.not for now, with a few more to follow soon
    in OPA.
  * Debug Adapter
  - Evaluate
    Regal's debug adapter protocol (DAP) implementation now
    supports evaluating variables and expressions inside of stack
    frames in debugging sessions! This also allows setting up
    watch expressions in clients like VS Code.
    Video see
    https://github.com/open-policy-agent/regal/releases/tag/v0.42.0
    Make sure to download the latest version of the OPA VS Code
    extension to try it out. More clients hopefully supported
    soon!
  * Various Improvements
  - Add --aggregate flag to regal new rule command to create
    aggregate rules. Thanks @mvanhorn!
  - Allocate less memory while linting with this one simple trick
  - Make common rule name provider provide suggestions for
    default rules
  - Make input.json completion provider provide suggestion for
    imports
  - Have boolean value completion provider provide suggestions in
    many more locations
  - Add inline docs to import provider
  - Add label details to built-in function completion provider
  - Bump OPA dependency to v1.18.2
  * Bugs Fixed
  - Override return type of object.subset while waiting for the
    next OPA release to fix this. Thanks @mvanhorn!
  - Fix wrong end location of reported for unresolved functions
  - Fix wrong end location reported by rule-shadows-builtin
  * Documentation
  - Update defunct styra.com links to point to archived copies
    until we find a better home for them
  - Documentation added for how GitHub Copilot breaks
    autocomplete in VS Code and a recommendation not to use it.
  * Changelog
  - 22365a3: docs: Document Copilot breaking language servers in
    VS Code (#2021) (@anderseknert)
  - b842742: docs: Archive some styra.com references (#2022)
    (@charlieegan3)
  - a2539ef: roast: adjust not test locations (#2023) (@srenatus)
  - 81d6485: feat: add --aggregate flag to regal new rule (#341)
    (#1966) (@mvanhorn)
  - 75ce34c: lsp: first implementation of find references and
    rename (#2029) (@anderseknert)
  - efa9106: perf: remove a million allocations with this one
    simple trick (#2024) (@anderseknert)
  - c64b3a3: build(deps): bump the dependencies group with 3
    updates (#2027) (@dependabot[bot])
  - b3594a4: docs: Small updates to address some inconsistencies
    (#2030) (@charlieegan3)
  - dd92373: [lsp] Update find references and rename request to
    support "some" variables (#2031) (@SeanLedford)
  - a107bea: build(deps): bump markdown-it and markdownlint-cli
    in /build (#2032) (@dependabot[bot])
  - 656cb56: [feature] Extending find references variable support
    (#2035) (@SeanLedford)
  - c78887b: build(deps): bump the dependencies group across 1
    directory with 4 updates (#2037) (@dependabot[bot])
  - 4e5e4a2: build(deps): bump the dependencies group with 5
    updates (#2043) (@dependabot[bot])
  - 9b380f4: build(deps): bump golang.org/x/net from 0.53.0 to
    0.55.0 in /build/lsp (#2041) (@dependabot[bot])
  - ce12d08: OPA v1.18.2 (#2040) (@anderseknert)
  - 4f5d1dc: fix: override object.subset return type to boolean
    (#2048) (@mvanhorn)
  - 75fd9d3: build(deps): bump golang.org/x/crypto from 0.50.0 to
    0.52.0 in /build/ws (#2044) (@dependabot[bot])
  - c2328a5: build(deps): bump the dependencies group with 4
    updates (#2049) (@dependabot[bot])
  - 758630a: Fix wrong end location of reported unresolved
    functions (#2053) (@anderseknert)
  - 9a74766: Fix wrong end location reported by
    rule-shadows-builtin (#2054) (@anderseknert)
  - 2bb3592: dap: Implement Evaluate feature (#2051)
    (@anderseknert)
  - 76ed1f0: Raise test timeout threshold to 3 seconds (#2058)
    (@anderseknert)
  - d7aaf8f: Use new inmem.NewFromASTObject to set up Regal store
    (#2056) (@anderseknert)
  - 98fc359: Add import future.keywords completion provider
    (#2055) (@anderseknert)
  - bcdaa1d: Various completion provider improvements (#2057)
    (@anderseknert)</changelog>
</package>
<package pkgid="2e8e75a2946d0d68b58a77c4df9b1bf267bc0af130b9605e404562edc98fbd9c94407995f7859f129920fe575a7c2ba14a962dbb21a594e949fec2edb4ef369a" name="regal-debuginfo" arch="s390x">
  <version epoch="0" ver="0.42.0" rel="11.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743163200">- new package regal: linter and language server for Rego, bringing
  your policy development experience to the next level</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 0.33.1:
  This release is the same tag as v0.33.1, please see that release
  for the release notes.
  Another v0.33.1 was released to trigger the rebuilding of some
  assets that were deleted in a draft release.
  * New Rule: in-wildcard-key
    Using a wildcard variable (_) for the key in the key-value form
    of iteration (some _, value in collection) is never needed, and
    can be replaced by the simple some value in … form . This rule
    flags cases where the key iteration is redundant. (Read more)
  * New Rule: confusing-alias
    While import aliases can improve readability, aliasing an
    import reference that is also imported without an alias is
    confusing, as both names point to the same resource. This rule
    catches such cases. (Read more)
  * New Rule: mixed-iteration
    Rego supports different styles of collection iteration. While
    "reference style" iteration (collection[_]) can be concise for
    deeply nested structures, mixing it with the some .. in style
    within a single iteration expression makes for code that’s more
    difficult to follow. This rule encourages consistency within a
    single iteration statement. (Read more)
  * New Rule: narrow-argument
    This new rule analyzes function arguments to suggest narrowing
    them down to the minimal value the function depends on. This
    can improve clarity and reusability. The rule considers
    incrementally defined functions across all their definitions.
    This is a powerful but opinionated rule and is thus in the
    custom category and is not on by default. See the documentation
    for how to enable it if you’re curious to try it out! (Read
    more)
  * Performance Improvements
    Several improvements have been made to reduce memory
    allocations and improve overall linting performance. Numbers
    below refer to Regal’s benchmark for linting its own policies.
  - Optimized config loading and parsing, saving around 2.7
    million allocations (#1491).
  - Reduced allocations by approximately 2 million (#1494).
  - Improved the performance of the use-strings-count rule,
    saving almost 1 million allocations (#1465).
  - Optimized reference comparisons and small iteration patterns,
    saving around 300k allocations (#1472).
  - Included performance enhancements alongside an update to the
    external-reference rule to make it more configurable (#1496).
  * OPA v1.3.0
    Regal has been upgraded to use OPA v1.3.0. This brings several
    upstream improvements, including support for the new one-liner
    grouping in formatting (see OPA#6760). (#1459)
  * Bug Fixes
  - Fixed a bug in the handling of Rego input from stdin. Thanks
    @tokyowizard for the report! (#1474)
  - Fixed a panic that could occur in FindConfigRoots when
    supplied with unexpected arguments. (#1487)
  * Other Rule Updates
  - The external-reference rule can now be configured with a
    maximum number of allowed external references, instead of
    solely flagging all external uses within a function. If you
    previously had this rule disabled, you might want to try
    enabling it now, and possibly tweak its configuration to your
    liking. (#1496)
  - The rule-length rule now has a separate setting
    (max-test-rule-length) with a higher default value (60 vs 30)
    for test rules, acknowledging that tests often include
    substantial data. (#1476)
  - Updated documentation for the rule-named-if rule based on
    community feedback received via the page feedback form
    (please let us know if you see issues! &amp; thanks for the
    report!) (#1463)
  * Dependencies
    This release also updates Regals dependencies as follows.
  - github.com/open-policy-agent/opa v1.2.0 -&gt; v1.3.0
  - github.com/prometheus/client_golang v1.21.0 -&gt; v1.21.1
  - go.opentelemetry.io/otel v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/metric v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/sdk v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/trace v1.34.0 -&gt; v1.35.0
  - golang.org/x/crypto v0.35.0 -&gt; v0.36.0
  - golang.org/x/net v0.36.0 -&gt; v0.38.0
  - golang.org/x/sync v0.11.0 -&gt; v0.12.0
  - golang.org/x/sys v0.30.0 -&gt; v0.31.0
  - golang.org/x/text v0.22.0 -&gt; v0.23.0
  - google.golang.org/protobuf v1.36.4 -&gt; v1.36.5
  * Changelog
  - automated: update capabilities by @github-actions in #1458
  - OPA 1.3.0 by @anderseknert in #1459
  - Parameterize some tests by @anderseknert in #1460
  - automated: update capabilities by @github-actions in #1461
  - build(deps): bump the dependencies group with 2 updates by
    @dependabot in #1462
  - docs: rule-named-if by @charlieegan3 in #1463
  - Some perf fixes by @anderseknert in #1465
  - Rule: in-wildcard-key by @anderseknert in #1466
  - Increase coverage by @anderseknert in #1467
  - build(deps): bump github/codeql-action from 3.28.13 to
    3.28.14 in the dependencies group by @dependabot in #1468
  - perf: various improvements by @anderseknert in #1472
  - Rule: confusing-alias by @anderseknert in #1470
  - Add benchmark for testing all rules individually by
    @anderseknert in #1469
  - Rule: mixed-iteration by @anderseknert in #1475
  - Add max-test-rule-length setting to rule-length rule by
    @anderseknert in #1476
  - fix: ensure policy from stdin is enumerated correctly by
    @anderseknert in #1474
  - automated: update capabilities by @github-actions in #1477
  - builtins.RegalIsFormatted: recover from formatter panics by
    @srenatus in #1481
  - automated: update capabilities by @github-actions in #1482
  - build(deps): bump github/codeql-action from 3.28.14 to
    3.28.15 in the dependencies group by @dependabot in #1484
  - Fix unnecessary-some rule not working after OPA 1.0+ by
    @anderseknert in #1485
  - FindConfigRoots: return error, not panic by @srenatus in
    [#1487]
  - perf: Improve how config is parsed, and when by @anderseknert
    in #1491
  - Rule: narrow-argument by @anderseknert in #1488
  - build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 by
    @dependabot in #1490
  - build(deps): bump codecov/codecov-action from 5.4.0 to 5.4.2
    in the dependencies group by @dependabot in #1495
  - Make external-reference rule less annoying by @anderseknert
    in #1496
  - docs: fix docs that still used v0 syntax by @anderseknert in
    [#1494]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 0.34.0:
  After a month of development, we're happy to announce Regal
  v0.34. This version of the OPA community's favorite linter and
  language server brings you new 3 linter rules, performance
  improvements and much more.
  With the v0.34.0 release, Regal now ships with more than 100
  linter rules!
  Which is pretty close to one new week per rule since the project
  started.
  * New rules
  - unresolved-reference
    This one is particularly exciting! The new
    unresolved-reference rule reports any references (like
    data.users.permissions) that cannot be resolved (i.e. found)
    anywhere in the project. Some projects will have valid
    references that can't be resolved at the time Regal lints the
    project, and the rule provides configuration options to mark
    certain references, or entire paths (like data.users.*) as
    resolved. See the docs for the rule for more details.
  - pointless-import
    Category: imports
    The new pointless-import rule will flags imports of the same
    package, and other import forms where the import has no real
    effect.
  - single-item-in
    Category: idiomatic
    The single-item-in rule reports cases of in being used on a
    single item collection, and suggests using an equality check
    instead.
  * Performance
  - Use OPA v1.5.0, which brings performance improvements to walk
    reducing linting time by about 10%.
  - Faster linting by avoiding walk in a few locations where
    possible.
  - Improve performance of aggregate rules.
  - Several performance optimizations to Regal's linter rules.
  * API
  - The linter API now has a new Prepare method that can be used
    to prepare the linter before reusing it across several runs.
  * Various
  - Some rules that would previously only scan the topmost level
    of a rule body will now recursively scan the whole rule.
  - The input completions provider has been rewritten in Rego
    (previously Go).
  - The automatic version check has been rewritten in Rego
    (previously Go).
  * Bugs
  - Fix false positive in custom one-liner-rule.
  * Docs
  - Updated roadmap. Go check it out!
  - Move rules table from README and into a more interactive form
    on the Styra docs. Take a look!
  - Add link to Renovating Rego blog.
  - README: add link to KubeCon London talk, which prominently
    featured Regal.
  - Update links to adapt to OPA's new documentation.
  - Update outdated information in README.
  * Dependencies
  - build(deps): bump the dependencies group with 2 updates
    (#1551)
  - build(deps): bump the dependencies group with 2 updates
    (#1544)
  - build(deps): bump the dependencies group with 2 updates
    (#1521)
  - build(deps): bump github/codeql-action in the dependencies
    group (#1507)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1749038400">- Update to version 0.34.1:
  This patch release fixes a bug found since v0.34.0 as well as it
  bumps the OPA dependency to the v1.5.1 patch also released today.
  While Regal's own policies were not affected by the regression in
  walk, custom linter rules could very well be.
  * Highlights
  - OPA v1.5.0 -&gt; v1.5.1
  - Go 1.23 -&gt; 1.24
  - Fix false positive in sprintf-arguments-mismatch when the
    %-*s pattern was used for padding.
  * Changelog
  - OPA v1.5.1 and some perf tweaks (#1580)
  - docs: Update typo in link (#1581)
  - deps: Revert 47c70f0 tablewriter changes (#1579)
  - docs: Update to allow better regal docs generation (#1578)
  - [create-pull-request] automated change (#1577)
  - fix: consider padding pattern in sprintf-arguments-mismatch
    (#1575)
  - build(deps): bump ossf/scorecard-action in the dependencies
    group (#1576)
  - Fix deprecated notices in .goreleaser.yaml (#1570)
  - Go 1.23 -&gt; 1.24 (#1573)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751371200">- Update to version 0.35.1 (0.35.0 was not released):
  We're happy to release v0.35.1, the mid-summer release of Regal
  for the 🏖️ ! This release updates to OPA v1.6.0 bringing a number
  of performance improvements as well as other improvements and bug
  fixes.
  * Improved Schema Loading This PR replaces Regal's custom schema
    loader with one that matches OPA's behavior, enabling the same
    schemas to work across opa check, opa eval, and other OPA
    commands. PR #1605
  * Performance Improvements
  - Thanks to a PR in OPA, Regal's memory use is now much reduced
    due to a change conditionally supplying built-in contexts
    only when needed.
  - This PR optimizes Rego evaluation by directly mapping source
    data to ast.Value objects instead of going through
    intermediate map[string]any or JSON representations,
    eliminating ~2.9 million allocations in benchmarks. PR #1606
  - Regal contributors will be happy with
    open-policy-agent/opa#7442 which makes running Regal's tests
    around 2.5x as fast!
  * Code Actions Rewrite
  - Code actions are LSP features that provide automated fixes or
    refactoring suggestions (like "quick fix" options), and this
    PR implements them for Regal with server-side filtering to
    reduce data transfer and ensure consistent editor behavior.
    This is also now implemented in Rego! PR #1604
  * Docs
  - PR #1584 refactors a number of Regal's pages including
    breaking down the previously large README into separate
    files. Browse the new structure on the Regal Website.
  - The Code Lens documentation has been updated to better
    explain supported configurations. Thanks @Shinzu for the
    report here. #1596
  * Changelog
  - 92d1ba9: deps: Update OPA to v1.6.0 (#1617) (@charlieegan3)
  - 2bbe76e: [create-pull-request] automated change (#1582)
    (@github-actions[bot])
  - 6e5e6bb: e2e: add frankenstein test build (@srenatus)
  - 5bf607d: build(deps): bump github/codeql-action in the
    dependencies group (#1585) (@dependabot[bot])
  - 6f45a9f: build(deps): bump brace-expansion from 2.0.1 to
    2.0.2 in /build (#1587) (@dependabot[bot])
  - e85b878: docs: Update config cli docs (#1584) (@charlieegan3)
  - 30c73fe: build(deps): bump github/codeql-action in the
    dependencies group (#1595) (@dependabot[bot])
  - b8f3e8f: fix: improve snippets suggestion condition (#1597)
    (@anderseknert)
  - eb48984: Fix issue with handling big numbers (#1599)
    (@anderseknert)
  - 1ee1cf4: fix: Correct end location in unresolved-reference
    (#1600) (@anderseknert)
  - e50c9af: Bump Roast -&gt; v0.12.0 (#1601) (@anderseknert)
  - 981d8d2: docs: Update Evaluation Code Lens docs (#1602)
    (@charlieegan3)
  - 3577efe: lsp/completion/input: don't suggest 'input'
    following dot (#1603) (@srenatus)
  - 02d1546: lsp: Code Action feature rewritten in Rego (#1604)
    (@anderseknert)
  - 25b1072: More robust loading of schemas (#1605)
    (@anderseknert)
  - 112dc87: perf: avoid JSON/map roundtrips in ast.Value
    transforms (#1606) (@anderseknert)
  - d87fd2f: docs: Tone down "obsolete" description for
    use-rego-v1 (#1610) (@anderseknert)
  - a939219: lsp: Roll over load file failures (#1611)
    (@charlieegan3)
  - 1d771ca: interning: bump opa+roast, replace call to
    ast.InternedBoolTerm() (#1613) (@srenatus)
  - ed0ead4: build(deps): bump
    github.com/go-viper/mapstructure/v2 in /e2e/testbuild (#1615)
    (@dependabot[bot])
  - 0d65ef0: build(deps): bump
    github.com/go-viper/mapstructure/v2 (#1614)
    (@dependabot[bot])</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1757851200">- Update to version 0.36.1 (0.36.0 was not released):
  This is Regal v0.36! The first Regal release since becoming a
  part of the OPA project last month. This release mostly delivers
  a number of new language server features as well as wider
  improvements under the hood and to the developer experience.
  * A note about Regal's documentation
    Our documentation is now displayed as part of the main OPA
    website!
    https://www.openpolicyagent.org/projects/regal
    From this release, links generated from Regal in output to
    rules will point to this location. You might find links to the
    old location as we get things updated. Please feel free to open
    any issues for link problems you find just so we don't miss
    anything.
  * Get contextual documentation when calling built-in functions
  - Following PR #1654, the Regal language server will now offer
    signatureHelp to compatible clients. This shows the current
    argument type and description in the help text for built-in
    functions. This is in addition to the other general function
    documentation displayed here.
  * Quickly see related fields in when editing METADATA
  - PR #1657 implements support for the documentHighlight request
    from clients. This is currently only used to show signal
    other related METADATA keys when working with Rego metadata.
    In future, this same functionality could be used to highlight
    other related items currently in the viewport.
  * Jump directly from ignore directives to documentation
  - documentLink is another request from clients which allow the
    server to respond with link ranges. We have used this to make
    regal ignore directives clickable, helping users quickly
    learn what they mean when encountered in policies PR #1657.
  * Get live diagnostics from custom rules as you type
  - PR #1631 ensures that users of custom linter rules are also
    able to access these for live diagnostics in language server
    clients. Previously these were not evaluated in the server,
    only in the Regal CLI.
  * Notable Refactors &amp; Development Changes
  - Rego Language Server Routing: PR #1675 makes some notable
    changes to how Rego is used within the Regal’s language
    server. The Language Server Protocol (LSP), which Regal
    implements to support LSP clients, is based on JSON message
    passing. This lends itself to Rego evaluation which is JSON
    in, JSON out. This PR updates the handling of different LSP
    messages sent from clients to route them in Rego, handling
    Rego backed rules first, and falling back to Golang
    implementations that still remain otherwise. This sets the
    direction for more Rego LSP functionality in the language
    server in future.
  - Development bundle loading from disk: PR #1646 gives those
    working on Regal in development the option of using the
    current source for the Regal bundle without rebuilding the
    binary. This improves the experience when working on Rego
    based language server functionality by reducing the time of a
    feedback loop. Set REGAL_BUNDLE_PATH to use this feature.
  * Changelog
  - 1f1044f: build: Remove tap key (#1687) (@charlieegan3)
  - build(deps): bump github/codeql-action from 3.29.0 to 3.29.1
    in the dependencies group by @dependabot[bot] in #1616
  - Add Regal bundle compilation benchmark by @anderseknert in
    [#1618]
  - Remove quotes from keywords in refs by @anderseknert in #1619
  - lsp: Skip loading files on disk when in cache by
    @charlieegan3 in #1620
  - build(deps): bump the dependencies group with 2 updates by
    @dependabot[bot] in #1621
  - automated: update capabilities by @github-actions[bot] in
    [#1622]
  - add experimental lsp package for websocket communication by
    @srenatus in #1623
  - internal/io: add FindInputPath when the content isn't needed
    by @srenatus in #1624
  - build(deps): bump github/codeql-action from 3.29.2 to 3.29.3
    in the dependencies group by @dependabot[bot] in #1626
  - lsp/completions: Handle hyphenated package names by
    @charlieegan3 in #1625
  - lsp: fix didOpen templating race by @charlieegan3 in #1627
  - build/lsp: add web client demo by @srenatus in #1629
  - lsp: Fix stale diagnostics after deletion by @charlieegan3 in
    [#1628]
  - Some doc updates by @anderseknert in #1632
  - lsp: Add support for custom rules by @charlieegan3 in #1631
  - Vendor roast dependency by @anderseknert in #1634
  - lsp: Address windows goto definition URI issue by
    @charlieegan3 in #1633
  - Fix regal new rule issues + refactor io code by @anderseknert
    in #1636
  - lsp: Use full text replacement for Intellij fmt by
    @charlieegan3 in #1637
  - test: refactor e2e test, add new regal command runner by
    @anderseknert in #1640
  - build(deps): bump github/codeql-action from 3.29.3 to 3.29.5
    in the dependencies group by @dependabot[bot] in #1641
  - Fix missing source.explore code action by @anderseknert in
    [#1643]
  - lsp: Present filename relative to root in errors by
    @charlieegan3 in #1638
  - refactor: Improve code quality throughout the codebase by
    @anderseknert in #1642
  - lsp/uri: Refactor URI handling by @charlieegan3 in #1644
  - Tidying up more code by @anderseknert in #1645
  - Provide development option to load bundle from disk by
    @anderseknert in #1646
  - lsp/eval: Ensure filenames use URI in print output by
    @charlieegan3 in #1647
  - Rewrite more completion providers in Rego. Resolve schemas at
    runtime. by @anderseknert in #1652
  - lsp: Add signature help by @charlieegan3 in #1654
  - lsp: Fix server signature race in test by @charlieegan3 in
    [#1655]
  - build(deps): bump the dependencies group with 5 updates by
    @dependabot[bot] in #1639
  - build(deps): bump the dependencies group with 3 updates by
    @dependabot[bot] in #1653
  - docs: update README badges for OPA 1.7.1 release by
    @charlieegan3 in #1656
  - New LSP features and internal improvements by @anderseknert
    in #1657
  - lsp/documenthighlight: Add tests by @charlieegan3 in #1659
  - Add tests for textDocument/documentLink handler by
    @anderseknert in #1658
  - Styra URLs -&gt; OPA URLs by @anderseknert in #1662
  - docs: Update README re: move to open-policy-agent by
    @charlieegan3 in #1664
  - internal/io: explicitly disable lazy loading of regal bundle
    by @srenatus in #1666
  - build(deps): bump the dependencies group across 1 directory
    with 4 updates by @dependabot[bot] in #1663
  - Enable pprof endpoint only with env var set by @anderseknert
    in #1667
  - docs: Remove update workflow &amp; minor adjustments by
    @charlieegan3 in #1668
  - Disable Codecov PR comments by @anderseknert in #1670
  - deps: OPA v1.8.0 by @anderseknert in #1669
  - docs: Changes needed in docs for opa site deploy by
    @charlieegan3 in #1673
  - build(deps): bump github/codeql-action from 3.29.11 to 3.30.0
    in the dependencies group by @dependabot[bot] in #1674
  - Rego-based routing of Rego handlers + refactor by
    @anderseknert in #1675
  - Just one more.. refactor by @anderseknert in #1677
  - docs: Updates in preparation for OPA site deploy by
    @charlieegan3 in #1676
  - lsp: GTD use URI for location by @charlieegan3 in #1680
  - fix: Don't use OS path separator when walking FS by
    @anderseknert in #1681
  - build(deps): bump the dependencies group with 3 updates by
    @dependabot[bot] in #1678
  - build: Add windows runners to build workflow by @charlieegan3
    in #1682
  - Weekend refactor by @anderseknert in #1684
  - Fix documentLink issue when no user config provided by
    @anderseknert in #1686
  - build: Remove tap key by @charlieegan3 in #1687</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- Update to version 0.37.0:
  This release features a new linter rule, several new language
  server features, and many improvements and fixes. The two major
  OPA versions bumped since the last release additionally contains
  several performance improvements that were contributed as part of
  developing Regal!
  * New Rule: prefer-equals-comparison
    The prefer-equals-comparison linter rule recommends using the
    == operator for equality comparison over the unification
    operator =. The rule helps improve code clarity by using
    operators for their intended purposes: := for assignment, ==
    for equality comparison, and = for unification. The linter
    identifies when = is used for comparison by checking if both
    sides of the operator are "unassignable".
    Avoid
    input.request.method = "GET"
    Prefer
    input.request.method == "GET"
    There are some certainly valid use cases for the unification
    operator! But simple equality comparison is not one. For more
    information, see the documentation for the rule. As an amusing
    aside, this fixes one of the first issues created in the
    project!
  * Language server: Document highlighting to help show where
    function args are referenced
    Document highlighting is one of the more subtle features of the
    LSP specification, but a really helpful one when implemented
    well. The experimental first implementation that shipped with
    Regal v0.36.0 is no longer experimental, and has also been
    extended to highlight usage of function argument variables
    inside of a function head or body.
    (Please find the screencast in the release notes)
  * Language server: Selection ranges
    Selection ranges provide smart selection of code that can
    expand and shrink based on knowledge of the code rather than
    simple text properties, like hyphens or whitespace. This makes
    moving code around extremely fast, and without leaving the
    keyboard. Consult the language server docs for how to enable
    this in your editor
    (Please find the screencast in the release notes)
  * Improvements
  - The pointless-reassignment rule would previously only flag
    reassignment at the top level of a rule body. Now it flags
    pointless reassignments also in nested bodies, like
    comprehensions, every statements, and so on.
  - All completion providers are now implemented purely in Rego
  - Remove the go-semver dependency in favor of a custom, much
    faster implementation
  - Build: Reduce permissions granted in update-caps top-level
    workflow, by @timothyklee
  - Docs: Update language server page to demonstrate recently
    added features
  - Docs: Add kakoune LSP configuration example
  * Windows compatibility improvements
    In this release we have fixed various Windows bugs (Language
    Server Init, Goto Definition, Error Popups) in #1740, #1737,
    [#1736], following #1633, and #1642 last release.
    These fixes have also made it possible to run our test suites
    on Windows runners to catch issues sooner in future. A huge
    thanks to @charlieegan3 for his tireless work on this!
  * Bugs fixed
  - Fix false positive in use-some-for-output-vars triggered by
    nested variables in rule ref heads, like rule[input[i]].allow
    if ....
  - Fix false positive in redundant-existence-check when a not
    check made an existence check necessary, reported by @gusega
  - Fix false positive in narrow-argument rule, which would
    incorrectly flag some arrays passed as arguments
  - Ensure that the language server InitOptions is never nil and
    don't cause issues with clients that don't provide those
  * Dependency Updates:
  - github.com/open-policy-agent/opa: v1.8.0 → v1.10.1
  - github.com/arl/statsviz: v0.7.1 → v0.7.2
  - github.com/go-git/go-git/v5: v5.16.2 → v5.16.3
  - github.com/olekukonko/tablewriter: v0.0.5 → v1.1.0
  - github.com/spf13/cobra: v1.9.1 → v1.10.1
  - github.com/spf13/pflag: v1.0.7 → v1.0.10
  - Removed: github.com/coreos/go-semver: v0.3.1
  * Changelog
  - 244459c: docs: Remove some old references (#1689)
    (@anderseknert)
  - 4212b5c: build(deps): bump the dependencies group with 2
    updates (#1690) (@dependabot[bot])
  - e149c6d: build: reduce update-caps top-level workflow
    permission to read (#1691) (@timothyklee)
  - 819bbec: lsp: Fix missing initial root (#1692)
    (@charlieegan3)
  - be8b020: docs: Update style guide links to new repo (#1693)
    (@charlieegan3)
  - ceb890b: Builtin function completion in Rego (#1694)
    (@anderseknert)
  - d36555e: Package ref import suggestions in Rego (#1698)
    (@anderseknert)
  - 4e44131: build(deps): bump the dependencies group with 2
    updates (#1703) (@dependabot[bot])
  - 14166e9: Avoid multi-line highlighting of issues (#1702)
    (@anderseknert)
  - 1685bb8: Move completion handler into Rego router (#1699)
    (@anderseknert)
  - 0da5eaa: build(deps): bump the dependencies group with 2
    updates (#1708) (@dependabot[bot])
  - e792757: Bump OPA -&gt; v1.9.0, golangci-lint 2.5.0 (#1709)
    (@anderseknert)
  - 3092d1d: docs: Address some broken links from OPA report
    (#1704) (@charlieegan3)
  - bebfd06: util: use Partial2 for IsAnyError (@srenatus)
  - f22a570: Fix false positive in redundant-existence-check
    (#1716) (@anderseknert)
  - 2703715: Various fixes (#1715) (@anderseknert)
  - 87981f2: build(deps): bump the dependencies group with 2
    updates (#1713) (@dependabot[bot])
  - a6487b6: lsp: document highlighting supporting function args
    (#1718) (@anderseknert)
  - fe8cbd3: Rule: prefer-equals-comparison (#1726)
    (@anderseknert)
  - f3722ea: Fix false positive in narrow-argument (#1724)
    (@anderseknert)
  - 73b8c65: Improve pointless-reassignment to cover nested cases
    (#1727) (@anderseknert)
  - 9cf180c: lsp: Implement selection ranges and linked editing
    range (#1722) (@anderseknert)
  - bf632d0: build(deps): bump the dependencies group with 2
    updates (#1725) (@dependabot[bot])
  - a373ae3: lsp: Use filename path for current buffer for defns
    (#1732) (@charlieegan3)
  - d758eaf: lsp: Refactor range utilities (#1729)
    (@anderseknert)
  - 13de8a9: Fix incorrect behavior in pointless-import (#1733)
    (@anderseknert)
  - fb560c1: Fix false positive in use-some-for-output-vars
    (#1731) (@anderseknert)
  - 70449b7: Various small fixes (#1736) (@anderseknert)
  - 2594719: windows: Better use of slash paths (#1737)
    (@charlieegan3)
  - 499125f: Get FindClosestMatchingRoot working on windows
    (#1740) (@charlieegan3)
  - 3715085: OPA v1.10.0 (#1742) (@anderseknert)
  - 781f809: deps: stick to
    github.com/vektah/gqlparser/v2@v2.5.30 (#1744) (@srenatus)
  - bbb03db: Use generic client identifier in tests (#1741)
    (@charlieegan3)
  - c42ce08: build(deps): bump github/codeql-action in the
    dependencies group (#1745) (@dependabot[bot])
  - 4384b0d: Remove go-semver dependency, plus various fixes
    (#1746) (@anderseknert)
  - 97dfbd4: docs: update LSP page to show new features (#1748)
    (@charlieegan3)
  - 818b33a: docs: Minor fixes to docs typos and links (#1747)
    (@charlieegan3)
  - 4138270: Update to OPA v1.10.1 (@charlieegan3)
  - 55cf029: lsp: ensure that InitOptions is never nil (#1752)
    (@srenatus)
  - 8ffa270: docs: add kakoune LSP config snippet (#1751)
    (@srenatus)
  - 216341a: reporter,lsp: update URLs for help links (#1750)
    (@srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 0.38.0:
  * Feature: String Interpolation Support
    v0.38.0 of your favorite Rego linter, debugger and language
    server brings full support for OPA's new string interpolation
    feature. This means not only that Regal lints code found inside
    interpolated strings, but that you'll have access to all your
    favorite language server features within them too — like code
    completions, tooltips on hover, or document highlighting. You
    can even use the debugger to step through interpolated
    expressions! If you haven't yet tried it out, grab OPA v1.12.2,
    Regal v0.38.0 and enjoy an absolutely awesome addition to the
    Rego language!
    In addition to this, we have a number of fun new features and
    performance improvements.
  * New Rule: disallow-rego-v1
    Category: custom
    This optional new rule flags the use of import rego.v1 in Rego
    policies (#1778). Since OPA v1.0 (December 2024), this import
    is a no-op and no longer needed. The rule helps users maintain
    clean code by preventing this outdated import from appearing in
    new policies. Teams standardizing on OPA 1.0+ can enable this
    rule to enforce modern Rego standards.
    package example
    import rego.v1 # &lt;-- Happy 2026! Time to stop doing this!
  * New Fixers
    @SeanLedford has also done some great work to help expand
    Regal's auto-fixing capabilities by having regal fixers added
    for three more rules.
  - prefer-equals-comparison
  - redundant-existence-check
  - constant-condition
    See (#1790) and (#1794) for more details.
  * Performance
    The fixer saw a 12% performance improvement by reusing the
    linter, reducing allocations from 2.3M to 2.0M operations
    (#1783). Additional optimizations include:
  - faster file filtering by avoiding recompiled ignore patterns
    (#1758),
  - better built-in function handling by registering Regal's
    functions globally only once (#1788),
  - and more efficient AST location serialization (#1758)
    To track ongoing performance work, a new post-merge
    benchmark-recording workflow was added (#1793).
  * LSP: New Ignore Code Action
    The language server now supports a code action to quickly add
    regal ignore configuration for specific rules directly from the
    editor (#1777).
  * Changelog
  - ac35695: Various performance improvements (#1758)
    (@anderseknert)
  - 48cd03d: docs: Add custom head for regal index page (#1761)
    (@charlieegan3)
  - 728ae28: build(deps): bump golangci/golangci-lint-action
    (#1762) (@dependabot[bot])
  - 92cf6ca: explorer: allow hiding stages without an effect
    (+misc) (#1760) (@srenatus)
  - c000994: docs: Correct sidebar labels (#1763) (@charlieegan3)
  - bf0b621: build(deps): bump
    github.com/containerd/containerd/v2 in /e2e/testbuild (#1753)
    (@dependabot[bot])
  - 18e7a89: build(deps): bump
    github.com/containerd/containerd/v2 (#1754)
    (@dependabot[bot])
  - ccab7bd: Rename: encoding/util -&gt; encoding/write (#1764)
    (@anderseknert)
  - 54f7625: build: run windows in matrix with other jobs (#1770)
    (@charlieegan3)
  - 5c9e6f0: update: Update version checking logic (#1772)
    (@charlieegan3)
  - 5034776: build: Add badge update to readme script (#1773)
    (@charlieegan3)
  - 95e8220: Added OPA installation as a Regal prerequisite, and
    fixed golangci-lint link. (#1774) (@SeanLedford)
  - 149f71d: build(deps): bump js-yaml from 4.1.0 to 4.1.1 in
    /build (#1775) (@dependabot[bot])
  - b8f8b7f: Enable more golangci-lint linters (@anderseknert)
  - e092627: build: Update mac runner (@charlieegan3)
  - 877884c: lsp: Add code action and command to ignore rule
    (#1777) (@charlieegan3)
  - ece9ca2: build(deps): bump the dependencies group with 5
    updates (@dependabot[bot])
  - bd37bbd: build(deps): bump golang.org/x/crypto in /build/lsp
    (@dependabot[bot])
  - 17cc429: build(deps): bump golang.org/x/crypto in
    /e2e/testbuild (@dependabot[bot])
  - 415b05f: build(deps): bump golang.org/x/crypto from 0.43.0 to
    0.45.0 (@dependabot[bot])
  - e1bb975: Improve fixer performance (@anderseknert)
  - 1b083ff: Added Rule: Disallow import rego.v1 (#1778)
    (@SeanLedford)
  - 9e43c50: Optimize and improve code for built-in functions
    (@anderseknert)
  - 64ce2aa: build(deps): bump glob and markdownlint-cli in
    /build (#1779) (@dependabot[bot])
  - 48fddeb: build(deps): bump github/codeql-action in the
    dependencies group (#1787) (@dependabot[bot])
  - bc41f63: pkg/linter: use errgroup, set limits + context on it
    (@srenatus)
  - f22c2aa: Add fixer for prefer-equals-comparison rule (#1790)
    (@SeanLedford)
  - cf88eb9: Fixers for redundant-existence-check and
    constant-condition rules (#1794) (@SeanLedford)
  - 36401a2: build(deps): bump the dependencies group across 1
    directory with 7 updates (#1796) (@dependabot[bot])
  - ecb23d3: version: Add OPA version to version output (#1798)
    (@charlieegan3)
  - 94ce038: build(deps): bump golang.org/x/crypto from 0.43.0 to
    0.45.0 in /build/ws (#1791) (@dependabot[bot])
  - 9ce1ddd: workflows: add post-merge benchmark-recording
    workflow (@srenatus)
  - e111443: workflows/benchmark: fix golang setup (@srenatus)
  - 4bb2d5a: docs: Update messy rule docs (@charlieegan3)
  - dec83ea: docs: Updates from opa website link scanner
    (@charlieegan3)
  - 8f544a6: fix typo in fix.go help message (#1807) (@gusega)
  - 941b02e: build(deps): bump the dependencies group with 3
    updates (#1804) (@dependabot[bot])
  - 9f09e6e: build(deps): bump the dependencies group with 4
    updates (#1808) (@dependabot[bot])
  - 476ef89: OPA v1.12.2 and full string interpolation support
    (#1811) (@anderseknert)
  - a9843ab: Move chained-rule-body to custom category (#1812)
    (@anderseknert)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768392000">- Update to version 0.38.1:
  This patch release fixes several bugs including some found in the
  recent v0.38.0 release, as well some other improvements.
  * Bug Fixes
  - Fix for prefer-equals-comparison fixer failing to parse
    policies with multiple "=" in expressions (#1824, fixes #1818
    reported by @gusega)
  - Fix for incorrect fixable violation count display in lint
    output (#1825, fixes #1813 reported by @gusega)
  - Fix for false positive in prefer-equals-comparison rule with
    comprehension term vars (#1828, fixes #1826 reported by
    @SeanLedford)
  - bundle: Surface configured rule notices as messages in lint
    output (#1827, fixes #1795 reported by @ghmer)
  * Improvements
  - Code action for prefer-equals-comparison fixer now available
    in the language server (#1810)
  - New option for prefer-value-in-head rule to count
    interpolated strings as scalars (#1817)
  - Minor performance improvement for any_set_item, used for
    selecting items from sets (#1815)
  * Changelog
  - f1c5f74: bundle: Improve performance of any_set_item (#1815)
    (@charlieegan3)
  - 9300420: Implemented Code action for prefer-equals-comparison
    fixer (#1810) (@SeanLedford)
  - 28121f0: build(deps): bump github/codeql-action in the
    dependencies group (#1823) (@dependabot[bot])
  - 54cdcb6: Add prefer-value-in-head option to count
    interpolated string as scalar (#1817) (@anderseknert)
  - e68184d: Fix false positivie in prefer-equals-comparison
    (#1828) (@anderseknert)
  - 593e221: fix: Prefer-Equals-Comparison Edge Case With
    Multiple "=" (#1824) (@SeanLedford)
  - 3dc28bb: bundle: Surface configured rule notices (#1827)
    (@charlieegan3)
  - aac9618: Updated lint reporter to track fixable violation
    count separate from fixable violation Set (#1825)
    (@SeanLedford)
  - fd6dd4d: Updated example for prefer-equals-comparison edge
    case to not include false positive (#1829) (@SeanLedford)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772193600">- Update to version 0.39.0:
  We're happy to announce Regal v0.39.0, featuring 3 new linter
  rules, many language server improvements, and much faster
  linting!
  * New Rule: use-array-flatten
    Category: idiomatic
    The use-array-flatten rule recommends using array.flatten
    instead of nested array.concatenation (#1873).
    Avoid
    package policy
    flat1 := array.concat(arr1, array.concat(arr2, arr3))
    flat2 := array.concat(arr1, array.concat(arr2, array.concat(arr3, arr4)))
    Prefer
    package policy
    flat1 := array.flatten([arr1, arr2, arr3])
    flat2 := array.flatten([arr1, arr2, arr3, arr4])
  * New Rule: use-object-union-n
    Category: idiomatic
    The use-object-union-n rule recommends using object.union_n
    over nested calls to object.union (#1873).
    Avoid
    package policy
    obj := object.union(obj1, object.union(obj2, obj3))
    Prefer
    package policy
    obj := object.union_n([obj1, obj2, obj3])
  * New Rule: equals-over-count
    Category: performance
    The new optional equals-over-count rule suggests using direct
    equality comparisons rather than count when checking collection
    membership or emptiness (#1878). This is a micro-optimization
    and not a general recommendation. Must be manually enabled.
  * Performance
    This release brings an approximate 25% reduction in linting
    time through aggregate remodeling and Rego prepare stage
    optimizations (#1838). Additional performance work includes
    Rego refactoring (#1857, #1884), AST transform improvements
    (#1892), and various micro-optimizations (#1866, #1879).
  * Language Server Improvements
    The language server now includes a semantic token framework for
    improved syntax highlighting (#1845, #1865, #1870), code
    actions for the constant-condition and
    redundant-existence-check fixers (#1830).  and an
    opaTestProvider feature for test discovery (#1888, #1889,
    [#1898]),
    Completion performance is improved with a
    completionItem/resolve handler (#1831), and server capabilities
    are now properly exposed and consistent with the clients
    (#1867, #1880).
    Note: Semantic token support is feature flagged and will be
    available in the next release.
  * Compiler Explorer
    Regal now supports the VSCode-based OPA Explorer extension,
    providing a rich GUI to compare compiler stages directly in VS
    Code (#1862) - thanks @srenatus! A new "Format stages" option
    has also been added to the compiler explorer (#1854) - thanks
    @johanfylling!
  * Experimental: rq Engine Support
    Initial support for the rq engine has been added (#1872)
  * Various Improvements
  - Improved redundant-existence-check rule (#1897, fixes #1805)
  - Disabled zero-arity-function rule as opa-fmt now covers that
    (#1885)
  * Bug Fixes
  - Fix nil dereference on compiler errors in explorer (#1837)
  - Fix broken links to fixer page (#1852)
  - Fix false positive in use-some-for-output-vars (#1886)
  - Fix broken input.json completion provider (#1891)
  * Dependency Updates
  - Regal has been upgraded to use OPA v1.14.0 and Go 1.26.
  * Documentation
  - Added mise as an alternative installation method (#1849)
  - Updated installation documentation (#1861)
  - Updated note about eval and debug roots (#1894)
  - Show release badge when using pre-release versions (#1899)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 0.40.0:
  Today we celebrate Regal who turns v0.40.0 just in time for the
  GitHub download tracker to report 1 million total downloads.
  Quite the milestone! Thank you all for the encouragement, support
  and contributions during these past 3 years. Together we're
  redefining the policy development experience, and we have a lot
  more of that planned for the future. Stay tuned!
  This release includes 2 new linter rules, and many new features
  and improvements to both the linter and language server.
  * Linter
  - New Rule: invalid-regexp
    Category: bugs
    The new invalid-regexp rule scans regular expressions found
    in policies and reports invalid patterns that would otherwise
    fail at runtime.
    Avoid
    package policy
    invalid if regexp.match("[a-z", "test")
    Prefer
    package policy
    valid if regexp.match("[a-z]", "test")
  - New Rule: superflous-object-get
    Category: idiomatic
    The superflous-object-get rule flags calls to object.get
    where using the built-in function provides no benefit
    compared to using a reference directly, and without the call.
    Avoid
    package policy
    superfluous if {
    [#] the default value (`""`) isn't used in the expression,
    [#] so object.get provides no benefit here
    object.get(input, ["user", "department"], "") == "engineering"
    }
    Prefer
    package policy
    much_better if {
    input.user.department == "engineering"
    }
    More cases of superfluous object.get will be added to this
    rule as we encounter them.
  * Improvements
  - The naming-convention rule now accepts a list of allowed
    names in addition to regex patterns
  - The non-loop-expression rule now identifies more types of
    expressions that could be moved out of iteration
  - All rules now contain a related_resources item in their
    metadata pointing to the docs for the rule
  - The regal new rule command now generates a Related Resources
    section in the new rule's documentation template
  * Bugs Fixed
  - Fixed two false positives reported in the non-loop-expression
    rule
  - The server now exits with an error if the --profile flag is
    used without --format json (thanks @mvanhorn!)
  * Language Server
  * Evaluate and Debug Actions
    Any input.json or input.yaml file found in the workspace will
    be used for input during evaluation and debugging sessions,
    but this wasn't obvious without reading the docs. The
    Evaluate and Debug code lenses / commands will now present a
    dialog option asking to create an input.json file in the
    project workspace in case one isn't found. This file is
    populated with dummy JSON data based on references to input
    found in the policy, and should be edited by the user to
    provide more relevant data.
  * Hover Provider Improvements
    The hover provider showing tooltips for built-in functions
    and keywords has been rewritten in Rego, and additionally saw
    a few improvements land as part of that process:
  - Links to examples for built-in functions now point to the
    correct location in the OPA docs
  - The print function now shows up in hover results as well
  - Hover provider now less resource intensive, and all
    information rendered just in time for display
  * Inlay Hints Improvements
    The inlay hint provider (that provides names of function
    arguments to be displayed at call sites) has also been
    rewritten in Rego, and the server now implements also the
    inlayHint/resolve handler, which improves performance by only
    calculating inlay hint details when the client requests them
    for display.
    Additionally, the inlay hint provider now properly takes the
    range of the active editor view into account, and will only
    spend resources calculating hints for code that the user can
    actually can see.
  * Semantic Tokens in Comprehensions and every Expressions
    The language server's semantic token provider (providing
    context-based syntax highlighting) now provides semantic
    tokens inside of comprehensions and every expressions in
    addition to previously supported contexts. Additionally, most
    of the semantic token logic is now implemented entirely in
    Rego.
  * Improved Language Server Initialization
    This release contains a number of fixes and improvements
    related to the language server's initialization routine,
    which should now be both more robust and faster.
  * Bugs Fixed
  - Two potential nil dereferences identified and fixed
  - Fix a potential out of bounds panic in slice access
  - The bundled web server now shows a link to Regal's editor
    integration documentation on its index page
  * Finally
    Extra thanks goes out to @charlieegan3 this release, who worked
    tirelessly to fix some really complex race conditions and
    concurrency issues in the language server. A thankless job, but
    extremely important, and he pulled it off like a true Viking!
  * Changelog
  - 691afe1: Replace some Styra references (#1904)
    (@anderseknert)
  - 975ae72: build(deps): bump github.com/go-git/go-git/v5 in the
    dependencies group (#1903) (@dependabot[bot])
  - c85d88f: build(deps): bump go.opentelemetry.io/otel/sdk in
    /build/lsp (#1906) (@dependabot[bot])
  - 5ff449b: build(deps): bump the dependencies group with 3
    updates (#1907) (@dependabot[bot])
  - 9900522: lsp: Wait for client to send initialized at boot
    (#1909) (@charlieegan3)
  - d661b5a: build(deps): bump github/codeql-action in the
    dependencies group (#1912) (@dependabot[bot])
  - fd85e2d: Allow naming-convention rule to take list of names
    (not only a pattern) (#1911) (@anderseknert)
  - 299d3fc: Semantic Token Support for Comprehensions and
    Constructs (#1883) (@SeanLedford)
  - 422a9ef: build(deps): bump github/codeql-action in the
    dependencies group (#1915) (@dependabot[bot])
  - 02a9dc8: Fail with error when --profile used without JSON
    format (#1918) (@mvanhorn)
  - 1716e13: lsp/webserver: Add links to the index page (#1914)
    (@charlieegan3)
  - 1ab360f: lsp/testing: Nested test implementation (#1913)
    (@charlieegan3)
  - 53e5bf2: build(deps): bump google.golang.org/grpc in
    /e2e/testbuild (#1916) (@dependabot[bot])
  - 45841bf: build(deps): bump smol-toml and markdownlint-cli in
    /build (#1919) (@dependabot[bot])
  - 371bf1f: build(deps): bump picomatch from 4.0.3 to 4.0.4 in
    /build (#1920) (@dependabot[bot])
  - 62852fc: build(deps): bump the dependencies group across 1
    directory with 4 updates (#1921) (@dependabot[bot])
  - d32408d: build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#1922) (@dependabot[bot])
  - 8b9bcf0: build(deps): bump github.com/go-git/go-git/v5 from
    5.17.0 to 5.17.1 (#1923) (@dependabot[bot])
  - f2251f2: [create-pull-request] automated change (#1908)
    (@github-actions[bot])
  - 820d3f0: OPA v1.15.1 (#1925) (@anderseknert)
  - a155b62: Add popup prompt for creating input.json if it
    doesnt exist when Evaluate is run (#1929) (@SeanLedford)
  - 27067af: build(deps): bump the dependencies group with 2
    updates (#1931) (@dependabot[bot])
  - 2179ae4: Fix non-loop-expression false positives (#1930)
    (@anderseknert)
  - 33282ba: Rule: superflous-object-get (#1932) (@anderseknert)
  - 6fd115a: Include rule docs links in metadata (#1935)
    (@anderseknert)
  - 6a364fb: Fix aggregate test loop initialization (#1936)
    (@charlieegan3)
  - 61ab730: Rule: invalid-regexp (#1937) (@anderseknert)
  - 752ca7e: Cover more non-loop-expressions (#1938)
    (@anderseknert)
  - cb9a9c8: Add convenience functions for working with lines and
    uints (#1944) (@anderseknert)
  - 85171b8: build(deps): bump go.opentelemetry.io/otel/sdk in
    /e2e/testbuild (#1942) (@dependabot[bot])
  - 7fd6d66: [feature] Create input.json Skeleton if User Would
    Like When One Doesn't Exist (#1934) (@SeanLedford)
  - e4e326b: OPA v1.15.2 (#1945) (@anderseknert)
  - e8f1469: build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
    (#1941) (@dependabot[bot])
  - 7a1235c: Fix potential nil deref in language server (#1947)
    (@anderseknert)
  - d6d2bf0: Fix index out of bounds in parital inlay hint
    (#1948) (@anderseknert)
  - 0a0f1f8: build(deps): bump the dependencies group with 2
    updates (#1946) (@dependabot[bot])
  - d0e99b5: Rewrite hover provider in Rego (#1951)
    (@anderseknert)
  - cc35d48: Fix possible nil deref in ogre (#1954)
    (@anderseknert)
  - 44ceabe: Rewrite inlay hint provider in Rego (#1953)
    (@anderseknert)
  - 5c62c72: testing: Improve lsp shutdown logic &amp; address test
    race conditions (#1943) (@charlieegan3)
  - 12cc776: Semantic package tokens in Rego (#1956)
    (@anderseknert)
  - b4ccafc: feat(new): add Related Resources source link to
    builtin rule doc template (#1957) (@mvanhorn)
  - 543d3fa: linter/lsp: Tidy use of aggregates and store in ls
    (#1962) (@charlieegan3)
  - 1442904: build(deps): bump github.com/go-git/go-git/v5 from
    5.17.2 to 5.18.0 (#1958) (@dependabot[bot])
  - 293cd7f: build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#1959) (@dependabot[bot])
  - 344a389: build(deps): bump the dependencies group with 3
    updates (#1963) (@dependabot[bot])
  - 784fa86: Semantic import tokens Rego rewrite (#1960)
    (@anderseknert)
  - 0a00617: Refactor: Sending Variable Semantic Tokens Data from
    Rego (#1961) (@SeanLedford)
  - 9016d3d: Minor fixes (#1965) (@anderseknert)
  - 0ddd70f: docs: Update setup-regal in docs (#1964)
    (@charlieegan3)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780488000">- update to 0.41.1:
  NOTE this is the same code as that of v0.41.0 — just that the
  combination of a release deployment issue and immutable releases
  just had that one end up without any downloadable artifacts. That
  is now corrected!
- Update to version 0.41.0:
  This release brings automatic Rego test generation, as well as
  squashing a bunch of issues under the hood with sweeping
  enhancements to the core language server code.
  * New Feature: Automatic Test Generation
    A first pass at automatic test generation has landed in the
    language server (#1982), thanks to @SeanLedford! With a new
    code action available when working in a policy file, Regal can
    generate a test stub based on the current state of the
    workspace. This uses the values found in input.json to populate
    the with statements in the generated test.
  * Language Server Improvements
    This release includes significant internal improvements to the
    language server.
    Completion performance has seen a major improvement: for
    clients like VS Code that support a default replacement range,
    the completion payload is now roughly half the size it was
    before, and clients generally do no longer need to send
    continuous requests to the server for more suggestions once you
    start typing (#1992).
    The folding range provider has been rewritten in Rego (#1979),
    and now additionally honours client capabilities like
    lineFoldingOnly and rangeLimit.
    The handling of input.json and input.yaml files has been
    overhauled (#2002). These files are now tracked as first-class
    workspace state: they are parsed and cached when saved, and the
    server now requests update notifications for them from the
    client, rather than re-parsing the file on each evaluation, or
    debug sessions started.
  * OPA v1.17.0
    Regal has been updated to OPA v1.17.0 (#2014). This OPA release
    notably introduces future.keywords.not, which improves the
    semantics of the not keyword by wrapping composite-expression
    negation in an implicit body. Thanks @johanfylling for making
    sure this also works in Regal now!
    Regal's RoAST representation (and docs) have been updated to
    support the new ast.Not form introduced alongside this feature
    (#1985).
  * RoAST module.comments Representation
    The RoAST representation of module.comments has changed
    (#1987). Comments are now represented as plain locations rather
    than base64-encoded text, allowing Regal to retrieve the
    original text from the source file directly with less bytes to
    transfer and parse. Note: this is a breaking change for custom
    rules that reference input.comments directly. Users should
    instead prefer to reference data.regal.ast.comments_decoded,
    which provides comment locations in the usual form and which
    will remain stable even through future format changes.
  * Bug Fixes
  - Addressed a panic in regal fix caused by fixes being applied
    in non-deterministic order; opa-fmt could reduce line count
    such that use-assignment-operator would then access
    out-of-bounds row numbers (#2003) as reported by @erazemk
  - The unassigned-return-value rule now correctly flags
    namespaced builtins like json.match_schema(...) in addition
    to flat builtins like lower(...) (#2005) — thanks @mvanhorn
    for the fix and @anderseknert for the report
  - Nicer formatting of with sequences (#1969)
  - regal/ast: metadata labels field is now recognized as a valid
    metadata key, aligned with OPA v1.17.0 (#1983, #1988) —
    thanks @srenatus
  - Regal fix now works regardless of local git state (#2011).
    Thanks @seiyab for the report in #2006
  * What's Changed
  - Use common aggregate data in circular-import (#2019)
  - build(deps): bump github/codeql-action in the dependencies
    group (#2017)
  - debug: Determine abs debugging path for input.json (#2018)
  - Unify common aggregation and aggregated data (#2016)
  - build(deps): bump the dependencies group with 3 updates
    (#2008)
  - build(deps): bump github.com/containerd/containerd/v2 in
    /e2e/testbuild (#2007)
  - Add capabilities verification to build check (#2015)
  - Use logger in Rego router (#2012)
  - deps: Update opa to 1.17.0 (#2014)
  - Extract file polling into waitForFile helper (#2013)
  - Remove git validation from fix command (#2011)
  - lsp: Introduce workspace abstraction (#2009)
  - Remove the settings.json change that was introduced in my
    previous PR (#2010)
  - fix(rules): unassigned-return-value now covers namespaced
    builtins (#2005)
  - [feature] First Pass at Automatic Test Generation in Regal
    (#1982)
  - fixer: Apply linter fixes in deterministic order (#2003)
  - build(deps): bump the dependencies group across 1 directory
    with 2 updates (#1998)
  - build(deps): bump brace-expansion from 5.0.5 to 5.0.6 in
    /build (#1997)
  - Improved handling of input.(json|yaml) files (#2002)
  - build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#2000)
  - build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.1 (#2001)
  - Move location of LSP storage helpers (#1993)
  - New framework for testing language server handlers (#1992)
  - Breaking: new RoAST representation of module.comments (#1987)
  - regal/ast: update metadata fields (#1988)
  - roast: Add marshaling support for `ast.Not` (#1985)
  - Introduce passthrough handler type (#1984)
  - regal/ast: add 'id' to valid metadata keys (#1983)
  - build(deps): bump github/codeql-action in the dependencies
    group (#1981)
  - Move folding range provider to Rego handlers (#1979)
  - Cleanup (#1978)
  - feat(pre-commit): add regal-fix hooks for auto-fixing rules
    (#1847) (#1976)
  - build(deps): bump the dependencies group with 2 updates
    (#1975)
  - Move initialize handler to Rego router (#1977)
  - Various code quality improvements (#1970)
  - Nicer formatting of `with` test sequences (#1969)
  - Update ast.json else to use "#/$defs/rule" (#1967)
  - Use OPA main until next OPA release (#1968)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784289600">- Update to version 0.42.0:
  * Language Server
  - Find References and Rename
    This release brings initial support for finding references
    and renaming symbols in the workspace. This first version is
    limited to function arguments and some bindings, but we plan
    to expand this in future releases.
    Video see
    https://github.com/open-policy-agent/regal/releases/tag/v0.42.0
    References are checked across the whole workspace, and
    renames work even when for example, a function is
    incrementally defined in several different files.
  - New future.keywords completion provider
    The language server will now suggest future.keywords in
    completions for import lines — notably the new import
    future.keywords.not for now, with a few more to follow soon
    in OPA.
  * Debug Adapter
  - Evaluate
    Regal's debug adapter protocol (DAP) implementation now
    supports evaluating variables and expressions inside of stack
    frames in debugging sessions! This also allows setting up
    watch expressions in clients like VS Code.
    Video see
    https://github.com/open-policy-agent/regal/releases/tag/v0.42.0
    Make sure to download the latest version of the OPA VS Code
    extension to try it out. More clients hopefully supported
    soon!
  * Various Improvements
  - Add --aggregate flag to regal new rule command to create
    aggregate rules. Thanks @mvanhorn!
  - Allocate less memory while linting with this one simple trick
  - Make common rule name provider provide suggestions for
    default rules
  - Make input.json completion provider provide suggestion for
    imports
  - Have boolean value completion provider provide suggestions in
    many more locations
  - Add inline docs to import provider
  - Add label details to built-in function completion provider
  - Bump OPA dependency to v1.18.2
  * Bugs Fixed
  - Override return type of object.subset while waiting for the
    next OPA release to fix this. Thanks @mvanhorn!
  - Fix wrong end location of reported for unresolved functions
  - Fix wrong end location reported by rule-shadows-builtin
  * Documentation
  - Update defunct styra.com links to point to archived copies
    until we find a better home for them
  - Documentation added for how GitHub Copilot breaks
    autocomplete in VS Code and a recommendation not to use it.
  * Changelog
  - 22365a3: docs: Document Copilot breaking language servers in
    VS Code (#2021) (@anderseknert)
  - b842742: docs: Archive some styra.com references (#2022)
    (@charlieegan3)
  - a2539ef: roast: adjust not test locations (#2023) (@srenatus)
  - 81d6485: feat: add --aggregate flag to regal new rule (#341)
    (#1966) (@mvanhorn)
  - 75ce34c: lsp: first implementation of find references and
    rename (#2029) (@anderseknert)
  - efa9106: perf: remove a million allocations with this one
    simple trick (#2024) (@anderseknert)
  - c64b3a3: build(deps): bump the dependencies group with 3
    updates (#2027) (@dependabot[bot])
  - b3594a4: docs: Small updates to address some inconsistencies
    (#2030) (@charlieegan3)
  - dd92373: [lsp] Update find references and rename request to
    support "some" variables (#2031) (@SeanLedford)
  - a107bea: build(deps): bump markdown-it and markdownlint-cli
    in /build (#2032) (@dependabot[bot])
  - 656cb56: [feature] Extending find references variable support
    (#2035) (@SeanLedford)
  - c78887b: build(deps): bump the dependencies group across 1
    directory with 4 updates (#2037) (@dependabot[bot])
  - 4e5e4a2: build(deps): bump the dependencies group with 5
    updates (#2043) (@dependabot[bot])
  - 9b380f4: build(deps): bump golang.org/x/net from 0.53.0 to
    0.55.0 in /build/lsp (#2041) (@dependabot[bot])
  - ce12d08: OPA v1.18.2 (#2040) (@anderseknert)
  - 4f5d1dc: fix: override object.subset return type to boolean
    (#2048) (@mvanhorn)
  - 75fd9d3: build(deps): bump golang.org/x/crypto from 0.50.0 to
    0.52.0 in /build/ws (#2044) (@dependabot[bot])
  - c2328a5: build(deps): bump the dependencies group with 4
    updates (#2049) (@dependabot[bot])
  - 758630a: Fix wrong end location of reported unresolved
    functions (#2053) (@anderseknert)
  - 9a74766: Fix wrong end location reported by
    rule-shadows-builtin (#2054) (@anderseknert)
  - 2bb3592: dap: Implement Evaluate feature (#2051)
    (@anderseknert)
  - 76ed1f0: Raise test timeout threshold to 3 seconds (#2058)
    (@anderseknert)
  - d7aaf8f: Use new inmem.NewFromASTObject to set up Regal store
    (#2056) (@anderseknert)
  - 98fc359: Add import future.keywords completion provider
    (#2055) (@anderseknert)
  - bcdaa1d: Various completion provider improvements (#2057)
    (@anderseknert)</changelog>
</package>
<package pkgid="ddbfd0049a240bbf41ff599e9e6830d68a63d3464bb80aec00fc9d7ccf57aa60750886b4bf81b7110e6eeba24f18c2fd7b024395564a00afeef76a762f1f923b" name="regal-fish-completion" arch="noarch">
  <version epoch="0" ver="0.42.0" rel="11.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743163200">- new package regal: linter and language server for Rego, bringing
  your policy development experience to the next level</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 0.33.1:
  This release is the same tag as v0.33.1, please see that release
  for the release notes.
  Another v0.33.1 was released to trigger the rebuilding of some
  assets that were deleted in a draft release.
  * New Rule: in-wildcard-key
    Using a wildcard variable (_) for the key in the key-value form
    of iteration (some _, value in collection) is never needed, and
    can be replaced by the simple some value in … form . This rule
    flags cases where the key iteration is redundant. (Read more)
  * New Rule: confusing-alias
    While import aliases can improve readability, aliasing an
    import reference that is also imported without an alias is
    confusing, as both names point to the same resource. This rule
    catches such cases. (Read more)
  * New Rule: mixed-iteration
    Rego supports different styles of collection iteration. While
    "reference style" iteration (collection[_]) can be concise for
    deeply nested structures, mixing it with the some .. in style
    within a single iteration expression makes for code that’s more
    difficult to follow. This rule encourages consistency within a
    single iteration statement. (Read more)
  * New Rule: narrow-argument
    This new rule analyzes function arguments to suggest narrowing
    them down to the minimal value the function depends on. This
    can improve clarity and reusability. The rule considers
    incrementally defined functions across all their definitions.
    This is a powerful but opinionated rule and is thus in the
    custom category and is not on by default. See the documentation
    for how to enable it if you’re curious to try it out! (Read
    more)
  * Performance Improvements
    Several improvements have been made to reduce memory
    allocations and improve overall linting performance. Numbers
    below refer to Regal’s benchmark for linting its own policies.
  - Optimized config loading and parsing, saving around 2.7
    million allocations (#1491).
  - Reduced allocations by approximately 2 million (#1494).
  - Improved the performance of the use-strings-count rule,
    saving almost 1 million allocations (#1465).
  - Optimized reference comparisons and small iteration patterns,
    saving around 300k allocations (#1472).
  - Included performance enhancements alongside an update to the
    external-reference rule to make it more configurable (#1496).
  * OPA v1.3.0
    Regal has been upgraded to use OPA v1.3.0. This brings several
    upstream improvements, including support for the new one-liner
    grouping in formatting (see OPA#6760). (#1459)
  * Bug Fixes
  - Fixed a bug in the handling of Rego input from stdin. Thanks
    @tokyowizard for the report! (#1474)
  - Fixed a panic that could occur in FindConfigRoots when
    supplied with unexpected arguments. (#1487)
  * Other Rule Updates
  - The external-reference rule can now be configured with a
    maximum number of allowed external references, instead of
    solely flagging all external uses within a function. If you
    previously had this rule disabled, you might want to try
    enabling it now, and possibly tweak its configuration to your
    liking. (#1496)
  - The rule-length rule now has a separate setting
    (max-test-rule-length) with a higher default value (60 vs 30)
    for test rules, acknowledging that tests often include
    substantial data. (#1476)
  - Updated documentation for the rule-named-if rule based on
    community feedback received via the page feedback form
    (please let us know if you see issues! &amp; thanks for the
    report!) (#1463)
  * Dependencies
    This release also updates Regals dependencies as follows.
  - github.com/open-policy-agent/opa v1.2.0 -&gt; v1.3.0
  - github.com/prometheus/client_golang v1.21.0 -&gt; v1.21.1
  - go.opentelemetry.io/otel v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/metric v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/sdk v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/trace v1.34.0 -&gt; v1.35.0
  - golang.org/x/crypto v0.35.0 -&gt; v0.36.0
  - golang.org/x/net v0.36.0 -&gt; v0.38.0
  - golang.org/x/sync v0.11.0 -&gt; v0.12.0
  - golang.org/x/sys v0.30.0 -&gt; v0.31.0
  - golang.org/x/text v0.22.0 -&gt; v0.23.0
  - google.golang.org/protobuf v1.36.4 -&gt; v1.36.5
  * Changelog
  - automated: update capabilities by @github-actions in #1458
  - OPA 1.3.0 by @anderseknert in #1459
  - Parameterize some tests by @anderseknert in #1460
  - automated: update capabilities by @github-actions in #1461
  - build(deps): bump the dependencies group with 2 updates by
    @dependabot in #1462
  - docs: rule-named-if by @charlieegan3 in #1463
  - Some perf fixes by @anderseknert in #1465
  - Rule: in-wildcard-key by @anderseknert in #1466
  - Increase coverage by @anderseknert in #1467
  - build(deps): bump github/codeql-action from 3.28.13 to
    3.28.14 in the dependencies group by @dependabot in #1468
  - perf: various improvements by @anderseknert in #1472
  - Rule: confusing-alias by @anderseknert in #1470
  - Add benchmark for testing all rules individually by
    @anderseknert in #1469
  - Rule: mixed-iteration by @anderseknert in #1475
  - Add max-test-rule-length setting to rule-length rule by
    @anderseknert in #1476
  - fix: ensure policy from stdin is enumerated correctly by
    @anderseknert in #1474
  - automated: update capabilities by @github-actions in #1477
  - builtins.RegalIsFormatted: recover from formatter panics by
    @srenatus in #1481
  - automated: update capabilities by @github-actions in #1482
  - build(deps): bump github/codeql-action from 3.28.14 to
    3.28.15 in the dependencies group by @dependabot in #1484
  - Fix unnecessary-some rule not working after OPA 1.0+ by
    @anderseknert in #1485
  - FindConfigRoots: return error, not panic by @srenatus in
    [#1487]
  - perf: Improve how config is parsed, and when by @anderseknert
    in #1491
  - Rule: narrow-argument by @anderseknert in #1488
  - build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 by
    @dependabot in #1490
  - build(deps): bump codecov/codecov-action from 5.4.0 to 5.4.2
    in the dependencies group by @dependabot in #1495
  - Make external-reference rule less annoying by @anderseknert
    in #1496
  - docs: fix docs that still used v0 syntax by @anderseknert in
    [#1494]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 0.34.0:
  After a month of development, we're happy to announce Regal
  v0.34. This version of the OPA community's favorite linter and
  language server brings you new 3 linter rules, performance
  improvements and much more.
  With the v0.34.0 release, Regal now ships with more than 100
  linter rules!
  Which is pretty close to one new week per rule since the project
  started.
  * New rules
  - unresolved-reference
    This one is particularly exciting! The new
    unresolved-reference rule reports any references (like
    data.users.permissions) that cannot be resolved (i.e. found)
    anywhere in the project. Some projects will have valid
    references that can't be resolved at the time Regal lints the
    project, and the rule provides configuration options to mark
    certain references, or entire paths (like data.users.*) as
    resolved. See the docs for the rule for more details.
  - pointless-import
    Category: imports
    The new pointless-import rule will flags imports of the same
    package, and other import forms where the import has no real
    effect.
  - single-item-in
    Category: idiomatic
    The single-item-in rule reports cases of in being used on a
    single item collection, and suggests using an equality check
    instead.
  * Performance
  - Use OPA v1.5.0, which brings performance improvements to walk
    reducing linting time by about 10%.
  - Faster linting by avoiding walk in a few locations where
    possible.
  - Improve performance of aggregate rules.
  - Several performance optimizations to Regal's linter rules.
  * API
  - The linter API now has a new Prepare method that can be used
    to prepare the linter before reusing it across several runs.
  * Various
  - Some rules that would previously only scan the topmost level
    of a rule body will now recursively scan the whole rule.
  - The input completions provider has been rewritten in Rego
    (previously Go).
  - The automatic version check has been rewritten in Rego
    (previously Go).
  * Bugs
  - Fix false positive in custom one-liner-rule.
  * Docs
  - Updated roadmap. Go check it out!
  - Move rules table from README and into a more interactive form
    on the Styra docs. Take a look!
  - Add link to Renovating Rego blog.
  - README: add link to KubeCon London talk, which prominently
    featured Regal.
  - Update links to adapt to OPA's new documentation.
  - Update outdated information in README.
  * Dependencies
  - build(deps): bump the dependencies group with 2 updates
    (#1551)
  - build(deps): bump the dependencies group with 2 updates
    (#1544)
  - build(deps): bump the dependencies group with 2 updates
    (#1521)
  - build(deps): bump github/codeql-action in the dependencies
    group (#1507)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1749038400">- Update to version 0.34.1:
  This patch release fixes a bug found since v0.34.0 as well as it
  bumps the OPA dependency to the v1.5.1 patch also released today.
  While Regal's own policies were not affected by the regression in
  walk, custom linter rules could very well be.
  * Highlights
  - OPA v1.5.0 -&gt; v1.5.1
  - Go 1.23 -&gt; 1.24
  - Fix false positive in sprintf-arguments-mismatch when the
    %-*s pattern was used for padding.
  * Changelog
  - OPA v1.5.1 and some perf tweaks (#1580)
  - docs: Update typo in link (#1581)
  - deps: Revert 47c70f0 tablewriter changes (#1579)
  - docs: Update to allow better regal docs generation (#1578)
  - [create-pull-request] automated change (#1577)
  - fix: consider padding pattern in sprintf-arguments-mismatch
    (#1575)
  - build(deps): bump ossf/scorecard-action in the dependencies
    group (#1576)
  - Fix deprecated notices in .goreleaser.yaml (#1570)
  - Go 1.23 -&gt; 1.24 (#1573)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751371200">- Update to version 0.35.1 (0.35.0 was not released):
  We're happy to release v0.35.1, the mid-summer release of Regal
  for the 🏖️ ! This release updates to OPA v1.6.0 bringing a number
  of performance improvements as well as other improvements and bug
  fixes.
  * Improved Schema Loading This PR replaces Regal's custom schema
    loader with one that matches OPA's behavior, enabling the same
    schemas to work across opa check, opa eval, and other OPA
    commands. PR #1605
  * Performance Improvements
  - Thanks to a PR in OPA, Regal's memory use is now much reduced
    due to a change conditionally supplying built-in contexts
    only when needed.
  - This PR optimizes Rego evaluation by directly mapping source
    data to ast.Value objects instead of going through
    intermediate map[string]any or JSON representations,
    eliminating ~2.9 million allocations in benchmarks. PR #1606
  - Regal contributors will be happy with
    open-policy-agent/opa#7442 which makes running Regal's tests
    around 2.5x as fast!
  * Code Actions Rewrite
  - Code actions are LSP features that provide automated fixes or
    refactoring suggestions (like "quick fix" options), and this
    PR implements them for Regal with server-side filtering to
    reduce data transfer and ensure consistent editor behavior.
    This is also now implemented in Rego! PR #1604
  * Docs
  - PR #1584 refactors a number of Regal's pages including
    breaking down the previously large README into separate
    files. Browse the new structure on the Regal Website.
  - The Code Lens documentation has been updated to better
    explain supported configurations. Thanks @Shinzu for the
    report here. #1596
  * Changelog
  - 92d1ba9: deps: Update OPA to v1.6.0 (#1617) (@charlieegan3)
  - 2bbe76e: [create-pull-request] automated change (#1582)
    (@github-actions[bot])
  - 6e5e6bb: e2e: add frankenstein test build (@srenatus)
  - 5bf607d: build(deps): bump github/codeql-action in the
    dependencies group (#1585) (@dependabot[bot])
  - 6f45a9f: build(deps): bump brace-expansion from 2.0.1 to
    2.0.2 in /build (#1587) (@dependabot[bot])
  - e85b878: docs: Update config cli docs (#1584) (@charlieegan3)
  - 30c73fe: build(deps): bump github/codeql-action in the
    dependencies group (#1595) (@dependabot[bot])
  - b8f3e8f: fix: improve snippets suggestion condition (#1597)
    (@anderseknert)
  - eb48984: Fix issue with handling big numbers (#1599)
    (@anderseknert)
  - 1ee1cf4: fix: Correct end location in unresolved-reference
    (#1600) (@anderseknert)
  - e50c9af: Bump Roast -&gt; v0.12.0 (#1601) (@anderseknert)
  - 981d8d2: docs: Update Evaluation Code Lens docs (#1602)
    (@charlieegan3)
  - 3577efe: lsp/completion/input: don't suggest 'input'
    following dot (#1603) (@srenatus)
  - 02d1546: lsp: Code Action feature rewritten in Rego (#1604)
    (@anderseknert)
  - 25b1072: More robust loading of schemas (#1605)
    (@anderseknert)
  - 112dc87: perf: avoid JSON/map roundtrips in ast.Value
    transforms (#1606) (@anderseknert)
  - d87fd2f: docs: Tone down "obsolete" description for
    use-rego-v1 (#1610) (@anderseknert)
  - a939219: lsp: Roll over load file failures (#1611)
    (@charlieegan3)
  - 1d771ca: interning: bump opa+roast, replace call to
    ast.InternedBoolTerm() (#1613) (@srenatus)
  - ed0ead4: build(deps): bump
    github.com/go-viper/mapstructure/v2 in /e2e/testbuild (#1615)
    (@dependabot[bot])
  - 0d65ef0: build(deps): bump
    github.com/go-viper/mapstructure/v2 (#1614)
    (@dependabot[bot])</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1757851200">- Update to version 0.36.1 (0.36.0 was not released):
  This is Regal v0.36! The first Regal release since becoming a
  part of the OPA project last month. This release mostly delivers
  a number of new language server features as well as wider
  improvements under the hood and to the developer experience.
  * A note about Regal's documentation
    Our documentation is now displayed as part of the main OPA
    website!
    https://www.openpolicyagent.org/projects/regal
    From this release, links generated from Regal in output to
    rules will point to this location. You might find links to the
    old location as we get things updated. Please feel free to open
    any issues for link problems you find just so we don't miss
    anything.
  * Get contextual documentation when calling built-in functions
  - Following PR #1654, the Regal language server will now offer
    signatureHelp to compatible clients. This shows the current
    argument type and description in the help text for built-in
    functions. This is in addition to the other general function
    documentation displayed here.
  * Quickly see related fields in when editing METADATA
  - PR #1657 implements support for the documentHighlight request
    from clients. This is currently only used to show signal
    other related METADATA keys when working with Rego metadata.
    In future, this same functionality could be used to highlight
    other related items currently in the viewport.
  * Jump directly from ignore directives to documentation
  - documentLink is another request from clients which allow the
    server to respond with link ranges. We have used this to make
    regal ignore directives clickable, helping users quickly
    learn what they mean when encountered in policies PR #1657.
  * Get live diagnostics from custom rules as you type
  - PR #1631 ensures that users of custom linter rules are also
    able to access these for live diagnostics in language server
    clients. Previously these were not evaluated in the server,
    only in the Regal CLI.
  * Notable Refactors &amp; Development Changes
  - Rego Language Server Routing: PR #1675 makes some notable
    changes to how Rego is used within the Regal’s language
    server. The Language Server Protocol (LSP), which Regal
    implements to support LSP clients, is based on JSON message
    passing. This lends itself to Rego evaluation which is JSON
    in, JSON out. This PR updates the handling of different LSP
    messages sent from clients to route them in Rego, handling
    Rego backed rules first, and falling back to Golang
    implementations that still remain otherwise. This sets the
    direction for more Rego LSP functionality in the language
    server in future.
  - Development bundle loading from disk: PR #1646 gives those
    working on Regal in development the option of using the
    current source for the Regal bundle without rebuilding the
    binary. This improves the experience when working on Rego
    based language server functionality by reducing the time of a
    feedback loop. Set REGAL_BUNDLE_PATH to use this feature.
  * Changelog
  - 1f1044f: build: Remove tap key (#1687) (@charlieegan3)
  - build(deps): bump github/codeql-action from 3.29.0 to 3.29.1
    in the dependencies group by @dependabot[bot] in #1616
  - Add Regal bundle compilation benchmark by @anderseknert in
    [#1618]
  - Remove quotes from keywords in refs by @anderseknert in #1619
  - lsp: Skip loading files on disk when in cache by
    @charlieegan3 in #1620
  - build(deps): bump the dependencies group with 2 updates by
    @dependabot[bot] in #1621
  - automated: update capabilities by @github-actions[bot] in
    [#1622]
  - add experimental lsp package for websocket communication by
    @srenatus in #1623
  - internal/io: add FindInputPath when the content isn't needed
    by @srenatus in #1624
  - build(deps): bump github/codeql-action from 3.29.2 to 3.29.3
    in the dependencies group by @dependabot[bot] in #1626
  - lsp/completions: Handle hyphenated package names by
    @charlieegan3 in #1625
  - lsp: fix didOpen templating race by @charlieegan3 in #1627
  - build/lsp: add web client demo by @srenatus in #1629
  - lsp: Fix stale diagnostics after deletion by @charlieegan3 in
    [#1628]
  - Some doc updates by @anderseknert in #1632
  - lsp: Add support for custom rules by @charlieegan3 in #1631
  - Vendor roast dependency by @anderseknert in #1634
  - lsp: Address windows goto definition URI issue by
    @charlieegan3 in #1633
  - Fix regal new rule issues + refactor io code by @anderseknert
    in #1636
  - lsp: Use full text replacement for Intellij fmt by
    @charlieegan3 in #1637
  - test: refactor e2e test, add new regal command runner by
    @anderseknert in #1640
  - build(deps): bump github/codeql-action from 3.29.3 to 3.29.5
    in the dependencies group by @dependabot[bot] in #1641
  - Fix missing source.explore code action by @anderseknert in
    [#1643]
  - lsp: Present filename relative to root in errors by
    @charlieegan3 in #1638
  - refactor: Improve code quality throughout the codebase by
    @anderseknert in #1642
  - lsp/uri: Refactor URI handling by @charlieegan3 in #1644
  - Tidying up more code by @anderseknert in #1645
  - Provide development option to load bundle from disk by
    @anderseknert in #1646
  - lsp/eval: Ensure filenames use URI in print output by
    @charlieegan3 in #1647
  - Rewrite more completion providers in Rego. Resolve schemas at
    runtime. by @anderseknert in #1652
  - lsp: Add signature help by @charlieegan3 in #1654
  - lsp: Fix server signature race in test by @charlieegan3 in
    [#1655]
  - build(deps): bump the dependencies group with 5 updates by
    @dependabot[bot] in #1639
  - build(deps): bump the dependencies group with 3 updates by
    @dependabot[bot] in #1653
  - docs: update README badges for OPA 1.7.1 release by
    @charlieegan3 in #1656
  - New LSP features and internal improvements by @anderseknert
    in #1657
  - lsp/documenthighlight: Add tests by @charlieegan3 in #1659
  - Add tests for textDocument/documentLink handler by
    @anderseknert in #1658
  - Styra URLs -&gt; OPA URLs by @anderseknert in #1662
  - docs: Update README re: move to open-policy-agent by
    @charlieegan3 in #1664
  - internal/io: explicitly disable lazy loading of regal bundle
    by @srenatus in #1666
  - build(deps): bump the dependencies group across 1 directory
    with 4 updates by @dependabot[bot] in #1663
  - Enable pprof endpoint only with env var set by @anderseknert
    in #1667
  - docs: Remove update workflow &amp; minor adjustments by
    @charlieegan3 in #1668
  - Disable Codecov PR comments by @anderseknert in #1670
  - deps: OPA v1.8.0 by @anderseknert in #1669
  - docs: Changes needed in docs for opa site deploy by
    @charlieegan3 in #1673
  - build(deps): bump github/codeql-action from 3.29.11 to 3.30.0
    in the dependencies group by @dependabot[bot] in #1674
  - Rego-based routing of Rego handlers + refactor by
    @anderseknert in #1675
  - Just one more.. refactor by @anderseknert in #1677
  - docs: Updates in preparation for OPA site deploy by
    @charlieegan3 in #1676
  - lsp: GTD use URI for location by @charlieegan3 in #1680
  - fix: Don't use OS path separator when walking FS by
    @anderseknert in #1681
  - build(deps): bump the dependencies group with 3 updates by
    @dependabot[bot] in #1678
  - build: Add windows runners to build workflow by @charlieegan3
    in #1682
  - Weekend refactor by @anderseknert in #1684
  - Fix documentLink issue when no user config provided by
    @anderseknert in #1686
  - build: Remove tap key by @charlieegan3 in #1687</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- Update to version 0.37.0:
  This release features a new linter rule, several new language
  server features, and many improvements and fixes. The two major
  OPA versions bumped since the last release additionally contains
  several performance improvements that were contributed as part of
  developing Regal!
  * New Rule: prefer-equals-comparison
    The prefer-equals-comparison linter rule recommends using the
    == operator for equality comparison over the unification
    operator =. The rule helps improve code clarity by using
    operators for their intended purposes: := for assignment, ==
    for equality comparison, and = for unification. The linter
    identifies when = is used for comparison by checking if both
    sides of the operator are "unassignable".
    Avoid
    input.request.method = "GET"
    Prefer
    input.request.method == "GET"
    There are some certainly valid use cases for the unification
    operator! But simple equality comparison is not one. For more
    information, see the documentation for the rule. As an amusing
    aside, this fixes one of the first issues created in the
    project!
  * Language server: Document highlighting to help show where
    function args are referenced
    Document highlighting is one of the more subtle features of the
    LSP specification, but a really helpful one when implemented
    well. The experimental first implementation that shipped with
    Regal v0.36.0 is no longer experimental, and has also been
    extended to highlight usage of function argument variables
    inside of a function head or body.
    (Please find the screencast in the release notes)
  * Language server: Selection ranges
    Selection ranges provide smart selection of code that can
    expand and shrink based on knowledge of the code rather than
    simple text properties, like hyphens or whitespace. This makes
    moving code around extremely fast, and without leaving the
    keyboard. Consult the language server docs for how to enable
    this in your editor
    (Please find the screencast in the release notes)
  * Improvements
  - The pointless-reassignment rule would previously only flag
    reassignment at the top level of a rule body. Now it flags
    pointless reassignments also in nested bodies, like
    comprehensions, every statements, and so on.
  - All completion providers are now implemented purely in Rego
  - Remove the go-semver dependency in favor of a custom, much
    faster implementation
  - Build: Reduce permissions granted in update-caps top-level
    workflow, by @timothyklee
  - Docs: Update language server page to demonstrate recently
    added features
  - Docs: Add kakoune LSP configuration example
  * Windows compatibility improvements
    In this release we have fixed various Windows bugs (Language
    Server Init, Goto Definition, Error Popups) in #1740, #1737,
    [#1736], following #1633, and #1642 last release.
    These fixes have also made it possible to run our test suites
    on Windows runners to catch issues sooner in future. A huge
    thanks to @charlieegan3 for his tireless work on this!
  * Bugs fixed
  - Fix false positive in use-some-for-output-vars triggered by
    nested variables in rule ref heads, like rule[input[i]].allow
    if ....
  - Fix false positive in redundant-existence-check when a not
    check made an existence check necessary, reported by @gusega
  - Fix false positive in narrow-argument rule, which would
    incorrectly flag some arrays passed as arguments
  - Ensure that the language server InitOptions is never nil and
    don't cause issues with clients that don't provide those
  * Dependency Updates:
  - github.com/open-policy-agent/opa: v1.8.0 → v1.10.1
  - github.com/arl/statsviz: v0.7.1 → v0.7.2
  - github.com/go-git/go-git/v5: v5.16.2 → v5.16.3
  - github.com/olekukonko/tablewriter: v0.0.5 → v1.1.0
  - github.com/spf13/cobra: v1.9.1 → v1.10.1
  - github.com/spf13/pflag: v1.0.7 → v1.0.10
  - Removed: github.com/coreos/go-semver: v0.3.1
  * Changelog
  - 244459c: docs: Remove some old references (#1689)
    (@anderseknert)
  - 4212b5c: build(deps): bump the dependencies group with 2
    updates (#1690) (@dependabot[bot])
  - e149c6d: build: reduce update-caps top-level workflow
    permission to read (#1691) (@timothyklee)
  - 819bbec: lsp: Fix missing initial root (#1692)
    (@charlieegan3)
  - be8b020: docs: Update style guide links to new repo (#1693)
    (@charlieegan3)
  - ceb890b: Builtin function completion in Rego (#1694)
    (@anderseknert)
  - d36555e: Package ref import suggestions in Rego (#1698)
    (@anderseknert)
  - 4e44131: build(deps): bump the dependencies group with 2
    updates (#1703) (@dependabot[bot])
  - 14166e9: Avoid multi-line highlighting of issues (#1702)
    (@anderseknert)
  - 1685bb8: Move completion handler into Rego router (#1699)
    (@anderseknert)
  - 0da5eaa: build(deps): bump the dependencies group with 2
    updates (#1708) (@dependabot[bot])
  - e792757: Bump OPA -&gt; v1.9.0, golangci-lint 2.5.0 (#1709)
    (@anderseknert)
  - 3092d1d: docs: Address some broken links from OPA report
    (#1704) (@charlieegan3)
  - bebfd06: util: use Partial2 for IsAnyError (@srenatus)
  - f22a570: Fix false positive in redundant-existence-check
    (#1716) (@anderseknert)
  - 2703715: Various fixes (#1715) (@anderseknert)
  - 87981f2: build(deps): bump the dependencies group with 2
    updates (#1713) (@dependabot[bot])
  - a6487b6: lsp: document highlighting supporting function args
    (#1718) (@anderseknert)
  - fe8cbd3: Rule: prefer-equals-comparison (#1726)
    (@anderseknert)
  - f3722ea: Fix false positive in narrow-argument (#1724)
    (@anderseknert)
  - 73b8c65: Improve pointless-reassignment to cover nested cases
    (#1727) (@anderseknert)
  - 9cf180c: lsp: Implement selection ranges and linked editing
    range (#1722) (@anderseknert)
  - bf632d0: build(deps): bump the dependencies group with 2
    updates (#1725) (@dependabot[bot])
  - a373ae3: lsp: Use filename path for current buffer for defns
    (#1732) (@charlieegan3)
  - d758eaf: lsp: Refactor range utilities (#1729)
    (@anderseknert)
  - 13de8a9: Fix incorrect behavior in pointless-import (#1733)
    (@anderseknert)
  - fb560c1: Fix false positive in use-some-for-output-vars
    (#1731) (@anderseknert)
  - 70449b7: Various small fixes (#1736) (@anderseknert)
  - 2594719: windows: Better use of slash paths (#1737)
    (@charlieegan3)
  - 499125f: Get FindClosestMatchingRoot working on windows
    (#1740) (@charlieegan3)
  - 3715085: OPA v1.10.0 (#1742) (@anderseknert)
  - 781f809: deps: stick to
    github.com/vektah/gqlparser/v2@v2.5.30 (#1744) (@srenatus)
  - bbb03db: Use generic client identifier in tests (#1741)
    (@charlieegan3)
  - c42ce08: build(deps): bump github/codeql-action in the
    dependencies group (#1745) (@dependabot[bot])
  - 4384b0d: Remove go-semver dependency, plus various fixes
    (#1746) (@anderseknert)
  - 97dfbd4: docs: update LSP page to show new features (#1748)
    (@charlieegan3)
  - 818b33a: docs: Minor fixes to docs typos and links (#1747)
    (@charlieegan3)
  - 4138270: Update to OPA v1.10.1 (@charlieegan3)
  - 55cf029: lsp: ensure that InitOptions is never nil (#1752)
    (@srenatus)
  - 8ffa270: docs: add kakoune LSP config snippet (#1751)
    (@srenatus)
  - 216341a: reporter,lsp: update URLs for help links (#1750)
    (@srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 0.38.0:
  * Feature: String Interpolation Support
    v0.38.0 of your favorite Rego linter, debugger and language
    server brings full support for OPA's new string interpolation
    feature. This means not only that Regal lints code found inside
    interpolated strings, but that you'll have access to all your
    favorite language server features within them too — like code
    completions, tooltips on hover, or document highlighting. You
    can even use the debugger to step through interpolated
    expressions! If you haven't yet tried it out, grab OPA v1.12.2,
    Regal v0.38.0 and enjoy an absolutely awesome addition to the
    Rego language!
    In addition to this, we have a number of fun new features and
    performance improvements.
  * New Rule: disallow-rego-v1
    Category: custom
    This optional new rule flags the use of import rego.v1 in Rego
    policies (#1778). Since OPA v1.0 (December 2024), this import
    is a no-op and no longer needed. The rule helps users maintain
    clean code by preventing this outdated import from appearing in
    new policies. Teams standardizing on OPA 1.0+ can enable this
    rule to enforce modern Rego standards.
    package example
    import rego.v1 # &lt;-- Happy 2026! Time to stop doing this!
  * New Fixers
    @SeanLedford has also done some great work to help expand
    Regal's auto-fixing capabilities by having regal fixers added
    for three more rules.
  - prefer-equals-comparison
  - redundant-existence-check
  - constant-condition
    See (#1790) and (#1794) for more details.
  * Performance
    The fixer saw a 12% performance improvement by reusing the
    linter, reducing allocations from 2.3M to 2.0M operations
    (#1783). Additional optimizations include:
  - faster file filtering by avoiding recompiled ignore patterns
    (#1758),
  - better built-in function handling by registering Regal's
    functions globally only once (#1788),
  - and more efficient AST location serialization (#1758)
    To track ongoing performance work, a new post-merge
    benchmark-recording workflow was added (#1793).
  * LSP: New Ignore Code Action
    The language server now supports a code action to quickly add
    regal ignore configuration for specific rules directly from the
    editor (#1777).
  * Changelog
  - ac35695: Various performance improvements (#1758)
    (@anderseknert)
  - 48cd03d: docs: Add custom head for regal index page (#1761)
    (@charlieegan3)
  - 728ae28: build(deps): bump golangci/golangci-lint-action
    (#1762) (@dependabot[bot])
  - 92cf6ca: explorer: allow hiding stages without an effect
    (+misc) (#1760) (@srenatus)
  - c000994: docs: Correct sidebar labels (#1763) (@charlieegan3)
  - bf0b621: build(deps): bump
    github.com/containerd/containerd/v2 in /e2e/testbuild (#1753)
    (@dependabot[bot])
  - 18e7a89: build(deps): bump
    github.com/containerd/containerd/v2 (#1754)
    (@dependabot[bot])
  - ccab7bd: Rename: encoding/util -&gt; encoding/write (#1764)
    (@anderseknert)
  - 54f7625: build: run windows in matrix with other jobs (#1770)
    (@charlieegan3)
  - 5c9e6f0: update: Update version checking logic (#1772)
    (@charlieegan3)
  - 5034776: build: Add badge update to readme script (#1773)
    (@charlieegan3)
  - 95e8220: Added OPA installation as a Regal prerequisite, and
    fixed golangci-lint link. (#1774) (@SeanLedford)
  - 149f71d: build(deps): bump js-yaml from 4.1.0 to 4.1.1 in
    /build (#1775) (@dependabot[bot])
  - b8f8b7f: Enable more golangci-lint linters (@anderseknert)
  - e092627: build: Update mac runner (@charlieegan3)
  - 877884c: lsp: Add code action and command to ignore rule
    (#1777) (@charlieegan3)
  - ece9ca2: build(deps): bump the dependencies group with 5
    updates (@dependabot[bot])
  - bd37bbd: build(deps): bump golang.org/x/crypto in /build/lsp
    (@dependabot[bot])
  - 17cc429: build(deps): bump golang.org/x/crypto in
    /e2e/testbuild (@dependabot[bot])
  - 415b05f: build(deps): bump golang.org/x/crypto from 0.43.0 to
    0.45.0 (@dependabot[bot])
  - e1bb975: Improve fixer performance (@anderseknert)
  - 1b083ff: Added Rule: Disallow import rego.v1 (#1778)
    (@SeanLedford)
  - 9e43c50: Optimize and improve code for built-in functions
    (@anderseknert)
  - 64ce2aa: build(deps): bump glob and markdownlint-cli in
    /build (#1779) (@dependabot[bot])
  - 48fddeb: build(deps): bump github/codeql-action in the
    dependencies group (#1787) (@dependabot[bot])
  - bc41f63: pkg/linter: use errgroup, set limits + context on it
    (@srenatus)
  - f22c2aa: Add fixer for prefer-equals-comparison rule (#1790)
    (@SeanLedford)
  - cf88eb9: Fixers for redundant-existence-check and
    constant-condition rules (#1794) (@SeanLedford)
  - 36401a2: build(deps): bump the dependencies group across 1
    directory with 7 updates (#1796) (@dependabot[bot])
  - ecb23d3: version: Add OPA version to version output (#1798)
    (@charlieegan3)
  - 94ce038: build(deps): bump golang.org/x/crypto from 0.43.0 to
    0.45.0 in /build/ws (#1791) (@dependabot[bot])
  - 9ce1ddd: workflows: add post-merge benchmark-recording
    workflow (@srenatus)
  - e111443: workflows/benchmark: fix golang setup (@srenatus)
  - 4bb2d5a: docs: Update messy rule docs (@charlieegan3)
  - dec83ea: docs: Updates from opa website link scanner
    (@charlieegan3)
  - 8f544a6: fix typo in fix.go help message (#1807) (@gusega)
  - 941b02e: build(deps): bump the dependencies group with 3
    updates (#1804) (@dependabot[bot])
  - 9f09e6e: build(deps): bump the dependencies group with 4
    updates (#1808) (@dependabot[bot])
  - 476ef89: OPA v1.12.2 and full string interpolation support
    (#1811) (@anderseknert)
  - a9843ab: Move chained-rule-body to custom category (#1812)
    (@anderseknert)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768392000">- Update to version 0.38.1:
  This patch release fixes several bugs including some found in the
  recent v0.38.0 release, as well some other improvements.
  * Bug Fixes
  - Fix for prefer-equals-comparison fixer failing to parse
    policies with multiple "=" in expressions (#1824, fixes #1818
    reported by @gusega)
  - Fix for incorrect fixable violation count display in lint
    output (#1825, fixes #1813 reported by @gusega)
  - Fix for false positive in prefer-equals-comparison rule with
    comprehension term vars (#1828, fixes #1826 reported by
    @SeanLedford)
  - bundle: Surface configured rule notices as messages in lint
    output (#1827, fixes #1795 reported by @ghmer)
  * Improvements
  - Code action for prefer-equals-comparison fixer now available
    in the language server (#1810)
  - New option for prefer-value-in-head rule to count
    interpolated strings as scalars (#1817)
  - Minor performance improvement for any_set_item, used for
    selecting items from sets (#1815)
  * Changelog
  - f1c5f74: bundle: Improve performance of any_set_item (#1815)
    (@charlieegan3)
  - 9300420: Implemented Code action for prefer-equals-comparison
    fixer (#1810) (@SeanLedford)
  - 28121f0: build(deps): bump github/codeql-action in the
    dependencies group (#1823) (@dependabot[bot])
  - 54cdcb6: Add prefer-value-in-head option to count
    interpolated string as scalar (#1817) (@anderseknert)
  - e68184d: Fix false positivie in prefer-equals-comparison
    (#1828) (@anderseknert)
  - 593e221: fix: Prefer-Equals-Comparison Edge Case With
    Multiple "=" (#1824) (@SeanLedford)
  - 3dc28bb: bundle: Surface configured rule notices (#1827)
    (@charlieegan3)
  - aac9618: Updated lint reporter to track fixable violation
    count separate from fixable violation Set (#1825)
    (@SeanLedford)
  - fd6dd4d: Updated example for prefer-equals-comparison edge
    case to not include false positive (#1829) (@SeanLedford)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772193600">- Update to version 0.39.0:
  We're happy to announce Regal v0.39.0, featuring 3 new linter
  rules, many language server improvements, and much faster
  linting!
  * New Rule: use-array-flatten
    Category: idiomatic
    The use-array-flatten rule recommends using array.flatten
    instead of nested array.concatenation (#1873).
    Avoid
    package policy
    flat1 := array.concat(arr1, array.concat(arr2, arr3))
    flat2 := array.concat(arr1, array.concat(arr2, array.concat(arr3, arr4)))
    Prefer
    package policy
    flat1 := array.flatten([arr1, arr2, arr3])
    flat2 := array.flatten([arr1, arr2, arr3, arr4])
  * New Rule: use-object-union-n
    Category: idiomatic
    The use-object-union-n rule recommends using object.union_n
    over nested calls to object.union (#1873).
    Avoid
    package policy
    obj := object.union(obj1, object.union(obj2, obj3))
    Prefer
    package policy
    obj := object.union_n([obj1, obj2, obj3])
  * New Rule: equals-over-count
    Category: performance
    The new optional equals-over-count rule suggests using direct
    equality comparisons rather than count when checking collection
    membership or emptiness (#1878). This is a micro-optimization
    and not a general recommendation. Must be manually enabled.
  * Performance
    This release brings an approximate 25% reduction in linting
    time through aggregate remodeling and Rego prepare stage
    optimizations (#1838). Additional performance work includes
    Rego refactoring (#1857, #1884), AST transform improvements
    (#1892), and various micro-optimizations (#1866, #1879).
  * Language Server Improvements
    The language server now includes a semantic token framework for
    improved syntax highlighting (#1845, #1865, #1870), code
    actions for the constant-condition and
    redundant-existence-check fixers (#1830).  and an
    opaTestProvider feature for test discovery (#1888, #1889,
    [#1898]),
    Completion performance is improved with a
    completionItem/resolve handler (#1831), and server capabilities
    are now properly exposed and consistent with the clients
    (#1867, #1880).
    Note: Semantic token support is feature flagged and will be
    available in the next release.
  * Compiler Explorer
    Regal now supports the VSCode-based OPA Explorer extension,
    providing a rich GUI to compare compiler stages directly in VS
    Code (#1862) - thanks @srenatus! A new "Format stages" option
    has also been added to the compiler explorer (#1854) - thanks
    @johanfylling!
  * Experimental: rq Engine Support
    Initial support for the rq engine has been added (#1872)
  * Various Improvements
  - Improved redundant-existence-check rule (#1897, fixes #1805)
  - Disabled zero-arity-function rule as opa-fmt now covers that
    (#1885)
  * Bug Fixes
  - Fix nil dereference on compiler errors in explorer (#1837)
  - Fix broken links to fixer page (#1852)
  - Fix false positive in use-some-for-output-vars (#1886)
  - Fix broken input.json completion provider (#1891)
  * Dependency Updates
  - Regal has been upgraded to use OPA v1.14.0 and Go 1.26.
  * Documentation
  - Added mise as an alternative installation method (#1849)
  - Updated installation documentation (#1861)
  - Updated note about eval and debug roots (#1894)
  - Show release badge when using pre-release versions (#1899)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 0.40.0:
  Today we celebrate Regal who turns v0.40.0 just in time for the
  GitHub download tracker to report 1 million total downloads.
  Quite the milestone! Thank you all for the encouragement, support
  and contributions during these past 3 years. Together we're
  redefining the policy development experience, and we have a lot
  more of that planned for the future. Stay tuned!
  This release includes 2 new linter rules, and many new features
  and improvements to both the linter and language server.
  * Linter
  - New Rule: invalid-regexp
    Category: bugs
    The new invalid-regexp rule scans regular expressions found
    in policies and reports invalid patterns that would otherwise
    fail at runtime.
    Avoid
    package policy
    invalid if regexp.match("[a-z", "test")
    Prefer
    package policy
    valid if regexp.match("[a-z]", "test")
  - New Rule: superflous-object-get
    Category: idiomatic
    The superflous-object-get rule flags calls to object.get
    where using the built-in function provides no benefit
    compared to using a reference directly, and without the call.
    Avoid
    package policy
    superfluous if {
    [#] the default value (`""`) isn't used in the expression,
    [#] so object.get provides no benefit here
    object.get(input, ["user", "department"], "") == "engineering"
    }
    Prefer
    package policy
    much_better if {
    input.user.department == "engineering"
    }
    More cases of superfluous object.get will be added to this
    rule as we encounter them.
  * Improvements
  - The naming-convention rule now accepts a list of allowed
    names in addition to regex patterns
  - The non-loop-expression rule now identifies more types of
    expressions that could be moved out of iteration
  - All rules now contain a related_resources item in their
    metadata pointing to the docs for the rule
  - The regal new rule command now generates a Related Resources
    section in the new rule's documentation template
  * Bugs Fixed
  - Fixed two false positives reported in the non-loop-expression
    rule
  - The server now exits with an error if the --profile flag is
    used without --format json (thanks @mvanhorn!)
  * Language Server
  * Evaluate and Debug Actions
    Any input.json or input.yaml file found in the workspace will
    be used for input during evaluation and debugging sessions,
    but this wasn't obvious without reading the docs. The
    Evaluate and Debug code lenses / commands will now present a
    dialog option asking to create an input.json file in the
    project workspace in case one isn't found. This file is
    populated with dummy JSON data based on references to input
    found in the policy, and should be edited by the user to
    provide more relevant data.
  * Hover Provider Improvements
    The hover provider showing tooltips for built-in functions
    and keywords has been rewritten in Rego, and additionally saw
    a few improvements land as part of that process:
  - Links to examples for built-in functions now point to the
    correct location in the OPA docs
  - The print function now shows up in hover results as well
  - Hover provider now less resource intensive, and all
    information rendered just in time for display
  * Inlay Hints Improvements
    The inlay hint provider (that provides names of function
    arguments to be displayed at call sites) has also been
    rewritten in Rego, and the server now implements also the
    inlayHint/resolve handler, which improves performance by only
    calculating inlay hint details when the client requests them
    for display.
    Additionally, the inlay hint provider now properly takes the
    range of the active editor view into account, and will only
    spend resources calculating hints for code that the user can
    actually can see.
  * Semantic Tokens in Comprehensions and every Expressions
    The language server's semantic token provider (providing
    context-based syntax highlighting) now provides semantic
    tokens inside of comprehensions and every expressions in
    addition to previously supported contexts. Additionally, most
    of the semantic token logic is now implemented entirely in
    Rego.
  * Improved Language Server Initialization
    This release contains a number of fixes and improvements
    related to the language server's initialization routine,
    which should now be both more robust and faster.
  * Bugs Fixed
  - Two potential nil dereferences identified and fixed
  - Fix a potential out of bounds panic in slice access
  - The bundled web server now shows a link to Regal's editor
    integration documentation on its index page
  * Finally
    Extra thanks goes out to @charlieegan3 this release, who worked
    tirelessly to fix some really complex race conditions and
    concurrency issues in the language server. A thankless job, but
    extremely important, and he pulled it off like a true Viking!
  * Changelog
  - 691afe1: Replace some Styra references (#1904)
    (@anderseknert)
  - 975ae72: build(deps): bump github.com/go-git/go-git/v5 in the
    dependencies group (#1903) (@dependabot[bot])
  - c85d88f: build(deps): bump go.opentelemetry.io/otel/sdk in
    /build/lsp (#1906) (@dependabot[bot])
  - 5ff449b: build(deps): bump the dependencies group with 3
    updates (#1907) (@dependabot[bot])
  - 9900522: lsp: Wait for client to send initialized at boot
    (#1909) (@charlieegan3)
  - d661b5a: build(deps): bump github/codeql-action in the
    dependencies group (#1912) (@dependabot[bot])
  - fd85e2d: Allow naming-convention rule to take list of names
    (not only a pattern) (#1911) (@anderseknert)
  - 299d3fc: Semantic Token Support for Comprehensions and
    Constructs (#1883) (@SeanLedford)
  - 422a9ef: build(deps): bump github/codeql-action in the
    dependencies group (#1915) (@dependabot[bot])
  - 02a9dc8: Fail with error when --profile used without JSON
    format (#1918) (@mvanhorn)
  - 1716e13: lsp/webserver: Add links to the index page (#1914)
    (@charlieegan3)
  - 1ab360f: lsp/testing: Nested test implementation (#1913)
    (@charlieegan3)
  - 53e5bf2: build(deps): bump google.golang.org/grpc in
    /e2e/testbuild (#1916) (@dependabot[bot])
  - 45841bf: build(deps): bump smol-toml and markdownlint-cli in
    /build (#1919) (@dependabot[bot])
  - 371bf1f: build(deps): bump picomatch from 4.0.3 to 4.0.4 in
    /build (#1920) (@dependabot[bot])
  - 62852fc: build(deps): bump the dependencies group across 1
    directory with 4 updates (#1921) (@dependabot[bot])
  - d32408d: build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#1922) (@dependabot[bot])
  - 8b9bcf0: build(deps): bump github.com/go-git/go-git/v5 from
    5.17.0 to 5.17.1 (#1923) (@dependabot[bot])
  - f2251f2: [create-pull-request] automated change (#1908)
    (@github-actions[bot])
  - 820d3f0: OPA v1.15.1 (#1925) (@anderseknert)
  - a155b62: Add popup prompt for creating input.json if it
    doesnt exist when Evaluate is run (#1929) (@SeanLedford)
  - 27067af: build(deps): bump the dependencies group with 2
    updates (#1931) (@dependabot[bot])
  - 2179ae4: Fix non-loop-expression false positives (#1930)
    (@anderseknert)
  - 33282ba: Rule: superflous-object-get (#1932) (@anderseknert)
  - 6fd115a: Include rule docs links in metadata (#1935)
    (@anderseknert)
  - 6a364fb: Fix aggregate test loop initialization (#1936)
    (@charlieegan3)
  - 61ab730: Rule: invalid-regexp (#1937) (@anderseknert)
  - 752ca7e: Cover more non-loop-expressions (#1938)
    (@anderseknert)
  - cb9a9c8: Add convenience functions for working with lines and
    uints (#1944) (@anderseknert)
  - 85171b8: build(deps): bump go.opentelemetry.io/otel/sdk in
    /e2e/testbuild (#1942) (@dependabot[bot])
  - 7fd6d66: [feature] Create input.json Skeleton if User Would
    Like When One Doesn't Exist (#1934) (@SeanLedford)
  - e4e326b: OPA v1.15.2 (#1945) (@anderseknert)
  - e8f1469: build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
    (#1941) (@dependabot[bot])
  - 7a1235c: Fix potential nil deref in language server (#1947)
    (@anderseknert)
  - d6d2bf0: Fix index out of bounds in parital inlay hint
    (#1948) (@anderseknert)
  - 0a0f1f8: build(deps): bump the dependencies group with 2
    updates (#1946) (@dependabot[bot])
  - d0e99b5: Rewrite hover provider in Rego (#1951)
    (@anderseknert)
  - cc35d48: Fix possible nil deref in ogre (#1954)
    (@anderseknert)
  - 44ceabe: Rewrite inlay hint provider in Rego (#1953)
    (@anderseknert)
  - 5c62c72: testing: Improve lsp shutdown logic &amp; address test
    race conditions (#1943) (@charlieegan3)
  - 12cc776: Semantic package tokens in Rego (#1956)
    (@anderseknert)
  - b4ccafc: feat(new): add Related Resources source link to
    builtin rule doc template (#1957) (@mvanhorn)
  - 543d3fa: linter/lsp: Tidy use of aggregates and store in ls
    (#1962) (@charlieegan3)
  - 1442904: build(deps): bump github.com/go-git/go-git/v5 from
    5.17.2 to 5.18.0 (#1958) (@dependabot[bot])
  - 293cd7f: build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#1959) (@dependabot[bot])
  - 344a389: build(deps): bump the dependencies group with 3
    updates (#1963) (@dependabot[bot])
  - 784fa86: Semantic import tokens Rego rewrite (#1960)
    (@anderseknert)
  - 0a00617: Refactor: Sending Variable Semantic Tokens Data from
    Rego (#1961) (@SeanLedford)
  - 9016d3d: Minor fixes (#1965) (@anderseknert)
  - 0ddd70f: docs: Update setup-regal in docs (#1964)
    (@charlieegan3)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780488000">- update to 0.41.1:
  NOTE this is the same code as that of v0.41.0 — just that the
  combination of a release deployment issue and immutable releases
  just had that one end up without any downloadable artifacts. That
  is now corrected!
- Update to version 0.41.0:
  This release brings automatic Rego test generation, as well as
  squashing a bunch of issues under the hood with sweeping
  enhancements to the core language server code.
  * New Feature: Automatic Test Generation
    A first pass at automatic test generation has landed in the
    language server (#1982), thanks to @SeanLedford! With a new
    code action available when working in a policy file, Regal can
    generate a test stub based on the current state of the
    workspace. This uses the values found in input.json to populate
    the with statements in the generated test.
  * Language Server Improvements
    This release includes significant internal improvements to the
    language server.
    Completion performance has seen a major improvement: for
    clients like VS Code that support a default replacement range,
    the completion payload is now roughly half the size it was
    before, and clients generally do no longer need to send
    continuous requests to the server for more suggestions once you
    start typing (#1992).
    The folding range provider has been rewritten in Rego (#1979),
    and now additionally honours client capabilities like
    lineFoldingOnly and rangeLimit.
    The handling of input.json and input.yaml files has been
    overhauled (#2002). These files are now tracked as first-class
    workspace state: they are parsed and cached when saved, and the
    server now requests update notifications for them from the
    client, rather than re-parsing the file on each evaluation, or
    debug sessions started.
  * OPA v1.17.0
    Regal has been updated to OPA v1.17.0 (#2014). This OPA release
    notably introduces future.keywords.not, which improves the
    semantics of the not keyword by wrapping composite-expression
    negation in an implicit body. Thanks @johanfylling for making
    sure this also works in Regal now!
    Regal's RoAST representation (and docs) have been updated to
    support the new ast.Not form introduced alongside this feature
    (#1985).
  * RoAST module.comments Representation
    The RoAST representation of module.comments has changed
    (#1987). Comments are now represented as plain locations rather
    than base64-encoded text, allowing Regal to retrieve the
    original text from the source file directly with less bytes to
    transfer and parse. Note: this is a breaking change for custom
    rules that reference input.comments directly. Users should
    instead prefer to reference data.regal.ast.comments_decoded,
    which provides comment locations in the usual form and which
    will remain stable even through future format changes.
  * Bug Fixes
  - Addressed a panic in regal fix caused by fixes being applied
    in non-deterministic order; opa-fmt could reduce line count
    such that use-assignment-operator would then access
    out-of-bounds row numbers (#2003) as reported by @erazemk
  - The unassigned-return-value rule now correctly flags
    namespaced builtins like json.match_schema(...) in addition
    to flat builtins like lower(...) (#2005) — thanks @mvanhorn
    for the fix and @anderseknert for the report
  - Nicer formatting of with sequences (#1969)
  - regal/ast: metadata labels field is now recognized as a valid
    metadata key, aligned with OPA v1.17.0 (#1983, #1988) —
    thanks @srenatus
  - Regal fix now works regardless of local git state (#2011).
    Thanks @seiyab for the report in #2006
  * What's Changed
  - Use common aggregate data in circular-import (#2019)
  - build(deps): bump github/codeql-action in the dependencies
    group (#2017)
  - debug: Determine abs debugging path for input.json (#2018)
  - Unify common aggregation and aggregated data (#2016)
  - build(deps): bump the dependencies group with 3 updates
    (#2008)
  - build(deps): bump github.com/containerd/containerd/v2 in
    /e2e/testbuild (#2007)
  - Add capabilities verification to build check (#2015)
  - Use logger in Rego router (#2012)
  - deps: Update opa to 1.17.0 (#2014)
  - Extract file polling into waitForFile helper (#2013)
  - Remove git validation from fix command (#2011)
  - lsp: Introduce workspace abstraction (#2009)
  - Remove the settings.json change that was introduced in my
    previous PR (#2010)
  - fix(rules): unassigned-return-value now covers namespaced
    builtins (#2005)
  - [feature] First Pass at Automatic Test Generation in Regal
    (#1982)
  - fixer: Apply linter fixes in deterministic order (#2003)
  - build(deps): bump the dependencies group across 1 directory
    with 2 updates (#1998)
  - build(deps): bump brace-expansion from 5.0.5 to 5.0.6 in
    /build (#1997)
  - Improved handling of input.(json|yaml) files (#2002)
  - build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#2000)
  - build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.1 (#2001)
  - Move location of LSP storage helpers (#1993)
  - New framework for testing language server handlers (#1992)
  - Breaking: new RoAST representation of module.comments (#1987)
  - regal/ast: update metadata fields (#1988)
  - roast: Add marshaling support for `ast.Not` (#1985)
  - Introduce passthrough handler type (#1984)
  - regal/ast: add 'id' to valid metadata keys (#1983)
  - build(deps): bump github/codeql-action in the dependencies
    group (#1981)
  - Move folding range provider to Rego handlers (#1979)
  - Cleanup (#1978)
  - feat(pre-commit): add regal-fix hooks for auto-fixing rules
    (#1847) (#1976)
  - build(deps): bump the dependencies group with 2 updates
    (#1975)
  - Move initialize handler to Rego router (#1977)
  - Various code quality improvements (#1970)
  - Nicer formatting of `with` test sequences (#1969)
  - Update ast.json else to use "#/$defs/rule" (#1967)
  - Use OPA main until next OPA release (#1968)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784289600">- Update to version 0.42.0:
  * Language Server
  - Find References and Rename
    This release brings initial support for finding references
    and renaming symbols in the workspace. This first version is
    limited to function arguments and some bindings, but we plan
    to expand this in future releases.
    Video see
    https://github.com/open-policy-agent/regal/releases/tag/v0.42.0
    References are checked across the whole workspace, and
    renames work even when for example, a function is
    incrementally defined in several different files.
  - New future.keywords completion provider
    The language server will now suggest future.keywords in
    completions for import lines — notably the new import
    future.keywords.not for now, with a few more to follow soon
    in OPA.
  * Debug Adapter
  - Evaluate
    Regal's debug adapter protocol (DAP) implementation now
    supports evaluating variables and expressions inside of stack
    frames in debugging sessions! This also allows setting up
    watch expressions in clients like VS Code.
    Video see
    https://github.com/open-policy-agent/regal/releases/tag/v0.42.0
    Make sure to download the latest version of the OPA VS Code
    extension to try it out. More clients hopefully supported
    soon!
  * Various Improvements
  - Add --aggregate flag to regal new rule command to create
    aggregate rules. Thanks @mvanhorn!
  - Allocate less memory while linting with this one simple trick
  - Make common rule name provider provide suggestions for
    default rules
  - Make input.json completion provider provide suggestion for
    imports
  - Have boolean value completion provider provide suggestions in
    many more locations
  - Add inline docs to import provider
  - Add label details to built-in function completion provider
  - Bump OPA dependency to v1.18.2
  * Bugs Fixed
  - Override return type of object.subset while waiting for the
    next OPA release to fix this. Thanks @mvanhorn!
  - Fix wrong end location of reported for unresolved functions
  - Fix wrong end location reported by rule-shadows-builtin
  * Documentation
  - Update defunct styra.com links to point to archived copies
    until we find a better home for them
  - Documentation added for how GitHub Copilot breaks
    autocomplete in VS Code and a recommendation not to use it.
  * Changelog
  - 22365a3: docs: Document Copilot breaking language servers in
    VS Code (#2021) (@anderseknert)
  - b842742: docs: Archive some styra.com references (#2022)
    (@charlieegan3)
  - a2539ef: roast: adjust not test locations (#2023) (@srenatus)
  - 81d6485: feat: add --aggregate flag to regal new rule (#341)
    (#1966) (@mvanhorn)
  - 75ce34c: lsp: first implementation of find references and
    rename (#2029) (@anderseknert)
  - efa9106: perf: remove a million allocations with this one
    simple trick (#2024) (@anderseknert)
  - c64b3a3: build(deps): bump the dependencies group with 3
    updates (#2027) (@dependabot[bot])
  - b3594a4: docs: Small updates to address some inconsistencies
    (#2030) (@charlieegan3)
  - dd92373: [lsp] Update find references and rename request to
    support "some" variables (#2031) (@SeanLedford)
  - a107bea: build(deps): bump markdown-it and markdownlint-cli
    in /build (#2032) (@dependabot[bot])
  - 656cb56: [feature] Extending find references variable support
    (#2035) (@SeanLedford)
  - c78887b: build(deps): bump the dependencies group across 1
    directory with 4 updates (#2037) (@dependabot[bot])
  - 4e5e4a2: build(deps): bump the dependencies group with 5
    updates (#2043) (@dependabot[bot])
  - 9b380f4: build(deps): bump golang.org/x/net from 0.53.0 to
    0.55.0 in /build/lsp (#2041) (@dependabot[bot])
  - ce12d08: OPA v1.18.2 (#2040) (@anderseknert)
  - 4f5d1dc: fix: override object.subset return type to boolean
    (#2048) (@mvanhorn)
  - 75fd9d3: build(deps): bump golang.org/x/crypto from 0.50.0 to
    0.52.0 in /build/ws (#2044) (@dependabot[bot])
  - c2328a5: build(deps): bump the dependencies group with 4
    updates (#2049) (@dependabot[bot])
  - 758630a: Fix wrong end location of reported unresolved
    functions (#2053) (@anderseknert)
  - 9a74766: Fix wrong end location reported by
    rule-shadows-builtin (#2054) (@anderseknert)
  - 2bb3592: dap: Implement Evaluate feature (#2051)
    (@anderseknert)
  - 76ed1f0: Raise test timeout threshold to 3 seconds (#2058)
    (@anderseknert)
  - d7aaf8f: Use new inmem.NewFromASTObject to set up Regal store
    (#2056) (@anderseknert)
  - 98fc359: Add import future.keywords completion provider
    (#2055) (@anderseknert)
  - bcdaa1d: Various completion provider improvements (#2057)
    (@anderseknert)</changelog>
</package>
<package pkgid="9331725b8d80ec0bfdbeb9a4935c2ae5deb6f8cdde57a00e0883a6ffaedfd2e46f4c8b70e4194102f293fab6b192cb9aee1cad65c65478f7f2c61de1f0fce574" name="regal-zsh-completion" arch="noarch">
  <version epoch="0" ver="0.42.0" rel="11.2"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743163200">- new package regal: linter and language server for Rego, bringing
  your policy development experience to the next level</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1745496000">- Update to version 0.33.1:
  This release is the same tag as v0.33.1, please see that release
  for the release notes.
  Another v0.33.1 was released to trigger the rebuilding of some
  assets that were deleted in a draft release.
  * New Rule: in-wildcard-key
    Using a wildcard variable (_) for the key in the key-value form
    of iteration (some _, value in collection) is never needed, and
    can be replaced by the simple some value in … form . This rule
    flags cases where the key iteration is redundant. (Read more)
  * New Rule: confusing-alias
    While import aliases can improve readability, aliasing an
    import reference that is also imported without an alias is
    confusing, as both names point to the same resource. This rule
    catches such cases. (Read more)
  * New Rule: mixed-iteration
    Rego supports different styles of collection iteration. While
    "reference style" iteration (collection[_]) can be concise for
    deeply nested structures, mixing it with the some .. in style
    within a single iteration expression makes for code that’s more
    difficult to follow. This rule encourages consistency within a
    single iteration statement. (Read more)
  * New Rule: narrow-argument
    This new rule analyzes function arguments to suggest narrowing
    them down to the minimal value the function depends on. This
    can improve clarity and reusability. The rule considers
    incrementally defined functions across all their definitions.
    This is a powerful but opinionated rule and is thus in the
    custom category and is not on by default. See the documentation
    for how to enable it if you’re curious to try it out! (Read
    more)
  * Performance Improvements
    Several improvements have been made to reduce memory
    allocations and improve overall linting performance. Numbers
    below refer to Regal’s benchmark for linting its own policies.
  - Optimized config loading and parsing, saving around 2.7
    million allocations (#1491).
  - Reduced allocations by approximately 2 million (#1494).
  - Improved the performance of the use-strings-count rule,
    saving almost 1 million allocations (#1465).
  - Optimized reference comparisons and small iteration patterns,
    saving around 300k allocations (#1472).
  - Included performance enhancements alongside an update to the
    external-reference rule to make it more configurable (#1496).
  * OPA v1.3.0
    Regal has been upgraded to use OPA v1.3.0. This brings several
    upstream improvements, including support for the new one-liner
    grouping in formatting (see OPA#6760). (#1459)
  * Bug Fixes
  - Fixed a bug in the handling of Rego input from stdin. Thanks
    @tokyowizard for the report! (#1474)
  - Fixed a panic that could occur in FindConfigRoots when
    supplied with unexpected arguments. (#1487)
  * Other Rule Updates
  - The external-reference rule can now be configured with a
    maximum number of allowed external references, instead of
    solely flagging all external uses within a function. If you
    previously had this rule disabled, you might want to try
    enabling it now, and possibly tweak its configuration to your
    liking. (#1496)
  - The rule-length rule now has a separate setting
    (max-test-rule-length) with a higher default value (60 vs 30)
    for test rules, acknowledging that tests often include
    substantial data. (#1476)
  - Updated documentation for the rule-named-if rule based on
    community feedback received via the page feedback form
    (please let us know if you see issues! &amp; thanks for the
    report!) (#1463)
  * Dependencies
    This release also updates Regals dependencies as follows.
  - github.com/open-policy-agent/opa v1.2.0 -&gt; v1.3.0
  - github.com/prometheus/client_golang v1.21.0 -&gt; v1.21.1
  - go.opentelemetry.io/otel v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/metric v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/sdk v1.34.0 -&gt; v1.35.0
  - go.opentelemetry.io/otel/trace v1.34.0 -&gt; v1.35.0
  - golang.org/x/crypto v0.35.0 -&gt; v0.36.0
  - golang.org/x/net v0.36.0 -&gt; v0.38.0
  - golang.org/x/sync v0.11.0 -&gt; v0.12.0
  - golang.org/x/sys v0.30.0 -&gt; v0.31.0
  - golang.org/x/text v0.22.0 -&gt; v0.23.0
  - google.golang.org/protobuf v1.36.4 -&gt; v1.36.5
  * Changelog
  - automated: update capabilities by @github-actions in #1458
  - OPA 1.3.0 by @anderseknert in #1459
  - Parameterize some tests by @anderseknert in #1460
  - automated: update capabilities by @github-actions in #1461
  - build(deps): bump the dependencies group with 2 updates by
    @dependabot in #1462
  - docs: rule-named-if by @charlieegan3 in #1463
  - Some perf fixes by @anderseknert in #1465
  - Rule: in-wildcard-key by @anderseknert in #1466
  - Increase coverage by @anderseknert in #1467
  - build(deps): bump github/codeql-action from 3.28.13 to
    3.28.14 in the dependencies group by @dependabot in #1468
  - perf: various improvements by @anderseknert in #1472
  - Rule: confusing-alias by @anderseknert in #1470
  - Add benchmark for testing all rules individually by
    @anderseknert in #1469
  - Rule: mixed-iteration by @anderseknert in #1475
  - Add max-test-rule-length setting to rule-length rule by
    @anderseknert in #1476
  - fix: ensure policy from stdin is enumerated correctly by
    @anderseknert in #1474
  - automated: update capabilities by @github-actions in #1477
  - builtins.RegalIsFormatted: recover from formatter panics by
    @srenatus in #1481
  - automated: update capabilities by @github-actions in #1482
  - build(deps): bump github/codeql-action from 3.28.14 to
    3.28.15 in the dependencies group by @dependabot in #1484
  - Fix unnecessary-some rule not working after OPA 1.0+ by
    @anderseknert in #1485
  - FindConfigRoots: return error, not panic by @srenatus in
    [#1487]
  - perf: Improve how config is parsed, and when by @anderseknert
    in #1491
  - Rule: narrow-argument by @anderseknert in #1488
  - build(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 by
    @dependabot in #1490
  - build(deps): bump codecov/codecov-action from 5.4.0 to 5.4.2
    in the dependencies group by @dependabot in #1495
  - Make external-reference rule less annoying by @anderseknert
    in #1496
  - docs: fix docs that still used v0 syntax by @anderseknert in
    [#1494]</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1748692800">- Update to version 0.34.0:
  After a month of development, we're happy to announce Regal
  v0.34. This version of the OPA community's favorite linter and
  language server brings you new 3 linter rules, performance
  improvements and much more.
  With the v0.34.0 release, Regal now ships with more than 100
  linter rules!
  Which is pretty close to one new week per rule since the project
  started.
  * New rules
  - unresolved-reference
    This one is particularly exciting! The new
    unresolved-reference rule reports any references (like
    data.users.permissions) that cannot be resolved (i.e. found)
    anywhere in the project. Some projects will have valid
    references that can't be resolved at the time Regal lints the
    project, and the rule provides configuration options to mark
    certain references, or entire paths (like data.users.*) as
    resolved. See the docs for the rule for more details.
  - pointless-import
    Category: imports
    The new pointless-import rule will flags imports of the same
    package, and other import forms where the import has no real
    effect.
  - single-item-in
    Category: idiomatic
    The single-item-in rule reports cases of in being used on a
    single item collection, and suggests using an equality check
    instead.
  * Performance
  - Use OPA v1.5.0, which brings performance improvements to walk
    reducing linting time by about 10%.
  - Faster linting by avoiding walk in a few locations where
    possible.
  - Improve performance of aggregate rules.
  - Several performance optimizations to Regal's linter rules.
  * API
  - The linter API now has a new Prepare method that can be used
    to prepare the linter before reusing it across several runs.
  * Various
  - Some rules that would previously only scan the topmost level
    of a rule body will now recursively scan the whole rule.
  - The input completions provider has been rewritten in Rego
    (previously Go).
  - The automatic version check has been rewritten in Rego
    (previously Go).
  * Bugs
  - Fix false positive in custom one-liner-rule.
  * Docs
  - Updated roadmap. Go check it out!
  - Move rules table from README and into a more interactive form
    on the Styra docs. Take a look!
  - Add link to Renovating Rego blog.
  - README: add link to KubeCon London talk, which prominently
    featured Regal.
  - Update links to adapt to OPA's new documentation.
  - Update outdated information in README.
  * Dependencies
  - build(deps): bump the dependencies group with 2 updates
    (#1551)
  - build(deps): bump the dependencies group with 2 updates
    (#1544)
  - build(deps): bump the dependencies group with 2 updates
    (#1521)
  - build(deps): bump github/codeql-action in the dependencies
    group (#1507)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1749038400">- Update to version 0.34.1:
  This patch release fixes a bug found since v0.34.0 as well as it
  bumps the OPA dependency to the v1.5.1 patch also released today.
  While Regal's own policies were not affected by the regression in
  walk, custom linter rules could very well be.
  * Highlights
  - OPA v1.5.0 -&gt; v1.5.1
  - Go 1.23 -&gt; 1.24
  - Fix false positive in sprintf-arguments-mismatch when the
    %-*s pattern was used for padding.
  * Changelog
  - OPA v1.5.1 and some perf tweaks (#1580)
  - docs: Update typo in link (#1581)
  - deps: Revert 47c70f0 tablewriter changes (#1579)
  - docs: Update to allow better regal docs generation (#1578)
  - [create-pull-request] automated change (#1577)
  - fix: consider padding pattern in sprintf-arguments-mismatch
    (#1575)
  - build(deps): bump ossf/scorecard-action in the dependencies
    group (#1576)
  - Fix deprecated notices in .goreleaser.yaml (#1570)
  - Go 1.23 -&gt; 1.24 (#1573)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1751371200">- Update to version 0.35.1 (0.35.0 was not released):
  We're happy to release v0.35.1, the mid-summer release of Regal
  for the 🏖️ ! This release updates to OPA v1.6.0 bringing a number
  of performance improvements as well as other improvements and bug
  fixes.
  * Improved Schema Loading This PR replaces Regal's custom schema
    loader with one that matches OPA's behavior, enabling the same
    schemas to work across opa check, opa eval, and other OPA
    commands. PR #1605
  * Performance Improvements
  - Thanks to a PR in OPA, Regal's memory use is now much reduced
    due to a change conditionally supplying built-in contexts
    only when needed.
  - This PR optimizes Rego evaluation by directly mapping source
    data to ast.Value objects instead of going through
    intermediate map[string]any or JSON representations,
    eliminating ~2.9 million allocations in benchmarks. PR #1606
  - Regal contributors will be happy with
    open-policy-agent/opa#7442 which makes running Regal's tests
    around 2.5x as fast!
  * Code Actions Rewrite
  - Code actions are LSP features that provide automated fixes or
    refactoring suggestions (like "quick fix" options), and this
    PR implements them for Regal with server-side filtering to
    reduce data transfer and ensure consistent editor behavior.
    This is also now implemented in Rego! PR #1604
  * Docs
  - PR #1584 refactors a number of Regal's pages including
    breaking down the previously large README into separate
    files. Browse the new structure on the Regal Website.
  - The Code Lens documentation has been updated to better
    explain supported configurations. Thanks @Shinzu for the
    report here. #1596
  * Changelog
  - 92d1ba9: deps: Update OPA to v1.6.0 (#1617) (@charlieegan3)
  - 2bbe76e: [create-pull-request] automated change (#1582)
    (@github-actions[bot])
  - 6e5e6bb: e2e: add frankenstein test build (@srenatus)
  - 5bf607d: build(deps): bump github/codeql-action in the
    dependencies group (#1585) (@dependabot[bot])
  - 6f45a9f: build(deps): bump brace-expansion from 2.0.1 to
    2.0.2 in /build (#1587) (@dependabot[bot])
  - e85b878: docs: Update config cli docs (#1584) (@charlieegan3)
  - 30c73fe: build(deps): bump github/codeql-action in the
    dependencies group (#1595) (@dependabot[bot])
  - b8f3e8f: fix: improve snippets suggestion condition (#1597)
    (@anderseknert)
  - eb48984: Fix issue with handling big numbers (#1599)
    (@anderseknert)
  - 1ee1cf4: fix: Correct end location in unresolved-reference
    (#1600) (@anderseknert)
  - e50c9af: Bump Roast -&gt; v0.12.0 (#1601) (@anderseknert)
  - 981d8d2: docs: Update Evaluation Code Lens docs (#1602)
    (@charlieegan3)
  - 3577efe: lsp/completion/input: don't suggest 'input'
    following dot (#1603) (@srenatus)
  - 02d1546: lsp: Code Action feature rewritten in Rego (#1604)
    (@anderseknert)
  - 25b1072: More robust loading of schemas (#1605)
    (@anderseknert)
  - 112dc87: perf: avoid JSON/map roundtrips in ast.Value
    transforms (#1606) (@anderseknert)
  - d87fd2f: docs: Tone down "obsolete" description for
    use-rego-v1 (#1610) (@anderseknert)
  - a939219: lsp: Roll over load file failures (#1611)
    (@charlieegan3)
  - 1d771ca: interning: bump opa+roast, replace call to
    ast.InternedBoolTerm() (#1613) (@srenatus)
  - ed0ead4: build(deps): bump
    github.com/go-viper/mapstructure/v2 in /e2e/testbuild (#1615)
    (@dependabot[bot])
  - 0d65ef0: build(deps): bump
    github.com/go-viper/mapstructure/v2 (#1614)
    (@dependabot[bot])</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1757851200">- Update to version 0.36.1 (0.36.0 was not released):
  This is Regal v0.36! The first Regal release since becoming a
  part of the OPA project last month. This release mostly delivers
  a number of new language server features as well as wider
  improvements under the hood and to the developer experience.
  * A note about Regal's documentation
    Our documentation is now displayed as part of the main OPA
    website!
    https://www.openpolicyagent.org/projects/regal
    From this release, links generated from Regal in output to
    rules will point to this location. You might find links to the
    old location as we get things updated. Please feel free to open
    any issues for link problems you find just so we don't miss
    anything.
  * Get contextual documentation when calling built-in functions
  - Following PR #1654, the Regal language server will now offer
    signatureHelp to compatible clients. This shows the current
    argument type and description in the help text for built-in
    functions. This is in addition to the other general function
    documentation displayed here.
  * Quickly see related fields in when editing METADATA
  - PR #1657 implements support for the documentHighlight request
    from clients. This is currently only used to show signal
    other related METADATA keys when working with Rego metadata.
    In future, this same functionality could be used to highlight
    other related items currently in the viewport.
  * Jump directly from ignore directives to documentation
  - documentLink is another request from clients which allow the
    server to respond with link ranges. We have used this to make
    regal ignore directives clickable, helping users quickly
    learn what they mean when encountered in policies PR #1657.
  * Get live diagnostics from custom rules as you type
  - PR #1631 ensures that users of custom linter rules are also
    able to access these for live diagnostics in language server
    clients. Previously these were not evaluated in the server,
    only in the Regal CLI.
  * Notable Refactors &amp; Development Changes
  - Rego Language Server Routing: PR #1675 makes some notable
    changes to how Rego is used within the Regal’s language
    server. The Language Server Protocol (LSP), which Regal
    implements to support LSP clients, is based on JSON message
    passing. This lends itself to Rego evaluation which is JSON
    in, JSON out. This PR updates the handling of different LSP
    messages sent from clients to route them in Rego, handling
    Rego backed rules first, and falling back to Golang
    implementations that still remain otherwise. This sets the
    direction for more Rego LSP functionality in the language
    server in future.
  - Development bundle loading from disk: PR #1646 gives those
    working on Regal in development the option of using the
    current source for the Regal bundle without rebuilding the
    binary. This improves the experience when working on Rego
    based language server functionality by reducing the time of a
    feedback loop. Set REGAL_BUNDLE_PATH to use this feature.
  * Changelog
  - 1f1044f: build: Remove tap key (#1687) (@charlieegan3)
  - build(deps): bump github/codeql-action from 3.29.0 to 3.29.1
    in the dependencies group by @dependabot[bot] in #1616
  - Add Regal bundle compilation benchmark by @anderseknert in
    [#1618]
  - Remove quotes from keywords in refs by @anderseknert in #1619
  - lsp: Skip loading files on disk when in cache by
    @charlieegan3 in #1620
  - build(deps): bump the dependencies group with 2 updates by
    @dependabot[bot] in #1621
  - automated: update capabilities by @github-actions[bot] in
    [#1622]
  - add experimental lsp package for websocket communication by
    @srenatus in #1623
  - internal/io: add FindInputPath when the content isn't needed
    by @srenatus in #1624
  - build(deps): bump github/codeql-action from 3.29.2 to 3.29.3
    in the dependencies group by @dependabot[bot] in #1626
  - lsp/completions: Handle hyphenated package names by
    @charlieegan3 in #1625
  - lsp: fix didOpen templating race by @charlieegan3 in #1627
  - build/lsp: add web client demo by @srenatus in #1629
  - lsp: Fix stale diagnostics after deletion by @charlieegan3 in
    [#1628]
  - Some doc updates by @anderseknert in #1632
  - lsp: Add support for custom rules by @charlieegan3 in #1631
  - Vendor roast dependency by @anderseknert in #1634
  - lsp: Address windows goto definition URI issue by
    @charlieegan3 in #1633
  - Fix regal new rule issues + refactor io code by @anderseknert
    in #1636
  - lsp: Use full text replacement for Intellij fmt by
    @charlieegan3 in #1637
  - test: refactor e2e test, add new regal command runner by
    @anderseknert in #1640
  - build(deps): bump github/codeql-action from 3.29.3 to 3.29.5
    in the dependencies group by @dependabot[bot] in #1641
  - Fix missing source.explore code action by @anderseknert in
    [#1643]
  - lsp: Present filename relative to root in errors by
    @charlieegan3 in #1638
  - refactor: Improve code quality throughout the codebase by
    @anderseknert in #1642
  - lsp/uri: Refactor URI handling by @charlieegan3 in #1644
  - Tidying up more code by @anderseknert in #1645
  - Provide development option to load bundle from disk by
    @anderseknert in #1646
  - lsp/eval: Ensure filenames use URI in print output by
    @charlieegan3 in #1647
  - Rewrite more completion providers in Rego. Resolve schemas at
    runtime. by @anderseknert in #1652
  - lsp: Add signature help by @charlieegan3 in #1654
  - lsp: Fix server signature race in test by @charlieegan3 in
    [#1655]
  - build(deps): bump the dependencies group with 5 updates by
    @dependabot[bot] in #1639
  - build(deps): bump the dependencies group with 3 updates by
    @dependabot[bot] in #1653
  - docs: update README badges for OPA 1.7.1 release by
    @charlieegan3 in #1656
  - New LSP features and internal improvements by @anderseknert
    in #1657
  - lsp/documenthighlight: Add tests by @charlieegan3 in #1659
  - Add tests for textDocument/documentLink handler by
    @anderseknert in #1658
  - Styra URLs -&gt; OPA URLs by @anderseknert in #1662
  - docs: Update README re: move to open-policy-agent by
    @charlieegan3 in #1664
  - internal/io: explicitly disable lazy loading of regal bundle
    by @srenatus in #1666
  - build(deps): bump the dependencies group across 1 directory
    with 4 updates by @dependabot[bot] in #1663
  - Enable pprof endpoint only with env var set by @anderseknert
    in #1667
  - docs: Remove update workflow &amp; minor adjustments by
    @charlieegan3 in #1668
  - Disable Codecov PR comments by @anderseknert in #1670
  - deps: OPA v1.8.0 by @anderseknert in #1669
  - docs: Changes needed in docs for opa site deploy by
    @charlieegan3 in #1673
  - build(deps): bump github/codeql-action from 3.29.11 to 3.30.0
    in the dependencies group by @dependabot[bot] in #1674
  - Rego-based routing of Rego handlers + refactor by
    @anderseknert in #1675
  - Just one more.. refactor by @anderseknert in #1677
  - docs: Updates in preparation for OPA site deploy by
    @charlieegan3 in #1676
  - lsp: GTD use URI for location by @charlieegan3 in #1680
  - fix: Don't use OS path separator when walking FS by
    @anderseknert in #1681
  - build(deps): bump the dependencies group with 3 updates by
    @dependabot[bot] in #1678
  - build: Add windows runners to build workflow by @charlieegan3
    in #1682
  - Weekend refactor by @anderseknert in #1684
  - Fix documentLink issue when no user config provided by
    @anderseknert in #1686
  - build: Remove tap key by @charlieegan3 in #1687</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762516800">- Update to version 0.37.0:
  This release features a new linter rule, several new language
  server features, and many improvements and fixes. The two major
  OPA versions bumped since the last release additionally contains
  several performance improvements that were contributed as part of
  developing Regal!
  * New Rule: prefer-equals-comparison
    The prefer-equals-comparison linter rule recommends using the
    == operator for equality comparison over the unification
    operator =. The rule helps improve code clarity by using
    operators for their intended purposes: := for assignment, ==
    for equality comparison, and = for unification. The linter
    identifies when = is used for comparison by checking if both
    sides of the operator are "unassignable".
    Avoid
    input.request.method = "GET"
    Prefer
    input.request.method == "GET"
    There are some certainly valid use cases for the unification
    operator! But simple equality comparison is not one. For more
    information, see the documentation for the rule. As an amusing
    aside, this fixes one of the first issues created in the
    project!
  * Language server: Document highlighting to help show where
    function args are referenced
    Document highlighting is one of the more subtle features of the
    LSP specification, but a really helpful one when implemented
    well. The experimental first implementation that shipped with
    Regal v0.36.0 is no longer experimental, and has also been
    extended to highlight usage of function argument variables
    inside of a function head or body.
    (Please find the screencast in the release notes)
  * Language server: Selection ranges
    Selection ranges provide smart selection of code that can
    expand and shrink based on knowledge of the code rather than
    simple text properties, like hyphens or whitespace. This makes
    moving code around extremely fast, and without leaving the
    keyboard. Consult the language server docs for how to enable
    this in your editor
    (Please find the screencast in the release notes)
  * Improvements
  - The pointless-reassignment rule would previously only flag
    reassignment at the top level of a rule body. Now it flags
    pointless reassignments also in nested bodies, like
    comprehensions, every statements, and so on.
  - All completion providers are now implemented purely in Rego
  - Remove the go-semver dependency in favor of a custom, much
    faster implementation
  - Build: Reduce permissions granted in update-caps top-level
    workflow, by @timothyklee
  - Docs: Update language server page to demonstrate recently
    added features
  - Docs: Add kakoune LSP configuration example
  * Windows compatibility improvements
    In this release we have fixed various Windows bugs (Language
    Server Init, Goto Definition, Error Popups) in #1740, #1737,
    [#1736], following #1633, and #1642 last release.
    These fixes have also made it possible to run our test suites
    on Windows runners to catch issues sooner in future. A huge
    thanks to @charlieegan3 for his tireless work on this!
  * Bugs fixed
  - Fix false positive in use-some-for-output-vars triggered by
    nested variables in rule ref heads, like rule[input[i]].allow
    if ....
  - Fix false positive in redundant-existence-check when a not
    check made an existence check necessary, reported by @gusega
  - Fix false positive in narrow-argument rule, which would
    incorrectly flag some arrays passed as arguments
  - Ensure that the language server InitOptions is never nil and
    don't cause issues with clients that don't provide those
  * Dependency Updates:
  - github.com/open-policy-agent/opa: v1.8.0 → v1.10.1
  - github.com/arl/statsviz: v0.7.1 → v0.7.2
  - github.com/go-git/go-git/v5: v5.16.2 → v5.16.3
  - github.com/olekukonko/tablewriter: v0.0.5 → v1.1.0
  - github.com/spf13/cobra: v1.9.1 → v1.10.1
  - github.com/spf13/pflag: v1.0.7 → v1.0.10
  - Removed: github.com/coreos/go-semver: v0.3.1
  * Changelog
  - 244459c: docs: Remove some old references (#1689)
    (@anderseknert)
  - 4212b5c: build(deps): bump the dependencies group with 2
    updates (#1690) (@dependabot[bot])
  - e149c6d: build: reduce update-caps top-level workflow
    permission to read (#1691) (@timothyklee)
  - 819bbec: lsp: Fix missing initial root (#1692)
    (@charlieegan3)
  - be8b020: docs: Update style guide links to new repo (#1693)
    (@charlieegan3)
  - ceb890b: Builtin function completion in Rego (#1694)
    (@anderseknert)
  - d36555e: Package ref import suggestions in Rego (#1698)
    (@anderseknert)
  - 4e44131: build(deps): bump the dependencies group with 2
    updates (#1703) (@dependabot[bot])
  - 14166e9: Avoid multi-line highlighting of issues (#1702)
    (@anderseknert)
  - 1685bb8: Move completion handler into Rego router (#1699)
    (@anderseknert)
  - 0da5eaa: build(deps): bump the dependencies group with 2
    updates (#1708) (@dependabot[bot])
  - e792757: Bump OPA -&gt; v1.9.0, golangci-lint 2.5.0 (#1709)
    (@anderseknert)
  - 3092d1d: docs: Address some broken links from OPA report
    (#1704) (@charlieegan3)
  - bebfd06: util: use Partial2 for IsAnyError (@srenatus)
  - f22a570: Fix false positive in redundant-existence-check
    (#1716) (@anderseknert)
  - 2703715: Various fixes (#1715) (@anderseknert)
  - 87981f2: build(deps): bump the dependencies group with 2
    updates (#1713) (@dependabot[bot])
  - a6487b6: lsp: document highlighting supporting function args
    (#1718) (@anderseknert)
  - fe8cbd3: Rule: prefer-equals-comparison (#1726)
    (@anderseknert)
  - f3722ea: Fix false positive in narrow-argument (#1724)
    (@anderseknert)
  - 73b8c65: Improve pointless-reassignment to cover nested cases
    (#1727) (@anderseknert)
  - 9cf180c: lsp: Implement selection ranges and linked editing
    range (#1722) (@anderseknert)
  - bf632d0: build(deps): bump the dependencies group with 2
    updates (#1725) (@dependabot[bot])
  - a373ae3: lsp: Use filename path for current buffer for defns
    (#1732) (@charlieegan3)
  - d758eaf: lsp: Refactor range utilities (#1729)
    (@anderseknert)
  - 13de8a9: Fix incorrect behavior in pointless-import (#1733)
    (@anderseknert)
  - fb560c1: Fix false positive in use-some-for-output-vars
    (#1731) (@anderseknert)
  - 70449b7: Various small fixes (#1736) (@anderseknert)
  - 2594719: windows: Better use of slash paths (#1737)
    (@charlieegan3)
  - 499125f: Get FindClosestMatchingRoot working on windows
    (#1740) (@charlieegan3)
  - 3715085: OPA v1.10.0 (#1742) (@anderseknert)
  - 781f809: deps: stick to
    github.com/vektah/gqlparser/v2@v2.5.30 (#1744) (@srenatus)
  - bbb03db: Use generic client identifier in tests (#1741)
    (@charlieegan3)
  - c42ce08: build(deps): bump github/codeql-action in the
    dependencies group (#1745) (@dependabot[bot])
  - 4384b0d: Remove go-semver dependency, plus various fixes
    (#1746) (@anderseknert)
  - 97dfbd4: docs: update LSP page to show new features (#1748)
    (@charlieegan3)
  - 818b33a: docs: Minor fixes to docs typos and links (#1747)
    (@charlieegan3)
  - 4138270: Update to OPA v1.10.1 (@charlieegan3)
  - 55cf029: lsp: ensure that InitOptions is never nil (#1752)
    (@srenatus)
  - 8ffa270: docs: add kakoune LSP config snippet (#1751)
    (@srenatus)
  - 216341a: reporter,lsp: update URLs for help links (#1750)
    (@srenatus)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 0.38.0:
  * Feature: String Interpolation Support
    v0.38.0 of your favorite Rego linter, debugger and language
    server brings full support for OPA's new string interpolation
    feature. This means not only that Regal lints code found inside
    interpolated strings, but that you'll have access to all your
    favorite language server features within them too — like code
    completions, tooltips on hover, or document highlighting. You
    can even use the debugger to step through interpolated
    expressions! If you haven't yet tried it out, grab OPA v1.12.2,
    Regal v0.38.0 and enjoy an absolutely awesome addition to the
    Rego language!
    In addition to this, we have a number of fun new features and
    performance improvements.
  * New Rule: disallow-rego-v1
    Category: custom
    This optional new rule flags the use of import rego.v1 in Rego
    policies (#1778). Since OPA v1.0 (December 2024), this import
    is a no-op and no longer needed. The rule helps users maintain
    clean code by preventing this outdated import from appearing in
    new policies. Teams standardizing on OPA 1.0+ can enable this
    rule to enforce modern Rego standards.
    package example
    import rego.v1 # &lt;-- Happy 2026! Time to stop doing this!
  * New Fixers
    @SeanLedford has also done some great work to help expand
    Regal's auto-fixing capabilities by having regal fixers added
    for three more rules.
  - prefer-equals-comparison
  - redundant-existence-check
  - constant-condition
    See (#1790) and (#1794) for more details.
  * Performance
    The fixer saw a 12% performance improvement by reusing the
    linter, reducing allocations from 2.3M to 2.0M operations
    (#1783). Additional optimizations include:
  - faster file filtering by avoiding recompiled ignore patterns
    (#1758),
  - better built-in function handling by registering Regal's
    functions globally only once (#1788),
  - and more efficient AST location serialization (#1758)
    To track ongoing performance work, a new post-merge
    benchmark-recording workflow was added (#1793).
  * LSP: New Ignore Code Action
    The language server now supports a code action to quickly add
    regal ignore configuration for specific rules directly from the
    editor (#1777).
  * Changelog
  - ac35695: Various performance improvements (#1758)
    (@anderseknert)
  - 48cd03d: docs: Add custom head for regal index page (#1761)
    (@charlieegan3)
  - 728ae28: build(deps): bump golangci/golangci-lint-action
    (#1762) (@dependabot[bot])
  - 92cf6ca: explorer: allow hiding stages without an effect
    (+misc) (#1760) (@srenatus)
  - c000994: docs: Correct sidebar labels (#1763) (@charlieegan3)
  - bf0b621: build(deps): bump
    github.com/containerd/containerd/v2 in /e2e/testbuild (#1753)
    (@dependabot[bot])
  - 18e7a89: build(deps): bump
    github.com/containerd/containerd/v2 (#1754)
    (@dependabot[bot])
  - ccab7bd: Rename: encoding/util -&gt; encoding/write (#1764)
    (@anderseknert)
  - 54f7625: build: run windows in matrix with other jobs (#1770)
    (@charlieegan3)
  - 5c9e6f0: update: Update version checking logic (#1772)
    (@charlieegan3)
  - 5034776: build: Add badge update to readme script (#1773)
    (@charlieegan3)
  - 95e8220: Added OPA installation as a Regal prerequisite, and
    fixed golangci-lint link. (#1774) (@SeanLedford)
  - 149f71d: build(deps): bump js-yaml from 4.1.0 to 4.1.1 in
    /build (#1775) (@dependabot[bot])
  - b8f8b7f: Enable more golangci-lint linters (@anderseknert)
  - e092627: build: Update mac runner (@charlieegan3)
  - 877884c: lsp: Add code action and command to ignore rule
    (#1777) (@charlieegan3)
  - ece9ca2: build(deps): bump the dependencies group with 5
    updates (@dependabot[bot])
  - bd37bbd: build(deps): bump golang.org/x/crypto in /build/lsp
    (@dependabot[bot])
  - 17cc429: build(deps): bump golang.org/x/crypto in
    /e2e/testbuild (@dependabot[bot])
  - 415b05f: build(deps): bump golang.org/x/crypto from 0.43.0 to
    0.45.0 (@dependabot[bot])
  - e1bb975: Improve fixer performance (@anderseknert)
  - 1b083ff: Added Rule: Disallow import rego.v1 (#1778)
    (@SeanLedford)
  - 9e43c50: Optimize and improve code for built-in functions
    (@anderseknert)
  - 64ce2aa: build(deps): bump glob and markdownlint-cli in
    /build (#1779) (@dependabot[bot])
  - 48fddeb: build(deps): bump github/codeql-action in the
    dependencies group (#1787) (@dependabot[bot])
  - bc41f63: pkg/linter: use errgroup, set limits + context on it
    (@srenatus)
  - f22c2aa: Add fixer for prefer-equals-comparison rule (#1790)
    (@SeanLedford)
  - cf88eb9: Fixers for redundant-existence-check and
    constant-condition rules (#1794) (@SeanLedford)
  - 36401a2: build(deps): bump the dependencies group across 1
    directory with 7 updates (#1796) (@dependabot[bot])
  - ecb23d3: version: Add OPA version to version output (#1798)
    (@charlieegan3)
  - 94ce038: build(deps): bump golang.org/x/crypto from 0.43.0 to
    0.45.0 in /build/ws (#1791) (@dependabot[bot])
  - 9ce1ddd: workflows: add post-merge benchmark-recording
    workflow (@srenatus)
  - e111443: workflows/benchmark: fix golang setup (@srenatus)
  - 4bb2d5a: docs: Update messy rule docs (@charlieegan3)
  - dec83ea: docs: Updates from opa website link scanner
    (@charlieegan3)
  - 8f544a6: fix typo in fix.go help message (#1807) (@gusega)
  - 941b02e: build(deps): bump the dependencies group with 3
    updates (#1804) (@dependabot[bot])
  - 9f09e6e: build(deps): bump the dependencies group with 4
    updates (#1808) (@dependabot[bot])
  - 476ef89: OPA v1.12.2 and full string interpolation support
    (#1811) (@anderseknert)
  - a9843ab: Move chained-rule-body to custom category (#1812)
    (@anderseknert)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768392000">- Update to version 0.38.1:
  This patch release fixes several bugs including some found in the
  recent v0.38.0 release, as well some other improvements.
  * Bug Fixes
  - Fix for prefer-equals-comparison fixer failing to parse
    policies with multiple "=" in expressions (#1824, fixes #1818
    reported by @gusega)
  - Fix for incorrect fixable violation count display in lint
    output (#1825, fixes #1813 reported by @gusega)
  - Fix for false positive in prefer-equals-comparison rule with
    comprehension term vars (#1828, fixes #1826 reported by
    @SeanLedford)
  - bundle: Surface configured rule notices as messages in lint
    output (#1827, fixes #1795 reported by @ghmer)
  * Improvements
  - Code action for prefer-equals-comparison fixer now available
    in the language server (#1810)
  - New option for prefer-value-in-head rule to count
    interpolated strings as scalars (#1817)
  - Minor performance improvement for any_set_item, used for
    selecting items from sets (#1815)
  * Changelog
  - f1c5f74: bundle: Improve performance of any_set_item (#1815)
    (@charlieegan3)
  - 9300420: Implemented Code action for prefer-equals-comparison
    fixer (#1810) (@SeanLedford)
  - 28121f0: build(deps): bump github/codeql-action in the
    dependencies group (#1823) (@dependabot[bot])
  - 54cdcb6: Add prefer-value-in-head option to count
    interpolated string as scalar (#1817) (@anderseknert)
  - e68184d: Fix false positivie in prefer-equals-comparison
    (#1828) (@anderseknert)
  - 593e221: fix: Prefer-Equals-Comparison Edge Case With
    Multiple "=" (#1824) (@SeanLedford)
  - 3dc28bb: bundle: Surface configured rule notices (#1827)
    (@charlieegan3)
  - aac9618: Updated lint reporter to track fixable violation
    count separate from fixable violation Set (#1825)
    (@SeanLedford)
  - fd6dd4d: Updated example for prefer-equals-comparison edge
    case to not include false positive (#1829) (@SeanLedford)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772193600">- Update to version 0.39.0:
  We're happy to announce Regal v0.39.0, featuring 3 new linter
  rules, many language server improvements, and much faster
  linting!
  * New Rule: use-array-flatten
    Category: idiomatic
    The use-array-flatten rule recommends using array.flatten
    instead of nested array.concatenation (#1873).
    Avoid
    package policy
    flat1 := array.concat(arr1, array.concat(arr2, arr3))
    flat2 := array.concat(arr1, array.concat(arr2, array.concat(arr3, arr4)))
    Prefer
    package policy
    flat1 := array.flatten([arr1, arr2, arr3])
    flat2 := array.flatten([arr1, arr2, arr3, arr4])
  * New Rule: use-object-union-n
    Category: idiomatic
    The use-object-union-n rule recommends using object.union_n
    over nested calls to object.union (#1873).
    Avoid
    package policy
    obj := object.union(obj1, object.union(obj2, obj3))
    Prefer
    package policy
    obj := object.union_n([obj1, obj2, obj3])
  * New Rule: equals-over-count
    Category: performance
    The new optional equals-over-count rule suggests using direct
    equality comparisons rather than count when checking collection
    membership or emptiness (#1878). This is a micro-optimization
    and not a general recommendation. Must be manually enabled.
  * Performance
    This release brings an approximate 25% reduction in linting
    time through aggregate remodeling and Rego prepare stage
    optimizations (#1838). Additional performance work includes
    Rego refactoring (#1857, #1884), AST transform improvements
    (#1892), and various micro-optimizations (#1866, #1879).
  * Language Server Improvements
    The language server now includes a semantic token framework for
    improved syntax highlighting (#1845, #1865, #1870), code
    actions for the constant-condition and
    redundant-existence-check fixers (#1830).  and an
    opaTestProvider feature for test discovery (#1888, #1889,
    [#1898]),
    Completion performance is improved with a
    completionItem/resolve handler (#1831), and server capabilities
    are now properly exposed and consistent with the clients
    (#1867, #1880).
    Note: Semantic token support is feature flagged and will be
    available in the next release.
  * Compiler Explorer
    Regal now supports the VSCode-based OPA Explorer extension,
    providing a rich GUI to compare compiler stages directly in VS
    Code (#1862) - thanks @srenatus! A new "Format stages" option
    has also been added to the compiler explorer (#1854) - thanks
    @johanfylling!
  * Experimental: rq Engine Support
    Initial support for the rq engine has been added (#1872)
  * Various Improvements
  - Improved redundant-existence-check rule (#1897, fixes #1805)
  - Disabled zero-arity-function rule as opa-fmt now covers that
    (#1885)
  * Bug Fixes
  - Fix nil dereference on compiler errors in explorer (#1837)
  - Fix broken links to fixer page (#1852)
  - Fix false positive in use-some-for-output-vars (#1886)
  - Fix broken input.json completion provider (#1891)
  * Dependency Updates
  - Regal has been upgraded to use OPA v1.14.0 and Go 1.26.
  * Documentation
  - Added mise as an alternative installation method (#1849)
  - Updated installation documentation (#1861)
  - Updated note about eval and debug roots (#1894)
  - Show release badge when using pre-release versions (#1899)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776772800">- Update to version 0.40.0:
  Today we celebrate Regal who turns v0.40.0 just in time for the
  GitHub download tracker to report 1 million total downloads.
  Quite the milestone! Thank you all for the encouragement, support
  and contributions during these past 3 years. Together we're
  redefining the policy development experience, and we have a lot
  more of that planned for the future. Stay tuned!
  This release includes 2 new linter rules, and many new features
  and improvements to both the linter and language server.
  * Linter
  - New Rule: invalid-regexp
    Category: bugs
    The new invalid-regexp rule scans regular expressions found
    in policies and reports invalid patterns that would otherwise
    fail at runtime.
    Avoid
    package policy
    invalid if regexp.match("[a-z", "test")
    Prefer
    package policy
    valid if regexp.match("[a-z]", "test")
  - New Rule: superflous-object-get
    Category: idiomatic
    The superflous-object-get rule flags calls to object.get
    where using the built-in function provides no benefit
    compared to using a reference directly, and without the call.
    Avoid
    package policy
    superfluous if {
    [#] the default value (`""`) isn't used in the expression,
    [#] so object.get provides no benefit here
    object.get(input, ["user", "department"], "") == "engineering"
    }
    Prefer
    package policy
    much_better if {
    input.user.department == "engineering"
    }
    More cases of superfluous object.get will be added to this
    rule as we encounter them.
  * Improvements
  - The naming-convention rule now accepts a list of allowed
    names in addition to regex patterns
  - The non-loop-expression rule now identifies more types of
    expressions that could be moved out of iteration
  - All rules now contain a related_resources item in their
    metadata pointing to the docs for the rule
  - The regal new rule command now generates a Related Resources
    section in the new rule's documentation template
  * Bugs Fixed
  - Fixed two false positives reported in the non-loop-expression
    rule
  - The server now exits with an error if the --profile flag is
    used without --format json (thanks @mvanhorn!)
  * Language Server
  * Evaluate and Debug Actions
    Any input.json or input.yaml file found in the workspace will
    be used for input during evaluation and debugging sessions,
    but this wasn't obvious without reading the docs. The
    Evaluate and Debug code lenses / commands will now present a
    dialog option asking to create an input.json file in the
    project workspace in case one isn't found. This file is
    populated with dummy JSON data based on references to input
    found in the policy, and should be edited by the user to
    provide more relevant data.
  * Hover Provider Improvements
    The hover provider showing tooltips for built-in functions
    and keywords has been rewritten in Rego, and additionally saw
    a few improvements land as part of that process:
  - Links to examples for built-in functions now point to the
    correct location in the OPA docs
  - The print function now shows up in hover results as well
  - Hover provider now less resource intensive, and all
    information rendered just in time for display
  * Inlay Hints Improvements
    The inlay hint provider (that provides names of function
    arguments to be displayed at call sites) has also been
    rewritten in Rego, and the server now implements also the
    inlayHint/resolve handler, which improves performance by only
    calculating inlay hint details when the client requests them
    for display.
    Additionally, the inlay hint provider now properly takes the
    range of the active editor view into account, and will only
    spend resources calculating hints for code that the user can
    actually can see.
  * Semantic Tokens in Comprehensions and every Expressions
    The language server's semantic token provider (providing
    context-based syntax highlighting) now provides semantic
    tokens inside of comprehensions and every expressions in
    addition to previously supported contexts. Additionally, most
    of the semantic token logic is now implemented entirely in
    Rego.
  * Improved Language Server Initialization
    This release contains a number of fixes and improvements
    related to the language server's initialization routine,
    which should now be both more robust and faster.
  * Bugs Fixed
  - Two potential nil dereferences identified and fixed
  - Fix a potential out of bounds panic in slice access
  - The bundled web server now shows a link to Regal's editor
    integration documentation on its index page
  * Finally
    Extra thanks goes out to @charlieegan3 this release, who worked
    tirelessly to fix some really complex race conditions and
    concurrency issues in the language server. A thankless job, but
    extremely important, and he pulled it off like a true Viking!
  * Changelog
  - 691afe1: Replace some Styra references (#1904)
    (@anderseknert)
  - 975ae72: build(deps): bump github.com/go-git/go-git/v5 in the
    dependencies group (#1903) (@dependabot[bot])
  - c85d88f: build(deps): bump go.opentelemetry.io/otel/sdk in
    /build/lsp (#1906) (@dependabot[bot])
  - 5ff449b: build(deps): bump the dependencies group with 3
    updates (#1907) (@dependabot[bot])
  - 9900522: lsp: Wait for client to send initialized at boot
    (#1909) (@charlieegan3)
  - d661b5a: build(deps): bump github/codeql-action in the
    dependencies group (#1912) (@dependabot[bot])
  - fd85e2d: Allow naming-convention rule to take list of names
    (not only a pattern) (#1911) (@anderseknert)
  - 299d3fc: Semantic Token Support for Comprehensions and
    Constructs (#1883) (@SeanLedford)
  - 422a9ef: build(deps): bump github/codeql-action in the
    dependencies group (#1915) (@dependabot[bot])
  - 02a9dc8: Fail with error when --profile used without JSON
    format (#1918) (@mvanhorn)
  - 1716e13: lsp/webserver: Add links to the index page (#1914)
    (@charlieegan3)
  - 1ab360f: lsp/testing: Nested test implementation (#1913)
    (@charlieegan3)
  - 53e5bf2: build(deps): bump google.golang.org/grpc in
    /e2e/testbuild (#1916) (@dependabot[bot])
  - 45841bf: build(deps): bump smol-toml and markdownlint-cli in
    /build (#1919) (@dependabot[bot])
  - 371bf1f: build(deps): bump picomatch from 4.0.3 to 4.0.4 in
    /build (#1920) (@dependabot[bot])
  - 62852fc: build(deps): bump the dependencies group across 1
    directory with 4 updates (#1921) (@dependabot[bot])
  - d32408d: build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#1922) (@dependabot[bot])
  - 8b9bcf0: build(deps): bump github.com/go-git/go-git/v5 from
    5.17.0 to 5.17.1 (#1923) (@dependabot[bot])
  - f2251f2: [create-pull-request] automated change (#1908)
    (@github-actions[bot])
  - 820d3f0: OPA v1.15.1 (#1925) (@anderseknert)
  - a155b62: Add popup prompt for creating input.json if it
    doesnt exist when Evaluate is run (#1929) (@SeanLedford)
  - 27067af: build(deps): bump the dependencies group with 2
    updates (#1931) (@dependabot[bot])
  - 2179ae4: Fix non-loop-expression false positives (#1930)
    (@anderseknert)
  - 33282ba: Rule: superflous-object-get (#1932) (@anderseknert)
  - 6fd115a: Include rule docs links in metadata (#1935)
    (@anderseknert)
  - 6a364fb: Fix aggregate test loop initialization (#1936)
    (@charlieegan3)
  - 61ab730: Rule: invalid-regexp (#1937) (@anderseknert)
  - 752ca7e: Cover more non-loop-expressions (#1938)
    (@anderseknert)
  - cb9a9c8: Add convenience functions for working with lines and
    uints (#1944) (@anderseknert)
  - 85171b8: build(deps): bump go.opentelemetry.io/otel/sdk in
    /e2e/testbuild (#1942) (@dependabot[bot])
  - 7fd6d66: [feature] Create input.json Skeleton if User Would
    Like When One Doesn't Exist (#1934) (@SeanLedford)
  - e4e326b: OPA v1.15.2 (#1945) (@anderseknert)
  - e8f1469: build(deps): bump
    go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
    (#1941) (@dependabot[bot])
  - 7a1235c: Fix potential nil deref in language server (#1947)
    (@anderseknert)
  - d6d2bf0: Fix index out of bounds in parital inlay hint
    (#1948) (@anderseknert)
  - 0a0f1f8: build(deps): bump the dependencies group with 2
    updates (#1946) (@dependabot[bot])
  - d0e99b5: Rewrite hover provider in Rego (#1951)
    (@anderseknert)
  - cc35d48: Fix possible nil deref in ogre (#1954)
    (@anderseknert)
  - 44ceabe: Rewrite inlay hint provider in Rego (#1953)
    (@anderseknert)
  - 5c62c72: testing: Improve lsp shutdown logic &amp; address test
    race conditions (#1943) (@charlieegan3)
  - 12cc776: Semantic package tokens in Rego (#1956)
    (@anderseknert)
  - b4ccafc: feat(new): add Related Resources source link to
    builtin rule doc template (#1957) (@mvanhorn)
  - 543d3fa: linter/lsp: Tidy use of aggregates and store in ls
    (#1962) (@charlieegan3)
  - 1442904: build(deps): bump github.com/go-git/go-git/v5 from
    5.17.2 to 5.18.0 (#1958) (@dependabot[bot])
  - 293cd7f: build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#1959) (@dependabot[bot])
  - 344a389: build(deps): bump the dependencies group with 3
    updates (#1963) (@dependabot[bot])
  - 784fa86: Semantic import tokens Rego rewrite (#1960)
    (@anderseknert)
  - 0a00617: Refactor: Sending Variable Semantic Tokens Data from
    Rego (#1961) (@SeanLedford)
  - 9016d3d: Minor fixes (#1965) (@anderseknert)
  - 0ddd70f: docs: Update setup-regal in docs (#1964)
    (@charlieegan3)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780488000">- update to 0.41.1:
  NOTE this is the same code as that of v0.41.0 — just that the
  combination of a release deployment issue and immutable releases
  just had that one end up without any downloadable artifacts. That
  is now corrected!
- Update to version 0.41.0:
  This release brings automatic Rego test generation, as well as
  squashing a bunch of issues under the hood with sweeping
  enhancements to the core language server code.
  * New Feature: Automatic Test Generation
    A first pass at automatic test generation has landed in the
    language server (#1982), thanks to @SeanLedford! With a new
    code action available when working in a policy file, Regal can
    generate a test stub based on the current state of the
    workspace. This uses the values found in input.json to populate
    the with statements in the generated test.
  * Language Server Improvements
    This release includes significant internal improvements to the
    language server.
    Completion performance has seen a major improvement: for
    clients like VS Code that support a default replacement range,
    the completion payload is now roughly half the size it was
    before, and clients generally do no longer need to send
    continuous requests to the server for more suggestions once you
    start typing (#1992).
    The folding range provider has been rewritten in Rego (#1979),
    and now additionally honours client capabilities like
    lineFoldingOnly and rangeLimit.
    The handling of input.json and input.yaml files has been
    overhauled (#2002). These files are now tracked as first-class
    workspace state: they are parsed and cached when saved, and the
    server now requests update notifications for them from the
    client, rather than re-parsing the file on each evaluation, or
    debug sessions started.
  * OPA v1.17.0
    Regal has been updated to OPA v1.17.0 (#2014). This OPA release
    notably introduces future.keywords.not, which improves the
    semantics of the not keyword by wrapping composite-expression
    negation in an implicit body. Thanks @johanfylling for making
    sure this also works in Regal now!
    Regal's RoAST representation (and docs) have been updated to
    support the new ast.Not form introduced alongside this feature
    (#1985).
  * RoAST module.comments Representation
    The RoAST representation of module.comments has changed
    (#1987). Comments are now represented as plain locations rather
    than base64-encoded text, allowing Regal to retrieve the
    original text from the source file directly with less bytes to
    transfer and parse. Note: this is a breaking change for custom
    rules that reference input.comments directly. Users should
    instead prefer to reference data.regal.ast.comments_decoded,
    which provides comment locations in the usual form and which
    will remain stable even through future format changes.
  * Bug Fixes
  - Addressed a panic in regal fix caused by fixes being applied
    in non-deterministic order; opa-fmt could reduce line count
    such that use-assignment-operator would then access
    out-of-bounds row numbers (#2003) as reported by @erazemk
  - The unassigned-return-value rule now correctly flags
    namespaced builtins like json.match_schema(...) in addition
    to flat builtins like lower(...) (#2005) — thanks @mvanhorn
    for the fix and @anderseknert for the report
  - Nicer formatting of with sequences (#1969)
  - regal/ast: metadata labels field is now recognized as a valid
    metadata key, aligned with OPA v1.17.0 (#1983, #1988) —
    thanks @srenatus
  - Regal fix now works regardless of local git state (#2011).
    Thanks @seiyab for the report in #2006
  * What's Changed
  - Use common aggregate data in circular-import (#2019)
  - build(deps): bump github/codeql-action in the dependencies
    group (#2017)
  - debug: Determine abs debugging path for input.json (#2018)
  - Unify common aggregation and aggregated data (#2016)
  - build(deps): bump the dependencies group with 3 updates
    (#2008)
  - build(deps): bump github.com/containerd/containerd/v2 in
    /e2e/testbuild (#2007)
  - Add capabilities verification to build check (#2015)
  - Use logger in Rego router (#2012)
  - deps: Update opa to 1.17.0 (#2014)
  - Extract file polling into waitForFile helper (#2013)
  - Remove git validation from fix command (#2011)
  - lsp: Introduce workspace abstraction (#2009)
  - Remove the settings.json change that was introduced in my
    previous PR (#2010)
  - fix(rules): unassigned-return-value now covers namespaced
    builtins (#2005)
  - [feature] First Pass at Automatic Test Generation in Regal
    (#1982)
  - fixer: Apply linter fixes in deterministic order (#2003)
  - build(deps): bump the dependencies group across 1 directory
    with 2 updates (#1998)
  - build(deps): bump brace-expansion from 5.0.5 to 5.0.6 in
    /build (#1997)
  - Improved handling of input.(json|yaml) files (#2002)
  - build(deps): bump github.com/go-git/go-git/v5 in
    /e2e/testbuild (#2000)
  - build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
    5.19.1 (#2001)
  - Move location of LSP storage helpers (#1993)
  - New framework for testing language server handlers (#1992)
  - Breaking: new RoAST representation of module.comments (#1987)
  - regal/ast: update metadata fields (#1988)
  - roast: Add marshaling support for `ast.Not` (#1985)
  - Introduce passthrough handler type (#1984)
  - regal/ast: add 'id' to valid metadata keys (#1983)
  - build(deps): bump github/codeql-action in the dependencies
    group (#1981)
  - Move folding range provider to Rego handlers (#1979)
  - Cleanup (#1978)
  - feat(pre-commit): add regal-fix hooks for auto-fixing rules
    (#1847) (#1976)
  - build(deps): bump the dependencies group with 2 updates
    (#1975)
  - Move initialize handler to Rego router (#1977)
  - Various code quality improvements (#1970)
  - Nicer formatting of `with` test sequences (#1969)
  - Update ast.json else to use "#/$defs/rule" (#1967)
  - Use OPA main until next OPA release (#1968)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784289600">- Update to version 0.42.0:
  * Language Server
  - Find References and Rename
    This release brings initial support for finding references
    and renaming symbols in the workspace. This first version is
    limited to function arguments and some bindings, but we plan
    to expand this in future releases.
    Video see
    https://github.com/open-policy-agent/regal/releases/tag/v0.42.0
    References are checked across the whole workspace, and
    renames work even when for example, a function is
    incrementally defined in several different files.
  - New future.keywords completion provider
    The language server will now suggest future.keywords in
    completions for import lines — notably the new import
    future.keywords.not for now, with a few more to follow soon
    in OPA.
  * Debug Adapter
  - Evaluate
    Regal's debug adapter protocol (DAP) implementation now
    supports evaluating variables and expressions inside of stack
    frames in debugging sessions! This also allows setting up
    watch expressions in clients like VS Code.
    Video see
    https://github.com/open-policy-agent/regal/releases/tag/v0.42.0
    Make sure to download the latest version of the OPA VS Code
    extension to try it out. More clients hopefully supported
    soon!
  * Various Improvements
  - Add --aggregate flag to regal new rule command to create
    aggregate rules. Thanks @mvanhorn!
  - Allocate less memory while linting with this one simple trick
  - Make common rule name provider provide suggestions for
    default rules
  - Make input.json completion provider provide suggestion for
    imports
  - Have boolean value completion provider provide suggestions in
    many more locations
  - Add inline docs to import provider
  - Add label details to built-in function completion provider
  - Bump OPA dependency to v1.18.2
  * Bugs Fixed
  - Override return type of object.subset while waiting for the
    next OPA release to fix this. Thanks @mvanhorn!
  - Fix wrong end location of reported for unresolved functions
  - Fix wrong end location reported by rule-shadows-builtin
  * Documentation
  - Update defunct styra.com links to point to archived copies
    until we find a better home for them
  - Documentation added for how GitHub Copilot breaks
    autocomplete in VS Code and a recommendation not to use it.
  * Changelog
  - 22365a3: docs: Document Copilot breaking language servers in
    VS Code (#2021) (@anderseknert)
  - b842742: docs: Archive some styra.com references (#2022)
    (@charlieegan3)
  - a2539ef: roast: adjust not test locations (#2023) (@srenatus)
  - 81d6485: feat: add --aggregate flag to regal new rule (#341)
    (#1966) (@mvanhorn)
  - 75ce34c: lsp: first implementation of find references and
    rename (#2029) (@anderseknert)
  - efa9106: perf: remove a million allocations with this one
    simple trick (#2024) (@anderseknert)
  - c64b3a3: build(deps): bump the dependencies group with 3
    updates (#2027) (@dependabot[bot])
  - b3594a4: docs: Small updates to address some inconsistencies
    (#2030) (@charlieegan3)
  - dd92373: [lsp] Update find references and rename request to
    support "some" variables (#2031) (@SeanLedford)
  - a107bea: build(deps): bump markdown-it and markdownlint-cli
    in /build (#2032) (@dependabot[bot])
  - 656cb56: [feature] Extending find references variable support
    (#2035) (@SeanLedford)
  - c78887b: build(deps): bump the dependencies group across 1
    directory with 4 updates (#2037) (@dependabot[bot])
  - 4e5e4a2: build(deps): bump the dependencies group with 5
    updates (#2043) (@dependabot[bot])
  - 9b380f4: build(deps): bump golang.org/x/net from 0.53.0 to
    0.55.0 in /build/lsp (#2041) (@dependabot[bot])
  - ce12d08: OPA v1.18.2 (#2040) (@anderseknert)
  - 4f5d1dc: fix: override object.subset return type to boolean
    (#2048) (@mvanhorn)
  - 75fd9d3: build(deps): bump golang.org/x/crypto from 0.50.0 to
    0.52.0 in /build/ws (#2044) (@dependabot[bot])
  - c2328a5: build(deps): bump the dependencies group with 4
    updates (#2049) (@dependabot[bot])
  - 758630a: Fix wrong end location of reported unresolved
    functions (#2053) (@anderseknert)
  - 9a74766: Fix wrong end location reported by
    rule-shadows-builtin (#2054) (@anderseknert)
  - 2bb3592: dap: Implement Evaluate feature (#2051)
    (@anderseknert)
  - 76ed1f0: Raise test timeout threshold to 3 seconds (#2058)
    (@anderseknert)
  - d7aaf8f: Use new inmem.NewFromASTObject to set up Regal store
    (#2056) (@anderseknert)
  - 98fc359: Add import future.keywords completion provider
    (#2055) (@anderseknert)
  - bcdaa1d: Various completion provider improvements (#2057)
    (@anderseknert)</changelog>
</package>
<package pkgid="be04795c4f6b87cc1f9de237880e09ef5e2459ba58f6ecf152b1338ae1535f027258b557e6ab5165bd3b7af276a577697ff0a1f1c038f855fef7fd965f3a26cb" name="regexploit" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="7.21"/>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1637496000">- initial package for version 1.0.0.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1706788800">- fix shebang of regexploit-python-env
  fixes boo#1219313</changelog>
</package>
<package pkgid="4cc77a182e55203155b1621b6894c9143907babf7f5aaae54699fa43de129d00b48fd670718ab0c60b1c9101ff92c9d8cca8c4f8656472d04dce92b709203248" name="regexploit" arch="src">
  <version epoch="0" ver="1.0.0" rel="7.21"/>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1637496000">- initial package for version 1.0.0.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1706788800">- fix shebang of regexploit-python-env
  fixes boo#1219313</changelog>
</package>
<package pkgid="06ab9fe851f953847e70e9370a656bc2b9fc8eba28ab04b0ee5a82758522abffebee236bdbbdb14a55496412f245852fea5fe9f6d5dd619cb7bf90cbf86253f7" name="rekor" arch="s390x">
  <version epoch="0" ver="1.5.2" rel="70.7"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680696000">- updated to rekor 1.1.0 (jsc#SLE-23476):
  Functional Enhancements
  - improve validation on intoto v0.0.2 type (#1351)
  - add feature to limit HTTP request body length to process (#1334)
  - add information about the file size limit (#1313)
  - Add script to backfill Redis from Rekor (#1163)
  - Feature: add search support for sha512 (#1142)
  Quality Enhancements
  - various fuzzing fixes
  Bug Fixes
  - remove goroutine usage from SearchLogQuery (#1407)
  - drop log messages regarding attestation storage to debug (#1408)
  - fix validation for proposed vs committed log entries for intoto v0.0.1 (#1309)
  - fix: fix regex for multi-digit counts (#1321)
  - return NotFound if treesize is 0 rather than calling trillian (#1311)
  - enumerate slice to get sugared logs (#1312)
  - put a reasonable size limit on ssh key reader (#1288)
  - CLIENT: Fix Custom Host and Path Issue (#1306)
  - do not persist local state if log is empty; fail consistency proofs from 0 size (#1290)
  - correctly handle invalid or missing pki format (#1281)
  - Add Verifier to get public key/cert and identities for entry type (#1210)
  - fix goroutine leak in client; add insecure TLS option (#1238)
  - Fix - Remove the force-recreate flag (#1179)
  - trim whitespace around public keys before parsing (#1175)
  - stop inserting envelope hash for intoto:0.0.2 types into index (#1171)
  - Revert "remove double encoding of payload and signature fields for intoto (#1150)" (#1158)
  - remove double encoding of payload and signature fields for intoto (#1150)
  - fix SearchLogQuery behavior to conform to openapi spec (#1145)
  - Remove pem-certificate-chain from client (#1138)
  - fix flag type for operator in search (#1136)
  - use sigstore/community dep review (#1132)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1683115200">- updated to rekor 1.1.1 (jsc#SLE-23476):
  Functional Enhancements
  - Refactor Trillian client with exported methods (#1454)
  - Switch to official redis-go client (#1459)
  - Remove replace in go.mod (#1444)
  - Add Rekor OID info. (#1390)
  Quality Enhancements
  - remove legacy encrypted cosign key (#1446)
  - swap cjson dependency (#1441)
  - Update release readme (#1456)
  Security fixes:
  - CVE-2023-30551: Fixed a potential denial of service (out of memory)
    when processing JAR META-INF files or .SIGN/.PKINFO files in APK files.
    (bsc#1211210 https://github.com/advisories/GHSA-2h5h-59f5-c5x9)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1685448000">- updated to rekor 1.2.1 (jsc#SLE-23476):
  Security fix:
  - CVE-2023-33199: Fixed that malformed proposed intoto v0.0.2 entries can cause a panic (bsc#1211790)
  Functional Enhancements
  - add client method to generate TLE struct (#1498)
  - add dsse type (#1487)
  - support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (#1488)
  - Add concurrency to backfill-redis (#1504)
  - omit informational message if machine-parseable output has been requested (#1486)
  - Publish stable checkpoint periodically to Redis (#1461)
  - Add intoto v0.0.2 to backfill script (#1500)
  - add new method to test insertability of proposed entries into log (#1410)
  Quality Enhancements
  - use t.Skip() in fuzzers (#1506)
  - improve fuzzing coverage (#1499)
  - Remove watcher script (#1484)
  Bug Fixes
  - Merge pull request from GHSA-frqx-jfcm-6jjr (CVE-2023-33199)
  - Remove requirement of PayloadHash for intoto 0.0.1 (#1490)
  - fix lint errors, bump linter up to 1.52 (#1485)
  - Remove dependencies from pkg/util (#1469)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1693569600">- updated to rekor 1.3.0 (jsc#SLE-23476):
  - Update openapi.yaml (#1655)
  - pass transient errors through retrieveLogEntry (#1653)
  - return full entryID on HTTP 409 responses (#1650)
  - feat: Support publishing new log entries to Pub/Sub topics (#1580)
  - Change values of Identity.Raw, add fingerprints (#1628)
  - Extract all subjects from SANs for x509 verifier (#1632)
  - Fix type comment for Identity struct (#1619)
  - Refactor Identities API (#1611)
  - Refactor Verifiers to return multiple keys (#1601)
  - Update checkpoint link (#1597)
  - Use correct log index in inclusion proof (#1599)
  - remove instrumentation library (#1595)
- updated to rekor 1.2.2 (jsc#SLE-23476):
  - pass down error with message instead of nil
  - swap killswitch for 'docker-compose restart'</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1700827200">- updated to rekor 1.3.3 (jsc#SLE-23476):
  - Update signer flag description
  - update trillian to 1.5.3
  - adds redis_auth
  - Add method to get artifact hash for an entry
  - make e2e tests more usable with docker-compose
  - install go at correct version for codeql
- updated to rekor 1.3.2 (jsc#SLE-23476):
- updated to rekor 1.3.1 (jsc#SLE-23476):
  New Features:
  - enable GCP cloud profiling on rekor-server (#1746)
  - move index storage into interface (#1741)
  - add info to readme to denote additional documentation sources (#1722)
  - Add type of ed25519 key for TUF (#1677)
  - Allow parsing base64-encoded TUF metadata and root content (#1671)
  Quality Enhancements:
  - disable quota in trillian in test harness (#1680)
  Bug Fixes:
  - Update contact for code of conduct (#1720)
  - Fix panic when parsing SSH SK pubkeys (#1712)
  - Correct index creation (#1708)
  - docs: fixzes a small typo on the readme (#1686)
  - chore: fix backfill-redis Makefile target (#1685)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1706443200">- update to 1.3.4:
  * add mysql indexstorage backend
  * add s3 storage for attestations
  * fix: Do not check for pubsub.topics.get on initialization
  * fix optional field in cose schema
  * Update ranges.go
  * update indexstorage interface to reduce roundtrips
  * use a single validator library in rekor-cli
  * Remove go-playground/validator dependency from pkg/pki</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1707134400">- update to 1.3.5 (jsc#SLE-23476):
  - Additional unique index correction
  - Remove timestamp from checkpoint
  - Drop conditional when verifying entry checkpoint
  - Fix panic for DSSE canonicalization
  - Change Redis value for locking mechanism
  - give log timestamps nanosecond precision
  - output trace in slog and override correlation header name
- bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1721995200">- refactor spec file
- switch to using obs_scm to generate the source obscpio archive
  * this way we do no longer need to hardcode the commit hash
  * and the tarball was never verified anyway</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721995201">- Update to version 1.3.6:
  * New Features
  - Add support for IEEE P1363 encoded ECDSA signatures
  - Add index performance script (#2042)
  - Add support for ed25519ph user keys in hashedrekord (#1945)
  - Add metrics for index insertion (#2015)
  - Add TLS support for Redis Client implementation (#1998)
  * Bug Fixes
  - fix typo in remoteIp and set full name for trace field</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- Update to version 1.3.7:
  * New Features
  - log request body on 500 error to aid debugging (#2283)
  - Add support for signing with Tink keyset (#2228)
  - Add public key hash check in Signed Note verification (#2214)
  - update Trillian TLS configuration (#2202)
  - Add TLS support for Trillian server (#2164)
  - Replace docker-compose with plugin if available (#2153)
  - Add flags to backfill script (#2146)
  - Unset DisableKeepalive for backfill HTTP client (#2137)
  - Add script to delete indexes from Redis (#2120)
  - Run CREATE statement in backfill script (#2109)
  - Add MySQL support to backfill script (#2081)
  - Run e2e tests on mysql and redis index backends (#2079)
  * Bug Fixes
  - remove unneeded value in log message (#2282)
  - Add error message when computing consistency proof (#2278)
  - fix validation error handling on API (#2217)
  - fix error in pretty-printed inclusion proof from verify
    subcommand (#2210)
  - Fix index scripts (#2203)
  - fix failing sharding test
  - Better error handling in backfill script (#2148)
  - Batch entries in cleanup script (#2158)
  - Add missing workflow for index cleanup test (#2121)
  - hashedrekord: fix schema $id (#2092)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737115200">- Update to version 1.3.8:
  * Bug Fixes
  - fix zizmor issues (#2298)
  - remove unneeded value in log message (#2282)
  * Quality Enhancements
  - chore: relax go directive to permit 1.22.x
  - fetch minisign from homebrew instead of custom ppa (#2329)
  - fix(ci): simplify GOVERSION extraction
  - chore(deps): bump actions pins to latest
  - Updates go and golangci-lint (#2302)
  - update builder to use go1.23.4 (#2301)
  - clean up spaces
  - log request body on 500 error to aid debugging (#2283)</changelog>
  <changelog author="meissner@suse.com" date="1738065600">- Update to version 1.3.9 (jsc#SLE-23476):
  * Cache checkpoint for inactive shards (#2332)
  * Support per-shard signing keys (#2330)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744372800">- Update to version 1.3.10:
  * Features
  - Added --client-signing-algorithms flag (#1974)
  * Fixes / Misc
  - emit unpopulated values when marshalling (#2438)
  - pkg/api: better logs when algorithm registry rejects a key
    (#2429)
  - chore: improve mysql readiness checks (#2397)
  - Added --client-signing-algorithms flag (#1974)
  * Security fixes (over the last releases):
  - CVE-2024-6104: rekor: hashicorp/go-retryablehttp: url might write sensitive information to log file (bsc#1227053)
  - CVE-2023-45288: rekor: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236519)
  - CVE-2025-27144: rekor: gopkg.in/go-jose/go-jose.v2,github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237638)
  - CVE-2025-22868: rekor: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239191)
  - CVE-2025-22869: rekor: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239327)
  - CVE-2025-30204: rekor: github.com/golang-jwt/jwt/v5: jwt-go allows excessive memory allocation during header parsing (bsc#1240468)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754222400">- Update to version 1.4.0:
  * changelog for v1.4.0 release (#2550)
  * enable retries and timeouts on GCP KMS calls (#2548)
  * allow configuring gRPC default service config for trillian
    client load balancing &amp; timeouts (#2549)
  * remove stable checkpoint feature (#2537)
  * build(deps): Bump sigs.k8s.io/release-utils from 0.11.1 to
    0.12.0
  * build(deps): Bump golang.org/x/net from 0.41.0 to 0.42.0
    (#2544)
  * build(deps): Bump the all group with 3 updates (#2545)
  * fix lints
  * bump golangci-lint to v2.2.x
  * use go1.24.5 to build rekor
  * build(deps): Bump google.golang.org/api from 0.238.0 to 0.242.0
    (#2543)
  * build(deps): Bump golang.org/x/sync from 0.15.0 to 0.16.0
    (#2541)
  * build(deps): Bump github.com/spf13/pflag in the all group
    (#2542)
  * build(deps): Bump github.com/sigstore/protobuf-specs from 0.4.3
    to 0.5.0
  * move context handling in trillian RPC calls to be request based
    and idiomatic (#2536)
  * build(deps): Bump github.com/go-viper/mapstructure/v2 (#2522)
  * build(deps): Bump golang from 1.24.4 to 1.24.5 in the all group
    (#2534)
  * build(deps): Bump the all group with 2 updates (#2518)
  * build(deps): Bump the all group with 2 updates (#2524)
  * build(deps): Bump sigstore/scaffolding/trillian_log_server
    (#2527)
  * build(deps): Bump sigstore/scaffolding/trillian_log_signer
    (#2526)
  * build(deps): Bump github.com/go-viper/mapstructure/v2 in
    /hack/tools (#2523)
  * backoff pubsub emulator to last-known good (#2535)
  * build(deps): Bump golang from `db5d0af` to `10c1318`
  * build(deps): Bump sigstore/cosign-installer in the all group
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump google.golang.org/api from 0.237.0 to 0.238.0
  * build(deps): Bump go.step.sm/crypto from 0.66.0 to 0.67.0
  * build(deps): Bump github/codeql-action in the all group
  * build(deps): Bump google.golang.org/api from 0.236.0 to 0.237.0
  * build(deps): Bump the all group with 7 updates
  * Update GoReleaser configurations (#2511)
  * update builder to use go1.24.4
  * build(deps): Bump google.golang.org/grpc from 1.72.2 to 1.73.0
  * build(deps): Bump golang.org/x/net from 0.40.0 to 0.41.0
  * build(deps): Bump github.com/redis/go-redis/v9 from 9.9.0 to
    9.10.0
  * build(deps): Bump google.golang.org/api from 0.235.0 to 0.236.0
  * build(deps): Bump golang from 1.24.3 to 1.24.4 in the all group
  * build(deps): Bump github.com/go-swagger/go-swagger
  * build(deps): Bump github/codeql-action in the all group
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump github.com/google/rpmpack from 0.6.0 to 0.7.0
  * build(deps): Bump github.com/redis/go-redis/v9 from 9.8.0 to
    9.9.0
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump go.step.sm/crypto from 0.64.0 to 0.66.0
  * build(deps): Bump google.golang.org/api from 0.234.0 to 0.235.0
  * build(deps): Bump golang from `4c0a181` to `81bf592`
  * build(deps): Bump google.golang.org/api from 0.233.0 to 0.234.0
  * build(deps): Bump golang from `86b4cff` to `4c0a181`
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump google.golang.org/grpc in the all group
  * build(deps): Bump go.step.sm/crypto from 0.63.0 to 0.64.0
  * Don't initialize index storage with stable checkpoint
    publishing (#2486)
  * build(deps): Bump golang from `39d9e7d` to `86b4cff`
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump the all group with 2 updates
  * build(deps): Bump google.golang.org/api from 0.232.0 to 0.233.0
  * build(deps): Bump the all group with 2 updates
  * Fix docker compose up --wait failing when Trillian server isn't
    healthy (#2473)
  * build(deps): Bump golang.org/x/crypto from 0.37.0 to 0.38.0
    (#2477)
  * build(deps): Bump golang.org/x/net from 0.39.0 to 0.40.0
    (#2475)
  * build(deps): Bump golang from 1.24.2 to 1.24.3 in the all group
    (#2480)
  * build(deps): Bump google.golang.org/api from 0.231.0 to 0.232.0
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2478)
  * build(deps): Bump actions/setup-go from 5.4.0 to 5.5.0 in the
    all group (#2474)
  * build(deps): Bump github.com/redis/go-redis/v9 from 9.7.3 to
    9.8.0 (#2470)
  * build(deps): Bump golangci/golangci-lint-action from 7.0.0 to
    8.0.0 (#2471)
  * build(deps): Bump google.golang.org/api from 0.230.0 to 0.231.0
  * build(deps): Bump go.step.sm/crypto from 0.61.0 to 0.63.0
    (#2468)
  * build(deps): Bump github/codeql-action in the all group (#2467)
  * build(deps): Bump golang from `d9db321` to `30baaea` (#2469)
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2466)
  * build(deps): Bump the all group with 2 updates
  * build(deps): Bump google.golang.org/api from 0.229.0 to 0.230.0
  * build(deps): Bump the all group with 3 updates
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2462)
  * Bump sigstore/sigstore, use shared Tink library (#2461)
  * better mysql healthcheck (#2459)
  * build(deps): Bump sigs.k8s.io/release-utils from 0.8.4 to
    0.11.1
  * build(deps): Bump google.golang.org/grpc from 1.71.1 to 1.72.0
  * build(deps): Bump github.com/tink-crypto/tink-go/v2 from 2.3.0
    to 2.4.0
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump golang
  * build(deps): Bump codecov/codecov-action in the all group
  * build(deps): Bump go.step.sm/crypto from 0.60.0 to 0.61.0
  * build(deps): Bump golang.org/x/crypto in /hack/tools
  * update builder image to use go1.24.2
  * build(deps): Bump golang from `991aa6a` to `1ecc479`
  * build(deps): Bump ko-build/setup-ko from 0.8 to 0.9 in the all
    group
  * build(deps): Bump cloud.google.com/go/pubsub from 1.47.0 to
    1.49.0
  * build(deps): Bump github.com/prometheus/client_golang
  * build(deps): Bump the all group with 7 updates
  * build(deps): Bump github.com/spf13/viper from 1.19.0 to 1.20.1
  * Add CHANGELOG for v1.3.10 (#2439)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1756728000">- Update to version 1.4.1 (jsc#SLE-23476)::
  * build(deps): Bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#2596)
    CVE-2025-58058: rekor: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory: (bsc#1248910)
  * build(deps): Bump github.com/redis/go-redis/v9 from 9.11.0 to 9.12.1
    CVE-2025-29923: rekor: github.com/redis/go-redis: potential out of order responses when `CLIENT SETINFO` times out during connection establishment (bsc#1241153)
  * use less expensive gRPC call to implement GetLeafAndProofByHash (#2581)
  * move to per-shard trillian client manager (#2564)
  * use cheaper gRPC endpoint when we already have the inclusion proof (#2580)
  * simplify hash and signature verification in rekord type (#2579)
  * return correct error if GetLeafAndProofByHash fails (#2574)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758196800">- Update to version 1.4.2:
  * build(deps): Bump google-github-actions/auth from 2.1.12 to
    3.0.0 by @dependabot[bot] in #2601
  * build(deps): Bump github/codeql-action from 3.29.11 to 3.30.0
    in the all group by @dependabot[bot] in #2602
  * build(deps): Bump the all group with 3 updates by
    @dependabot[bot] in #2599
  * optimize performance of regex operations by @bobcallaway in
    [#2603]
  * move to direct decoding instead of mapstructure by @bobcallaway
    in #2598
  * build(deps): Bump github.com/go-openapi/swag from 0.23.1 to
    0.24.1 by @dependabot[bot] in #2600
  * build(deps): Bump golang from 1.24.6 to 1.25.0 in the all group
    by @dependabot[bot] in #2587
  * process type contents serially by @bobcallaway in #2604
  * use pubsub client to check IAM permissions by @bobcallaway in
    [#2605]
  * add changelog for v1.4.2 by @bobcallaway in #2606</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380800">- Update to version 1.4.3:
  This release reduces dependencies for a number of exported
  packages.
  This release also changes the format of the binary and container
  signature, which is now a Sigstore bundle. To verify a release,
  use the latest Cosign 3.x, verifying with
    cosign verify-blob --bundle &lt;artifact&gt;-keyless.sigstore.json &lt;artifact&gt;.
  * Improvements
  - use interruptable context to elegantly handle signals in
    rekor-cli (#2681)
  - restapi: Don't log client errors as errors (#2680)
  - pkg: separate pki types from implementations (#2668)
  - e2e: don't mix e2e and regular utilities (#2672)
  - pkg: remove viper config from spec definitions (#2669)
  - log: remove zap &amp; go-chi dependecy from pkg/types (#2667)
  - chore: update go-openapi/runtime to v0.29.0 (#2670)
  - chore: remove double imported mapstructure pkg (#2671)
  - remove archived dependency and use stdlib slices (#2650)
  * Documentation
  - (docs): guard unsafe int/uint conversions flagged by gosec
    (#2679)
  * Dependencies
  - build(deps): Bump actions/setup-go from 5.5.0 to 6.0.0
  - build(deps): Bump actions/upload-artifact from 4.6.2 to 5.0.0
  - build(deps): Bump cloud.google.com/go/pubsub/v2 from 2.0.0 to
    2.3.0 (#2654)
  - build(deps): Bump github.com/go-openapi/loads from 0.22.0 to
    0.23.1 (#2632)
  - build(deps): Bump github.com/go-openapi/swag from 0.24.1 to
    0.25.1 (#2666)
  - build(deps): Bump github.com/go-openapi/swag/conv from 0.24.0
    to 0.25.1 (#2628)
  - build(deps): Bump github.com/go-openapi/validate from 0.24.0
    to 0.25.0 (#2629)
  - build(deps): Bump github.com/go-swagger/go-swagger from
    0.32.3 to 0.33.1 in /hack/tools in the all group (#2643)
  - build(deps): Bump github.com/redis/go-redis/v9 from 9.12.1 to
    9.13.0
  - build(deps): Bump github.com/redis/go-redis/v9 from 9.13.0 to
    9.14.0
  - build(deps): Bump github.com/spf13/cobra from 1.9.1 to 1.10.1
  - build(deps): Bump github.com/spf13/viper from 1.20.1 to
    1.21.0
  - build(deps): Bump github.com/tink-crypto/tink-go/v2 from
    2.4.0 to 2.5.0 (#2661)
  - build(deps): Bump github/codeql-action from 3.30.3 to 4.30.9
    (#2645)
  - build(deps): Bump github/codeql-action in the all group
    (#2659)
  - build(deps): Bump github/codeql-action in the all group
    (#2663)
  - build(deps): Bump go.step.sm/crypto from 0.70.0 to 0.72.0
    (#2651)
  - build(deps): Bump go.step.sm/crypto from 0.73.0 to 0.74.0
    (#2674)
  - build(deps): Bump golang from 1.25.0 to 1.25.1 in the all
    group (#2611)
  - build(deps): Bump golang from 1.25.1 to 1.25.2 in the all
    group (#2644)
  - build(deps): Bump golang from 1.25.2 to 1.25.3 in the all
    group
  - build(deps): Bump golang from 1.25.3 to 1.25.4 in the all
    group (#2675)
  - build(deps): Bump golang from `a5e935d` to `8305f5f`
  - build(deps): Bump golang.org/x/mod from 0.27.0 to 0.28.0
  - build(deps): Bump golang.org/x/mod from 0.28.0 to 0.29.0
    (#2665)
  - build(deps): Bump golang.org/x/net from 0.43.0 to 0.44.0
  - build(deps): Bump golang.org/x/net from 0.44.0 to 0.46.0
    (#2656)
  - build(deps): Bump golang.org/x/sync from 0.16.0 to 0.17.0
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2618)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2642)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2658)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2660)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2676)
  - build(deps): Bump google.golang.org/api from 0.248.0 to
    0.249.0
  - build(deps): Bump google.golang.org/api from 0.249.0 to
    0.252.0 (#2648)
  - build(deps): Bump google.golang.org/api from 0.252.0 to
    0.253.0 (#2653)
  - build(deps): Bump google.golang.org/grpc from 1.75.1 to
    1.76.0 (#2652)
  - build(deps): Bump sigstore/cosign-installer from 3.10.0 to
    4.0.0 (#2646)
  - build(deps): Bump sigstore/scaffolding/trillian_log_server
    (#2636)
  - build(deps): Bump sigstore/scaffolding/trillian_log_server
    (#2678)
  - build(deps): Bump sigstore/scaffolding/trillian_log_signer
    (#2635)
  - build(deps): Bump sigstore/scaffolding/trillian_log_signer
    (#2677)
  - build(deps): Bump the all group across 1 directory with 5
    updates (#2647)
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump the all group with 3 updates
  - build(deps): Bump the all group with 7 updates (#2673)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769083200">- Update to version 1.5.0:
  This release fixes the following security issues:
  - GHSA-4c4x-jm2x-pf9j / CVE-2026-24117 / bsc#1257135: Fixed Server-Side Request Forgery (SSRF) via provided public key URL
  - GHSA-273p-m2cw-6833 / CVE-2026-23831 / bsc#1257132: Fixed  lack of input validation thatg can cause a thread crash
  - GHSA-j5w8-q4qc-rx2x / CVE-2025-58181 / bsc#1253817: Fixed golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption
  Note that this drops support for fetching public keys via URL
  when querying the search API.
  * Vulnerability Fixes
  - Handle malformed COSE and DSSE entries (#2729)
  - Drop support for fetching public keys by URL in the search
    index (#2731)
  * Features
  - Add support for a custom TLS config for clients (#2709)
  * Dependencies
  - build(deps): Bump github.com/redis/go-redis/v9 from 9.14.1 to
    9.17.2 (#2706)
  - build(deps): Bump google.golang.org/api from 0.256.0 to
    0.259.0 (#2723)
  - build(deps): Bump golang.org/x/net from 0.47.0 to 0.48.0
    (#2722)
  - build(deps): Bump github.com/sigstore/sigstore from 1.9.5 to
    1.10.3 (#2724)
  - build(deps): Bump the all group across 1 directory with 3
    updates (#2727)
  - build(deps): Bump the all group with 2 updates (#2728)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2726)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2720)
  - build(deps): Bump
    github.com/sigstore/sigstore/pkg/signature/kms/azure (#2716)
  - build(deps): Bump golang.org/x/sync from 0.18.0 to 0.19.0
    (#2715)
  - build(deps): Bump actions/upload-artifact from 5.0.0 to 6.0.0
    (#2714)
  - build(deps): Bump
    github.com/sigstore/sigstore/pkg/signature/kms/hashivault
    (#2717)
  - build(deps): Bump
    github.com/sigstore/sigstore/pkg/signature/kms/aws (#2718)
  - build(deps): Bump sigstore/scaffolding/trillian_log_signer
    (#2713)
  - build(deps): Bump sigstore/scaffolding/trillian_log_server
    (#2712)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2711)
  - build(deps): Bump the all group across 1 directory with 4
    updates (#2707)
  - build(deps): Bump golang from 1.25.4 to 1.25.5 in the all
    group (#2703)
  - build(deps): Bump the all group across 1 directory with 4
    updates (#2708)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump golang from `e68f6a0` to `6981837`
  - build(deps): Bump sigstore/scaffolding/trillian_log_signer
  - build(deps): Bump sigstore/scaffolding/trillian_log_server
  - build(deps): Bump google.golang.org/api from 0.254.0 to
    0.256.0
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump github/codeql-action in the all group
  - build(deps): Bump the all group with 3 updates (#2692)
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump golangci/golangci-lint-action from 8.0.0 to
    9.1.0
  - build(deps): Bump actions/checkout from 5.0.0 to 6.0.0
  - build(deps): Bump golang.org/x/crypto from 0.43.0 to 0.45.0
  - build(deps): Bump golang.org/x/crypto in /hack/tools
  - build(deps): Bump golang from `6ca9eb0` to `e68f6a0`
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773144000">- Update to version 1.5.1:
  * optimize memory for DSSE v0.0.1 processing (#2766)
  * Type assert the entry bundle when verifying inclusion proof (#2755)
  * return correct errors in rare failure situations (#2753)
  * raise error if decoding hash fails during inclusion proof (#2754)
  * Dependencies
  - build(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#2773)
  - build(deps): Bump google.golang.org/api from 0.264.0 to
    0.269.0 (#2770)
  - build(deps): Bump github/codeql-action in the all group
    (#2772)
  - build(deps): Bump github.com/redis/go-redis/v9 from 9.17.3 to
    9.18.0 (#2769)
  - build(deps): Bump the all group with 11 updates (#2768)
  - build(deps): Bump gocloud.dev from 0.40.0 to 0.44.0 (#2757)
  - build(deps): Bump go.step.sm/crypto from 0.74.0 to 0.76.2
    (#2760)
  - build(deps): Bump
    github.com/secure-systems-lab/go-securesystemslib (#2758)
  - build(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0 (#2763)
  - build(deps): Bump the all group across 1 directory with 2
    updates (#2764)
  - build(deps): Bump github.com/tink-crypto/tink-go/v2 from
    2.5.0 to 2.6.0 (#2761)
  - build(deps): Bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
  - build(deps): Bump golang.org/x/crypto from 0.47.0 to 0.48.0
  - build(deps): Bump golang.org/x/mod from 0.31.0 to 0.33.0
  - build(deps): Bump cloud.google.com/go/pubsub/v2 from 2.3.0 to
    2.4.0
  - build(deps): Bump google.golang.org/grpc from 1.78.0 to
    1.79.1
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump github/codeql-action in the all group
  - update golang builder to use go1.25.7 (#2702)
  - build(deps): Bump github/codeql-action in the all group
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump golang from 1.25.6 to 1.25.7 in the all
    group
  - build(deps): Bump the all group across 1 directory with 5
    updates
  - build(deps): Bump github.com/sigstore/sigstore from 1.10.3 to
    1.10.4 (#2732)
  - build(deps): Bump the all group with 2 updates (#2737)
  - build(deps): Bump golang.org/x/net from 0.48.0 to 0.49.0
    (#2738)
  - build(deps): Bump
    github.com/sigstore/sigstore/pkg/signature/kms/gcp (#2739)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2740)
  - build(deps): Bump golang from 1.25.5 to 1.25.6 in the all
    group (#2733)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2734)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 1.5.2:
  * build(deps): Bump the all group across 1 directory with 7
    updates (#2829)
  * alpine: Enforce max size limit on decompression (#2831)
  * Support restricting kinds on insertion (#2814)
  * fix(trillianclient): strip dns:/// scheme from TLS ServerName
    in gRPC dial (#2812)
  * build(deps): Bump cloud.google.com/go/profiler from 0.4.3 to
    0.6.0
  * build(deps): Bump go.uber.org/zap from 1.27.1 to 1.28.0
  * build(deps): Bump golang in the all group across 1 directory
  * build(deps): Bump github.com/go-openapi/swag from 0.25.5 to
    0.26.0
  * build(deps): Bump github.com/tink-crypto/tink-go-awskms/v2 to
    v3 (#2827)
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2820)
  * fix fuzz build failures and crashes (#2824)
  * increase fuzz duration to address build timeouts (#2822)
  * fuzzing updates (#2815)
  * build(deps): Bump cloud.google.com/go/pubsub/v2 from 2.4.0 to
    2.6.0 (#2810)
  * build(deps): Bump golang from 1.25.7 to 1.26.0 in the all group
    (#2746)
  * build(deps): Bump
    github.com/secure-systems-lab/go-securesystemslib (#2809)
  * build(deps): Bump go.step.sm/crypto from 0.76.2 to 0.77.7
    (#2811)
  * add checks to ensure returned entries match client inputs to
    rekor-cli (#2799)
  * add nil pointer check to resolve fuzzing crash (#2807)
  * build(deps): Bump golang.org/x/net from 0.52.0 to 0.53.0
    (#2804)
  * client: surface last-response details after retries are
    exhausted (#2796)
  * build(deps): Bump the all group with 2 updates (#2802)
  * build(deps): Bump github/codeql-action in the all group (#2803)
  * Fix internal error detail leakage in 500 responses (#2801)
  * add defensive check to ensure tid is in config ahead of getting
    client (#2795)
  * restapi: include inactiveShards in the homepage total count
    (#2797)
  * build(deps): Bump the all group with 5 updates (#2794)
  * build(deps): Bump actions/upload-artifact in the all group
  * add generated files to pr
  * build(deps): Bump github.com/go-swagger/go-swagger
  * build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * build(deps): Bump go.opentelemetry.io/otel/sdk from 1.42.0 to
    1.43.0
  * build(deps): Bump google.golang.org/api from 0.269.0 to 0.271.0
    (#2781)
  * build(deps): Bump golang.org/x/net from 0.50.0 to 0.52.0
    (#2780)
  * build(deps): Bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#2789)
  * build(deps): Bump golang.org/x/sync from 0.19.0 to 0.20.0
    (#2771)
  * build(deps): Bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4 (#2788)
  * Add changelog for v1.5.1 (#2774)
  * build(deps): Bump the all group across 1 directory with 3
    updates
  * build(deps): Bump the all group across 1 directory with 7
    updates</changelog>
</package>
<package pkgid="731dba29eaa9915e0e097551df0cb824d9d5bd7c1d4824cae799ea4c7752f852e852e9525c676271c5f7d4351685ab3b6e2b2ecbde775872033b6cedcca8ebe0" name="rekor" arch="src">
  <version epoch="0" ver="1.5.2" rel="70.7"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680696000">- updated to rekor 1.1.0 (jsc#SLE-23476):
  Functional Enhancements
  - improve validation on intoto v0.0.2 type (#1351)
  - add feature to limit HTTP request body length to process (#1334)
  - add information about the file size limit (#1313)
  - Add script to backfill Redis from Rekor (#1163)
  - Feature: add search support for sha512 (#1142)
  Quality Enhancements
  - various fuzzing fixes
  Bug Fixes
  - remove goroutine usage from SearchLogQuery (#1407)
  - drop log messages regarding attestation storage to debug (#1408)
  - fix validation for proposed vs committed log entries for intoto v0.0.1 (#1309)
  - fix: fix regex for multi-digit counts (#1321)
  - return NotFound if treesize is 0 rather than calling trillian (#1311)
  - enumerate slice to get sugared logs (#1312)
  - put a reasonable size limit on ssh key reader (#1288)
  - CLIENT: Fix Custom Host and Path Issue (#1306)
  - do not persist local state if log is empty; fail consistency proofs from 0 size (#1290)
  - correctly handle invalid or missing pki format (#1281)
  - Add Verifier to get public key/cert and identities for entry type (#1210)
  - fix goroutine leak in client; add insecure TLS option (#1238)
  - Fix - Remove the force-recreate flag (#1179)
  - trim whitespace around public keys before parsing (#1175)
  - stop inserting envelope hash for intoto:0.0.2 types into index (#1171)
  - Revert "remove double encoding of payload and signature fields for intoto (#1150)" (#1158)
  - remove double encoding of payload and signature fields for intoto (#1150)
  - fix SearchLogQuery behavior to conform to openapi spec (#1145)
  - Remove pem-certificate-chain from client (#1138)
  - fix flag type for operator in search (#1136)
  - use sigstore/community dep review (#1132)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1683115200">- updated to rekor 1.1.1 (jsc#SLE-23476):
  Functional Enhancements
  - Refactor Trillian client with exported methods (#1454)
  - Switch to official redis-go client (#1459)
  - Remove replace in go.mod (#1444)
  - Add Rekor OID info. (#1390)
  Quality Enhancements
  - remove legacy encrypted cosign key (#1446)
  - swap cjson dependency (#1441)
  - Update release readme (#1456)
  Security fixes:
  - CVE-2023-30551: Fixed a potential denial of service (out of memory)
    when processing JAR META-INF files or .SIGN/.PKINFO files in APK files.
    (bsc#1211210 https://github.com/advisories/GHSA-2h5h-59f5-c5x9)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1685448000">- updated to rekor 1.2.1 (jsc#SLE-23476):
  Security fix:
  - CVE-2023-33199: Fixed that malformed proposed intoto v0.0.2 entries can cause a panic (bsc#1211790)
  Functional Enhancements
  - add client method to generate TLE struct (#1498)
  - add dsse type (#1487)
  - support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (#1488)
  - Add concurrency to backfill-redis (#1504)
  - omit informational message if machine-parseable output has been requested (#1486)
  - Publish stable checkpoint periodically to Redis (#1461)
  - Add intoto v0.0.2 to backfill script (#1500)
  - add new method to test insertability of proposed entries into log (#1410)
  Quality Enhancements
  - use t.Skip() in fuzzers (#1506)
  - improve fuzzing coverage (#1499)
  - Remove watcher script (#1484)
  Bug Fixes
  - Merge pull request from GHSA-frqx-jfcm-6jjr (CVE-2023-33199)
  - Remove requirement of PayloadHash for intoto 0.0.1 (#1490)
  - fix lint errors, bump linter up to 1.52 (#1485)
  - Remove dependencies from pkg/util (#1469)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1693569600">- updated to rekor 1.3.0 (jsc#SLE-23476):
  - Update openapi.yaml (#1655)
  - pass transient errors through retrieveLogEntry (#1653)
  - return full entryID on HTTP 409 responses (#1650)
  - feat: Support publishing new log entries to Pub/Sub topics (#1580)
  - Change values of Identity.Raw, add fingerprints (#1628)
  - Extract all subjects from SANs for x509 verifier (#1632)
  - Fix type comment for Identity struct (#1619)
  - Refactor Identities API (#1611)
  - Refactor Verifiers to return multiple keys (#1601)
  - Update checkpoint link (#1597)
  - Use correct log index in inclusion proof (#1599)
  - remove instrumentation library (#1595)
- updated to rekor 1.2.2 (jsc#SLE-23476):
  - pass down error with message instead of nil
  - swap killswitch for 'docker-compose restart'</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1700827200">- updated to rekor 1.3.3 (jsc#SLE-23476):
  - Update signer flag description
  - update trillian to 1.5.3
  - adds redis_auth
  - Add method to get artifact hash for an entry
  - make e2e tests more usable with docker-compose
  - install go at correct version for codeql
- updated to rekor 1.3.2 (jsc#SLE-23476):
- updated to rekor 1.3.1 (jsc#SLE-23476):
  New Features:
  - enable GCP cloud profiling on rekor-server (#1746)
  - move index storage into interface (#1741)
  - add info to readme to denote additional documentation sources (#1722)
  - Add type of ed25519 key for TUF (#1677)
  - Allow parsing base64-encoded TUF metadata and root content (#1671)
  Quality Enhancements:
  - disable quota in trillian in test harness (#1680)
  Bug Fixes:
  - Update contact for code of conduct (#1720)
  - Fix panic when parsing SSH SK pubkeys (#1712)
  - Correct index creation (#1708)
  - docs: fixzes a small typo on the readme (#1686)
  - chore: fix backfill-redis Makefile target (#1685)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1706443200">- update to 1.3.4:
  * add mysql indexstorage backend
  * add s3 storage for attestations
  * fix: Do not check for pubsub.topics.get on initialization
  * fix optional field in cose schema
  * Update ranges.go
  * update indexstorage interface to reduce roundtrips
  * use a single validator library in rekor-cli
  * Remove go-playground/validator dependency from pkg/pki</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1707134400">- update to 1.3.5 (jsc#SLE-23476):
  - Additional unique index correction
  - Remove timestamp from checkpoint
  - Drop conditional when verifying entry checkpoint
  - Fix panic for DSSE canonicalization
  - Change Redis value for locking mechanism
  - give log timestamps nanosecond precision
  - output trace in slog and override correlation header name
- bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1721995200">- refactor spec file
- switch to using obs_scm to generate the source obscpio archive
  * this way we do no longer need to hardcode the commit hash
  * and the tarball was never verified anyway</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721995201">- Update to version 1.3.6:
  * New Features
  - Add support for IEEE P1363 encoded ECDSA signatures
  - Add index performance script (#2042)
  - Add support for ed25519ph user keys in hashedrekord (#1945)
  - Add metrics for index insertion (#2015)
  - Add TLS support for Redis Client implementation (#1998)
  * Bug Fixes
  - fix typo in remoteIp and set full name for trace field</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- Update to version 1.3.7:
  * New Features
  - log request body on 500 error to aid debugging (#2283)
  - Add support for signing with Tink keyset (#2228)
  - Add public key hash check in Signed Note verification (#2214)
  - update Trillian TLS configuration (#2202)
  - Add TLS support for Trillian server (#2164)
  - Replace docker-compose with plugin if available (#2153)
  - Add flags to backfill script (#2146)
  - Unset DisableKeepalive for backfill HTTP client (#2137)
  - Add script to delete indexes from Redis (#2120)
  - Run CREATE statement in backfill script (#2109)
  - Add MySQL support to backfill script (#2081)
  - Run e2e tests on mysql and redis index backends (#2079)
  * Bug Fixes
  - remove unneeded value in log message (#2282)
  - Add error message when computing consistency proof (#2278)
  - fix validation error handling on API (#2217)
  - fix error in pretty-printed inclusion proof from verify
    subcommand (#2210)
  - Fix index scripts (#2203)
  - fix failing sharding test
  - Better error handling in backfill script (#2148)
  - Batch entries in cleanup script (#2158)
  - Add missing workflow for index cleanup test (#2121)
  - hashedrekord: fix schema $id (#2092)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737115200">- Update to version 1.3.8:
  * Bug Fixes
  - fix zizmor issues (#2298)
  - remove unneeded value in log message (#2282)
  * Quality Enhancements
  - chore: relax go directive to permit 1.22.x
  - fetch minisign from homebrew instead of custom ppa (#2329)
  - fix(ci): simplify GOVERSION extraction
  - chore(deps): bump actions pins to latest
  - Updates go and golangci-lint (#2302)
  - update builder to use go1.23.4 (#2301)
  - clean up spaces
  - log request body on 500 error to aid debugging (#2283)</changelog>
  <changelog author="meissner@suse.com" date="1738065600">- Update to version 1.3.9 (jsc#SLE-23476):
  * Cache checkpoint for inactive shards (#2332)
  * Support per-shard signing keys (#2330)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744372800">- Update to version 1.3.10:
  * Features
  - Added --client-signing-algorithms flag (#1974)
  * Fixes / Misc
  - emit unpopulated values when marshalling (#2438)
  - pkg/api: better logs when algorithm registry rejects a key
    (#2429)
  - chore: improve mysql readiness checks (#2397)
  - Added --client-signing-algorithms flag (#1974)
  * Security fixes (over the last releases):
  - CVE-2024-6104: rekor: hashicorp/go-retryablehttp: url might write sensitive information to log file (bsc#1227053)
  - CVE-2023-45288: rekor: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236519)
  - CVE-2025-27144: rekor: gopkg.in/go-jose/go-jose.v2,github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237638)
  - CVE-2025-22868: rekor: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239191)
  - CVE-2025-22869: rekor: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239327)
  - CVE-2025-30204: rekor: github.com/golang-jwt/jwt/v5: jwt-go allows excessive memory allocation during header parsing (bsc#1240468)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754222400">- Update to version 1.4.0:
  * changelog for v1.4.0 release (#2550)
  * enable retries and timeouts on GCP KMS calls (#2548)
  * allow configuring gRPC default service config for trillian
    client load balancing &amp; timeouts (#2549)
  * remove stable checkpoint feature (#2537)
  * build(deps): Bump sigs.k8s.io/release-utils from 0.11.1 to
    0.12.0
  * build(deps): Bump golang.org/x/net from 0.41.0 to 0.42.0
    (#2544)
  * build(deps): Bump the all group with 3 updates (#2545)
  * fix lints
  * bump golangci-lint to v2.2.x
  * use go1.24.5 to build rekor
  * build(deps): Bump google.golang.org/api from 0.238.0 to 0.242.0
    (#2543)
  * build(deps): Bump golang.org/x/sync from 0.15.0 to 0.16.0
    (#2541)
  * build(deps): Bump github.com/spf13/pflag in the all group
    (#2542)
  * build(deps): Bump github.com/sigstore/protobuf-specs from 0.4.3
    to 0.5.0
  * move context handling in trillian RPC calls to be request based
    and idiomatic (#2536)
  * build(deps): Bump github.com/go-viper/mapstructure/v2 (#2522)
  * build(deps): Bump golang from 1.24.4 to 1.24.5 in the all group
    (#2534)
  * build(deps): Bump the all group with 2 updates (#2518)
  * build(deps): Bump the all group with 2 updates (#2524)
  * build(deps): Bump sigstore/scaffolding/trillian_log_server
    (#2527)
  * build(deps): Bump sigstore/scaffolding/trillian_log_signer
    (#2526)
  * build(deps): Bump github.com/go-viper/mapstructure/v2 in
    /hack/tools (#2523)
  * backoff pubsub emulator to last-known good (#2535)
  * build(deps): Bump golang from `db5d0af` to `10c1318`
  * build(deps): Bump sigstore/cosign-installer in the all group
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump google.golang.org/api from 0.237.0 to 0.238.0
  * build(deps): Bump go.step.sm/crypto from 0.66.0 to 0.67.0
  * build(deps): Bump github/codeql-action in the all group
  * build(deps): Bump google.golang.org/api from 0.236.0 to 0.237.0
  * build(deps): Bump the all group with 7 updates
  * Update GoReleaser configurations (#2511)
  * update builder to use go1.24.4
  * build(deps): Bump google.golang.org/grpc from 1.72.2 to 1.73.0
  * build(deps): Bump golang.org/x/net from 0.40.0 to 0.41.0
  * build(deps): Bump github.com/redis/go-redis/v9 from 9.9.0 to
    9.10.0
  * build(deps): Bump google.golang.org/api from 0.235.0 to 0.236.0
  * build(deps): Bump golang from 1.24.3 to 1.24.4 in the all group
  * build(deps): Bump github.com/go-swagger/go-swagger
  * build(deps): Bump github/codeql-action in the all group
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump github.com/google/rpmpack from 0.6.0 to 0.7.0
  * build(deps): Bump github.com/redis/go-redis/v9 from 9.8.0 to
    9.9.0
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump go.step.sm/crypto from 0.64.0 to 0.66.0
  * build(deps): Bump google.golang.org/api from 0.234.0 to 0.235.0
  * build(deps): Bump golang from `4c0a181` to `81bf592`
  * build(deps): Bump google.golang.org/api from 0.233.0 to 0.234.0
  * build(deps): Bump golang from `86b4cff` to `4c0a181`
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump google.golang.org/grpc in the all group
  * build(deps): Bump go.step.sm/crypto from 0.63.0 to 0.64.0
  * Don't initialize index storage with stable checkpoint
    publishing (#2486)
  * build(deps): Bump golang from `39d9e7d` to `86b4cff`
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump the all group with 2 updates
  * build(deps): Bump google.golang.org/api from 0.232.0 to 0.233.0
  * build(deps): Bump the all group with 2 updates
  * Fix docker compose up --wait failing when Trillian server isn't
    healthy (#2473)
  * build(deps): Bump golang.org/x/crypto from 0.37.0 to 0.38.0
    (#2477)
  * build(deps): Bump golang.org/x/net from 0.39.0 to 0.40.0
    (#2475)
  * build(deps): Bump golang from 1.24.2 to 1.24.3 in the all group
    (#2480)
  * build(deps): Bump google.golang.org/api from 0.231.0 to 0.232.0
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2478)
  * build(deps): Bump actions/setup-go from 5.4.0 to 5.5.0 in the
    all group (#2474)
  * build(deps): Bump github.com/redis/go-redis/v9 from 9.7.3 to
    9.8.0 (#2470)
  * build(deps): Bump golangci/golangci-lint-action from 7.0.0 to
    8.0.0 (#2471)
  * build(deps): Bump google.golang.org/api from 0.230.0 to 0.231.0
  * build(deps): Bump go.step.sm/crypto from 0.61.0 to 0.63.0
    (#2468)
  * build(deps): Bump github/codeql-action in the all group (#2467)
  * build(deps): Bump golang from `d9db321` to `30baaea` (#2469)
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2466)
  * build(deps): Bump the all group with 2 updates
  * build(deps): Bump google.golang.org/api from 0.229.0 to 0.230.0
  * build(deps): Bump the all group with 3 updates
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2462)
  * Bump sigstore/sigstore, use shared Tink library (#2461)
  * better mysql healthcheck (#2459)
  * build(deps): Bump sigs.k8s.io/release-utils from 0.8.4 to
    0.11.1
  * build(deps): Bump google.golang.org/grpc from 1.71.1 to 1.72.0
  * build(deps): Bump github.com/tink-crypto/tink-go/v2 from 2.3.0
    to 2.4.0
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump golang
  * build(deps): Bump codecov/codecov-action in the all group
  * build(deps): Bump go.step.sm/crypto from 0.60.0 to 0.61.0
  * build(deps): Bump golang.org/x/crypto in /hack/tools
  * update builder image to use go1.24.2
  * build(deps): Bump golang from `991aa6a` to `1ecc479`
  * build(deps): Bump ko-build/setup-ko from 0.8 to 0.9 in the all
    group
  * build(deps): Bump cloud.google.com/go/pubsub from 1.47.0 to
    1.49.0
  * build(deps): Bump github.com/prometheus/client_golang
  * build(deps): Bump the all group with 7 updates
  * build(deps): Bump github.com/spf13/viper from 1.19.0 to 1.20.1
  * Add CHANGELOG for v1.3.10 (#2439)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1756728000">- Update to version 1.4.1 (jsc#SLE-23476)::
  * build(deps): Bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#2596)
    CVE-2025-58058: rekor: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory: (bsc#1248910)
  * build(deps): Bump github.com/redis/go-redis/v9 from 9.11.0 to 9.12.1
    CVE-2025-29923: rekor: github.com/redis/go-redis: potential out of order responses when `CLIENT SETINFO` times out during connection establishment (bsc#1241153)
  * use less expensive gRPC call to implement GetLeafAndProofByHash (#2581)
  * move to per-shard trillian client manager (#2564)
  * use cheaper gRPC endpoint when we already have the inclusion proof (#2580)
  * simplify hash and signature verification in rekord type (#2579)
  * return correct error if GetLeafAndProofByHash fails (#2574)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758196800">- Update to version 1.4.2:
  * build(deps): Bump google-github-actions/auth from 2.1.12 to
    3.0.0 by @dependabot[bot] in #2601
  * build(deps): Bump github/codeql-action from 3.29.11 to 3.30.0
    in the all group by @dependabot[bot] in #2602
  * build(deps): Bump the all group with 3 updates by
    @dependabot[bot] in #2599
  * optimize performance of regex operations by @bobcallaway in
    [#2603]
  * move to direct decoding instead of mapstructure by @bobcallaway
    in #2598
  * build(deps): Bump github.com/go-openapi/swag from 0.23.1 to
    0.24.1 by @dependabot[bot] in #2600
  * build(deps): Bump golang from 1.24.6 to 1.25.0 in the all group
    by @dependabot[bot] in #2587
  * process type contents serially by @bobcallaway in #2604
  * use pubsub client to check IAM permissions by @bobcallaway in
    [#2605]
  * add changelog for v1.4.2 by @bobcallaway in #2606</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380800">- Update to version 1.4.3:
  This release reduces dependencies for a number of exported
  packages.
  This release also changes the format of the binary and container
  signature, which is now a Sigstore bundle. To verify a release,
  use the latest Cosign 3.x, verifying with
    cosign verify-blob --bundle &lt;artifact&gt;-keyless.sigstore.json &lt;artifact&gt;.
  * Improvements
  - use interruptable context to elegantly handle signals in
    rekor-cli (#2681)
  - restapi: Don't log client errors as errors (#2680)
  - pkg: separate pki types from implementations (#2668)
  - e2e: don't mix e2e and regular utilities (#2672)
  - pkg: remove viper config from spec definitions (#2669)
  - log: remove zap &amp; go-chi dependecy from pkg/types (#2667)
  - chore: update go-openapi/runtime to v0.29.0 (#2670)
  - chore: remove double imported mapstructure pkg (#2671)
  - remove archived dependency and use stdlib slices (#2650)
  * Documentation
  - (docs): guard unsafe int/uint conversions flagged by gosec
    (#2679)
  * Dependencies
  - build(deps): Bump actions/setup-go from 5.5.0 to 6.0.0
  - build(deps): Bump actions/upload-artifact from 4.6.2 to 5.0.0
  - build(deps): Bump cloud.google.com/go/pubsub/v2 from 2.0.0 to
    2.3.0 (#2654)
  - build(deps): Bump github.com/go-openapi/loads from 0.22.0 to
    0.23.1 (#2632)
  - build(deps): Bump github.com/go-openapi/swag from 0.24.1 to
    0.25.1 (#2666)
  - build(deps): Bump github.com/go-openapi/swag/conv from 0.24.0
    to 0.25.1 (#2628)
  - build(deps): Bump github.com/go-openapi/validate from 0.24.0
    to 0.25.0 (#2629)
  - build(deps): Bump github.com/go-swagger/go-swagger from
    0.32.3 to 0.33.1 in /hack/tools in the all group (#2643)
  - build(deps): Bump github.com/redis/go-redis/v9 from 9.12.1 to
    9.13.0
  - build(deps): Bump github.com/redis/go-redis/v9 from 9.13.0 to
    9.14.0
  - build(deps): Bump github.com/spf13/cobra from 1.9.1 to 1.10.1
  - build(deps): Bump github.com/spf13/viper from 1.20.1 to
    1.21.0
  - build(deps): Bump github.com/tink-crypto/tink-go/v2 from
    2.4.0 to 2.5.0 (#2661)
  - build(deps): Bump github/codeql-action from 3.30.3 to 4.30.9
    (#2645)
  - build(deps): Bump github/codeql-action in the all group
    (#2659)
  - build(deps): Bump github/codeql-action in the all group
    (#2663)
  - build(deps): Bump go.step.sm/crypto from 0.70.0 to 0.72.0
    (#2651)
  - build(deps): Bump go.step.sm/crypto from 0.73.0 to 0.74.0
    (#2674)
  - build(deps): Bump golang from 1.25.0 to 1.25.1 in the all
    group (#2611)
  - build(deps): Bump golang from 1.25.1 to 1.25.2 in the all
    group (#2644)
  - build(deps): Bump golang from 1.25.2 to 1.25.3 in the all
    group
  - build(deps): Bump golang from 1.25.3 to 1.25.4 in the all
    group (#2675)
  - build(deps): Bump golang from `a5e935d` to `8305f5f`
  - build(deps): Bump golang.org/x/mod from 0.27.0 to 0.28.0
  - build(deps): Bump golang.org/x/mod from 0.28.0 to 0.29.0
    (#2665)
  - build(deps): Bump golang.org/x/net from 0.43.0 to 0.44.0
  - build(deps): Bump golang.org/x/net from 0.44.0 to 0.46.0
    (#2656)
  - build(deps): Bump golang.org/x/sync from 0.16.0 to 0.17.0
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2618)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2642)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2658)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2660)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2676)
  - build(deps): Bump google.golang.org/api from 0.248.0 to
    0.249.0
  - build(deps): Bump google.golang.org/api from 0.249.0 to
    0.252.0 (#2648)
  - build(deps): Bump google.golang.org/api from 0.252.0 to
    0.253.0 (#2653)
  - build(deps): Bump google.golang.org/grpc from 1.75.1 to
    1.76.0 (#2652)
  - build(deps): Bump sigstore/cosign-installer from 3.10.0 to
    4.0.0 (#2646)
  - build(deps): Bump sigstore/scaffolding/trillian_log_server
    (#2636)
  - build(deps): Bump sigstore/scaffolding/trillian_log_server
    (#2678)
  - build(deps): Bump sigstore/scaffolding/trillian_log_signer
    (#2635)
  - build(deps): Bump sigstore/scaffolding/trillian_log_signer
    (#2677)
  - build(deps): Bump the all group across 1 directory with 5
    updates (#2647)
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump the all group with 3 updates
  - build(deps): Bump the all group with 7 updates (#2673)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769083200">- Update to version 1.5.0:
  This release fixes the following security issues:
  - GHSA-4c4x-jm2x-pf9j / CVE-2026-24117 / bsc#1257135: Fixed Server-Side Request Forgery (SSRF) via provided public key URL
  - GHSA-273p-m2cw-6833 / CVE-2026-23831 / bsc#1257132: Fixed  lack of input validation thatg can cause a thread crash
  - GHSA-j5w8-q4qc-rx2x / CVE-2025-58181 / bsc#1253817: Fixed golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption
  Note that this drops support for fetching public keys via URL
  when querying the search API.
  * Vulnerability Fixes
  - Handle malformed COSE and DSSE entries (#2729)
  - Drop support for fetching public keys by URL in the search
    index (#2731)
  * Features
  - Add support for a custom TLS config for clients (#2709)
  * Dependencies
  - build(deps): Bump github.com/redis/go-redis/v9 from 9.14.1 to
    9.17.2 (#2706)
  - build(deps): Bump google.golang.org/api from 0.256.0 to
    0.259.0 (#2723)
  - build(deps): Bump golang.org/x/net from 0.47.0 to 0.48.0
    (#2722)
  - build(deps): Bump github.com/sigstore/sigstore from 1.9.5 to
    1.10.3 (#2724)
  - build(deps): Bump the all group across 1 directory with 3
    updates (#2727)
  - build(deps): Bump the all group with 2 updates (#2728)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2726)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2720)
  - build(deps): Bump
    github.com/sigstore/sigstore/pkg/signature/kms/azure (#2716)
  - build(deps): Bump golang.org/x/sync from 0.18.0 to 0.19.0
    (#2715)
  - build(deps): Bump actions/upload-artifact from 5.0.0 to 6.0.0
    (#2714)
  - build(deps): Bump
    github.com/sigstore/sigstore/pkg/signature/kms/hashivault
    (#2717)
  - build(deps): Bump
    github.com/sigstore/sigstore/pkg/signature/kms/aws (#2718)
  - build(deps): Bump sigstore/scaffolding/trillian_log_signer
    (#2713)
  - build(deps): Bump sigstore/scaffolding/trillian_log_server
    (#2712)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2711)
  - build(deps): Bump the all group across 1 directory with 4
    updates (#2707)
  - build(deps): Bump golang from 1.25.4 to 1.25.5 in the all
    group (#2703)
  - build(deps): Bump the all group across 1 directory with 4
    updates (#2708)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump golang from `e68f6a0` to `6981837`
  - build(deps): Bump sigstore/scaffolding/trillian_log_signer
  - build(deps): Bump sigstore/scaffolding/trillian_log_server
  - build(deps): Bump google.golang.org/api from 0.254.0 to
    0.256.0
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump github/codeql-action in the all group
  - build(deps): Bump the all group with 3 updates (#2692)
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump golangci/golangci-lint-action from 8.0.0 to
    9.1.0
  - build(deps): Bump actions/checkout from 5.0.0 to 6.0.0
  - build(deps): Bump golang.org/x/crypto from 0.43.0 to 0.45.0
  - build(deps): Bump golang.org/x/crypto in /hack/tools
  - build(deps): Bump golang from `6ca9eb0` to `e68f6a0`
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773144000">- Update to version 1.5.1:
  * optimize memory for DSSE v0.0.1 processing (#2766)
  * Type assert the entry bundle when verifying inclusion proof (#2755)
  * return correct errors in rare failure situations (#2753)
  * raise error if decoding hash fails during inclusion proof (#2754)
  * Dependencies
  - build(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#2773)
  - build(deps): Bump google.golang.org/api from 0.264.0 to
    0.269.0 (#2770)
  - build(deps): Bump github/codeql-action in the all group
    (#2772)
  - build(deps): Bump github.com/redis/go-redis/v9 from 9.17.3 to
    9.18.0 (#2769)
  - build(deps): Bump the all group with 11 updates (#2768)
  - build(deps): Bump gocloud.dev from 0.40.0 to 0.44.0 (#2757)
  - build(deps): Bump go.step.sm/crypto from 0.74.0 to 0.76.2
    (#2760)
  - build(deps): Bump
    github.com/secure-systems-lab/go-securesystemslib (#2758)
  - build(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0 (#2763)
  - build(deps): Bump the all group across 1 directory with 2
    updates (#2764)
  - build(deps): Bump github.com/tink-crypto/tink-go/v2 from
    2.5.0 to 2.6.0 (#2761)
  - build(deps): Bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
  - build(deps): Bump golang.org/x/crypto from 0.47.0 to 0.48.0
  - build(deps): Bump golang.org/x/mod from 0.31.0 to 0.33.0
  - build(deps): Bump cloud.google.com/go/pubsub/v2 from 2.3.0 to
    2.4.0
  - build(deps): Bump google.golang.org/grpc from 1.78.0 to
    1.79.1
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump github/codeql-action in the all group
  - update golang builder to use go1.25.7 (#2702)
  - build(deps): Bump github/codeql-action in the all group
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump golang from 1.25.6 to 1.25.7 in the all
    group
  - build(deps): Bump the all group across 1 directory with 5
    updates
  - build(deps): Bump github.com/sigstore/sigstore from 1.10.3 to
    1.10.4 (#2732)
  - build(deps): Bump the all group with 2 updates (#2737)
  - build(deps): Bump golang.org/x/net from 0.48.0 to 0.49.0
    (#2738)
  - build(deps): Bump
    github.com/sigstore/sigstore/pkg/signature/kms/gcp (#2739)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2740)
  - build(deps): Bump golang from 1.25.5 to 1.25.6 in the all
    group (#2733)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2734)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 1.5.2:
  * build(deps): Bump the all group across 1 directory with 7
    updates (#2829)
  * alpine: Enforce max size limit on decompression (#2831)
  * Support restricting kinds on insertion (#2814)
  * fix(trillianclient): strip dns:/// scheme from TLS ServerName
    in gRPC dial (#2812)
  * build(deps): Bump cloud.google.com/go/profiler from 0.4.3 to
    0.6.0
  * build(deps): Bump go.uber.org/zap from 1.27.1 to 1.28.0
  * build(deps): Bump golang in the all group across 1 directory
  * build(deps): Bump github.com/go-openapi/swag from 0.25.5 to
    0.26.0
  * build(deps): Bump github.com/tink-crypto/tink-go-awskms/v2 to
    v3 (#2827)
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2820)
  * fix fuzz build failures and crashes (#2824)
  * increase fuzz duration to address build timeouts (#2822)
  * fuzzing updates (#2815)
  * build(deps): Bump cloud.google.com/go/pubsub/v2 from 2.4.0 to
    2.6.0 (#2810)
  * build(deps): Bump golang from 1.25.7 to 1.26.0 in the all group
    (#2746)
  * build(deps): Bump
    github.com/secure-systems-lab/go-securesystemslib (#2809)
  * build(deps): Bump go.step.sm/crypto from 0.76.2 to 0.77.7
    (#2811)
  * add checks to ensure returned entries match client inputs to
    rekor-cli (#2799)
  * add nil pointer check to resolve fuzzing crash (#2807)
  * build(deps): Bump golang.org/x/net from 0.52.0 to 0.53.0
    (#2804)
  * client: surface last-response details after retries are
    exhausted (#2796)
  * build(deps): Bump the all group with 2 updates (#2802)
  * build(deps): Bump github/codeql-action in the all group (#2803)
  * Fix internal error detail leakage in 500 responses (#2801)
  * add defensive check to ensure tid is in config ahead of getting
    client (#2795)
  * restapi: include inactiveShards in the homepage total count
    (#2797)
  * build(deps): Bump the all group with 5 updates (#2794)
  * build(deps): Bump actions/upload-artifact in the all group
  * add generated files to pr
  * build(deps): Bump github.com/go-swagger/go-swagger
  * build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * build(deps): Bump go.opentelemetry.io/otel/sdk from 1.42.0 to
    1.43.0
  * build(deps): Bump google.golang.org/api from 0.269.0 to 0.271.0
    (#2781)
  * build(deps): Bump golang.org/x/net from 0.50.0 to 0.52.0
    (#2780)
  * build(deps): Bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#2789)
  * build(deps): Bump golang.org/x/sync from 0.19.0 to 0.20.0
    (#2771)
  * build(deps): Bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4 (#2788)
  * Add changelog for v1.5.1 (#2774)
  * build(deps): Bump the all group across 1 directory with 3
    updates
  * build(deps): Bump the all group across 1 directory with 7
    updates</changelog>
</package>
<package pkgid="b7ff37a5fa692a16264672ad3a73e45daf6dabdfa239ff60243ed229637c6d627c7316e2be9e5cc92e067dead3972a98fde7024d1bb6d46fc8ba7a6c69fb50e9" name="rekor-debuginfo" arch="s390x">
  <version epoch="0" ver="1.5.2" rel="70.7"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1680696000">- updated to rekor 1.1.0 (jsc#SLE-23476):
  Functional Enhancements
  - improve validation on intoto v0.0.2 type (#1351)
  - add feature to limit HTTP request body length to process (#1334)
  - add information about the file size limit (#1313)
  - Add script to backfill Redis from Rekor (#1163)
  - Feature: add search support for sha512 (#1142)
  Quality Enhancements
  - various fuzzing fixes
  Bug Fixes
  - remove goroutine usage from SearchLogQuery (#1407)
  - drop log messages regarding attestation storage to debug (#1408)
  - fix validation for proposed vs committed log entries for intoto v0.0.1 (#1309)
  - fix: fix regex for multi-digit counts (#1321)
  - return NotFound if treesize is 0 rather than calling trillian (#1311)
  - enumerate slice to get sugared logs (#1312)
  - put a reasonable size limit on ssh key reader (#1288)
  - CLIENT: Fix Custom Host and Path Issue (#1306)
  - do not persist local state if log is empty; fail consistency proofs from 0 size (#1290)
  - correctly handle invalid or missing pki format (#1281)
  - Add Verifier to get public key/cert and identities for entry type (#1210)
  - fix goroutine leak in client; add insecure TLS option (#1238)
  - Fix - Remove the force-recreate flag (#1179)
  - trim whitespace around public keys before parsing (#1175)
  - stop inserting envelope hash for intoto:0.0.2 types into index (#1171)
  - Revert "remove double encoding of payload and signature fields for intoto (#1150)" (#1158)
  - remove double encoding of payload and signature fields for intoto (#1150)
  - fix SearchLogQuery behavior to conform to openapi spec (#1145)
  - Remove pem-certificate-chain from client (#1138)
  - fix flag type for operator in search (#1136)
  - use sigstore/community dep review (#1132)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1683115200">- updated to rekor 1.1.1 (jsc#SLE-23476):
  Functional Enhancements
  - Refactor Trillian client with exported methods (#1454)
  - Switch to official redis-go client (#1459)
  - Remove replace in go.mod (#1444)
  - Add Rekor OID info. (#1390)
  Quality Enhancements
  - remove legacy encrypted cosign key (#1446)
  - swap cjson dependency (#1441)
  - Update release readme (#1456)
  Security fixes:
  - CVE-2023-30551: Fixed a potential denial of service (out of memory)
    when processing JAR META-INF files or .SIGN/.PKINFO files in APK files.
    (bsc#1211210 https://github.com/advisories/GHSA-2h5h-59f5-c5x9)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1685448000">- updated to rekor 1.2.1 (jsc#SLE-23476):
  Security fix:
  - CVE-2023-33199: Fixed that malformed proposed intoto v0.0.2 entries can cause a panic (bsc#1211790)
  Functional Enhancements
  - add client method to generate TLE struct (#1498)
  - add dsse type (#1487)
  - support other KMS providers (AWS, Azure, Hashicorp) in addition to GCP (#1488)
  - Add concurrency to backfill-redis (#1504)
  - omit informational message if machine-parseable output has been requested (#1486)
  - Publish stable checkpoint periodically to Redis (#1461)
  - Add intoto v0.0.2 to backfill script (#1500)
  - add new method to test insertability of proposed entries into log (#1410)
  Quality Enhancements
  - use t.Skip() in fuzzers (#1506)
  - improve fuzzing coverage (#1499)
  - Remove watcher script (#1484)
  Bug Fixes
  - Merge pull request from GHSA-frqx-jfcm-6jjr (CVE-2023-33199)
  - Remove requirement of PayloadHash for intoto 0.0.1 (#1490)
  - fix lint errors, bump linter up to 1.52 (#1485)
  - Remove dependencies from pkg/util (#1469)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1693569600">- updated to rekor 1.3.0 (jsc#SLE-23476):
  - Update openapi.yaml (#1655)
  - pass transient errors through retrieveLogEntry (#1653)
  - return full entryID on HTTP 409 responses (#1650)
  - feat: Support publishing new log entries to Pub/Sub topics (#1580)
  - Change values of Identity.Raw, add fingerprints (#1628)
  - Extract all subjects from SANs for x509 verifier (#1632)
  - Fix type comment for Identity struct (#1619)
  - Refactor Identities API (#1611)
  - Refactor Verifiers to return multiple keys (#1601)
  - Update checkpoint link (#1597)
  - Use correct log index in inclusion proof (#1599)
  - remove instrumentation library (#1595)
- updated to rekor 1.2.2 (jsc#SLE-23476):
  - pass down error with message instead of nil
  - swap killswitch for 'docker-compose restart'</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1700827200">- updated to rekor 1.3.3 (jsc#SLE-23476):
  - Update signer flag description
  - update trillian to 1.5.3
  - adds redis_auth
  - Add method to get artifact hash for an entry
  - make e2e tests more usable with docker-compose
  - install go at correct version for codeql
- updated to rekor 1.3.2 (jsc#SLE-23476):
- updated to rekor 1.3.1 (jsc#SLE-23476):
  New Features:
  - enable GCP cloud profiling on rekor-server (#1746)
  - move index storage into interface (#1741)
  - add info to readme to denote additional documentation sources (#1722)
  - Add type of ed25519 key for TUF (#1677)
  - Allow parsing base64-encoded TUF metadata and root content (#1671)
  Quality Enhancements:
  - disable quota in trillian in test harness (#1680)
  Bug Fixes:
  - Update contact for code of conduct (#1720)
  - Fix panic when parsing SSH SK pubkeys (#1712)
  - Correct index creation (#1708)
  - docs: fixzes a small typo on the readme (#1686)
  - chore: fix backfill-redis Makefile target (#1685)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1706443200">- update to 1.3.4:
  * add mysql indexstorage backend
  * add s3 storage for attestations
  * fix: Do not check for pubsub.topics.get on initialization
  * fix optional field in cose schema
  * Update ranges.go
  * update indexstorage interface to reduce roundtrips
  * use a single validator library in rekor-cli
  * Remove go-playground/validator dependency from pkg/pki</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1707134400">- update to 1.3.5 (jsc#SLE-23476):
  - Additional unique index correction
  - Remove timestamp from checkpoint
  - Drop conditional when verifying entry checkpoint
  - Fix panic for DSSE canonicalization
  - Change Redis value for locking mechanism
  - give log timestamps nanosecond precision
  - output trace in slog and override correlation header name
- bumped embedded golang.org/x/crypto/ssh to fix the Terrapin attack CVE-2023-48795 (bsc#1218207)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1721995200">- refactor spec file
- switch to using obs_scm to generate the source obscpio archive
  * this way we do no longer need to hardcode the commit hash
  * and the tarball was never verified anyway</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1721995201">- Update to version 1.3.6:
  * New Features
  - Add support for IEEE P1363 encoded ECDSA signatures
  - Add index performance script (#2042)
  - Add support for ed25519ph user keys in hashedrekord (#1945)
  - Add metrics for index insertion (#2015)
  - Add TLS support for Redis Client implementation (#1998)
  * Bug Fixes
  - fix typo in remoteIp and set full name for trace field</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1732276800">- Update to version 1.3.7:
  * New Features
  - log request body on 500 error to aid debugging (#2283)
  - Add support for signing with Tink keyset (#2228)
  - Add public key hash check in Signed Note verification (#2214)
  - update Trillian TLS configuration (#2202)
  - Add TLS support for Trillian server (#2164)
  - Replace docker-compose with plugin if available (#2153)
  - Add flags to backfill script (#2146)
  - Unset DisableKeepalive for backfill HTTP client (#2137)
  - Add script to delete indexes from Redis (#2120)
  - Run CREATE statement in backfill script (#2109)
  - Add MySQL support to backfill script (#2081)
  - Run e2e tests on mysql and redis index backends (#2079)
  * Bug Fixes
  - remove unneeded value in log message (#2282)
  - Add error message when computing consistency proof (#2278)
  - fix validation error handling on API (#2217)
  - fix error in pretty-printed inclusion proof from verify
    subcommand (#2210)
  - Fix index scripts (#2203)
  - fix failing sharding test
  - Better error handling in backfill script (#2148)
  - Batch entries in cleanup script (#2158)
  - Add missing workflow for index cleanup test (#2121)
  - hashedrekord: fix schema $id (#2092)</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737115200">- Update to version 1.3.8:
  * Bug Fixes
  - fix zizmor issues (#2298)
  - remove unneeded value in log message (#2282)
  * Quality Enhancements
  - chore: relax go directive to permit 1.22.x
  - fetch minisign from homebrew instead of custom ppa (#2329)
  - fix(ci): simplify GOVERSION extraction
  - chore(deps): bump actions pins to latest
  - Updates go and golangci-lint (#2302)
  - update builder to use go1.23.4 (#2301)
  - clean up spaces
  - log request body on 500 error to aid debugging (#2283)</changelog>
  <changelog author="meissner@suse.com" date="1738065600">- Update to version 1.3.9 (jsc#SLE-23476):
  * Cache checkpoint for inactive shards (#2332)
  * Support per-shard signing keys (#2330)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744372800">- Update to version 1.3.10:
  * Features
  - Added --client-signing-algorithms flag (#1974)
  * Fixes / Misc
  - emit unpopulated values when marshalling (#2438)
  - pkg/api: better logs when algorithm registry rejects a key
    (#2429)
  - chore: improve mysql readiness checks (#2397)
  - Added --client-signing-algorithms flag (#1974)
  * Security fixes (over the last releases):
  - CVE-2024-6104: rekor: hashicorp/go-retryablehttp: url might write sensitive information to log file (bsc#1227053)
  - CVE-2023-45288: rekor: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236519)
  - CVE-2025-27144: rekor: gopkg.in/go-jose/go-jose.v2,github.com/go-jose/go-jose/v4,github.com/go-jose/go-jose/v3: Go JOSE's Parsing Vulnerable to Denial of Service (bsc#1237638)
  - CVE-2025-22868: rekor: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239191)
  - CVE-2025-22869: rekor: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239327)
  - CVE-2025-30204: rekor: github.com/golang-jwt/jwt/v5: jwt-go allows excessive memory allocation during header parsing (bsc#1240468)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1754222400">- Update to version 1.4.0:
  * changelog for v1.4.0 release (#2550)
  * enable retries and timeouts on GCP KMS calls (#2548)
  * allow configuring gRPC default service config for trillian
    client load balancing &amp; timeouts (#2549)
  * remove stable checkpoint feature (#2537)
  * build(deps): Bump sigs.k8s.io/release-utils from 0.11.1 to
    0.12.0
  * build(deps): Bump golang.org/x/net from 0.41.0 to 0.42.0
    (#2544)
  * build(deps): Bump the all group with 3 updates (#2545)
  * fix lints
  * bump golangci-lint to v2.2.x
  * use go1.24.5 to build rekor
  * build(deps): Bump google.golang.org/api from 0.238.0 to 0.242.0
    (#2543)
  * build(deps): Bump golang.org/x/sync from 0.15.0 to 0.16.0
    (#2541)
  * build(deps): Bump github.com/spf13/pflag in the all group
    (#2542)
  * build(deps): Bump github.com/sigstore/protobuf-specs from 0.4.3
    to 0.5.0
  * move context handling in trillian RPC calls to be request based
    and idiomatic (#2536)
  * build(deps): Bump github.com/go-viper/mapstructure/v2 (#2522)
  * build(deps): Bump golang from 1.24.4 to 1.24.5 in the all group
    (#2534)
  * build(deps): Bump the all group with 2 updates (#2518)
  * build(deps): Bump the all group with 2 updates (#2524)
  * build(deps): Bump sigstore/scaffolding/trillian_log_server
    (#2527)
  * build(deps): Bump sigstore/scaffolding/trillian_log_signer
    (#2526)
  * build(deps): Bump github.com/go-viper/mapstructure/v2 in
    /hack/tools (#2523)
  * backoff pubsub emulator to last-known good (#2535)
  * build(deps): Bump golang from `db5d0af` to `10c1318`
  * build(deps): Bump sigstore/cosign-installer in the all group
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump google.golang.org/api from 0.237.0 to 0.238.0
  * build(deps): Bump go.step.sm/crypto from 0.66.0 to 0.67.0
  * build(deps): Bump github/codeql-action in the all group
  * build(deps): Bump google.golang.org/api from 0.236.0 to 0.237.0
  * build(deps): Bump the all group with 7 updates
  * Update GoReleaser configurations (#2511)
  * update builder to use go1.24.4
  * build(deps): Bump google.golang.org/grpc from 1.72.2 to 1.73.0
  * build(deps): Bump golang.org/x/net from 0.40.0 to 0.41.0
  * build(deps): Bump github.com/redis/go-redis/v9 from 9.9.0 to
    9.10.0
  * build(deps): Bump google.golang.org/api from 0.235.0 to 0.236.0
  * build(deps): Bump golang from 1.24.3 to 1.24.4 in the all group
  * build(deps): Bump github.com/go-swagger/go-swagger
  * build(deps): Bump github/codeql-action in the all group
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump github.com/google/rpmpack from 0.6.0 to 0.7.0
  * build(deps): Bump github.com/redis/go-redis/v9 from 9.8.0 to
    9.9.0
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump go.step.sm/crypto from 0.64.0 to 0.66.0
  * build(deps): Bump google.golang.org/api from 0.234.0 to 0.235.0
  * build(deps): Bump golang from `4c0a181` to `81bf592`
  * build(deps): Bump google.golang.org/api from 0.233.0 to 0.234.0
  * build(deps): Bump golang from `86b4cff` to `4c0a181`
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump google.golang.org/grpc in the all group
  * build(deps): Bump go.step.sm/crypto from 0.63.0 to 0.64.0
  * Don't initialize index storage with stable checkpoint
    publishing (#2486)
  * build(deps): Bump golang from `39d9e7d` to `86b4cff`
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump the all group with 2 updates
  * build(deps): Bump google.golang.org/api from 0.232.0 to 0.233.0
  * build(deps): Bump the all group with 2 updates
  * Fix docker compose up --wait failing when Trillian server isn't
    healthy (#2473)
  * build(deps): Bump golang.org/x/crypto from 0.37.0 to 0.38.0
    (#2477)
  * build(deps): Bump golang.org/x/net from 0.39.0 to 0.40.0
    (#2475)
  * build(deps): Bump golang from 1.24.2 to 1.24.3 in the all group
    (#2480)
  * build(deps): Bump google.golang.org/api from 0.231.0 to 0.232.0
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2478)
  * build(deps): Bump actions/setup-go from 5.4.0 to 5.5.0 in the
    all group (#2474)
  * build(deps): Bump github.com/redis/go-redis/v9 from 9.7.3 to
    9.8.0 (#2470)
  * build(deps): Bump golangci/golangci-lint-action from 7.0.0 to
    8.0.0 (#2471)
  * build(deps): Bump google.golang.org/api from 0.230.0 to 0.231.0
  * build(deps): Bump go.step.sm/crypto from 0.61.0 to 0.63.0
    (#2468)
  * build(deps): Bump github/codeql-action in the all group (#2467)
  * build(deps): Bump golang from `d9db321` to `30baaea` (#2469)
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2466)
  * build(deps): Bump the all group with 2 updates
  * build(deps): Bump google.golang.org/api from 0.229.0 to 0.230.0
  * build(deps): Bump the all group with 3 updates
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2462)
  * Bump sigstore/sigstore, use shared Tink library (#2461)
  * better mysql healthcheck (#2459)
  * build(deps): Bump sigs.k8s.io/release-utils from 0.8.4 to
    0.11.1
  * build(deps): Bump google.golang.org/grpc from 1.71.1 to 1.72.0
  * build(deps): Bump github.com/tink-crypto/tink-go/v2 from 2.3.0
    to 2.4.0
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  * build(deps): Bump golang
  * build(deps): Bump codecov/codecov-action in the all group
  * build(deps): Bump go.step.sm/crypto from 0.60.0 to 0.61.0
  * build(deps): Bump golang.org/x/crypto in /hack/tools
  * update builder image to use go1.24.2
  * build(deps): Bump golang from `991aa6a` to `1ecc479`
  * build(deps): Bump ko-build/setup-ko from 0.8 to 0.9 in the all
    group
  * build(deps): Bump cloud.google.com/go/pubsub from 1.47.0 to
    1.49.0
  * build(deps): Bump github.com/prometheus/client_golang
  * build(deps): Bump the all group with 7 updates
  * build(deps): Bump github.com/spf13/viper from 1.19.0 to 1.20.1
  * Add CHANGELOG for v1.3.10 (#2439)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1756728000">- Update to version 1.4.1 (jsc#SLE-23476)::
  * build(deps): Bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#2596)
    CVE-2025-58058: rekor: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory: (bsc#1248910)
  * build(deps): Bump github.com/redis/go-redis/v9 from 9.11.0 to 9.12.1
    CVE-2025-29923: rekor: github.com/redis/go-redis: potential out of order responses when `CLIENT SETINFO` times out during connection establishment (bsc#1241153)
  * use less expensive gRPC call to implement GetLeafAndProofByHash (#2581)
  * move to per-shard trillian client manager (#2564)
  * use cheaper gRPC endpoint when we already have the inclusion proof (#2580)
  * simplify hash and signature verification in rekord type (#2579)
  * return correct error if GetLeafAndProofByHash fails (#2574)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1758196800">- Update to version 1.4.2:
  * build(deps): Bump google-github-actions/auth from 2.1.12 to
    3.0.0 by @dependabot[bot] in #2601
  * build(deps): Bump github/codeql-action from 3.29.11 to 3.30.0
    in the all group by @dependabot[bot] in #2602
  * build(deps): Bump the all group with 3 updates by
    @dependabot[bot] in #2599
  * optimize performance of regex operations by @bobcallaway in
    [#2603]
  * move to direct decoding instead of mapstructure by @bobcallaway
    in #2598
  * build(deps): Bump github.com/go-openapi/swag from 0.23.1 to
    0.24.1 by @dependabot[bot] in #2600
  * build(deps): Bump golang from 1.24.6 to 1.25.0 in the all group
    by @dependabot[bot] in #2587
  * process type contents serially by @bobcallaway in #2604
  * use pubsub client to check IAM permissions by @bobcallaway in
    [#2605]
  * add changelog for v1.4.2 by @bobcallaway in #2606</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1763380800">- Update to version 1.4.3:
  This release reduces dependencies for a number of exported
  packages.
  This release also changes the format of the binary and container
  signature, which is now a Sigstore bundle. To verify a release,
  use the latest Cosign 3.x, verifying with
    cosign verify-blob --bundle &lt;artifact&gt;-keyless.sigstore.json &lt;artifact&gt;.
  * Improvements
  - use interruptable context to elegantly handle signals in
    rekor-cli (#2681)
  - restapi: Don't log client errors as errors (#2680)
  - pkg: separate pki types from implementations (#2668)
  - e2e: don't mix e2e and regular utilities (#2672)
  - pkg: remove viper config from spec definitions (#2669)
  - log: remove zap &amp; go-chi dependecy from pkg/types (#2667)
  - chore: update go-openapi/runtime to v0.29.0 (#2670)
  - chore: remove double imported mapstructure pkg (#2671)
  - remove archived dependency and use stdlib slices (#2650)
  * Documentation
  - (docs): guard unsafe int/uint conversions flagged by gosec
    (#2679)
  * Dependencies
  - build(deps): Bump actions/setup-go from 5.5.0 to 6.0.0
  - build(deps): Bump actions/upload-artifact from 4.6.2 to 5.0.0
  - build(deps): Bump cloud.google.com/go/pubsub/v2 from 2.0.0 to
    2.3.0 (#2654)
  - build(deps): Bump github.com/go-openapi/loads from 0.22.0 to
    0.23.1 (#2632)
  - build(deps): Bump github.com/go-openapi/swag from 0.24.1 to
    0.25.1 (#2666)
  - build(deps): Bump github.com/go-openapi/swag/conv from 0.24.0
    to 0.25.1 (#2628)
  - build(deps): Bump github.com/go-openapi/validate from 0.24.0
    to 0.25.0 (#2629)
  - build(deps): Bump github.com/go-swagger/go-swagger from
    0.32.3 to 0.33.1 in /hack/tools in the all group (#2643)
  - build(deps): Bump github.com/redis/go-redis/v9 from 9.12.1 to
    9.13.0
  - build(deps): Bump github.com/redis/go-redis/v9 from 9.13.0 to
    9.14.0
  - build(deps): Bump github.com/spf13/cobra from 1.9.1 to 1.10.1
  - build(deps): Bump github.com/spf13/viper from 1.20.1 to
    1.21.0
  - build(deps): Bump github.com/tink-crypto/tink-go/v2 from
    2.4.0 to 2.5.0 (#2661)
  - build(deps): Bump github/codeql-action from 3.30.3 to 4.30.9
    (#2645)
  - build(deps): Bump github/codeql-action in the all group
    (#2659)
  - build(deps): Bump github/codeql-action in the all group
    (#2663)
  - build(deps): Bump go.step.sm/crypto from 0.70.0 to 0.72.0
    (#2651)
  - build(deps): Bump go.step.sm/crypto from 0.73.0 to 0.74.0
    (#2674)
  - build(deps): Bump golang from 1.25.0 to 1.25.1 in the all
    group (#2611)
  - build(deps): Bump golang from 1.25.1 to 1.25.2 in the all
    group (#2644)
  - build(deps): Bump golang from 1.25.2 to 1.25.3 in the all
    group
  - build(deps): Bump golang from 1.25.3 to 1.25.4 in the all
    group (#2675)
  - build(deps): Bump golang from `a5e935d` to `8305f5f`
  - build(deps): Bump golang.org/x/mod from 0.27.0 to 0.28.0
  - build(deps): Bump golang.org/x/mod from 0.28.0 to 0.29.0
    (#2665)
  - build(deps): Bump golang.org/x/net from 0.43.0 to 0.44.0
  - build(deps): Bump golang.org/x/net from 0.44.0 to 0.46.0
    (#2656)
  - build(deps): Bump golang.org/x/sync from 0.16.0 to 0.17.0
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2618)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2642)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2658)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2660)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2676)
  - build(deps): Bump google.golang.org/api from 0.248.0 to
    0.249.0
  - build(deps): Bump google.golang.org/api from 0.249.0 to
    0.252.0 (#2648)
  - build(deps): Bump google.golang.org/api from 0.252.0 to
    0.253.0 (#2653)
  - build(deps): Bump google.golang.org/grpc from 1.75.1 to
    1.76.0 (#2652)
  - build(deps): Bump sigstore/cosign-installer from 3.10.0 to
    4.0.0 (#2646)
  - build(deps): Bump sigstore/scaffolding/trillian_log_server
    (#2636)
  - build(deps): Bump sigstore/scaffolding/trillian_log_server
    (#2678)
  - build(deps): Bump sigstore/scaffolding/trillian_log_signer
    (#2635)
  - build(deps): Bump sigstore/scaffolding/trillian_log_signer
    (#2677)
  - build(deps): Bump the all group across 1 directory with 5
    updates (#2647)
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump the all group with 3 updates
  - build(deps): Bump the all group with 7 updates (#2673)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1769083200">- Update to version 1.5.0:
  This release fixes the following security issues:
  - GHSA-4c4x-jm2x-pf9j / CVE-2026-24117 / bsc#1257135: Fixed Server-Side Request Forgery (SSRF) via provided public key URL
  - GHSA-273p-m2cw-6833 / CVE-2026-23831 / bsc#1257132: Fixed  lack of input validation thatg can cause a thread crash
  - GHSA-j5w8-q4qc-rx2x / CVE-2025-58181 / bsc#1253817: Fixed golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption
  Note that this drops support for fetching public keys via URL
  when querying the search API.
  * Vulnerability Fixes
  - Handle malformed COSE and DSSE entries (#2729)
  - Drop support for fetching public keys by URL in the search
    index (#2731)
  * Features
  - Add support for a custom TLS config for clients (#2709)
  * Dependencies
  - build(deps): Bump github.com/redis/go-redis/v9 from 9.14.1 to
    9.17.2 (#2706)
  - build(deps): Bump google.golang.org/api from 0.256.0 to
    0.259.0 (#2723)
  - build(deps): Bump golang.org/x/net from 0.47.0 to 0.48.0
    (#2722)
  - build(deps): Bump github.com/sigstore/sigstore from 1.9.5 to
    1.10.3 (#2724)
  - build(deps): Bump the all group across 1 directory with 3
    updates (#2727)
  - build(deps): Bump the all group with 2 updates (#2728)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2726)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2720)
  - build(deps): Bump
    github.com/sigstore/sigstore/pkg/signature/kms/azure (#2716)
  - build(deps): Bump golang.org/x/sync from 0.18.0 to 0.19.0
    (#2715)
  - build(deps): Bump actions/upload-artifact from 5.0.0 to 6.0.0
    (#2714)
  - build(deps): Bump
    github.com/sigstore/sigstore/pkg/signature/kms/hashivault
    (#2717)
  - build(deps): Bump
    github.com/sigstore/sigstore/pkg/signature/kms/aws (#2718)
  - build(deps): Bump sigstore/scaffolding/trillian_log_signer
    (#2713)
  - build(deps): Bump sigstore/scaffolding/trillian_log_server
    (#2712)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2711)
  - build(deps): Bump the all group across 1 directory with 4
    updates (#2707)
  - build(deps): Bump golang from 1.25.4 to 1.25.5 in the all
    group (#2703)
  - build(deps): Bump the all group across 1 directory with 4
    updates (#2708)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump golang from `e68f6a0` to `6981837`
  - build(deps): Bump sigstore/scaffolding/trillian_log_signer
  - build(deps): Bump sigstore/scaffolding/trillian_log_server
  - build(deps): Bump google.golang.org/api from 0.254.0 to
    0.256.0
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump github/codeql-action in the all group
  - build(deps): Bump the all group with 3 updates (#2692)
  - build(deps): Bump the all group with 2 updates
  - build(deps): Bump golangci/golangci-lint-action from 8.0.0 to
    9.1.0
  - build(deps): Bump actions/checkout from 5.0.0 to 6.0.0
  - build(deps): Bump golang.org/x/crypto from 0.43.0 to 0.45.0
  - build(deps): Bump golang.org/x/crypto in /hack/tools
  - build(deps): Bump golang from `6ca9eb0` to `e68f6a0`
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773144000">- Update to version 1.5.1:
  * optimize memory for DSSE v0.0.1 processing (#2766)
  * Type assert the entry bundle when verifying inclusion proof (#2755)
  * return correct errors in rare failure situations (#2753)
  * raise error if decoding hash fails during inclusion proof (#2754)
  * Dependencies
  - build(deps): Bump actions/upload-artifact from 6.0.0 to 7.0.0
    (#2773)
  - build(deps): Bump google.golang.org/api from 0.264.0 to
    0.269.0 (#2770)
  - build(deps): Bump github/codeql-action in the all group
    (#2772)
  - build(deps): Bump github.com/redis/go-redis/v9 from 9.17.3 to
    9.18.0 (#2769)
  - build(deps): Bump the all group with 11 updates (#2768)
  - build(deps): Bump gocloud.dev from 0.40.0 to 0.44.0 (#2757)
  - build(deps): Bump go.step.sm/crypto from 0.74.0 to 0.76.2
    (#2760)
  - build(deps): Bump
    github.com/secure-systems-lab/go-securesystemslib (#2758)
  - build(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0 (#2763)
  - build(deps): Bump the all group across 1 directory with 2
    updates (#2764)
  - build(deps): Bump github.com/tink-crypto/tink-go/v2 from
    2.5.0 to 2.6.0 (#2761)
  - build(deps): Bump filippo.io/edwards25519 from 1.1.0 to 1.1.1
  - build(deps): Bump golang.org/x/crypto from 0.47.0 to 0.48.0
  - build(deps): Bump golang.org/x/mod from 0.31.0 to 0.33.0
  - build(deps): Bump cloud.google.com/go/pubsub/v2 from 2.3.0 to
    2.4.0
  - build(deps): Bump google.golang.org/grpc from 1.78.0 to
    1.79.1
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump github/codeql-action in the all group
  - update golang builder to use go1.25.7 (#2702)
  - build(deps): Bump github/codeql-action in the all group
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
  - build(deps): Bump golang from 1.25.6 to 1.25.7 in the all
    group
  - build(deps): Bump the all group across 1 directory with 5
    updates
  - build(deps): Bump github.com/sigstore/sigstore from 1.10.3 to
    1.10.4 (#2732)
  - build(deps): Bump the all group with 2 updates (#2737)
  - build(deps): Bump golang.org/x/net from 0.48.0 to 0.49.0
    (#2738)
  - build(deps): Bump
    github.com/sigstore/sigstore/pkg/signature/kms/gcp (#2739)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2740)
  - build(deps): Bump golang from 1.25.5 to 1.25.6 in the all
    group (#2733)
  - build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2734)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1780056000">- Update to version 1.5.2:
  * build(deps): Bump the all group across 1 directory with 7
    updates (#2829)
  * alpine: Enforce max size limit on decompression (#2831)
  * Support restricting kinds on insertion (#2814)
  * fix(trillianclient): strip dns:/// scheme from TLS ServerName
    in gRPC dial (#2812)
  * build(deps): Bump cloud.google.com/go/profiler from 0.4.3 to
    0.6.0
  * build(deps): Bump go.uber.org/zap from 1.27.1 to 1.28.0
  * build(deps): Bump golang in the all group across 1 directory
  * build(deps): Bump github.com/go-openapi/swag from 0.25.5 to
    0.26.0
  * build(deps): Bump github.com/tink-crypto/tink-go-awskms/v2 to
    v3 (#2827)
  * build(deps): Bump google.com/cloudsdktool/google-cloud-cli
    (#2820)
  * fix fuzz build failures and crashes (#2824)
  * increase fuzz duration to address build timeouts (#2822)
  * fuzzing updates (#2815)
  * build(deps): Bump cloud.google.com/go/pubsub/v2 from 2.4.0 to
    2.6.0 (#2810)
  * build(deps): Bump golang from 1.25.7 to 1.26.0 in the all group
    (#2746)
  * build(deps): Bump
    github.com/secure-systems-lab/go-securesystemslib (#2809)
  * build(deps): Bump go.step.sm/crypto from 0.76.2 to 0.77.7
    (#2811)
  * add checks to ensure returned entries match client inputs to
    rekor-cli (#2799)
  * add nil pointer check to resolve fuzzing crash (#2807)
  * build(deps): Bump golang.org/x/net from 0.52.0 to 0.53.0
    (#2804)
  * client: surface last-response details after retries are
    exhausted (#2796)
  * build(deps): Bump the all group with 2 updates (#2802)
  * build(deps): Bump github/codeql-action in the all group (#2803)
  * Fix internal error detail leakage in 500 responses (#2801)
  * add defensive check to ensure tid is in config ahead of getting
    client (#2795)
  * restapi: include inactiveShards in the homepage total count
    (#2797)
  * build(deps): Bump the all group with 5 updates (#2794)
  * build(deps): Bump actions/upload-artifact in the all group
  * add generated files to pr
  * build(deps): Bump github.com/go-swagger/go-swagger
  * build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * build(deps): Bump go.opentelemetry.io/otel/sdk from 1.42.0 to
    1.43.0
  * build(deps): Bump google.golang.org/api from 0.269.0 to 0.271.0
    (#2781)
  * build(deps): Bump golang.org/x/net from 0.50.0 to 0.52.0
    (#2780)
  * build(deps): Bump codecov/codecov-action from 5.5.2 to 6.0.0
    (#2789)
  * build(deps): Bump golang.org/x/sync from 0.19.0 to 0.20.0
    (#2771)
  * build(deps): Bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4 (#2788)
  * Add changelog for v1.5.1 (#2774)
  * build(deps): Bump the all group across 1 directory with 3
    updates
  * build(deps): Bump the all group across 1 directory with 7
    updates</changelog>
</package>
<package pkgid="f02e9ec7c83e7741b8322d5bf18bb10d06bb8f6bd1925517aea259e3fe65ce860393cabf24a5e2d29a4c18b5cfe0b01dbca8103789ab483052967903b6d2db81" name="rkhunter" arch="s390x">
  <version epoch="0" ver="1.4.6" rel="87.8"/>
  <changelog author="Mathias Homann &lt;Mathias.Homann@opensuse.org&gt;" date="1537790400">- upgrade to version 1.4.6
  * 1.4.6 (20/02/2018)
  * New:
  - Added support for Alpine Linux (busybox).
  - Added the 'Diamorphine LKM' test.
  - Added the ALLOWIPCPID configuration file option. This will allow
  specific PIDs to be whitelisted from the shared memory check.
  - Added the ALLOWIPCUSER configuration file option. This will allow
  specific usernames to be whitelisted from the shared memory check.
  - Added the IPC_SEG_SIZE configuration file option. This can be used
  to set the minimum shared memory segment size to check. The default
  value is 1048576 bytes (1MB).
  - Added the SKIP_INODE_CHECK configuration file option. Setting this
  option will disable the reporting of any changed inode numbers.
  The default is to report inode changes. (This option may be useful
  for filesystems such as Btrfs.)
  - Added Ebury sshd backdoor test.
  - Added a new SSH configuration test to check for various suspicious
  configuration options. Currently there is only one check which
  relates to the Ebury backdoor.
  - Added basic test for Jynx2 rootkit.
  - Added Komplex trojan test.
  - Added basic test for KeRanger running process.
  - Added test for Keydnap backdoor.
  - Added basic test for Eleanor backdoor running process.
  - Added basic tests for Mokes backdoor.
  - Added tests for Proton backdoor.
  - Added the SUSPSCAN_WHITELIST configuration file option. This
  option can be used to whitelist file pathnames from the
  'suspscan' test.
  * Changes:
  - The 'ipc_shared_mem' test will now log the minimum segment size
  that will be checked. It will also log the size of any segments
  which appear suspicious (that is, larger than the configured
  allowed maximum size).
  - If verbose logging is disabled, then generally only the test
  name and the final result for the test will now be logged.
  - Kernel symbol checks will now use the 'System.map' file, if it
  exists, and no other kernel symbol file can be found.
  * Bugfixes:
  - For prelinked systems ensure that the default hash function is
  SHA1 and not SHA256.
  - The result from the 'hidden_procs' test was not being
  calculated correctly.
  - Checking the O/S version number could be missed in some cases.
  - Minor improvement to the *BSD immutable files check.
  - The 'OS_VERSION_FILE' configuration option pathname cannot be
  a link, but this was not checked.
  - Improved checks for the O/S name on Devuan systems.
  - Handling of the '/etc/issue' file during O/S detection has now
  improved. Escape sequences are either replaced or removed.
  - Not all the linux kernel module names were being checked.
  - The logging of detached memory segments tried to show the
  process pathname. This has now been corrected, and where no
  pathname is available, the segment owner and PID will be logged.
  - It was possible for the return code to be lost when running the
  'ipc_shared_mem' test. This has now been corrected.
  - Some configuration options were still not being handled correctly
  when specified more than once.
  - The 'ipc_shared_mem' test did not correctly handle whitelisting
  when a segment pathname was flagged as deleted. This has now
  been corrected.
  - Commands disabled in the configuration file were being logged
  as not found. They are now logged as having been disabled.
  - Disabling verbose logging could hide some warning messages.
  - The 'shared_libs' test now caters for simple filenames, as well
  as pathnames which contain the '$LIB', '$ORIGIN' or '$PLATFORM'
  variables.
  - -</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1537876800">- Replace %__-type macro indirections.
- Avoid repeating name in summary.</changelog>
  <changelog author="ecsos@opensuse.org" date="1554984000">- Generate rkhunter.conf.local to prevent hash error for
  rkhunter.conf.
- Remove some rpmlint-erros.</changelog>
  <changelog author="kukuk@suse.de" date="1566302400">- BuildRequire cron, as this contains now the cron directories</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1566561600">- package the /etc/cron.daily instead of buildrequire cron</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.de&gt;" date="1578571200">- Remove default cron job and install it with the documentation.
  This way the user can decide if he needs rkhunter to run regularly
  (bsc#1150553).</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- renable gpg verification, change to https urls.
- rkhunter.keyring: changed from keyserver</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1653307200">- Use correct SCRIPTDIR</changelog>
  <changelog author="Alexander van Kaam &lt;alexvkaam@gmail.com&gt;" date="1664366400">- added systemd timer and service file
  fix boo#1115455</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708689600">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="5188d612691e8c9bedfe6b9ce803acb4bb9577d81cad6e0716af96f93cc425ee006bf7de54e0e5e585afbd7c192f8c5c261fb1a1deb1bd07af94e8a691ed35df" name="rkhunter" arch="src">
  <version epoch="0" ver="1.4.6" rel="87.8"/>
  <changelog author="Greg.Freemyer@gmail.com" date="1414152000">- update to v1.4.2
  * See CHANGELOG at http://rkhunter.cvs.sourceforge.net/viewvc/rkhunter/rkhunter/files/CHANGELOG
- change Source: field to full URL
- change the spelling of README.SuSE to README.SUSE
- delete patch rkhunter-1.4.0-crontab.patch, now upstream
- add +%{_var}/lib/%{name}/db/signatures to %files section</changelog>
  <changelog author="arun@gmx.de" date="1428235200">- specfile:
  * added ALLOWHIDENFILE /dev/.blkid.tab, /dev/.blkid.tab.old, and
    /etc/.updated</changelog>
  <changelog author="VolkerKuhlmann@gmx.de" date="1431259200">- Fix spec obliterating PKGMGR_NO_VRFY. This fixes bnc#926624
- Create /etc/rkhunter.d and put config added by rpm in a file in it.
- Fix hideous way of spec adding config variables to a file.</changelog>
  <changelog author="VolkerKuhlmann@gmx.de" date="1431259201">- Default config file changed so APPEND_LOG was no longer activated.
  Add to /etc/rkhunter.d/00-opensuse.conf</changelog>
  <changelog author="mpluskal@suse.com" date="1451044800">- Add gpg signature</changelog>
  <changelog author="bwiedemann@suse.com" date="1456660800">- Add rkhunter-grep-fix.patch to fix a bogus warning (boo#968578)</changelog>
  <changelog author="meissner@suse.com" date="1477396800">- do not use /etc/SuSE-release anymore, fallback to generic
  /etc/os-release (bsc#1006382)</changelog>
  <changelog author="saigkill@opensuse.org" date="1491566400">- whitelist /dev/shm/CAPI20* and /dev/shm/sem.CAPI20* (boo#1030378)
- whitelist /usr/bin/.fipscheck.hmac (boo#1030378)</changelog>
  <changelog author="sven@uebelacker.net" date="1499083200">- upgrade to version 1.4.4 (29/06/2017)
- Added the GLOBSTAR configuration file option. This will set the shells globstar option to allow recursive checks of directories. By default this option is disabled.
- Added a Japanese translation file.
- Added support for the 'BSDng' package manager option. This can be used by those *BSD systems which have the 'pkg' command available (currently later FreeBSD systems).
- The BSD package manager will now try the 'pkg_info' command '-W' option if the '-F' option fails.
- Added the LOCKDIR configuration option. It is now possible to specify the directory rkhunter will use to store the lock file (if USE_LOCKING has been set). The default is unset, and this will cause rkhunter to look for a directory to use. Details are in the configuration file.
- Added the ALLOWIPCPROC configuration file option. This can be used to whitelist suspicious processes using shared memory segments (found during the 'ipc_shared_mem' check).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="Mathias Homann &lt;Mathias.Homann@opensuse.org&gt;" date="1537790400">- upgrade to version 1.4.6
  * 1.4.6 (20/02/2018)
  * New:
  - Added support for Alpine Linux (busybox).
  - Added the 'Diamorphine LKM' test.
  - Added the ALLOWIPCPID configuration file option. This will allow
  specific PIDs to be whitelisted from the shared memory check.
  - Added the ALLOWIPCUSER configuration file option. This will allow
  specific usernames to be whitelisted from the shared memory check.
  - Added the IPC_SEG_SIZE configuration file option. This can be used
  to set the minimum shared memory segment size to check. The default
  value is 1048576 bytes (1MB).
  - Added the SKIP_INODE_CHECK configuration file option. Setting this
  option will disable the reporting of any changed inode numbers.
  The default is to report inode changes. (This option may be useful
  for filesystems such as Btrfs.)
  - Added Ebury sshd backdoor test.
  - Added a new SSH configuration test to check for various suspicious
  configuration options. Currently there is only one check which
  relates to the Ebury backdoor.
  - Added basic test for Jynx2 rootkit.
  - Added Komplex trojan test.
  - Added basic test for KeRanger running process.
  - Added test for Keydnap backdoor.
  - Added basic test for Eleanor backdoor running process.
  - Added basic tests for Mokes backdoor.
  - Added tests for Proton backdoor.
  - Added the SUSPSCAN_WHITELIST configuration file option. This
  option can be used to whitelist file pathnames from the
  'suspscan' test.
  * Changes:
  - The 'ipc_shared_mem' test will now log the minimum segment size
  that will be checked. It will also log the size of any segments
  which appear suspicious (that is, larger than the configured
  allowed maximum size).
  - If verbose logging is disabled, then generally only the test
  name and the final result for the test will now be logged.
  - Kernel symbol checks will now use the 'System.map' file, if it
  exists, and no other kernel symbol file can be found.
  * Bugfixes:
  - For prelinked systems ensure that the default hash function is
  SHA1 and not SHA256.
  - The result from the 'hidden_procs' test was not being
  calculated correctly.
  - Checking the O/S version number could be missed in some cases.
  - Minor improvement to the *BSD immutable files check.
  - The 'OS_VERSION_FILE' configuration option pathname cannot be
  a link, but this was not checked.
  - Improved checks for the O/S name on Devuan systems.
  - Handling of the '/etc/issue' file during O/S detection has now
  improved. Escape sequences are either replaced or removed.
  - Not all the linux kernel module names were being checked.
  - The logging of detached memory segments tried to show the
  process pathname. This has now been corrected, and where no
  pathname is available, the segment owner and PID will be logged.
  - It was possible for the return code to be lost when running the
  'ipc_shared_mem' test. This has now been corrected.
  - Some configuration options were still not being handled correctly
  when specified more than once.
  - The 'ipc_shared_mem' test did not correctly handle whitelisting
  when a segment pathname was flagged as deleted. This has now
  been corrected.
  - Commands disabled in the configuration file were being logged
  as not found. They are now logged as having been disabled.
  - Disabling verbose logging could hide some warning messages.
  - The 'shared_libs' test now caters for simple filenames, as well
  as pathnames which contain the '$LIB', '$ORIGIN' or '$PLATFORM'
  variables.
  - -</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1537876800">- Replace %__-type macro indirections.
- Avoid repeating name in summary.</changelog>
  <changelog author="ecsos@opensuse.org" date="1554984000">- Generate rkhunter.conf.local to prevent hash error for
  rkhunter.conf.
- Remove some rpmlint-erros.</changelog>
  <changelog author="kukuk@suse.de" date="1566302400">- BuildRequire cron, as this contains now the cron directories</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1566561600">- package the /etc/cron.daily instead of buildrequire cron</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.de&gt;" date="1578571200">- Remove default cron job and install it with the documentation.
  This way the user can decide if he needs rkhunter to run regularly
  (bsc#1150553).</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- renable gpg verification, change to https urls.
- rkhunter.keyring: changed from keyserver</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1653307200">- Use correct SCRIPTDIR</changelog>
  <changelog author="Alexander van Kaam &lt;alexvkaam@gmail.com&gt;" date="1664366400">- added systemd timer and service file
  fix boo#1115455</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708689600">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="268028727725bbc9667c77d4be80a61ab748c31a841676d937c752b1b59ec25a6375c014302f648e9d61223e0b401d41f8fe280bd5cec00987add48ce0bc9bcc" name="rsign2" arch="s390x">
  <version epoch="0" ver="0.6.3+0" rel="9.49"/>
  <changelog author="cunix@mail.de" date="1613476800">- Initial rsign2 package version 0.5.7</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1641556800">- Update to 0.6.1
- Change packaging to use obs_scm and cargo services</changelog>
  <changelog author="cunix@mail.de" date="1642248000">- Bump minimum Rust version to 1.46
- Catch more vendored licenses</changelog>
  <changelog author="cunix@mail.de" date="1647950400">- switched to vendored_licenses_packager as build dependency</changelog>
  <changelog author="cunix@mail.de" date="1687521600">- Update to 0.6.3
  * support passwordless secret keys
  * dependencies updated
- Bump minimum Rust version to 1.64</changelog>
</package>
<package pkgid="10ab3fefa1757c9e656e66091d6ff37b9518078e5459f4114b4e472ce6d156459afc59955dd150d680041862fbf55daeefeef8781e6d4a24cb50a4b8118592eb" name="rsign2" arch="src">
  <version epoch="0" ver="0.6.3+0" rel="9.49"/>
  <changelog author="cunix@mail.de" date="1613476800">- Initial rsign2 package version 0.5.7</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1641556800">- Update to 0.6.1
- Change packaging to use obs_scm and cargo services</changelog>
  <changelog author="cunix@mail.de" date="1642248000">- Bump minimum Rust version to 1.46
- Catch more vendored licenses</changelog>
  <changelog author="cunix@mail.de" date="1647950400">- switched to vendored_licenses_packager as build dependency</changelog>
  <changelog author="cunix@mail.de" date="1687521600">- Update to 0.6.3
  * support passwordless secret keys
  * dependencies updated
- Bump minimum Rust version to 1.64</changelog>
</package>
<package pkgid="198c0ecb27e50e678d886d8c91765b3f2e556d7c61f3e8226e201a97c01af9bd59e122b05110706aecaae6dc8e9172b0aa890513dea97409cbf3e6ec67a01558" name="ruby4.0-rubygem-dawnscanner" arch="s390x">
  <version epoch="0" ver="2.2.0" rel="1.30"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt; - 2.0.0.rc4" date="1617710400">- Create a new RPM package for dawnscanner tool</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1681732800">[#]# Version 2.2.0 (2023-04-17)
  * DepedencyCheck: marked as deprecated
  * UnsafeDependencyCheck: added support for new kb keywords:
  - versionEndIncluding
  - versionEndExcluding
  [#]# Version 2.1.1 (2023-04-14)
  * Issue #252 fix was uncomplete.
  [#]# Version 2.1.0 (2023-04-13)
  * BasicCheck: added an attribute do flag as vulnerable a dependency gem only if
  it matches the name, overriding the version. It will be used in dawn kb list
  command, when the user won't enter the version information.
  * Added the "list" subcommand to "kb". It can be used to fetch from the
  knowledge base all CVEs affecting a particular gem.
  [#]# Version 2.0.0 (2023-04-13)
  * New knowledge base, YAML based and distributed separately from the ruby gem.
  * New CLI based on Thor library. Please read README.md file to know how to
  invoke dawn the right way or use the 'dawn help' command
  * Added a new debug\_verbosely API for engines and checks
  * Removed rake osvdb[name] and rake cve[name] tasks
  * Dawn::Utils include refactory. Now it's available application wide
  * debug information refactory.
  * engine class, apply_all method now accepts an optional parameter containing a
  list of security checks to be excluded (issue #230).
  * Fix issue #244. Now the KB path is no more hardcoded but it is relative to
  $HOME and 'dawnscanner' folder where results are stored.
  * Fix issue #245. Pattern matching check is skipped on empty files.
  * Fix issue #250. Require missing fileutils, thanks to @lukaszsliwa
  * Fix issue #252. File.exists was removed in newer interpreter versions
  * Dropping codenames
  * Class names must be declared before loading YAML files</changelog>
</package>
<package pkgid="b5057a320716c076453331b2cfcfae18170d7aa34b9f9c76c82d4c309217d5c1417e6cfd02b5259dfe3c48705b8a39b9f541f86f06fe581f86db705a5f9b64b9" name="rubygem-dawnscanner" arch="src">
  <version epoch="0" ver="2.2.0" rel="1.30"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt; - 2.0.0.rc4" date="1617710400">- Create a new RPM package for dawnscanner tool</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1681732800">[#]# Version 2.2.0 (2023-04-17)
  * DepedencyCheck: marked as deprecated
  * UnsafeDependencyCheck: added support for new kb keywords:
  - versionEndIncluding
  - versionEndExcluding
  [#]# Version 2.1.1 (2023-04-14)
  * Issue #252 fix was uncomplete.
  [#]# Version 2.1.0 (2023-04-13)
  * BasicCheck: added an attribute do flag as vulnerable a dependency gem only if
  it matches the name, overriding the version. It will be used in dawn kb list
  command, when the user won't enter the version information.
  * Added the "list" subcommand to "kb". It can be used to fetch from the
  knowledge base all CVEs affecting a particular gem.
  [#]# Version 2.0.0 (2023-04-13)
  * New knowledge base, YAML based and distributed separately from the ruby gem.
  * New CLI based on Thor library. Please read README.md file to know how to
  invoke dawn the right way or use the 'dawn help' command
  * Added a new debug\_verbosely API for engines and checks
  * Removed rake osvdb[name] and rake cve[name] tasks
  * Dawn::Utils include refactory. Now it's available application wide
  * debug information refactory.
  * engine class, apply_all method now accepts an optional parameter containing a
  list of security checks to be excluded (issue #230).
  * Fix issue #244. Now the KB path is no more hardcoded but it is relative to
  $HOME and 'dawnscanner' folder where results are stored.
  * Fix issue #245. Pattern matching check is skipped on empty files.
  * Fix issue #250. Require missing fileutils, thanks to @lukaszsliwa
  * Fix issue #252. File.exists was removed in newer interpreter versions
  * Dropping codenames
  * Class names must be declared before loading YAML files</changelog>
</package>
<package pkgid="e75ac7c6c11e04f8be8e5a5704451db3da2fc269b3d3901cb59c032dab5f90c385903f3862468a9fff84e7b1c8c8a2e0d85237125eaee469fbae5d6202723534" name="rust-keylime" arch="s390x">
  <version epoch="0" ver="0.2.9+49" rel="87.3"/>
  <changelog author="aplanas@suse.com" date="1701432000">- Update to version 0.2.3+git.1701075380.a5dc985:
  * build(deps): bump actix-rt from 2.8.0 to 2.9.0
  * Bump version to 0.2.3
  * build(deps): bump reqwest from 0.11.20 to 0.11.22
  * Bump configuration version and fix enable_iak_idevid
  * Enable test functional/iak-idevid-register-with-certificates
  * Update packit plan with new tests
  * Add certificates and certificate checking for IDevID and IAK keys (#669)</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version 0.2.4+git.1706692574.a744517:
  * Bump version to 0.2.4
  * build(deps): bump uuid from 1.4.1 to 1.7.0
  * keylime-agent.conf: Allow setting event logs paths
  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.
  * workflows: Update checkout action to version 4
  * build(deps): bump serde from 1.0.188 to 1.0.195
  * build(deps): bump pest_derive from 2.7.0 to 2.7.6
  * build(deps): bump openssl from 0.10.62 to 0.10.63
  * build(deps): bump config from 0.13.3 to 0.13.4
  * build(deps): bump base64 from 0.21.4 to 0.21.7
  * build(deps): bump tempfile from 3.8.0 to 3.9.0
  * build(deps): bump pest from 2.7.0 to 2.7.6
  * build(deps): bump actix-web from 4.4.0 to 4.4.1
  * build(deps): bump reqwest from 0.11.22 to 0.11.23
  * build(deps): bump h2 from 0.3.17 to 0.3.24
  * build(deps): bump shlex from 1.1.0 to 1.3.0
  * cargo: Bump tss-esapi to version 7.4.0
  * workflows: Fix keylime-bot token usage
  * tpm: Add error context for every possible error
  * tpm: Add AlgorithmError to TpmError
  * detect idevid template from certificates
  * build(deps): bump wiremock from 0.5.18 to 0.5.22
  * build(deps): bump thiserror from 1.0.48 to 1.0.56
  * Make use of workspace dependencies
  * build(deps): bump openssl from 0.10.57 to 0.10.62
  * packit: Bump Fedora version used for code coverage</changelog>
  <changelog author="aplanas@suse.com" date="1714478400">- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)
- Update to version 0.2.4~39:
  * build(deps): bump openssl from 0.10.63 to 0.10.64
  * build(deps): bump h2 from 0.3.24 to 0.3.26
  * build(deps): bump serde_json from 1.0.107 to 1.0.116
  * build(deps): bump actix-web from 4.4.1 to 4.5.1
  * crypto: Enable TLS 1.3
  * build(deps): bump tempfile from 3.9.0 to 3.10.1
  * build(deps): bump mio from 0.8.4 to 0.8.11
  * enable hex values to be used for tpm_ownerpassword
  * config: Support IPv6 with or without brackets
  * keylime: Implement a simple IP parser to remove brackets
  * crypto: Implement CertificateBuilder to generate certificates
  * tests: Fix coverage download by supporting arbitrary URL
  * cargo: Add testing feature to keylime library
  * Set X509 SAN with local DNSname/IP/IPv6
  * Include newest Node20 versions for Github actions
  * tpm: Add unit test for uncovered public functions
  * crypto: Implement ECC key generation support
  * crypto: Add test for match_cert_to_template()
  * Fix minor typo, format and remove end whitespaces
  * crypto: Make error types less specific
  * tests/run.sh: Run tarpaulin with a single thread
  * payloads: Remove explicit drop of channel transmitter
  * crypto: Move to keylime library
  * crypto: Add specific type for every possible error
  * tpm: Rename origin of error as source in structures
  * list_parser: Add source for error for backtrace
  * algorithms: Make errors more specific
  * typo fix for default path to measured boot log file
  * README: remove mentions of libarchive as a dependency
  * Dockerfile.wolfi: Update clang to version 17
  * docker: Remove libarchive as a dependency
  * rpm: Remove libarchive from dependencies
  * cargo: Replace compress-tools with zip crate
  * cargo: Bump ahash to version 0.8.7
  * build(deps): bump serde from 1.0.195 to 1.0.196
  * build(deps): bump libc from 0.2.152 to 0.2.153
  * build(deps): bump reqwest from 0.11.23 to 0.11.24
  * docker: Install configuration file in the correct path
  * config: Make IAK/IDevID disabled by default</changelog>
  <changelog author="aplanas@suse.com" date="1714651200">- Update to version 0.2.5~0:
  * Bump version to 0.2.5
  * cargo: Relax required version for pest crate
  * build(deps): bump log from 0.4.20 to 0.4.21
  * build(deps): bump thiserror from 1.0.56 to 1.0.59</changelog>
  <changelog author="aplanas@suse.com" date="1715860800">- Update to version 0.2.5~4:
  * Fix 'unnecessary qualification' warnings
  * fix IAK template to match IDevID
  * rpm: fix COPR RPMs build for centos-stream-10
  * Build COPR RPMs for centos-stream-10</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version 0.2.6~0:
  * Bump version to 0.2.6
  * build(deps): bump libc from 0.2.153 to 0.2.155
  * build(deps): bump serde from 1.0.196 to 1.0.203
  * rpm/fedora: Update rust macro usage
  * config: Support hostnames in registrar_ip option
  * added use of persisted IAK and IDevID and authorisation values
  * config changes
  * Adding /agent/info API to agent
  * Fix leftover 'unnecessary qualification' warnings on tests</changelog>
  <changelog author="aplanas@suse.com" date="1725278400">- Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
  * rustix 0.37.25
  * rustix 0.38.34
  * shlex  1.3.0
- Update to version 0.2.6+13:
  * Enable test functional/iak-idevid-persisted-and-protected
  * build(deps): bump uuid from 1.7.0 to 1.10.0
  * build(deps): bump openssl from 0.10.64 to 0.10.66
  * keylime-agent/src/revocation: Fix comment indentation
  * keylime/crypto: Fix indentation of documentation comment
  * build(deps): bump thiserror from 1.0.59 to 1.0.63
  * build(deps): bump serde_json from 1.0.116 to 1.0.120
  * dependabot: Extend to also monitor workflow actions
  * ci: Disable Packit CI on CentOS Stream 9
  * ci: use CODECOV_TOKEN when submitting coverage data
  * revocation: Use into() for unfallible transformation
  * secure_mount: Fix possible infinite loop
  * error: Rename enum variants to avoid clippy warning</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version 0.2.7+1:
  * dist: Enable logging for keylime library in the service
  * Bump version to 0.2.7
  * scripts: Download coverage data from Testing Farm directly
  * main: Remove unnecessary lifetime
  * cargo: Bump pretty_env_logger to version 0.5.0
  * scripts: Fix regex in download_packit_coverage.sh
  * cargo: Bump clap crate to version 4.5.23
  * cargo: Bump base64 crate to version 0.22.1
  * build(deps): bump log from 0.4.22 to 0.4.25
  * build(deps): bump serde_json from 1.0.133 to 1.0.135
  * cargo: Bump tokio crate to version 1.42.0
  * packit: Fix RPM builds on copr
  * cargo: Bump thiserror crate to version 0.2.9
  * cargo: Update reqwest to version 0.12.12
  * build(deps): bump libc from 0.2.168 to 0.2.169
  * build(deps): bump glob from 0.3.1 to 0.3.2
  * version: Implement API version validation and ordering
  * main: Support using multiple API versions for registration
  * keylime: Introduce the registrar_client module
  * Provide endpoints under multiple API versions
  * Move 'serialization' module to the keylime library
  * Drop unnecessary dependency on common::API_VERSION
  * keylime-agent.conf: Bump version to 2.3
  * build(deps): bump serde from 1.0.210 to 1.0.217
  * build(deps): bump pest_derive from 2.7.14 to 2.7.15
  * build(deps): bump pest from 2.7.14 to 2.7.15
  * build(deps): bump libc from 0.2.167 to 0.2.168
  * config: Make IAK and IDevID certificates optional
  * Fix warnings reported by clippy
  * workflows: Run job in the CI container directly
  * tests: Add unit test for device ID builder
  * main: Move IAK/IDevID related code to dedicated module
  * tests: Add script to generate IAK and IDevID certificates
  * build(deps): bump openssl from 0.10.66 to 0.10.68
  * build(deps): bump uuid from 1.10.0 to 1.11.0
  * build(deps): bump serde_json from 1.0.128 to 1.0.133
  * build(deps): bump actix-web from 4.5.1 to 4.9.0
  * build(deps): bump reqwest from 0.12.7 to 0.12.9
  * tests/setup_swtpm.sh: Add script to setup temporary TPM
  * Use a single TPM context and avoid race conditions during tests
  * config: Enable passing a hostname instead of IP
  * build(deps): bump clap from 4.3.11 to 4.5.21
  * build(deps): bump tempfile from 3.10.1 to 3.14.0
  * build(deps): bump pest_derive from 2.7.6 to 2.7.14
  * build(deps): bump pest from 2.7.6 to 2.7.14
  * build(deps): bump codecov/codecov-action from 4 to 5
  * workflows: Submit the coverage for merged PR from Fedora 41
  * tests: Use Fedora 41 to generate code coverage
  * api: Make API configuration modular
  * agent_handler: Move the /agent scope configuration
  * notifications_handler: Move the /notifications scope configuration
  * quotes_handler: Move the /quotes scope configuration to quotes_handler
  * keys_handler: Move /keys scope configuration to keys_handler
  * Use ${DESTDIR} for config
  * Fix showing wrong UUID
  * build(deps): bump actix-rt from 2.9.0 to 2.10.0
  * config: Refactor AgentConfig Source trait implementation
  * build(deps): bump log from 0.4.21 to 0.4.22
  * build(deps): bump serde_json from 1.0.120 to 1.0.128
  * tpm: check if EK certificate has valid ASN.1 DER encoding
  * build(deps): bump futures from 0.3.27 to 0.3.31
  * cargo: Bump reqwest to version 0.12.7
  * build(deps): bump serde from 1.0.203 to 1.0.210
  * tests: Add more tests to Packit CI
  * build(deps): bump docker/build-push-action from 5 to 6
  * tests: apply workarounds to known bugs</changelog>
  <changelog author="aplanas@suse.com" date="1749124800">- Update vendored crates (bsc#1243861, CVE-2024-12224)
  * idna 1.0.3
- Add Cargo_lock.patch to adjust versions that will allow the
  compilation of mbox crate
- Update to version 0.2.7+70:
  * build(deps): bump wiremock from 0.6.2 to 0.6.3
  * build(deps): bump uuid from 1.16.0 to 1.17.0
  * lib: Introduce AgentIdentity structure
  * gitignore: Add *.swp and *.orig to be ignored
  * build(deps): bump clap from 4.5.38 to 4.5.39
  * build(deps): bump tokio from 1.45.0 to 1.45.1
  * Unify Push Model structures time formats to UTC (#1016)
  * Add Quote related structures to Keylime library
  * Remove configuration file trailing whitespaces (#1012)
  * keylime-agent.conf: add all accepted TPM encryption algs
  * tpm: add policy auth for EK to activate crendential
  * Enable non standard key sizes and curves for EK and AK
  * config: Use next_back() instead of last() for iterators
  * Update to tss-esapi v7.6.0
  * Avoid duplicated call to ctx.create_ek
  * build(deps): bump clap from 4.5.23 to 4.5.38
  * Add registration for Push Model client
  * build(deps): bump tokio from 1.44.2 to 1.45.0
  * build(deps): bump chrono from 0.4.40 to 0.4.41
  * build(deps): bump tempfile from 3.17.1 to 3.20.0
  * Refactor code: move error, registration to lib
  * Move structure filling and URL selection code (#999)
  * build(deps): bump pest_derive from 2.7.15 to 2.8.0
  * build(deps): bump pest from 2.7.15 to 2.8.0
  * build(deps): bump libc from 0.2.169 to 0.2.172
  * Add Evidence/Authentication messages to prototype
  * build(deps): bump uuid from 1.15.1 to 1.16.0
  * build(deps): bump thiserror from 2.0.11 to 2.0.12
  * build(deps): bump signal-hook from 0.3.17 to 0.3.18
  * build(deps): bump log from 0.4.25 to 0.4.27
  * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
  * build(deps): bump actix-web from 4.9.0 to 4.10.2
  * build(deps): bump reqwest from 0.12.12 to 0.12.15
  * build(deps): bump serde from 1.0.217 to 1.0.219
  * Add unit tests for sessions.rs structures
  * Add auth(sessions) structures
  * Fix minor README.md issue (#988)
  * Define EvidenceHandling structures (#971)
  * Add mockoon test scenario
  * Add client certificates to push-attestation prototype
  * Cargo: bump url crate to version 2.5.4
  * Add logging to the push attestation prototype
  * Do not use certificate on insecure mode
  * common: Move the EncryptedData structure from common to the library
  * common: Move AuthTag from common to the library
  * build(deps): bump openssl from 0.10.71 to 0.10.72
  * common: Move Symmkey to library as crypto::symmkey
  * common: Remove unused constants and static values
  * build(deps): bump tokio from 1.43.0 to 1.44.2
  * Refactor code: Include AgentIdentity structure
  * Push model prototype
  * Add support for ek certificate chain, stored in TPM NVRAM.
  * Recover key_class field and set it as "asymmetric"
  * Update push model structures to latest values
  * build(deps): bump serde_json from 1.0.138 to 1.0.140
  * packit: Add identifier for each copr_build job
  * keylime-agent.conf: only mention ecdsa and rsassa for signing
  * build(deps): bump openssl from 0.10.70 to 0.10.71
  * build(deps): bump uuid from 1.13.2 to 1.15.1
  * Add capabilities_negotiation structures
  * packit: Add compatibility/api_version_compatibility test
  * build(deps): bump uuid from 1.11.0 to 1.13.2
  * build(deps): bump serde_json from 1.0.135 to 1.0.138
  * build(deps): bump thiserror from 2.0.9 to 2.0.11
  * build(deps): bump tempfile from 3.14.0 to 3.17.1
  * Allow agent to start as non-root
  * scripts: Fix coverage information downloading script
  * build(deps): bump openssl from 0.10.68 to 0.10.70
  * build(deps): bump tokio from 1.42.0 to 1.43.0</changelog>
  <changelog author="aplanas@suse.com" date="1752494400">- Update vendored crates (bsc#1242623, CVE-2025-3416)
  * openssl 0.10.73
- Update to version 0.2.7+117:
  * Increase coverage in evidence handling structure
  * Add Capabilities Negotiations resp. missing fields
  * Fix UEFI test to check file access in all cases
  * context_info_handler: Do not assume /var/lib/keylime exists
  * Fix clippy warnings about uninlined format arguments
  * attestation: Allow unwrap() in tests
  * Increase coverage (groom code, extend unit tests)
  * Include IMA/UEFI logs in Evidence Handling request
  * Include method to get all IMA entries as string
  * Send correct list of pcr banks and sign algorithms
  * Try to fix TPM tests related issues
  * Define attestation perform asynchronous
  * Perform attestation in push model agent binary
  * Refactor code to use new attestation.rs
  * Create attestation.rs for Attestation stuff
  * Move ContextInfo management to its own handler
  * Adjust context_info.rs after rebase
  * Add attestation function to ContextInfo structure
  * Add prohibited signing algorithms, avoid ecschnorr
  * keylime/config: Use macro to implement PushModelConfigTrait
  * Introduce keylime-macros and define_view_trait
  * config: Remove KeylimeConfig structure
  * config: Remove unnecessary options and lazy initialization
  * Fix pcr_bank function to send all possible slots
  * Send Content-Type:application/json on request (#1039)
  * Send correct 'key_algorithm' in certification_keys (#1035)
  * Push Model: Persist Attestation Key to file
  * Add Keylime push model binary to root GNUmakefile
  * Use singleton to avoid multiple Context allocation
  * tests: Do not assume `/var/lib/keylime` exists (#1030)
  * lib/cert: Fix race condition due to use of same file path
  * payloads: Fix race condition in tests
  * Add uefi_log_handler.rs to parse UEFI binary
  * Use IMA log parser to send correct entry count
  * Add IMA log parser
  * build(deps): bump once_cell from 1.19.0 to 1.21.3
  * lib/config/base.rs: Add more unit tests
  * lib/permissions: Add unit tests
  * keylime-agent: move JsonWrapper from common.rs to the library
  * lib/agent_data: Move agent_data related tests from common
  * common: Replace APIVersion with the library Version structure
  * keylime_agent: Move secure_mount.rs to the library
  * lib: Rename keylime_error.rs as error.rs
  * config: Move config to keylime library
  * config: Rename push_model_config to push_model
  * lib: Move permissions.rs from keylime-agent to the lib
  * Extract Capabilities Negotiation info from TPM (#1014)</changelog>
  <changelog author="aplanas@suse.com" date="1754568000">- Update vendored crates (bsc#1247193, CVE-2025-58266)
  * shlex 1.3.0
- Rebase keylime-agent.conf.diff for current configuration
- Drop Cargo_lock.patch patch, already present in Cargo.lock
- Update to version 0.2.7+141:
  * service: Use WantedBy=multi-user.target
  * rpm: Add subpackage for push-attestation agent
  * push-model: implement continuous attestation with configurable intervals
  * Retry registration forever in the state machine
  * Add Verifier URL to configuration
  * Align exp.backoff to current configuration format
  * Increase coverage of state machine (using Context)
  * Increase coverage of struct_filler.rs
  * Groom code (remove dead code)
  * Fix exponential backoff (10secs, 4xx accepted)
  * test: Add documentation test to tests/run.sh
  * tpm: Avoid running code example during documentation tests
  * state_machine: Always start the agent from the Unregistered state
  * Add fixes for the URL construction
  * Refactor evidences collection in push attestation agent
  * push-model: refactor attestation logic into a state machine
  * Fix body sending by allowing serializing strings (#1057)
  * Log ResilientClient errors/response status codes (#1055)
  * Add AK signing scheme and hash algorithm to negotiation
  * tpm: Add method to extract signing scheme and hash algorithm from AK
  * Allow custom content-type/accept headers
  * Integrate exponential backoff to registration (#1052)
  * keylime/structures: Rename ShaValues to PcrBanks
  * Add resilient_client for exponential backoff (#1048)</changelog>
  <changelog author="aplanas@suse.com" date="1755691200">- Update vendored crates (bsc#1248006, CVE-2025-55159)
  * slab 0.4.11
- Add Cargo_lock.patch patch to update slab and other dependencies
- Update to version 0.2.8+12:
  * build(deps): bump actions/checkout from 4 to 5
  * build(deps): bump cfg-if from 1.0.0 to 1.0.1
  * build(deps): bump openssl from 0.10.72 to 0.10.73
  * build(deps): bump clap from 4.5.39 to 4.5.45
  * build(deps): bump pest from 2.8.0 to 2.8.1
  * Fix clippy warnings
  * Use verifier-provided interval for continuous attestation timing
  * Add meta object with seconds_to_next_attestation to evidence response
  * Fix boot time retrieval
  * Fix IMA log format (it must be ['text/plain']) (#1073)
  * Remove unnecessary configuration fields
  * cargo: Bump retry-policies to version 0.4.0
  * Bump version to 0.2.8</changelog>
  <changelog author="aplanas@suse.com" date="1767787200">- Use tmpfiles.d for /var directories (PED-14736)
  + tmpfiles.keylime renamed to rust-keylime.conf and extended
- Update to version 0.2.8+96:
  * build(deps): bump wiremock from 0.6.4 to 0.6.5
  * build(deps): bump actions/checkout from 5 to 6
  * build(deps): bump chrono from 0.4.41 to 0.4.42
  * packit: Get coverage from Fedora 43 runs
  * Fix issues pointed out by clippy
  * Replace mutex unwraps with proper error handling in TPM library
  * Remove unused session request methods from StructureFiller
  * Fix config panic on missing ek_handle in push model agent
  * build(deps): bump tempfile from 3.21.0 to 3.23.0
  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  * Fix clippy warnings project-wide
  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  * Thread privileged resources and use MeasurementList for IMA reading
  * Add privileged resource initialization and privilege dropping to push model agent
  * Fix privilege dropping order in run_as()
  * add documentation on FQDN hostnames
  * Remove confusing logs for push mode agent
  * Set correct default Verifier port (8891-&gt;8881) (#1159)
  * Add verifier_url to reference configuration file (#1158)
  * Add TLS support for Registrar communication (#1139)
  * Fix agent handling of 403 registration responses (#1154)
  * Add minor README.md rephrasing (#1151)
  * build(deps): bump actions/checkout from 5 to 6 (#1153)
  * ci: update spec files for packit COPR build
  * docs: improve challenge encoding and async TPM documentation
  * refactor: improve middleware and error handling
  * feat: add authentication client with middleware integration
  * docker: Include keylime_push_model_agent binary
  * Include attestation_interval configuration (#1146)
  * Persist payload keys to avoid attestation failure on restart
  * crypto: Implement the load or generate pattern for keys
  * Use simple algorithm specifiers in certification_keys object (#1140)
  * tests: Enable more tests in CI
  * Fix RSA2048 algorithm reporting in keylime agent
  * Remove disabled_signing_algorithms configuration
  * rpm: Fix metadata patches to apply to current code
  * workflows/rpm.yml: Use more strict patching
  * build(deps): bump uuid from 1.17.0 to 1.18.1
  * Fix ECC algorithm selection and reporting for keylime agent
  * Improve logging consistency and coherency
  * Implement minimal RFC compliance for Location header and URI parsing (#1125)
  * Use separate keys for payload mechanism and mTLS
  * docker: update rust to 1.81 for distroless Dockerfile
  * Ensure UEFI log capabilities are set to false
  * build(deps): bump http from 1.1.0 to 1.3.1
  * build(deps): bump log from 0.4.27 to 0.4.28
  * build(deps): bump cfg-if from 1.0.1 to 1.0.3
  * build(deps): bump actix-rt from 2.10.0 to 2.11.0
  * build(deps): bump async-trait from 0.1.88 to 0.1.89
  * build(deps): bump trybuild from 1.0.105 to 1.0.110
  * Accept evidence handling structures null entries
  * workflows: Add test to check if RPM patches still apply
  * CI: Enable test add-agent-with-malformed-ek-cert
  * config: Fix singleton tests
  * FSM: Remove needless lifetime annotations (#1105)
  * rpm: Do not remove wiremock which is now available in Fedora
  * Use latest Fedora httpdate version (1.0.3)
  * Enhance coverage with parse_retry_after test
  * Fix issues reported by CI regarding unwrap() calls
  * Reuse max retries indicated to the ResilientClient
  * Include limit of retries to 5 for Retry-After
  * Add policy to handle Retry-After response headers
  * build(deps): bump wiremock from 0.6.3 to 0.6.4
  * build(deps): bump serde_json from 1.0.140 to 1.0.143
  * build(deps): bump pest_derive from 2.8.0 to 2.8.1
  * build(deps): bump syn from 2.0.90 to 2.0.106
  * build(deps): bump tempfile from 3.20.0 to 3.21.0
  * build(deps): bump thiserror from 2.0.12 to 2.0.16
  * rpm: Fix patches to apply to current master code
  * build(deps): bump anyhow from 1.0.98 to 1.0.99
  * state_machine: Automatically clean config override during tests
  * config: Implement singleton and factory pattern
  * testing: Support overriding configuration during tests
  * feat: implement standalone challenge-response authentication module
  * structures: rename session structs for clarity and fix typos
  * tpm: refactor certify_credential_with_iak() into a more generic function
  * Add Push Model Agent Mermaid FSM chart (#1095)
  * Add state to avoid exiting on wrong attestation (#1093)
  * Add 6 alphanumeric lowercase X-Request-ID header
  * Enhance Evidence Handling response parsing
  * build(deps): bump quote from 1.0.35 to 1.0.40
  * build(deps): bump libc from 0.2.172 to 0.2.175
  * build(deps): bump glob from 0.3.2 to 0.3.3
  * build(deps): bump actix-web from 4.10.2 to 4.11.0</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update vendored crates (bsc#1257908, CVE-2026-25727)
  * time 0.3.47
- Update to version 0.2.8+116:
  * build(deps): bump bytes from 1.7.2 to 1.11.1
  * api: Modify /version endpoint output in version 2.5
  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  * tests: add unit test for resolve_agent_id (#1182)
  * (pull-model): enable retry logic for registration
  * rpm: Update specfiles to apply on master
  * workflows: Add test to detect unused crates
  * lib: Drop unused crates
  * push-model: Drop unused crates
  * keylime-agent: Drop unused crates
  * build(deps): bump uuid from 1.18.1 to 1.19.0
  * Update reqwest-retry to 0.8, retry-policies to 0.5
  * rpm: Fix cargo_build macro usage on CentOS Stream
  * fix(push-model): resolve hash_ek uuid to actual EK hash
  * build(deps): bump thiserror from 2.0.16 to 2.0.17
  * workflows: Separate upstream test suite from e2e coverage
  * Send UEFI measured boot logs as raw bytes (#1173)
  * auth: Add unit tests for SecretToken implementation
  * packit: Enable push-attestation tests
  * resilient_client: Prevent authentication token leakage in logs</changelog>
  <changelog author="aplanas@suse.com" date="1774008000">- Update to version 0.2.9+8:
  * build(deps): bump thiserror from 2.0.17 to 2.0.18
  * build(deps): bump docker/login-action from 3 to 4
  * build(deps): bump docker/metadata-action from 5 to 6
  * Remove generate-bindings feature from tss-esapi
  * Use port constants instead of hardcoded values in tests
  * push-attestation: Use registrar TLS port when TLS is enabled
  * build(deps): bump docker/build-push-action from 6 to 7
  * build(deps): bump actions/upload-artifact from 6 to 7
  * dist: Make the services to conflict with each other
  * Bump version to 0.2.9
  * build(deps): bump mockoon/cli-action from 2 to 3
  * cargo: Bump tracing_subscriber to version 0.3.20
  * cargo: Bump time to version 0.3.47
  * build(deps): bump http from 1.3.1 to 1.4.0
  * Update reqwest from 0.12 to 0.13
  * build(deps): bump serde from 1.0.219 to 1.0.228
  * auth: Load CA certificate in authentication client
  * packit: Add missing e2e tests
  * registrar: Rename insecure option to disable_tls
  * push-attestation: Drop self-signed mTLS certificate generation
  * config: Add missing config options to keylime-agent.conf
  * config: Add support for "default" in registrar_api_versions option
  * config: Add support for "default" in registrar_tls_ca_cert option
  * config: Drop unused config options and constants
  * push-attestation: Drop support for mTLS to registrar
  * push-attestation: Drop mTLS support and require PoP authentication
  * build(deps): bump clap from 4.5.45 to 4.5.54
  * build(deps): bump actix-web from 4.11.0 to 4.12.1
  * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
  * resilient_client: Reauthenticate if a 403 error is received</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1774008001">- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add Cargo_toml.patch to re-generate TSS bindings</changelog>
  <changelog author="Aaron Puchert &lt;aaronpuchert@alice-dsl.net&gt;" date="1775908800">- Build with Clang &lt;= 21 for now to work around boo#1260596.</changelog>
  <changelog author="aplanas@suse.com" date="1776081600">- Update to version 0.2.9+21:
  * tests: use Express-style named params in Mockoon endpoints
  * build(deps): bump pest_derive from 2.8.1 to 2.8.6
  * build(deps): bump trybuild from 1.0.110 to 1.0.115
  * build(deps): bump log from 0.4.28 to 0.4.29
  * build(deps): bump uuid from 1.19.0 to 1.20.0
  * build(deps): bump codecov/codecov-action from 5 to 6
  * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  * build(deps): bump cfg-if from 1.0.3 to 1.0.4
  * build(deps): bump tokio from 1.49.0 to 1.50.0
  * build(deps): bump actix-web from 4.12.1 to 4.13.0
  * build(deps): bump anyhow from 1.0.99 to 1.0.102
  * build(deps): bump clap from 4.5.57 to 4.5.60
  * build(deps): bump tracing from 0.1.36 to 0.1.44</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1776081601">- Make tss-esai-sys depends on bindgen 72.1 to support llvm &gt; 21</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Remove Cargo_toml.patch (merged upstream)
- Update openssl to 0.10.81
  bsc#1270174, CVE-2026-41676
  bsc#1270999, CVE-2026-45784
  bsc#1270903, CVE-2026-44662
  bsc#1270842, CVE-2026-41898
  bsc#1270792, CVE-2026-41681
  bsc#1270699, CVE-2026-41678
  bsc#1270614, CVE-2026-41677
  bsc#1270523, CVE-2026-42327
- Update to version 0.2.9+49:
  * build(deps): bump uuid from 1.23.3 to 1.23.4
  * build(deps): bump syn from 2.0.117 to 2.0.118
  * build(deps): bump openssl from 0.10.80 to 0.10.81
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * Added new regression test into packit-ci.yaml
  * build(deps): bump actions/checkout from 6 to 7
  * build(deps): bump uuid from 1.23.1 to 1.23.3
  * build(deps): bump log from 0.4.29 to 0.4.32
  * build(deps): bump http from 1.4.0 to 1.4.2
  * build(deps): bump codecov/codecov-action from 6 to 7
  * build(deps): bump retry-policies from 0.5.1 to 0.5.2
  * fix: Remove unused base64::Engine import in context_info tests
  * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  * build(deps): bump serde_json from 1.0.149 to 1.0.150
  * build(deps): bump openssl from 0.10.79 to 0.10.80
  * agent: Hash agent ID before TPM2_Certify qualifying data
  * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  * build(deps): bump openssl from 0.10.78 to 0.10.79
  * build(deps): bump once_cell from 1.21.3 to 1.21.4
  * build(deps): bump tempfile from 3.23.0 to 3.27.0
  * push-model: cache UEFI event log bytes at startup
  * build(deps): bump quote from 1.0.40 to 1.0.45
  * build(deps): bump chrono from 0.4.42 to 0.4.44
  * build(deps): bump openssl from 0.10.73 to 0.10.78
  * build(deps): bump serde_json from 1.0.143 to 1.0.149
  * build(deps): bump syn from 2.0.106 to 2.0.117
  * build(deps): bump libc from 0.2.175 to 0.2.184
  * build(deps): bump rand from 0.9.2 to 0.9.4</changelog>
</package>
<package pkgid="02fbcce4f5ce2d7a947b2206c3750eacea68bdcee1637ed884619834914b71b1cd88fd1fcd2c5546427d07c045a09299de9a06415472f21efe996357575be211" name="rust-keylime" arch="src">
  <version epoch="0" ver="0.2.9+49" rel="87.3"/>
  <changelog author="aplanas@suse.com" date="1701432000">- Update to version 0.2.3+git.1701075380.a5dc985:
  * build(deps): bump actix-rt from 2.8.0 to 2.9.0
  * Bump version to 0.2.3
  * build(deps): bump reqwest from 0.11.20 to 0.11.22
  * Bump configuration version and fix enable_iak_idevid
  * Enable test functional/iak-idevid-register-with-certificates
  * Update packit plan with new tests
  * Add certificates and certificate checking for IDevID and IAK keys (#669)</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version 0.2.4+git.1706692574.a744517:
  * Bump version to 0.2.4
  * build(deps): bump uuid from 1.4.1 to 1.7.0
  * keylime-agent.conf: Allow setting event logs paths
  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.
  * workflows: Update checkout action to version 4
  * build(deps): bump serde from 1.0.188 to 1.0.195
  * build(deps): bump pest_derive from 2.7.0 to 2.7.6
  * build(deps): bump openssl from 0.10.62 to 0.10.63
  * build(deps): bump config from 0.13.3 to 0.13.4
  * build(deps): bump base64 from 0.21.4 to 0.21.7
  * build(deps): bump tempfile from 3.8.0 to 3.9.0
  * build(deps): bump pest from 2.7.0 to 2.7.6
  * build(deps): bump actix-web from 4.4.0 to 4.4.1
  * build(deps): bump reqwest from 0.11.22 to 0.11.23
  * build(deps): bump h2 from 0.3.17 to 0.3.24
  * build(deps): bump shlex from 1.1.0 to 1.3.0
  * cargo: Bump tss-esapi to version 7.4.0
  * workflows: Fix keylime-bot token usage
  * tpm: Add error context for every possible error
  * tpm: Add AlgorithmError to TpmError
  * detect idevid template from certificates
  * build(deps): bump wiremock from 0.5.18 to 0.5.22
  * build(deps): bump thiserror from 1.0.48 to 1.0.56
  * Make use of workspace dependencies
  * build(deps): bump openssl from 0.10.57 to 0.10.62
  * packit: Bump Fedora version used for code coverage</changelog>
  <changelog author="aplanas@suse.com" date="1714478400">- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)
- Update to version 0.2.4~39:
  * build(deps): bump openssl from 0.10.63 to 0.10.64
  * build(deps): bump h2 from 0.3.24 to 0.3.26
  * build(deps): bump serde_json from 1.0.107 to 1.0.116
  * build(deps): bump actix-web from 4.4.1 to 4.5.1
  * crypto: Enable TLS 1.3
  * build(deps): bump tempfile from 3.9.0 to 3.10.1
  * build(deps): bump mio from 0.8.4 to 0.8.11
  * enable hex values to be used for tpm_ownerpassword
  * config: Support IPv6 with or without brackets
  * keylime: Implement a simple IP parser to remove brackets
  * crypto: Implement CertificateBuilder to generate certificates
  * tests: Fix coverage download by supporting arbitrary URL
  * cargo: Add testing feature to keylime library
  * Set X509 SAN with local DNSname/IP/IPv6
  * Include newest Node20 versions for Github actions
  * tpm: Add unit test for uncovered public functions
  * crypto: Implement ECC key generation support
  * crypto: Add test for match_cert_to_template()
  * Fix minor typo, format and remove end whitespaces
  * crypto: Make error types less specific
  * tests/run.sh: Run tarpaulin with a single thread
  * payloads: Remove explicit drop of channel transmitter
  * crypto: Move to keylime library
  * crypto: Add specific type for every possible error
  * tpm: Rename origin of error as source in structures
  * list_parser: Add source for error for backtrace
  * algorithms: Make errors more specific
  * typo fix for default path to measured boot log file
  * README: remove mentions of libarchive as a dependency
  * Dockerfile.wolfi: Update clang to version 17
  * docker: Remove libarchive as a dependency
  * rpm: Remove libarchive from dependencies
  * cargo: Replace compress-tools with zip crate
  * cargo: Bump ahash to version 0.8.7
  * build(deps): bump serde from 1.0.195 to 1.0.196
  * build(deps): bump libc from 0.2.152 to 0.2.153
  * build(deps): bump reqwest from 0.11.23 to 0.11.24
  * docker: Install configuration file in the correct path
  * config: Make IAK/IDevID disabled by default</changelog>
  <changelog author="aplanas@suse.com" date="1714651200">- Update to version 0.2.5~0:
  * Bump version to 0.2.5
  * cargo: Relax required version for pest crate
  * build(deps): bump log from 0.4.20 to 0.4.21
  * build(deps): bump thiserror from 1.0.56 to 1.0.59</changelog>
  <changelog author="aplanas@suse.com" date="1715860800">- Update to version 0.2.5~4:
  * Fix 'unnecessary qualification' warnings
  * fix IAK template to match IDevID
  * rpm: fix COPR RPMs build for centos-stream-10
  * Build COPR RPMs for centos-stream-10</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version 0.2.6~0:
  * Bump version to 0.2.6
  * build(deps): bump libc from 0.2.153 to 0.2.155
  * build(deps): bump serde from 1.0.196 to 1.0.203
  * rpm/fedora: Update rust macro usage
  * config: Support hostnames in registrar_ip option
  * added use of persisted IAK and IDevID and authorisation values
  * config changes
  * Adding /agent/info API to agent
  * Fix leftover 'unnecessary qualification' warnings on tests</changelog>
  <changelog author="aplanas@suse.com" date="1725278400">- Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
  * rustix 0.37.25
  * rustix 0.38.34
  * shlex  1.3.0
- Update to version 0.2.6+13:
  * Enable test functional/iak-idevid-persisted-and-protected
  * build(deps): bump uuid from 1.7.0 to 1.10.0
  * build(deps): bump openssl from 0.10.64 to 0.10.66
  * keylime-agent/src/revocation: Fix comment indentation
  * keylime/crypto: Fix indentation of documentation comment
  * build(deps): bump thiserror from 1.0.59 to 1.0.63
  * build(deps): bump serde_json from 1.0.116 to 1.0.120
  * dependabot: Extend to also monitor workflow actions
  * ci: Disable Packit CI on CentOS Stream 9
  * ci: use CODECOV_TOKEN when submitting coverage data
  * revocation: Use into() for unfallible transformation
  * secure_mount: Fix possible infinite loop
  * error: Rename enum variants to avoid clippy warning</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version 0.2.7+1:
  * dist: Enable logging for keylime library in the service
  * Bump version to 0.2.7
  * scripts: Download coverage data from Testing Farm directly
  * main: Remove unnecessary lifetime
  * cargo: Bump pretty_env_logger to version 0.5.0
  * scripts: Fix regex in download_packit_coverage.sh
  * cargo: Bump clap crate to version 4.5.23
  * cargo: Bump base64 crate to version 0.22.1
  * build(deps): bump log from 0.4.22 to 0.4.25
  * build(deps): bump serde_json from 1.0.133 to 1.0.135
  * cargo: Bump tokio crate to version 1.42.0
  * packit: Fix RPM builds on copr
  * cargo: Bump thiserror crate to version 0.2.9
  * cargo: Update reqwest to version 0.12.12
  * build(deps): bump libc from 0.2.168 to 0.2.169
  * build(deps): bump glob from 0.3.1 to 0.3.2
  * version: Implement API version validation and ordering
  * main: Support using multiple API versions for registration
  * keylime: Introduce the registrar_client module
  * Provide endpoints under multiple API versions
  * Move 'serialization' module to the keylime library
  * Drop unnecessary dependency on common::API_VERSION
  * keylime-agent.conf: Bump version to 2.3
  * build(deps): bump serde from 1.0.210 to 1.0.217
  * build(deps): bump pest_derive from 2.7.14 to 2.7.15
  * build(deps): bump pest from 2.7.14 to 2.7.15
  * build(deps): bump libc from 0.2.167 to 0.2.168
  * config: Make IAK and IDevID certificates optional
  * Fix warnings reported by clippy
  * workflows: Run job in the CI container directly
  * tests: Add unit test for device ID builder
  * main: Move IAK/IDevID related code to dedicated module
  * tests: Add script to generate IAK and IDevID certificates
  * build(deps): bump openssl from 0.10.66 to 0.10.68
  * build(deps): bump uuid from 1.10.0 to 1.11.0
  * build(deps): bump serde_json from 1.0.128 to 1.0.133
  * build(deps): bump actix-web from 4.5.1 to 4.9.0
  * build(deps): bump reqwest from 0.12.7 to 0.12.9
  * tests/setup_swtpm.sh: Add script to setup temporary TPM
  * Use a single TPM context and avoid race conditions during tests
  * config: Enable passing a hostname instead of IP
  * build(deps): bump clap from 4.3.11 to 4.5.21
  * build(deps): bump tempfile from 3.10.1 to 3.14.0
  * build(deps): bump pest_derive from 2.7.6 to 2.7.14
  * build(deps): bump pest from 2.7.6 to 2.7.14
  * build(deps): bump codecov/codecov-action from 4 to 5
  * workflows: Submit the coverage for merged PR from Fedora 41
  * tests: Use Fedora 41 to generate code coverage
  * api: Make API configuration modular
  * agent_handler: Move the /agent scope configuration
  * notifications_handler: Move the /notifications scope configuration
  * quotes_handler: Move the /quotes scope configuration to quotes_handler
  * keys_handler: Move /keys scope configuration to keys_handler
  * Use ${DESTDIR} for config
  * Fix showing wrong UUID
  * build(deps): bump actix-rt from 2.9.0 to 2.10.0
  * config: Refactor AgentConfig Source trait implementation
  * build(deps): bump log from 0.4.21 to 0.4.22
  * build(deps): bump serde_json from 1.0.120 to 1.0.128
  * tpm: check if EK certificate has valid ASN.1 DER encoding
  * build(deps): bump futures from 0.3.27 to 0.3.31
  * cargo: Bump reqwest to version 0.12.7
  * build(deps): bump serde from 1.0.203 to 1.0.210
  * tests: Add more tests to Packit CI
  * build(deps): bump docker/build-push-action from 5 to 6
  * tests: apply workarounds to known bugs</changelog>
  <changelog author="aplanas@suse.com" date="1749124800">- Update vendored crates (bsc#1243861, CVE-2024-12224)
  * idna 1.0.3
- Add Cargo_lock.patch to adjust versions that will allow the
  compilation of mbox crate
- Update to version 0.2.7+70:
  * build(deps): bump wiremock from 0.6.2 to 0.6.3
  * build(deps): bump uuid from 1.16.0 to 1.17.0
  * lib: Introduce AgentIdentity structure
  * gitignore: Add *.swp and *.orig to be ignored
  * build(deps): bump clap from 4.5.38 to 4.5.39
  * build(deps): bump tokio from 1.45.0 to 1.45.1
  * Unify Push Model structures time formats to UTC (#1016)
  * Add Quote related structures to Keylime library
  * Remove configuration file trailing whitespaces (#1012)
  * keylime-agent.conf: add all accepted TPM encryption algs
  * tpm: add policy auth for EK to activate crendential
  * Enable non standard key sizes and curves for EK and AK
  * config: Use next_back() instead of last() for iterators
  * Update to tss-esapi v7.6.0
  * Avoid duplicated call to ctx.create_ek
  * build(deps): bump clap from 4.5.23 to 4.5.38
  * Add registration for Push Model client
  * build(deps): bump tokio from 1.44.2 to 1.45.0
  * build(deps): bump chrono from 0.4.40 to 0.4.41
  * build(deps): bump tempfile from 3.17.1 to 3.20.0
  * Refactor code: move error, registration to lib
  * Move structure filling and URL selection code (#999)
  * build(deps): bump pest_derive from 2.7.15 to 2.8.0
  * build(deps): bump pest from 2.7.15 to 2.8.0
  * build(deps): bump libc from 0.2.169 to 0.2.172
  * Add Evidence/Authentication messages to prototype
  * build(deps): bump uuid from 1.15.1 to 1.16.0
  * build(deps): bump thiserror from 2.0.11 to 2.0.12
  * build(deps): bump signal-hook from 0.3.17 to 0.3.18
  * build(deps): bump log from 0.4.25 to 0.4.27
  * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
  * build(deps): bump actix-web from 4.9.0 to 4.10.2
  * build(deps): bump reqwest from 0.12.12 to 0.12.15
  * build(deps): bump serde from 1.0.217 to 1.0.219
  * Add unit tests for sessions.rs structures
  * Add auth(sessions) structures
  * Fix minor README.md issue (#988)
  * Define EvidenceHandling structures (#971)
  * Add mockoon test scenario
  * Add client certificates to push-attestation prototype
  * Cargo: bump url crate to version 2.5.4
  * Add logging to the push attestation prototype
  * Do not use certificate on insecure mode
  * common: Move the EncryptedData structure from common to the library
  * common: Move AuthTag from common to the library
  * build(deps): bump openssl from 0.10.71 to 0.10.72
  * common: Move Symmkey to library as crypto::symmkey
  * common: Remove unused constants and static values
  * build(deps): bump tokio from 1.43.0 to 1.44.2
  * Refactor code: Include AgentIdentity structure
  * Push model prototype
  * Add support for ek certificate chain, stored in TPM NVRAM.
  * Recover key_class field and set it as "asymmetric"
  * Update push model structures to latest values
  * build(deps): bump serde_json from 1.0.138 to 1.0.140
  * packit: Add identifier for each copr_build job
  * keylime-agent.conf: only mention ecdsa and rsassa for signing
  * build(deps): bump openssl from 0.10.70 to 0.10.71
  * build(deps): bump uuid from 1.13.2 to 1.15.1
  * Add capabilities_negotiation structures
  * packit: Add compatibility/api_version_compatibility test
  * build(deps): bump uuid from 1.11.0 to 1.13.2
  * build(deps): bump serde_json from 1.0.135 to 1.0.138
  * build(deps): bump thiserror from 2.0.9 to 2.0.11
  * build(deps): bump tempfile from 3.14.0 to 3.17.1
  * Allow agent to start as non-root
  * scripts: Fix coverage information downloading script
  * build(deps): bump openssl from 0.10.68 to 0.10.70
  * build(deps): bump tokio from 1.42.0 to 1.43.0</changelog>
  <changelog author="aplanas@suse.com" date="1752494400">- Update vendored crates (bsc#1242623, CVE-2025-3416)
  * openssl 0.10.73
- Update to version 0.2.7+117:
  * Increase coverage in evidence handling structure
  * Add Capabilities Negotiations resp. missing fields
  * Fix UEFI test to check file access in all cases
  * context_info_handler: Do not assume /var/lib/keylime exists
  * Fix clippy warnings about uninlined format arguments
  * attestation: Allow unwrap() in tests
  * Increase coverage (groom code, extend unit tests)
  * Include IMA/UEFI logs in Evidence Handling request
  * Include method to get all IMA entries as string
  * Send correct list of pcr banks and sign algorithms
  * Try to fix TPM tests related issues
  * Define attestation perform asynchronous
  * Perform attestation in push model agent binary
  * Refactor code to use new attestation.rs
  * Create attestation.rs for Attestation stuff
  * Move ContextInfo management to its own handler
  * Adjust context_info.rs after rebase
  * Add attestation function to ContextInfo structure
  * Add prohibited signing algorithms, avoid ecschnorr
  * keylime/config: Use macro to implement PushModelConfigTrait
  * Introduce keylime-macros and define_view_trait
  * config: Remove KeylimeConfig structure
  * config: Remove unnecessary options and lazy initialization
  * Fix pcr_bank function to send all possible slots
  * Send Content-Type:application/json on request (#1039)
  * Send correct 'key_algorithm' in certification_keys (#1035)
  * Push Model: Persist Attestation Key to file
  * Add Keylime push model binary to root GNUmakefile
  * Use singleton to avoid multiple Context allocation
  * tests: Do not assume `/var/lib/keylime` exists (#1030)
  * lib/cert: Fix race condition due to use of same file path
  * payloads: Fix race condition in tests
  * Add uefi_log_handler.rs to parse UEFI binary
  * Use IMA log parser to send correct entry count
  * Add IMA log parser
  * build(deps): bump once_cell from 1.19.0 to 1.21.3
  * lib/config/base.rs: Add more unit tests
  * lib/permissions: Add unit tests
  * keylime-agent: move JsonWrapper from common.rs to the library
  * lib/agent_data: Move agent_data related tests from common
  * common: Replace APIVersion with the library Version structure
  * keylime_agent: Move secure_mount.rs to the library
  * lib: Rename keylime_error.rs as error.rs
  * config: Move config to keylime library
  * config: Rename push_model_config to push_model
  * lib: Move permissions.rs from keylime-agent to the lib
  * Extract Capabilities Negotiation info from TPM (#1014)</changelog>
  <changelog author="aplanas@suse.com" date="1754568000">- Update vendored crates (bsc#1247193, CVE-2025-58266)
  * shlex 1.3.0
- Rebase keylime-agent.conf.diff for current configuration
- Drop Cargo_lock.patch patch, already present in Cargo.lock
- Update to version 0.2.7+141:
  * service: Use WantedBy=multi-user.target
  * rpm: Add subpackage for push-attestation agent
  * push-model: implement continuous attestation with configurable intervals
  * Retry registration forever in the state machine
  * Add Verifier URL to configuration
  * Align exp.backoff to current configuration format
  * Increase coverage of state machine (using Context)
  * Increase coverage of struct_filler.rs
  * Groom code (remove dead code)
  * Fix exponential backoff (10secs, 4xx accepted)
  * test: Add documentation test to tests/run.sh
  * tpm: Avoid running code example during documentation tests
  * state_machine: Always start the agent from the Unregistered state
  * Add fixes for the URL construction
  * Refactor evidences collection in push attestation agent
  * push-model: refactor attestation logic into a state machine
  * Fix body sending by allowing serializing strings (#1057)
  * Log ResilientClient errors/response status codes (#1055)
  * Add AK signing scheme and hash algorithm to negotiation
  * tpm: Add method to extract signing scheme and hash algorithm from AK
  * Allow custom content-type/accept headers
  * Integrate exponential backoff to registration (#1052)
  * keylime/structures: Rename ShaValues to PcrBanks
  * Add resilient_client for exponential backoff (#1048)</changelog>
  <changelog author="aplanas@suse.com" date="1755691200">- Update vendored crates (bsc#1248006, CVE-2025-55159)
  * slab 0.4.11
- Add Cargo_lock.patch patch to update slab and other dependencies
- Update to version 0.2.8+12:
  * build(deps): bump actions/checkout from 4 to 5
  * build(deps): bump cfg-if from 1.0.0 to 1.0.1
  * build(deps): bump openssl from 0.10.72 to 0.10.73
  * build(deps): bump clap from 4.5.39 to 4.5.45
  * build(deps): bump pest from 2.8.0 to 2.8.1
  * Fix clippy warnings
  * Use verifier-provided interval for continuous attestation timing
  * Add meta object with seconds_to_next_attestation to evidence response
  * Fix boot time retrieval
  * Fix IMA log format (it must be ['text/plain']) (#1073)
  * Remove unnecessary configuration fields
  * cargo: Bump retry-policies to version 0.4.0
  * Bump version to 0.2.8</changelog>
  <changelog author="aplanas@suse.com" date="1767787200">- Use tmpfiles.d for /var directories (PED-14736)
  + tmpfiles.keylime renamed to rust-keylime.conf and extended
- Update to version 0.2.8+96:
  * build(deps): bump wiremock from 0.6.4 to 0.6.5
  * build(deps): bump actions/checkout from 5 to 6
  * build(deps): bump chrono from 0.4.41 to 0.4.42
  * packit: Get coverage from Fedora 43 runs
  * Fix issues pointed out by clippy
  * Replace mutex unwraps with proper error handling in TPM library
  * Remove unused session request methods from StructureFiller
  * Fix config panic on missing ek_handle in push model agent
  * build(deps): bump tempfile from 3.21.0 to 3.23.0
  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  * Fix clippy warnings project-wide
  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  * Thread privileged resources and use MeasurementList for IMA reading
  * Add privileged resource initialization and privilege dropping to push model agent
  * Fix privilege dropping order in run_as()
  * add documentation on FQDN hostnames
  * Remove confusing logs for push mode agent
  * Set correct default Verifier port (8891-&gt;8881) (#1159)
  * Add verifier_url to reference configuration file (#1158)
  * Add TLS support for Registrar communication (#1139)
  * Fix agent handling of 403 registration responses (#1154)
  * Add minor README.md rephrasing (#1151)
  * build(deps): bump actions/checkout from 5 to 6 (#1153)
  * ci: update spec files for packit COPR build
  * docs: improve challenge encoding and async TPM documentation
  * refactor: improve middleware and error handling
  * feat: add authentication client with middleware integration
  * docker: Include keylime_push_model_agent binary
  * Include attestation_interval configuration (#1146)
  * Persist payload keys to avoid attestation failure on restart
  * crypto: Implement the load or generate pattern for keys
  * Use simple algorithm specifiers in certification_keys object (#1140)
  * tests: Enable more tests in CI
  * Fix RSA2048 algorithm reporting in keylime agent
  * Remove disabled_signing_algorithms configuration
  * rpm: Fix metadata patches to apply to current code
  * workflows/rpm.yml: Use more strict patching
  * build(deps): bump uuid from 1.17.0 to 1.18.1
  * Fix ECC algorithm selection and reporting for keylime agent
  * Improve logging consistency and coherency
  * Implement minimal RFC compliance for Location header and URI parsing (#1125)
  * Use separate keys for payload mechanism and mTLS
  * docker: update rust to 1.81 for distroless Dockerfile
  * Ensure UEFI log capabilities are set to false
  * build(deps): bump http from 1.1.0 to 1.3.1
  * build(deps): bump log from 0.4.27 to 0.4.28
  * build(deps): bump cfg-if from 1.0.1 to 1.0.3
  * build(deps): bump actix-rt from 2.10.0 to 2.11.0
  * build(deps): bump async-trait from 0.1.88 to 0.1.89
  * build(deps): bump trybuild from 1.0.105 to 1.0.110
  * Accept evidence handling structures null entries
  * workflows: Add test to check if RPM patches still apply
  * CI: Enable test add-agent-with-malformed-ek-cert
  * config: Fix singleton tests
  * FSM: Remove needless lifetime annotations (#1105)
  * rpm: Do not remove wiremock which is now available in Fedora
  * Use latest Fedora httpdate version (1.0.3)
  * Enhance coverage with parse_retry_after test
  * Fix issues reported by CI regarding unwrap() calls
  * Reuse max retries indicated to the ResilientClient
  * Include limit of retries to 5 for Retry-After
  * Add policy to handle Retry-After response headers
  * build(deps): bump wiremock from 0.6.3 to 0.6.4
  * build(deps): bump serde_json from 1.0.140 to 1.0.143
  * build(deps): bump pest_derive from 2.8.0 to 2.8.1
  * build(deps): bump syn from 2.0.90 to 2.0.106
  * build(deps): bump tempfile from 3.20.0 to 3.21.0
  * build(deps): bump thiserror from 2.0.12 to 2.0.16
  * rpm: Fix patches to apply to current master code
  * build(deps): bump anyhow from 1.0.98 to 1.0.99
  * state_machine: Automatically clean config override during tests
  * config: Implement singleton and factory pattern
  * testing: Support overriding configuration during tests
  * feat: implement standalone challenge-response authentication module
  * structures: rename session structs for clarity and fix typos
  * tpm: refactor certify_credential_with_iak() into a more generic function
  * Add Push Model Agent Mermaid FSM chart (#1095)
  * Add state to avoid exiting on wrong attestation (#1093)
  * Add 6 alphanumeric lowercase X-Request-ID header
  * Enhance Evidence Handling response parsing
  * build(deps): bump quote from 1.0.35 to 1.0.40
  * build(deps): bump libc from 0.2.172 to 0.2.175
  * build(deps): bump glob from 0.3.2 to 0.3.3
  * build(deps): bump actix-web from 4.10.2 to 4.11.0</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update vendored crates (bsc#1257908, CVE-2026-25727)
  * time 0.3.47
- Update to version 0.2.8+116:
  * build(deps): bump bytes from 1.7.2 to 1.11.1
  * api: Modify /version endpoint output in version 2.5
  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  * tests: add unit test for resolve_agent_id (#1182)
  * (pull-model): enable retry logic for registration
  * rpm: Update specfiles to apply on master
  * workflows: Add test to detect unused crates
  * lib: Drop unused crates
  * push-model: Drop unused crates
  * keylime-agent: Drop unused crates
  * build(deps): bump uuid from 1.18.1 to 1.19.0
  * Update reqwest-retry to 0.8, retry-policies to 0.5
  * rpm: Fix cargo_build macro usage on CentOS Stream
  * fix(push-model): resolve hash_ek uuid to actual EK hash
  * build(deps): bump thiserror from 2.0.16 to 2.0.17
  * workflows: Separate upstream test suite from e2e coverage
  * Send UEFI measured boot logs as raw bytes (#1173)
  * auth: Add unit tests for SecretToken implementation
  * packit: Enable push-attestation tests
  * resilient_client: Prevent authentication token leakage in logs</changelog>
  <changelog author="aplanas@suse.com" date="1774008000">- Update to version 0.2.9+8:
  * build(deps): bump thiserror from 2.0.17 to 2.0.18
  * build(deps): bump docker/login-action from 3 to 4
  * build(deps): bump docker/metadata-action from 5 to 6
  * Remove generate-bindings feature from tss-esapi
  * Use port constants instead of hardcoded values in tests
  * push-attestation: Use registrar TLS port when TLS is enabled
  * build(deps): bump docker/build-push-action from 6 to 7
  * build(deps): bump actions/upload-artifact from 6 to 7
  * dist: Make the services to conflict with each other
  * Bump version to 0.2.9
  * build(deps): bump mockoon/cli-action from 2 to 3
  * cargo: Bump tracing_subscriber to version 0.3.20
  * cargo: Bump time to version 0.3.47
  * build(deps): bump http from 1.3.1 to 1.4.0
  * Update reqwest from 0.12 to 0.13
  * build(deps): bump serde from 1.0.219 to 1.0.228
  * auth: Load CA certificate in authentication client
  * packit: Add missing e2e tests
  * registrar: Rename insecure option to disable_tls
  * push-attestation: Drop self-signed mTLS certificate generation
  * config: Add missing config options to keylime-agent.conf
  * config: Add support for "default" in registrar_api_versions option
  * config: Add support for "default" in registrar_tls_ca_cert option
  * config: Drop unused config options and constants
  * push-attestation: Drop support for mTLS to registrar
  * push-attestation: Drop mTLS support and require PoP authentication
  * build(deps): bump clap from 4.5.45 to 4.5.54
  * build(deps): bump actix-web from 4.11.0 to 4.12.1
  * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
  * resilient_client: Reauthenticate if a 403 error is received</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1774008001">- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add Cargo_toml.patch to re-generate TSS bindings</changelog>
  <changelog author="Aaron Puchert &lt;aaronpuchert@alice-dsl.net&gt;" date="1775908800">- Build with Clang &lt;= 21 for now to work around boo#1260596.</changelog>
  <changelog author="aplanas@suse.com" date="1776081600">- Update to version 0.2.9+21:
  * tests: use Express-style named params in Mockoon endpoints
  * build(deps): bump pest_derive from 2.8.1 to 2.8.6
  * build(deps): bump trybuild from 1.0.110 to 1.0.115
  * build(deps): bump log from 0.4.28 to 0.4.29
  * build(deps): bump uuid from 1.19.0 to 1.20.0
  * build(deps): bump codecov/codecov-action from 5 to 6
  * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  * build(deps): bump cfg-if from 1.0.3 to 1.0.4
  * build(deps): bump tokio from 1.49.0 to 1.50.0
  * build(deps): bump actix-web from 4.12.1 to 4.13.0
  * build(deps): bump anyhow from 1.0.99 to 1.0.102
  * build(deps): bump clap from 4.5.57 to 4.5.60
  * build(deps): bump tracing from 0.1.36 to 0.1.44</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1776081601">- Make tss-esai-sys depends on bindgen 72.1 to support llvm &gt; 21</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Remove Cargo_toml.patch (merged upstream)
- Update openssl to 0.10.81
  bsc#1270174, CVE-2026-41676
  bsc#1270999, CVE-2026-45784
  bsc#1270903, CVE-2026-44662
  bsc#1270842, CVE-2026-41898
  bsc#1270792, CVE-2026-41681
  bsc#1270699, CVE-2026-41678
  bsc#1270614, CVE-2026-41677
  bsc#1270523, CVE-2026-42327
- Update to version 0.2.9+49:
  * build(deps): bump uuid from 1.23.3 to 1.23.4
  * build(deps): bump syn from 2.0.117 to 2.0.118
  * build(deps): bump openssl from 0.10.80 to 0.10.81
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * Added new regression test into packit-ci.yaml
  * build(deps): bump actions/checkout from 6 to 7
  * build(deps): bump uuid from 1.23.1 to 1.23.3
  * build(deps): bump log from 0.4.29 to 0.4.32
  * build(deps): bump http from 1.4.0 to 1.4.2
  * build(deps): bump codecov/codecov-action from 6 to 7
  * build(deps): bump retry-policies from 0.5.1 to 0.5.2
  * fix: Remove unused base64::Engine import in context_info tests
  * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  * build(deps): bump serde_json from 1.0.149 to 1.0.150
  * build(deps): bump openssl from 0.10.79 to 0.10.80
  * agent: Hash agent ID before TPM2_Certify qualifying data
  * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  * build(deps): bump openssl from 0.10.78 to 0.10.79
  * build(deps): bump once_cell from 1.21.3 to 1.21.4
  * build(deps): bump tempfile from 3.23.0 to 3.27.0
  * push-model: cache UEFI event log bytes at startup
  * build(deps): bump quote from 1.0.40 to 1.0.45
  * build(deps): bump chrono from 0.4.42 to 0.4.44
  * build(deps): bump openssl from 0.10.73 to 0.10.78
  * build(deps): bump serde_json from 1.0.143 to 1.0.149
  * build(deps): bump syn from 2.0.106 to 2.0.117
  * build(deps): bump libc from 0.2.175 to 0.2.184
  * build(deps): bump rand from 0.9.2 to 0.9.4</changelog>
</package>
<package pkgid="795cee7e4eb78cd1ad564b5d910692eff3032cf94e3a7997c95773a5fa7f5946ebd84bfc7440a909d52728aca6ac445da3cf616657298af89a6deb74343723c3" name="rust-keylime-debuginfo" arch="s390x">
  <version epoch="0" ver="0.2.9+49" rel="87.3"/>
  <changelog author="aplanas@suse.com" date="1701432000">- Update to version 0.2.3+git.1701075380.a5dc985:
  * build(deps): bump actix-rt from 2.8.0 to 2.9.0
  * Bump version to 0.2.3
  * build(deps): bump reqwest from 0.11.20 to 0.11.22
  * Bump configuration version and fix enable_iak_idevid
  * Enable test functional/iak-idevid-register-with-certificates
  * Update packit plan with new tests
  * Add certificates and certificate checking for IDevID and IAK keys (#669)</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version 0.2.4+git.1706692574.a744517:
  * Bump version to 0.2.4
  * build(deps): bump uuid from 1.4.1 to 1.7.0
  * keylime-agent.conf: Allow setting event logs paths
  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.
  * workflows: Update checkout action to version 4
  * build(deps): bump serde from 1.0.188 to 1.0.195
  * build(deps): bump pest_derive from 2.7.0 to 2.7.6
  * build(deps): bump openssl from 0.10.62 to 0.10.63
  * build(deps): bump config from 0.13.3 to 0.13.4
  * build(deps): bump base64 from 0.21.4 to 0.21.7
  * build(deps): bump tempfile from 3.8.0 to 3.9.0
  * build(deps): bump pest from 2.7.0 to 2.7.6
  * build(deps): bump actix-web from 4.4.0 to 4.4.1
  * build(deps): bump reqwest from 0.11.22 to 0.11.23
  * build(deps): bump h2 from 0.3.17 to 0.3.24
  * build(deps): bump shlex from 1.1.0 to 1.3.0
  * cargo: Bump tss-esapi to version 7.4.0
  * workflows: Fix keylime-bot token usage
  * tpm: Add error context for every possible error
  * tpm: Add AlgorithmError to TpmError
  * detect idevid template from certificates
  * build(deps): bump wiremock from 0.5.18 to 0.5.22
  * build(deps): bump thiserror from 1.0.48 to 1.0.56
  * Make use of workspace dependencies
  * build(deps): bump openssl from 0.10.57 to 0.10.62
  * packit: Bump Fedora version used for code coverage</changelog>
  <changelog author="aplanas@suse.com" date="1714478400">- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)
- Update to version 0.2.4~39:
  * build(deps): bump openssl from 0.10.63 to 0.10.64
  * build(deps): bump h2 from 0.3.24 to 0.3.26
  * build(deps): bump serde_json from 1.0.107 to 1.0.116
  * build(deps): bump actix-web from 4.4.1 to 4.5.1
  * crypto: Enable TLS 1.3
  * build(deps): bump tempfile from 3.9.0 to 3.10.1
  * build(deps): bump mio from 0.8.4 to 0.8.11
  * enable hex values to be used for tpm_ownerpassword
  * config: Support IPv6 with or without brackets
  * keylime: Implement a simple IP parser to remove brackets
  * crypto: Implement CertificateBuilder to generate certificates
  * tests: Fix coverage download by supporting arbitrary URL
  * cargo: Add testing feature to keylime library
  * Set X509 SAN with local DNSname/IP/IPv6
  * Include newest Node20 versions for Github actions
  * tpm: Add unit test for uncovered public functions
  * crypto: Implement ECC key generation support
  * crypto: Add test for match_cert_to_template()
  * Fix minor typo, format and remove end whitespaces
  * crypto: Make error types less specific
  * tests/run.sh: Run tarpaulin with a single thread
  * payloads: Remove explicit drop of channel transmitter
  * crypto: Move to keylime library
  * crypto: Add specific type for every possible error
  * tpm: Rename origin of error as source in structures
  * list_parser: Add source for error for backtrace
  * algorithms: Make errors more specific
  * typo fix for default path to measured boot log file
  * README: remove mentions of libarchive as a dependency
  * Dockerfile.wolfi: Update clang to version 17
  * docker: Remove libarchive as a dependency
  * rpm: Remove libarchive from dependencies
  * cargo: Replace compress-tools with zip crate
  * cargo: Bump ahash to version 0.8.7
  * build(deps): bump serde from 1.0.195 to 1.0.196
  * build(deps): bump libc from 0.2.152 to 0.2.153
  * build(deps): bump reqwest from 0.11.23 to 0.11.24
  * docker: Install configuration file in the correct path
  * config: Make IAK/IDevID disabled by default</changelog>
  <changelog author="aplanas@suse.com" date="1714651200">- Update to version 0.2.5~0:
  * Bump version to 0.2.5
  * cargo: Relax required version for pest crate
  * build(deps): bump log from 0.4.20 to 0.4.21
  * build(deps): bump thiserror from 1.0.56 to 1.0.59</changelog>
  <changelog author="aplanas@suse.com" date="1715860800">- Update to version 0.2.5~4:
  * Fix 'unnecessary qualification' warnings
  * fix IAK template to match IDevID
  * rpm: fix COPR RPMs build for centos-stream-10
  * Build COPR RPMs for centos-stream-10</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version 0.2.6~0:
  * Bump version to 0.2.6
  * build(deps): bump libc from 0.2.153 to 0.2.155
  * build(deps): bump serde from 1.0.196 to 1.0.203
  * rpm/fedora: Update rust macro usage
  * config: Support hostnames in registrar_ip option
  * added use of persisted IAK and IDevID and authorisation values
  * config changes
  * Adding /agent/info API to agent
  * Fix leftover 'unnecessary qualification' warnings on tests</changelog>
  <changelog author="aplanas@suse.com" date="1725278400">- Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
  * rustix 0.37.25
  * rustix 0.38.34
  * shlex  1.3.0
- Update to version 0.2.6+13:
  * Enable test functional/iak-idevid-persisted-and-protected
  * build(deps): bump uuid from 1.7.0 to 1.10.0
  * build(deps): bump openssl from 0.10.64 to 0.10.66
  * keylime-agent/src/revocation: Fix comment indentation
  * keylime/crypto: Fix indentation of documentation comment
  * build(deps): bump thiserror from 1.0.59 to 1.0.63
  * build(deps): bump serde_json from 1.0.116 to 1.0.120
  * dependabot: Extend to also monitor workflow actions
  * ci: Disable Packit CI on CentOS Stream 9
  * ci: use CODECOV_TOKEN when submitting coverage data
  * revocation: Use into() for unfallible transformation
  * secure_mount: Fix possible infinite loop
  * error: Rename enum variants to avoid clippy warning</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version 0.2.7+1:
  * dist: Enable logging for keylime library in the service
  * Bump version to 0.2.7
  * scripts: Download coverage data from Testing Farm directly
  * main: Remove unnecessary lifetime
  * cargo: Bump pretty_env_logger to version 0.5.0
  * scripts: Fix regex in download_packit_coverage.sh
  * cargo: Bump clap crate to version 4.5.23
  * cargo: Bump base64 crate to version 0.22.1
  * build(deps): bump log from 0.4.22 to 0.4.25
  * build(deps): bump serde_json from 1.0.133 to 1.0.135
  * cargo: Bump tokio crate to version 1.42.0
  * packit: Fix RPM builds on copr
  * cargo: Bump thiserror crate to version 0.2.9
  * cargo: Update reqwest to version 0.12.12
  * build(deps): bump libc from 0.2.168 to 0.2.169
  * build(deps): bump glob from 0.3.1 to 0.3.2
  * version: Implement API version validation and ordering
  * main: Support using multiple API versions for registration
  * keylime: Introduce the registrar_client module
  * Provide endpoints under multiple API versions
  * Move 'serialization' module to the keylime library
  * Drop unnecessary dependency on common::API_VERSION
  * keylime-agent.conf: Bump version to 2.3
  * build(deps): bump serde from 1.0.210 to 1.0.217
  * build(deps): bump pest_derive from 2.7.14 to 2.7.15
  * build(deps): bump pest from 2.7.14 to 2.7.15
  * build(deps): bump libc from 0.2.167 to 0.2.168
  * config: Make IAK and IDevID certificates optional
  * Fix warnings reported by clippy
  * workflows: Run job in the CI container directly
  * tests: Add unit test for device ID builder
  * main: Move IAK/IDevID related code to dedicated module
  * tests: Add script to generate IAK and IDevID certificates
  * build(deps): bump openssl from 0.10.66 to 0.10.68
  * build(deps): bump uuid from 1.10.0 to 1.11.0
  * build(deps): bump serde_json from 1.0.128 to 1.0.133
  * build(deps): bump actix-web from 4.5.1 to 4.9.0
  * build(deps): bump reqwest from 0.12.7 to 0.12.9
  * tests/setup_swtpm.sh: Add script to setup temporary TPM
  * Use a single TPM context and avoid race conditions during tests
  * config: Enable passing a hostname instead of IP
  * build(deps): bump clap from 4.3.11 to 4.5.21
  * build(deps): bump tempfile from 3.10.1 to 3.14.0
  * build(deps): bump pest_derive from 2.7.6 to 2.7.14
  * build(deps): bump pest from 2.7.6 to 2.7.14
  * build(deps): bump codecov/codecov-action from 4 to 5
  * workflows: Submit the coverage for merged PR from Fedora 41
  * tests: Use Fedora 41 to generate code coverage
  * api: Make API configuration modular
  * agent_handler: Move the /agent scope configuration
  * notifications_handler: Move the /notifications scope configuration
  * quotes_handler: Move the /quotes scope configuration to quotes_handler
  * keys_handler: Move /keys scope configuration to keys_handler
  * Use ${DESTDIR} for config
  * Fix showing wrong UUID
  * build(deps): bump actix-rt from 2.9.0 to 2.10.0
  * config: Refactor AgentConfig Source trait implementation
  * build(deps): bump log from 0.4.21 to 0.4.22
  * build(deps): bump serde_json from 1.0.120 to 1.0.128
  * tpm: check if EK certificate has valid ASN.1 DER encoding
  * build(deps): bump futures from 0.3.27 to 0.3.31
  * cargo: Bump reqwest to version 0.12.7
  * build(deps): bump serde from 1.0.203 to 1.0.210
  * tests: Add more tests to Packit CI
  * build(deps): bump docker/build-push-action from 5 to 6
  * tests: apply workarounds to known bugs</changelog>
  <changelog author="aplanas@suse.com" date="1749124800">- Update vendored crates (bsc#1243861, CVE-2024-12224)
  * idna 1.0.3
- Add Cargo_lock.patch to adjust versions that will allow the
  compilation of mbox crate
- Update to version 0.2.7+70:
  * build(deps): bump wiremock from 0.6.2 to 0.6.3
  * build(deps): bump uuid from 1.16.0 to 1.17.0
  * lib: Introduce AgentIdentity structure
  * gitignore: Add *.swp and *.orig to be ignored
  * build(deps): bump clap from 4.5.38 to 4.5.39
  * build(deps): bump tokio from 1.45.0 to 1.45.1
  * Unify Push Model structures time formats to UTC (#1016)
  * Add Quote related structures to Keylime library
  * Remove configuration file trailing whitespaces (#1012)
  * keylime-agent.conf: add all accepted TPM encryption algs
  * tpm: add policy auth for EK to activate crendential
  * Enable non standard key sizes and curves for EK and AK
  * config: Use next_back() instead of last() for iterators
  * Update to tss-esapi v7.6.0
  * Avoid duplicated call to ctx.create_ek
  * build(deps): bump clap from 4.5.23 to 4.5.38
  * Add registration for Push Model client
  * build(deps): bump tokio from 1.44.2 to 1.45.0
  * build(deps): bump chrono from 0.4.40 to 0.4.41
  * build(deps): bump tempfile from 3.17.1 to 3.20.0
  * Refactor code: move error, registration to lib
  * Move structure filling and URL selection code (#999)
  * build(deps): bump pest_derive from 2.7.15 to 2.8.0
  * build(deps): bump pest from 2.7.15 to 2.8.0
  * build(deps): bump libc from 0.2.169 to 0.2.172
  * Add Evidence/Authentication messages to prototype
  * build(deps): bump uuid from 1.15.1 to 1.16.0
  * build(deps): bump thiserror from 2.0.11 to 2.0.12
  * build(deps): bump signal-hook from 0.3.17 to 0.3.18
  * build(deps): bump log from 0.4.25 to 0.4.27
  * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
  * build(deps): bump actix-web from 4.9.0 to 4.10.2
  * build(deps): bump reqwest from 0.12.12 to 0.12.15
  * build(deps): bump serde from 1.0.217 to 1.0.219
  * Add unit tests for sessions.rs structures
  * Add auth(sessions) structures
  * Fix minor README.md issue (#988)
  * Define EvidenceHandling structures (#971)
  * Add mockoon test scenario
  * Add client certificates to push-attestation prototype
  * Cargo: bump url crate to version 2.5.4
  * Add logging to the push attestation prototype
  * Do not use certificate on insecure mode
  * common: Move the EncryptedData structure from common to the library
  * common: Move AuthTag from common to the library
  * build(deps): bump openssl from 0.10.71 to 0.10.72
  * common: Move Symmkey to library as crypto::symmkey
  * common: Remove unused constants and static values
  * build(deps): bump tokio from 1.43.0 to 1.44.2
  * Refactor code: Include AgentIdentity structure
  * Push model prototype
  * Add support for ek certificate chain, stored in TPM NVRAM.
  * Recover key_class field and set it as "asymmetric"
  * Update push model structures to latest values
  * build(deps): bump serde_json from 1.0.138 to 1.0.140
  * packit: Add identifier for each copr_build job
  * keylime-agent.conf: only mention ecdsa and rsassa for signing
  * build(deps): bump openssl from 0.10.70 to 0.10.71
  * build(deps): bump uuid from 1.13.2 to 1.15.1
  * Add capabilities_negotiation structures
  * packit: Add compatibility/api_version_compatibility test
  * build(deps): bump uuid from 1.11.0 to 1.13.2
  * build(deps): bump serde_json from 1.0.135 to 1.0.138
  * build(deps): bump thiserror from 2.0.9 to 2.0.11
  * build(deps): bump tempfile from 3.14.0 to 3.17.1
  * Allow agent to start as non-root
  * scripts: Fix coverage information downloading script
  * build(deps): bump openssl from 0.10.68 to 0.10.70
  * build(deps): bump tokio from 1.42.0 to 1.43.0</changelog>
  <changelog author="aplanas@suse.com" date="1752494400">- Update vendored crates (bsc#1242623, CVE-2025-3416)
  * openssl 0.10.73
- Update to version 0.2.7+117:
  * Increase coverage in evidence handling structure
  * Add Capabilities Negotiations resp. missing fields
  * Fix UEFI test to check file access in all cases
  * context_info_handler: Do not assume /var/lib/keylime exists
  * Fix clippy warnings about uninlined format arguments
  * attestation: Allow unwrap() in tests
  * Increase coverage (groom code, extend unit tests)
  * Include IMA/UEFI logs in Evidence Handling request
  * Include method to get all IMA entries as string
  * Send correct list of pcr banks and sign algorithms
  * Try to fix TPM tests related issues
  * Define attestation perform asynchronous
  * Perform attestation in push model agent binary
  * Refactor code to use new attestation.rs
  * Create attestation.rs for Attestation stuff
  * Move ContextInfo management to its own handler
  * Adjust context_info.rs after rebase
  * Add attestation function to ContextInfo structure
  * Add prohibited signing algorithms, avoid ecschnorr
  * keylime/config: Use macro to implement PushModelConfigTrait
  * Introduce keylime-macros and define_view_trait
  * config: Remove KeylimeConfig structure
  * config: Remove unnecessary options and lazy initialization
  * Fix pcr_bank function to send all possible slots
  * Send Content-Type:application/json on request (#1039)
  * Send correct 'key_algorithm' in certification_keys (#1035)
  * Push Model: Persist Attestation Key to file
  * Add Keylime push model binary to root GNUmakefile
  * Use singleton to avoid multiple Context allocation
  * tests: Do not assume `/var/lib/keylime` exists (#1030)
  * lib/cert: Fix race condition due to use of same file path
  * payloads: Fix race condition in tests
  * Add uefi_log_handler.rs to parse UEFI binary
  * Use IMA log parser to send correct entry count
  * Add IMA log parser
  * build(deps): bump once_cell from 1.19.0 to 1.21.3
  * lib/config/base.rs: Add more unit tests
  * lib/permissions: Add unit tests
  * keylime-agent: move JsonWrapper from common.rs to the library
  * lib/agent_data: Move agent_data related tests from common
  * common: Replace APIVersion with the library Version structure
  * keylime_agent: Move secure_mount.rs to the library
  * lib: Rename keylime_error.rs as error.rs
  * config: Move config to keylime library
  * config: Rename push_model_config to push_model
  * lib: Move permissions.rs from keylime-agent to the lib
  * Extract Capabilities Negotiation info from TPM (#1014)</changelog>
  <changelog author="aplanas@suse.com" date="1754568000">- Update vendored crates (bsc#1247193, CVE-2025-58266)
  * shlex 1.3.0
- Rebase keylime-agent.conf.diff for current configuration
- Drop Cargo_lock.patch patch, already present in Cargo.lock
- Update to version 0.2.7+141:
  * service: Use WantedBy=multi-user.target
  * rpm: Add subpackage for push-attestation agent
  * push-model: implement continuous attestation with configurable intervals
  * Retry registration forever in the state machine
  * Add Verifier URL to configuration
  * Align exp.backoff to current configuration format
  * Increase coverage of state machine (using Context)
  * Increase coverage of struct_filler.rs
  * Groom code (remove dead code)
  * Fix exponential backoff (10secs, 4xx accepted)
  * test: Add documentation test to tests/run.sh
  * tpm: Avoid running code example during documentation tests
  * state_machine: Always start the agent from the Unregistered state
  * Add fixes for the URL construction
  * Refactor evidences collection in push attestation agent
  * push-model: refactor attestation logic into a state machine
  * Fix body sending by allowing serializing strings (#1057)
  * Log ResilientClient errors/response status codes (#1055)
  * Add AK signing scheme and hash algorithm to negotiation
  * tpm: Add method to extract signing scheme and hash algorithm from AK
  * Allow custom content-type/accept headers
  * Integrate exponential backoff to registration (#1052)
  * keylime/structures: Rename ShaValues to PcrBanks
  * Add resilient_client for exponential backoff (#1048)</changelog>
  <changelog author="aplanas@suse.com" date="1755691200">- Update vendored crates (bsc#1248006, CVE-2025-55159)
  * slab 0.4.11
- Add Cargo_lock.patch patch to update slab and other dependencies
- Update to version 0.2.8+12:
  * build(deps): bump actions/checkout from 4 to 5
  * build(deps): bump cfg-if from 1.0.0 to 1.0.1
  * build(deps): bump openssl from 0.10.72 to 0.10.73
  * build(deps): bump clap from 4.5.39 to 4.5.45
  * build(deps): bump pest from 2.8.0 to 2.8.1
  * Fix clippy warnings
  * Use verifier-provided interval for continuous attestation timing
  * Add meta object with seconds_to_next_attestation to evidence response
  * Fix boot time retrieval
  * Fix IMA log format (it must be ['text/plain']) (#1073)
  * Remove unnecessary configuration fields
  * cargo: Bump retry-policies to version 0.4.0
  * Bump version to 0.2.8</changelog>
  <changelog author="aplanas@suse.com" date="1767787200">- Use tmpfiles.d for /var directories (PED-14736)
  + tmpfiles.keylime renamed to rust-keylime.conf and extended
- Update to version 0.2.8+96:
  * build(deps): bump wiremock from 0.6.4 to 0.6.5
  * build(deps): bump actions/checkout from 5 to 6
  * build(deps): bump chrono from 0.4.41 to 0.4.42
  * packit: Get coverage from Fedora 43 runs
  * Fix issues pointed out by clippy
  * Replace mutex unwraps with proper error handling in TPM library
  * Remove unused session request methods from StructureFiller
  * Fix config panic on missing ek_handle in push model agent
  * build(deps): bump tempfile from 3.21.0 to 3.23.0
  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  * Fix clippy warnings project-wide
  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  * Thread privileged resources and use MeasurementList for IMA reading
  * Add privileged resource initialization and privilege dropping to push model agent
  * Fix privilege dropping order in run_as()
  * add documentation on FQDN hostnames
  * Remove confusing logs for push mode agent
  * Set correct default Verifier port (8891-&gt;8881) (#1159)
  * Add verifier_url to reference configuration file (#1158)
  * Add TLS support for Registrar communication (#1139)
  * Fix agent handling of 403 registration responses (#1154)
  * Add minor README.md rephrasing (#1151)
  * build(deps): bump actions/checkout from 5 to 6 (#1153)
  * ci: update spec files for packit COPR build
  * docs: improve challenge encoding and async TPM documentation
  * refactor: improve middleware and error handling
  * feat: add authentication client with middleware integration
  * docker: Include keylime_push_model_agent binary
  * Include attestation_interval configuration (#1146)
  * Persist payload keys to avoid attestation failure on restart
  * crypto: Implement the load or generate pattern for keys
  * Use simple algorithm specifiers in certification_keys object (#1140)
  * tests: Enable more tests in CI
  * Fix RSA2048 algorithm reporting in keylime agent
  * Remove disabled_signing_algorithms configuration
  * rpm: Fix metadata patches to apply to current code
  * workflows/rpm.yml: Use more strict patching
  * build(deps): bump uuid from 1.17.0 to 1.18.1
  * Fix ECC algorithm selection and reporting for keylime agent
  * Improve logging consistency and coherency
  * Implement minimal RFC compliance for Location header and URI parsing (#1125)
  * Use separate keys for payload mechanism and mTLS
  * docker: update rust to 1.81 for distroless Dockerfile
  * Ensure UEFI log capabilities are set to false
  * build(deps): bump http from 1.1.0 to 1.3.1
  * build(deps): bump log from 0.4.27 to 0.4.28
  * build(deps): bump cfg-if from 1.0.1 to 1.0.3
  * build(deps): bump actix-rt from 2.10.0 to 2.11.0
  * build(deps): bump async-trait from 0.1.88 to 0.1.89
  * build(deps): bump trybuild from 1.0.105 to 1.0.110
  * Accept evidence handling structures null entries
  * workflows: Add test to check if RPM patches still apply
  * CI: Enable test add-agent-with-malformed-ek-cert
  * config: Fix singleton tests
  * FSM: Remove needless lifetime annotations (#1105)
  * rpm: Do not remove wiremock which is now available in Fedora
  * Use latest Fedora httpdate version (1.0.3)
  * Enhance coverage with parse_retry_after test
  * Fix issues reported by CI regarding unwrap() calls
  * Reuse max retries indicated to the ResilientClient
  * Include limit of retries to 5 for Retry-After
  * Add policy to handle Retry-After response headers
  * build(deps): bump wiremock from 0.6.3 to 0.6.4
  * build(deps): bump serde_json from 1.0.140 to 1.0.143
  * build(deps): bump pest_derive from 2.8.0 to 2.8.1
  * build(deps): bump syn from 2.0.90 to 2.0.106
  * build(deps): bump tempfile from 3.20.0 to 3.21.0
  * build(deps): bump thiserror from 2.0.12 to 2.0.16
  * rpm: Fix patches to apply to current master code
  * build(deps): bump anyhow from 1.0.98 to 1.0.99
  * state_machine: Automatically clean config override during tests
  * config: Implement singleton and factory pattern
  * testing: Support overriding configuration during tests
  * feat: implement standalone challenge-response authentication module
  * structures: rename session structs for clarity and fix typos
  * tpm: refactor certify_credential_with_iak() into a more generic function
  * Add Push Model Agent Mermaid FSM chart (#1095)
  * Add state to avoid exiting on wrong attestation (#1093)
  * Add 6 alphanumeric lowercase X-Request-ID header
  * Enhance Evidence Handling response parsing
  * build(deps): bump quote from 1.0.35 to 1.0.40
  * build(deps): bump libc from 0.2.172 to 0.2.175
  * build(deps): bump glob from 0.3.2 to 0.3.3
  * build(deps): bump actix-web from 4.10.2 to 4.11.0</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update vendored crates (bsc#1257908, CVE-2026-25727)
  * time 0.3.47
- Update to version 0.2.8+116:
  * build(deps): bump bytes from 1.7.2 to 1.11.1
  * api: Modify /version endpoint output in version 2.5
  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  * tests: add unit test for resolve_agent_id (#1182)
  * (pull-model): enable retry logic for registration
  * rpm: Update specfiles to apply on master
  * workflows: Add test to detect unused crates
  * lib: Drop unused crates
  * push-model: Drop unused crates
  * keylime-agent: Drop unused crates
  * build(deps): bump uuid from 1.18.1 to 1.19.0
  * Update reqwest-retry to 0.8, retry-policies to 0.5
  * rpm: Fix cargo_build macro usage on CentOS Stream
  * fix(push-model): resolve hash_ek uuid to actual EK hash
  * build(deps): bump thiserror from 2.0.16 to 2.0.17
  * workflows: Separate upstream test suite from e2e coverage
  * Send UEFI measured boot logs as raw bytes (#1173)
  * auth: Add unit tests for SecretToken implementation
  * packit: Enable push-attestation tests
  * resilient_client: Prevent authentication token leakage in logs</changelog>
  <changelog author="aplanas@suse.com" date="1774008000">- Update to version 0.2.9+8:
  * build(deps): bump thiserror from 2.0.17 to 2.0.18
  * build(deps): bump docker/login-action from 3 to 4
  * build(deps): bump docker/metadata-action from 5 to 6
  * Remove generate-bindings feature from tss-esapi
  * Use port constants instead of hardcoded values in tests
  * push-attestation: Use registrar TLS port when TLS is enabled
  * build(deps): bump docker/build-push-action from 6 to 7
  * build(deps): bump actions/upload-artifact from 6 to 7
  * dist: Make the services to conflict with each other
  * Bump version to 0.2.9
  * build(deps): bump mockoon/cli-action from 2 to 3
  * cargo: Bump tracing_subscriber to version 0.3.20
  * cargo: Bump time to version 0.3.47
  * build(deps): bump http from 1.3.1 to 1.4.0
  * Update reqwest from 0.12 to 0.13
  * build(deps): bump serde from 1.0.219 to 1.0.228
  * auth: Load CA certificate in authentication client
  * packit: Add missing e2e tests
  * registrar: Rename insecure option to disable_tls
  * push-attestation: Drop self-signed mTLS certificate generation
  * config: Add missing config options to keylime-agent.conf
  * config: Add support for "default" in registrar_api_versions option
  * config: Add support for "default" in registrar_tls_ca_cert option
  * config: Drop unused config options and constants
  * push-attestation: Drop support for mTLS to registrar
  * push-attestation: Drop mTLS support and require PoP authentication
  * build(deps): bump clap from 4.5.45 to 4.5.54
  * build(deps): bump actix-web from 4.11.0 to 4.12.1
  * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
  * resilient_client: Reauthenticate if a 403 error is received</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1774008001">- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add Cargo_toml.patch to re-generate TSS bindings</changelog>
  <changelog author="Aaron Puchert &lt;aaronpuchert@alice-dsl.net&gt;" date="1775908800">- Build with Clang &lt;= 21 for now to work around boo#1260596.</changelog>
  <changelog author="aplanas@suse.com" date="1776081600">- Update to version 0.2.9+21:
  * tests: use Express-style named params in Mockoon endpoints
  * build(deps): bump pest_derive from 2.8.1 to 2.8.6
  * build(deps): bump trybuild from 1.0.110 to 1.0.115
  * build(deps): bump log from 0.4.28 to 0.4.29
  * build(deps): bump uuid from 1.19.0 to 1.20.0
  * build(deps): bump codecov/codecov-action from 5 to 6
  * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  * build(deps): bump cfg-if from 1.0.3 to 1.0.4
  * build(deps): bump tokio from 1.49.0 to 1.50.0
  * build(deps): bump actix-web from 4.12.1 to 4.13.0
  * build(deps): bump anyhow from 1.0.99 to 1.0.102
  * build(deps): bump clap from 4.5.57 to 4.5.60
  * build(deps): bump tracing from 0.1.36 to 0.1.44</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1776081601">- Make tss-esai-sys depends on bindgen 72.1 to support llvm &gt; 21</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Remove Cargo_toml.patch (merged upstream)
- Update openssl to 0.10.81
  bsc#1270174, CVE-2026-41676
  bsc#1270999, CVE-2026-45784
  bsc#1270903, CVE-2026-44662
  bsc#1270842, CVE-2026-41898
  bsc#1270792, CVE-2026-41681
  bsc#1270699, CVE-2026-41678
  bsc#1270614, CVE-2026-41677
  bsc#1270523, CVE-2026-42327
- Update to version 0.2.9+49:
  * build(deps): bump uuid from 1.23.3 to 1.23.4
  * build(deps): bump syn from 2.0.117 to 2.0.118
  * build(deps): bump openssl from 0.10.80 to 0.10.81
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * Added new regression test into packit-ci.yaml
  * build(deps): bump actions/checkout from 6 to 7
  * build(deps): bump uuid from 1.23.1 to 1.23.3
  * build(deps): bump log from 0.4.29 to 0.4.32
  * build(deps): bump http from 1.4.0 to 1.4.2
  * build(deps): bump codecov/codecov-action from 6 to 7
  * build(deps): bump retry-policies from 0.5.1 to 0.5.2
  * fix: Remove unused base64::Engine import in context_info tests
  * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  * build(deps): bump serde_json from 1.0.149 to 1.0.150
  * build(deps): bump openssl from 0.10.79 to 0.10.80
  * agent: Hash agent ID before TPM2_Certify qualifying data
  * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  * build(deps): bump openssl from 0.10.78 to 0.10.79
  * build(deps): bump once_cell from 1.21.3 to 1.21.4
  * build(deps): bump tempfile from 3.23.0 to 3.27.0
  * push-model: cache UEFI event log bytes at startup
  * build(deps): bump quote from 1.0.40 to 1.0.45
  * build(deps): bump chrono from 0.4.42 to 0.4.44
  * build(deps): bump openssl from 0.10.73 to 0.10.78
  * build(deps): bump serde_json from 1.0.143 to 1.0.149
  * build(deps): bump syn from 2.0.106 to 2.0.117
  * build(deps): bump libc from 0.2.175 to 0.2.184
  * build(deps): bump rand from 0.9.2 to 0.9.4</changelog>
</package>
<package pkgid="a97795c57151692e9d78e58367127d96f39230571525518b500cce6ee5fc9ba33301beefe4cfbff4879fcad702a2c34adac4833aeff4fcbaa57eb59b29eff387" name="rust-keylime-debugsource" arch="s390x">
  <version epoch="0" ver="0.2.9+49" rel="87.3"/>
  <changelog author="aplanas@suse.com" date="1701432000">- Update to version 0.2.3+git.1701075380.a5dc985:
  * build(deps): bump actix-rt from 2.8.0 to 2.9.0
  * Bump version to 0.2.3
  * build(deps): bump reqwest from 0.11.20 to 0.11.22
  * Bump configuration version and fix enable_iak_idevid
  * Enable test functional/iak-idevid-register-with-certificates
  * Update packit plan with new tests
  * Add certificates and certificate checking for IDevID and IAK keys (#669)</changelog>
  <changelog author="aplanas@suse.com" date="1706702400">- Update to version 0.2.4+git.1706692574.a744517:
  * Bump version to 0.2.4
  * build(deps): bump uuid from 1.4.1 to 1.7.0
  * keylime-agent.conf: Allow setting event logs paths
  * Mutable log paths: allow IMA and MBA log paths to be overridden by keylime configuration.
  * workflows: Update checkout action to version 4
  * build(deps): bump serde from 1.0.188 to 1.0.195
  * build(deps): bump pest_derive from 2.7.0 to 2.7.6
  * build(deps): bump openssl from 0.10.62 to 0.10.63
  * build(deps): bump config from 0.13.3 to 0.13.4
  * build(deps): bump base64 from 0.21.4 to 0.21.7
  * build(deps): bump tempfile from 3.8.0 to 3.9.0
  * build(deps): bump pest from 2.7.0 to 2.7.6
  * build(deps): bump actix-web from 4.4.0 to 4.4.1
  * build(deps): bump reqwest from 0.11.22 to 0.11.23
  * build(deps): bump h2 from 0.3.17 to 0.3.24
  * build(deps): bump shlex from 1.1.0 to 1.3.0
  * cargo: Bump tss-esapi to version 7.4.0
  * workflows: Fix keylime-bot token usage
  * tpm: Add error context for every possible error
  * tpm: Add AlgorithmError to TpmError
  * detect idevid template from certificates
  * build(deps): bump wiremock from 0.5.18 to 0.5.22
  * build(deps): bump thiserror from 1.0.48 to 1.0.56
  * Make use of workspace dependencies
  * build(deps): bump openssl from 0.10.57 to 0.10.62
  * packit: Bump Fedora version used for code coverage</changelog>
  <changelog author="aplanas@suse.com" date="1714478400">- actix-web update moves rustls as feature (bsc#1223234, CVE-2024-32650)
- Update to version 0.2.4~39:
  * build(deps): bump openssl from 0.10.63 to 0.10.64
  * build(deps): bump h2 from 0.3.24 to 0.3.26
  * build(deps): bump serde_json from 1.0.107 to 1.0.116
  * build(deps): bump actix-web from 4.4.1 to 4.5.1
  * crypto: Enable TLS 1.3
  * build(deps): bump tempfile from 3.9.0 to 3.10.1
  * build(deps): bump mio from 0.8.4 to 0.8.11
  * enable hex values to be used for tpm_ownerpassword
  * config: Support IPv6 with or without brackets
  * keylime: Implement a simple IP parser to remove brackets
  * crypto: Implement CertificateBuilder to generate certificates
  * tests: Fix coverage download by supporting arbitrary URL
  * cargo: Add testing feature to keylime library
  * Set X509 SAN with local DNSname/IP/IPv6
  * Include newest Node20 versions for Github actions
  * tpm: Add unit test for uncovered public functions
  * crypto: Implement ECC key generation support
  * crypto: Add test for match_cert_to_template()
  * Fix minor typo, format and remove end whitespaces
  * crypto: Make error types less specific
  * tests/run.sh: Run tarpaulin with a single thread
  * payloads: Remove explicit drop of channel transmitter
  * crypto: Move to keylime library
  * crypto: Add specific type for every possible error
  * tpm: Rename origin of error as source in structures
  * list_parser: Add source for error for backtrace
  * algorithms: Make errors more specific
  * typo fix for default path to measured boot log file
  * README: remove mentions of libarchive as a dependency
  * Dockerfile.wolfi: Update clang to version 17
  * docker: Remove libarchive as a dependency
  * rpm: Remove libarchive from dependencies
  * cargo: Replace compress-tools with zip crate
  * cargo: Bump ahash to version 0.8.7
  * build(deps): bump serde from 1.0.195 to 1.0.196
  * build(deps): bump libc from 0.2.152 to 0.2.153
  * build(deps): bump reqwest from 0.11.23 to 0.11.24
  * docker: Install configuration file in the correct path
  * config: Make IAK/IDevID disabled by default</changelog>
  <changelog author="aplanas@suse.com" date="1714651200">- Update to version 0.2.5~0:
  * Bump version to 0.2.5
  * cargo: Relax required version for pest crate
  * build(deps): bump log from 0.4.20 to 0.4.21
  * build(deps): bump thiserror from 1.0.56 to 1.0.59</changelog>
  <changelog author="aplanas@suse.com" date="1715860800">- Update to version 0.2.5~4:
  * Fix 'unnecessary qualification' warnings
  * fix IAK template to match IDevID
  * rpm: fix COPR RPMs build for centos-stream-10
  * Build COPR RPMs for centos-stream-10</changelog>
  <changelog author="aplanas@suse.com" date="1718366400">- Update to version 0.2.6~0:
  * Bump version to 0.2.6
  * build(deps): bump libc from 0.2.153 to 0.2.155
  * build(deps): bump serde from 1.0.196 to 1.0.203
  * rpm/fedora: Update rust macro usage
  * config: Support hostnames in registrar_ip option
  * added use of persisted IAK and IDevID and authorisation values
  * config changes
  * Adding /agent/info API to agent
  * Fix leftover 'unnecessary qualification' warnings on tests</changelog>
  <changelog author="aplanas@suse.com" date="1725278400">- Update vendored crates (bsc#1229952, bsc#1230029, CVE-2024-43806)
  * rustix 0.37.25
  * rustix 0.38.34
  * shlex  1.3.0
- Update to version 0.2.6+13:
  * Enable test functional/iak-idevid-persisted-and-protected
  * build(deps): bump uuid from 1.7.0 to 1.10.0
  * build(deps): bump openssl from 0.10.64 to 0.10.66
  * keylime-agent/src/revocation: Fix comment indentation
  * keylime/crypto: Fix indentation of documentation comment
  * build(deps): bump thiserror from 1.0.59 to 1.0.63
  * build(deps): bump serde_json from 1.0.116 to 1.0.120
  * dependabot: Extend to also monitor workflow actions
  * ci: Disable Packit CI on CentOS Stream 9
  * ci: use CODECOV_TOKEN when submitting coverage data
  * revocation: Use into() for unfallible transformation
  * secure_mount: Fix possible infinite loop
  * error: Rename enum variants to avoid clippy warning</changelog>
  <changelog author="aplanas@suse.com" date="1737979200">- Update to version 0.2.7+1:
  * dist: Enable logging for keylime library in the service
  * Bump version to 0.2.7
  * scripts: Download coverage data from Testing Farm directly
  * main: Remove unnecessary lifetime
  * cargo: Bump pretty_env_logger to version 0.5.0
  * scripts: Fix regex in download_packit_coverage.sh
  * cargo: Bump clap crate to version 4.5.23
  * cargo: Bump base64 crate to version 0.22.1
  * build(deps): bump log from 0.4.22 to 0.4.25
  * build(deps): bump serde_json from 1.0.133 to 1.0.135
  * cargo: Bump tokio crate to version 1.42.0
  * packit: Fix RPM builds on copr
  * cargo: Bump thiserror crate to version 0.2.9
  * cargo: Update reqwest to version 0.12.12
  * build(deps): bump libc from 0.2.168 to 0.2.169
  * build(deps): bump glob from 0.3.1 to 0.3.2
  * version: Implement API version validation and ordering
  * main: Support using multiple API versions for registration
  * keylime: Introduce the registrar_client module
  * Provide endpoints under multiple API versions
  * Move 'serialization' module to the keylime library
  * Drop unnecessary dependency on common::API_VERSION
  * keylime-agent.conf: Bump version to 2.3
  * build(deps): bump serde from 1.0.210 to 1.0.217
  * build(deps): bump pest_derive from 2.7.14 to 2.7.15
  * build(deps): bump pest from 2.7.14 to 2.7.15
  * build(deps): bump libc from 0.2.167 to 0.2.168
  * config: Make IAK and IDevID certificates optional
  * Fix warnings reported by clippy
  * workflows: Run job in the CI container directly
  * tests: Add unit test for device ID builder
  * main: Move IAK/IDevID related code to dedicated module
  * tests: Add script to generate IAK and IDevID certificates
  * build(deps): bump openssl from 0.10.66 to 0.10.68
  * build(deps): bump uuid from 1.10.0 to 1.11.0
  * build(deps): bump serde_json from 1.0.128 to 1.0.133
  * build(deps): bump actix-web from 4.5.1 to 4.9.0
  * build(deps): bump reqwest from 0.12.7 to 0.12.9
  * tests/setup_swtpm.sh: Add script to setup temporary TPM
  * Use a single TPM context and avoid race conditions during tests
  * config: Enable passing a hostname instead of IP
  * build(deps): bump clap from 4.3.11 to 4.5.21
  * build(deps): bump tempfile from 3.10.1 to 3.14.0
  * build(deps): bump pest_derive from 2.7.6 to 2.7.14
  * build(deps): bump pest from 2.7.6 to 2.7.14
  * build(deps): bump codecov/codecov-action from 4 to 5
  * workflows: Submit the coverage for merged PR from Fedora 41
  * tests: Use Fedora 41 to generate code coverage
  * api: Make API configuration modular
  * agent_handler: Move the /agent scope configuration
  * notifications_handler: Move the /notifications scope configuration
  * quotes_handler: Move the /quotes scope configuration to quotes_handler
  * keys_handler: Move /keys scope configuration to keys_handler
  * Use ${DESTDIR} for config
  * Fix showing wrong UUID
  * build(deps): bump actix-rt from 2.9.0 to 2.10.0
  * config: Refactor AgentConfig Source trait implementation
  * build(deps): bump log from 0.4.21 to 0.4.22
  * build(deps): bump serde_json from 1.0.120 to 1.0.128
  * tpm: check if EK certificate has valid ASN.1 DER encoding
  * build(deps): bump futures from 0.3.27 to 0.3.31
  * cargo: Bump reqwest to version 0.12.7
  * build(deps): bump serde from 1.0.203 to 1.0.210
  * tests: Add more tests to Packit CI
  * build(deps): bump docker/build-push-action from 5 to 6
  * tests: apply workarounds to known bugs</changelog>
  <changelog author="aplanas@suse.com" date="1749124800">- Update vendored crates (bsc#1243861, CVE-2024-12224)
  * idna 1.0.3
- Add Cargo_lock.patch to adjust versions that will allow the
  compilation of mbox crate
- Update to version 0.2.7+70:
  * build(deps): bump wiremock from 0.6.2 to 0.6.3
  * build(deps): bump uuid from 1.16.0 to 1.17.0
  * lib: Introduce AgentIdentity structure
  * gitignore: Add *.swp and *.orig to be ignored
  * build(deps): bump clap from 4.5.38 to 4.5.39
  * build(deps): bump tokio from 1.45.0 to 1.45.1
  * Unify Push Model structures time formats to UTC (#1016)
  * Add Quote related structures to Keylime library
  * Remove configuration file trailing whitespaces (#1012)
  * keylime-agent.conf: add all accepted TPM encryption algs
  * tpm: add policy auth for EK to activate crendential
  * Enable non standard key sizes and curves for EK and AK
  * config: Use next_back() instead of last() for iterators
  * Update to tss-esapi v7.6.0
  * Avoid duplicated call to ctx.create_ek
  * build(deps): bump clap from 4.5.23 to 4.5.38
  * Add registration for Push Model client
  * build(deps): bump tokio from 1.44.2 to 1.45.0
  * build(deps): bump chrono from 0.4.40 to 0.4.41
  * build(deps): bump tempfile from 3.17.1 to 3.20.0
  * Refactor code: move error, registration to lib
  * Move structure filling and URL selection code (#999)
  * build(deps): bump pest_derive from 2.7.15 to 2.8.0
  * build(deps): bump pest from 2.7.15 to 2.8.0
  * build(deps): bump libc from 0.2.169 to 0.2.172
  * Add Evidence/Authentication messages to prototype
  * build(deps): bump uuid from 1.15.1 to 1.16.0
  * build(deps): bump thiserror from 2.0.11 to 2.0.12
  * build(deps): bump signal-hook from 0.3.17 to 0.3.18
  * build(deps): bump log from 0.4.25 to 0.4.27
  * build(deps): bump assert_cmd from 2.0.16 to 2.0.17
  * build(deps): bump actix-web from 4.9.0 to 4.10.2
  * build(deps): bump reqwest from 0.12.12 to 0.12.15
  * build(deps): bump serde from 1.0.217 to 1.0.219
  * Add unit tests for sessions.rs structures
  * Add auth(sessions) structures
  * Fix minor README.md issue (#988)
  * Define EvidenceHandling structures (#971)
  * Add mockoon test scenario
  * Add client certificates to push-attestation prototype
  * Cargo: bump url crate to version 2.5.4
  * Add logging to the push attestation prototype
  * Do not use certificate on insecure mode
  * common: Move the EncryptedData structure from common to the library
  * common: Move AuthTag from common to the library
  * build(deps): bump openssl from 0.10.71 to 0.10.72
  * common: Move Symmkey to library as crypto::symmkey
  * common: Remove unused constants and static values
  * build(deps): bump tokio from 1.43.0 to 1.44.2
  * Refactor code: Include AgentIdentity structure
  * Push model prototype
  * Add support for ek certificate chain, stored in TPM NVRAM.
  * Recover key_class field and set it as "asymmetric"
  * Update push model structures to latest values
  * build(deps): bump serde_json from 1.0.138 to 1.0.140
  * packit: Add identifier for each copr_build job
  * keylime-agent.conf: only mention ecdsa and rsassa for signing
  * build(deps): bump openssl from 0.10.70 to 0.10.71
  * build(deps): bump uuid from 1.13.2 to 1.15.1
  * Add capabilities_negotiation structures
  * packit: Add compatibility/api_version_compatibility test
  * build(deps): bump uuid from 1.11.0 to 1.13.2
  * build(deps): bump serde_json from 1.0.135 to 1.0.138
  * build(deps): bump thiserror from 2.0.9 to 2.0.11
  * build(deps): bump tempfile from 3.14.0 to 3.17.1
  * Allow agent to start as non-root
  * scripts: Fix coverage information downloading script
  * build(deps): bump openssl from 0.10.68 to 0.10.70
  * build(deps): bump tokio from 1.42.0 to 1.43.0</changelog>
  <changelog author="aplanas@suse.com" date="1752494400">- Update vendored crates (bsc#1242623, CVE-2025-3416)
  * openssl 0.10.73
- Update to version 0.2.7+117:
  * Increase coverage in evidence handling structure
  * Add Capabilities Negotiations resp. missing fields
  * Fix UEFI test to check file access in all cases
  * context_info_handler: Do not assume /var/lib/keylime exists
  * Fix clippy warnings about uninlined format arguments
  * attestation: Allow unwrap() in tests
  * Increase coverage (groom code, extend unit tests)
  * Include IMA/UEFI logs in Evidence Handling request
  * Include method to get all IMA entries as string
  * Send correct list of pcr banks and sign algorithms
  * Try to fix TPM tests related issues
  * Define attestation perform asynchronous
  * Perform attestation in push model agent binary
  * Refactor code to use new attestation.rs
  * Create attestation.rs for Attestation stuff
  * Move ContextInfo management to its own handler
  * Adjust context_info.rs after rebase
  * Add attestation function to ContextInfo structure
  * Add prohibited signing algorithms, avoid ecschnorr
  * keylime/config: Use macro to implement PushModelConfigTrait
  * Introduce keylime-macros and define_view_trait
  * config: Remove KeylimeConfig structure
  * config: Remove unnecessary options and lazy initialization
  * Fix pcr_bank function to send all possible slots
  * Send Content-Type:application/json on request (#1039)
  * Send correct 'key_algorithm' in certification_keys (#1035)
  * Push Model: Persist Attestation Key to file
  * Add Keylime push model binary to root GNUmakefile
  * Use singleton to avoid multiple Context allocation
  * tests: Do not assume `/var/lib/keylime` exists (#1030)
  * lib/cert: Fix race condition due to use of same file path
  * payloads: Fix race condition in tests
  * Add uefi_log_handler.rs to parse UEFI binary
  * Use IMA log parser to send correct entry count
  * Add IMA log parser
  * build(deps): bump once_cell from 1.19.0 to 1.21.3
  * lib/config/base.rs: Add more unit tests
  * lib/permissions: Add unit tests
  * keylime-agent: move JsonWrapper from common.rs to the library
  * lib/agent_data: Move agent_data related tests from common
  * common: Replace APIVersion with the library Version structure
  * keylime_agent: Move secure_mount.rs to the library
  * lib: Rename keylime_error.rs as error.rs
  * config: Move config to keylime library
  * config: Rename push_model_config to push_model
  * lib: Move permissions.rs from keylime-agent to the lib
  * Extract Capabilities Negotiation info from TPM (#1014)</changelog>
  <changelog author="aplanas@suse.com" date="1754568000">- Update vendored crates (bsc#1247193, CVE-2025-58266)
  * shlex 1.3.0
- Rebase keylime-agent.conf.diff for current configuration
- Drop Cargo_lock.patch patch, already present in Cargo.lock
- Update to version 0.2.7+141:
  * service: Use WantedBy=multi-user.target
  * rpm: Add subpackage for push-attestation agent
  * push-model: implement continuous attestation with configurable intervals
  * Retry registration forever in the state machine
  * Add Verifier URL to configuration
  * Align exp.backoff to current configuration format
  * Increase coverage of state machine (using Context)
  * Increase coverage of struct_filler.rs
  * Groom code (remove dead code)
  * Fix exponential backoff (10secs, 4xx accepted)
  * test: Add documentation test to tests/run.sh
  * tpm: Avoid running code example during documentation tests
  * state_machine: Always start the agent from the Unregistered state
  * Add fixes for the URL construction
  * Refactor evidences collection in push attestation agent
  * push-model: refactor attestation logic into a state machine
  * Fix body sending by allowing serializing strings (#1057)
  * Log ResilientClient errors/response status codes (#1055)
  * Add AK signing scheme and hash algorithm to negotiation
  * tpm: Add method to extract signing scheme and hash algorithm from AK
  * Allow custom content-type/accept headers
  * Integrate exponential backoff to registration (#1052)
  * keylime/structures: Rename ShaValues to PcrBanks
  * Add resilient_client for exponential backoff (#1048)</changelog>
  <changelog author="aplanas@suse.com" date="1755691200">- Update vendored crates (bsc#1248006, CVE-2025-55159)
  * slab 0.4.11
- Add Cargo_lock.patch patch to update slab and other dependencies
- Update to version 0.2.8+12:
  * build(deps): bump actions/checkout from 4 to 5
  * build(deps): bump cfg-if from 1.0.0 to 1.0.1
  * build(deps): bump openssl from 0.10.72 to 0.10.73
  * build(deps): bump clap from 4.5.39 to 4.5.45
  * build(deps): bump pest from 2.8.0 to 2.8.1
  * Fix clippy warnings
  * Use verifier-provided interval for continuous attestation timing
  * Add meta object with seconds_to_next_attestation to evidence response
  * Fix boot time retrieval
  * Fix IMA log format (it must be ['text/plain']) (#1073)
  * Remove unnecessary configuration fields
  * cargo: Bump retry-policies to version 0.4.0
  * Bump version to 0.2.8</changelog>
  <changelog author="aplanas@suse.com" date="1767787200">- Use tmpfiles.d for /var directories (PED-14736)
  + tmpfiles.keylime renamed to rust-keylime.conf and extended
- Update to version 0.2.8+96:
  * build(deps): bump wiremock from 0.6.4 to 0.6.5
  * build(deps): bump actions/checkout from 5 to 6
  * build(deps): bump chrono from 0.4.41 to 0.4.42
  * packit: Get coverage from Fedora 43 runs
  * Fix issues pointed out by clippy
  * Replace mutex unwraps with proper error handling in TPM library
  * Remove unused session request methods from StructureFiller
  * Fix config panic on missing ek_handle in push model agent
  * build(deps): bump tempfile from 3.21.0 to 3.23.0
  * build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  * Fix clippy warnings project-wide
  * Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  * Thread privileged resources and use MeasurementList for IMA reading
  * Add privileged resource initialization and privilege dropping to push model agent
  * Fix privilege dropping order in run_as()
  * add documentation on FQDN hostnames
  * Remove confusing logs for push mode agent
  * Set correct default Verifier port (8891-&gt;8881) (#1159)
  * Add verifier_url to reference configuration file (#1158)
  * Add TLS support for Registrar communication (#1139)
  * Fix agent handling of 403 registration responses (#1154)
  * Add minor README.md rephrasing (#1151)
  * build(deps): bump actions/checkout from 5 to 6 (#1153)
  * ci: update spec files for packit COPR build
  * docs: improve challenge encoding and async TPM documentation
  * refactor: improve middleware and error handling
  * feat: add authentication client with middleware integration
  * docker: Include keylime_push_model_agent binary
  * Include attestation_interval configuration (#1146)
  * Persist payload keys to avoid attestation failure on restart
  * crypto: Implement the load or generate pattern for keys
  * Use simple algorithm specifiers in certification_keys object (#1140)
  * tests: Enable more tests in CI
  * Fix RSA2048 algorithm reporting in keylime agent
  * Remove disabled_signing_algorithms configuration
  * rpm: Fix metadata patches to apply to current code
  * workflows/rpm.yml: Use more strict patching
  * build(deps): bump uuid from 1.17.0 to 1.18.1
  * Fix ECC algorithm selection and reporting for keylime agent
  * Improve logging consistency and coherency
  * Implement minimal RFC compliance for Location header and URI parsing (#1125)
  * Use separate keys for payload mechanism and mTLS
  * docker: update rust to 1.81 for distroless Dockerfile
  * Ensure UEFI log capabilities are set to false
  * build(deps): bump http from 1.1.0 to 1.3.1
  * build(deps): bump log from 0.4.27 to 0.4.28
  * build(deps): bump cfg-if from 1.0.1 to 1.0.3
  * build(deps): bump actix-rt from 2.10.0 to 2.11.0
  * build(deps): bump async-trait from 0.1.88 to 0.1.89
  * build(deps): bump trybuild from 1.0.105 to 1.0.110
  * Accept evidence handling structures null entries
  * workflows: Add test to check if RPM patches still apply
  * CI: Enable test add-agent-with-malformed-ek-cert
  * config: Fix singleton tests
  * FSM: Remove needless lifetime annotations (#1105)
  * rpm: Do not remove wiremock which is now available in Fedora
  * Use latest Fedora httpdate version (1.0.3)
  * Enhance coverage with parse_retry_after test
  * Fix issues reported by CI regarding unwrap() calls
  * Reuse max retries indicated to the ResilientClient
  * Include limit of retries to 5 for Retry-After
  * Add policy to handle Retry-After response headers
  * build(deps): bump wiremock from 0.6.3 to 0.6.4
  * build(deps): bump serde_json from 1.0.140 to 1.0.143
  * build(deps): bump pest_derive from 2.8.0 to 2.8.1
  * build(deps): bump syn from 2.0.90 to 2.0.106
  * build(deps): bump tempfile from 3.20.0 to 3.21.0
  * build(deps): bump thiserror from 2.0.12 to 2.0.16
  * rpm: Fix patches to apply to current master code
  * build(deps): bump anyhow from 1.0.98 to 1.0.99
  * state_machine: Automatically clean config override during tests
  * config: Implement singleton and factory pattern
  * testing: Support overriding configuration during tests
  * feat: implement standalone challenge-response authentication module
  * structures: rename session structs for clarity and fix typos
  * tpm: refactor certify_credential_with_iak() into a more generic function
  * Add Push Model Agent Mermaid FSM chart (#1095)
  * Add state to avoid exiting on wrong attestation (#1093)
  * Add 6 alphanumeric lowercase X-Request-ID header
  * Enhance Evidence Handling response parsing
  * build(deps): bump quote from 1.0.35 to 1.0.40
  * build(deps): bump libc from 0.2.172 to 0.2.175
  * build(deps): bump glob from 0.3.2 to 0.3.3
  * build(deps): bump actix-web from 4.10.2 to 4.11.0</changelog>
  <changelog author="aplanas@suse.com" date="1770638400">- Update vendored crates (bsc#1257908, CVE-2026-25727)
  * time 0.3.47
- Update to version 0.2.8+116:
  * build(deps): bump bytes from 1.7.2 to 1.11.1
  * api: Modify /version endpoint output in version 2.5
  * Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  * tests: add unit test for resolve_agent_id (#1182)
  * (pull-model): enable retry logic for registration
  * rpm: Update specfiles to apply on master
  * workflows: Add test to detect unused crates
  * lib: Drop unused crates
  * push-model: Drop unused crates
  * keylime-agent: Drop unused crates
  * build(deps): bump uuid from 1.18.1 to 1.19.0
  * Update reqwest-retry to 0.8, retry-policies to 0.5
  * rpm: Fix cargo_build macro usage on CentOS Stream
  * fix(push-model): resolve hash_ek uuid to actual EK hash
  * build(deps): bump thiserror from 2.0.16 to 2.0.17
  * workflows: Separate upstream test suite from e2e coverage
  * Send UEFI measured boot logs as raw bytes (#1173)
  * auth: Add unit tests for SecretToken implementation
  * packit: Enable push-attestation tests
  * resilient_client: Prevent authentication token leakage in logs</changelog>
  <changelog author="aplanas@suse.com" date="1774008000">- Update to version 0.2.9+8:
  * build(deps): bump thiserror from 2.0.17 to 2.0.18
  * build(deps): bump docker/login-action from 3 to 4
  * build(deps): bump docker/metadata-action from 5 to 6
  * Remove generate-bindings feature from tss-esapi
  * Use port constants instead of hardcoded values in tests
  * push-attestation: Use registrar TLS port when TLS is enabled
  * build(deps): bump docker/build-push-action from 6 to 7
  * build(deps): bump actions/upload-artifact from 6 to 7
  * dist: Make the services to conflict with each other
  * Bump version to 0.2.9
  * build(deps): bump mockoon/cli-action from 2 to 3
  * cargo: Bump tracing_subscriber to version 0.3.20
  * cargo: Bump time to version 0.3.47
  * build(deps): bump http from 1.3.1 to 1.4.0
  * Update reqwest from 0.12 to 0.13
  * build(deps): bump serde from 1.0.219 to 1.0.228
  * auth: Load CA certificate in authentication client
  * packit: Add missing e2e tests
  * registrar: Rename insecure option to disable_tls
  * push-attestation: Drop self-signed mTLS certificate generation
  * config: Add missing config options to keylime-agent.conf
  * config: Add support for "default" in registrar_api_versions option
  * config: Add support for "default" in registrar_tls_ca_cert option
  * config: Drop unused config options and constants
  * push-attestation: Drop support for mTLS to registrar
  * push-attestation: Drop mTLS support and require PoP authentication
  * build(deps): bump clap from 4.5.45 to 4.5.54
  * build(deps): bump actix-web from 4.11.0 to 4.12.1
  * auth: Reuse existing ContextInfo to avoid duplicate TPM objects
  * resilient_client: Reauthenticate if a 403 error is received</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1774008001">- Suggests only the IMA policy package, and keep it as example (bsc#1259963)
- Add Cargo_toml.patch to re-generate TSS bindings</changelog>
  <changelog author="Aaron Puchert &lt;aaronpuchert@alice-dsl.net&gt;" date="1775908800">- Build with Clang &lt;= 21 for now to work around boo#1260596.</changelog>
  <changelog author="aplanas@suse.com" date="1776081600">- Update to version 0.2.9+21:
  * tests: use Express-style named params in Mockoon endpoints
  * build(deps): bump pest_derive from 2.8.1 to 2.8.6
  * build(deps): bump trybuild from 1.0.110 to 1.0.115
  * build(deps): bump log from 0.4.28 to 0.4.29
  * build(deps): bump uuid from 1.19.0 to 1.20.0
  * build(deps): bump codecov/codecov-action from 5 to 6
  * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  * build(deps): bump cfg-if from 1.0.3 to 1.0.4
  * build(deps): bump tokio from 1.49.0 to 1.50.0
  * build(deps): bump actix-web from 4.12.1 to 4.13.0
  * build(deps): bump anyhow from 1.0.99 to 1.0.102
  * build(deps): bump clap from 4.5.57 to 4.5.60
  * build(deps): bump tracing from 0.1.36 to 0.1.44</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1776081601">- Make tss-esai-sys depends on bindgen 72.1 to support llvm &gt; 21</changelog>
  <changelog author="aplanas@suse.com" date="1783339200">- Remove Cargo_toml.patch (merged upstream)
- Update openssl to 0.10.81
  bsc#1270174, CVE-2026-41676
  bsc#1270999, CVE-2026-45784
  bsc#1270903, CVE-2026-44662
  bsc#1270842, CVE-2026-41898
  bsc#1270792, CVE-2026-41681
  bsc#1270699, CVE-2026-41678
  bsc#1270614, CVE-2026-41677
  bsc#1270523, CVE-2026-42327
- Update to version 0.2.9+49:
  * build(deps): bump uuid from 1.23.3 to 1.23.4
  * build(deps): bump syn from 2.0.117 to 2.0.118
  * build(deps): bump openssl from 0.10.80 to 0.10.81
  * build(deps): bump rand from 0.9.4 to 0.10.1
  * Added new regression test into packit-ci.yaml
  * build(deps): bump actions/checkout from 6 to 7
  * build(deps): bump uuid from 1.23.1 to 1.23.3
  * build(deps): bump log from 0.4.29 to 0.4.32
  * build(deps): bump http from 1.4.0 to 1.4.2
  * build(deps): bump codecov/codecov-action from 6 to 7
  * build(deps): bump retry-policies from 0.5.1 to 0.5.2
  * fix: Remove unused base64::Engine import in context_info tests
  * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  * build(deps): bump serde_json from 1.0.149 to 1.0.150
  * build(deps): bump openssl from 0.10.79 to 0.10.80
  * agent: Hash agent ID before TPM2_Certify qualifying data
  * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  * build(deps): bump openssl from 0.10.78 to 0.10.79
  * build(deps): bump once_cell from 1.21.3 to 1.21.4
  * build(deps): bump tempfile from 3.23.0 to 3.27.0
  * push-model: cache UEFI event log bytes at startup
  * build(deps): bump quote from 1.0.40 to 1.0.45
  * build(deps): bump chrono from 0.4.42 to 0.4.44
  * build(deps): bump openssl from 0.10.73 to 0.10.78
  * build(deps): bump serde_json from 1.0.143 to 1.0.149
  * build(deps): bump syn from 2.0.106 to 2.0.117
  * build(deps): bump libc from 0.2.175 to 0.2.184
  * build(deps): bump rand from 0.9.2 to 0.9.4</changelog>
</package>
<package pkgid="9afdb2d398561d385e3a3698ac49ba4f582367a6782b4267b09ae3177639c6eb296b629a255d23464306758086814e4e35e8f7a08f137297f758e262a4734b13" name="scanssh" arch="s390x">
  <version epoch="0" ver="2.1.3.1" rel="1.7"/>
  <changelog author="Hans-Peter Jansen &lt;hpj@urpla.net&gt;" date="1682424000">- Version 2.1.3.1: initial build</changelog>
</package>
<package pkgid="25e95977c9c6c2149e29acd4d7aeb61bb722dbe76bcabe23358f0cd1e88184c006b9bfc65c177f276d3c20a18645ec4da304cac78c4d31cbb0c34badd0165a0e" name="scanssh" arch="src">
  <version epoch="0" ver="2.1.3.1" rel="1.7"/>
  <changelog author="Hans-Peter Jansen &lt;hpj@urpla.net&gt;" date="1682424000">- Version 2.1.3.1: initial build</changelog>
</package>
<package pkgid="ebcecb442cc906d543fcf03a62d9d0983c1690ea81a9198841b81c3264f9edfbc612833140eaad999291fe6448ec090b3321c6fba4eafda46889dd8b0a1b2d48" name="scanssh-debuginfo" arch="s390x">
  <version epoch="0" ver="2.1.3.1" rel="1.7"/>
  <changelog author="Hans-Peter Jansen &lt;hpj@urpla.net&gt;" date="1682424000">- Version 2.1.3.1: initial build</changelog>
</package>
<package pkgid="cf2a8ce28b501b5a195184bd7e212af7fbc76ea50e9df07733a6fc3ceb9596f2910f485e876d003cb164bf9b950559361084b74e602d61b25a1b58ebda3e7ee7" name="scanssh-debugsource" arch="s390x">
  <version epoch="0" ver="2.1.3.1" rel="1.7"/>
  <changelog author="Hans-Peter Jansen &lt;hpj@urpla.net&gt;" date="1682424000">- Version 2.1.3.1: initial build</changelog>
</package>
<package pkgid="92e09d67e9e4a1f1cea6fabf6824c1721e1dfcaf28a35821f49710af7ff148a693ca09adea442952b1c8be6918ebed61171e893c316ed807265dff94a990be87" name="scap-security-guide" arch="noarch">
  <version epoch="0" ver="0.1.81" rel="159.5"/>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741089600">- removed ssg-reproducable.patch: upstream</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741089601">- added build support for almalinux9</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176000">- updates redhat package to include almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176001">- fix a bug in redhad package description for almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176002">- removed tables reference related to almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741694400">- creation of a new request</changelog>
  <changelog author="Shawn Dunn &lt;sfalken@opensuse.org&gt;" date="1742644800">- Add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to fix FTBFS with cmake4
- Remove Group: declarations, no longer used</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1742731200">- ssg-fix-python.patch: fix build with older python3.</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1749729600">- updated to 0.1.77 (jsc#ECO-3319)
  - Introduce Architecture Decisions Records
  - Move stablization to the third Monday of the second month
  - Remove CCI References
  - Remove macOS content
- removed ssg-fix-python.patch: upstream
- Added support for tencentos4</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1750766400">- buildrequire cmake3 on older SLES versions for build</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1753876800">- ssg-remove-cis.patch: remove cis profiles
- Update description: remove cis profiles</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1755777600">- Remove ssg-remove-cis.patch: tarball
- Add check if cis profiles exists in the tarball</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1755777601">- Remove the cis profiles from the tarball</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1759147200">- updated to 0.1.78 (jsc#ECO-3319)
  - Enable SCE content for problematic rules that can traverse the whole filesystem
  - Remove unnecessary Jinja2 macros in control files
  - Update RHEL 8 STIG to V2R4 and RHEL 9 STIG to V2R5
  - Add Debian 13 profile for ANSSI BP 28 (enhanced)
  - Create SLEM5 General profile
  - Create SL Micro 6 product and general profile
  - Update SLE15 STIG version to V2R5
  - Update SLE12 STIG version to V3R3
  - Update SLEM5 STIG version to V1R2
- Remove the cis profiles from all products</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1765886400">- updated to 0.1.79 (jsc#ECO-3319)
  - Add rhcos4 Profile for BSI Grundschutz
  - Create SLE15 general profile
  - Fix crypto policy settings in RHEL CIS profiles
  - Remove deprecated CIS OpenShift 1.4.0 and 1.5.0 profiles
  - Remove OCP STIG V1R1
  - Remove OCP STIG V2R1
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230400">- updated to 0.1.80 (jsc#ECO-3319)
  - Create SLE16 HIPAA profile
  - Create SLE16 PCI DSS 4 profile
  - Use Sequoia in RHEL 10 instead of GPG
  - New Profile for RHEL10: BSI
  - Move RHEL Control files to product files
  - Update RHEL 9 CCN profile
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230401">- Add SLE16 profiles to the build</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230402">- Update the SSG package description</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1780401600">- updated to 0.1.81 (jsc#ECO-3319)
  - Create SLE16 ANSSI profiles
  - Update SLE15 STIG version to V2R7
  - Update SLE12 STIG version to V3R5
  - Update SLEM5 STIG version to V1R3
  - Add Claude Code skills for content development workflows
  - Create Claude Skill for creating new products
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1780401601">- Add Hummingbird product support</changelog>
</package>
<package pkgid="d60d06ad35770e5fa8d218c01a81b6aad5c227307a263921e483a896b9b0bd555f1995091a9f7bbc7b7a759d3a5a96704dc394a453aad6f1625f34fc29be3dc6" name="scap-security-guide" arch="src">
  <version epoch="0" ver="0.1.81" rel="159.5"/>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741089600">- removed ssg-reproducable.patch: upstream</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741089601">- added build support for almalinux9</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176000">- updates redhat package to include almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176001">- fix a bug in redhad package description for almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176002">- removed tables reference related to almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741694400">- creation of a new request</changelog>
  <changelog author="Shawn Dunn &lt;sfalken@opensuse.org&gt;" date="1742644800">- Add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to fix FTBFS with cmake4
- Remove Group: declarations, no longer used</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1742731200">- ssg-fix-python.patch: fix build with older python3.</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1749729600">- updated to 0.1.77 (jsc#ECO-3319)
  - Introduce Architecture Decisions Records
  - Move stablization to the third Monday of the second month
  - Remove CCI References
  - Remove macOS content
- removed ssg-fix-python.patch: upstream
- Added support for tencentos4</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1750766400">- buildrequire cmake3 on older SLES versions for build</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1753876800">- ssg-remove-cis.patch: remove cis profiles
- Update description: remove cis profiles</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1755777600">- Remove ssg-remove-cis.patch: tarball
- Add check if cis profiles exists in the tarball</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1755777601">- Remove the cis profiles from the tarball</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1759147200">- updated to 0.1.78 (jsc#ECO-3319)
  - Enable SCE content for problematic rules that can traverse the whole filesystem
  - Remove unnecessary Jinja2 macros in control files
  - Update RHEL 8 STIG to V2R4 and RHEL 9 STIG to V2R5
  - Add Debian 13 profile for ANSSI BP 28 (enhanced)
  - Create SLEM5 General profile
  - Create SL Micro 6 product and general profile
  - Update SLE15 STIG version to V2R5
  - Update SLE12 STIG version to V3R3
  - Update SLEM5 STIG version to V1R2
- Remove the cis profiles from all products</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1765886400">- updated to 0.1.79 (jsc#ECO-3319)
  - Add rhcos4 Profile for BSI Grundschutz
  - Create SLE15 general profile
  - Fix crypto policy settings in RHEL CIS profiles
  - Remove deprecated CIS OpenShift 1.4.0 and 1.5.0 profiles
  - Remove OCP STIG V1R1
  - Remove OCP STIG V2R1
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230400">- updated to 0.1.80 (jsc#ECO-3319)
  - Create SLE16 HIPAA profile
  - Create SLE16 PCI DSS 4 profile
  - Use Sequoia in RHEL 10 instead of GPG
  - New Profile for RHEL10: BSI
  - Move RHEL Control files to product files
  - Update RHEL 9 CCN profile
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230401">- Add SLE16 profiles to the build</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230402">- Update the SSG package description</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1780401600">- updated to 0.1.81 (jsc#ECO-3319)
  - Create SLE16 ANSSI profiles
  - Update SLE15 STIG version to V2R7
  - Update SLE12 STIG version to V3R5
  - Update SLEM5 STIG version to V1R3
  - Add Claude Code skills for content development workflows
  - Create Claude Skill for creating new products
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1780401601">- Add Hummingbird product support</changelog>
</package>
<package pkgid="dfa3ed9137456e3a2a5613b3feea43486ce95d4e194f55f4a49175ec5d4bf213cf9db9a4d9965d6b5b13e59ac9f89cbc8a0075bec6ce4a30c1b2ccbf6f68bd44" name="scap-security-guide-debian" arch="noarch">
  <version epoch="0" ver="0.1.81" rel="159.5"/>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741089600">- removed ssg-reproducable.patch: upstream</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741089601">- added build support for almalinux9</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176000">- updates redhat package to include almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176001">- fix a bug in redhad package description for almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176002">- removed tables reference related to almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741694400">- creation of a new request</changelog>
  <changelog author="Shawn Dunn &lt;sfalken@opensuse.org&gt;" date="1742644800">- Add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to fix FTBFS with cmake4
- Remove Group: declarations, no longer used</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1742731200">- ssg-fix-python.patch: fix build with older python3.</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1749729600">- updated to 0.1.77 (jsc#ECO-3319)
  - Introduce Architecture Decisions Records
  - Move stablization to the third Monday of the second month
  - Remove CCI References
  - Remove macOS content
- removed ssg-fix-python.patch: upstream
- Added support for tencentos4</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1750766400">- buildrequire cmake3 on older SLES versions for build</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1753876800">- ssg-remove-cis.patch: remove cis profiles
- Update description: remove cis profiles</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1755777600">- Remove ssg-remove-cis.patch: tarball
- Add check if cis profiles exists in the tarball</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1755777601">- Remove the cis profiles from the tarball</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1759147200">- updated to 0.1.78 (jsc#ECO-3319)
  - Enable SCE content for problematic rules that can traverse the whole filesystem
  - Remove unnecessary Jinja2 macros in control files
  - Update RHEL 8 STIG to V2R4 and RHEL 9 STIG to V2R5
  - Add Debian 13 profile for ANSSI BP 28 (enhanced)
  - Create SLEM5 General profile
  - Create SL Micro 6 product and general profile
  - Update SLE15 STIG version to V2R5
  - Update SLE12 STIG version to V3R3
  - Update SLEM5 STIG version to V1R2
- Remove the cis profiles from all products</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1765886400">- updated to 0.1.79 (jsc#ECO-3319)
  - Add rhcos4 Profile for BSI Grundschutz
  - Create SLE15 general profile
  - Fix crypto policy settings in RHEL CIS profiles
  - Remove deprecated CIS OpenShift 1.4.0 and 1.5.0 profiles
  - Remove OCP STIG V1R1
  - Remove OCP STIG V2R1
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230400">- updated to 0.1.80 (jsc#ECO-3319)
  - Create SLE16 HIPAA profile
  - Create SLE16 PCI DSS 4 profile
  - Use Sequoia in RHEL 10 instead of GPG
  - New Profile for RHEL10: BSI
  - Move RHEL Control files to product files
  - Update RHEL 9 CCN profile
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230401">- Add SLE16 profiles to the build</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230402">- Update the SSG package description</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1780401600">- updated to 0.1.81 (jsc#ECO-3319)
  - Create SLE16 ANSSI profiles
  - Update SLE15 STIG version to V2R7
  - Update SLE12 STIG version to V3R5
  - Update SLEM5 STIG version to V1R3
  - Add Claude Code skills for content development workflows
  - Create Claude Skill for creating new products
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1780401601">- Add Hummingbird product support</changelog>
</package>
<package pkgid="409af23c984ead780355a52954e6dbfac7eb0c5e9d0afcfbd51653649ecdc23f9e7fbe7df809e52d949c828111be2c44755bd01cb3b4bdd951dbd3bc8b49ebf7" name="scap-security-guide-redhat" arch="noarch">
  <version epoch="0" ver="0.1.81" rel="159.5"/>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741089600">- removed ssg-reproducable.patch: upstream</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741089601">- added build support for almalinux9</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176000">- updates redhat package to include almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176001">- fix a bug in redhad package description for almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176002">- removed tables reference related to almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741694400">- creation of a new request</changelog>
  <changelog author="Shawn Dunn &lt;sfalken@opensuse.org&gt;" date="1742644800">- Add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to fix FTBFS with cmake4
- Remove Group: declarations, no longer used</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1742731200">- ssg-fix-python.patch: fix build with older python3.</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1749729600">- updated to 0.1.77 (jsc#ECO-3319)
  - Introduce Architecture Decisions Records
  - Move stablization to the third Monday of the second month
  - Remove CCI References
  - Remove macOS content
- removed ssg-fix-python.patch: upstream
- Added support for tencentos4</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1750766400">- buildrequire cmake3 on older SLES versions for build</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1753876800">- ssg-remove-cis.patch: remove cis profiles
- Update description: remove cis profiles</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1755777600">- Remove ssg-remove-cis.patch: tarball
- Add check if cis profiles exists in the tarball</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1755777601">- Remove the cis profiles from the tarball</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1759147200">- updated to 0.1.78 (jsc#ECO-3319)
  - Enable SCE content for problematic rules that can traverse the whole filesystem
  - Remove unnecessary Jinja2 macros in control files
  - Update RHEL 8 STIG to V2R4 and RHEL 9 STIG to V2R5
  - Add Debian 13 profile for ANSSI BP 28 (enhanced)
  - Create SLEM5 General profile
  - Create SL Micro 6 product and general profile
  - Update SLE15 STIG version to V2R5
  - Update SLE12 STIG version to V3R3
  - Update SLEM5 STIG version to V1R2
- Remove the cis profiles from all products</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1765886400">- updated to 0.1.79 (jsc#ECO-3319)
  - Add rhcos4 Profile for BSI Grundschutz
  - Create SLE15 general profile
  - Fix crypto policy settings in RHEL CIS profiles
  - Remove deprecated CIS OpenShift 1.4.0 and 1.5.0 profiles
  - Remove OCP STIG V1R1
  - Remove OCP STIG V2R1
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230400">- updated to 0.1.80 (jsc#ECO-3319)
  - Create SLE16 HIPAA profile
  - Create SLE16 PCI DSS 4 profile
  - Use Sequoia in RHEL 10 instead of GPG
  - New Profile for RHEL10: BSI
  - Move RHEL Control files to product files
  - Update RHEL 9 CCN profile
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230401">- Add SLE16 profiles to the build</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230402">- Update the SSG package description</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1780401600">- updated to 0.1.81 (jsc#ECO-3319)
  - Create SLE16 ANSSI profiles
  - Update SLE15 STIG version to V2R7
  - Update SLE12 STIG version to V3R5
  - Update SLEM5 STIG version to V1R3
  - Add Claude Code skills for content development workflows
  - Create Claude Skill for creating new products
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1780401601">- Add Hummingbird product support</changelog>
</package>
<package pkgid="a942877b5354f9f01b6b2759713a7759c81c49d864ea88e25f49973aa9ef68153f82d9616cdd3abce2f3a535fdd6e0af2916cddeb5ffce71b9ac2bc485012b50" name="scap-security-guide-ubuntu" arch="noarch">
  <version epoch="0" ver="0.1.81" rel="159.5"/>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741089600">- removed ssg-reproducable.patch: upstream</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741089601">- added build support for almalinux9</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176000">- updates redhat package to include almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176001">- fix a bug in redhad package description for almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741176002">- removed tables reference related to almalinux9 builds</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1741694400">- creation of a new request</changelog>
  <changelog author="Shawn Dunn &lt;sfalken@opensuse.org&gt;" date="1742644800">- Add -DCMAKE_POLICY_VERSION_MINIMUM=3.5 to fix FTBFS with cmake4
- Remove Group: declarations, no longer used</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1742731200">- ssg-fix-python.patch: fix build with older python3.</changelog>
  <changelog author="Rumen Chikov &lt;rumen.chikov@suse.com&gt;" date="1749729600">- updated to 0.1.77 (jsc#ECO-3319)
  - Introduce Architecture Decisions Records
  - Move stablization to the third Monday of the second month
  - Remove CCI References
  - Remove macOS content
- removed ssg-fix-python.patch: upstream
- Added support for tencentos4</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1750766400">- buildrequire cmake3 on older SLES versions for build</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1753876800">- ssg-remove-cis.patch: remove cis profiles
- Update description: remove cis profiles</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1755777600">- Remove ssg-remove-cis.patch: tarball
- Add check if cis profiles exists in the tarball</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1755777601">- Remove the cis profiles from the tarball</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1759147200">- updated to 0.1.78 (jsc#ECO-3319)
  - Enable SCE content for problematic rules that can traverse the whole filesystem
  - Remove unnecessary Jinja2 macros in control files
  - Update RHEL 8 STIG to V2R4 and RHEL 9 STIG to V2R5
  - Add Debian 13 profile for ANSSI BP 28 (enhanced)
  - Create SLEM5 General profile
  - Create SL Micro 6 product and general profile
  - Update SLE15 STIG version to V2R5
  - Update SLE12 STIG version to V3R3
  - Update SLEM5 STIG version to V1R2
- Remove the cis profiles from all products</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1765886400">- updated to 0.1.79 (jsc#ECO-3319)
  - Add rhcos4 Profile for BSI Grundschutz
  - Create SLE15 general profile
  - Fix crypto policy settings in RHEL CIS profiles
  - Remove deprecated CIS OpenShift 1.4.0 and 1.5.0 profiles
  - Remove OCP STIG V1R1
  - Remove OCP STIG V2R1
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230400">- updated to 0.1.80 (jsc#ECO-3319)
  - Create SLE16 HIPAA profile
  - Create SLE16 PCI DSS 4 profile
  - Use Sequoia in RHEL 10 instead of GPG
  - New Profile for RHEL10: BSI
  - Move RHEL Control files to product files
  - Update RHEL 9 CCN profile
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230401">- Add SLE16 profiles to the build</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1773230402">- Update the SSG package description</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1780401600">- updated to 0.1.81 (jsc#ECO-3319)
  - Create SLE16 ANSSI profiles
  - Update SLE15 STIG version to V2R7
  - Update SLE12 STIG version to V3R5
  - Update SLEM5 STIG version to V1R3
  - Add Claude Code skills for content development workflows
  - Create Claude Skill for creating new products
  - Various updates for SLE 12/15</changelog>
  <changelog author="Boychev &lt;svetlin.boychev@suse.com&gt;" date="1780401601">- Add Hummingbird product support</changelog>
</package>
<package pkgid="805c3dbe84cecda5f827d7eca4bab84d8827b679fec653c85982ca6aecd9aa70e81af16e6b6acb68c4c3137a3876018b6bdd764222d5409e28742ff927432359" name="scap-workbench" arch="s390x">
  <version epoch="0" ver="1.2.1+git20221219.10c1929" rel="47.14"/>
  <changelog author="zaitor@opensuse.org" date="1505908800">- Update to version 1.1.5:
  + Highlights: Tri-state checkboxes in Tailoring Window.
  + Bugfixes:
  - Fixed remote host and port being cleared when scan starts
  - Fixed formating of Profile html description in Tailoring Window
  - Fixed oscap message "Downloading ... ok" appearing as an error
  + Other improvements:
  - Fixed tab order of widgets in main window.
  - Load Content as the default button of the SSG integration
    dialog.
  - New validation of the customization file name.
- Drop obsolete and unused conditional libwebkitgtk-devel and
  libwebkit-devel BuildRequires, this dependency was dropped in
  version 0.0.8 upstream.</changelog>
  <changelog author="jengelh@inai.de" date="1514635200">- Fix RPM groups. Optimize unnecessary subshell calls.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1532606400">- 0001-pkexec-avoid-potential-local-root-exploit-by-using-P.patch:
  harden and sanitize the pkexec wrapper (bsc#1084706).</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1555156800">- Update to 1.2.0. Changes since 1.1.5:
  * ported from Qt4 to Qt5
  * UX improvements
  * Generate bash and Ansible remediation roles from profiles
  * Generate bash and Ansible remediation roles from results after
    scanning
  * Fixed a short integer overflow when using ssh port numbers
    higher than 32k</changelog>
  <changelog author="Klaus K&#xE4;mpf &lt;kkaempf@suse.com&gt;" date="1570795200">- fix Qt5 deprecation warnings
  0002-Qt5-deprecations.patch</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1585137600">- Update to 1.2.1. No changelog.
- Rebase 0001-pkexec-avoid-potential-local-root-exploit-by-using-P.patch
- Drop 0002-Qt5-deprecations.patch. Merged upstream
- Add 0001-Port-Qt5-deprecated-methods.patch</changelog>
  <changelog author="Klaus K&#xE4;mpf &lt;kkaempf@suse.com&gt;" date="1622808000">- Update to 1.2.1+git20210604.1fc6def to fix Factory build
- drop 0001-Port-Qt5-deprecated-methods.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1642075200">- require "ssh" at buildtime to enable remote mode. (bsc#1194604)</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.2.1+git20221219.10c1929:
  * Use version 1 of get package for Ubuntu package installation.
  * Replace words with "control".
  * Use fedora latest to build scap-workbench.
  * Switch branch target to main.
  * Remove obsoleted sources of SCAP content from the manual
  * Update manual with how to obtain content from upstream source
  * Fix appdata, desktop and icons for Linux (Freedesktop)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
</package>
<package pkgid="542e29b7d26dfbb042e306e9aeafe2fee6b1dba4ba5047b4554fd7ae9a844ee86acc1981380f51fd00296084acec6160b1d8c90994843c5d13bd3bcbb27e327a" name="scap-workbench" arch="src">
  <version epoch="0" ver="1.2.1+git20221219.10c1929" rel="47.14"/>
  <changelog author="kkaempf@suse.com" date="1391860800">- Initial version 0.8.6</changelog>
  <changelog author="kkaempf@suse.com" date="1391860801">- fix path to bash, add scap-workbench-0.8.6.patch</changelog>
  <changelog author="meissner@suse.com" date="1420804800">- version 1.0.3
  This is a maintenance release with many bugfixes, usability improvements
  and documentation fixes. All users are recommended to update.
  See https://fedorahosted.org/scap-workbench/query?group=status&amp;milestone=1.0.3
  for full list of changes.
- scap-workbench-0.8.6.patch: upstream</changelog>
  <changelog author="kkaempf@suse.com" date="1423137600">- Require libqt4-devel &gt;= 4.8</changelog>
  <changelog author="meissner@suse.com" date="1427371200">- updated to 1.1.0
  Shiny new major release of SCAP Workbench. A lot of UX improvements
  and many new exciting features including a much better SCAP Security
  Guide integration. Downstreams are now encouraged to depend on
  scap-security-guide.</changelog>
  <changelog author="kkaempf@suse.com" date="1444651200">- take ownership of /usr/share/polkit-1*</changelog>
  <changelog author="kkaempf@suse.com" date="1444651201">- Update to 1.1.1
  Bugfix release</changelog>
  <changelog author="meissner@suse.com" date="1484568000">- Update to 1.1.4
  - Highlights
    Fix --fetch-remote-resources warning with older openscap
  - Bugfixes
    Check capabilities of oscap with propper arguments
  - Other improvements
    Show number of selected rules in profile listing
    Enable High DPI mode in MacOSX builds
    Remove fixed sizes of checkboxes and Port label
    Improve UX of recent remote machine history list
  - See https://github.com/OpenSCAP/scap-workbench/issues?q=milestone%3A1.1.4 for more details
- Update to 1.1.3
  - Highlights
    UX improvements
    Improved error message when scanning a remote machine in which openscap-scanner is not installed
  - Bugfixes
    Fixed search on disabled item
    Fixed multi benchmark tailoring use case
    Fixed a bug that caused tailored profiles to have titles duplicated
    Fixed path of tailoring file in dry run output
    Fixed fetch remote resources warning
  - Other improvements
    Added a helper script that builds SCAP Workbench for OSX
    Now Workbench doesn't allow edit of values with prohibitedChanges attribute
    Added --version and --help command line options
    Improved workflow of dry run execution
  - See https://github.com/OpenSCAP/scap-workbench/issues?q=milestone%3A1.1.3 for more details
- Update to 1.1.2:
  - New feature: "dry-run" - see which oscap arguments you have to use to do the same evaluation as SCAP Workbench as it is currently set.
  - Minor bugfixes:
    fixed checklist combobox when a datastream with multiple benchmarks is opened
    fixed minor licensing issues
  - See https://github.com/OpenSCAP/scap-workbench/issues?q=milestone%3A1.1.2 for more</changelog>
  <changelog author="zaitor@opensuse.org" date="1505908800">- Update to version 1.1.5:
  + Highlights: Tri-state checkboxes in Tailoring Window.
  + Bugfixes:
  - Fixed remote host and port being cleared when scan starts
  - Fixed formating of Profile html description in Tailoring Window
  - Fixed oscap message "Downloading ... ok" appearing as an error
  + Other improvements:
  - Fixed tab order of widgets in main window.
  - Load Content as the default button of the SSG integration
    dialog.
  - New validation of the customization file name.
- Drop obsolete and unused conditional libwebkitgtk-devel and
  libwebkit-devel BuildRequires, this dependency was dropped in
  version 0.0.8 upstream.</changelog>
  <changelog author="jengelh@inai.de" date="1514635200">- Fix RPM groups. Optimize unnecessary subshell calls.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1532606400">- 0001-pkexec-avoid-potential-local-root-exploit-by-using-P.patch:
  harden and sanitize the pkexec wrapper (bsc#1084706).</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1555156800">- Update to 1.2.0. Changes since 1.1.5:
  * ported from Qt4 to Qt5
  * UX improvements
  * Generate bash and Ansible remediation roles from profiles
  * Generate bash and Ansible remediation roles from results after
    scanning
  * Fixed a short integer overflow when using ssh port numbers
    higher than 32k</changelog>
  <changelog author="Klaus K&#xE4;mpf &lt;kkaempf@suse.com&gt;" date="1570795200">- fix Qt5 deprecation warnings
  0002-Qt5-deprecations.patch</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1585137600">- Update to 1.2.1. No changelog.
- Rebase 0001-pkexec-avoid-potential-local-root-exploit-by-using-P.patch
- Drop 0002-Qt5-deprecations.patch. Merged upstream
- Add 0001-Port-Qt5-deprecated-methods.patch</changelog>
  <changelog author="Klaus K&#xE4;mpf &lt;kkaempf@suse.com&gt;" date="1622808000">- Update to 1.2.1+git20210604.1fc6def to fix Factory build
- drop 0001-Port-Qt5-deprecated-methods.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1642075200">- require "ssh" at buildtime to enable remote mode. (bsc#1194604)</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.2.1+git20221219.10c1929:
  * Use version 1 of get package for Ubuntu package installation.
  * Replace words with "control".
  * Use fedora latest to build scap-workbench.
  * Switch branch target to main.
  * Remove obsoleted sources of SCAP content from the manual
  * Update manual with how to obtain content from upstream source
  * Fix appdata, desktop and icons for Linux (Freedesktop)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
</package>
<package pkgid="195a95cc2b7721ccd91438025034cfcff36c4111977498f2eff860a786e97aa9e0e0dcff5541cdfb77d6cfc1c6a8fb1380cc3b4989c43d64b1a489b03dc64e26" name="scap-workbench-debuginfo" arch="s390x">
  <version epoch="0" ver="1.2.1+git20221219.10c1929" rel="47.14"/>
  <changelog author="zaitor@opensuse.org" date="1505908800">- Update to version 1.1.5:
  + Highlights: Tri-state checkboxes in Tailoring Window.
  + Bugfixes:
  - Fixed remote host and port being cleared when scan starts
  - Fixed formating of Profile html description in Tailoring Window
  - Fixed oscap message "Downloading ... ok" appearing as an error
  + Other improvements:
  - Fixed tab order of widgets in main window.
  - Load Content as the default button of the SSG integration
    dialog.
  - New validation of the customization file name.
- Drop obsolete and unused conditional libwebkitgtk-devel and
  libwebkit-devel BuildRequires, this dependency was dropped in
  version 0.0.8 upstream.</changelog>
  <changelog author="jengelh@inai.de" date="1514635200">- Fix RPM groups. Optimize unnecessary subshell calls.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1532606400">- 0001-pkexec-avoid-potential-local-root-exploit-by-using-P.patch:
  harden and sanitize the pkexec wrapper (bsc#1084706).</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1555156800">- Update to 1.2.0. Changes since 1.1.5:
  * ported from Qt4 to Qt5
  * UX improvements
  * Generate bash and Ansible remediation roles from profiles
  * Generate bash and Ansible remediation roles from results after
    scanning
  * Fixed a short integer overflow when using ssh port numbers
    higher than 32k</changelog>
  <changelog author="Klaus K&#xE4;mpf &lt;kkaempf@suse.com&gt;" date="1570795200">- fix Qt5 deprecation warnings
  0002-Qt5-deprecations.patch</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1585137600">- Update to 1.2.1. No changelog.
- Rebase 0001-pkexec-avoid-potential-local-root-exploit-by-using-P.patch
- Drop 0002-Qt5-deprecations.patch. Merged upstream
- Add 0001-Port-Qt5-deprecated-methods.patch</changelog>
  <changelog author="Klaus K&#xE4;mpf &lt;kkaempf@suse.com&gt;" date="1622808000">- Update to 1.2.1+git20210604.1fc6def to fix Factory build
- drop 0001-Port-Qt5-deprecated-methods.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1642075200">- require "ssh" at buildtime to enable remote mode. (bsc#1194604)</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.2.1+git20221219.10c1929:
  * Use version 1 of get package for Ubuntu package installation.
  * Replace words with "control".
  * Use fedora latest to build scap-workbench.
  * Switch branch target to main.
  * Remove obsoleted sources of SCAP content from the manual
  * Update manual with how to obtain content from upstream source
  * Fix appdata, desktop and icons for Linux (Freedesktop)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
</package>
<package pkgid="c4b629d17f0f378fbc0405ee8d9d54dec0c4d7aafc4a8d6a28c8077f078eb0c7208c32f621148fe05111742bf32e9d630e8b3793fbfb8c3ed7aceb86be217abc" name="scap-workbench-doc" arch="s390x">
  <version epoch="0" ver="1.2.1+git20221219.10c1929" rel="47.14"/>
  <changelog author="zaitor@opensuse.org" date="1505908800">- Update to version 1.1.5:
  + Highlights: Tri-state checkboxes in Tailoring Window.
  + Bugfixes:
  - Fixed remote host and port being cleared when scan starts
  - Fixed formating of Profile html description in Tailoring Window
  - Fixed oscap message "Downloading ... ok" appearing as an error
  + Other improvements:
  - Fixed tab order of widgets in main window.
  - Load Content as the default button of the SSG integration
    dialog.
  - New validation of the customization file name.
- Drop obsolete and unused conditional libwebkitgtk-devel and
  libwebkit-devel BuildRequires, this dependency was dropped in
  version 0.0.8 upstream.</changelog>
  <changelog author="jengelh@inai.de" date="1514635200">- Fix RPM groups. Optimize unnecessary subshell calls.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1532606400">- 0001-pkexec-avoid-potential-local-root-exploit-by-using-P.patch:
  harden and sanitize the pkexec wrapper (bsc#1084706).</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1555156800">- Update to 1.2.0. Changes since 1.1.5:
  * ported from Qt4 to Qt5
  * UX improvements
  * Generate bash and Ansible remediation roles from profiles
  * Generate bash and Ansible remediation roles from results after
    scanning
  * Fixed a short integer overflow when using ssh port numbers
    higher than 32k</changelog>
  <changelog author="Klaus K&#xE4;mpf &lt;kkaempf@suse.com&gt;" date="1570795200">- fix Qt5 deprecation warnings
  0002-Qt5-deprecations.patch</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1585137600">- Update to 1.2.1. No changelog.
- Rebase 0001-pkexec-avoid-potential-local-root-exploit-by-using-P.patch
- Drop 0002-Qt5-deprecations.patch. Merged upstream
- Add 0001-Port-Qt5-deprecated-methods.patch</changelog>
  <changelog author="Klaus K&#xE4;mpf &lt;kkaempf@suse.com&gt;" date="1622808000">- Update to 1.2.1+git20210604.1fc6def to fix Factory build
- drop 0001-Port-Qt5-deprecated-methods.patch (upstream)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1642075200">- require "ssh" at buildtime to enable remote mode. (bsc#1194604)</changelog>
  <changelog author="kkaempf@suse.com" date="1680004800">- Update to version 1.2.1+git20221219.10c1929:
  * Use version 1 of get package for Ubuntu package installation.
  * Replace words with "control".
  * Use fedora latest to build scap-workbench.
  * Switch branch target to main.
  * Remove obsoleted sources of SCAP content from the manual
  * Update manual with how to obtain content from upstream source
  * Fix appdata, desktop and icons for Linux (Freedesktop)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
</package>
<package pkgid="1e75063e3f3f2e9f12fa07d2b28884a92fb1180b6a84500a093c4441d51dbe7dd3ddf1fe46de7075ab535164ee8096ba4b4b6439b8f6ee77e442416fda7d9d7a" name="scapy" arch="noarch">
  <version epoch="0" ver="2.7.0" rel="17.4"/>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1599134400">- Update to 2.4.4
  * Core
  - fix how timestamps are measured on layer 3 (broken since 2.4.1)
  - drop DNET support (deprecated since 2.4.0)
  - Scapy will now use libpcap instead of tcpdump to compile the filters (tcpdump is still used to filter pcaps)
  - major changes to the online doc and more doc to many functions
  * Layers
  - New layers (homeplug sg, smb2, NSH, RPL, ERSPAN, BFD, ROCE...)
  - TLS: TLS 1.3 support &amp; many fixes
  - 802.11 improvements / WPA3 detection
  - Netflow 9 fixes
  - Major refactor &amp; changes of the Automotive layers
  - HTTP changes
  - DHCPv6 fixes according to revision of the RFC
  - Bluetooth improvements (+BLE)
  - minor fixes to Radius, PPP, GTP, IPsec, CDP, VTP, HTTP/2, ...</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1618920000">- Update to 2.4.5
  * Core
  - Python 3.9 support
  - New interfaces system. `conf.iface` is now an object (retro-compatible as a
    string) which contains additional information about the interface and
    allows for an automatic selection of the socket type. `conf.ifaces` now lists
    all available interfaces.
  - Fix BSD support. Improve filters handling on Linux and `libpcap`
  - Automaton: support for `STOP` event - allows to cleanly end an Automata.
    Implemented in all Scapy's automatons
  - [Deprecated] Naming different fields with the same name will now raise a
    deprecation warning. This behavior has never properly worked and should never
    be necessary
  - Enhance `Net` and `Net6`
  - Improvements to scapy's logging, colored output and to UTscapy
  - Fix edge-cases with `ConditionalField` and `MultipleTypeField` to make them
    more resilient
  - [Doc] Enhancements: improved `MultipleTypeField` handling, add `view source`.
  * Layers
  - 6LoWPAN refactor
  - TLS improvements (TLS 1.3 server downgrade, TLS 1.2 EXT MS...)
  - HTTP improvements (http_request, support for zstd...)
  - Refactor TunTap support
  - Cleanup MACsec
  - Many small bug fixes or improvements to layers (SMB2, BFD, DNS, Zigbee,
    EAP, HomeplugGP, DHCPv6, 802.11...)
  * Automotive
  - Renaming of ENET to HSFZ
  - Added XCP layer
  - Added DoIP layer
  - Renaming of ECU to Ecu
  - Refactoring of EcuState class to be more versatile
  - Minor updates to the documentation</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1671969600">- Update to 2.5.0
  * Main Changes
  - Type hinting of Scapy core: Scapy now provides type hintings for all of its core
  - Python 3.9 and 3.10 support
  - enhanced loopback interface support on Linux, *BSD, and Windows
  - SPDX License identifiers added
  - several major CLI improvements, especially in autocompletion
  * Core
  - improved support of BPF
  - support pcapng writing, comments, TLS secrets decryption block
  - Re-work how sent_time is shared across packets iterators
  - support new LINUX_SLL2 packet type (new tcpdump versions)
  - pipes: performances issues fixed
  - tools: fixes to hexdiff, lhex...
  * Layers
  - new layers related to Windows: DCERPC/NTLM/KERBEROS/GSSAPI/SPNEGO/(C)LDAP.
  - new contrib layers: ESMC/RTPS/RTPC/metawatch
  - rework Netbios/SMB1/SMB2, basic SMB clients &amp; server, ntlm relay
  - several fixes to the TLS implementation
  - major zigbee/6lowpan improvements
  - bug fixes in TLS: properly support FFDH, fix the TLS 1.3 notebooks... among other things
  - p0f module update
  - IPsec: fixes, x25519 support...
  - various updates to the ASN.1 engine
  - IKEv2: fixes, UDP encapsulation
  - STUN support
  - Postgres line protocol 3.0 support
  - EDNS0 client subnet support
  - ESMC protocol added
  - support TCP-MD5 and TCP-AO options
  - ERF Ethernet Support
  - many fixes: modbus, 802.11, BTLE, SCTP, DNS, LLDP, Kerberos, RTPS, DHCP, MQTT, BGP, L2TP...
  * Automotive
  - ISOTPSoftSocket: Bug fixes and performance improvements
  - IPv6 support for DoIP
  - Bugfixes for DoIP
  - UDS-, GMLAN- and OBD-Scanner refactoring
  - CANFD support
  * Misc
  - new sanity rules prevent fields from having the same name in all packets
  - archives of the Scapy repo should now have more consistent hashes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1702296000">- Update URL
- Drop obsolete suse version check for 1110
- Use python rpm macros during %build and %install
- Do not install test scripts - %{python3_sitelib}/test/</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1702555200">- Add python3-cryptography to BuildRequires to have out of the
  box support for
  + PKI &amp; TLS crypto-related features
  + WEP decryption/encryption. (Dot11)
  + IPsec encryption/authentication.
- Recommend python3-PyX to be able to be able to use psdump() or
  pdfdump().
- Recommend python3-ipython for better experience when working in
  interactive mode (command completion, history, ...).
  mode
- Add workaround for openSUSE where /etc/protocols and
  /etc/protocols no longer live in /etc/ but /usr/etc/
- Run spec-cleaner</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1727697600">- Update to 2.6.0
  * support for RFC6874-like scope identifiers. This is very useful for
    multicast IPs as one can now do the following on L3:
    sr(IP(dst="224.0.0.1%eth0")/..., multi=True)
  * using the iface= argument is deprecated on level3 functions (send, sr, sr1),
    as its behavior was undefined. It remains in use for level2
    functions (sendp, srp, srp1). RFC6874-like scope identifiers should be used.
  * the internals that read the routes and interfaces configuration have been
    rewritten on Linux and BSD:
  - on linux, to use RTNETLINK. (this should help on machines that have huge BPG tables)
  - on *BSDs, to use PF_ROUTE.
  - on Linux, NetBSD and FreeBSD, link-local and multicast routes should now properly be loaded
  * new Windows protocols:
  - DCE/RPC: DCERPC_Client and DCERPC_Server with support for NCACN_IP_TCP and NCACN_NP
  - SMB2/3:
  * Protocol refactor, many more SMB2/3 structures supported
  * Server (class + 'simple' util smbserver()) (2.0.2 to 3.1.1)
  * Client (class + interactive CLI smbclient()) (2.0.2 to 3.1.1)
  * SMB socket, RPC over SMB socket, etc.
  - Kerberos:
  * KerberosSSP to use in SMB/RPC clients/servers, [MS-KILE] variants, SFU and more
  * Crypto: use cryptography, latest RFC8009, GSS_WrapEx support, typing, etc.
  * Util functions krb_as_req, krb_tgt_req, kpasswd (both modes), etc.
  * Ticketer++: ccache support, ask/renew/resign/edit tickets, etc
  - NTLM:
  * refactor, clean SSP
  - Extensive GSSAPI / SPNEGO support
  - LDAP
  * Fixes, ASN.1 Windows variation support
  * dclocator, answering machine for "LDAP PING", etc.
  * add a (very) basic LDAP_client (support for various binding mechanisms, encryption, etc.)
- More features, bug fixes and updated protocol support as listed in:
  https://github.com/secdev/scapy/releases/tag/v2.6.0</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1727870400">- Move sed call to fix reproducible builds (boo#1231253)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1728302400">- Fix load of embedded manufdb, by explicitly targeting non-executable-scripts
- Fix /etc paths to point to /usr/etc in published rpm.
- Enable unit tests to find issues earlier.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1730808000">- Update to 2.6.1
  * On linux machines with IPv6 disabled, Scapy would crash on startup
  * The scapy.1 manpage was no longer installed
  * Upon the first startup, there could be a crash related to the creation of
    Scapy's XDG-* related folders.
  * other small bugs that could lead to issues during packaging.
    Thanks to the downstream package maintainers for their help.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1774785600">- Update to version 2.7.0
  * https://github.com/secdev/scapy/releases/tag/v2.7.0</changelog>
</package>
<package pkgid="3590b9be9c201399ebbcdb9155fe1f13156d74a6f87d41cda8202896c2f5597330a72549c7d0efdd78f25b80b8604152016956412835f58cd8f2c3ad27fc16b2" name="scapy" arch="src">
  <version epoch="0" ver="2.7.0" rel="17.4"/>
  <changelog author="pascal.bleser@opensuse.org" date="1279195200">- initial package (2.1.1)</changelog>
  <changelog author="hpj@urpla.net" date="1360670400">- update to 2.2.0</changelog>
  <changelog author="speilicke@suse.com" date="1376654400">- Spec cleanup: license header, simplified macro usage, explicit file
  list, dropped %clean section
- Provide/obsolete python-scapy, it's the same software
- Use tarball from PyPI and a source URL so that it can be verified
- Remove documentation from tarball and thus from src and binary RPMs,
  we are not allowed to distribute it</changelog>
  <changelog author="hpj@urpla.net" date="1376654401">- add note about testing requirements, local test run successful</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1541764800">- update to 2.4.0
  * Core
  - Pcap/PcapNg improvements
  - OSX 802.11 monitor mode
  - Krack AP module
  - iPython support
  * Layers
  - major changes
  * TLS (including TLS1.3), X.509
  - New
  * HTTP/2, EAP-TTLS, TACACS, MQTT
  - Improved
  * IPv6, SCTP, NTP, PPTP, CDP, BGP, ISIS
- use python3 by default</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1547553600">- update to 2.4.2
  * Core
  - Python 3.7 support
  - unit testing is now 100% tox based
  * Layers
  - Many automotive related layers added (ISO-TP...)
  - New:
    EtherCat, OPCDA, SOCKS, USBpcap, RPKI
  - Improved:
    MACsec, MQTT, MPLS, DNS, ARP, Dot15d4, Zigbee, Bluetooth4LE, RadioTap</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1565265600">- Update to 2.4.3
  * Core
  - latency improvements
  - sniff() can be used to test BPF fiters on pcap files
  - more unit tests and Python3 compatibility
  - asynchronous sniffing
  - UTScapy vim syntax highlighting
  - Console / IPython integration improvements
  * Layers
  - New:
    HTTP (from the deprecated scapy-http module), TLS 1.3, ATA over Ethernet, OVD, IEC 60870-5-104, enip, ...
  - Improved:
    NetflowV9, ISOTP, Zigbee, RTR, BLE, PPI, DNS, LLDP, Bluetooth/BTLE rework, PPI / 802.11 improvements</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1599134400">- Update to 2.4.4
  * Core
  - fix how timestamps are measured on layer 3 (broken since 2.4.1)
  - drop DNET support (deprecated since 2.4.0)
  - Scapy will now use libpcap instead of tcpdump to compile the filters (tcpdump is still used to filter pcaps)
  - major changes to the online doc and more doc to many functions
  * Layers
  - New layers (homeplug sg, smb2, NSH, RPL, ERSPAN, BFD, ROCE...)
  - TLS: TLS 1.3 support &amp; many fixes
  - 802.11 improvements / WPA3 detection
  - Netflow 9 fixes
  - Major refactor &amp; changes of the Automotive layers
  - HTTP changes
  - DHCPv6 fixes according to revision of the RFC
  - Bluetooth improvements (+BLE)
  - minor fixes to Radius, PPP, GTP, IPsec, CDP, VTP, HTTP/2, ...</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1618920000">- Update to 2.4.5
  * Core
  - Python 3.9 support
  - New interfaces system. `conf.iface` is now an object (retro-compatible as a
    string) which contains additional information about the interface and
    allows for an automatic selection of the socket type. `conf.ifaces` now lists
    all available interfaces.
  - Fix BSD support. Improve filters handling on Linux and `libpcap`
  - Automaton: support for `STOP` event - allows to cleanly end an Automata.
    Implemented in all Scapy's automatons
  - [Deprecated] Naming different fields with the same name will now raise a
    deprecation warning. This behavior has never properly worked and should never
    be necessary
  - Enhance `Net` and `Net6`
  - Improvements to scapy's logging, colored output and to UTscapy
  - Fix edge-cases with `ConditionalField` and `MultipleTypeField` to make them
    more resilient
  - [Doc] Enhancements: improved `MultipleTypeField` handling, add `view source`.
  * Layers
  - 6LoWPAN refactor
  - TLS improvements (TLS 1.3 server downgrade, TLS 1.2 EXT MS...)
  - HTTP improvements (http_request, support for zstd...)
  - Refactor TunTap support
  - Cleanup MACsec
  - Many small bug fixes or improvements to layers (SMB2, BFD, DNS, Zigbee,
    EAP, HomeplugGP, DHCPv6, 802.11...)
  * Automotive
  - Renaming of ENET to HSFZ
  - Added XCP layer
  - Added DoIP layer
  - Renaming of ECU to Ecu
  - Refactoring of EcuState class to be more versatile
  - Minor updates to the documentation</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1671969600">- Update to 2.5.0
  * Main Changes
  - Type hinting of Scapy core: Scapy now provides type hintings for all of its core
  - Python 3.9 and 3.10 support
  - enhanced loopback interface support on Linux, *BSD, and Windows
  - SPDX License identifiers added
  - several major CLI improvements, especially in autocompletion
  * Core
  - improved support of BPF
  - support pcapng writing, comments, TLS secrets decryption block
  - Re-work how sent_time is shared across packets iterators
  - support new LINUX_SLL2 packet type (new tcpdump versions)
  - pipes: performances issues fixed
  - tools: fixes to hexdiff, lhex...
  * Layers
  - new layers related to Windows: DCERPC/NTLM/KERBEROS/GSSAPI/SPNEGO/(C)LDAP.
  - new contrib layers: ESMC/RTPS/RTPC/metawatch
  - rework Netbios/SMB1/SMB2, basic SMB clients &amp; server, ntlm relay
  - several fixes to the TLS implementation
  - major zigbee/6lowpan improvements
  - bug fixes in TLS: properly support FFDH, fix the TLS 1.3 notebooks... among other things
  - p0f module update
  - IPsec: fixes, x25519 support...
  - various updates to the ASN.1 engine
  - IKEv2: fixes, UDP encapsulation
  - STUN support
  - Postgres line protocol 3.0 support
  - EDNS0 client subnet support
  - ESMC protocol added
  - support TCP-MD5 and TCP-AO options
  - ERF Ethernet Support
  - many fixes: modbus, 802.11, BTLE, SCTP, DNS, LLDP, Kerberos, RTPS, DHCP, MQTT, BGP, L2TP...
  * Automotive
  - ISOTPSoftSocket: Bug fixes and performance improvements
  - IPv6 support for DoIP
  - Bugfixes for DoIP
  - UDS-, GMLAN- and OBD-Scanner refactoring
  - CANFD support
  * Misc
  - new sanity rules prevent fields from having the same name in all packets
  - archives of the Scapy repo should now have more consistent hashes</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1702296000">- Update URL
- Drop obsolete suse version check for 1110
- Use python rpm macros during %build and %install
- Do not install test scripts - %{python3_sitelib}/test/</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1702555200">- Add python3-cryptography to BuildRequires to have out of the
  box support for
  + PKI &amp; TLS crypto-related features
  + WEP decryption/encryption. (Dot11)
  + IPsec encryption/authentication.
- Recommend python3-PyX to be able to be able to use psdump() or
  pdfdump().
- Recommend python3-ipython for better experience when working in
  interactive mode (command completion, history, ...).
  mode
- Add workaround for openSUSE where /etc/protocols and
  /etc/protocols no longer live in /etc/ but /usr/etc/
- Run spec-cleaner</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1727697600">- Update to 2.6.0
  * support for RFC6874-like scope identifiers. This is very useful for
    multicast IPs as one can now do the following on L3:
    sr(IP(dst="224.0.0.1%eth0")/..., multi=True)
  * using the iface= argument is deprecated on level3 functions (send, sr, sr1),
    as its behavior was undefined. It remains in use for level2
    functions (sendp, srp, srp1). RFC6874-like scope identifiers should be used.
  * the internals that read the routes and interfaces configuration have been
    rewritten on Linux and BSD:
  - on linux, to use RTNETLINK. (this should help on machines that have huge BPG tables)
  - on *BSDs, to use PF_ROUTE.
  - on Linux, NetBSD and FreeBSD, link-local and multicast routes should now properly be loaded
  * new Windows protocols:
  - DCE/RPC: DCERPC_Client and DCERPC_Server with support for NCACN_IP_TCP and NCACN_NP
  - SMB2/3:
  * Protocol refactor, many more SMB2/3 structures supported
  * Server (class + 'simple' util smbserver()) (2.0.2 to 3.1.1)
  * Client (class + interactive CLI smbclient()) (2.0.2 to 3.1.1)
  * SMB socket, RPC over SMB socket, etc.
  - Kerberos:
  * KerberosSSP to use in SMB/RPC clients/servers, [MS-KILE] variants, SFU and more
  * Crypto: use cryptography, latest RFC8009, GSS_WrapEx support, typing, etc.
  * Util functions krb_as_req, krb_tgt_req, kpasswd (both modes), etc.
  * Ticketer++: ccache support, ask/renew/resign/edit tickets, etc
  - NTLM:
  * refactor, clean SSP
  - Extensive GSSAPI / SPNEGO support
  - LDAP
  * Fixes, ASN.1 Windows variation support
  * dclocator, answering machine for "LDAP PING", etc.
  * add a (very) basic LDAP_client (support for various binding mechanisms, encryption, etc.)
- More features, bug fixes and updated protocol support as listed in:
  https://github.com/secdev/scapy/releases/tag/v2.6.0</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1727870400">- Move sed call to fix reproducible builds (boo#1231253)</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1728302400">- Fix load of embedded manufdb, by explicitly targeting non-executable-scripts
- Fix /etc paths to point to /usr/etc in published rpm.
- Enable unit tests to find issues earlier.</changelog>
  <changelog author="Robert Frohl &lt;rfrohl@suse.com&gt;" date="1730808000">- Update to 2.6.1
  * On linux machines with IPv6 disabled, Scapy would crash on startup
  * The scapy.1 manpage was no longer installed
  * Upon the first startup, there could be a crash related to the creation of
    Scapy's XDG-* related folders.
  * other small bugs that could lead to issues during packaging.
    Thanks to the downstream package maintainers for their help.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1774785600">- Update to version 2.7.0
  * https://github.com/secdev/scapy/releases/tag/v2.7.0</changelog>
</package>
<package pkgid="50f64e06bdcc2c5668c5c3e7c8834264c4b6f6acccb812732663cd9c6d65ff110bab05c3aa39426bbb31d4cc40cdb921fbbe17dce30ef925a1a53c3591cf11c8" name="scrub" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="17.13"/>
  <changelog author="meissner@suse.com" date="1375963200">- imported scrub 2.5.2, a generic disk scrubber with multiple
  government mandated scrub algorithms.</changelog>
  <changelog author="p.drouand@gmail.com" date="1427112000">- Update to version 2.6.1
  * Add dist tag to release (TOSS-2665)
  * OS X build/test failrues (issue 31)
  * Minor autotools fixes.
- Update download Url
- Enable parallel building with %{?_smp_mflags}</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1731672000">- scrub-fix-build.patch: fix build with gcc14.</changelog>
</package>
<package pkgid="23a4dd038995d825c0f96469386ef2b73eca68b8192a8c27e2b41747ba459aafdb4e6d3abc36bae839aec30e2996f1142807c377733d6c3b21b9bf1838b6916a" name="scrub" arch="src">
  <version epoch="0" ver="2.6.1" rel="17.13"/>
  <changelog author="meissner@suse.com" date="1375963200">- imported scrub 2.5.2, a generic disk scrubber with multiple
  government mandated scrub algorithms.</changelog>
  <changelog author="p.drouand@gmail.com" date="1427112000">- Update to version 2.6.1
  * Add dist tag to release (TOSS-2665)
  * OS X build/test failrues (issue 31)
  * Minor autotools fixes.
- Update download Url
- Enable parallel building with %{?_smp_mflags}</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1731672000">- scrub-fix-build.patch: fix build with gcc14.</changelog>
</package>
<package pkgid="d26801c4de89e8eab11c5a1a4451e9619bc234411af938a7a313ba326a31fcfaf5abbe3ea585f6c5f1e8fcf4e2fc8a6f9a8e6e1e1021e39f5f5f89f1f6f1d78e" name="scrub-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="17.13"/>
  <changelog author="meissner@suse.com" date="1375963200">- imported scrub 2.5.2, a generic disk scrubber with multiple
  government mandated scrub algorithms.</changelog>
  <changelog author="p.drouand@gmail.com" date="1427112000">- Update to version 2.6.1
  * Add dist tag to release (TOSS-2665)
  * OS X build/test failrues (issue 31)
  * Minor autotools fixes.
- Update download Url
- Enable parallel building with %{?_smp_mflags}</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1731672000">- scrub-fix-build.patch: fix build with gcc14.</changelog>
</package>
<package pkgid="bd6dd52d6480e0597b965cf69fbf16d6a72286b5f0f1c8607d6c42846ea8567d5d0fe0bec20af4e48f58aeec1cfcc3da67d3888f6841dfe2c52269f24e3aaf23" name="scrub-debugsource" arch="s390x">
  <version epoch="0" ver="2.6.1" rel="17.13"/>
  <changelog author="meissner@suse.com" date="1375963200">- imported scrub 2.5.2, a generic disk scrubber with multiple
  government mandated scrub algorithms.</changelog>
  <changelog author="p.drouand@gmail.com" date="1427112000">- Update to version 2.6.1
  * Add dist tag to release (TOSS-2665)
  * OS X build/test failrues (issue 31)
  * Minor autotools fixes.
- Update download Url
- Enable parallel building with %{?_smp_mflags}</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1731672000">- scrub-fix-build.patch: fix build with gcc14.</changelog>
</package>
<package pkgid="15fc2e6a3afa40f0afb73182f619ed2a8920507cd9ca26f3dde1522aa98505595aff77d304e9a0187d0acca69a1319a8ecad066f3e9b806923446c73a1a9ee49" name="scrypt" arch="s390x">
  <version epoch="0" ver="1.3.3" rel="16.12"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296475200">- Initial package</changelog>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296475201">- fix build in i586, that doesnt enable sse2 :-(</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1300449600">- Disable SSE2 ugly hack, just provide a binary with SSE2
  always.</changelog>
  <changelog author="mpluskal@suse.com" date="1441972800">- Update to 1.2.0
  * no upstream changelog provided
- Update license
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1456488000">- Small spec file cleanups</changelog>
  <changelog author="mpluskal@suse.com" date="1489665600">- Update to version 1.2.1:
  * Unit tests are available</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1575892800">- Update to version 1.3.0:
  * No upstream changelog available</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1600257600">- use https for downloads
- add gpg verification
- update to 1.3.1:
  * see https://github.com/Tarsnap/scrypt/compare/1.3.0...1.3.1</changelog>
  <changelog author="Wang Jun &lt;badboywj@gmail.com&gt;" date="1702296000">- update to 1.3.2:
  * see https://github.com/Tarsnap/scrypt/compare/1.3.0...1.3.1</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1742040000">- update to 1.3.3:
  * see https://github.com/Tarsnap/scrypt/compare/1.3.2...1.3.3</changelog>
</package>
<package pkgid="6fc903d2be34aee99e01734e4ac1b662865984d1b19766251de8d14c0c2a26440f35ff2adfee9524fbd851d0db457e903de7e9be60396a8a3ca2cf32eb366127" name="scrypt" arch="src">
  <version epoch="0" ver="1.3.3" rel="16.12"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296475200">- Initial package</changelog>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296475201">- fix build in i586, that doesnt enable sse2 :-(</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1300449600">- Disable SSE2 ugly hack, just provide a binary with SSE2
  always.</changelog>
  <changelog author="mpluskal@suse.com" date="1441972800">- Update to 1.2.0
  * no upstream changelog provided
- Update license
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1456488000">- Small spec file cleanups</changelog>
  <changelog author="mpluskal@suse.com" date="1489665600">- Update to version 1.2.1:
  * Unit tests are available</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1575892800">- Update to version 1.3.0:
  * No upstream changelog available</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1600257600">- use https for downloads
- add gpg verification
- update to 1.3.1:
  * see https://github.com/Tarsnap/scrypt/compare/1.3.0...1.3.1</changelog>
  <changelog author="Wang Jun &lt;badboywj@gmail.com&gt;" date="1702296000">- update to 1.3.2:
  * see https://github.com/Tarsnap/scrypt/compare/1.3.0...1.3.1</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1742040000">- update to 1.3.3:
  * see https://github.com/Tarsnap/scrypt/compare/1.3.2...1.3.3</changelog>
</package>
<package pkgid="25a6f05c016006d56c96ca5fe406d461959894118ce53c68fc5243f6dda32c860b27b932145d9a2292da9a24b1a04f59c7e50a5d9db427a0d68fbe15ee8ba572" name="scrypt-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3.3" rel="16.12"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296475200">- Initial package</changelog>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296475201">- fix build in i586, that doesnt enable sse2 :-(</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1300449600">- Disable SSE2 ugly hack, just provide a binary with SSE2
  always.</changelog>
  <changelog author="mpluskal@suse.com" date="1441972800">- Update to 1.2.0
  * no upstream changelog provided
- Update license
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1456488000">- Small spec file cleanups</changelog>
  <changelog author="mpluskal@suse.com" date="1489665600">- Update to version 1.2.1:
  * Unit tests are available</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1575892800">- Update to version 1.3.0:
  * No upstream changelog available</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1600257600">- use https for downloads
- add gpg verification
- update to 1.3.1:
  * see https://github.com/Tarsnap/scrypt/compare/1.3.0...1.3.1</changelog>
  <changelog author="Wang Jun &lt;badboywj@gmail.com&gt;" date="1702296000">- update to 1.3.2:
  * see https://github.com/Tarsnap/scrypt/compare/1.3.0...1.3.1</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1742040000">- update to 1.3.3:
  * see https://github.com/Tarsnap/scrypt/compare/1.3.2...1.3.3</changelog>
</package>
<package pkgid="e05814f3534b58ad23847d32df63cfd1999a83847922f52f1c8d4a2b5bcc83645a084a1439016c7cc70a36c6896037f9acfaa4f11af095088550a7598e145764" name="scrypt-debugsource" arch="s390x">
  <version epoch="0" ver="1.3.3" rel="16.12"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296475200">- Initial package</changelog>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296475201">- fix build in i586, that doesnt enable sse2 :-(</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1300449600">- Disable SSE2 ugly hack, just provide a binary with SSE2
  always.</changelog>
  <changelog author="mpluskal@suse.com" date="1441972800">- Update to 1.2.0
  * no upstream changelog provided
- Update license
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1456488000">- Small spec file cleanups</changelog>
  <changelog author="mpluskal@suse.com" date="1489665600">- Update to version 1.2.1:
  * Unit tests are available</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1575892800">- Update to version 1.3.0:
  * No upstream changelog available</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1600257600">- use https for downloads
- add gpg verification
- update to 1.3.1:
  * see https://github.com/Tarsnap/scrypt/compare/1.3.0...1.3.1</changelog>
  <changelog author="Wang Jun &lt;badboywj@gmail.com&gt;" date="1702296000">- update to 1.3.2:
  * see https://github.com/Tarsnap/scrypt/compare/1.3.0...1.3.1</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1742040000">- update to 1.3.3:
  * see https://github.com/Tarsnap/scrypt/compare/1.3.2...1.3.3</changelog>
</package>
<package pkgid="e1b7b523e1172a3bce39a443eb15a6649d4d1970bc67043b91f46460683662c2f9e6bf286fd8b1a14b08fd5eb7778380d414d5c5f4b6466ac7b77c01f69d87fe" name="secbox" arch="noarch">
  <version epoch="0" ver="1.34" rel="50.1"/>
</package>
<package pkgid="9dded0602f20250ef89ab8f23019068a7bdf06957b5a3081d1f7c3c13330e97e269df2e94297e01bf04cd915055c7b1846240c48ec0b17f317f4051a0ec10faf" name="secbox" arch="src">
  <version epoch="0" ver="1.34" rel="50.1"/>
</package>
<package pkgid="8b6fac5d895c0c33ecd05a9491a1de34dbe3d649e79752da45e34c6d1a9eaf7588bdc9e210faa36926950c19e0661115c247512991234c29db88aaffcd0a8479" name="seccheck" arch="noarch">
  <version epoch="0" ver="3.0" rel="1419.39"/>
  <changelog author="vpereira@suse.com" date="1469361600">-  fixed bnc#985802: security monthly reports were broken</changelog>
  <changelog author="vpereira@suse.com" date="1488801600">- fixed: bsc#1021036: mute stderr on sysctl -a</changelog>
  <changelog author="vpereira@suse.com" date="1502798400">- fixed: bsc#1033244: john integration were broken</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="vpereira@microfocus.com" date="1525694400">- fixes proposed by the bsc#1084449:
  + introduction of SECCHK_FROM
  + deletion of empty file</changelog>
  <changelog author="abergmann@suse.com" date="1551960000">- Move seccheck to systemd timers (bsc#1115415).</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1552737600">- Combine %service_* calls to reduce generated boilerplate.</changelog>
  <changelog author="d_werner@gmx.net" date="1567944000">- adapt WantedBy so the timers are actually started at boot
  time when enabled (#1132919)
  added patch: timers_wanted_by_1132919.patch
- correct indentation of SECCHK_FROM (#985802) for the
  weekly and monthly mails so that the mail header lines
  are recognised by the receiving mail client
  added patch: mail_headerlines_985802.patch</changelog>
  <changelog author="d_werner@gmx.net" date="1577620800">- update package description: no longer started by cron</changelog>
  <changelog author="&lt;d_werner@gmx.net&gt;" date="1607860800">- libexec_move_1178617.patch: update paths after move to /usr/libexec
- security_announce_url_1178617.patch: update url for security
  announcements to suse (boo#1178617)</changelog>
</package>
<package pkgid="6b1ea239435c632096558417711b433108123673054a6f13321dcc606d193dc2d970dd06f06afff61e1d5015a6ac6f8602b3be71218a7507c976cc835d086a63" name="seccheck" arch="src">
  <version epoch="0" ver="3.0" rel="1419.39"/>
  <changelog author="abergmann@suse.com" date="1392379200">- Extended autologout functionality in seccheck-2.0-autologout.patch
  with SSH. See autologout.conf file for configuration details.
- Fixed issue if no user is logged on in seccheck-2.0-autologout.patch.</changelog>
  <changelog author="abergmann@suse.com" date="1392811200">- Disable autologout as default (bnc#864534).
  (seccheck-2.0-autologout.patch)</changelog>
  <changelog author="vpereira@suse.com" date="1408017600">- New version 3.0
- refactored codebase
- added new security tests
- moved the upstream to https://github.com/vpereira/seccheck
- Upstreamed patches:
  seccheck-2.0.diff
  seccheck-2.0-misc.patch
  seccheck-2.0-nisfix.patch
  seccheck-2.0-grep.patch
  seccheck-2.0-sort.patch
  seccheck-2.0-newpromisccheck.patch
  seccheck-2.0-filesystems_added.patch
  seccheck-2.0_john-path.diff
  seccheck-2.0_withoutmedia-bug47024.diff
  seccheck-2.0_update-datafiles-regexfix-bug51004.diff
  seccheck-2.0_fix-ls-output-local.diff
  seccheck-2.0_find_mount_arg.diff
  seccheck-2.0_find_with_dev.diff
  seccheck-2.0_dont_run_xarg_on_empty_input.diff
  seccheck-2.0-john.patch
  seccheck-2.0-website.patch
  seccheck-2.0_new_rpm_output_handle_more_filesystems_bnc746042.diff
  seccheck-2.0_daily_uid_bnc769770.diff
  seccheck-2.0-autologout.patch</changelog>
  <changelog author="vpereira@suse.com" date="1409745600">- refactoring: each security test, has its own helper
- ran spec-clean</changelog>
  <changelog author="vpereira@suse.com" date="1418731200">- daily-mailer.patch: applied patch suggested in bnc#904544</changelog>
  <changelog author="Led &lt;ledest@gmail.com&gt;" date="1418817600">- fix bashisms in scripts
- fix chebang of autologout.sh script than contains bash-specific
  constructions
- add patches:
  * seccheck-3.0-fix-bashisms.patch</changelog>
  <changelog author="vpereira@suse.com" date="1422964800">- bnc#914656: fixed function guessable_password_email definition</changelog>
  <changelog author="vpereira@suse.com" date="1430136000">- added patch: emails-without-subject.patch to fix bnc#923688</changelog>
  <changelog author="vpereira@suse.com" date="1444046400">- use upstream version of code</changelog>
  <changelog author="vpereira@suse.com" date="1444219200">- fixed bnc#942846: seccheck does not collect the same data in
  SLES 12 and SLES 11 sp3
- seccheck-3.0-fix-bashisms.patch and daily-mailer.patch were merged into upstream</changelog>
  <changelog author="vpereira@suse.com" date="1469361600">-  fixed bnc#985802: security monthly reports were broken</changelog>
  <changelog author="vpereira@suse.com" date="1488801600">- fixed: bsc#1021036: mute stderr on sysctl -a</changelog>
  <changelog author="vpereira@suse.com" date="1502798400">- fixed: bsc#1033244: john integration were broken</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="vpereira@microfocus.com" date="1525694400">- fixes proposed by the bsc#1084449:
  + introduction of SECCHK_FROM
  + deletion of empty file</changelog>
  <changelog author="abergmann@suse.com" date="1551960000">- Move seccheck to systemd timers (bsc#1115415).</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1552737600">- Combine %service_* calls to reduce generated boilerplate.</changelog>
  <changelog author="d_werner@gmx.net" date="1567944000">- adapt WantedBy so the timers are actually started at boot
  time when enabled (#1132919)
  added patch: timers_wanted_by_1132919.patch
- correct indentation of SECCHK_FROM (#985802) for the
  weekly and monthly mails so that the mail header lines
  are recognised by the receiving mail client
  added patch: mail_headerlines_985802.patch</changelog>
  <changelog author="d_werner@gmx.net" date="1577620800">- update package description: no longer started by cron</changelog>
  <changelog author="&lt;d_werner@gmx.net&gt;" date="1607860800">- libexec_move_1178617.patch: update paths after move to /usr/libexec
- security_announce_url_1178617.patch: update url for security
  announcements to suse (boo#1178617)</changelog>
</package>
<package pkgid="0af040fdbe26ee2d3e30d69606ca12b1c71d34c724ddc6d9075b4e39aac7ba876a579d6f4fb0d99ce19ab0e4a330edd3feeddbb82692ebc9d64e37e7afa8d3d2" name="secure-delete" arch="s390x">
  <version epoch="0" ver="3.1" rel="8.22"/>
  <changelog author="Darin Perusich &lt;darin@darins.net&gt;" date="1310385600">- Initial build for openSUSE</changelog>
  <changelog author="Darin Perusich &lt;darin@darins.net&gt;" date="1311336000">- Updated to include srm</changelog>
  <changelog author="Darin Perusich &lt;darin@darins.net&gt;" date="1312459200">- added conflict for srm package</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376000">- SPEC file changes:
  * add SUSE copyright header
  * move 'changes' to the changes file
  * rename license to 'GPL-1.0+'</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- switch URL to https (even if no longer really related to secure delete</changelog>
</package>
<package pkgid="1aa28f6213d6474c8c9c0175d48d7b6cfa21c64cea2ebed75b109fa5256be3e1e40ba060874071da474754b07e498b73c147b6b82d732a40cfb763eba2a5f4b1" name="secure-delete" arch="src">
  <version epoch="0" ver="3.1" rel="8.22"/>
  <changelog author="Darin Perusich &lt;darin@darins.net&gt;" date="1310385600">- Initial build for openSUSE</changelog>
  <changelog author="Darin Perusich &lt;darin@darins.net&gt;" date="1311336000">- Updated to include srm</changelog>
  <changelog author="Darin Perusich &lt;darin@darins.net&gt;" date="1312459200">- added conflict for srm package</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376000">- SPEC file changes:
  * add SUSE copyright header
  * move 'changes' to the changes file
  * rename license to 'GPL-1.0+'</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- switch URL to https (even if no longer really related to secure delete</changelog>
</package>
<package pkgid="247830452ccc495af44b258f2b6bd51fdbb742982563f51c75b884dabac55e6da1d3bcc7ba95f6118155d0e99cdb6fc21293179d996774455aba0d9db23e9bb4" name="secure-delete-debuginfo" arch="s390x">
  <version epoch="0" ver="3.1" rel="8.22"/>
  <changelog author="Darin Perusich &lt;darin@darins.net&gt;" date="1310385600">- Initial build for openSUSE</changelog>
  <changelog author="Darin Perusich &lt;darin@darins.net&gt;" date="1311336000">- Updated to include srm</changelog>
  <changelog author="Darin Perusich &lt;darin@darins.net&gt;" date="1312459200">- added conflict for srm package</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1514376000">- SPEC file changes:
  * add SUSE copyright header
  * move 'changes' to the changes file
  * rename license to 'GPL-1.0+'</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- switch URL to https (even if no longer really related to secure delete</changelog>
</package>
<package pkgid="e1d2fbda3ffcc668c7648764104d9374ccedb273f5ca7bb19396785a36ffbc17eeed9d29a7e9916102cc4e0a1a0af7979067da5827786d71f8168ff93cdef57d" name="sha1collisiondetection" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="20.21"/>
  <changelog author="astieger@suse.com" date="1488283200">- CLI to check for SHA-1 collisions bsc#1026646 - CVE-2005-4900
- initial package (cli only)</changelog>
  <changelog author="astieger@suse.com" date="1491825600">- update to 1.0.3:
  * SIMD code removed
  * performance improvements
- package library
- conflicts with libmd-devel</changelog>
  <changelog author="astieger@suse.com" date="1495454400">- better printing of errors, and allow hashing stdin
  add sha1collisiondetection-1.0.3-io-fixes.patch</changelog>
  <changelog author="tiwai@suse.de" date="1501848000">- Fix include header path to /usr/include/sha1dc/sha1.h as supposed
  by upstream installation
- Remove conflicts with libmd-devel, as we changed the header path</changelog>
  <changelog author="ro@suse.de" date="1517400000">- add sha1collisiondetection-endian_detection.patch
  fix detection of endianness at compile time</changelog>
  <changelog author="ro@suse.de" date="1517400001">- cleaner solution for the endian detection issue:
  include the proper header file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="d35ad82f74bf67bb7e6d47088053fa227d77d9bed0aa6a31d0d32729661d04c7e08e8ec0e89d74ccc53372e52b6be60e65239c48335de8c163819748a6602fc8" name="sha1collisiondetection" arch="src">
  <version epoch="0" ver="1.0.3" rel="20.21"/>
  <changelog author="astieger@suse.com" date="1488283200">- CLI to check for SHA-1 collisions bsc#1026646 - CVE-2005-4900
- initial package (cli only)</changelog>
  <changelog author="astieger@suse.com" date="1491825600">- update to 1.0.3:
  * SIMD code removed
  * performance improvements
- package library
- conflicts with libmd-devel</changelog>
  <changelog author="astieger@suse.com" date="1495454400">- better printing of errors, and allow hashing stdin
  add sha1collisiondetection-1.0.3-io-fixes.patch</changelog>
  <changelog author="tiwai@suse.de" date="1501848000">- Fix include header path to /usr/include/sha1dc/sha1.h as supposed
  by upstream installation
- Remove conflicts with libmd-devel, as we changed the header path</changelog>
  <changelog author="ro@suse.de" date="1517400000">- add sha1collisiondetection-endian_detection.patch
  fix detection of endianness at compile time</changelog>
  <changelog author="ro@suse.de" date="1517400001">- cleaner solution for the endian detection issue:
  include the proper header file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="6fb8f6860f125fc2b6cd827d67286388b1b224c0c5a51375f659f96379fba900d09428eb8496bfd85e4c3982c8552f1827ac38b7a85f21a3c46dad945514010e" name="sha1collisiondetection-debuginfo" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="20.21"/>
  <changelog author="astieger@suse.com" date="1488283200">- CLI to check for SHA-1 collisions bsc#1026646 - CVE-2005-4900
- initial package (cli only)</changelog>
  <changelog author="astieger@suse.com" date="1491825600">- update to 1.0.3:
  * SIMD code removed
  * performance improvements
- package library
- conflicts with libmd-devel</changelog>
  <changelog author="astieger@suse.com" date="1495454400">- better printing of errors, and allow hashing stdin
  add sha1collisiondetection-1.0.3-io-fixes.patch</changelog>
  <changelog author="tiwai@suse.de" date="1501848000">- Fix include header path to /usr/include/sha1dc/sha1.h as supposed
  by upstream installation
- Remove conflicts with libmd-devel, as we changed the header path</changelog>
  <changelog author="ro@suse.de" date="1517400000">- add sha1collisiondetection-endian_detection.patch
  fix detection of endianness at compile time</changelog>
  <changelog author="ro@suse.de" date="1517400001">- cleaner solution for the endian detection issue:
  include the proper header file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="2c5074f9ff555ccd853849d2b14b7fbd73ab5a38bd30d8e1765f3fc0a670d2422766dad3da0a2ed185cf2ce63a699587cc9122157f4c42c49a1927b0daf425d0" name="sha1collisiondetection-debugsource" arch="s390x">
  <version epoch="0" ver="1.0.3" rel="20.21"/>
  <changelog author="astieger@suse.com" date="1488283200">- CLI to check for SHA-1 collisions bsc#1026646 - CVE-2005-4900
- initial package (cli only)</changelog>
  <changelog author="astieger@suse.com" date="1491825600">- update to 1.0.3:
  * SIMD code removed
  * performance improvements
- package library
- conflicts with libmd-devel</changelog>
  <changelog author="astieger@suse.com" date="1495454400">- better printing of errors, and allow hashing stdin
  add sha1collisiondetection-1.0.3-io-fixes.patch</changelog>
  <changelog author="tiwai@suse.de" date="1501848000">- Fix include header path to /usr/include/sha1dc/sha1.h as supposed
  by upstream installation
- Remove conflicts with libmd-devel, as we changed the header path</changelog>
  <changelog author="ro@suse.de" date="1517400000">- add sha1collisiondetection-endian_detection.patch
  fix detection of endianness at compile time</changelog>
  <changelog author="ro@suse.de" date="1517400001">- cleaner solution for the endian detection issue:
  include the proper header file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
</package>
<package pkgid="b63657db43c99159008125e187ba15614929835b9eed763ea3df3e482ba493fe184bdd1da2b350d3f2f0fecfa8748dce20131af7b8977a6eed4296d5e6e08ba4" name="snallygaster" arch="noarch">
  <version epoch="0" ver="0.0.14" rel="29.4"/>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1602072000">- update to version 0.0.9:
  - Fix composer false positive
  - disable broken python nightly, enable 3.9-dev
  - add http header injection test
  - doc for headerinject
  - check if we document all the tests in TESTS.md
  - fix pyflakes and pyupgrade warnings
  - add wordpress debug.log test
  - document wpdebug
  - add .orig to backupfiles test, created by patch tool
  - dnspython 2.x support, this requires using dns.resolver.resolve if av…
  - codingstyle for backupfiles
- update to version 0.0.8:
  - Test: phpinfo
  - code styling
  - add vb_test.php check
  - fix whitespace error from merge
  - document phpinfo
  - use annotated tags for changelog</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1617710400">- add fix-codestyle.patch from https://github.com/hannob/snallygaster/pull/58 to replace a deprecated function.
  the deprecated function caused pylint to fail which is part of the unittests.
- add testdata and run full tests.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1620993600">- remove the codestyle tests, we are not interested in them, they cause blocking build fails</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1624017600">- Update to version 0.0.10:
  - New test for Wordpress duplicator installer files and directory listings.
  - Move from Travis CI to Github Actions.
  - Fix and silence new pylint warnings.
- remove obsolete fix-codestyle.patch</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1640692800">- update to version 0.0.11:
  - disable python 3.11 tests for now due to pylint/wrapt incompatibility
  - fix pylint warning use-implicit-booleaness-not-comparison
  - add detection of symfony debugging mode on 404 pages
  - support v3 php-cs-fixer format and rename test
  - enable onlinetests in GH actions
  - improve apache server info detection / avoid false positives by adding closing h1 tag
  - remove apache perl status, add documentation for apache-info check
  - update check for apache-info, check for perl-info still need improving
  add check for apache server info and perl-status
  - Readme: add openSUSE package</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1643803200">- update to version 0.0.12:
  - use more f-strings
  - let pyupgrade enforce f-strings and latest python
  - use more f-strings
  - catch all the different ways the HTML parser can fail
  - Remove nargs=1, simplifies code
  - raise version to 0.0.11</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1643803201">- remove unnecessary build dependency pyupgrade. We don't execute this test.
- remove tests irrelevant for us</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1725624000">- run tests with pytest, as setuptools lost its test command</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1744718400">- Update to 0.0.13:
  - License change to 0BSD.
  - Django staticfile.json test (info).
  - Various minor fixes, style improvements, etc.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1757332800">- update to version 0.0.14:
  - Rework 404 error page checks
  Avoid global variable and use @functools.cache instead for code
  simplification.
  Split out checks for django and symfony debugging pages into their
  own tests.
  Use a random, but static url path for 404 checks to allow duplicate
  detection to work.
  Closes: https://github.com/hannob/snallygaster/issues/84
  - silence dlint warnings about lxml
  - Fully replace beautifulsoup with lxml
  beautifulsoup was a constant source of issues, causing
  mutliple warnings to be silenced, regular API changes, etc.
  We now use lxml for HTML parsing, which considerably simplifies
  the code.
  Closes: https://github.com/hannob/snallygaster/issues/87
  Closes: https://github.com/hannob/snallygaster/pull/85
  - Convert wordpress test from beautifulsoup to lxml
  Bug: https://github.com/hannob/snallygaster/issues/87
  - Raise minimum python version (3.7-&gt;3.9) in setup.py and CI</changelog>
</package>
<package pkgid="aee835274d7b573c9ec4b7012d51a761ff82d8c8d8091fbb422add41be4b51d8708ac0747d8c47f7cb6d03765dae8577eb85e93ca370e532961ba78050f68803" name="snallygaster" arch="src">
  <version epoch="0" ver="0.0.14" rel="29.4"/>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1593864000">- initial package for version 0.0.7</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1602072000">- update to version 0.0.9:
  - Fix composer false positive
  - disable broken python nightly, enable 3.9-dev
  - add http header injection test
  - doc for headerinject
  - check if we document all the tests in TESTS.md
  - fix pyflakes and pyupgrade warnings
  - add wordpress debug.log test
  - document wpdebug
  - add .orig to backupfiles test, created by patch tool
  - dnspython 2.x support, this requires using dns.resolver.resolve if av…
  - codingstyle for backupfiles
- update to version 0.0.8:
  - Test: phpinfo
  - code styling
  - add vb_test.php check
  - fix whitespace error from merge
  - document phpinfo
  - use annotated tags for changelog</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1617710400">- add fix-codestyle.patch from https://github.com/hannob/snallygaster/pull/58 to replace a deprecated function.
  the deprecated function caused pylint to fail which is part of the unittests.
- add testdata and run full tests.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1620993600">- remove the codestyle tests, we are not interested in them, they cause blocking build fails</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1624017600">- Update to version 0.0.10:
  - New test for Wordpress duplicator installer files and directory listings.
  - Move from Travis CI to Github Actions.
  - Fix and silence new pylint warnings.
- remove obsolete fix-codestyle.patch</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1640692800">- update to version 0.0.11:
  - disable python 3.11 tests for now due to pylint/wrapt incompatibility
  - fix pylint warning use-implicit-booleaness-not-comparison
  - add detection of symfony debugging mode on 404 pages
  - support v3 php-cs-fixer format and rename test
  - enable onlinetests in GH actions
  - improve apache server info detection / avoid false positives by adding closing h1 tag
  - remove apache perl status, add documentation for apache-info check
  - update check for apache-info, check for perl-info still need improving
  add check for apache server info and perl-status
  - Readme: add openSUSE package</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1643803200">- update to version 0.0.12:
  - use more f-strings
  - let pyupgrade enforce f-strings and latest python
  - use more f-strings
  - catch all the different ways the HTML parser can fail
  - Remove nargs=1, simplifies code
  - raise version to 0.0.11</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1643803201">- remove unnecessary build dependency pyupgrade. We don't execute this test.
- remove tests irrelevant for us</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1725624000">- run tests with pytest, as setuptools lost its test command</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1744718400">- Update to 0.0.13:
  - License change to 0BSD.
  - Django staticfile.json test (info).
  - Various minor fixes, style improvements, etc.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1757332800">- update to version 0.0.14:
  - Rework 404 error page checks
  Avoid global variable and use @functools.cache instead for code
  simplification.
  Split out checks for django and symfony debugging pages into their
  own tests.
  Use a random, but static url path for 404 checks to allow duplicate
  detection to work.
  Closes: https://github.com/hannob/snallygaster/issues/84
  - silence dlint warnings about lxml
  - Fully replace beautifulsoup with lxml
  beautifulsoup was a constant source of issues, causing
  mutliple warnings to be silenced, regular API changes, etc.
  We now use lxml for HTML parsing, which considerably simplifies
  the code.
  Closes: https://github.com/hannob/snallygaster/issues/87
  Closes: https://github.com/hannob/snallygaster/pull/85
  - Convert wordpress test from beautifulsoup to lxml
  Bug: https://github.com/hannob/snallygaster/issues/87
  - Raise minimum python version (3.7-&gt;3.9) in setup.py and CI</changelog>
</package>
<package pkgid="d407728199ff181f2d73be6baa28bb7e9bf144fd83b45b43ebea11aeed21f9a9a7cac114b05f18686dd210f1cbf3b41b2058af300a39f4b113fb88c6c4bcd83a" name="sockdump" arch="noarch">
  <version epoch="0" ver="20231211" rel="4.8"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1733140800">- Initial import of https://github.com/mechpen/sockdump
  commit d40ec77e960d021861220bc14a273c5dcad13160</changelog>
</package>
<package pkgid="4e3abea85a1cae0f9aac3f3be62d747770f3ab233b64a5bd85d9669cfd7492d90d9c4a63d710e1d37f7b17abbf477538c860b18a28a4bb07afec76a792464b49" name="sockdump" arch="src">
  <version epoch="0" ver="20231211" rel="4.8"/>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1733140800">- Initial import of https://github.com/mechpen/sockdump
  commit d40ec77e960d021861220bc14a273c5dcad13160</changelog>
</package>
<package pkgid="69b3c3ad2ef3e601599512e4d35a7e6a457f04c84fc69ec8078ca28ab313055555c895f8b19fd6d0c9bff109609691ea514ec5d4fdbd29c4997253d80a48dc97" name="softhsm" arch="s390x">
  <version epoch="0" ver="2.6.1+git.1732869438.f7883c2" rel="40.21"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1584446400">- Update to version 2.6.0
  Changes:
  * Issue #493: Upgrade to Botan 2.
  * Issue #530: Update appveyor build.
  * Issue #438: Detect crypto algorithms by default.
  * Issue #455: Provide a new configuration option to allow enabling and
    disabling various mechanisms (slots.mechanisms in the softhsm2.conf).
  * Issue #479: Increase SQLite busy timeout from 15 seconds to 3 minutes.
  * Issue #513: Add configuration option to reset state on fork closing all
    sessions rather than keeping all sessions open in duplicate process.
  * Issue #500: C_WaitForSlotEvent implementation.
  * Issue #445: Add wrap support with CKM_AES_CBC.
  Bugfixes:
  * Issue #418: Set fields to NULL to avoid double free.
  * Issue #423: ENGINE_load_rdrand is not supported with older openssl.
  * Issue #429: Updated prerequisite to build from repository.
  * Issue #434: Fix build issues with CMake.
  * Issue #435: Fix botan build without EDDSA.
  * Issue #442: Release resources from OSSLEVPSymmetricAlgorithm.
  * Issue #449/#502: Do not copy zero sized buffer avoid null pointer reference.
  * Issue #464: Race condition with multiple threads closing last session and
    opening a newer sessions.
  * Issue #452: Fixes to automake build fir undefined macros.
  * Issue #462: User PIN count wrongly calculated.
  * Issue #516: Fix memory leak in OSSLCryptoFactory.
  * Issue #494: Allow null pointers as arguments when count is zero.
  * Issue #518: Sporadic problem in closing sessions because of lookup of
    object without prior locking.
  * Issue #506: Check key type for C_EncryptInit and C_DecryptInit.
  * Issue #526: Adjust EDDSA code to return valid EC_PARAMS.
  * Issue #452: Autogen failure on undefined macro AC_MSG_ERROR.
  * Issue #527: Fixed some build errors for GCC 10.
  * Issue #470: Null pointer arguments validation for C_EncryptFinal, etc.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1588248000">- Update to version 2.6.1
  * Issue #542: Support Ed448/X448 for OpenSSL
  * Issue #538: Improved warning and compilation issues for GCC10</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- switched URL to https</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1713182400">- Rebuild with inspiration (and patches) from the Fedora package.
- Remove obsolete patch softhsm-rsakeys.patch
- Add Fedora patches (comments in SPEC indicate their true origin):
  - softhsm-openssl3-tests.patch
  - softhsm-prevent-global-deleted-objects-access.patch
  - softhsm-2.6.1-rh1831086-exit.patch
  - softhsm-2.6.1-uninitialized.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715083200">- Add creation of ods user.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715428800">- We actually don't need any hard Requires for OpenSSL at all
  (and yes, rpmlint is right, we shouldn't use it at all).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716292800">- Use correct SOURCE for
  /usr/share/p11-kit/modules/softhsm.module (fix bsc#1224356).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1726488000">- Update to version 2.6.1+git.1700562855.913e7bf:
  * fix typo
  * Move cmake modules into own/clearer directory
  * avoid unnecessary check for sqlite3 binary
  * Fix memory leak in SoftHSM::UnwrapKeySym.
  * doc add CMAKE build for windows
  * fix check minimal botan version
  * fix db backend tools compilation errors
  * feat enable DB backend for windows
  * fix compilation warnings
  * fix cmake minimal version (CMP0054)
  * feat make test output more verbose
  * feat enable openssl build
  * feat make ctest ouput more verbose
  * feat disable openssl backend
  * fix cppunit handlemanager
  * fix remove getopt from cache
  * fix cppunit path
  * fix cmake minimal version 3.20
  * fix unreferenced formal parameter warning
  * fix missing cppunit include
  * fix cppUnit path
  * fix remove windows getopt component under GNU license
  * fix appveyor build script
  * Update .appveyor.yml
  * fix appveyor build script
  * fix appveyor build script
  * fix update vcpkg build tool
  * Update .appveyor.yml
  * fix update appveyor vcpkg build tool
  * fix update appveyor vcpkg build tool
  * fix cmake MSVC flags
  * fix vcpkg options
  * fix compile options
  * feat add console output for test executable
  * feat add windows compile options
  * feat make tests more verbose
  * fix disable ECB test
  * fix build script for CppUnit
  * fix disable ECB Tests
  * fix enable appveyor cache on error
  * fix enable appveyor cache on error
  * fix cppunit vcpkg autodetect
  * fix remove cppunit path
  * fix enable post build tests
  * fix windows duplicate define
  * fix windows execution
  * feat add a message if cppunit library is missing
  * fix add Softhsm2-negative-mech.conf for p11test
  * fix cmake windows static lib
  * fix Botan ECB mode dropped
  * fix set warning level to W4 for softhsm test binaries
  * fix set warning level to W4 for softhsm libraries
  * feat change compile crypto backend order
  * fix add cmake windows compatibility files
  * fix DEFAULT_UMASK missing
  * fix set windows compile warning level W4
  * fix set windows compiler warning W4
  * fix ECC &amp; GOST are now disabled by default
  * Fix issue 585 by resetting en/decrypt op on input validation
  * Enforce attributes becoming read-only once set to CK_TRUE on CKA_WRAP_WITH_TRUSTED and CKA_SENSITIVE
- Remove upstreamed patches:
  * softhsm-2.6.1-rh1831086-exit.patch
  * softhsm-2.6.1-uninitialized.patch</changelog>
  <changelog author="mcepl@cepl.eu" date="1732881600">- Update to version 2.6.1+git.1732869438.f7883c2:
  * init
  * add libtool for macos
  * upgrade to macos-14
  * build on selected branches push only
  * tweek
  * Minor README.md fixes
  * Add macOS to CI
  * Build and run tests in CI for Windows
  * Add GitHub Actions CI
- Update softhsm2-pk11install.c from
  https://github.com/dogtagpki/coolkey/blob/master/src/install/pk11install.c</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1735473600">- readd %sysusers_requires, as otherwise the %pre script fails to install</changelog>
</package>
<package pkgid="494d6459587a0a8a6c1f6ecbcb4e17a8edea4d6d6d609044b6251694fcd51ca6ab04a28640e186f95534d1723f13d77af733d3a3cd32b6e84977e4b2cd40ff1f" name="softhsm" arch="src">
  <version epoch="0" ver="2.6.1+git.1732869438.f7883c2" rel="40.21"/>
  <changelog author="pwouters@redhat.com" date="1383480000">- Updated to 1.3.5 (rhbz#987721)</changelog>
  <changelog author="pwouters@redhat.com" date="1397822400">- Updated to 1.3.6 (rhbz#1070196)
- Provide a p11-kit module file (rhbz#1085327)</changelog>
  <changelog author="pwouters@redhat.com" date="1412078400">- Add support for CKM_RSA_PKCS_OAEP key un/wrapping [Petr Spacek]
- Use OpenSSL EVP interface for AES key wrapping [Petr Spacek]
- Fix softhsm2-pk11install buid and post call
- Do not use --with-objectstore-backend-db (causes issues on i686)
- Change install directory to /usr/lib*/pkcs11/
- Install pkcs11 module file
- Use official upstream tar ball
- Create ods user to own softhsm/token files
- Enable migration tools (for softhsm-v1 installs)
- Add softlink for softhsm-v1 .so (needed for opendnssec's conf.xml)
- Require p11-kit, nss-tools, for SoftHSM PKCS #11 Module file
- Copy pk11install.c from coolkey package
- Enable hardened build
- Add upstream official source url</changelog>
  <changelog author="hguo@suse.com" date="1431086400">- Source extracted from Fedora 21 release SRPM with minor modifications.</changelog>
  <changelog author="meissner@suse.com" date="1444305600">- softhsm-rsakeys.patch: do not test odd bit RSA keys, this breaks
  with the FIPS enabled openssl from leap/sle12, as thats rounds
  up the keylength to the next even number. bsc#949492</changelog>
  <changelog author="meissner@suse.com" date="1494158400">- softhsm-newcppunit.patch: new cppunit uses pkg-config now, not
  cppunit-config</changelog>
  <changelog author="mardnh@gmx.de" date="1513512000">- Update to version 2.3.0
  * Upgraded to PKCS#11 v2.40.
  * Minor changes to some return values.
  * Added CKA_DESTROYABLE to all objects. Used by C_DestroyObject().
  * Added CKA_PUBLIC_KEY_INFO to certificates, private, and public key
    objects. Will be accepted from application, but SoftHSM will
    currently not calculate it.
  * Support for CKM_AES_CTR.
  * Add unit tests for SessionManager.
  * C_DigestKey returns CKR_KEY_INDIGESTIBLE when key
    attribute CKA_EXTRACTABLE = false. Whitelist SHA algorithms to allow
    C_DigestKey in this case.
  * Show slot id after initialization.
  * Run AppVeyor (Windows CI) for each PR and merge.
  * Set CKA_DECRYPT/CKA_ENCRYPT flags on key import to true.
  * Add support for libeaycompat lib for FIPS on Windows.
  * Support importing ECDSA P-521 in softhsm-util.
  * Support for Botan 2.0.
  * Editorial changes from Mountain Lion to Sierra.
  * More detailed error messages when initializing SoftHSM.
  * Support for LibreSSL.
  * Change to enable builds and reports on new Jenkinks environment.
  * Detect cppunit in autoconf.
  * CKO_CERTIFICATE and CKO_PUBLIC_KEY now defaults to CKA_PRIVATE=false.
  * Update README with information about logging.
  * Adjust log levels for failing to enumerate object store.
  * Better handling of CRYPTO_set_locking_callback() for OpenSSL.
  * Fix deriving shared secret with ECC.
  * HMAC with sizes less than L bytes is strongly discouraged.
    Set a lower bound equal to L bytes in ulMinKeySize and check it when
    initializing the operation.
  * Fix test of p11 shared library.
  * Minor fix of 'EVP_CipherFinal_ex'.
  * Fix build with cppunit.
  * Export PKCS#11 symbols from the library.
  * Zero pad key to fit the block in CKM_AES_KEY_WRAP.
  * Detecting CppUnit when using Macports.
- Update to version 2.2.0
  * Delete a token using softhsm2-util.
  * Change access mode bits for /var/lib/softhsm/tokens/
    to 1777. All users can now create tokens, but only access their own.
  * Reinitializing a token will now keep the token, but all
    token objects are deleted, the user PIN is removed and the token
    label is updated.
  * Support for OpenSSL 1.1.0.
  * Calling C_GetSlotList with NULL_PTR will make sure that
    there is always a slot with an uninitialized token available.
  * The token serial number will be used when setting the slot
    number. The serial number is set after the token has been initialized.
  * Update the command utils to use the token label or serial
    to find the token and its slot number.
  * Possibility to test other PKCS#11 implementations with the CppUnit test.
  * Mark public key as non private by default.
  * Install p11-kit module, to disable use --disable-p11-kit.
  * Add windows continuous integration build.
  * Missing new source file and test configuration in the
    Windows build project.
  * ECDSA P-521 support for OpenSSL and better test coverage.
  * Fix segmentation faults in loadLibrary function.
  * Crash on module unload with OpenSSL.
  * C++11 not detected.
  * API changes in Botan 1.11.27.
  * Fix include guard to check WITH_FIPS.
  * p11test fails on 32-bit systems.
  * Build warning about "converting a string constant".
  * Fix C++11 check to look for unique_ptr.
- Update to version 2.1.0
  * Improved guide and build scripts for Windows.
  * The password prompt in softhsm2-util can now be
    interrupted (ctrl-c).
  * Add slots.removable config option.
  * Prioritize the return values in C_GetAttributeValue.
  * Handle the CKA_CHECK_VALUE correctly for certificates
    and symmetric key objects.
  * Not possible to create certificate objects containing
    CKA_CERTIFICATE_CATEGORY, CKA_NAME_HASH_ALGORITHM, or
    CKA_JAVA_MIDP_SECURITY_DOMAIN.
  * Do not attempt decryption of empty byte strings.
  * Minor changes after a PVS-Studio code analysis, and
    C_EncryptUpdate crash if no ciphered data is produced.
  * One-byte buffer overflow in call to EVP_DecryptUpdate.
  * Problem while closing library that is initialized but
    improperly finalized.
  * Adjust return values for the template parsing.
  * C_DeriveKey() error with leading zero bytes.
  * CKA_NEVER_EXTRACTABLE set to CK_FALSE on objects
    created with C_CreateObject.
  * Stop discarding the global OpenSSL libcrypto state.
- Drop not longer needed patches (fixed upstream):
  * softhsm-v2.0.0b1-aes-key-wrap.patch
  * softhsm-v2.0.0b1-ckm-rsa-pkcs-oaep-key-wrap.patch
  * softhsm-newcppunit.patch
- Rebase patches:
  * softhsm-rsakeys.patch
- Fix URL</changelog>
  <changelog author="mardnh@gmx.de" date="1519732800">- Update to version 2.4.0
  * Support PKCS#8 for GOST.
  * Support for CKA_ALLOWED_MECHANISMS.
  * Support CKA_ALWAYS_AUTHENTICATE for private key objects.
  * Support for CKM_DES3_CMAC and CKM_AES_CMAC.
  * Support for CKM_AES_GCM.
  * Document that initialized tokens will be reassigned to another
    slot (based on the token serial number).
  * Support for CKM_RSA_PKCS_PSS.
  * Import AES keys with softhsm2-util.
  * softhsm2-util will check the configuration and report any
    issues before loading the PKCS#11 library.</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1537790400">- Update to version 2.5.0
  Updates:
  * Issue #323: Support for EDDSA with vendor defined mechanisms.
  * Issue #362: CMake Build System Support for SoftHSM.
  * Issue #368: Support migrating 32-bit SoftHSMv1 DB on 64-bit system (LP64).
  * Issue #385: Default is not to build EDDSA since it has not been released in OpenSSL.
  * Issue #387: Windows: Add VS2017 detection to Configure.py.
  * Issue #412: Replace PKCS11 headers with a version from p11-kit.
  Bugfixes:
  * Issue #366: Support cross-compilation.
  * Issue #377: Duplicate symbol error with custom p11test.
  * Issue #386: Use RDRAND in OpenSSL if that engine is available.
  * Issue #388: Update DBTests.cpp to fix x86 test failure.
  * Issue #393: Not setting CKA_PUBLIC_KEY_INFO correctly.
  * Issue #401: Wrong key and keyserver mentioned in installation documentation.
  * Issue #408: Remove mutex callbacks after C_Finalize().</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1558353600">- Add the missing zlib requirement.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1584446400">- Update to version 2.6.0
  Changes:
  * Issue #493: Upgrade to Botan 2.
  * Issue #530: Update appveyor build.
  * Issue #438: Detect crypto algorithms by default.
  * Issue #455: Provide a new configuration option to allow enabling and
    disabling various mechanisms (slots.mechanisms in the softhsm2.conf).
  * Issue #479: Increase SQLite busy timeout from 15 seconds to 3 minutes.
  * Issue #513: Add configuration option to reset state on fork closing all
    sessions rather than keeping all sessions open in duplicate process.
  * Issue #500: C_WaitForSlotEvent implementation.
  * Issue #445: Add wrap support with CKM_AES_CBC.
  Bugfixes:
  * Issue #418: Set fields to NULL to avoid double free.
  * Issue #423: ENGINE_load_rdrand is not supported with older openssl.
  * Issue #429: Updated prerequisite to build from repository.
  * Issue #434: Fix build issues with CMake.
  * Issue #435: Fix botan build without EDDSA.
  * Issue #442: Release resources from OSSLEVPSymmetricAlgorithm.
  * Issue #449/#502: Do not copy zero sized buffer avoid null pointer reference.
  * Issue #464: Race condition with multiple threads closing last session and
    opening a newer sessions.
  * Issue #452: Fixes to automake build fir undefined macros.
  * Issue #462: User PIN count wrongly calculated.
  * Issue #516: Fix memory leak in OSSLCryptoFactory.
  * Issue #494: Allow null pointers as arguments when count is zero.
  * Issue #518: Sporadic problem in closing sessions because of lookup of
    object without prior locking.
  * Issue #506: Check key type for C_EncryptInit and C_DecryptInit.
  * Issue #526: Adjust EDDSA code to return valid EC_PARAMS.
  * Issue #452: Autogen failure on undefined macro AC_MSG_ERROR.
  * Issue #527: Fixed some build errors for GCC 10.
  * Issue #470: Null pointer arguments validation for C_EncryptFinal, etc.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1588248000">- Update to version 2.6.1
  * Issue #542: Support Ed448/X448 for OpenSSL
  * Issue #538: Improved warning and compilation issues for GCC10</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- switched URL to https</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1713182400">- Rebuild with inspiration (and patches) from the Fedora package.
- Remove obsolete patch softhsm-rsakeys.patch
- Add Fedora patches (comments in SPEC indicate their true origin):
  - softhsm-openssl3-tests.patch
  - softhsm-prevent-global-deleted-objects-access.patch
  - softhsm-2.6.1-rh1831086-exit.patch
  - softhsm-2.6.1-uninitialized.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715083200">- Add creation of ods user.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715428800">- We actually don't need any hard Requires for OpenSSL at all
  (and yes, rpmlint is right, we shouldn't use it at all).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716292800">- Use correct SOURCE for
  /usr/share/p11-kit/modules/softhsm.module (fix bsc#1224356).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1726488000">- Update to version 2.6.1+git.1700562855.913e7bf:
  * fix typo
  * Move cmake modules into own/clearer directory
  * avoid unnecessary check for sqlite3 binary
  * Fix memory leak in SoftHSM::UnwrapKeySym.
  * doc add CMAKE build for windows
  * fix check minimal botan version
  * fix db backend tools compilation errors
  * feat enable DB backend for windows
  * fix compilation warnings
  * fix cmake minimal version (CMP0054)
  * feat make test output more verbose
  * feat enable openssl build
  * feat make ctest ouput more verbose
  * feat disable openssl backend
  * fix cppunit handlemanager
  * fix remove getopt from cache
  * fix cppunit path
  * fix cmake minimal version 3.20
  * fix unreferenced formal parameter warning
  * fix missing cppunit include
  * fix cppUnit path
  * fix remove windows getopt component under GNU license
  * fix appveyor build script
  * Update .appveyor.yml
  * fix appveyor build script
  * fix appveyor build script
  * fix update vcpkg build tool
  * Update .appveyor.yml
  * fix update appveyor vcpkg build tool
  * fix update appveyor vcpkg build tool
  * fix cmake MSVC flags
  * fix vcpkg options
  * fix compile options
  * feat add console output for test executable
  * feat add windows compile options
  * feat make tests more verbose
  * fix disable ECB test
  * fix build script for CppUnit
  * fix disable ECB Tests
  * fix enable appveyor cache on error
  * fix enable appveyor cache on error
  * fix cppunit vcpkg autodetect
  * fix remove cppunit path
  * fix enable post build tests
  * fix windows duplicate define
  * fix windows execution
  * feat add a message if cppunit library is missing
  * fix add Softhsm2-negative-mech.conf for p11test
  * fix cmake windows static lib
  * fix Botan ECB mode dropped
  * fix set warning level to W4 for softhsm test binaries
  * fix set warning level to W4 for softhsm libraries
  * feat change compile crypto backend order
  * fix add cmake windows compatibility files
  * fix DEFAULT_UMASK missing
  * fix set windows compile warning level W4
  * fix set windows compiler warning W4
  * fix ECC &amp; GOST are now disabled by default
  * Fix issue 585 by resetting en/decrypt op on input validation
  * Enforce attributes becoming read-only once set to CK_TRUE on CKA_WRAP_WITH_TRUSTED and CKA_SENSITIVE
- Remove upstreamed patches:
  * softhsm-2.6.1-rh1831086-exit.patch
  * softhsm-2.6.1-uninitialized.patch</changelog>
  <changelog author="mcepl@cepl.eu" date="1732881600">- Update to version 2.6.1+git.1732869438.f7883c2:
  * init
  * add libtool for macos
  * upgrade to macos-14
  * build on selected branches push only
  * tweek
  * Minor README.md fixes
  * Add macOS to CI
  * Build and run tests in CI for Windows
  * Add GitHub Actions CI
- Update softhsm2-pk11install.c from
  https://github.com/dogtagpki/coolkey/blob/master/src/install/pk11install.c</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1735473600">- readd %sysusers_requires, as otherwise the %pre script fails to install</changelog>
</package>
<package pkgid="cf7d48b717b38f26353c018ef86d0ba78e21789cc41619fc0429029d7d8615f026189322be809d51a605133cb78d42d4a1bd4a15ba56365f0de1b88389810547" name="softhsm-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.1+git.1732869438.f7883c2" rel="40.21"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1584446400">- Update to version 2.6.0
  Changes:
  * Issue #493: Upgrade to Botan 2.
  * Issue #530: Update appveyor build.
  * Issue #438: Detect crypto algorithms by default.
  * Issue #455: Provide a new configuration option to allow enabling and
    disabling various mechanisms (slots.mechanisms in the softhsm2.conf).
  * Issue #479: Increase SQLite busy timeout from 15 seconds to 3 minutes.
  * Issue #513: Add configuration option to reset state on fork closing all
    sessions rather than keeping all sessions open in duplicate process.
  * Issue #500: C_WaitForSlotEvent implementation.
  * Issue #445: Add wrap support with CKM_AES_CBC.
  Bugfixes:
  * Issue #418: Set fields to NULL to avoid double free.
  * Issue #423: ENGINE_load_rdrand is not supported with older openssl.
  * Issue #429: Updated prerequisite to build from repository.
  * Issue #434: Fix build issues with CMake.
  * Issue #435: Fix botan build without EDDSA.
  * Issue #442: Release resources from OSSLEVPSymmetricAlgorithm.
  * Issue #449/#502: Do not copy zero sized buffer avoid null pointer reference.
  * Issue #464: Race condition with multiple threads closing last session and
    opening a newer sessions.
  * Issue #452: Fixes to automake build fir undefined macros.
  * Issue #462: User PIN count wrongly calculated.
  * Issue #516: Fix memory leak in OSSLCryptoFactory.
  * Issue #494: Allow null pointers as arguments when count is zero.
  * Issue #518: Sporadic problem in closing sessions because of lookup of
    object without prior locking.
  * Issue #506: Check key type for C_EncryptInit and C_DecryptInit.
  * Issue #526: Adjust EDDSA code to return valid EC_PARAMS.
  * Issue #452: Autogen failure on undefined macro AC_MSG_ERROR.
  * Issue #527: Fixed some build errors for GCC 10.
  * Issue #470: Null pointer arguments validation for C_EncryptFinal, etc.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1588248000">- Update to version 2.6.1
  * Issue #542: Support Ed448/X448 for OpenSSL
  * Issue #538: Improved warning and compilation issues for GCC10</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- switched URL to https</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1713182400">- Rebuild with inspiration (and patches) from the Fedora package.
- Remove obsolete patch softhsm-rsakeys.patch
- Add Fedora patches (comments in SPEC indicate their true origin):
  - softhsm-openssl3-tests.patch
  - softhsm-prevent-global-deleted-objects-access.patch
  - softhsm-2.6.1-rh1831086-exit.patch
  - softhsm-2.6.1-uninitialized.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715083200">- Add creation of ods user.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715428800">- We actually don't need any hard Requires for OpenSSL at all
  (and yes, rpmlint is right, we shouldn't use it at all).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716292800">- Use correct SOURCE for
  /usr/share/p11-kit/modules/softhsm.module (fix bsc#1224356).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1726488000">- Update to version 2.6.1+git.1700562855.913e7bf:
  * fix typo
  * Move cmake modules into own/clearer directory
  * avoid unnecessary check for sqlite3 binary
  * Fix memory leak in SoftHSM::UnwrapKeySym.
  * doc add CMAKE build for windows
  * fix check minimal botan version
  * fix db backend tools compilation errors
  * feat enable DB backend for windows
  * fix compilation warnings
  * fix cmake minimal version (CMP0054)
  * feat make test output more verbose
  * feat enable openssl build
  * feat make ctest ouput more verbose
  * feat disable openssl backend
  * fix cppunit handlemanager
  * fix remove getopt from cache
  * fix cppunit path
  * fix cmake minimal version 3.20
  * fix unreferenced formal parameter warning
  * fix missing cppunit include
  * fix cppUnit path
  * fix remove windows getopt component under GNU license
  * fix appveyor build script
  * Update .appveyor.yml
  * fix appveyor build script
  * fix appveyor build script
  * fix update vcpkg build tool
  * Update .appveyor.yml
  * fix update appveyor vcpkg build tool
  * fix update appveyor vcpkg build tool
  * fix cmake MSVC flags
  * fix vcpkg options
  * fix compile options
  * feat add console output for test executable
  * feat add windows compile options
  * feat make tests more verbose
  * fix disable ECB test
  * fix build script for CppUnit
  * fix disable ECB Tests
  * fix enable appveyor cache on error
  * fix enable appveyor cache on error
  * fix cppunit vcpkg autodetect
  * fix remove cppunit path
  * fix enable post build tests
  * fix windows duplicate define
  * fix windows execution
  * feat add a message if cppunit library is missing
  * fix add Softhsm2-negative-mech.conf for p11test
  * fix cmake windows static lib
  * fix Botan ECB mode dropped
  * fix set warning level to W4 for softhsm test binaries
  * fix set warning level to W4 for softhsm libraries
  * feat change compile crypto backend order
  * fix add cmake windows compatibility files
  * fix DEFAULT_UMASK missing
  * fix set windows compile warning level W4
  * fix set windows compiler warning W4
  * fix ECC &amp; GOST are now disabled by default
  * Fix issue 585 by resetting en/decrypt op on input validation
  * Enforce attributes becoming read-only once set to CK_TRUE on CKA_WRAP_WITH_TRUSTED and CKA_SENSITIVE
- Remove upstreamed patches:
  * softhsm-2.6.1-rh1831086-exit.patch
  * softhsm-2.6.1-uninitialized.patch</changelog>
  <changelog author="mcepl@cepl.eu" date="1732881600">- Update to version 2.6.1+git.1732869438.f7883c2:
  * init
  * add libtool for macos
  * upgrade to macos-14
  * build on selected branches push only
  * tweek
  * Minor README.md fixes
  * Add macOS to CI
  * Build and run tests in CI for Windows
  * Add GitHub Actions CI
- Update softhsm2-pk11install.c from
  https://github.com/dogtagpki/coolkey/blob/master/src/install/pk11install.c</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1735473600">- readd %sysusers_requires, as otherwise the %pre script fails to install</changelog>
</package>
<package pkgid="c9d23ba13c5e139678e76117f32b7a616f89817b27eb626fec1ff66fa7d4f645195b57f938743e522c53844bcbaf89ea28fe9b8361bdaf23d1de7b07f94af442" name="softhsm-debugsource" arch="s390x">
  <version epoch="0" ver="2.6.1+git.1732869438.f7883c2" rel="40.21"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1584446400">- Update to version 2.6.0
  Changes:
  * Issue #493: Upgrade to Botan 2.
  * Issue #530: Update appveyor build.
  * Issue #438: Detect crypto algorithms by default.
  * Issue #455: Provide a new configuration option to allow enabling and
    disabling various mechanisms (slots.mechanisms in the softhsm2.conf).
  * Issue #479: Increase SQLite busy timeout from 15 seconds to 3 minutes.
  * Issue #513: Add configuration option to reset state on fork closing all
    sessions rather than keeping all sessions open in duplicate process.
  * Issue #500: C_WaitForSlotEvent implementation.
  * Issue #445: Add wrap support with CKM_AES_CBC.
  Bugfixes:
  * Issue #418: Set fields to NULL to avoid double free.
  * Issue #423: ENGINE_load_rdrand is not supported with older openssl.
  * Issue #429: Updated prerequisite to build from repository.
  * Issue #434: Fix build issues with CMake.
  * Issue #435: Fix botan build without EDDSA.
  * Issue #442: Release resources from OSSLEVPSymmetricAlgorithm.
  * Issue #449/#502: Do not copy zero sized buffer avoid null pointer reference.
  * Issue #464: Race condition with multiple threads closing last session and
    opening a newer sessions.
  * Issue #452: Fixes to automake build fir undefined macros.
  * Issue #462: User PIN count wrongly calculated.
  * Issue #516: Fix memory leak in OSSLCryptoFactory.
  * Issue #494: Allow null pointers as arguments when count is zero.
  * Issue #518: Sporadic problem in closing sessions because of lookup of
    object without prior locking.
  * Issue #506: Check key type for C_EncryptInit and C_DecryptInit.
  * Issue #526: Adjust EDDSA code to return valid EC_PARAMS.
  * Issue #452: Autogen failure on undefined macro AC_MSG_ERROR.
  * Issue #527: Fixed some build errors for GCC 10.
  * Issue #470: Null pointer arguments validation for C_EncryptFinal, etc.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1588248000">- Update to version 2.6.1
  * Issue #542: Support Ed448/X448 for OpenSSL
  * Issue #538: Improved warning and compilation issues for GCC10</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- switched URL to https</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1713182400">- Rebuild with inspiration (and patches) from the Fedora package.
- Remove obsolete patch softhsm-rsakeys.patch
- Add Fedora patches (comments in SPEC indicate their true origin):
  - softhsm-openssl3-tests.patch
  - softhsm-prevent-global-deleted-objects-access.patch
  - softhsm-2.6.1-rh1831086-exit.patch
  - softhsm-2.6.1-uninitialized.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715083200">- Add creation of ods user.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715428800">- We actually don't need any hard Requires for OpenSSL at all
  (and yes, rpmlint is right, we shouldn't use it at all).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716292800">- Use correct SOURCE for
  /usr/share/p11-kit/modules/softhsm.module (fix bsc#1224356).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1726488000">- Update to version 2.6.1+git.1700562855.913e7bf:
  * fix typo
  * Move cmake modules into own/clearer directory
  * avoid unnecessary check for sqlite3 binary
  * Fix memory leak in SoftHSM::UnwrapKeySym.
  * doc add CMAKE build for windows
  * fix check minimal botan version
  * fix db backend tools compilation errors
  * feat enable DB backend for windows
  * fix compilation warnings
  * fix cmake minimal version (CMP0054)
  * feat make test output more verbose
  * feat enable openssl build
  * feat make ctest ouput more verbose
  * feat disable openssl backend
  * fix cppunit handlemanager
  * fix remove getopt from cache
  * fix cppunit path
  * fix cmake minimal version 3.20
  * fix unreferenced formal parameter warning
  * fix missing cppunit include
  * fix cppUnit path
  * fix remove windows getopt component under GNU license
  * fix appveyor build script
  * Update .appveyor.yml
  * fix appveyor build script
  * fix appveyor build script
  * fix update vcpkg build tool
  * Update .appveyor.yml
  * fix update appveyor vcpkg build tool
  * fix update appveyor vcpkg build tool
  * fix cmake MSVC flags
  * fix vcpkg options
  * fix compile options
  * feat add console output for test executable
  * feat add windows compile options
  * feat make tests more verbose
  * fix disable ECB test
  * fix build script for CppUnit
  * fix disable ECB Tests
  * fix enable appveyor cache on error
  * fix enable appveyor cache on error
  * fix cppunit vcpkg autodetect
  * fix remove cppunit path
  * fix enable post build tests
  * fix windows duplicate define
  * fix windows execution
  * feat add a message if cppunit library is missing
  * fix add Softhsm2-negative-mech.conf for p11test
  * fix cmake windows static lib
  * fix Botan ECB mode dropped
  * fix set warning level to W4 for softhsm test binaries
  * fix set warning level to W4 for softhsm libraries
  * feat change compile crypto backend order
  * fix add cmake windows compatibility files
  * fix DEFAULT_UMASK missing
  * fix set windows compile warning level W4
  * fix set windows compiler warning W4
  * fix ECC &amp; GOST are now disabled by default
  * Fix issue 585 by resetting en/decrypt op on input validation
  * Enforce attributes becoming read-only once set to CK_TRUE on CKA_WRAP_WITH_TRUSTED and CKA_SENSITIVE
- Remove upstreamed patches:
  * softhsm-2.6.1-rh1831086-exit.patch
  * softhsm-2.6.1-uninitialized.patch</changelog>
  <changelog author="mcepl@cepl.eu" date="1732881600">- Update to version 2.6.1+git.1732869438.f7883c2:
  * init
  * add libtool for macos
  * upgrade to macos-14
  * build on selected branches push only
  * tweek
  * Minor README.md fixes
  * Add macOS to CI
  * Build and run tests in CI for Windows
  * Add GitHub Actions CI
- Update softhsm2-pk11install.c from
  https://github.com/dogtagpki/coolkey/blob/master/src/install/pk11install.c</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1735473600">- readd %sysusers_requires, as otherwise the %pre script fails to install</changelog>
</package>
<package pkgid="223f2664dbd79915ca8e4d5fb6a458738d998776eda4f21cff258e820c067d42e6587bc8a78ea329589bdcd68f5edf66724f09b61fc10051d7865602f7b80a1f" name="softhsm-devel" arch="s390x">
  <version epoch="0" ver="2.6.1+git.1732869438.f7883c2" rel="40.21"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1584446400">- Update to version 2.6.0
  Changes:
  * Issue #493: Upgrade to Botan 2.
  * Issue #530: Update appveyor build.
  * Issue #438: Detect crypto algorithms by default.
  * Issue #455: Provide a new configuration option to allow enabling and
    disabling various mechanisms (slots.mechanisms in the softhsm2.conf).
  * Issue #479: Increase SQLite busy timeout from 15 seconds to 3 minutes.
  * Issue #513: Add configuration option to reset state on fork closing all
    sessions rather than keeping all sessions open in duplicate process.
  * Issue #500: C_WaitForSlotEvent implementation.
  * Issue #445: Add wrap support with CKM_AES_CBC.
  Bugfixes:
  * Issue #418: Set fields to NULL to avoid double free.
  * Issue #423: ENGINE_load_rdrand is not supported with older openssl.
  * Issue #429: Updated prerequisite to build from repository.
  * Issue #434: Fix build issues with CMake.
  * Issue #435: Fix botan build without EDDSA.
  * Issue #442: Release resources from OSSLEVPSymmetricAlgorithm.
  * Issue #449/#502: Do not copy zero sized buffer avoid null pointer reference.
  * Issue #464: Race condition with multiple threads closing last session and
    opening a newer sessions.
  * Issue #452: Fixes to automake build fir undefined macros.
  * Issue #462: User PIN count wrongly calculated.
  * Issue #516: Fix memory leak in OSSLCryptoFactory.
  * Issue #494: Allow null pointers as arguments when count is zero.
  * Issue #518: Sporadic problem in closing sessions because of lookup of
    object without prior locking.
  * Issue #506: Check key type for C_EncryptInit and C_DecryptInit.
  * Issue #526: Adjust EDDSA code to return valid EC_PARAMS.
  * Issue #452: Autogen failure on undefined macro AC_MSG_ERROR.
  * Issue #527: Fixed some build errors for GCC 10.
  * Issue #470: Null pointer arguments validation for C_EncryptFinal, etc.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1588248000">- Update to version 2.6.1
  * Issue #542: Support Ed448/X448 for OpenSSL
  * Issue #538: Improved warning and compilation issues for GCC10</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- switched URL to https</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1713182400">- Rebuild with inspiration (and patches) from the Fedora package.
- Remove obsolete patch softhsm-rsakeys.patch
- Add Fedora patches (comments in SPEC indicate their true origin):
  - softhsm-openssl3-tests.patch
  - softhsm-prevent-global-deleted-objects-access.patch
  - softhsm-2.6.1-rh1831086-exit.patch
  - softhsm-2.6.1-uninitialized.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715083200">- Add creation of ods user.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1715428800">- We actually don't need any hard Requires for OpenSSL at all
  (and yes, rpmlint is right, we shouldn't use it at all).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1716292800">- Use correct SOURCE for
  /usr/share/p11-kit/modules/softhsm.module (fix bsc#1224356).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1726488000">- Update to version 2.6.1+git.1700562855.913e7bf:
  * fix typo
  * Move cmake modules into own/clearer directory
  * avoid unnecessary check for sqlite3 binary
  * Fix memory leak in SoftHSM::UnwrapKeySym.
  * doc add CMAKE build for windows
  * fix check minimal botan version
  * fix db backend tools compilation errors
  * feat enable DB backend for windows
  * fix compilation warnings
  * fix cmake minimal version (CMP0054)
  * feat make test output more verbose
  * feat enable openssl build
  * feat make ctest ouput more verbose
  * feat disable openssl backend
  * fix cppunit handlemanager
  * fix remove getopt from cache
  * fix cppunit path
  * fix cmake minimal version 3.20
  * fix unreferenced formal parameter warning
  * fix missing cppunit include
  * fix cppUnit path
  * fix remove windows getopt component under GNU license
  * fix appveyor build script
  * Update .appveyor.yml
  * fix appveyor build script
  * fix appveyor build script
  * fix update vcpkg build tool
  * Update .appveyor.yml
  * fix update appveyor vcpkg build tool
  * fix update appveyor vcpkg build tool
  * fix cmake MSVC flags
  * fix vcpkg options
  * fix compile options
  * feat add console output for test executable
  * feat add windows compile options
  * feat make tests more verbose
  * fix disable ECB test
  * fix build script for CppUnit
  * fix disable ECB Tests
  * fix enable appveyor cache on error
  * fix enable appveyor cache on error
  * fix cppunit vcpkg autodetect
  * fix remove cppunit path
  * fix enable post build tests
  * fix windows duplicate define
  * fix windows execution
  * feat add a message if cppunit library is missing
  * fix add Softhsm2-negative-mech.conf for p11test
  * fix cmake windows static lib
  * fix Botan ECB mode dropped
  * fix set warning level to W4 for softhsm test binaries
  * fix set warning level to W4 for softhsm libraries
  * feat change compile crypto backend order
  * fix add cmake windows compatibility files
  * fix DEFAULT_UMASK missing
  * fix set windows compile warning level W4
  * fix set windows compiler warning W4
  * fix ECC &amp; GOST are now disabled by default
  * Fix issue 585 by resetting en/decrypt op on input validation
  * Enforce attributes becoming read-only once set to CK_TRUE on CKA_WRAP_WITH_TRUSTED and CKA_SENSITIVE
- Remove upstreamed patches:
  * softhsm-2.6.1-rh1831086-exit.patch
  * softhsm-2.6.1-uninitialized.patch</changelog>
  <changelog author="mcepl@cepl.eu" date="1732881600">- Update to version 2.6.1+git.1732869438.f7883c2:
  * init
  * add libtool for macos
  * upgrade to macos-14
  * build on selected branches push only
  * tweek
  * Minor README.md fixes
  * Add macOS to CI
  * Build and run tests in CI for Windows
  * Add GitHub Actions CI
- Update softhsm2-pk11install.c from
  https://github.com/dogtagpki/coolkey/blob/master/src/install/pk11install.c</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1735473600">- readd %sysusers_requires, as otherwise the %pre script fails to install</changelog>
</package>
<package pkgid="89847532b1dcffae83619a319b4d2f4569e9c4682fc0c1cf47e5bdc3dcc6ce6025e20228b5891aa05ee24d8f04cf14c0fcd0e2759e0b176b65f372089af2237a" name="sops" arch="s390x">
  <version epoch="0" ver="3.13.3" rel="44.2"/>
  <changelog author="Johannes Kastl &lt;kastl@b1-systems.de&gt;" date="1695643200">- update to 3.8.0:
  * Features:
  - Support --version without network requests using
  - -disable-version-check (#1115)
  - Support --input-type for updatekeys command (#1116)
  * Improvements:
  - pgp: modernize and improve, and add tests (#1054, #1282)
  - azkv: update SDK to latest, add tests, tidy (#1067, #1092,
    [#1256])
  - age: improve identity loading, add tests, tidy (#1064)
  - kms: AWS SDK V2, allow creds config, add tests (#1065, #1257)
  - gcpkms: update SDK to latest, add tests, tidy (#1072, #1255)
  - hcvault: update API, add tests, tidy (#1085)
  - Do not report version when upstream --version check fails
    (#1124)
  - Use GitHub endpoints in --version command (#1261)
  - Close temporary file before invoking editor to widen support
    on Windows (#1265)
  - Update dependencies (#1063, #1091, #1147, #1242, #1260,
    [#1264], #1275, #1280, #1283)
  - Deal with various deprecations of dependencies (#1113, #1262)
  * Bug fixes:
  - Ensure YAML comments are not displaced (#1069)
  - Ensure default Google credentials can be used again after
    introduction of GOOGLE_CREDENTIALS (#1249)
  - Avoid duplicate logging of errors in some key sources (#1146,
    [#1281])
  - Using --set on a root level key does no longer truncate
    existing values (#899)
  - Ensure stable order of SOPS parameters in dotenv file (#1101)
  * Project changes:
  - Update Go to 1.20 (#1148)
  - Update rustc functional tests to v1.70.0 (#1234)
  - Remove remaining CircleCI workflow (#1237)
  - Run CLI workflow on main (#1243)
  - Delete obsolete validation/ artifact (#1248)
  - Rename Go module to github.com/getsops/sops/v3 (#1247)
  - Revamp release automation, including (Cosign) signed
    container images and checksums file, SLSA3 provenance and
    SBOMs (#1250)
  - Update various bits of documentation (#1244)
  - Add missing --encrypt flag from Vault example (#1060)
  - Add documentation on how to use age in .sops.yaml (#1192)
  - Improve Make targets and address various issues (#1258)
  - Ensure clean working tree in CI (#1267)
  - Fix CHANGELOG.rst formatting (#1269)
  - Pin GitHub Actions to full length commit SHA and add CodeQL
    (#1276)
  - Enable Dependabot for Docker, GitHub Actions and Go Mod
    (#1277)
  - Generate versioned .intoto.jsonl (#1278)
  - Update CI dependencies (#1279)</changelog>
  <changelog author="Johannes Kastl &lt;kastl@b1-systems.de&gt;" date="1696420800">- fix broken sops executable (sorry...)</changelog>
  <changelog author="kastl@b1-systems.de" date="1697112000">- Update to version 3.8.1:
  * Release v3.8.1
  * Update dependencies
  * Add section in CONTRIBUTING.md on docs changes.
  * Add checkdocs, checkrst, and checkmd make targets.
  * Add workflow for rstcheck and mdl.
  * Change some SOPSs back to sops.
  * Normalize SOPS usages.
  * Normalize indentation for code blocks and YAML files.
  * Improve MD files (with mdl feedback).
  * Improve RST files (with rstcheck feedback).
  * pgp: further improve import error format
  * pgp: better error reporting for missing GPG binary
  * docs: document AWS environment variables
  * build(deps): Bump the go group with 7 updates
  * Make sure to wrap raw errors with toExitError().
  * Report key rotation errors.
  * Check err for nil in tests.
  * Defer only after checking err.
  * Handle unhandled errors.
  * Ignore irrelevant return value (it is always nil).
  * decrypt: fix dropped error
  * pgp: do not require abs path for SopsGpgExecEnv
  * Make error the last return value
  * Handle return values of dec.Token() to improve error messages.
  * Fix versions in comments
  * build(deps): Bump the ci group with 1 update
  * build(deps): Bump the go group with 4 updates
  * Fix descriptions of unencrypted-regex and encrypted-regex
    flags.
  * Reject completely empty documents.
  * On macOS, prefer XDG_CONFIG_HOME over os.UserConfigDir()
  * Improve handling of errors when binary store handles bad data
  * Delete sops encrypted file we don't have keys for.
  * pgp: remove `--no-default-keyring` argument
  * pgp: improve handling of GnuPG home dir
  * build(deps): Bump the ci group with 3 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720008000">- Update to version 3.9.0:
  * Respect aws_profile from Keygroup Config by @Kouzukii in #1049
  * build(deps): Bump the go group with 6 updates by @dependabot in
    [#1327]
  * build(deps): Bump the go group with 3 updates by @dependabot in
    [#1328]
  * build(deps): Bump the go group with 1 update by @dependabot in
    [#1330]
  * build(deps): Bump github.com/docker/docker from
    20.10.24+incompatible to 24.0.7+incompatible by @dependabot in
    [#1336]
  * build(deps): Bump the go group with 3 updates by @dependabot in
    [#1334]
  * Improve README.rst by @Ph0tonic in #1339
  * Fix typos by @felixfontein in #1337
  * build(deps): Bump the go group with 7 updates by @dependabot in
    [#1344]
  * Add --mac-only-encrypted to compute MAC only over values which
    end up encrypted by @mitar in #973
  * build(deps): Bump the ci group with 1 update by @dependabot in
    [#1347]
  * build(deps): Bump the go group with 7 updates by @dependabot in
    [#1348]
  * README: Correctly tag code as yaml-stream by @felixfontein in
    [#1350]
  * build(deps): Bump the go group with 5 updates by @dependabot in
    [#1354]
  * use getUserConfigDir also in tests by @bkreitch in #1346
  * Overwrite home dir in vault test by @bkreitch in #1349
  * Allow configuration of indentation for YAML and JSON stores by
    @Ph0tonic in #1273
  * build(deps): Bump github.com/go-jose/go-jose/v3 from 3.0.0 to
    3.0.1 by @dependabot in #1357
  * build(deps): Bump the go group with 4 updates by @dependabot in
    [#1360]
  * build(deps): Bump the ci group with 1 update by @dependabot in
    [#1359]
  * Fix TestGnuPGHome_Validate by @stormentt in #1370
  * build(deps): Bump the go group with 6 updates by @dependabot in
    [#1373]
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1376]
  * Docs: indent is used both for encryption and decryption by
    @felixfontein in #1372
  * fix a bug where not having a config results in a panic by
    @stormentt in #1371
  * Polish the 'sops help' output a bit by @felixfontein in #1341
  * introduce a --pristine flag to sops exec-env by @e-nikolov in
    [#912]
  * Allow to pass multiple paths to 'updatekeys' by @sj14 in #1274
  * Warn/fail if the wrong number of arguments is provided by
    @felixfontein in #1342
  * Allow to override fileName with different value by
    @felixfontein in #1332
  * Sort masterkeys according to decryption-order by @bkreitch in
    [#1345]
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1382]
  * build(deps): Bump the go group with 5 updates by @dependabot in
    [#1381]
  * Deprecate the --background option to exec-env and exec-file by
    @felixfontein in #1379
  * build(deps): Bump golang.org/x/crypto from 0.16.0 to 0.17.0 by
    @dependabot in #1383
  * build(deps): Bump the ci group with 1 update by @dependabot in
    [#1386]
  * build(deps): Bump the go group with 5 updates by @dependabot in
    [#1385]
  * Consolidate Flatten/Unflatten pre/post processing by
    @lancerushing in #1356
  * INI, DotEnv stores: shamir_threshold is an integer by
    @felixfontein in #1394
  * Improve integration tests: reformat test code, make sure exit
    codes are always checked by @felixfontein in #1390
  * Make check whether file contains invalid keys for encryption
    dependent on output store by @felixfontein in #1393
  * Create a constant for the 'sops' metadata key by @felixfontein
    in #1398
  * build(deps): Bump github.com/cloudflare/circl from 1.3.3 to
    1.3.7 by @dependabot in #1408
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1425]
  * build(deps): Bump github.com/opencontainers/runc from 1.1.5 to
    1.1.12 by @dependabot in #1428
  * build(deps): Bump the go group with 10 updates by @dependabot
    in #1429
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1432]
  * Warn if more than one command is used by @felixfontein in #1388
  * Move extraction of encryption and rotation options to separate
    functions by @felixfontein in #1389
  * Add separate subcommands for encryption, decryption, rotating,
    editing, and setting values by @felixfontein in #1391
  * Add basic tests for exec-env and exec-file by @felixfontein in
    [#1396]
  * build with go 1.21 and update dependencies by @b-dean in #1427
  * build(deps): Bump the go group with 4 updates by @dependabot in
    [#1439]
  * sops: fix typo in interface name by @duthils in #1477
  * Fix function name in comment by @pullmerge in #1484
  * build(deps): Bump the ci group across 1 directory with 9
    updates by @dependabot in #1498
  * build(deps): Bump github.com/go-jose/go-jose/v3 from 3.0.1 to
    3.0.3 by @dependabot in #1454
  * build(deps): Bump google.golang.org/protobuf from 1.32.0 to
    1.33.0 by @dependabot in #1460
  * build(deps): Bump github.com/docker/docker from
    24.0.7+incompatible to 24.0.9+incompatible by @dependabot in
  [#1466]
  * build(deps): Bump golang.org/x/net from 0.21.0 to 0.23.0 by
    @dependabot in #1489
  * build(deps): Bump actions/setup-go from 5.0.0 to 5.0.1 in the
    ci group by @dependabot in #1503
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1508]
  * LoadCreationRuleForFile: correctly handle nil without error in
    callers by @felixfontein in #1506
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1510]
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1516]
  * Fix CVE-2024-2660 by @TheoBrigitte in #1519
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1521]
  * fix(Makefile): set locale to make tests pass by
    @jonasbadstuebner in #1492
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1524]
  * Adjust Makefile to new goreleaser 6.0.0 release by
    @felixfontein in #1526
  * build(deps): Bump the go group across 1 directory with 23
    updates by @dependabot in #1525
  * update documentation for age by @tomaszduda23 in #1399
  * exec-file: if --filename is used, use the provided filename
    without random suffix by @felixfontein in #1474
  * build(deps): Bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.5.2 to
    1.6.0 by @dependabot in #1528
  * Do not use DotEnv store for exec-env, but specialized
    environment serializing code by @felixfontein in #1436
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1534]
  * Decryption: do not fail if no matching creation_rule is present
    in config file by @felixfontein in #1434
  * add filestatus command by @endorama in #545
  * build(deps): Bump the go group across 1 directory with 16
    updates by @dependabot in #1540
  * build(deps): Bump the go group across 1 directory with 4
    updates by @dependabot in #1543
  * add command unset by @duthils in #1475
  * Update sops.go comment by @rjeczkow in #1544
  * Support using comments to select parts to encrypt by
    @felixfontein in #1392
  * Feature: merge key for key groups and make keys unique by
    @jonasbadstuebner in #1493
  * Update all go deps by @felixfontein in #1545
  * Release 3.9.0 by @felixfontein in #1546</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728216000">- Update to version 3.9.1:
  * Add missing newlines.
  * Add changelog for 3.9.1.
  * Bump version to 3.9.1.
  * Do not ignore errors when trying to parse a config file.
  * Update all go deps with 'go get -t -u ./...'.
  * build(deps): Bump the rust group in /functional-tests with 5
    updates
  * build(deps): Bump the go group with 7 updates
  * Add Cargo.lock for better reproducability of functional tests.
  * build(deps): Bump the go group with 7 updates
  * build(deps): Bump the ci group with 2 updates
  * Dependabot: fix config for Docker, add config for Rust/Cargo.
  * Show changes in shamir_threshold when updating keys.
  * Do not encrypt if a key group is empty, or there are no key
    groups.
  * Fix checkout action version.
  * Use Go version from go.mod.
  * Build release with Go 1.22.x.
  * Allow edit subcommand to create files.
  * Build 1.22 1.23 because 1.21 is unsupported without security
    fixes
  * Review: Add test "matrix" but only for 1.22
  * feat(build): Build last 2 Go versions
  * refactor: specify missing file in error message
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 10 updates
  * Add 'check' task to CI that makes sure everything is green.
  * sops_test: add more tests on errors
  * sops_test: homogenize use of asserts
  * tests: add coverage for unset
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 4 updates
  * Fix `--config` being ignored by `loadConfig`
  * github actions: set rust version globally
  * linters: pin version of Rust
  * functional tests: formatting lint
  * github actions: add Rust linter
  * Added example of having age recipients in .sops.yaml
  * Actually use option --shamir-secret-sharing-threshold.
  * build(deps): Bump github.com/opencontainers/runc from 1.1.13 to
    1.1.14
  * build(deps): Bump the go group with 12 updates
  * tests: ignore env var SOPS_AGE_KEY_FILE
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 7 updates
  * build(deps): Bump the ci group with 2 updates
  * Bump go version.
  * build(deps): Bump the go group across 1 directory with 15
    updates
  * build(deps): Bump the ci group with 2 updates
  * Use ReST admonition syntax for note
  * Note on the name of the configuration file
  * build(deps): Bump the ci group with 3 updates
  * build(deps): Bump github.com/docker/docker
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 5 updates
  * build(deps): Bump github.com/docker/docker
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 4 updates
  * build(deps): Bump the ci group across 1 directory with 5
    updates
  * build(deps): Bump the go group with 5 updates
  * build(deps): Bump the ci group with 3 updates
  * build(deps): Bump the go group with 10 updates
  * build(deps): Bump the go group with 11 updates
  * build(deps): Bump the ci group with 4 updates
  * Fix the URL used for determining the latest SOPS version.
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 8 updates
  * Explicitly mark goreleaser's version, to avoid confusion with
    the Go version.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- Update to version 3.9.2:
  * Add changelog for 3.9.2.
  * Bump version to 3.9.2.
  * build(deps): Bump the go group with 8 updates
  * Update go.mod.
  * Adjust protoc command line for latest versions of plugins; fix
    protoc Go plugin versions and install plugins locally.
  * keyservice: update protobuf to an recent release
  * fix(config): remove unused variables
  * chore(deps): Update Rust dependencies
  * Correctly handle comments during JSON serialization.
  * Move Python patch tool to .github/utils/.
  * Run 'make vendor' in CodeQL build step.
  * Patch harmless parts of go.mod before looking for changes in
    CI.
  * build(deps): Bump the go group across 1 directory with 18
    updates
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the rust group in /functional-tests with 3
    updates
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the ci group across 1 directory with 3
    updates
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the ci group with 5 updates
  * build(deps): Bump the go group with 7 updates
  * fix(azkv): handle whitespace in Azure Key Vault URLs
  * build(deps): Bump serde_json in /functional-tests in the rust
    group
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 6 updates
  * build(deps): Bump the ci group with 5 updates
  * build(deps): Bump the go group with 12 updates
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump the go group with 11 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1735732800">- Update to version 3.9.3:
  * Add changelog for 3.9.3.
  * Bump version to 3.9.3.
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * Run 'make vendor'.
  * Update all dependencies with 'go get -t -u ./...'.
  * Fix input-type CLI flag being ignored for updatekeys
    subcommand.
  * Use container images from
    https://github.com/getsops/ci-container-images.
  * Document using subkeys with GnuPG.
  * Correctly handle trailing "!" when passing shortened
    fingerprints to GnuPG.
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump serde_json in /functional-tests in the rust
    group
  * build(deps): Bump the go group across 1 directory with 13
    updates
  * Bump golang.org/x/net to 0.33.0 to address CVE-2024-45338.
  * build(deps): Bump filippo.io/age from 1.2.0 to 1.2.1
  * Add 'persist-credentials: false' to checkout actions.
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump golang.org/x/crypto from 0.30.0 to 0.31.0
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 10 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737892800">- Update to version 3.9.4:
  * build(deps): Bump the go group with 5 updates by @dependabot in
    [#1727]
  * build(deps): Bump tempfile from 3.14.0 to 3.15.0 in
    /functional-tests in the rust group by @dependabot in #1728
  * build(deps): Bump the go group with 16 updates by @dependabot
    in #1732
  * build(deps): Bump the ci group with 3 updates by @dependabot in
    [#1730]
  * build(deps): Bump serde_json from 1.0.134 to 1.0.135 in
    /functional-tests in the rust group by @dependabot in #1731
  * build(deps): Bump the go group with 12 updates by @dependabot
    in #1734
  * build(deps): Bump serde_json from 1.0.135 to 1.0.137 in
    /functional-tests in the rust group by @dependabot in #1735
  * Fix ToString for AWS KMS to include role, context, and profile
    by @felixfontein in #1733
  * build(deps): Bump the ci group with 3 updates by @dependabot in
    [#1738]
  * build(deps): Bump the go group with 6 updates by @dependabot in
    [#1739]
  * Release 3.9.4 by @felixfontein in #1740</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743422400">- Update to version 3.10.0:
  * build(deps): Bump alpine from 3.18 to 3.21 in /.release in the
    docker group across 1 directory by @dependabot in #1700
  * Convert changelog to MarkDown by @felixfontein in #1741
  * build(deps): Bump the go group with 7 updates by @dependabot in
    [#1743]
  * build(deps): Bump the go group with 9 updates by @dependabot in
    [#1745]
  * build(deps): Bump the rust group in /functional-tests with 2
    updates by @dependabot in #1744
  * build(deps): Bump github/codeql-action from 3.28.5 to 3.28.8 in
    the ci group by @dependabot in #1746
  * build(deps): Bump the go group with 12 updates by @dependabot
    in #1751
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1750]
  * Add --input-type option for filestatus subcommand by
    @felixfontein in #1601
  * Use SOPS_EDITOR before EDITOR by @felixfontein in #1611
  * Allow users to disable version check via environment variable
    by @nicklasfrahm in #1684
  * add duplicate section support to ini store by @reindlt in #1452
  * stores: test for duplicate keys, reserve keyword (yaml only
    now) by @holiman in #1203
  * Add same process option for exec-env by @ricmatsui in #880
  * outputs: add trailing newline at the end of JSON files by
    @duthils in #1476
  * set subcommand: add --idempotent flag that will not write the
    file if no change happened by @felixfontein in #1754
  * Encrypt and decrypt time.Time objects by @felixfontein in #1759
  * build(deps): Bump the go group with 8 updates by @dependabot in
    [#1763]
  * build(deps): Bump tempfile from 3.16.0 to 3.17.0 in
    /functional-tests in the rust group by @dependabot in #1762
  * build(deps): Bump goreleaser/goreleaser-action from 6.1.0 to
    6.2.1 in the ci group by @dependabot in #1761
  * fix(docs): typo in README.rst by @Paredev in #1765
  * Add SSH support for age by @haoqixu in #1692
  * make sure that tests do not pick keys.txt from user's HOME dir
    by @tomaszduda23 in #1766
  * support for age identity with passphrase by @tomaszduda23 in
    [#1400]
  * build(deps): Bump the rust group in /functional-tests with 4
    updates by @dependabot in #1768
  * build(deps): Bump the go group with 12 updates by @dependabot
    in #1769
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1770]
  * build(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.4 to
    4.0.5 by @dependabot in #1773
  * feat: add age plugin support by @brianmcgee in #1641
  * Check GnuPG decryption result for non-empty size by
    @felixfontein in #1776
  * vendored age code: consolidate passphrase reading functionality
    by @felixfontein in #1775
  * Allow to encrypt and decrypt from stdin by @felixfontein in
    [#1690]
  * build(deps): Bump the go group with 11 updates by @dependabot
    in #1784
  * build(deps): Bump the ci group with 5 updates by @dependabot in
    [#1782]
  * build(deps): Bump serde_json from 1.0.139 to 1.0.140 in
    /functional-tests in the rust group; bump Rust to 1.85.0 by
    @dependabot in #1783
  * build(deps): Bump the go group with 13 updates by @dependabot
    in #1797
  * build(deps): Bump the rust group in /functional-tests with 3
    updates by @dependabot in #1796
  * build(deps): Bump github/codeql-action from 3.28.10 to 3.28.11
    in the ci group by @dependabot in #1795
  * build(deps): Bump the go group with 6 updates by @dependabot in
    [#1802]
  * build(deps): Bump tempfile from 3.18.0 to 3.19.0 in
    /functional-tests in the rust group by @dependabot in #1800
  * build(deps): Bump docker/login-action from 3.3.0 to 3.4.0 in
    the ci group by @dependabot in #1801
  * build(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to
    5.2.2 by @dependabot in #1806
  * goreleaser: add windows arm64 by @duthils in #1791
  * Add a way to set sops config location via envvar by @sledzikowy
    in #1701
  * build(deps): Bump the go group with 3 updates by @dependabot in
    [#1809]
  * build(deps): Bump the ci group with 5 updates by @dependabot in
    [#1808]
  * build(deps): Bump tempfile from 3.19.0 to 3.19.1 in
    /functional-tests in the rust group by @dependabot in #1807
  * Support --config option in publish subcommand by @felixfontein
    in #1779
  * Fix caching of Metadata.DataKey by @felixfontein in #1781
  * Lint by @felixfontein in #1780
  * updatekeys subcommand: rename GroupQuorum to ShamirThreshold by
    @felixfontein in #1631
  * If --filename-override is specified, convert it to an absolute
    path same as regular filenames by @felixfontein in #1793
  * Add support for oauth2.TokenSource in GCP KMS by @matheuscscp
    in #1794
  * Added SOPS_AGE_KEY_CMD option to age, fixes #1323 by
    @danilobuerger in #1811
  * chore: omitempty metadata to reduce the size of stored config
    by @cgetzen in #1571
  * Improve Shamir Secret Sharing code by @felixfontein in #1813
  * Update all dependencies by @felixfontein in #1814
  * Run 'gofmt -w' on all .go files by @felixfontein in #1817
  * Add option to explicitly check for the latest version;
    deprecate current default of always doing that unless disabled
    by @felixfontein in #1816
  * Build using Go 1.24 and drop support for 1.22 by @hiddeco in
    [#1819]
  * Support GOOGLE_OAUTH_ACCESS_TOKEN for Google Cloud Platform by
    @marensofier in #1578
  * Warn about .sops.yml files found while searching for .sops.yaml
    by @felixfontein in #1820
  * Release 3.10.0 by @felixfontein in #1815
  * Added support for multiarch windows release binaries by
    @sabre1041 in #1823</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743422401">- Update to version 3.10.1:
  * Add changelog.
  * Bump version to 3.10.1.
  * build(deps): Bump the ci group with 2 updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744804800">- Update to version 3.10.2:
  * build(deps): Bump the go group with 13 updates by @dependabot
    in #1834
  * Use latest 1.24 Go version for release build by @hiddeco in
    [#1836]
  * Remove reserved keyword check from YAML store's LoadPlainFile()
    by @felixfontein in #1829
  * build(deps): Bump the go group with 9 updates by @dependabot in
    [#1839]
  * build(deps): Bump github/codeql-action from 3.28.13 to 3.28.15
    in the ci group by @dependabot in #1840
  * Release 3.10.2 release by @felixfontein in #1841</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1759147200">- Update to version 3.11.0:
  * Bump version to 3.11.0.
  * Add changelog for 3.11.0.
  * Address review comments.
  * Move dotenv.IsComplexValue to stores.
  * Do not put sensitive value into error message when the key can
    be printed as well.
  * Apply review suggestions.
  * AZKV: Also allow to omit version for AZKV keys specified in key
    groups.
  * Make SingleValueStore extend Store instead of the other way
    around.
  * Ignore encryption selection options for binary store (and warn
    when they are used).
  * build(deps): Bump the go group across 1 directory with 10
    updates
  * Get rid of conf variable.
  * When encrypting, load the config only once.
  * build(deps): Bump the go group across 1 directory with 21
    updates
  * Build with Go 1.24 and 1.25, release with 1.25.
  * Improve formulations.
  * Add YAML keys for all keys in a key group.
  * Get rid of some unrelated tabs.
  * Document (most of) the SOPS config format.
  * build(deps): Bump anchore/sbom-action in the ci group
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the rust group in /functional-tests with 4
    updates
  * Fix grammar.
  * Always load age identities from all locations, and report
    unused locations in error messages.
  * Fix mention of macOS XDG_CONFIG_HOME fallback.
  * Allow for non-string values in exec-env
  * Avoid panic when values are numbers
  * Fix argument order.
  * Move ValToString to stores.
  * Improve formatting of floats.
  * Add tests.
  * Fix converting integers to strings. Also improve time.Time
    formatting.
  * Update azkv/keysource.go
  * build(deps): Bump the ci group with 2 updates
  * fix: correct destination validation logic to detect all
    conflicts
  * Switch from deprecated gopkg.in/yaml.v3 to go.yaml.in/yaml/v3
  * feat(azkv): Skipping key-version will get latest key
  * Allow to configure --enable-local-keyservice and --keyservice
    through env variables.
  * Remove paragraph on GPG/PGP keyservers.
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the go group with 14 updates
  * build(deps): Bump github.com/go-viper/mapstructure/v2
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump the go group with 9 updates
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump the go group with 15 updates
  * Fix keyservice client for unix domain sockets
  * Fix example.yaml.
  * Addressing felixfontein's latest review. Adds a key type field
    to the ParseKeyField fn.
  * Resolves #1864. Adds Native List as an option for configuring
    keys in addition to the trailing comma option already given.
  * Resolves #1864. Adds Native List as an option for configuring
    keys in addition to the trailing comma option already given.
  * Collect age identity loading errors and only report if
    decryption failed.
  * Document #1876 and --value-stdin.
  * Add --value-stdin option to 'sops set'.
  * Ensure temporary file for editing is only read-writable by
    owner.
  * Mention all stores in various places.
  * build(deps): Bump the ci group with 3 updates
  * build(deps): Bump serde_json in /functional-tests in the rust
    group
  * build(deps): Bump the go group with 12 updates
  * update completion command usage description
  * add source link for completion snippet
  * Also parse floating point numbers if they represent integers.
  * Store floating point number without decimal places.
  * Fix Shamir threshold encoding for INI and ENV files.
  * double backticks on configuration directory list 2/2
  * double backticks on configuration directory list 1/2
  * Document XDG_CONFIG_HOME support on mac
  * Add "--value-file" option to "sops set [...]"
  * build(deps): Bump the go group with 6 updates
  * add completion script. Resolves #1868
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 3 updates
  * Correct Windows path to store keys.txt
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 4 updates
  * build(deps): Bump github.com/go-viper/mapstructure/v2
  * Fix Typo in README.rst
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 8 updates
  * build(deps): Bump the ci group across 1 directory with 3
    updates
  * build(deps): Bump the go group with 12 updates
  * build(deps): Bump github.com/cloudflare/circl from 1.6.0 to
    1.6.1
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 12 updates
  * build(deps): Bump alpine in /.release in the docker group
  * build(deps): Bump the go group with 4 updates
  * Remove unmatched '`' from README.rst
  * build(deps): Bump the go group with 7 updates
  * Update authors in main.go
  * Allow injecting custom HTTP client for AWS, Azure, GCP and
    HashiCorp Vault
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 5 updates
  * Introduce EncryptContext and DecryptContext for AWS, Azure,
    GCP, PGP and HashiCorp Vault
  * Apply suggestions from code review.
  * build(deps): Bump actions/setup-go from 5.4.0 to 5.5.0 in the
    ci group
  * build(deps): Bump tempfile in /functional-tests in the rust
    group
  * build(deps): Bump the go group with 8 updates
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump the go group with 5 updates
  * build(deps): Bump the go group with 4 updates
  * add newline before sublist start
  * add newline before sublist start
  * use bullet points for structure</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 3.12.1 (.0 was not released):
  * Features:
  - Add support for HuaweiCloud KMS (#2001).
  - GCP KMS: Add SOPS_GCP_KMS_CLIENT_TYPE environment variable
    support to select between gRPC and REST clients (#1973).
  - Age: support hybrid post-quantum identities (#2033).
  - Age: pass SOPS_AGE_RECIPIENT environment variable to
    SOPS_AGE_KEY_CMD (#2045).
  - Age: add SOPS_AGE_SSH_PRIVATE_KEY_CMD environment variable
    (#2070).
  * Improvements:
  - Dependency updates (#1967, #1971, #1978, #1986, #1988, #1991,
    [#1993], #2002, #2004, #2007, #2012, #2018, #2024, #2029,
    [#2037], #2043, #2047, #2050, #2059, #2074, #2078).
  - Fix mistakes in --help output (#1975, #1963).
  - Improve documentation (#1997).
  - Unset user's GNUPGHOME environment variable for tests
    (#2052).
  - Use age's plugin.NewTerminalUI() instead of vendoring the
    code (#2034).
  - Remove dead code during YAML loading (#2072).
  - Build release with Go 1.26 (#2071).
  * Bugfixes:
  - Add --decryption-order flag to exec-env, exec-file, and
    publish commands. The subcommand code was using the flags,
    but it wasn't declared (#1965).
  - Fix AWS KMS encryption context not being passed when config
    is pre-loaded (#2021).
  - Fix recursive publish (#2019).
  - Set quota project to API project in GCP KMS (#1697).
  - DotEnv store now properly reports missing metadata (#2055).
  - AWS KMS: allow role splitting without hard-coded aws
    partition (#2042).
  * Project changes:
  - Add Go 1.26 to CI (#2071).
  - CI dependency updates (#1961, #1966, #1970, #1979, #1985,
    [#1989], #1992, #2003, #2006, #2010, #2011, #2017, #2023,
    [#2028], #2038, #2044, #2046, #2049, #2058, #2075).
  - Rust dependency updates for functional tests (#1962, #2027,
    [#2035], #2073).</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773835200">- Update to version 3.12.2:
  * Set version to 3.12.2.
  * Add 3.12.2 changelog entry.
  * Revert "Merge pull request #1697 from onjen/fix-1142"
  * build(deps): Bump tempfile in /functional-tests in the rust
    group
  * build(deps): Bump the ci group with 4 updates
  * Delete temporary file on termination.
  * At least on Linux, you need to press Enter.
  * Refactor loop.
  * Uniformly check file before encrypting.
  * build(deps): Bump the ci group with 4 updates
  * fix: handle mac only encrypted flag in global
  * build(deps): Bump github.com/docker/cli
  * build(deps): Bump tempfile in /functional-tests in the rust
    group
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0
  * build(deps): Bump github.com/cloudflare/circl from 1.6.1 to
    1.6.3
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 6 updates
  * Rearrange CI steps; disable setup-go's caching.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778414400">- Update to version 3.13.0:
  * Bump version to 3.13.0.
  * Add 3.13.0 changelog.
  * Re-add some of Hidde's comments.
  * Handle empty branch in `convert`
  * Drop unused newline-escaping helpers
  * Drop redundant `SopsPrefix` constant in dotenv store
  * Compact comment-skipping in `sopsToGoSlice`
  * Apply review nits to metadata helpers
  * Fix age key in tests.
  * Apply first suggestions from Hidde's review.
  * Replace unflattening algorithm.
  * Also move tests.
  * Better separation.
  * Remove code unrelated to (un-)flattening to other file.
  * Make internal metadata type private.
  * Remove old (de-)serialization.
  * Remove old flattening code.
  * Add common code to encode and decode metadata.
  * Use mapstructure for parsing.
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 5 updates
  * Also append '/' to address to test.
  * Add documentation.
  * Allow to skip all Docker tests.
  * Add allowlist for HashiCorp Vault URLs.
  * Allow to have space-separated keys in SOPS_AGE_KEY.
  * Update all Go dependencies with 'go get -t -u ./...'
  * build(deps): Bump goreleaser/goreleaser-action in the ci group
  * build(deps): Bump the go group with 3 updates
  * Obtain `--indent` global flag value and pass it to store
    configs
  * Reject non-local paths.
  * Improve error handling.
  * Make sure to set GID to correct value instead of UID.
  * build(deps): Bump the go group with 12 updates
  * chore(docs): update broken link
  * build(deps): Bump the ci group with 3 updates
  * Update release for cosign v3
  * build(deps): Bump the go group across 1 directory with 21
    updates
  * build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to
    1.43.0
  * Drop support for Go 1.24.
  * Use prefixed and truncated key hash instead of location as GPG
    agent cache key.
  * build(deps): Bump actions/upload-artifact in the ci group
  * Add newline.
  * docs: add get key permission requirement for Azure Key Vault
    when version is omitted
  * build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * fix: preserve trailing inline comments in YAML emit when no
    items follow
  * test: add nested inline comment roundtrip test
  * fix: preserve YAML inline comments through encrypt/edit
    roundtrip
  * docs: move JSON top-level array note to appropriate section
  * build(deps): Bump docker/login-action in the ci group
  * fix(json): improve error message for top-level arrays (fixes
    [#1974])
  * build(deps): Bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4
  * fix(gcpkms): address review comments on sovereign cloud KMS
    support
  * build(deps): Bump the ci group with 3 updates
  * build(deps): Bump the ci group with 3 updates
  * feat(gcpkms): add SOPS_GCP_KMS_ENDPOINT and
    SOPS_GCP_KMS_UNIVERSE_DOMAIN env vars
  * build(deps): Bump google.golang.org/grpc from 1.79.1 to 1.79.3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 3.13.1:
  * Fix minimum Go version in contributor docs.
  * Redirect documentation to getsops.io.
  * Bump Go version in contributing docs.
  * Redirect documentation changes to getsops/docs.
  * Avoid percent-encoding of cache key to blow up size &gt; 50
    characters.
  * Apply 'gofmt -w -s' to all .go files.
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 9 updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782907200">- Update to version 3.13.2:
  * build(deps): Bump the go group with 3 updates by
    @dependabot[bot] in #2185
  * build(deps): Bump github/codeql-action from 4.35.4 to 4.35.5 in
    the ci group by @dependabot[bot] in #2184
  * build(deps): Bump the go group with 11 updates by
    @dependabot[bot] in #2193
  * build(deps): Bump the ci group with 4 updates by
    @dependabot[bot] in #2192
  * build(deps): Bump serde_json from 1.0.149 to 1.0.150 in
    /functional-tests in the rust group by @dependabot[bot] in
    [#2191]
  * build(deps): Bump the go group with 11 updates by
    @dependabot[bot] in #2197
  * build(deps): Bump docker/setup-qemu-action from 4.0.0 to 4.1.0
    in the ci group by @dependabot[bot] in #2196
  * test: unset all age env vars in make test target by
    @arpitjain099 in #2208
  * build(deps): Bump the go group with 10 updates by
    @dependabot[bot] in #2212
  * build(deps): Bump the ci group with 2 updates by
    @dependabot[bot] in #2211
  * build(deps): Bump the go group with 15 updates by
    @dependabot[bot] in #2218
  * build(deps): Bump alpine from 3.23 to 3.24 in /.release in the
    docker group by @dependabot[bot] in #2217
  * fix: handle pointers when serializing context by @tlercher in
    [#2219]
  * docs: fix typo in exec-file --filename help text by @s3onghyun
    in #2221
  * JSON store: preserve large integers that fit into int64 by
    @s3onghyun in #2222
  * Fix panic when expecting an encrypted string, but a non-string
    is encountered by @felixfontein in #2227
  * Fix INI store no longer double-encoding newlines by
    @felixfontein in #2189
  * exec-file/exec-env: reset supplementary groups when changing
    user by @felixfontein in #2194
  * build(deps): Bump the go group with 6 updates by
    @dependabot[bot] in #2229
  * build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 in the
    ci group by @dependabot[bot] in #2228
  * Fix issue when changing user in exec subcommands by @sabre1041
    in #2230
  * Shorten .md lines by @felixfontein in #2206
  * Update all Go dependencies with go get -t -u ./... by
    @felixfontein in #2231
  * build(deps): Bump github.com/opencontainers/runc from 1.2.8 to
    1.3.6 by @dependabot[bot] in #2233
  * build(deps): Bump the ci group with 2 updates by
    @dependabot[bot] in #2236
  * Release 3.13.2 by @felixfontein in #2232</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 3.13.3:
  * Add ini to supported input/output type descriptions by
    @TheKhanj in #2239
  * build(deps): Bump the go group with 10 updates by
    @dependabot[bot] in #2242
  * build(deps): Bump the ci group with 6 updates by
    @dependabot[bot] in #2241
  * fix: include decrypted sequence comments in the MAC (fixes
    [#2243]) by @cbcoutinho in #2245
  * build(deps): Bump the go group with 14 updates by
    @dependabot[bot] in #2251
  * build(deps): Bump the ci group with 2 updates by
    @dependabot[bot] in #2250
  * build(deps): Bump the go group with 11 updates by
    @dependabot[bot] in #2261
  * build(deps): Bump the ci group with 3 updates by
    @dependabot[bot] in #2260
  * build(deps): Bump the rust group in /functional-tests with 3
    updates by @dependabot[bot] in #2259
  * Update dependencies with 'go get -t -u ./...' by @felixfontein
    in #2248
  * Completion scripts: remove leading newline by @felixfontein in
    [#2253]</changelog>
</package>
<package pkgid="7b009c504a0d5158f0d895b540ee4e961ef8f89c5934a6a553ede119ff8cf749d208dfda315444f2586dbd239023319cd953441d225ee0a4a0307ca3f2f7cee5" name="sops" arch="src">
  <version epoch="0" ver="3.13.3" rel="44.2"/>
  <changelog author="rombert@apache.org" date="1647432000">- Update to version 3.7.2:
  * Fixed CHANGELOG formatting
  * prep v3.7.2
  * Add arm64 .deb and .rpm builds
  * README and author tweaks
  * Change labeling and upload linux arm64
  * Move age environment variable names to constants
  * Support SOPS_AGE_KEY environment variable
  * Added support for go 1.16 and darwin-arm64
  * Tests should not fail fast</changelog>
  <changelog author="rombert@apache.org" date="1653393600">- Update to version 3.7.3:
  * prep for v3.7.3
  * Use custom GOOGLE_CREDENTIALS or fallback to default
  * Replace x/crypto/openpgp with ProtonMail/go-crypto
  * Update remaining dependencies
  * Update golang.org/x/{net,oauth2,sys} dependencies
  * Update keyservice implementation dependencies
  * Update golang.org/x/crypto
  * Limit role session name length to 64 characters.
  * keyservice: accept KeyServiceServer in LocalClient
  * Use latest dockerd in CI to allow build alpine image (#870)
  * Add tests for single key
  * Make `masterKeyFromRecipient` private
  * This fixes a bug with age encryption when specifying multiple age recipients
  * Explicitly build linux amd64 binary
  * Remove duplicated stage from Dockerfile.alpine
  * Upgrade all dependencies
  * Build alpine container in CI (#870)
  * Update keysource.go
  * support gcp credentials as env var
  * Allow empty maps for yaml (#907)
  * Add a test to reproduce #907</changelog>
  <changelog author="Johannes Kastl &lt;kastl@b1-systems.de&gt;" date="1695643200">- update to 3.8.0:
  * Features:
  - Support --version without network requests using
  - -disable-version-check (#1115)
  - Support --input-type for updatekeys command (#1116)
  * Improvements:
  - pgp: modernize and improve, and add tests (#1054, #1282)
  - azkv: update SDK to latest, add tests, tidy (#1067, #1092,
    [#1256])
  - age: improve identity loading, add tests, tidy (#1064)
  - kms: AWS SDK V2, allow creds config, add tests (#1065, #1257)
  - gcpkms: update SDK to latest, add tests, tidy (#1072, #1255)
  - hcvault: update API, add tests, tidy (#1085)
  - Do not report version when upstream --version check fails
    (#1124)
  - Use GitHub endpoints in --version command (#1261)
  - Close temporary file before invoking editor to widen support
    on Windows (#1265)
  - Update dependencies (#1063, #1091, #1147, #1242, #1260,
    [#1264], #1275, #1280, #1283)
  - Deal with various deprecations of dependencies (#1113, #1262)
  * Bug fixes:
  - Ensure YAML comments are not displaced (#1069)
  - Ensure default Google credentials can be used again after
    introduction of GOOGLE_CREDENTIALS (#1249)
  - Avoid duplicate logging of errors in some key sources (#1146,
    [#1281])
  - Using --set on a root level key does no longer truncate
    existing values (#899)
  - Ensure stable order of SOPS parameters in dotenv file (#1101)
  * Project changes:
  - Update Go to 1.20 (#1148)
  - Update rustc functional tests to v1.70.0 (#1234)
  - Remove remaining CircleCI workflow (#1237)
  - Run CLI workflow on main (#1243)
  - Delete obsolete validation/ artifact (#1248)
  - Rename Go module to github.com/getsops/sops/v3 (#1247)
  - Revamp release automation, including (Cosign) signed
    container images and checksums file, SLSA3 provenance and
    SBOMs (#1250)
  - Update various bits of documentation (#1244)
  - Add missing --encrypt flag from Vault example (#1060)
  - Add documentation on how to use age in .sops.yaml (#1192)
  - Improve Make targets and address various issues (#1258)
  - Ensure clean working tree in CI (#1267)
  - Fix CHANGELOG.rst formatting (#1269)
  - Pin GitHub Actions to full length commit SHA and add CodeQL
    (#1276)
  - Enable Dependabot for Docker, GitHub Actions and Go Mod
    (#1277)
  - Generate versioned .intoto.jsonl (#1278)
  - Update CI dependencies (#1279)</changelog>
  <changelog author="Johannes Kastl &lt;kastl@b1-systems.de&gt;" date="1696420800">- fix broken sops executable (sorry...)</changelog>
  <changelog author="kastl@b1-systems.de" date="1697112000">- Update to version 3.8.1:
  * Release v3.8.1
  * Update dependencies
  * Add section in CONTRIBUTING.md on docs changes.
  * Add checkdocs, checkrst, and checkmd make targets.
  * Add workflow for rstcheck and mdl.
  * Change some SOPSs back to sops.
  * Normalize SOPS usages.
  * Normalize indentation for code blocks and YAML files.
  * Improve MD files (with mdl feedback).
  * Improve RST files (with rstcheck feedback).
  * pgp: further improve import error format
  * pgp: better error reporting for missing GPG binary
  * docs: document AWS environment variables
  * build(deps): Bump the go group with 7 updates
  * Make sure to wrap raw errors with toExitError().
  * Report key rotation errors.
  * Check err for nil in tests.
  * Defer only after checking err.
  * Handle unhandled errors.
  * Ignore irrelevant return value (it is always nil).
  * decrypt: fix dropped error
  * pgp: do not require abs path for SopsGpgExecEnv
  * Make error the last return value
  * Handle return values of dec.Token() to improve error messages.
  * Fix versions in comments
  * build(deps): Bump the ci group with 1 update
  * build(deps): Bump the go group with 4 updates
  * Fix descriptions of unencrypted-regex and encrypted-regex
    flags.
  * Reject completely empty documents.
  * On macOS, prefer XDG_CONFIG_HOME over os.UserConfigDir()
  * Improve handling of errors when binary store handles bad data
  * Delete sops encrypted file we don't have keys for.
  * pgp: remove `--no-default-keyring` argument
  * pgp: improve handling of GnuPG home dir
  * build(deps): Bump the ci group with 3 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720008000">- Update to version 3.9.0:
  * Respect aws_profile from Keygroup Config by @Kouzukii in #1049
  * build(deps): Bump the go group with 6 updates by @dependabot in
    [#1327]
  * build(deps): Bump the go group with 3 updates by @dependabot in
    [#1328]
  * build(deps): Bump the go group with 1 update by @dependabot in
    [#1330]
  * build(deps): Bump github.com/docker/docker from
    20.10.24+incompatible to 24.0.7+incompatible by @dependabot in
    [#1336]
  * build(deps): Bump the go group with 3 updates by @dependabot in
    [#1334]
  * Improve README.rst by @Ph0tonic in #1339
  * Fix typos by @felixfontein in #1337
  * build(deps): Bump the go group with 7 updates by @dependabot in
    [#1344]
  * Add --mac-only-encrypted to compute MAC only over values which
    end up encrypted by @mitar in #973
  * build(deps): Bump the ci group with 1 update by @dependabot in
    [#1347]
  * build(deps): Bump the go group with 7 updates by @dependabot in
    [#1348]
  * README: Correctly tag code as yaml-stream by @felixfontein in
    [#1350]
  * build(deps): Bump the go group with 5 updates by @dependabot in
    [#1354]
  * use getUserConfigDir also in tests by @bkreitch in #1346
  * Overwrite home dir in vault test by @bkreitch in #1349
  * Allow configuration of indentation for YAML and JSON stores by
    @Ph0tonic in #1273
  * build(deps): Bump github.com/go-jose/go-jose/v3 from 3.0.0 to
    3.0.1 by @dependabot in #1357
  * build(deps): Bump the go group with 4 updates by @dependabot in
    [#1360]
  * build(deps): Bump the ci group with 1 update by @dependabot in
    [#1359]
  * Fix TestGnuPGHome_Validate by @stormentt in #1370
  * build(deps): Bump the go group with 6 updates by @dependabot in
    [#1373]
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1376]
  * Docs: indent is used both for encryption and decryption by
    @felixfontein in #1372
  * fix a bug where not having a config results in a panic by
    @stormentt in #1371
  * Polish the 'sops help' output a bit by @felixfontein in #1341
  * introduce a --pristine flag to sops exec-env by @e-nikolov in
    [#912]
  * Allow to pass multiple paths to 'updatekeys' by @sj14 in #1274
  * Warn/fail if the wrong number of arguments is provided by
    @felixfontein in #1342
  * Allow to override fileName with different value by
    @felixfontein in #1332
  * Sort masterkeys according to decryption-order by @bkreitch in
    [#1345]
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1382]
  * build(deps): Bump the go group with 5 updates by @dependabot in
    [#1381]
  * Deprecate the --background option to exec-env and exec-file by
    @felixfontein in #1379
  * build(deps): Bump golang.org/x/crypto from 0.16.0 to 0.17.0 by
    @dependabot in #1383
  * build(deps): Bump the ci group with 1 update by @dependabot in
    [#1386]
  * build(deps): Bump the go group with 5 updates by @dependabot in
    [#1385]
  * Consolidate Flatten/Unflatten pre/post processing by
    @lancerushing in #1356
  * INI, DotEnv stores: shamir_threshold is an integer by
    @felixfontein in #1394
  * Improve integration tests: reformat test code, make sure exit
    codes are always checked by @felixfontein in #1390
  * Make check whether file contains invalid keys for encryption
    dependent on output store by @felixfontein in #1393
  * Create a constant for the 'sops' metadata key by @felixfontein
    in #1398
  * build(deps): Bump github.com/cloudflare/circl from 1.3.3 to
    1.3.7 by @dependabot in #1408
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1425]
  * build(deps): Bump github.com/opencontainers/runc from 1.1.5 to
    1.1.12 by @dependabot in #1428
  * build(deps): Bump the go group with 10 updates by @dependabot
    in #1429
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1432]
  * Warn if more than one command is used by @felixfontein in #1388
  * Move extraction of encryption and rotation options to separate
    functions by @felixfontein in #1389
  * Add separate subcommands for encryption, decryption, rotating,
    editing, and setting values by @felixfontein in #1391
  * Add basic tests for exec-env and exec-file by @felixfontein in
    [#1396]
  * build with go 1.21 and update dependencies by @b-dean in #1427
  * build(deps): Bump the go group with 4 updates by @dependabot in
    [#1439]
  * sops: fix typo in interface name by @duthils in #1477
  * Fix function name in comment by @pullmerge in #1484
  * build(deps): Bump the ci group across 1 directory with 9
    updates by @dependabot in #1498
  * build(deps): Bump github.com/go-jose/go-jose/v3 from 3.0.1 to
    3.0.3 by @dependabot in #1454
  * build(deps): Bump google.golang.org/protobuf from 1.32.0 to
    1.33.0 by @dependabot in #1460
  * build(deps): Bump github.com/docker/docker from
    24.0.7+incompatible to 24.0.9+incompatible by @dependabot in
  [#1466]
  * build(deps): Bump golang.org/x/net from 0.21.0 to 0.23.0 by
    @dependabot in #1489
  * build(deps): Bump actions/setup-go from 5.0.0 to 5.0.1 in the
    ci group by @dependabot in #1503
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1508]
  * LoadCreationRuleForFile: correctly handle nil without error in
    callers by @felixfontein in #1506
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1510]
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1516]
  * Fix CVE-2024-2660 by @TheoBrigitte in #1519
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1521]
  * fix(Makefile): set locale to make tests pass by
    @jonasbadstuebner in #1492
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1524]
  * Adjust Makefile to new goreleaser 6.0.0 release by
    @felixfontein in #1526
  * build(deps): Bump the go group across 1 directory with 23
    updates by @dependabot in #1525
  * update documentation for age by @tomaszduda23 in #1399
  * exec-file: if --filename is used, use the provided filename
    without random suffix by @felixfontein in #1474
  * build(deps): Bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.5.2 to
    1.6.0 by @dependabot in #1528
  * Do not use DotEnv store for exec-env, but specialized
    environment serializing code by @felixfontein in #1436
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1534]
  * Decryption: do not fail if no matching creation_rule is present
    in config file by @felixfontein in #1434
  * add filestatus command by @endorama in #545
  * build(deps): Bump the go group across 1 directory with 16
    updates by @dependabot in #1540
  * build(deps): Bump the go group across 1 directory with 4
    updates by @dependabot in #1543
  * add command unset by @duthils in #1475
  * Update sops.go comment by @rjeczkow in #1544
  * Support using comments to select parts to encrypt by
    @felixfontein in #1392
  * Feature: merge key for key groups and make keys unique by
    @jonasbadstuebner in #1493
  * Update all go deps by @felixfontein in #1545
  * Release 3.9.0 by @felixfontein in #1546</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728216000">- Update to version 3.9.1:
  * Add missing newlines.
  * Add changelog for 3.9.1.
  * Bump version to 3.9.1.
  * Do not ignore errors when trying to parse a config file.
  * Update all go deps with 'go get -t -u ./...'.
  * build(deps): Bump the rust group in /functional-tests with 5
    updates
  * build(deps): Bump the go group with 7 updates
  * Add Cargo.lock for better reproducability of functional tests.
  * build(deps): Bump the go group with 7 updates
  * build(deps): Bump the ci group with 2 updates
  * Dependabot: fix config for Docker, add config for Rust/Cargo.
  * Show changes in shamir_threshold when updating keys.
  * Do not encrypt if a key group is empty, or there are no key
    groups.
  * Fix checkout action version.
  * Use Go version from go.mod.
  * Build release with Go 1.22.x.
  * Allow edit subcommand to create files.
  * Build 1.22 1.23 because 1.21 is unsupported without security
    fixes
  * Review: Add test "matrix" but only for 1.22
  * feat(build): Build last 2 Go versions
  * refactor: specify missing file in error message
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 10 updates
  * Add 'check' task to CI that makes sure everything is green.
  * sops_test: add more tests on errors
  * sops_test: homogenize use of asserts
  * tests: add coverage for unset
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 4 updates
  * Fix `--config` being ignored by `loadConfig`
  * github actions: set rust version globally
  * linters: pin version of Rust
  * functional tests: formatting lint
  * github actions: add Rust linter
  * Added example of having age recipients in .sops.yaml
  * Actually use option --shamir-secret-sharing-threshold.
  * build(deps): Bump github.com/opencontainers/runc from 1.1.13 to
    1.1.14
  * build(deps): Bump the go group with 12 updates
  * tests: ignore env var SOPS_AGE_KEY_FILE
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 7 updates
  * build(deps): Bump the ci group with 2 updates
  * Bump go version.
  * build(deps): Bump the go group across 1 directory with 15
    updates
  * build(deps): Bump the ci group with 2 updates
  * Use ReST admonition syntax for note
  * Note on the name of the configuration file
  * build(deps): Bump the ci group with 3 updates
  * build(deps): Bump github.com/docker/docker
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 5 updates
  * build(deps): Bump github.com/docker/docker
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 4 updates
  * build(deps): Bump the ci group across 1 directory with 5
    updates
  * build(deps): Bump the go group with 5 updates
  * build(deps): Bump the ci group with 3 updates
  * build(deps): Bump the go group with 10 updates
  * build(deps): Bump the go group with 11 updates
  * build(deps): Bump the ci group with 4 updates
  * Fix the URL used for determining the latest SOPS version.
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 8 updates
  * Explicitly mark goreleaser's version, to avoid confusion with
    the Go version.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- Update to version 3.9.2:
  * Add changelog for 3.9.2.
  * Bump version to 3.9.2.
  * build(deps): Bump the go group with 8 updates
  * Update go.mod.
  * Adjust protoc command line for latest versions of plugins; fix
    protoc Go plugin versions and install plugins locally.
  * keyservice: update protobuf to an recent release
  * fix(config): remove unused variables
  * chore(deps): Update Rust dependencies
  * Correctly handle comments during JSON serialization.
  * Move Python patch tool to .github/utils/.
  * Run 'make vendor' in CodeQL build step.
  * Patch harmless parts of go.mod before looking for changes in
    CI.
  * build(deps): Bump the go group across 1 directory with 18
    updates
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the rust group in /functional-tests with 3
    updates
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the ci group across 1 directory with 3
    updates
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the ci group with 5 updates
  * build(deps): Bump the go group with 7 updates
  * fix(azkv): handle whitespace in Azure Key Vault URLs
  * build(deps): Bump serde_json in /functional-tests in the rust
    group
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 6 updates
  * build(deps): Bump the ci group with 5 updates
  * build(deps): Bump the go group with 12 updates
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump the go group with 11 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1735732800">- Update to version 3.9.3:
  * Add changelog for 3.9.3.
  * Bump version to 3.9.3.
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * Run 'make vendor'.
  * Update all dependencies with 'go get -t -u ./...'.
  * Fix input-type CLI flag being ignored for updatekeys
    subcommand.
  * Use container images from
    https://github.com/getsops/ci-container-images.
  * Document using subkeys with GnuPG.
  * Correctly handle trailing "!" when passing shortened
    fingerprints to GnuPG.
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump serde_json in /functional-tests in the rust
    group
  * build(deps): Bump the go group across 1 directory with 13
    updates
  * Bump golang.org/x/net to 0.33.0 to address CVE-2024-45338.
  * build(deps): Bump filippo.io/age from 1.2.0 to 1.2.1
  * Add 'persist-credentials: false' to checkout actions.
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump golang.org/x/crypto from 0.30.0 to 0.31.0
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 10 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737892800">- Update to version 3.9.4:
  * build(deps): Bump the go group with 5 updates by @dependabot in
    [#1727]
  * build(deps): Bump tempfile from 3.14.0 to 3.15.0 in
    /functional-tests in the rust group by @dependabot in #1728
  * build(deps): Bump the go group with 16 updates by @dependabot
    in #1732
  * build(deps): Bump the ci group with 3 updates by @dependabot in
    [#1730]
  * build(deps): Bump serde_json from 1.0.134 to 1.0.135 in
    /functional-tests in the rust group by @dependabot in #1731
  * build(deps): Bump the go group with 12 updates by @dependabot
    in #1734
  * build(deps): Bump serde_json from 1.0.135 to 1.0.137 in
    /functional-tests in the rust group by @dependabot in #1735
  * Fix ToString for AWS KMS to include role, context, and profile
    by @felixfontein in #1733
  * build(deps): Bump the ci group with 3 updates by @dependabot in
    [#1738]
  * build(deps): Bump the go group with 6 updates by @dependabot in
    [#1739]
  * Release 3.9.4 by @felixfontein in #1740</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743422400">- Update to version 3.10.0:
  * build(deps): Bump alpine from 3.18 to 3.21 in /.release in the
    docker group across 1 directory by @dependabot in #1700
  * Convert changelog to MarkDown by @felixfontein in #1741
  * build(deps): Bump the go group with 7 updates by @dependabot in
    [#1743]
  * build(deps): Bump the go group with 9 updates by @dependabot in
    [#1745]
  * build(deps): Bump the rust group in /functional-tests with 2
    updates by @dependabot in #1744
  * build(deps): Bump github/codeql-action from 3.28.5 to 3.28.8 in
    the ci group by @dependabot in #1746
  * build(deps): Bump the go group with 12 updates by @dependabot
    in #1751
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1750]
  * Add --input-type option for filestatus subcommand by
    @felixfontein in #1601
  * Use SOPS_EDITOR before EDITOR by @felixfontein in #1611
  * Allow users to disable version check via environment variable
    by @nicklasfrahm in #1684
  * add duplicate section support to ini store by @reindlt in #1452
  * stores: test for duplicate keys, reserve keyword (yaml only
    now) by @holiman in #1203
  * Add same process option for exec-env by @ricmatsui in #880
  * outputs: add trailing newline at the end of JSON files by
    @duthils in #1476
  * set subcommand: add --idempotent flag that will not write the
    file if no change happened by @felixfontein in #1754
  * Encrypt and decrypt time.Time objects by @felixfontein in #1759
  * build(deps): Bump the go group with 8 updates by @dependabot in
    [#1763]
  * build(deps): Bump tempfile from 3.16.0 to 3.17.0 in
    /functional-tests in the rust group by @dependabot in #1762
  * build(deps): Bump goreleaser/goreleaser-action from 6.1.0 to
    6.2.1 in the ci group by @dependabot in #1761
  * fix(docs): typo in README.rst by @Paredev in #1765
  * Add SSH support for age by @haoqixu in #1692
  * make sure that tests do not pick keys.txt from user's HOME dir
    by @tomaszduda23 in #1766
  * support for age identity with passphrase by @tomaszduda23 in
    [#1400]
  * build(deps): Bump the rust group in /functional-tests with 4
    updates by @dependabot in #1768
  * build(deps): Bump the go group with 12 updates by @dependabot
    in #1769
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1770]
  * build(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.4 to
    4.0.5 by @dependabot in #1773
  * feat: add age plugin support by @brianmcgee in #1641
  * Check GnuPG decryption result for non-empty size by
    @felixfontein in #1776
  * vendored age code: consolidate passphrase reading functionality
    by @felixfontein in #1775
  * Allow to encrypt and decrypt from stdin by @felixfontein in
    [#1690]
  * build(deps): Bump the go group with 11 updates by @dependabot
    in #1784
  * build(deps): Bump the ci group with 5 updates by @dependabot in
    [#1782]
  * build(deps): Bump serde_json from 1.0.139 to 1.0.140 in
    /functional-tests in the rust group; bump Rust to 1.85.0 by
    @dependabot in #1783
  * build(deps): Bump the go group with 13 updates by @dependabot
    in #1797
  * build(deps): Bump the rust group in /functional-tests with 3
    updates by @dependabot in #1796
  * build(deps): Bump github/codeql-action from 3.28.10 to 3.28.11
    in the ci group by @dependabot in #1795
  * build(deps): Bump the go group with 6 updates by @dependabot in
    [#1802]
  * build(deps): Bump tempfile from 3.18.0 to 3.19.0 in
    /functional-tests in the rust group by @dependabot in #1800
  * build(deps): Bump docker/login-action from 3.3.0 to 3.4.0 in
    the ci group by @dependabot in #1801
  * build(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to
    5.2.2 by @dependabot in #1806
  * goreleaser: add windows arm64 by @duthils in #1791
  * Add a way to set sops config location via envvar by @sledzikowy
    in #1701
  * build(deps): Bump the go group with 3 updates by @dependabot in
    [#1809]
  * build(deps): Bump the ci group with 5 updates by @dependabot in
    [#1808]
  * build(deps): Bump tempfile from 3.19.0 to 3.19.1 in
    /functional-tests in the rust group by @dependabot in #1807
  * Support --config option in publish subcommand by @felixfontein
    in #1779
  * Fix caching of Metadata.DataKey by @felixfontein in #1781
  * Lint by @felixfontein in #1780
  * updatekeys subcommand: rename GroupQuorum to ShamirThreshold by
    @felixfontein in #1631
  * If --filename-override is specified, convert it to an absolute
    path same as regular filenames by @felixfontein in #1793
  * Add support for oauth2.TokenSource in GCP KMS by @matheuscscp
    in #1794
  * Added SOPS_AGE_KEY_CMD option to age, fixes #1323 by
    @danilobuerger in #1811
  * chore: omitempty metadata to reduce the size of stored config
    by @cgetzen in #1571
  * Improve Shamir Secret Sharing code by @felixfontein in #1813
  * Update all dependencies by @felixfontein in #1814
  * Run 'gofmt -w' on all .go files by @felixfontein in #1817
  * Add option to explicitly check for the latest version;
    deprecate current default of always doing that unless disabled
    by @felixfontein in #1816
  * Build using Go 1.24 and drop support for 1.22 by @hiddeco in
    [#1819]
  * Support GOOGLE_OAUTH_ACCESS_TOKEN for Google Cloud Platform by
    @marensofier in #1578
  * Warn about .sops.yml files found while searching for .sops.yaml
    by @felixfontein in #1820
  * Release 3.10.0 by @felixfontein in #1815
  * Added support for multiarch windows release binaries by
    @sabre1041 in #1823</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743422401">- Update to version 3.10.1:
  * Add changelog.
  * Bump version to 3.10.1.
  * build(deps): Bump the ci group with 2 updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744804800">- Update to version 3.10.2:
  * build(deps): Bump the go group with 13 updates by @dependabot
    in #1834
  * Use latest 1.24 Go version for release build by @hiddeco in
    [#1836]
  * Remove reserved keyword check from YAML store's LoadPlainFile()
    by @felixfontein in #1829
  * build(deps): Bump the go group with 9 updates by @dependabot in
    [#1839]
  * build(deps): Bump github/codeql-action from 3.28.13 to 3.28.15
    in the ci group by @dependabot in #1840
  * Release 3.10.2 release by @felixfontein in #1841</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1759147200">- Update to version 3.11.0:
  * Bump version to 3.11.0.
  * Add changelog for 3.11.0.
  * Address review comments.
  * Move dotenv.IsComplexValue to stores.
  * Do not put sensitive value into error message when the key can
    be printed as well.
  * Apply review suggestions.
  * AZKV: Also allow to omit version for AZKV keys specified in key
    groups.
  * Make SingleValueStore extend Store instead of the other way
    around.
  * Ignore encryption selection options for binary store (and warn
    when they are used).
  * build(deps): Bump the go group across 1 directory with 10
    updates
  * Get rid of conf variable.
  * When encrypting, load the config only once.
  * build(deps): Bump the go group across 1 directory with 21
    updates
  * Build with Go 1.24 and 1.25, release with 1.25.
  * Improve formulations.
  * Add YAML keys for all keys in a key group.
  * Get rid of some unrelated tabs.
  * Document (most of) the SOPS config format.
  * build(deps): Bump anchore/sbom-action in the ci group
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the rust group in /functional-tests with 4
    updates
  * Fix grammar.
  * Always load age identities from all locations, and report
    unused locations in error messages.
  * Fix mention of macOS XDG_CONFIG_HOME fallback.
  * Allow for non-string values in exec-env
  * Avoid panic when values are numbers
  * Fix argument order.
  * Move ValToString to stores.
  * Improve formatting of floats.
  * Add tests.
  * Fix converting integers to strings. Also improve time.Time
    formatting.
  * Update azkv/keysource.go
  * build(deps): Bump the ci group with 2 updates
  * fix: correct destination validation logic to detect all
    conflicts
  * Switch from deprecated gopkg.in/yaml.v3 to go.yaml.in/yaml/v3
  * feat(azkv): Skipping key-version will get latest key
  * Allow to configure --enable-local-keyservice and --keyservice
    through env variables.
  * Remove paragraph on GPG/PGP keyservers.
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the go group with 14 updates
  * build(deps): Bump github.com/go-viper/mapstructure/v2
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump the go group with 9 updates
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump the go group with 15 updates
  * Fix keyservice client for unix domain sockets
  * Fix example.yaml.
  * Addressing felixfontein's latest review. Adds a key type field
    to the ParseKeyField fn.
  * Resolves #1864. Adds Native List as an option for configuring
    keys in addition to the trailing comma option already given.
  * Resolves #1864. Adds Native List as an option for configuring
    keys in addition to the trailing comma option already given.
  * Collect age identity loading errors and only report if
    decryption failed.
  * Document #1876 and --value-stdin.
  * Add --value-stdin option to 'sops set'.
  * Ensure temporary file for editing is only read-writable by
    owner.
  * Mention all stores in various places.
  * build(deps): Bump the ci group with 3 updates
  * build(deps): Bump serde_json in /functional-tests in the rust
    group
  * build(deps): Bump the go group with 12 updates
  * update completion command usage description
  * add source link for completion snippet
  * Also parse floating point numbers if they represent integers.
  * Store floating point number without decimal places.
  * Fix Shamir threshold encoding for INI and ENV files.
  * double backticks on configuration directory list 2/2
  * double backticks on configuration directory list 1/2
  * Document XDG_CONFIG_HOME support on mac
  * Add "--value-file" option to "sops set [...]"
  * build(deps): Bump the go group with 6 updates
  * add completion script. Resolves #1868
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 3 updates
  * Correct Windows path to store keys.txt
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 4 updates
  * build(deps): Bump github.com/go-viper/mapstructure/v2
  * Fix Typo in README.rst
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 8 updates
  * build(deps): Bump the ci group across 1 directory with 3
    updates
  * build(deps): Bump the go group with 12 updates
  * build(deps): Bump github.com/cloudflare/circl from 1.6.0 to
    1.6.1
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 12 updates
  * build(deps): Bump alpine in /.release in the docker group
  * build(deps): Bump the go group with 4 updates
  * Remove unmatched '`' from README.rst
  * build(deps): Bump the go group with 7 updates
  * Update authors in main.go
  * Allow injecting custom HTTP client for AWS, Azure, GCP and
    HashiCorp Vault
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 5 updates
  * Introduce EncryptContext and DecryptContext for AWS, Azure,
    GCP, PGP and HashiCorp Vault
  * Apply suggestions from code review.
  * build(deps): Bump actions/setup-go from 5.4.0 to 5.5.0 in the
    ci group
  * build(deps): Bump tempfile in /functional-tests in the rust
    group
  * build(deps): Bump the go group with 8 updates
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump the go group with 5 updates
  * build(deps): Bump the go group with 4 updates
  * add newline before sublist start
  * add newline before sublist start
  * use bullet points for structure</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 3.12.1 (.0 was not released):
  * Features:
  - Add support for HuaweiCloud KMS (#2001).
  - GCP KMS: Add SOPS_GCP_KMS_CLIENT_TYPE environment variable
    support to select between gRPC and REST clients (#1973).
  - Age: support hybrid post-quantum identities (#2033).
  - Age: pass SOPS_AGE_RECIPIENT environment variable to
    SOPS_AGE_KEY_CMD (#2045).
  - Age: add SOPS_AGE_SSH_PRIVATE_KEY_CMD environment variable
    (#2070).
  * Improvements:
  - Dependency updates (#1967, #1971, #1978, #1986, #1988, #1991,
    [#1993], #2002, #2004, #2007, #2012, #2018, #2024, #2029,
    [#2037], #2043, #2047, #2050, #2059, #2074, #2078).
  - Fix mistakes in --help output (#1975, #1963).
  - Improve documentation (#1997).
  - Unset user's GNUPGHOME environment variable for tests
    (#2052).
  - Use age's plugin.NewTerminalUI() instead of vendoring the
    code (#2034).
  - Remove dead code during YAML loading (#2072).
  - Build release with Go 1.26 (#2071).
  * Bugfixes:
  - Add --decryption-order flag to exec-env, exec-file, and
    publish commands. The subcommand code was using the flags,
    but it wasn't declared (#1965).
  - Fix AWS KMS encryption context not being passed when config
    is pre-loaded (#2021).
  - Fix recursive publish (#2019).
  - Set quota project to API project in GCP KMS (#1697).
  - DotEnv store now properly reports missing metadata (#2055).
  - AWS KMS: allow role splitting without hard-coded aws
    partition (#2042).
  * Project changes:
  - Add Go 1.26 to CI (#2071).
  - CI dependency updates (#1961, #1966, #1970, #1979, #1985,
    [#1989], #1992, #2003, #2006, #2010, #2011, #2017, #2023,
    [#2028], #2038, #2044, #2046, #2049, #2058, #2075).
  - Rust dependency updates for functional tests (#1962, #2027,
    [#2035], #2073).</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773835200">- Update to version 3.12.2:
  * Set version to 3.12.2.
  * Add 3.12.2 changelog entry.
  * Revert "Merge pull request #1697 from onjen/fix-1142"
  * build(deps): Bump tempfile in /functional-tests in the rust
    group
  * build(deps): Bump the ci group with 4 updates
  * Delete temporary file on termination.
  * At least on Linux, you need to press Enter.
  * Refactor loop.
  * Uniformly check file before encrypting.
  * build(deps): Bump the ci group with 4 updates
  * fix: handle mac only encrypted flag in global
  * build(deps): Bump github.com/docker/cli
  * build(deps): Bump tempfile in /functional-tests in the rust
    group
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0
  * build(deps): Bump github.com/cloudflare/circl from 1.6.1 to
    1.6.3
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 6 updates
  * Rearrange CI steps; disable setup-go's caching.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778414400">- Update to version 3.13.0:
  * Bump version to 3.13.0.
  * Add 3.13.0 changelog.
  * Re-add some of Hidde's comments.
  * Handle empty branch in `convert`
  * Drop unused newline-escaping helpers
  * Drop redundant `SopsPrefix` constant in dotenv store
  * Compact comment-skipping in `sopsToGoSlice`
  * Apply review nits to metadata helpers
  * Fix age key in tests.
  * Apply first suggestions from Hidde's review.
  * Replace unflattening algorithm.
  * Also move tests.
  * Better separation.
  * Remove code unrelated to (un-)flattening to other file.
  * Make internal metadata type private.
  * Remove old (de-)serialization.
  * Remove old flattening code.
  * Add common code to encode and decode metadata.
  * Use mapstructure for parsing.
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 5 updates
  * Also append '/' to address to test.
  * Add documentation.
  * Allow to skip all Docker tests.
  * Add allowlist for HashiCorp Vault URLs.
  * Allow to have space-separated keys in SOPS_AGE_KEY.
  * Update all Go dependencies with 'go get -t -u ./...'
  * build(deps): Bump goreleaser/goreleaser-action in the ci group
  * build(deps): Bump the go group with 3 updates
  * Obtain `--indent` global flag value and pass it to store
    configs
  * Reject non-local paths.
  * Improve error handling.
  * Make sure to set GID to correct value instead of UID.
  * build(deps): Bump the go group with 12 updates
  * chore(docs): update broken link
  * build(deps): Bump the ci group with 3 updates
  * Update release for cosign v3
  * build(deps): Bump the go group across 1 directory with 21
    updates
  * build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to
    1.43.0
  * Drop support for Go 1.24.
  * Use prefixed and truncated key hash instead of location as GPG
    agent cache key.
  * build(deps): Bump actions/upload-artifact in the ci group
  * Add newline.
  * docs: add get key permission requirement for Azure Key Vault
    when version is omitted
  * build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * fix: preserve trailing inline comments in YAML emit when no
    items follow
  * test: add nested inline comment roundtrip test
  * fix: preserve YAML inline comments through encrypt/edit
    roundtrip
  * docs: move JSON top-level array note to appropriate section
  * build(deps): Bump docker/login-action in the ci group
  * fix(json): improve error message for top-level arrays (fixes
    [#1974])
  * build(deps): Bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4
  * fix(gcpkms): address review comments on sovereign cloud KMS
    support
  * build(deps): Bump the ci group with 3 updates
  * build(deps): Bump the ci group with 3 updates
  * feat(gcpkms): add SOPS_GCP_KMS_ENDPOINT and
    SOPS_GCP_KMS_UNIVERSE_DOMAIN env vars
  * build(deps): Bump google.golang.org/grpc from 1.79.1 to 1.79.3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 3.13.1:
  * Fix minimum Go version in contributor docs.
  * Redirect documentation to getsops.io.
  * Bump Go version in contributing docs.
  * Redirect documentation changes to getsops/docs.
  * Avoid percent-encoding of cache key to blow up size &gt; 50
    characters.
  * Apply 'gofmt -w -s' to all .go files.
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 9 updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782907200">- Update to version 3.13.2:
  * build(deps): Bump the go group with 3 updates by
    @dependabot[bot] in #2185
  * build(deps): Bump github/codeql-action from 4.35.4 to 4.35.5 in
    the ci group by @dependabot[bot] in #2184
  * build(deps): Bump the go group with 11 updates by
    @dependabot[bot] in #2193
  * build(deps): Bump the ci group with 4 updates by
    @dependabot[bot] in #2192
  * build(deps): Bump serde_json from 1.0.149 to 1.0.150 in
    /functional-tests in the rust group by @dependabot[bot] in
    [#2191]
  * build(deps): Bump the go group with 11 updates by
    @dependabot[bot] in #2197
  * build(deps): Bump docker/setup-qemu-action from 4.0.0 to 4.1.0
    in the ci group by @dependabot[bot] in #2196
  * test: unset all age env vars in make test target by
    @arpitjain099 in #2208
  * build(deps): Bump the go group with 10 updates by
    @dependabot[bot] in #2212
  * build(deps): Bump the ci group with 2 updates by
    @dependabot[bot] in #2211
  * build(deps): Bump the go group with 15 updates by
    @dependabot[bot] in #2218
  * build(deps): Bump alpine from 3.23 to 3.24 in /.release in the
    docker group by @dependabot[bot] in #2217
  * fix: handle pointers when serializing context by @tlercher in
    [#2219]
  * docs: fix typo in exec-file --filename help text by @s3onghyun
    in #2221
  * JSON store: preserve large integers that fit into int64 by
    @s3onghyun in #2222
  * Fix panic when expecting an encrypted string, but a non-string
    is encountered by @felixfontein in #2227
  * Fix INI store no longer double-encoding newlines by
    @felixfontein in #2189
  * exec-file/exec-env: reset supplementary groups when changing
    user by @felixfontein in #2194
  * build(deps): Bump the go group with 6 updates by
    @dependabot[bot] in #2229
  * build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 in the
    ci group by @dependabot[bot] in #2228
  * Fix issue when changing user in exec subcommands by @sabre1041
    in #2230
  * Shorten .md lines by @felixfontein in #2206
  * Update all Go dependencies with go get -t -u ./... by
    @felixfontein in #2231
  * build(deps): Bump github.com/opencontainers/runc from 1.2.8 to
    1.3.6 by @dependabot[bot] in #2233
  * build(deps): Bump the ci group with 2 updates by
    @dependabot[bot] in #2236
  * Release 3.13.2 by @felixfontein in #2232</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 3.13.3:
  * Add ini to supported input/output type descriptions by
    @TheKhanj in #2239
  * build(deps): Bump the go group with 10 updates by
    @dependabot[bot] in #2242
  * build(deps): Bump the ci group with 6 updates by
    @dependabot[bot] in #2241
  * fix: include decrypted sequence comments in the MAC (fixes
    [#2243]) by @cbcoutinho in #2245
  * build(deps): Bump the go group with 14 updates by
    @dependabot[bot] in #2251
  * build(deps): Bump the ci group with 2 updates by
    @dependabot[bot] in #2250
  * build(deps): Bump the go group with 11 updates by
    @dependabot[bot] in #2261
  * build(deps): Bump the ci group with 3 updates by
    @dependabot[bot] in #2260
  * build(deps): Bump the rust group in /functional-tests with 3
    updates by @dependabot[bot] in #2259
  * Update dependencies with 'go get -t -u ./...' by @felixfontein
    in #2248
  * Completion scripts: remove leading newline by @felixfontein in
    [#2253]</changelog>
</package>
<package pkgid="58c1d338ca87fc19010ccefd49e4fe9297949d90ab715175a1a5b8a5671924397a4c9fafa73ee84a397876a5bf9e10de90c5d2ac7747c99e83e8766cb07ee210" name="sops-debuginfo" arch="s390x">
  <version epoch="0" ver="3.13.3" rel="44.2"/>
  <changelog author="Johannes Kastl &lt;kastl@b1-systems.de&gt;" date="1695643200">- update to 3.8.0:
  * Features:
  - Support --version without network requests using
  - -disable-version-check (#1115)
  - Support --input-type for updatekeys command (#1116)
  * Improvements:
  - pgp: modernize and improve, and add tests (#1054, #1282)
  - azkv: update SDK to latest, add tests, tidy (#1067, #1092,
    [#1256])
  - age: improve identity loading, add tests, tidy (#1064)
  - kms: AWS SDK V2, allow creds config, add tests (#1065, #1257)
  - gcpkms: update SDK to latest, add tests, tidy (#1072, #1255)
  - hcvault: update API, add tests, tidy (#1085)
  - Do not report version when upstream --version check fails
    (#1124)
  - Use GitHub endpoints in --version command (#1261)
  - Close temporary file before invoking editor to widen support
    on Windows (#1265)
  - Update dependencies (#1063, #1091, #1147, #1242, #1260,
    [#1264], #1275, #1280, #1283)
  - Deal with various deprecations of dependencies (#1113, #1262)
  * Bug fixes:
  - Ensure YAML comments are not displaced (#1069)
  - Ensure default Google credentials can be used again after
    introduction of GOOGLE_CREDENTIALS (#1249)
  - Avoid duplicate logging of errors in some key sources (#1146,
    [#1281])
  - Using --set on a root level key does no longer truncate
    existing values (#899)
  - Ensure stable order of SOPS parameters in dotenv file (#1101)
  * Project changes:
  - Update Go to 1.20 (#1148)
  - Update rustc functional tests to v1.70.0 (#1234)
  - Remove remaining CircleCI workflow (#1237)
  - Run CLI workflow on main (#1243)
  - Delete obsolete validation/ artifact (#1248)
  - Rename Go module to github.com/getsops/sops/v3 (#1247)
  - Revamp release automation, including (Cosign) signed
    container images and checksums file, SLSA3 provenance and
    SBOMs (#1250)
  - Update various bits of documentation (#1244)
  - Add missing --encrypt flag from Vault example (#1060)
  - Add documentation on how to use age in .sops.yaml (#1192)
  - Improve Make targets and address various issues (#1258)
  - Ensure clean working tree in CI (#1267)
  - Fix CHANGELOG.rst formatting (#1269)
  - Pin GitHub Actions to full length commit SHA and add CodeQL
    (#1276)
  - Enable Dependabot for Docker, GitHub Actions and Go Mod
    (#1277)
  - Generate versioned .intoto.jsonl (#1278)
  - Update CI dependencies (#1279)</changelog>
  <changelog author="Johannes Kastl &lt;kastl@b1-systems.de&gt;" date="1696420800">- fix broken sops executable (sorry...)</changelog>
  <changelog author="kastl@b1-systems.de" date="1697112000">- Update to version 3.8.1:
  * Release v3.8.1
  * Update dependencies
  * Add section in CONTRIBUTING.md on docs changes.
  * Add checkdocs, checkrst, and checkmd make targets.
  * Add workflow for rstcheck and mdl.
  * Change some SOPSs back to sops.
  * Normalize SOPS usages.
  * Normalize indentation for code blocks and YAML files.
  * Improve MD files (with mdl feedback).
  * Improve RST files (with rstcheck feedback).
  * pgp: further improve import error format
  * pgp: better error reporting for missing GPG binary
  * docs: document AWS environment variables
  * build(deps): Bump the go group with 7 updates
  * Make sure to wrap raw errors with toExitError().
  * Report key rotation errors.
  * Check err for nil in tests.
  * Defer only after checking err.
  * Handle unhandled errors.
  * Ignore irrelevant return value (it is always nil).
  * decrypt: fix dropped error
  * pgp: do not require abs path for SopsGpgExecEnv
  * Make error the last return value
  * Handle return values of dec.Token() to improve error messages.
  * Fix versions in comments
  * build(deps): Bump the ci group with 1 update
  * build(deps): Bump the go group with 4 updates
  * Fix descriptions of unencrypted-regex and encrypted-regex
    flags.
  * Reject completely empty documents.
  * On macOS, prefer XDG_CONFIG_HOME over os.UserConfigDir()
  * Improve handling of errors when binary store handles bad data
  * Delete sops encrypted file we don't have keys for.
  * pgp: remove `--no-default-keyring` argument
  * pgp: improve handling of GnuPG home dir
  * build(deps): Bump the ci group with 3 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1720008000">- Update to version 3.9.0:
  * Respect aws_profile from Keygroup Config by @Kouzukii in #1049
  * build(deps): Bump the go group with 6 updates by @dependabot in
    [#1327]
  * build(deps): Bump the go group with 3 updates by @dependabot in
    [#1328]
  * build(deps): Bump the go group with 1 update by @dependabot in
    [#1330]
  * build(deps): Bump github.com/docker/docker from
    20.10.24+incompatible to 24.0.7+incompatible by @dependabot in
    [#1336]
  * build(deps): Bump the go group with 3 updates by @dependabot in
    [#1334]
  * Improve README.rst by @Ph0tonic in #1339
  * Fix typos by @felixfontein in #1337
  * build(deps): Bump the go group with 7 updates by @dependabot in
    [#1344]
  * Add --mac-only-encrypted to compute MAC only over values which
    end up encrypted by @mitar in #973
  * build(deps): Bump the ci group with 1 update by @dependabot in
    [#1347]
  * build(deps): Bump the go group with 7 updates by @dependabot in
    [#1348]
  * README: Correctly tag code as yaml-stream by @felixfontein in
    [#1350]
  * build(deps): Bump the go group with 5 updates by @dependabot in
    [#1354]
  * use getUserConfigDir also in tests by @bkreitch in #1346
  * Overwrite home dir in vault test by @bkreitch in #1349
  * Allow configuration of indentation for YAML and JSON stores by
    @Ph0tonic in #1273
  * build(deps): Bump github.com/go-jose/go-jose/v3 from 3.0.0 to
    3.0.1 by @dependabot in #1357
  * build(deps): Bump the go group with 4 updates by @dependabot in
    [#1360]
  * build(deps): Bump the ci group with 1 update by @dependabot in
    [#1359]
  * Fix TestGnuPGHome_Validate by @stormentt in #1370
  * build(deps): Bump the go group with 6 updates by @dependabot in
    [#1373]
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1376]
  * Docs: indent is used both for encryption and decryption by
    @felixfontein in #1372
  * fix a bug where not having a config results in a panic by
    @stormentt in #1371
  * Polish the 'sops help' output a bit by @felixfontein in #1341
  * introduce a --pristine flag to sops exec-env by @e-nikolov in
    [#912]
  * Allow to pass multiple paths to 'updatekeys' by @sj14 in #1274
  * Warn/fail if the wrong number of arguments is provided by
    @felixfontein in #1342
  * Allow to override fileName with different value by
    @felixfontein in #1332
  * Sort masterkeys according to decryption-order by @bkreitch in
    [#1345]
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1382]
  * build(deps): Bump the go group with 5 updates by @dependabot in
    [#1381]
  * Deprecate the --background option to exec-env and exec-file by
    @felixfontein in #1379
  * build(deps): Bump golang.org/x/crypto from 0.16.0 to 0.17.0 by
    @dependabot in #1383
  * build(deps): Bump the ci group with 1 update by @dependabot in
    [#1386]
  * build(deps): Bump the go group with 5 updates by @dependabot in
    [#1385]
  * Consolidate Flatten/Unflatten pre/post processing by
    @lancerushing in #1356
  * INI, DotEnv stores: shamir_threshold is an integer by
    @felixfontein in #1394
  * Improve integration tests: reformat test code, make sure exit
    codes are always checked by @felixfontein in #1390
  * Make check whether file contains invalid keys for encryption
    dependent on output store by @felixfontein in #1393
  * Create a constant for the 'sops' metadata key by @felixfontein
    in #1398
  * build(deps): Bump github.com/cloudflare/circl from 1.3.3 to
    1.3.7 by @dependabot in #1408
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1425]
  * build(deps): Bump github.com/opencontainers/runc from 1.1.5 to
    1.1.12 by @dependabot in #1428
  * build(deps): Bump the go group with 10 updates by @dependabot
    in #1429
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1432]
  * Warn if more than one command is used by @felixfontein in #1388
  * Move extraction of encryption and rotation options to separate
    functions by @felixfontein in #1389
  * Add separate subcommands for encryption, decryption, rotating,
    editing, and setting values by @felixfontein in #1391
  * Add basic tests for exec-env and exec-file by @felixfontein in
    [#1396]
  * build with go 1.21 and update dependencies by @b-dean in #1427
  * build(deps): Bump the go group with 4 updates by @dependabot in
    [#1439]
  * sops: fix typo in interface name by @duthils in #1477
  * Fix function name in comment by @pullmerge in #1484
  * build(deps): Bump the ci group across 1 directory with 9
    updates by @dependabot in #1498
  * build(deps): Bump github.com/go-jose/go-jose/v3 from 3.0.1 to
    3.0.3 by @dependabot in #1454
  * build(deps): Bump google.golang.org/protobuf from 1.32.0 to
    1.33.0 by @dependabot in #1460
  * build(deps): Bump github.com/docker/docker from
    24.0.7+incompatible to 24.0.9+incompatible by @dependabot in
  [#1466]
  * build(deps): Bump golang.org/x/net from 0.21.0 to 0.23.0 by
    @dependabot in #1489
  * build(deps): Bump actions/setup-go from 5.0.0 to 5.0.1 in the
    ci group by @dependabot in #1503
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1508]
  * LoadCreationRuleForFile: correctly handle nil without error in
    callers by @felixfontein in #1506
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1510]
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1516]
  * Fix CVE-2024-2660 by @TheoBrigitte in #1519
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1521]
  * fix(Makefile): set locale to make tests pass by
    @jonasbadstuebner in #1492
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1524]
  * Adjust Makefile to new goreleaser 6.0.0 release by
    @felixfontein in #1526
  * build(deps): Bump the go group across 1 directory with 23
    updates by @dependabot in #1525
  * update documentation for age by @tomaszduda23 in #1399
  * exec-file: if --filename is used, use the provided filename
    without random suffix by @felixfontein in #1474
  * build(deps): Bump
    github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.5.2 to
    1.6.0 by @dependabot in #1528
  * Do not use DotEnv store for exec-env, but specialized
    environment serializing code by @felixfontein in #1436
  * build(deps): Bump the ci group with 2 updates by @dependabot in
    [#1534]
  * Decryption: do not fail if no matching creation_rule is present
    in config file by @felixfontein in #1434
  * add filestatus command by @endorama in #545
  * build(deps): Bump the go group across 1 directory with 16
    updates by @dependabot in #1540
  * build(deps): Bump the go group across 1 directory with 4
    updates by @dependabot in #1543
  * add command unset by @duthils in #1475
  * Update sops.go comment by @rjeczkow in #1544
  * Support using comments to select parts to encrypt by
    @felixfontein in #1392
  * Feature: merge key for key groups and make keys unique by
    @jonasbadstuebner in #1493
  * Update all go deps by @felixfontein in #1545
  * Release 3.9.0 by @felixfontein in #1546</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1728216000">- Update to version 3.9.1:
  * Add missing newlines.
  * Add changelog for 3.9.1.
  * Bump version to 3.9.1.
  * Do not ignore errors when trying to parse a config file.
  * Update all go deps with 'go get -t -u ./...'.
  * build(deps): Bump the rust group in /functional-tests with 5
    updates
  * build(deps): Bump the go group with 7 updates
  * Add Cargo.lock for better reproducability of functional tests.
  * build(deps): Bump the go group with 7 updates
  * build(deps): Bump the ci group with 2 updates
  * Dependabot: fix config for Docker, add config for Rust/Cargo.
  * Show changes in shamir_threshold when updating keys.
  * Do not encrypt if a key group is empty, or there are no key
    groups.
  * Fix checkout action version.
  * Use Go version from go.mod.
  * Build release with Go 1.22.x.
  * Allow edit subcommand to create files.
  * Build 1.22 1.23 because 1.21 is unsupported without security
    fixes
  * Review: Add test "matrix" but only for 1.22
  * feat(build): Build last 2 Go versions
  * refactor: specify missing file in error message
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 10 updates
  * Add 'check' task to CI that makes sure everything is green.
  * sops_test: add more tests on errors
  * sops_test: homogenize use of asserts
  * tests: add coverage for unset
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 4 updates
  * Fix `--config` being ignored by `loadConfig`
  * github actions: set rust version globally
  * linters: pin version of Rust
  * functional tests: formatting lint
  * github actions: add Rust linter
  * Added example of having age recipients in .sops.yaml
  * Actually use option --shamir-secret-sharing-threshold.
  * build(deps): Bump github.com/opencontainers/runc from 1.1.13 to
    1.1.14
  * build(deps): Bump the go group with 12 updates
  * tests: ignore env var SOPS_AGE_KEY_FILE
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 7 updates
  * build(deps): Bump the ci group with 2 updates
  * Bump go version.
  * build(deps): Bump the go group across 1 directory with 15
    updates
  * build(deps): Bump the ci group with 2 updates
  * Use ReST admonition syntax for note
  * Note on the name of the configuration file
  * build(deps): Bump the ci group with 3 updates
  * build(deps): Bump github.com/docker/docker
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 5 updates
  * build(deps): Bump github.com/docker/docker
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 4 updates
  * build(deps): Bump the ci group across 1 directory with 5
    updates
  * build(deps): Bump the go group with 5 updates
  * build(deps): Bump the ci group with 3 updates
  * build(deps): Bump the go group with 10 updates
  * build(deps): Bump the go group with 11 updates
  * build(deps): Bump the ci group with 4 updates
  * Fix the URL used for determining the latest SOPS version.
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 8 updates
  * Explicitly mark goreleaser's version, to avoid confusion with
    the Go version.</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1733227200">- Update to version 3.9.2:
  * Add changelog for 3.9.2.
  * Bump version to 3.9.2.
  * build(deps): Bump the go group with 8 updates
  * Update go.mod.
  * Adjust protoc command line for latest versions of plugins; fix
    protoc Go plugin versions and install plugins locally.
  * keyservice: update protobuf to an recent release
  * fix(config): remove unused variables
  * chore(deps): Update Rust dependencies
  * Correctly handle comments during JSON serialization.
  * Move Python patch tool to .github/utils/.
  * Run 'make vendor' in CodeQL build step.
  * Patch harmless parts of go.mod before looking for changes in
    CI.
  * build(deps): Bump the go group across 1 directory with 18
    updates
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the rust group in /functional-tests with 3
    updates
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the ci group across 1 directory with 3
    updates
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the ci group with 5 updates
  * build(deps): Bump the go group with 7 updates
  * fix(azkv): handle whitespace in Azure Key Vault URLs
  * build(deps): Bump serde_json in /functional-tests in the rust
    group
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 6 updates
  * build(deps): Bump the ci group with 5 updates
  * build(deps): Bump the go group with 12 updates
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump the go group with 11 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1735732800">- Update to version 3.9.3:
  * Add changelog for 3.9.3.
  * Bump version to 3.9.3.
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * Run 'make vendor'.
  * Update all dependencies with 'go get -t -u ./...'.
  * Fix input-type CLI flag being ignored for updatekeys
    subcommand.
  * Use container images from
    https://github.com/getsops/ci-container-images.
  * Document using subkeys with GnuPG.
  * Correctly handle trailing "!" when passing shortened
    fingerprints to GnuPG.
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump serde_json in /functional-tests in the rust
    group
  * build(deps): Bump the go group across 1 directory with 13
    updates
  * Bump golang.org/x/net to 0.33.0 to address CVE-2024-45338.
  * build(deps): Bump filippo.io/age from 1.2.0 to 1.2.1
  * Add 'persist-credentials: false' to checkout actions.
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump golang.org/x/crypto from 0.30.0 to 0.31.0
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 10 updates</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1737892800">- Update to version 3.9.4:
  * build(deps): Bump the go group with 5 updates by @dependabot in
    [#1727]
  * build(deps): Bump tempfile from 3.14.0 to 3.15.0 in
    /functional-tests in the rust group by @dependabot in #1728
  * build(deps): Bump the go group with 16 updates by @dependabot
    in #1732
  * build(deps): Bump the ci group with 3 updates by @dependabot in
    [#1730]
  * build(deps): Bump serde_json from 1.0.134 to 1.0.135 in
    /functional-tests in the rust group by @dependabot in #1731
  * build(deps): Bump the go group with 12 updates by @dependabot
    in #1734
  * build(deps): Bump serde_json from 1.0.135 to 1.0.137 in
    /functional-tests in the rust group by @dependabot in #1735
  * Fix ToString for AWS KMS to include role, context, and profile
    by @felixfontein in #1733
  * build(deps): Bump the ci group with 3 updates by @dependabot in
    [#1738]
  * build(deps): Bump the go group with 6 updates by @dependabot in
    [#1739]
  * Release 3.9.4 by @felixfontein in #1740</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743422400">- Update to version 3.10.0:
  * build(deps): Bump alpine from 3.18 to 3.21 in /.release in the
    docker group across 1 directory by @dependabot in #1700
  * Convert changelog to MarkDown by @felixfontein in #1741
  * build(deps): Bump the go group with 7 updates by @dependabot in
    [#1743]
  * build(deps): Bump the go group with 9 updates by @dependabot in
    [#1745]
  * build(deps): Bump the rust group in /functional-tests with 2
    updates by @dependabot in #1744
  * build(deps): Bump github/codeql-action from 3.28.5 to 3.28.8 in
    the ci group by @dependabot in #1746
  * build(deps): Bump the go group with 12 updates by @dependabot
    in #1751
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1750]
  * Add --input-type option for filestatus subcommand by
    @felixfontein in #1601
  * Use SOPS_EDITOR before EDITOR by @felixfontein in #1611
  * Allow users to disable version check via environment variable
    by @nicklasfrahm in #1684
  * add duplicate section support to ini store by @reindlt in #1452
  * stores: test for duplicate keys, reserve keyword (yaml only
    now) by @holiman in #1203
  * Add same process option for exec-env by @ricmatsui in #880
  * outputs: add trailing newline at the end of JSON files by
    @duthils in #1476
  * set subcommand: add --idempotent flag that will not write the
    file if no change happened by @felixfontein in #1754
  * Encrypt and decrypt time.Time objects by @felixfontein in #1759
  * build(deps): Bump the go group with 8 updates by @dependabot in
    [#1763]
  * build(deps): Bump tempfile from 3.16.0 to 3.17.0 in
    /functional-tests in the rust group by @dependabot in #1762
  * build(deps): Bump goreleaser/goreleaser-action from 6.1.0 to
    6.2.1 in the ci group by @dependabot in #1761
  * fix(docs): typo in README.rst by @Paredev in #1765
  * Add SSH support for age by @haoqixu in #1692
  * make sure that tests do not pick keys.txt from user's HOME dir
    by @tomaszduda23 in #1766
  * support for age identity with passphrase by @tomaszduda23 in
    [#1400]
  * build(deps): Bump the rust group in /functional-tests with 4
    updates by @dependabot in #1768
  * build(deps): Bump the go group with 12 updates by @dependabot
    in #1769
  * build(deps): Bump the ci group with 4 updates by @dependabot in
    [#1770]
  * build(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.4 to
    4.0.5 by @dependabot in #1773
  * feat: add age plugin support by @brianmcgee in #1641
  * Check GnuPG decryption result for non-empty size by
    @felixfontein in #1776
  * vendored age code: consolidate passphrase reading functionality
    by @felixfontein in #1775
  * Allow to encrypt and decrypt from stdin by @felixfontein in
    [#1690]
  * build(deps): Bump the go group with 11 updates by @dependabot
    in #1784
  * build(deps): Bump the ci group with 5 updates by @dependabot in
    [#1782]
  * build(deps): Bump serde_json from 1.0.139 to 1.0.140 in
    /functional-tests in the rust group; bump Rust to 1.85.0 by
    @dependabot in #1783
  * build(deps): Bump the go group with 13 updates by @dependabot
    in #1797
  * build(deps): Bump the rust group in /functional-tests with 3
    updates by @dependabot in #1796
  * build(deps): Bump github/codeql-action from 3.28.10 to 3.28.11
    in the ci group by @dependabot in #1795
  * build(deps): Bump the go group with 6 updates by @dependabot in
    [#1802]
  * build(deps): Bump tempfile from 3.18.0 to 3.19.0 in
    /functional-tests in the rust group by @dependabot in #1800
  * build(deps): Bump docker/login-action from 3.3.0 to 3.4.0 in
    the ci group by @dependabot in #1801
  * build(deps): Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to
    5.2.2 by @dependabot in #1806
  * goreleaser: add windows arm64 by @duthils in #1791
  * Add a way to set sops config location via envvar by @sledzikowy
    in #1701
  * build(deps): Bump the go group with 3 updates by @dependabot in
    [#1809]
  * build(deps): Bump the ci group with 5 updates by @dependabot in
    [#1808]
  * build(deps): Bump tempfile from 3.19.0 to 3.19.1 in
    /functional-tests in the rust group by @dependabot in #1807
  * Support --config option in publish subcommand by @felixfontein
    in #1779
  * Fix caching of Metadata.DataKey by @felixfontein in #1781
  * Lint by @felixfontein in #1780
  * updatekeys subcommand: rename GroupQuorum to ShamirThreshold by
    @felixfontein in #1631
  * If --filename-override is specified, convert it to an absolute
    path same as regular filenames by @felixfontein in #1793
  * Add support for oauth2.TokenSource in GCP KMS by @matheuscscp
    in #1794
  * Added SOPS_AGE_KEY_CMD option to age, fixes #1323 by
    @danilobuerger in #1811
  * chore: omitempty metadata to reduce the size of stored config
    by @cgetzen in #1571
  * Improve Shamir Secret Sharing code by @felixfontein in #1813
  * Update all dependencies by @felixfontein in #1814
  * Run 'gofmt -w' on all .go files by @felixfontein in #1817
  * Add option to explicitly check for the latest version;
    deprecate current default of always doing that unless disabled
    by @felixfontein in #1816
  * Build using Go 1.24 and drop support for 1.22 by @hiddeco in
    [#1819]
  * Support GOOGLE_OAUTH_ACCESS_TOKEN for Google Cloud Platform by
    @marensofier in #1578
  * Warn about .sops.yml files found while searching for .sops.yaml
    by @felixfontein in #1820
  * Release 3.10.0 by @felixfontein in #1815
  * Added support for multiarch windows release binaries by
    @sabre1041 in #1823</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1743422401">- Update to version 3.10.1:
  * Add changelog.
  * Bump version to 3.10.1.
  * build(deps): Bump the ci group with 2 updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1744804800">- Update to version 3.10.2:
  * build(deps): Bump the go group with 13 updates by @dependabot
    in #1834
  * Use latest 1.24 Go version for release build by @hiddeco in
    [#1836]
  * Remove reserved keyword check from YAML store's LoadPlainFile()
    by @felixfontein in #1829
  * build(deps): Bump the go group with 9 updates by @dependabot in
    [#1839]
  * build(deps): Bump github/codeql-action from 3.28.13 to 3.28.15
    in the ci group by @dependabot in #1840
  * Release 3.10.2 release by @felixfontein in #1841</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1759147200">- Update to version 3.11.0:
  * Bump version to 3.11.0.
  * Add changelog for 3.11.0.
  * Address review comments.
  * Move dotenv.IsComplexValue to stores.
  * Do not put sensitive value into error message when the key can
    be printed as well.
  * Apply review suggestions.
  * AZKV: Also allow to omit version for AZKV keys specified in key
    groups.
  * Make SingleValueStore extend Store instead of the other way
    around.
  * Ignore encryption selection options for binary store (and warn
    when they are used).
  * build(deps): Bump the go group across 1 directory with 10
    updates
  * Get rid of conf variable.
  * When encrypting, load the config only once.
  * build(deps): Bump the go group across 1 directory with 21
    updates
  * Build with Go 1.24 and 1.25, release with 1.25.
  * Improve formulations.
  * Add YAML keys for all keys in a key group.
  * Get rid of some unrelated tabs.
  * Document (most of) the SOPS config format.
  * build(deps): Bump anchore/sbom-action in the ci group
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the rust group in /functional-tests with 4
    updates
  * Fix grammar.
  * Always load age identities from all locations, and report
    unused locations in error messages.
  * Fix mention of macOS XDG_CONFIG_HOME fallback.
  * Allow for non-string values in exec-env
  * Avoid panic when values are numbers
  * Fix argument order.
  * Move ValToString to stores.
  * Improve formatting of floats.
  * Add tests.
  * Fix converting integers to strings. Also improve time.Time
    formatting.
  * Update azkv/keysource.go
  * build(deps): Bump the ci group with 2 updates
  * fix: correct destination validation logic to detect all
    conflicts
  * Switch from deprecated gopkg.in/yaml.v3 to go.yaml.in/yaml/v3
  * feat(azkv): Skipping key-version will get latest key
  * Allow to configure --enable-local-keyservice and --keyservice
    through env variables.
  * Remove paragraph on GPG/PGP keyservers.
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the rust group in /functional-tests with 2
    updates
  * build(deps): Bump the go group with 14 updates
  * build(deps): Bump github.com/go-viper/mapstructure/v2
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump the go group with 9 updates
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump the go group with 15 updates
  * Fix keyservice client for unix domain sockets
  * Fix example.yaml.
  * Addressing felixfontein's latest review. Adds a key type field
    to the ParseKeyField fn.
  * Resolves #1864. Adds Native List as an option for configuring
    keys in addition to the trailing comma option already given.
  * Resolves #1864. Adds Native List as an option for configuring
    keys in addition to the trailing comma option already given.
  * Collect age identity loading errors and only report if
    decryption failed.
  * Document #1876 and --value-stdin.
  * Add --value-stdin option to 'sops set'.
  * Ensure temporary file for editing is only read-writable by
    owner.
  * Mention all stores in various places.
  * build(deps): Bump the ci group with 3 updates
  * build(deps): Bump serde_json in /functional-tests in the rust
    group
  * build(deps): Bump the go group with 12 updates
  * update completion command usage description
  * add source link for completion snippet
  * Also parse floating point numbers if they represent integers.
  * Store floating point number without decimal places.
  * Fix Shamir threshold encoding for INI and ENV files.
  * double backticks on configuration directory list 2/2
  * double backticks on configuration directory list 1/2
  * Document XDG_CONFIG_HOME support on mac
  * Add "--value-file" option to "sops set [...]"
  * build(deps): Bump the go group with 6 updates
  * add completion script. Resolves #1868
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 3 updates
  * Correct Windows path to store keys.txt
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 4 updates
  * build(deps): Bump github.com/go-viper/mapstructure/v2
  * Fix Typo in README.rst
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 8 updates
  * build(deps): Bump the ci group across 1 directory with 3
    updates
  * build(deps): Bump the go group with 12 updates
  * build(deps): Bump github.com/cloudflare/circl from 1.6.0 to
    1.6.1
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 12 updates
  * build(deps): Bump alpine in /.release in the docker group
  * build(deps): Bump the go group with 4 updates
  * Remove unmatched '`' from README.rst
  * build(deps): Bump the go group with 7 updates
  * Update authors in main.go
  * Allow injecting custom HTTP client for AWS, Azure, GCP and
    HashiCorp Vault
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 5 updates
  * Introduce EncryptContext and DecryptContext for AWS, Azure,
    GCP, PGP and HashiCorp Vault
  * Apply suggestions from code review.
  * build(deps): Bump actions/setup-go from 5.4.0 to 5.5.0 in the
    ci group
  * build(deps): Bump tempfile in /functional-tests in the rust
    group
  * build(deps): Bump the go group with 8 updates
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump the go group with 5 updates
  * build(deps): Bump the go group with 4 updates
  * add newline before sublist start
  * add newline before sublist start
  * use bullet points for structure</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1772020800">- Update to version 3.12.1 (.0 was not released):
  * Features:
  - Add support for HuaweiCloud KMS (#2001).
  - GCP KMS: Add SOPS_GCP_KMS_CLIENT_TYPE environment variable
    support to select between gRPC and REST clients (#1973).
  - Age: support hybrid post-quantum identities (#2033).
  - Age: pass SOPS_AGE_RECIPIENT environment variable to
    SOPS_AGE_KEY_CMD (#2045).
  - Age: add SOPS_AGE_SSH_PRIVATE_KEY_CMD environment variable
    (#2070).
  * Improvements:
  - Dependency updates (#1967, #1971, #1978, #1986, #1988, #1991,
    [#1993], #2002, #2004, #2007, #2012, #2018, #2024, #2029,
    [#2037], #2043, #2047, #2050, #2059, #2074, #2078).
  - Fix mistakes in --help output (#1975, #1963).
  - Improve documentation (#1997).
  - Unset user's GNUPGHOME environment variable for tests
    (#2052).
  - Use age's plugin.NewTerminalUI() instead of vendoring the
    code (#2034).
  - Remove dead code during YAML loading (#2072).
  - Build release with Go 1.26 (#2071).
  * Bugfixes:
  - Add --decryption-order flag to exec-env, exec-file, and
    publish commands. The subcommand code was using the flags,
    but it wasn't declared (#1965).
  - Fix AWS KMS encryption context not being passed when config
    is pre-loaded (#2021).
  - Fix recursive publish (#2019).
  - Set quota project to API project in GCP KMS (#1697).
  - DotEnv store now properly reports missing metadata (#2055).
  - AWS KMS: allow role splitting without hard-coded aws
    partition (#2042).
  * Project changes:
  - Add Go 1.26 to CI (#2071).
  - CI dependency updates (#1961, #1966, #1970, #1979, #1985,
    [#1989], #1992, #2003, #2006, #2010, #2011, #2017, #2023,
    [#2028], #2038, #2044, #2046, #2049, #2058, #2075).
  - Rust dependency updates for functional tests (#1962, #2027,
    [#2035], #2073).</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773835200">- Update to version 3.12.2:
  * Set version to 3.12.2.
  * Add 3.12.2 changelog entry.
  * Revert "Merge pull request #1697 from onjen/fix-1142"
  * build(deps): Bump tempfile in /functional-tests in the rust
    group
  * build(deps): Bump the ci group with 4 updates
  * Delete temporary file on termination.
  * At least on Linux, you need to press Enter.
  * Refactor loop.
  * Uniformly check file before encrypting.
  * build(deps): Bump the ci group with 4 updates
  * fix: handle mac only encrypted flag in global
  * build(deps): Bump github.com/docker/cli
  * build(deps): Bump tempfile in /functional-tests in the rust
    group
  * build(deps): Bump the ci group with 4 updates
  * build(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to
    1.40.0
  * build(deps): Bump github.com/cloudflare/circl from 1.6.1 to
    1.6.3
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 6 updates
  * Rearrange CI steps; disable setup-go's caching.</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778414400">- Update to version 3.13.0:
  * Bump version to 3.13.0.
  * Add 3.13.0 changelog.
  * Re-add some of Hidde's comments.
  * Handle empty branch in `convert`
  * Drop unused newline-escaping helpers
  * Drop redundant `SopsPrefix` constant in dotenv store
  * Compact comment-skipping in `sopsToGoSlice`
  * Apply review nits to metadata helpers
  * Fix age key in tests.
  * Apply first suggestions from Hidde's review.
  * Replace unflattening algorithm.
  * Also move tests.
  * Better separation.
  * Remove code unrelated to (un-)flattening to other file.
  * Make internal metadata type private.
  * Remove old (de-)serialization.
  * Remove old flattening code.
  * Add common code to encode and decode metadata.
  * Use mapstructure for parsing.
  * build(deps): Bump github/codeql-action in the ci group
  * build(deps): Bump the go group with 5 updates
  * Also append '/' to address to test.
  * Add documentation.
  * Allow to skip all Docker tests.
  * Add allowlist for HashiCorp Vault URLs.
  * Allow to have space-separated keys in SOPS_AGE_KEY.
  * Update all Go dependencies with 'go get -t -u ./...'
  * build(deps): Bump goreleaser/goreleaser-action in the ci group
  * build(deps): Bump the go group with 3 updates
  * Obtain `--indent` global flag value and pass it to store
    configs
  * Reject non-local paths.
  * Improve error handling.
  * Make sure to set GID to correct value instead of UID.
  * build(deps): Bump the go group with 12 updates
  * chore(docs): update broken link
  * build(deps): Bump the ci group with 3 updates
  * Update release for cosign v3
  * build(deps): Bump the go group across 1 directory with 21
    updates
  * build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to
    1.43.0
  * Drop support for Go 1.24.
  * Use prefixed and truncated key hash instead of location as GPG
    agent cache key.
  * build(deps): Bump actions/upload-artifact in the ci group
  * Add newline.
  * docs: add get key permission requirement for Azure Key Vault
    when version is omitted
  * build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
  * fix: preserve trailing inline comments in YAML emit when no
    items follow
  * test: add nested inline comment roundtrip test
  * fix: preserve YAML inline comments through encrypt/edit
    roundtrip
  * docs: move JSON top-level array note to appropriate section
  * build(deps): Bump docker/login-action in the ci group
  * fix(json): improve error message for top-level arrays (fixes
    [#1974])
  * build(deps): Bump github.com/go-jose/go-jose/v4 from 4.1.3 to
    4.1.4
  * fix(gcpkms): address review comments on sovereign cloud KMS
    support
  * build(deps): Bump the ci group with 3 updates
  * build(deps): Bump the ci group with 3 updates
  * feat(gcpkms): add SOPS_GCP_KMS_ENDPOINT and
    SOPS_GCP_KMS_UNIVERSE_DOMAIN env vars
  * build(deps): Bump google.golang.org/grpc from 1.79.1 to 1.79.3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 3.13.1:
  * Fix minimum Go version in contributor docs.
  * Redirect documentation to getsops.io.
  * Bump Go version in contributing docs.
  * Redirect documentation changes to getsops/docs.
  * Avoid percent-encoding of cache key to blow up size &gt; 50
    characters.
  * Apply 'gofmt -w -s' to all .go files.
  * build(deps): Bump the ci group with 2 updates
  * build(deps): Bump the go group with 9 updates</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782907200">- Update to version 3.13.2:
  * build(deps): Bump the go group with 3 updates by
    @dependabot[bot] in #2185
  * build(deps): Bump github/codeql-action from 4.35.4 to 4.35.5 in
    the ci group by @dependabot[bot] in #2184
  * build(deps): Bump the go group with 11 updates by
    @dependabot[bot] in #2193
  * build(deps): Bump the ci group with 4 updates by
    @dependabot[bot] in #2192
  * build(deps): Bump serde_json from 1.0.149 to 1.0.150 in
    /functional-tests in the rust group by @dependabot[bot] in
    [#2191]
  * build(deps): Bump the go group with 11 updates by
    @dependabot[bot] in #2197
  * build(deps): Bump docker/setup-qemu-action from 4.0.0 to 4.1.0
    in the ci group by @dependabot[bot] in #2196
  * test: unset all age env vars in make test target by
    @arpitjain099 in #2208
  * build(deps): Bump the go group with 10 updates by
    @dependabot[bot] in #2212
  * build(deps): Bump the ci group with 2 updates by
    @dependabot[bot] in #2211
  * build(deps): Bump the go group with 15 updates by
    @dependabot[bot] in #2218
  * build(deps): Bump alpine from 3.23 to 3.24 in /.release in the
    docker group by @dependabot[bot] in #2217
  * fix: handle pointers when serializing context by @tlercher in
    [#2219]
  * docs: fix typo in exec-file --filename help text by @s3onghyun
    in #2221
  * JSON store: preserve large integers that fit into int64 by
    @s3onghyun in #2222
  * Fix panic when expecting an encrypted string, but a non-string
    is encountered by @felixfontein in #2227
  * Fix INI store no longer double-encoding newlines by
    @felixfontein in #2189
  * exec-file/exec-env: reset supplementary groups when changing
    user by @felixfontein in #2194
  * build(deps): Bump the go group with 6 updates by
    @dependabot[bot] in #2229
  * build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 in the
    ci group by @dependabot[bot] in #2228
  * Fix issue when changing user in exec subcommands by @sabre1041
    in #2230
  * Shorten .md lines by @felixfontein in #2206
  * Update all Go dependencies with go get -t -u ./... by
    @felixfontein in #2231
  * build(deps): Bump github.com/opencontainers/runc from 1.2.8 to
    1.3.6 by @dependabot[bot] in #2233
  * build(deps): Bump the ci group with 2 updates by
    @dependabot[bot] in #2236
  * Release 3.13.2 by @felixfontein in #2232</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784808000">- Update to version 3.13.3:
  * Add ini to supported input/output type descriptions by
    @TheKhanj in #2239
  * build(deps): Bump the go group with 10 updates by
    @dependabot[bot] in #2242
  * build(deps): Bump the ci group with 6 updates by
    @dependabot[bot] in #2241
  * fix: include decrypted sequence comments in the MAC (fixes
    [#2243]) by @cbcoutinho in #2245
  * build(deps): Bump the go group with 14 updates by
    @dependabot[bot] in #2251
  * build(deps): Bump the ci group with 2 updates by
    @dependabot[bot] in #2250
  * build(deps): Bump the go group with 11 updates by
    @dependabot[bot] in #2261
  * build(deps): Bump the ci group with 3 updates by
    @dependabot[bot] in #2260
  * build(deps): Bump the rust group in /functional-tests with 3
    updates by @dependabot[bot] in #2259
  * Update dependencies with 'go get -t -u ./...' by @felixfontein
    in #2248
  * Completion scripts: remove leading newline by @felixfontein in
    [#2253]</changelog>
</package>
<package pkgid="4784e949fcfc91c84a51a7b47bc27df4888b5a367248487ff3bb70fb293d54a9b380b381c93b0633f343ba037d97539293a71656201f847c792193b7fea4a48f" name="sqlmap" arch="noarch">
  <version epoch="0" ver="1.10.8" rel="65.1"/>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1704456000">- update to 1.8:
  * H2 queries to get data use wrong order for LIMIT and OFFSET (#5580)
  * Cleaning some mess with limitQuery
  * fix issue #5571, #5229, #5581, #5585
  * update documentation and copyright year</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1710590400">- update to 1.8.3:
  * Adding switch '--unsafe-naming'
  * Fixes #5619
  * Fixes #5590
  * Add Patch related to empty multiform-data field value
  * Fix Python 3.12 warnings</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1716638400">- update to 1.8.5:
  * Patch related to the #5700 (Send raw binary data to postprocess function)
- update to 1.8.4:
  * Removing some obsolete code</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1725278400">- update to 1.8.8:
  * fixed #5727 SQLAlchemy connection issue
  * fixed #5725 Arbitrary Injection Point Not Working
  * implements #5728 More error-based payloads
  * fixed #5738 probing web services on non-standard ports
  * fixed #5731 python 3.13 compatibility
  * fixed #4613 Single column enumeration (-C) broken for Firebird backend
  * fixed #5755, #5759 Unhandled exception</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1732708800">- update to 1.8.11:
  * fixed #5772, #5761 unhandled exception
  * fixed #5763 Can not perform sql blind injection again latest dvwa
  * fixed #5798 Some bugs with common tables and columns check
  * fixed #5767 direct connection to oracle database not working
  * update translations</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1735992000">- update to 1.9:
  * Implements --disable-hashing (#5827)
  * fixed #5828 Clickhouse - Unable to retrieve tables
  * update of checksums</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1743854400">- update to 1.9.4:
  * Minor improvement for _linux_wav_play
  * Minor improvement to Set-Cookie detection
  * Minor update of fingerprinting methods
  * Implement experimental --http2
  * Minor update (adding support for silent mode)
  * Update of six third-party library
  * Minor update for the automatic reporting
  * Fix #5885 (unhandled exception)
  * Fix #5881 (Add luanginxmore tamper script)
  * Fix #5857 (Parameters "--csrf-method“ and "--csrf-data" are ignored)</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1747483200">- update to 1.9.5:
  * Minor update of fingerprint data for MySQL</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1749902400">- update to 1.9.6:
  * Fixed #5908
    Running sqlmap with --headers and -H parameters gives us different
    output albeit same header values are provided</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1754827200">- update to 1.9.8:
  * Fixes #5936 (Unhandled exception)
  * Minor update of fingerprinting payloads</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1757764800">- update to 1.9.9:
  * Minor update of common outputs</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1759838400">- update to 1.9.10:
  * update of user-agents
  * fix typos in README</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1762603200">- update to 1.9.11:
  * Minor bug fix</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1765627200">- update to 1.9.12:
  * Fix bug in 302 redirect (issue #5985)</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1773576000">- update to 1.10.3:
  * Minor improvement of ERROR_PARSING_REGEXES
  * Improving keep-alive support</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1775995200">- update to 1.10.4:
  * Fixes #6043 (Unhandled exception)</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1778932800">- update to 1.10.5:
  * Minor update</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1781352000">- update to 1.10.6:
  * Fix WebSocket request traffic logging</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1783857600">- update to 1.10.7:
  * Minor optimization</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1786363200">- update to 1.10.8:
  * Couple of trivial bug fixes</changelog>
</package>
<package pkgid="a5cfe37d5f701b37bb99ceef52a7790b00dc3c6356fa4bcaf6a8b0193c246296b52b904f4dbeb765396382cd29e25ea884b007fc8d5ca814287a14e7ee6b4f70" name="sqlmap" arch="src">
  <version epoch="0" ver="1.10.8" rel="65.1"/>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1704456000">- update to 1.8:
  * H2 queries to get data use wrong order for LIMIT and OFFSET (#5580)
  * Cleaning some mess with limitQuery
  * fix issue #5571, #5229, #5581, #5585
  * update documentation and copyright year</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1710590400">- update to 1.8.3:
  * Adding switch '--unsafe-naming'
  * Fixes #5619
  * Fixes #5590
  * Add Patch related to empty multiform-data field value
  * Fix Python 3.12 warnings</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1716638400">- update to 1.8.5:
  * Patch related to the #5700 (Send raw binary data to postprocess function)
- update to 1.8.4:
  * Removing some obsolete code</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1725278400">- update to 1.8.8:
  * fixed #5727 SQLAlchemy connection issue
  * fixed #5725 Arbitrary Injection Point Not Working
  * implements #5728 More error-based payloads
  * fixed #5738 probing web services on non-standard ports
  * fixed #5731 python 3.13 compatibility
  * fixed #4613 Single column enumeration (-C) broken for Firebird backend
  * fixed #5755, #5759 Unhandled exception</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1732708800">- update to 1.8.11:
  * fixed #5772, #5761 unhandled exception
  * fixed #5763 Can not perform sql blind injection again latest dvwa
  * fixed #5798 Some bugs with common tables and columns check
  * fixed #5767 direct connection to oracle database not working
  * update translations</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1735992000">- update to 1.9:
  * Implements --disable-hashing (#5827)
  * fixed #5828 Clickhouse - Unable to retrieve tables
  * update of checksums</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1743854400">- update to 1.9.4:
  * Minor improvement for _linux_wav_play
  * Minor improvement to Set-Cookie detection
  * Minor update of fingerprinting methods
  * Implement experimental --http2
  * Minor update (adding support for silent mode)
  * Update of six third-party library
  * Minor update for the automatic reporting
  * Fix #5885 (unhandled exception)
  * Fix #5881 (Add luanginxmore tamper script)
  * Fix #5857 (Parameters "--csrf-method“ and "--csrf-data" are ignored)</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1747483200">- update to 1.9.5:
  * Minor update of fingerprint data for MySQL</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1749902400">- update to 1.9.6:
  * Fixed #5908
    Running sqlmap with --headers and -H parameters gives us different
    output albeit same header values are provided</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1754827200">- update to 1.9.8:
  * Fixes #5936 (Unhandled exception)
  * Minor update of fingerprinting payloads</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1757764800">- update to 1.9.9:
  * Minor update of common outputs</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1759838400">- update to 1.9.10:
  * update of user-agents
  * fix typos in README</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1762603200">- update to 1.9.11:
  * Minor bug fix</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1765627200">- update to 1.9.12:
  * Fix bug in 302 redirect (issue #5985)</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1773576000">- update to 1.10.3:
  * Minor improvement of ERROR_PARSING_REGEXES
  * Improving keep-alive support</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1775995200">- update to 1.10.4:
  * Fixes #6043 (Unhandled exception)</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1778932800">- update to 1.10.5:
  * Minor update</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1781352000">- update to 1.10.6:
  * Fix WebSocket request traffic logging</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1783857600">- update to 1.10.7:
  * Minor optimization</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1786363200">- update to 1.10.8:
  * Couple of trivial bug fixes</changelog>
</package>
<package pkgid="bd5fb34cf6a2de32a63663f53c77ec9a801f8ca452b492a1f193962126fc7d89ca575a1d1168ef22227c1df5a2ebd19c3c9ff8c0e025654659232d006831b4d3" name="squilt" arch="noarch">
  <version epoch="0" ver="20251029.56b4c47" rel="11.4"/>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1676980800">- Package version 20220617.c1a5044:
  * Sort and comment config entries
  * squilt: add ld.so.cache for libraries in non-standard locations
  * allow working directory to be beneath /tmp
  * squilt: also map /etc/rpm for local RPM macros to be available
  * squilt: improve support for non-SUSE systems
  * Initial release of squilt</changelog>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1677067200">- Fix spec file: remove noarch, add ExclusiveArch in line with dependencies</changelog>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1688990400">- Fix squilt fixed /etc path to /usr/etc on Tumbleweed</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1761739200">- Update to version 20251029.56b4c47:
  * Change to bubblewrap for confinment
  * Drop restriction to x86_64 since bubblewrap is available for other
    architectures</changelog>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1764590400">- Update description to mention bubblewrap
- Simplify spec file</changelog>
</package>
<package pkgid="94cb49767d83d2de929af88747177a4d1b799198fb60af4d10d896fc4f8d69218e6925131d2d0ca5321444949cd6d814e0fd7e5ab717dc18eee5f21cf583320a" name="squilt" arch="src">
  <version epoch="0" ver="20251029.56b4c47" rel="11.4"/>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1676980800">- Package version 20220617.c1a5044:
  * Sort and comment config entries
  * squilt: add ld.so.cache for libraries in non-standard locations
  * allow working directory to be beneath /tmp
  * squilt: also map /etc/rpm for local RPM macros to be available
  * squilt: improve support for non-SUSE systems
  * Initial release of squilt</changelog>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1677067200">- Fix spec file: remove noarch, add ExclusiveArch in line with dependencies</changelog>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1688990400">- Fix squilt fixed /etc path to /usr/etc on Tumbleweed</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1761739200">- Update to version 20251029.56b4c47:
  * Change to bubblewrap for confinment
  * Drop restriction to x86_64 since bubblewrap is available for other
    architectures</changelog>
  <changelog author="Filippo Bonazzi &lt;filippo.bonazzi@suse.com&gt;" date="1764590400">- Update description to mention bubblewrap
- Simplify spec file</changelog>
</package>
<package pkgid="c88b6671cd42877b1ce6d1c65645f8fbdee6914bd57ffcbf0dfee8e49dcce648c337b1b9937602419f5d516fb2ab787c7181a7cc2e5a790a817e84e56487842d" name="srm" arch="s390x">
  <version epoch="0" ver="1.2.15" rel="35.27"/>
  <changelog author="crrodriguez@opensuse.org" date="1298635200">- Initial version</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1298635201">- Fix header detection</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346760000">- ran thru spec-cleaner
- change license in specfile from BSD to MIT
- remove "-autoreconf -fiv" so it can build with OS 12.2
- remove srm-configure.patch since it is no longer used by autoreconf
- add --disable-debug to configure line</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347883200">- replace _service with a tarball in preparation of submission to factory</changelog>
  <changelog author="cfarrell@suse.com" date="1347969600">- license update: SUSE-SGI-FreeB-2.0
  MIT with the advertising clause below is more akin to the SGI FreeB 2.0
  license</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1409572800">- update to v1.2.13
  * add command line are for Gutmann method
  * overwrite POSIX attributes on Linux
  * exit status 1 if remove fails
  * various code cleanups - see &lt;http://sourceforge.net/p/srm/srm/commit_browser&gt;</changelog>
  <changelog author="p.drouand@gmail.com" date="1427371200">- Update to version 1.2.15
  * fix handling of files &gt; 2GB on Windows.
  * fix handling of symlinks to files owned by root.
- Changes from version 1.2.14
  * fix fill() function, this fixes DoE and Gutmann modes.
  * new --rcmp mode.
  * use simple mode by default and not Gutmann 35 pass.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- switch source url to https</changelog>
  <changelog author="Gordon Leung &lt;pirateclip@protonmail.com&gt;" date="1674043200">- amend license SUSE-SGI-FreeB-2.0 to SPDX's SGI-B-2.0</changelog>
</package>
<package pkgid="11ea9e81c9bdf4bf633cb54a2ffe8068f026552adfe0e54946def97eb513287ca10cefd6d903a9be36102c838124dde459ed4d924247ad6ac060f664906acc64" name="srm" arch="src">
  <version epoch="0" ver="1.2.15" rel="35.27"/>
  <changelog author="crrodriguez@opensuse.org" date="1298635200">- Initial version</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1298635201">- Fix header detection</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346760000">- ran thru spec-cleaner
- change license in specfile from BSD to MIT
- remove "-autoreconf -fiv" so it can build with OS 12.2
- remove srm-configure.patch since it is no longer used by autoreconf
- add --disable-debug to configure line</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347883200">- replace _service with a tarball in preparation of submission to factory</changelog>
  <changelog author="cfarrell@suse.com" date="1347969600">- license update: SUSE-SGI-FreeB-2.0
  MIT with the advertising clause below is more akin to the SGI FreeB 2.0
  license</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1409572800">- update to v1.2.13
  * add command line are for Gutmann method
  * overwrite POSIX attributes on Linux
  * exit status 1 if remove fails
  * various code cleanups - see &lt;http://sourceforge.net/p/srm/srm/commit_browser&gt;</changelog>
  <changelog author="p.drouand@gmail.com" date="1427371200">- Update to version 1.2.15
  * fix handling of files &gt; 2GB on Windows.
  * fix handling of symlinks to files owned by root.
- Changes from version 1.2.14
  * fix fill() function, this fixes DoE and Gutmann modes.
  * new --rcmp mode.
  * use simple mode by default and not Gutmann 35 pass.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- switch source url to https</changelog>
  <changelog author="Gordon Leung &lt;pirateclip@protonmail.com&gt;" date="1674043200">- amend license SUSE-SGI-FreeB-2.0 to SPDX's SGI-B-2.0</changelog>
</package>
<package pkgid="eb0651f957e9456ea005dc968a468906f650a5d73e17fe022094ca9a407260af5aaea00bd48095a0c675316b6a26a6cff6c187562ce5b7dbf4b0009ea11a85a9" name="srm-debuginfo" arch="s390x">
  <version epoch="0" ver="1.2.15" rel="35.27"/>
  <changelog author="crrodriguez@opensuse.org" date="1298635200">- Initial version</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1298635201">- Fix header detection</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346760000">- ran thru spec-cleaner
- change license in specfile from BSD to MIT
- remove "-autoreconf -fiv" so it can build with OS 12.2
- remove srm-configure.patch since it is no longer used by autoreconf
- add --disable-debug to configure line</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347883200">- replace _service with a tarball in preparation of submission to factory</changelog>
  <changelog author="cfarrell@suse.com" date="1347969600">- license update: SUSE-SGI-FreeB-2.0
  MIT with the advertising clause below is more akin to the SGI FreeB 2.0
  license</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1409572800">- update to v1.2.13
  * add command line are for Gutmann method
  * overwrite POSIX attributes on Linux
  * exit status 1 if remove fails
  * various code cleanups - see &lt;http://sourceforge.net/p/srm/srm/commit_browser&gt;</changelog>
  <changelog author="p.drouand@gmail.com" date="1427371200">- Update to version 1.2.15
  * fix handling of files &gt; 2GB on Windows.
  * fix handling of symlinks to files owned by root.
- Changes from version 1.2.14
  * fix fill() function, this fixes DoE and Gutmann modes.
  * new --rcmp mode.
  * use simple mode by default and not Gutmann 35 pass.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- switch source url to https</changelog>
  <changelog author="Gordon Leung &lt;pirateclip@protonmail.com&gt;" date="1674043200">- amend license SUSE-SGI-FreeB-2.0 to SPDX's SGI-B-2.0</changelog>
</package>
<package pkgid="d989ac766a1553de626a4a243cb73943a69bd1f4d210796f669abb124f8028b908e979140ffb89e83bdefd85d11c6519f4abe63cd3bd8d5c388c2633ebfcb2a9" name="srm-debugsource" arch="s390x">
  <version epoch="0" ver="1.2.15" rel="35.27"/>
  <changelog author="crrodriguez@opensuse.org" date="1298635200">- Initial version</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1298635201">- Fix header detection</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346760000">- ran thru spec-cleaner
- change license in specfile from BSD to MIT
- remove "-autoreconf -fiv" so it can build with OS 12.2
- remove srm-configure.patch since it is no longer used by autoreconf
- add --disable-debug to configure line</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1347883200">- replace _service with a tarball in preparation of submission to factory</changelog>
  <changelog author="cfarrell@suse.com" date="1347969600">- license update: SUSE-SGI-FreeB-2.0
  MIT with the advertising clause below is more akin to the SGI FreeB 2.0
  license</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1409572800">- update to v1.2.13
  * add command line are for Gutmann method
  * overwrite POSIX attributes on Linux
  * exit status 1 if remove fails
  * various code cleanups - see &lt;http://sourceforge.net/p/srm/srm/commit_browser&gt;</changelog>
  <changelog author="p.drouand@gmail.com" date="1427371200">- Update to version 1.2.15
  * fix handling of files &gt; 2GB on Windows.
  * fix handling of symlinks to files owned by root.
- Changes from version 1.2.14
  * fix fill() function, this fixes DoE and Gutmann modes.
  * new --rcmp mode.
  * use simple mode by default and not Gutmann 35 pass.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- switch source url to https</changelog>
  <changelog author="Gordon Leung &lt;pirateclip@protonmail.com&gt;" date="1674043200">- amend license SUSE-SGI-FreeB-2.0 to SPDX's SGI-B-2.0</changelog>
</package>
<package pkgid="73bda9c48302577a1c4fbb78938a9da81e2587fb31ee47f92cd261de9caf230ae4559389e8d349f6d45470beb708485612b29baf636b93db24603374c287022e" name="ssdeep" arch="s390x">
  <version epoch="0" ver="2.14.1" rel="21.59"/>
  <changelog author="Greg.Freemyer@gmail.com" date="1328961600">- initial submission
  Recursive computing and matching of Context Triggered Piecewise
  Hashing (aka Fuzzy Hashing). Supports Windows, *nix, BSD, OS X, etc.</changelog>
  <changelog author="aj@suse.de" date="1344513600">- Run through spec-cleaner, remove obsolete comments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1345204800">- Add ssdeep-dynamic.patch: Link ssdeep dynamically to libfuzzy.
  As a side-effect, we can actually now also use configure
  - -disable-static.
- Add libtool BuildRequires and call autoreconf, as above patch
  touches the build system.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1413460800">- ssdeep 2.11.1
  * Made libfuzzy compile as a shared library again.
- includes changes from 2.11:
  * Added fuzzy_clone function to the API.
  * Fixed edge case on signature generaion. Behavior now matches v2.9 again.
- includes changes from 2.10:
  * Fuzzy Hashing engine re-written to be thread safe.
  * Fixed bug on comparing signatures with the same block size.
  * Fixed crash on comparing short signatures.
  * Fixed memory leak
- includes changes from 2.9:
  * Added warning message for when some data on stdin is not hashed.
  * Can now hash up to 512MB of data on stdin.
  * Added clustering mode to group together matching files
  * Fixed incorrect match scores for hashes with long filenames.
- includes changes from 2.8:
  * Converted to C++
  * Fixed support for large files on some platforms.
  * Fixed errors in handling command line argument processing.
- remove ssdeep-dynamic.patch, not required
- remove autoreconf call
- License is GPL-2.0+, but please review [boo#901394]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1414152000">- ssdeep 2.12:
  - Fixed issue when comparing identical hashes but with different
    block sizes.
- Fixes licence problem in edit_dist.c [boo#901394]
  Package licence is GPL-2.0 and GPL-2.0+:</changelog>
  <changelog author="astieger@suse.com" date="1430222400">- ssdeep 2.13:
  * Added fuzzy_set_total_input_length function to the API.
  * Added support for files up to 192GB.
  * Added support for arbitrary length input from the standard input.
  * Fixed issue when comparing hashes from relatively simple files.
  * Fixed portability issues.</changelog>
  <changelog author="astieger@suse.com" date="1510574400">- ssdeep 2.14.1:
  * Optimizations to the fuzzy hashing engine
  * Fixed issue when certain memory allocation is failed</changelog>
</package>
<package pkgid="e001e685cc1eae376598161c038b59fef2a1e2f9175ad431e51bb4c7ea4576819cfe47eeffdfb332882b46308aa36f57d21bc54f6e123a06165debc01f8e95d2" name="ssdeep" arch="src">
  <version epoch="0" ver="2.14.1" rel="21.59"/>
  <changelog author="Greg.Freemyer@gmail.com" date="1328961600">- initial submission
  Recursive computing and matching of Context Triggered Piecewise
  Hashing (aka Fuzzy Hashing). Supports Windows, *nix, BSD, OS X, etc.</changelog>
  <changelog author="aj@suse.de" date="1344513600">- Run through spec-cleaner, remove obsolete comments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1345204800">- Add ssdeep-dynamic.patch: Link ssdeep dynamically to libfuzzy.
  As a side-effect, we can actually now also use configure
  - -disable-static.
- Add libtool BuildRequires and call autoreconf, as above patch
  touches the build system.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1413460800">- ssdeep 2.11.1
  * Made libfuzzy compile as a shared library again.
- includes changes from 2.11:
  * Added fuzzy_clone function to the API.
  * Fixed edge case on signature generaion. Behavior now matches v2.9 again.
- includes changes from 2.10:
  * Fuzzy Hashing engine re-written to be thread safe.
  * Fixed bug on comparing signatures with the same block size.
  * Fixed crash on comparing short signatures.
  * Fixed memory leak
- includes changes from 2.9:
  * Added warning message for when some data on stdin is not hashed.
  * Can now hash up to 512MB of data on stdin.
  * Added clustering mode to group together matching files
  * Fixed incorrect match scores for hashes with long filenames.
- includes changes from 2.8:
  * Converted to C++
  * Fixed support for large files on some platforms.
  * Fixed errors in handling command line argument processing.
- remove ssdeep-dynamic.patch, not required
- remove autoreconf call
- License is GPL-2.0+, but please review [boo#901394]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1414152000">- ssdeep 2.12:
  - Fixed issue when comparing identical hashes but with different
    block sizes.
- Fixes licence problem in edit_dist.c [boo#901394]
  Package licence is GPL-2.0 and GPL-2.0+:</changelog>
  <changelog author="astieger@suse.com" date="1430222400">- ssdeep 2.13:
  * Added fuzzy_set_total_input_length function to the API.
  * Added support for files up to 192GB.
  * Added support for arbitrary length input from the standard input.
  * Fixed issue when comparing hashes from relatively simple files.
  * Fixed portability issues.</changelog>
  <changelog author="astieger@suse.com" date="1510574400">- ssdeep 2.14.1:
  * Optimizations to the fuzzy hashing engine
  * Fixed issue when certain memory allocation is failed</changelog>
</package>
<package pkgid="c2efb5d3bc8d73b4a987660d889c337af672dcc097088e0ee6ae7d6ac172195a486cfbd68c87993f54c1292e398017a5cb5a7bf44a9461a5f70a41f758a1823e" name="ssdeep-debuginfo" arch="s390x">
  <version epoch="0" ver="2.14.1" rel="21.59"/>
  <changelog author="Greg.Freemyer@gmail.com" date="1328961600">- initial submission
  Recursive computing and matching of Context Triggered Piecewise
  Hashing (aka Fuzzy Hashing). Supports Windows, *nix, BSD, OS X, etc.</changelog>
  <changelog author="aj@suse.de" date="1344513600">- Run through spec-cleaner, remove obsolete comments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1345204800">- Add ssdeep-dynamic.patch: Link ssdeep dynamically to libfuzzy.
  As a side-effect, we can actually now also use configure
  - -disable-static.
- Add libtool BuildRequires and call autoreconf, as above patch
  touches the build system.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1413460800">- ssdeep 2.11.1
  * Made libfuzzy compile as a shared library again.
- includes changes from 2.11:
  * Added fuzzy_clone function to the API.
  * Fixed edge case on signature generaion. Behavior now matches v2.9 again.
- includes changes from 2.10:
  * Fuzzy Hashing engine re-written to be thread safe.
  * Fixed bug on comparing signatures with the same block size.
  * Fixed crash on comparing short signatures.
  * Fixed memory leak
- includes changes from 2.9:
  * Added warning message for when some data on stdin is not hashed.
  * Can now hash up to 512MB of data on stdin.
  * Added clustering mode to group together matching files
  * Fixed incorrect match scores for hashes with long filenames.
- includes changes from 2.8:
  * Converted to C++
  * Fixed support for large files on some platforms.
  * Fixed errors in handling command line argument processing.
- remove ssdeep-dynamic.patch, not required
- remove autoreconf call
- License is GPL-2.0+, but please review [boo#901394]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1414152000">- ssdeep 2.12:
  - Fixed issue when comparing identical hashes but with different
    block sizes.
- Fixes licence problem in edit_dist.c [boo#901394]
  Package licence is GPL-2.0 and GPL-2.0+:</changelog>
  <changelog author="astieger@suse.com" date="1430222400">- ssdeep 2.13:
  * Added fuzzy_set_total_input_length function to the API.
  * Added support for files up to 192GB.
  * Added support for arbitrary length input from the standard input.
  * Fixed issue when comparing hashes from relatively simple files.
  * Fixed portability issues.</changelog>
  <changelog author="astieger@suse.com" date="1510574400">- ssdeep 2.14.1:
  * Optimizations to the fuzzy hashing engine
  * Fixed issue when certain memory allocation is failed</changelog>
</package>
<package pkgid="dd4f0f90c61dc471fbd3e1fd3d13db03dde0a53c4424f157084e645d132fd1dafa541c3709159946daf1a9fff0e73bc8c6706b698105aebddac63fe2ba266f07" name="ssdeep-debugsource" arch="s390x">
  <version epoch="0" ver="2.14.1" rel="21.59"/>
  <changelog author="Greg.Freemyer@gmail.com" date="1328961600">- initial submission
  Recursive computing and matching of Context Triggered Piecewise
  Hashing (aka Fuzzy Hashing). Supports Windows, *nix, BSD, OS X, etc.</changelog>
  <changelog author="aj@suse.de" date="1344513600">- Run through spec-cleaner, remove obsolete comments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1345204800">- Add ssdeep-dynamic.patch: Link ssdeep dynamically to libfuzzy.
  As a side-effect, we can actually now also use configure
  - -disable-static.
- Add libtool BuildRequires and call autoreconf, as above patch
  touches the build system.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1413460800">- ssdeep 2.11.1
  * Made libfuzzy compile as a shared library again.
- includes changes from 2.11:
  * Added fuzzy_clone function to the API.
  * Fixed edge case on signature generaion. Behavior now matches v2.9 again.
- includes changes from 2.10:
  * Fuzzy Hashing engine re-written to be thread safe.
  * Fixed bug on comparing signatures with the same block size.
  * Fixed crash on comparing short signatures.
  * Fixed memory leak
- includes changes from 2.9:
  * Added warning message for when some data on stdin is not hashed.
  * Can now hash up to 512MB of data on stdin.
  * Added clustering mode to group together matching files
  * Fixed incorrect match scores for hashes with long filenames.
- includes changes from 2.8:
  * Converted to C++
  * Fixed support for large files on some platforms.
  * Fixed errors in handling command line argument processing.
- remove ssdeep-dynamic.patch, not required
- remove autoreconf call
- License is GPL-2.0+, but please review [boo#901394]</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1414152000">- ssdeep 2.12:
  - Fixed issue when comparing identical hashes but with different
    block sizes.
- Fixes licence problem in edit_dist.c [boo#901394]
  Package licence is GPL-2.0 and GPL-2.0+:</changelog>
  <changelog author="astieger@suse.com" date="1430222400">- ssdeep 2.13:
  * Added fuzzy_set_total_input_length function to the API.
  * Added support for files up to 192GB.
  * Added support for arbitrary length input from the standard input.
  * Fixed issue when comparing hashes from relatively simple files.
  * Fixed portability issues.</changelog>
  <changelog author="astieger@suse.com" date="1510574400">- ssdeep 2.14.1:
  * Optimizations to the fuzzy hashing engine
  * Fixed issue when certain memory allocation is failed</changelog>
</package>
<package pkgid="0b251b53eb91a6a37c3b42cf55f838e82e9f4a3b4e69f8062000fcecd8edb32629fa6252282ff577e99d7f92c1bf93397bbcf890f7c9c432ba5bd22596d79e6b" name="ssh-audit" arch="noarch">
  <version epoch="0" ver="3.9.0" rel="23.3"/>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1604059200">- Update to version 2.3.1
  * Now parses public key sizes for
    rsa-sha2-256-cert-v01@openssh.com and
    rsa-sha2-512-cert-v01@openssh.com host key types.
  * Flag ssh-rsa-cert-v01@openssh.com as a failure due to SHA-1
    hash.
  * Fixed bug in recommendation output which suppressed some
    algorithms inappropriately.
  * Built-in policies now include CA key requirements (if
    certificates are in use).
  * Lookup function (--lookup) now performs case-insensitive
    lookups of similar algorithms.
  * Migrated pre-made policies from external files to internal
    database.
  * Split single 3,500 line script into many files (by class).
  * Added setup.py support
  * Added 1 new cipher: des-cbc@ssh.com.
- Install manpage
- Use py-* rpm macros</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1614600000">- Update to version 2.4.0
  * Added multi-threaded scanning support.
  * Added version check for OpenSSH user enumeration
    (CVE-2018-15473).
  * Added deprecation note to host key types based on SHA-1.
  * Added extra warnings for SSHv1.
  * Added built-in hardened OpenSSH v8.5 policy.
  * Upgraded warnings to failures for host key types based on SHA-1
  * Fixed crash when receiving unexpected response during host key
    test.
  * Fixed hang against older Cisco devices during host key test &amp;
    gex test.
  * Fixed improper termination while scanning multiple targets when
    one target returns an error.
  * Dropped support for Python 3.5 (which reached EOL in Sept.2020)
  * Added 1 new key exchange: sntrup761x25519-sha512@openssh.com.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1629979200">- Update to version 2.5.0
  * Fixed crash when running host key tests.
  * Handles server connection failures more gracefully.
  * Now prints JSON with indents when -jj is used (useful for
    debugging).
  * Added MD5 fingerprints to verbose output.
  * Added -d/--debug option for getting debugging output.
  * Updated JSON output to include MD5 fingerprints. Note that
    this results in a breaking change in the 'fingerprints'
    dictionary format.
  * Updated OpenSSH 8.1 (and earlier) policies to include
    rsa-sha2-512 and rsa-sha2-256.
  * Added OpenSSH v8.6 &amp; v8.7 policies.
  * Added 3 new key exchanges:
    + gss-gex-sha1-eipGX3TCiQSrx573bT1o1Q==
    + gss-group1-sha1-eipGX3TCiQSrx573bT1o1Q==
    + gss-group14-sha1-eipGX3TCiQSrx573bT1o1Q==
  * Added 3 new MACs:
    + hmac-ripemd160-96
    + AEAD_AES_128_GCM
    + AEAD_AES_256_GCM</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1630324800">- Require correct python version</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1682942400">- Update to version 2.9.0
  * Dropped support for Python 3.6
  * Updated CVE database.
  * Added -g and --gex-test for granular GEX modulus size tests.
  * JSON 'target' field now always includes port number.
  * JSON output now includes recommendations and CVE data.
  * Mixed host key/CA key types (i.e.: RSA host keys signed with
    ED25519 CAs, etc.) are now properly handled.
  * Warnings are now printed for 2048-bit moduli.
  * SHA-1 algorithms now cause failures.
  * CBC mode ciphers are now warnings instead of failures.
  * Generic failure/warning messages replaced with more specific
    reasons (i.e.:'using weak cipher' =&gt; 'using broken RC4 cipher')
  * Updated built-in policies to include missing host key size
    information.
  * Added built-in policies for OpenSSH 8.8, 8.9, 9.0, 9.1, 9.2,
    and 9.3.
  * Added 33 new host keys.
  * Added 46 new key exchanges.
  * Added 28 new ciphers.
  * Added 5 new MACs.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1694260800">- Update to version 3.0.0
  * Results from concurrent scans against multiple hosts are no
    longer improperly combined.
  * Hostname resolution failure no longer causes scans against
    multiple hosts to terminate unexpectedly.
  * Algorithm recommendations resulting from warnings are now
    printed in yellow instead of red.
  * Added failure, warning, and info notes to JSON output (note
    that this results in a breaking change to the banner protocol,
    "enc", and "mac" fields).
  * Fixed crash during GEX tests.
  * Refined GEX testing against OpenSSH servers: when the fallback
    mechanism is suspected of being triggered, perform an
    additional test to obtain more accurate results.
  * The color of all notes will be printed in green when the
    related algorithm is rated good.
  * Prioritized host key certificate algorithms for Ubuntu
    22.04 LTS client policy.
  * Marked all NIST K-, B-, and T-curves as unproven since they
    are so rarely used.
  * Added built-in policy for OpenSSH 9.4.
  * Added 12 new host keys
  * Added 15 new key exchanges.
  * Added 8 new ciphers.
  * Added 14 new MACs.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1703073600">- Update to 3.1.0:
  * Added test for the Terrapin message prefix truncation
    vulnerability (CVE-2023-48795).
  * Dropped support for Python 3.7 (EOL was reached in June 2023).
  * Added Python 3.12 support.
  * In server policies, reduced expected DH modulus sizes from
    4096 to 3072 to match the online hardening guides (note that
    3072-bit moduli provide the equivalent of 128-bit symmetric
    security).
  * In Ubuntu 22.04 client policy, moved host key types
    sk-ssh-ed25519@openssh.com and ssh-ed25519 to the end of all
    certificate types.
  * Updated Ubuntu Server &amp; Client policies for 20.04 and 22.04
    to account for key exchange list changes due to Terrapin
    vulnerability patches.
  * Re-organized option host key types for OpenSSH 9.2 server
    policy to correspond with updated Debian 12 hardening guide.
  * Added built-in policies for OpenSSH 9.5 and 9.6.
  * Added an additional_notes field to the JSON output.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1713873600">- Update to version 3.2.0
  * Added implementation of the DHEat denial-of-service attack
    (see --dheat option; CVE-2002-20001).
  * Expanded filter of CBC ciphers to flag for the Terrapin
    vulnerability. It now includes more rarely found ciphers.
  * Fixed parsing of ecdsa-sha2-nistp* CA signatures on host keys.
    Additionally, they are now flagged as potentially
    back-doored, just as standard host keys are.
  * Gracefully handle rare exceptions (i.e.: crashes) while
    performing GEX tests.
  * Built-in policies now include a change log (use -L -v to view
    them).
  * Custom policies now support the
    allow_algorithm_subset_and_reordering directive to allow
    targets to pass with a subset and/or re-ordered list of host
    keys, kex, ciphers, and MACs. This allows for the creation of
    a baseline policy where targets can optionally implement
    stricter controls;
  * Custom policies now support the allow_larger_keys directive to
    allow targets to pass with larger host keys, CA keys, and
    Diffie-Hellman keys. This allows for the creation of a baseline
    policy where targets can optionally implement stricter controls
  * Color output is disabled if the NO_COLOR environment variable
    is set (see https://no-color.org/).
  * Added 1 new key exchange algorithm: gss-nistp384-sha384-*.
  * Added 1 new cipher: aes128-ocb@libassh.org.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1728993600">- Update to version 3.3.0
  * Added Python 3.13 support.
  * Added built-in policies for Ubuntu 24.04 LTS server &amp; client,
    OpenSSH 9.8, and OpenSSH 9.9.
  * Added IPv6 support for DHEat and connection rate tests.
  * Added TCP port information to JSON policy scan results.
  * Added LANcom LCOS server recognition and Ed448 key extraction
  * Now reports ECDSA and DSS fingerprints when in verbose mode.
  * Removed CVE information based on server/client version numbers,
    as this was wildly inaccurate (see this thread for the full
    discussion, as well as the results of the community vote on
    this matter).
  * Fixed crash when running with -P and -T options simultaneously.
  * Fixed host key tests from only reporting a key type at most
    once despite multiple hosts supporting it.
  * Fixed invalid JSON output when a socket error occurs while
    performing a client audit.
  * When scanning multiple targets (using -T/--targets),
    the -p/--port option will now be used as the default port
    (set to 22 if -p/--port is not given). Hosts specified in the
    file can override this default with an explicit port number
    (i.e.: "host1:1234"). For example, when using -T targets.txt
  - p 222, all hosts in targets.txt that do not explicitly include
    a port number will default to 222; when using -T targets.txt
    (without -p), all hosts will use a default of 22.
  * Updated built-in server &amp; client policies for
    Amazon Linux 2023, Debian 12, Rocky Linux 9, and Ubuntu 22.04
    to improve host key efficiency and cipher resistance to quantum
    attacks.
  * Added 1 new cipher: grasshopper-ctr128.
  * Added 2 new key exchanges: mlkem768x25519-sha256,
    sntrup761x25519-sha512.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1783252800">- Update to version 3.9.0
  * Warnings will be issued on key exchanges that are not
    post-quantum safe.
  * Hardening guides are now included for all supported platforms
    (see --list-hardening-guides).
  * UNIX sockets can be used as scan targets (specified with
    unix:///path/to/socket); useful in containerized environments
    such as CI/CD pipelines.
  * Scanning through SOCKS5 proxies can now be done (with --socks5)
  * A variety of new post-quantum algorithms can now be identified.
- Update ssh-audit.keyring</changelog>
</package>
<package pkgid="f4123abfa00144665232f1819184ac4df97f6c07bcab9053a0f0b1de8247abbe00e3e93c07871aa8f84dfaedaff2193aeb93edc57c8ee7c9ac41a57803746e06" name="ssh-audit" arch="src">
  <version epoch="0" ver="3.9.0" rel="23.3"/>
  <changelog author="lars@linux-schulserver.de - 2.0.0" date="1569412800">- initial version 2.0.0</changelog>
  <changelog author="Lars Vogdt &lt;lars@linux-schulserver.de&gt;" date="1573819200">- update to 2.1.0:
  The highlights of this release include client-testing functionality to audit
  the protocols accepted by client software, a JSON output format, support for
  new algorithms, and bugfixes. Below is the full changelog:
  + Added client software auditing functionality (see -c / --client-audit option).
  + Added JSON output option (see -j / --json option; credit Andreas Jaggi).
  + Fixed crash while scanning Solaris Sun_SSH.</changelog>
  <changelog author="Lars Vogdt &lt;lars@linux-schulserver.de&gt;" date="1577620800">- update to 2.1.1:
  This maintenance release focuses on improving support for client testing.
  The full changelog is:
  + Added 2 new host key types: rsa-sha2-256-cert-v01@openssh.com,
    rsa-sha2-512-cert-v01@openssh.com.
  + Added 2 new ciphers: des, 3des.
  + Added 3 new PuTTY vulnerabilities.
  + During client testing, client IP address is now listed in output.
- added _service file
- add signatures for source verification</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1580731200">* Remove _service file; use download URL for all files
  * Run spec-cleaner
  * Don't package ssh-audit with the .py extension
  * Run testsuite</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1580817600">- Rename keyring to %name.keyring</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1583928000">- Update to version 2.2.0
  * Marked host key type ssh-rsa as weak due to practical SHA-1
    collisions.
  * Added 10 new host key types:
    ecdsa-sha2-1.3.132.0.10, x509v3-sign-dss, x509v3-sign-rsa,
    x509v3-sign-rsa-sha256@ssh.com,
    x509v3-ssh-dss, x509v3-ssh-rsa,
    sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,
    sk-ecdsa-sha2-nistp256@openssh.com,
    sk-ssh-ed25519-cert-v01@openssh.com,
    and sk-ssh-ed25519@openssh.com.
  * Added 18 new key exchanges:
    diffie-hellman-group14-sha256@ssh.com,
    diffie-hellman-group15-sha256@ssh.com,
    diffie-hellman-group15-sha384@ssh.com,
    diffie-hellman-group16-sha384@ssh.com,
    diffie-hellman-group16-sha512@ssh.com,
    diffie-hellman-group18-sha512@ssh.com,
    ecdh-sha2-curve25519, ecdh-sha2-nistb233,
    ecdh-sha2-nistb409, ecdh-sha2-nistk163,
    ecdh-sha2-nistk233, ecdh-sha2-nistk283,
    ecdh-sha2-nistk409, ecdh-sha2-nistp192,
    ecdh-sha2-nistp224, ecdh-sha2-nistt571,
    gss-gex-sha1-, and gss-group1-sha1-.
  * Added 9 new ciphers:
    camellia128-cbc, camellia128-ctr, camellia192-cbc,
    camellia192-ctr, camellia256-cbc, camellia256-ctr,
    aes128-gcm, aes256-gcm, and chacha20-poly1305.
  * Added 2 new MACs:
    aes128-gcm and aes256-gcm.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1601294400">- Update to version 2.3.0
  The highlight of this release is support for policy scanning
  (this allows an admin to test a server against a
  hardened/standard configuration).
  * Added new policy auditing functionality to test adherence to
    a hardening guide/standard configuration
    (see -L/--list-policies, -M/--make-policy and -P/--policy).
  * Created new man page (see ssh-audit.1 file).
  * 1024-bit moduli upgraded from warnings to failures.
  * Many Python 2 code clean-ups, testing framework improvements,
    pylint &amp; flake8 fixes, and mypy type comments.
  * Added feature to look up algorithms in internal database
    (see --lookup)
  * Suppress recommendation of token host key types.
  * Added check for use-after-free vulnerability in PuTTY v0.73.
  * Added 11 new host key types: ssh-rsa1, ssh-dss-sha256@ssh.com,
    ssh-gost2001, ssh-gost2012-256, ssh-gost2012-512,
    spki-sign-rsa, ssh-ed448, x509v3-ecdsa-sha2-nistp256,
    x509v3-ecdsa-sha2-nistp384, x509v3-ecdsa-sha2-nistp521,
    x509v3-rsa2048-sha256.
  * Added 8 new key exchanges: diffie-hellman-group1-sha256,
    kexAlgoCurve25519SHA256, Curve25519SHA256, gss-group14-sha256-,
    gss-group15-sha512-, gss-group16-sha512-, gss-nistp256-sha256-,
    gss-curve25519-sha256-.
  * Added 5 new ciphers: blowfish, AEAD_AES_128_GCM,
    AEAD_AES_256_GCM, crypticore128@ssh.com, seed-cbc@ssh.com.
  * Added 3 new MACs: chacha20-poly1305@openssh.com, hmac-sha3-224,
    crypticore-mac@ssh.com.
- Update ssh-audit.keyring</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1604059200">- Update to version 2.3.1
  * Now parses public key sizes for
    rsa-sha2-256-cert-v01@openssh.com and
    rsa-sha2-512-cert-v01@openssh.com host key types.
  * Flag ssh-rsa-cert-v01@openssh.com as a failure due to SHA-1
    hash.
  * Fixed bug in recommendation output which suppressed some
    algorithms inappropriately.
  * Built-in policies now include CA key requirements (if
    certificates are in use).
  * Lookup function (--lookup) now performs case-insensitive
    lookups of similar algorithms.
  * Migrated pre-made policies from external files to internal
    database.
  * Split single 3,500 line script into many files (by class).
  * Added setup.py support
  * Added 1 new cipher: des-cbc@ssh.com.
- Install manpage
- Use py-* rpm macros</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1614600000">- Update to version 2.4.0
  * Added multi-threaded scanning support.
  * Added version check for OpenSSH user enumeration
    (CVE-2018-15473).
  * Added deprecation note to host key types based on SHA-1.
  * Added extra warnings for SSHv1.
  * Added built-in hardened OpenSSH v8.5 policy.
  * Upgraded warnings to failures for host key types based on SHA-1
  * Fixed crash when receiving unexpected response during host key
    test.
  * Fixed hang against older Cisco devices during host key test &amp;
    gex test.
  * Fixed improper termination while scanning multiple targets when
    one target returns an error.
  * Dropped support for Python 3.5 (which reached EOL in Sept.2020)
  * Added 1 new key exchange: sntrup761x25519-sha512@openssh.com.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1629979200">- Update to version 2.5.0
  * Fixed crash when running host key tests.
  * Handles server connection failures more gracefully.
  * Now prints JSON with indents when -jj is used (useful for
    debugging).
  * Added MD5 fingerprints to verbose output.
  * Added -d/--debug option for getting debugging output.
  * Updated JSON output to include MD5 fingerprints. Note that
    this results in a breaking change in the 'fingerprints'
    dictionary format.
  * Updated OpenSSH 8.1 (and earlier) policies to include
    rsa-sha2-512 and rsa-sha2-256.
  * Added OpenSSH v8.6 &amp; v8.7 policies.
  * Added 3 new key exchanges:
    + gss-gex-sha1-eipGX3TCiQSrx573bT1o1Q==
    + gss-group1-sha1-eipGX3TCiQSrx573bT1o1Q==
    + gss-group14-sha1-eipGX3TCiQSrx573bT1o1Q==
  * Added 3 new MACs:
    + hmac-ripemd160-96
    + AEAD_AES_128_GCM
    + AEAD_AES_256_GCM</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1630324800">- Require correct python version</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1682942400">- Update to version 2.9.0
  * Dropped support for Python 3.6
  * Updated CVE database.
  * Added -g and --gex-test for granular GEX modulus size tests.
  * JSON 'target' field now always includes port number.
  * JSON output now includes recommendations and CVE data.
  * Mixed host key/CA key types (i.e.: RSA host keys signed with
    ED25519 CAs, etc.) are now properly handled.
  * Warnings are now printed for 2048-bit moduli.
  * SHA-1 algorithms now cause failures.
  * CBC mode ciphers are now warnings instead of failures.
  * Generic failure/warning messages replaced with more specific
    reasons (i.e.:'using weak cipher' =&gt; 'using broken RC4 cipher')
  * Updated built-in policies to include missing host key size
    information.
  * Added built-in policies for OpenSSH 8.8, 8.9, 9.0, 9.1, 9.2,
    and 9.3.
  * Added 33 new host keys.
  * Added 46 new key exchanges.
  * Added 28 new ciphers.
  * Added 5 new MACs.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1694260800">- Update to version 3.0.0
  * Results from concurrent scans against multiple hosts are no
    longer improperly combined.
  * Hostname resolution failure no longer causes scans against
    multiple hosts to terminate unexpectedly.
  * Algorithm recommendations resulting from warnings are now
    printed in yellow instead of red.
  * Added failure, warning, and info notes to JSON output (note
    that this results in a breaking change to the banner protocol,
    "enc", and "mac" fields).
  * Fixed crash during GEX tests.
  * Refined GEX testing against OpenSSH servers: when the fallback
    mechanism is suspected of being triggered, perform an
    additional test to obtain more accurate results.
  * The color of all notes will be printed in green when the
    related algorithm is rated good.
  * Prioritized host key certificate algorithms for Ubuntu
    22.04 LTS client policy.
  * Marked all NIST K-, B-, and T-curves as unproven since they
    are so rarely used.
  * Added built-in policy for OpenSSH 9.4.
  * Added 12 new host keys
  * Added 15 new key exchanges.
  * Added 8 new ciphers.
  * Added 14 new MACs.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1703073600">- Update to 3.1.0:
  * Added test for the Terrapin message prefix truncation
    vulnerability (CVE-2023-48795).
  * Dropped support for Python 3.7 (EOL was reached in June 2023).
  * Added Python 3.12 support.
  * In server policies, reduced expected DH modulus sizes from
    4096 to 3072 to match the online hardening guides (note that
    3072-bit moduli provide the equivalent of 128-bit symmetric
    security).
  * In Ubuntu 22.04 client policy, moved host key types
    sk-ssh-ed25519@openssh.com and ssh-ed25519 to the end of all
    certificate types.
  * Updated Ubuntu Server &amp; Client policies for 20.04 and 22.04
    to account for key exchange list changes due to Terrapin
    vulnerability patches.
  * Re-organized option host key types for OpenSSH 9.2 server
    policy to correspond with updated Debian 12 hardening guide.
  * Added built-in policies for OpenSSH 9.5 and 9.6.
  * Added an additional_notes field to the JSON output.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1713873600">- Update to version 3.2.0
  * Added implementation of the DHEat denial-of-service attack
    (see --dheat option; CVE-2002-20001).
  * Expanded filter of CBC ciphers to flag for the Terrapin
    vulnerability. It now includes more rarely found ciphers.
  * Fixed parsing of ecdsa-sha2-nistp* CA signatures on host keys.
    Additionally, they are now flagged as potentially
    back-doored, just as standard host keys are.
  * Gracefully handle rare exceptions (i.e.: crashes) while
    performing GEX tests.
  * Built-in policies now include a change log (use -L -v to view
    them).
  * Custom policies now support the
    allow_algorithm_subset_and_reordering directive to allow
    targets to pass with a subset and/or re-ordered list of host
    keys, kex, ciphers, and MACs. This allows for the creation of
    a baseline policy where targets can optionally implement
    stricter controls;
  * Custom policies now support the allow_larger_keys directive to
    allow targets to pass with larger host keys, CA keys, and
    Diffie-Hellman keys. This allows for the creation of a baseline
    policy where targets can optionally implement stricter controls
  * Color output is disabled if the NO_COLOR environment variable
    is set (see https://no-color.org/).
  * Added 1 new key exchange algorithm: gss-nistp384-sha384-*.
  * Added 1 new cipher: aes128-ocb@libassh.org.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1728993600">- Update to version 3.3.0
  * Added Python 3.13 support.
  * Added built-in policies for Ubuntu 24.04 LTS server &amp; client,
    OpenSSH 9.8, and OpenSSH 9.9.
  * Added IPv6 support for DHEat and connection rate tests.
  * Added TCP port information to JSON policy scan results.
  * Added LANcom LCOS server recognition and Ed448 key extraction
  * Now reports ECDSA and DSS fingerprints when in verbose mode.
  * Removed CVE information based on server/client version numbers,
    as this was wildly inaccurate (see this thread for the full
    discussion, as well as the results of the community vote on
    this matter).
  * Fixed crash when running with -P and -T options simultaneously.
  * Fixed host key tests from only reporting a key type at most
    once despite multiple hosts supporting it.
  * Fixed invalid JSON output when a socket error occurs while
    performing a client audit.
  * When scanning multiple targets (using -T/--targets),
    the -p/--port option will now be used as the default port
    (set to 22 if -p/--port is not given). Hosts specified in the
    file can override this default with an explicit port number
    (i.e.: "host1:1234"). For example, when using -T targets.txt
  - p 222, all hosts in targets.txt that do not explicitly include
    a port number will default to 222; when using -T targets.txt
    (without -p), all hosts will use a default of 22.
  * Updated built-in server &amp; client policies for
    Amazon Linux 2023, Debian 12, Rocky Linux 9, and Ubuntu 22.04
    to improve host key efficiency and cipher resistance to quantum
    attacks.
  * Added 1 new cipher: grasshopper-ctr128.
  * Added 2 new key exchanges: mlkem768x25519-sha256,
    sntrup761x25519-sha512.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1783252800">- Update to version 3.9.0
  * Warnings will be issued on key exchanges that are not
    post-quantum safe.
  * Hardening guides are now included for all supported platforms
    (see --list-hardening-guides).
  * UNIX sockets can be used as scan targets (specified with
    unix:///path/to/socket); useful in containerized environments
    such as CI/CD pipelines.
  * Scanning through SOCKS5 proxies can now be done (with --socks5)
  * A variety of new post-quantum algorithms can now be identified.
- Update ssh-audit.keyring</changelog>
</package>
<package pkgid="ac9dcfd2049a0598cbdc99a4f35060f57232ec919f5f3dcd3dc7b02a31ba8da0c21df4fd621cffad68df5e856e2a03a7536e907b1a2f6be39f9f5e23f96ed2a9" name="ssh-import-id" arch="noarch">
  <version epoch="0" ver="5.11" rel="3.39"/>
  <changelog author="Hans Petter Jansson &lt;hpj@suse.com&gt;" date="1632139200">- Initial build at version 5.11.</changelog>
</package>
<package pkgid="2195edde9c36fb757d1548238900b645753629b6b0875d392f8ae8e7daa86738b74b109c430f231da8d3c6fafdae4d3a5d9422c60344198cecfd63a715a0109b" name="ssh-import-id" arch="src">
  <version epoch="0" ver="5.11" rel="3.39"/>
  <changelog author="Hans Petter Jansson &lt;hpj@suse.com&gt;" date="1632139200">- Initial build at version 5.11.</changelog>
</package>
<package pkgid="246aea79439fbc55ab318e24d5441cc29557e22ffeb87a4ccecd084b4449368099b03fc3941afe70ff9b30c5911abf30124df10318b9cb666a3f6a81962a9dbd" name="sshguard" arch="s390x">
  <version epoch="0" ver="2.4.3" rel="60.14"/>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1560254400">- Build version 2.4.0
  * Match "Failed authentication attempt" for Gitea
  * Log human-readable service names instead of service code
  * Correctly terminate child processes when sshguard is killed
  * No longer accept logs given via standard input</changelog>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1598443200">- Build version 2.4.1
  * Recognize RFC 5424 syslog banners
  * Recognize busybox syslog -S banners
  * Recognize rsyslog banners
  * Recognize web services TYPO3, Contao, and Joomla
  * Update signatures for Dovecot
  * Update signatures for OpenSSH
  * Whitelist entire 127.0.0.0/8 and ::1 block
  * Whitelist file allows inline comments
  * Fix FILES and LOGREADER configuration file options
- boo#1124121</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620820800">- Update to version 2.4.2
  * Recognize rejections from Postfix's postscreen daemon
  * The parser can now be changed using the 'PARSER' and
    'POST_PARSER' options
  * Remove some false positive attack signatures for SSH and Cyrus
  * Adjust log verbosity of some log messages
  * The *firewalld* backend now uses *firewall-cmd* instead of
    'iptables' to flush block lists</changelog>
  <changelog author="Enrico Belleri &lt;idesmi@protonmail.com&gt;" date="1621166400">- Changed 'BACKEND' to "/usr/libexec/sshg-fw-iptables" from incorrect syntax</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1637668800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_sshguard.service.patch
  Modified:
  * sshguard.service</changelog>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1642680000">- Deleted the iptables entries from sshguard.service as firewalld is used
- Added BACKEND="/usr/libexec/sshg-fw-firewalld" in stead of
  BACKEND="/usr/libexec/sshg-fw-iptables" as firewalld is used</changelog>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1643025600">- Corrected the BACKEND in /etc/sshguard.conf</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1661860800">- sshguard-overflow.patch: fixed 1 byte 0x00 overwrite in a memset
  (bsc#1202944)</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1696248000">- update to version 2.4.3:
  * Add signature for BIND
  * Add signature for Gitea
  * Add signature for Microsoft SQL Server for Linux
  * Add signature for OpenVPN Portshare
  * Add signature for user-defined HTTP attacks
  * Update signatures for Dovecot
  * Update signatures for Postfix
  * Fixed Fix memset off-by-one
  * Fixed Resolve DNS names in capability mode using casper
- removed patch sshguard-overflow.patch as fixed in upstream
- clean up .spec file</changelog>
  <changelog author="pgajdos@suse.com" date="1740744000">- added patches
  fix build with gcc15
  + sshguard-gcc15.patch</changelog>
</package>
<package pkgid="b7d2f7f4e921a91a643fa933a81e41240b54171c5aa1d2b00a22675c3c6a3d0df25ca5d4f2665ac7fae77e2d297a22704f04ba7a87bc211aea7196fcc9df8031" name="sshguard" arch="src">
  <version epoch="0" ver="2.4.3" rel="60.14"/>
  <changelog author="joop.boonen@opensuse.org" date="1452513600">- Added ip6tables support handles via init and service files</changelog>
  <changelog author="eshmarnev@suse.com" date="1455796800">- Build version 1.6.3
  - Disable blacklisting by default
  - Implement logging as wrappers around syslog(2)
  - Improve log and error messages
  - Match sendmail authentication failures
  - Remove PID file option
  - Remove SIGTSTP and SIGCONT handler
  - Remove reverse mapping attack signature
  - Remove safe_fgets() and exit on interrupt
  - Terminate state entries for hosts blocked with pf
  - Update and shorten command-line usage
  - Use 'configure' to set feature-test macros
- Updated patch file for new version of sshguard</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1455883200">- Added a corrected attack treshold value (40 default)</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1483012800">- Build version 1.7.1
  - Add sample Mac OS X 10.12 style launchd.plist
  - Allow multiple forward slashes in process name
  - Log released addresses only when debugging
  - Process validation (``-f`` option) is deprecated
  - Adjust TIMESTAMP_ISO8601 for Mac OS X 10.12
  - Fix build error in hosts backend
  - Fix empty functions in firewall scripts causing errors with Bash
  - Flush stdout after every line in sshg-parser
  - Add *sshg-logtail*
  - Add *sshg-parser*
  - Control firewall using *sshg-fw*
  - Match "no matching key exchange method" for SSH
  - Hosts backend is deprecated
  - Logsuck (``-l`` option) is deprecated, use *sshg-logtail* instead
  - Process validation (``-f`` option) is deprecated
  - Remove external hooks (``-e`` option)
  - Remove support for genfilt and ipfilter backends
  - Accept socklog messages without a timestamp
  - Fix excessive logging causing endless looping in logsuck
  - Fix undefined assignment of initial inode number
  - Match Postfix pre-authentication disconnects
  - Fix bashisms in iptables backend
  - Fix size argument in inet_ntop() call
  - Remove excessive logging when polling from files
  - Keep looking for unreadable files while polling
  - Update Dovecot signature for POP3
  - Match "Connection reset" message for SSH
  - Resurrect PID file option by popular demand
  - Adjust default abuse threshold</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1488369600">- Add a systemd journal tail so sshguard can parse this file</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1541678400">-  Corrected the service scripts, start after network.target</changelog>
  <changelog author="liedke@rz.uni-mannheim.de" date="1548331200">- Build version 2.3.1
  * Fix OpenSSH "Did not receive identification string"
  * Fix syslog banner detection on macOS
- Build version 2.3.0
  * Add signatures for Courier IMAP/POP and OpenVPN
  * Add signatures for TLS failures against Cyrus IMAP
  * Match more attacks against SSHD, Cockpit, and Dovecot
  * Update SSH invalid user signature for macOS
  * Add to and remove from ipfw table quietly
  * Reduce "Connection closed... [preauth]" score to 2
  * Switch ipsets to hash:net
  * Don't recreate existing ipsets
  * Match more log banners (Fix greedy SYSLOG_BANNER)
- Build version 2.2.0
  * Add '--disable-maintainer-mode' in configure for package maintainers
  * BusyBox log banner detection
  * Match Exim "auth mechanism not supported"
  * Match Exim "auth when not advertised"
  * Match Postfix greylist early retry
  * OpenSMTPD monitoring support
  * Recognize IPv6 addresses with interface name
  * Ignore CR in addition to LF
  * Only log attacks if not already blocked or whitelisted
  * Use correct signal names in driver shell script
- Build version 2.1.0
  * Add nftables backend
  * Add monitoring support for new service: Cockpit, Linux server dashboard
  * Match "maximum authentication attempts" for SSH
  * Match Debian-style "Failed password for invalid user" for SSH
  * Add monitoring support for new service: Common webserver probes, in
    Common Log Format
  * Match 'Disconnecting invalid user' for SSH
  * Add monitoring support for new service: WordPress, in Common Log Format
  * Add monitoring support for new service: SSHGuard
  * Firewall backends now support blocking subnets.
  * Add new IPV6_SUBNET and IPV4_SUBNET configuration options. Defaults
    to traditional single-address blocking.
  * Add monitoring support for new service: OpenSMTPD
  * Log whitelist matches with higher priority
  * Match port number in "invalid user" attack
  * FirewallD backend reloads firewall configuration less often.
- Build version 2.0.0
  * Add firewalld backend
  * Add ipset backend
  * Annotate logs using -a flag to sshg-parser
  * Match "no matching cipher" for SSH
  * Preliminary support for Capsicum and pledge()
  * Resurrect ipfilter backend
  * Support reading from os_log on macOS 10.12 and systemd journal
  * Add warning when reading from standard input
  * Build and install all backends by default
  * Improve log messages and tweak logging priorities
  * Runtime flags now configurable in the configuration file
  * SSHGuard requires a configuration file to start
  * Remove process validation (-f option)
  * Fix ipfw backend on FreeBSD 11
  * Fix initial block time
  * Update Dovecot pattern for macOS
  * Use standard score for Sendmail auth attack</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549281600">- Use noun phrase in summary.
- Join %service_* to reduce generated boilerplate.</changelog>
  <changelog author="joop.boonen@opensuse.org" date="1549454400">- Removed not needed files and service files
  as sshguard can now parse journal files
- /etc/sysconfig/sshguard is not used any more
  as sshguard uses it's own config file</changelog>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1560254400">- Build version 2.4.0
  * Match "Failed authentication attempt" for Gitea
  * Log human-readable service names instead of service code
  * Correctly terminate child processes when sshguard is killed
  * No longer accept logs given via standard input</changelog>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1598443200">- Build version 2.4.1
  * Recognize RFC 5424 syslog banners
  * Recognize busybox syslog -S banners
  * Recognize rsyslog banners
  * Recognize web services TYPO3, Contao, and Joomla
  * Update signatures for Dovecot
  * Update signatures for OpenSSH
  * Whitelist entire 127.0.0.0/8 and ::1 block
  * Whitelist file allows inline comments
  * Fix FILES and LOGREADER configuration file options
- boo#1124121</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620820800">- Update to version 2.4.2
  * Recognize rejections from Postfix's postscreen daemon
  * The parser can now be changed using the 'PARSER' and
    'POST_PARSER' options
  * Remove some false positive attack signatures for SSH and Cyrus
  * Adjust log verbosity of some log messages
  * The *firewalld* backend now uses *firewall-cmd* instead of
    'iptables' to flush block lists</changelog>
  <changelog author="Enrico Belleri &lt;idesmi@protonmail.com&gt;" date="1621166400">- Changed 'BACKEND' to "/usr/libexec/sshg-fw-iptables" from incorrect syntax</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1637668800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_sshguard.service.patch
  Modified:
  * sshguard.service</changelog>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1642680000">- Deleted the iptables entries from sshguard.service as firewalld is used
- Added BACKEND="/usr/libexec/sshg-fw-firewalld" in stead of
  BACKEND="/usr/libexec/sshg-fw-iptables" as firewalld is used</changelog>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1643025600">- Corrected the BACKEND in /etc/sshguard.conf</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1661860800">- sshguard-overflow.patch: fixed 1 byte 0x00 overwrite in a memset
  (bsc#1202944)</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1696248000">- update to version 2.4.3:
  * Add signature for BIND
  * Add signature for Gitea
  * Add signature for Microsoft SQL Server for Linux
  * Add signature for OpenVPN Portshare
  * Add signature for user-defined HTTP attacks
  * Update signatures for Dovecot
  * Update signatures for Postfix
  * Fixed Fix memset off-by-one
  * Fixed Resolve DNS names in capability mode using casper
- removed patch sshguard-overflow.patch as fixed in upstream
- clean up .spec file</changelog>
  <changelog author="pgajdos@suse.com" date="1740744000">- added patches
  fix build with gcc15
  + sshguard-gcc15.patch</changelog>
</package>
<package pkgid="6bda379f00d72e5a4a9a5d6666c54a4d81f5d6b4289ef15455270682ee16bb1e076b25afb1aa8f54897105ae2cbe46f3b37ee7efca38342fa50b96eb01fedab0" name="sshguard-debuginfo" arch="s390x">
  <version epoch="0" ver="2.4.3" rel="60.14"/>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1560254400">- Build version 2.4.0
  * Match "Failed authentication attempt" for Gitea
  * Log human-readable service names instead of service code
  * Correctly terminate child processes when sshguard is killed
  * No longer accept logs given via standard input</changelog>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1598443200">- Build version 2.4.1
  * Recognize RFC 5424 syslog banners
  * Recognize busybox syslog -S banners
  * Recognize rsyslog banners
  * Recognize web services TYPO3, Contao, and Joomla
  * Update signatures for Dovecot
  * Update signatures for OpenSSH
  * Whitelist entire 127.0.0.0/8 and ::1 block
  * Whitelist file allows inline comments
  * Fix FILES and LOGREADER configuration file options
- boo#1124121</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620820800">- Update to version 2.4.2
  * Recognize rejections from Postfix's postscreen daemon
  * The parser can now be changed using the 'PARSER' and
    'POST_PARSER' options
  * Remove some false positive attack signatures for SSH and Cyrus
  * Adjust log verbosity of some log messages
  * The *firewalld* backend now uses *firewall-cmd* instead of
    'iptables' to flush block lists</changelog>
  <changelog author="Enrico Belleri &lt;idesmi@protonmail.com&gt;" date="1621166400">- Changed 'BACKEND' to "/usr/libexec/sshg-fw-iptables" from incorrect syntax</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1637668800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_sshguard.service.patch
  Modified:
  * sshguard.service</changelog>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1642680000">- Deleted the iptables entries from sshguard.service as firewalld is used
- Added BACKEND="/usr/libexec/sshg-fw-firewalld" in stead of
  BACKEND="/usr/libexec/sshg-fw-iptables" as firewalld is used</changelog>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1643025600">- Corrected the BACKEND in /etc/sshguard.conf</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1661860800">- sshguard-overflow.patch: fixed 1 byte 0x00 overwrite in a memset
  (bsc#1202944)</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1696248000">- update to version 2.4.3:
  * Add signature for BIND
  * Add signature for Gitea
  * Add signature for Microsoft SQL Server for Linux
  * Add signature for OpenVPN Portshare
  * Add signature for user-defined HTTP attacks
  * Update signatures for Dovecot
  * Update signatures for Postfix
  * Fixed Fix memset off-by-one
  * Fixed Resolve DNS names in capability mode using casper
- removed patch sshguard-overflow.patch as fixed in upstream
- clean up .spec file</changelog>
  <changelog author="pgajdos@suse.com" date="1740744000">- added patches
  fix build with gcc15
  + sshguard-gcc15.patch</changelog>
</package>
<package pkgid="9e90cfefdbad41ce3fb4f0747b0faa8d7c55b935ec990778e141c1b326dfacdfd06c67cbb004035311a4b63a716039f5fa4e907aa98282f6d8aa9e9823aea691" name="sshguard-debugsource" arch="s390x">
  <version epoch="0" ver="2.4.3" rel="60.14"/>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1560254400">- Build version 2.4.0
  * Match "Failed authentication attempt" for Gitea
  * Log human-readable service names instead of service code
  * Correctly terminate child processes when sshguard is killed
  * No longer accept logs given via standard input</changelog>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1598443200">- Build version 2.4.1
  * Recognize RFC 5424 syslog banners
  * Recognize busybox syslog -S banners
  * Recognize rsyslog banners
  * Recognize web services TYPO3, Contao, and Joomla
  * Update signatures for Dovecot
  * Update signatures for OpenSSH
  * Whitelist entire 127.0.0.0/8 and ::1 block
  * Whitelist file allows inline comments
  * Fix FILES and LOGREADER configuration file options
- boo#1124121</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620820800">- Update to version 2.4.2
  * Recognize rejections from Postfix's postscreen daemon
  * The parser can now be changed using the 'PARSER' and
    'POST_PARSER' options
  * Remove some false positive attack signatures for SSH and Cyrus
  * Adjust log verbosity of some log messages
  * The *firewalld* backend now uses *firewall-cmd* instead of
    'iptables' to flush block lists</changelog>
  <changelog author="Enrico Belleri &lt;idesmi@protonmail.com&gt;" date="1621166400">- Changed 'BACKEND' to "/usr/libexec/sshg-fw-iptables" from incorrect syntax</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1637668800">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_sshguard.service.patch
  Modified:
  * sshguard.service</changelog>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1642680000">- Deleted the iptables entries from sshguard.service as firewalld is used
- Added BACKEND="/usr/libexec/sshg-fw-firewalld" in stead of
  BACKEND="/usr/libexec/sshg-fw-iptables" as firewalld is used</changelog>
  <changelog author="Joop Boonen &lt;joop.boonen@opensuse.org&gt;" date="1643025600">- Corrected the BACKEND in /etc/sshguard.conf</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1661860800">- sshguard-overflow.patch: fixed 1 byte 0x00 overwrite in a memset
  (bsc#1202944)</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1696248000">- update to version 2.4.3:
  * Add signature for BIND
  * Add signature for Gitea
  * Add signature for Microsoft SQL Server for Linux
  * Add signature for OpenVPN Portshare
  * Add signature for user-defined HTTP attacks
  * Update signatures for Dovecot
  * Update signatures for Postfix
  * Fixed Fix memset off-by-one
  * Fixed Resolve DNS names in capability mode using casper
- removed patch sshguard-overflow.patch as fixed in upstream
- clean up .spec file</changelog>
  <changelog author="pgajdos@suse.com" date="1740744000">- added patches
  fix build with gcc15
  + sshguard-gcc15.patch</changelog>
</package>
<package pkgid="bfa99165428caa97a45462672791fd4db310dbba2e525208f8540e5cc1fa49a9760fb5e03b03dea7e90515b00f46513908627ef39a90e26fad50e9ed016d7cd8" name="sshuttle" arch="noarch">
  <version epoch="0" ver="1.3.2" rel="53.12"/>
  <changelog author="pgajdos@suse.com" date="1650888000">- version update to 1.1.0
  * Support the sudo use_pty option which is now the default in some operating systems. See #712.
  * Support doas as well as sudo. See #708.
  * for more details see
    https://github.com/sshuttle/sshuttle/releases/
- modified patches
  % fix-shebang.patch (refreshed)
- python-mock is not required for build</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1651665600">- depend on setuptools_scm also on older dists</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670068800">- update to 1.1.1:
  * Make --sudoers option work properly, fix regression in v1.1.0
  * Clarify --disable-ipv6 in man page.
  * Improve message when bind fails with a IPv6 address
  * Add tests for host name resolution
  * Allows wildcard host names as subnets
  * Fix typo
  * Remove --sudoers, improve --sudoers-no-modify
  * avoid moving/renaming the hosts file - fix docker container issue
  * fixed some spelling mistakes
  * Fix incorrect permissions for /etc/hosts
  * This test broke in Python3.11
  * all elements are strings
  * Replace setuptools_scm with bump2version
- drop fix-shebang.patch (obsolete)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1686571200">- switch to pep517 build for better shebangs</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1688472000">- Remove
  * PrivateDevices=true
  * ProtectHostname=true
  * ProtectClock=true
  * ProtectKernelTunables=true
  * ProtectKernelModules=true
  * ProtectKernelLogs=true
  * RestrictRealtime=true
  settings from service file as they imply NNP, which doesn't work
  with the sudo setup sshuttle uses (bsc#1212949)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1695297600">- add sysusers-requires
- remove sle12 specific conditionals</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729684800">- update to 1.1.2:
  * Removed a little bit of legacy code
  * logging priority to turn off noise
  * Add support for SSHUTTLE_ARGS environment variable
  * tproxy: Apply DNS rules first
  * Workaround when sudo prints text to standard out
  * Keep terminal in a sane state when sudo use_pty is used.
  * Allow flake8 to determine the version of pyflakes
- drop fix-pytest.patch: obsolete (added pytest-cov instead)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1739448000">- update to 1.2.0:
  * Add support for Python 3.11 and Python 3.11
  * bad file descriptor error in windows, fix pytest errors
  * drop Python 3.8 support
  * ensure poetry works for Python 3.9
  * fix broken workflow_dispatch CI rule
  * Remove more references to legacy Python versions
  * replace requirements.txt files with poetry
  * update nix flake to fix problems
  * use Python &amp;gt;= 3.10 for docs</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1762948800">- update to 1.3.2:
  * improve broken pipe (EPIPE) error handling in socket
    operations
  * Updates sudoers config according to executable
  * switch to a network namespace on Linux
  * prevent UnicodeDecodeError parsing iptables rule with
    comments
  * remove temp build hack
  * support ':' sign in password
  * replace nix-env with nix-shell
  * update installation instructions</changelog>
</package>
<package pkgid="2fbea647a49a8fc34ec40f6ef5053ca53724527da3434ab6cb982def1b2c6c4fade2ee4cf80def46f5aa03396ffa9af691395e1bafe5bed9965acbc6db7001cb" name="sshuttle" arch="src">
  <version epoch="0" ver="1.3.2" rel="53.12"/>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1592913600">- Update to 1.0.2:
  + Added:
  * Python 3.8 support.
  * sshpass support.
  * Auto sudoers file (#269).
  * option for latency control buffer size.
  + Removed:
  * Python 2.6 support.
  * Python 2.7 support.
  + Fixed:
  * Leave use of default port to ssh command.
  * Remove unwanted references to Python 2.7 in docs.
  * Replace usage of deprecated imp.
  * Fix connection with @ sign in username.
  * Remove debug message for getpeername failure.
  * Fix crash triggered by port scans closing socket.
  * Added "Running as a service" to docs.
  * Systemd integration.
  * Trap UnicodeError to handle cases where hostnames returned by DNS are invalid.
  * Formatting error in CHANGES.rst
  * Various errors in documentation.
  * Nftables based method.
  * Make hostwatch locale-independent (#379).
  * Add tproxy udp port mark filter that was missed in #144, fixes #367.
  * Capturing of local DNS servers.
  * Crashing on ECONNABORTED.
  * Size of pf_rule, which grew in OpenBSD 6.4.
  * Use prompt for sudo, not needed for doas.
  * Arch linux installation instructions.
  * tests for existing PR-312 (#337).
  * Hyphen in hostname.
  * Assembler import (#319)
  - add fix-pytest.patch</changelog>
  <changelog author="Martin Rey &lt;mrey@suse.com&gt;" date="1595937600">- Update to 1.0.3:
  * Fixed:
  - Ask setuptools to require Python 3.5 and above.
  - Add missing import.
  - Fix formatting typos in usage docs
- Add fix-shebang.patch to fix env-script-interpreter rpmlint error</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1603886400">- Update to 1.0.4:
  * Allow Mux() flush/fill to work with python &lt; 3.5
  * Fix parse_hostport to always return string for host.
  * Require -r/--remote parameter.
  * Add missing package in OpenWRT documentation.
  * Fix doc about --listen option.
  * README: add Ubuntu.
  * Increase IP4 ttl to 63 hops instead of 42.
  * Fix formatting in installation.rst</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1609761600">- Update to 1.0.5:
  + Added
  * IPv6 support in nft method.
  * Intercept DNS requests sent by systemd-resolved.
  * Set default tmark.
  * Fix python2 server compatibility.
  * Python 3.9 support.
  + Fixed
  * Fix #494 sshuttle caught in infinite select() loop.
  * Include sshuttle version in verbose output.
  * Add psutil as dependency in setup.py
  * When subnets and excludes are specified with hostnames, use all IPs.
  * Update/document client's handling of IPv4 and IPv6.
  * Update sdnotify.py documentation.
  * Allow no remote to work.
  * Make prefixes in verbose output more consistent.
  * Make nat and nft rules consistent; improve rule ordering.
  * Make server and client handle resolv.conf differently.
  * Fix handling OSError in FirewallClient#__init__
  * Refactor automatic method selection.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1613736000">- only build for main python3 version, this is not a module</changelog>
  <changelog author="Loic Devulder &lt;ldevulder@suse.com&gt;" date="1623240000">- Add support for a systemd service, this is useful if we want to
  start sshuttle VPN at boot time.</changelog>
  <changelog author="Loic Devulder &lt;ldevulder@suse.com&gt;" date="1623326400">- Fix fix-shebang.patch to use /bin/bash and /bin/sh, as older
  distributions don't have /usr/bin/bash</changelog>
  <changelog author="Loic Devulder &lt;ldevulder@suse.com&gt;" date="1624017600">- Sshuttle service should be started after firewalld</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1637928000">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * sshuttle.service</changelog>
  <changelog author="pgajdos@suse.com" date="1638878400">- do not require pytest-runner for build, it is not needed</changelog>
  <changelog author="pgajdos@suse.com" date="1650888000">- version update to 1.1.0
  * Support the sudo use_pty option which is now the default in some operating systems. See #712.
  * Support doas as well as sudo. See #708.
  * for more details see
    https://github.com/sshuttle/sshuttle/releases/
- modified patches
  % fix-shebang.patch (refreshed)
- python-mock is not required for build</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1651665600">- depend on setuptools_scm also on older dists</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670068800">- update to 1.1.1:
  * Make --sudoers option work properly, fix regression in v1.1.0
  * Clarify --disable-ipv6 in man page.
  * Improve message when bind fails with a IPv6 address
  * Add tests for host name resolution
  * Allows wildcard host names as subnets
  * Fix typo
  * Remove --sudoers, improve --sudoers-no-modify
  * avoid moving/renaming the hosts file - fix docker container issue
  * fixed some spelling mistakes
  * Fix incorrect permissions for /etc/hosts
  * This test broke in Python3.11
  * all elements are strings
  * Replace setuptools_scm with bump2version
- drop fix-shebang.patch (obsolete)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1686571200">- switch to pep517 build for better shebangs</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1688472000">- Remove
  * PrivateDevices=true
  * ProtectHostname=true
  * ProtectClock=true
  * ProtectKernelTunables=true
  * ProtectKernelModules=true
  * ProtectKernelLogs=true
  * RestrictRealtime=true
  settings from service file as they imply NNP, which doesn't work
  with the sudo setup sshuttle uses (bsc#1212949)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1695297600">- add sysusers-requires
- remove sle12 specific conditionals</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729684800">- update to 1.1.2:
  * Removed a little bit of legacy code
  * logging priority to turn off noise
  * Add support for SSHUTTLE_ARGS environment variable
  * tproxy: Apply DNS rules first
  * Workaround when sudo prints text to standard out
  * Keep terminal in a sane state when sudo use_pty is used.
  * Allow flake8 to determine the version of pyflakes
- drop fix-pytest.patch: obsolete (added pytest-cov instead)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1739448000">- update to 1.2.0:
  * Add support for Python 3.11 and Python 3.11
  * bad file descriptor error in windows, fix pytest errors
  * drop Python 3.8 support
  * ensure poetry works for Python 3.9
  * fix broken workflow_dispatch CI rule
  * Remove more references to legacy Python versions
  * replace requirements.txt files with poetry
  * update nix flake to fix problems
  * use Python &amp;gt;= 3.10 for docs</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1762948800">- update to 1.3.2:
  * improve broken pipe (EPIPE) error handling in socket
    operations
  * Updates sudoers config according to executable
  * switch to a network namespace on Linux
  * prevent UnicodeDecodeError parsing iptables rule with
    comments
  * remove temp build hack
  * support ':' sign in password
  * replace nix-env with nix-shell
  * update installation instructions</changelog>
</package>
<package pkgid="f2e677a2689506389783e4fcca77f8012a81e21b2cef398ac4c0685b1cbb6eaf748f10204555481a77c3ce31538f6f43148f60f00b61343b40880b3ae70f69fc" name="ssldump" arch="s390x">
  <version epoch="0" ver="1.9" rel="518.7"/>
  <changelog author="alarrosa@suse.com" date="1435924800">- Added a conditional build requirement to compile in versions
  other than Factory.</changelog>
  <changelog author="mlin@suse.com" date="1498737600">- Compile with libpcap-devel-static if Leap
  * Since pcap updated to new version in 42.3 too, ssldump need to
    compile with libpcap-devel-static.</changelog>
  <changelog author="Michael Calmer &lt;mc@suse.com&gt;" date="1585051200">- fix macro to fix build on openSUSE Leap 15.2</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1618228800">- Specfile overhaul
- Update source URL (original upstream is dead)
- Update to version 1.4
  * Add support for IPv6 traffic dump
  * Fix ja3(s) length of strings used in MD5 computation + update
    MD5 functions.
  * Add support for ja3 &amp; ja3s.
- Update to version 1.3
  * Avoid leak in TCP segment reassembly code.
  * Avoid client session_id related leak.
  * Avoid server_random related leak.
  * Avoid client_random related leak.
  * Check ssl_decode_enum() return code correctly.
  * Exit process_tcp_packet() in case TCP header is incomplete.
  * Check timestamp_diff return code correctly.
  * Cleanup before exit on error.
  * Fix for crash if length of captured frame is less than
    Ethernet header size.
  * Check packet size before looking at IP header.
  * Check return code after string extraction.
  * Limit length during server name decoding.
  * Decode ClientHello v2 properly.
  * Output error to stderr.
  * Avoid leak by freeing SSL decoding context properly.
  * Close everything properly in case of SIGINT.
  * Fix leak in associative array implementation.
  * First import of the JSON output code
  * Do not print information message when no connection is
    cleaned at shutdown.
  * Fix memory leak in ssl_process_server_session_id()
  * Close global pcap struct properly in case of SIGINT.
  * Add missing extension names
  * Code cleanup
  * Add save decrypted datato pcap. first alpha version.
  * Fix for use of deprecated OpenSSL HMAC functions.
  * Fix for type casting related warnings.
  * Add missing function prototype.
  * Remove definitions of unused variables.
  * Fix for uninitialized variables and possible overflow.
  * Remove unused RCSSTRING variable globally.
- Drop patches (not longer needed)
  * ssldump-0.9b3-libpcap.diff
  * random_return.patch
  * ssldump-0.9b3-aes.patch
  * implicit_def.patch
  * ssldump-0.9b3-newssl.patch
  * ssldump-cvs-06-19-2006.diff
  * update-config.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1653566400">- Update to version 1.5
  Changes
  * doc: An example use-case of JA3.
  Other
  * Add parentheses around MAX and MIN.
  * Add support for pcap output to FIFO.</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1675598400">- Update to version 1.6
  Changes:
  * Fix missing port # in pcap files
  * Print MAC keys only for non AEAD ciphers</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1697198400">- Update to version 1.8:
  * Add date to version output
  * Print meaningful error messages
  * use cmake as build tool
  * Add -z option for printing timestamps in front of TCP headers
- Update to version 1.7:
  * For Y2K38 on 32 bit systems time_t tv_sec can be long long
  * Adding tls1.3 decryption support</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1730635200">- Update to version 1.9
  Enhancements
  * Original PCAP Timestamps: Added support for original PCAP
    timestamps, replacing timeofday-generated timestamps for
    improved accuracy.
  * TLS 1.3 Handling: Introduced handling for TLS version 1.3.
  * RAW IP Capture Support: Implemented support for "raw IP"
    captures, allowing capture of packets without Layer 2 headers.
  * Connection Tracker Enhancements: Improved connection tracking
    with live list and purge functionality.
  Bug Fixes
  * Documentation Updates: Updated README layout and fixed command
    documentation.</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1749211200">- Stopped to use leap_version macro</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1760443200">- Dropped usage of libpcap-devel-static library</changelog>
</package>
<package pkgid="b6b7bc4f7aafab9ba9a4548b7654cc48279ea29c1072e4cfdf1965e1de7bbf377dde14c457a5fff34a62b3f224c1628e5bbf544b59454d9f92701042fae69917" name="ssldump" arch="src">
  <version epoch="0" ver="1.9" rel="518.7"/>
  <changelog author="choeger@suse.de" date="1082721600">- use -fno-strict-aliasing to compile
- fixed two functions which does not return anything matching
  their prototypes</changelog>
  <changelog author="choeger@suse.de" date="1108641600">- Bugfix Bugzilla ID#50952 - ssldump has no support for AES cipher-suites</changelog>
  <changelog author="choeger@suse.de" date="1120651200">- #include &lt;string.h&gt; when using related functions</changelog>
  <changelog author="ro@suse.de" date="1129291200">- include openssl/md5.h in ssldecode.c</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="mc@suse.de" date="1181044800">- add ssldump-cvs-06-19-2006.diff
- re-work patch for new ssl version</changelog>
  <changelog author="prusnak@suse.cz" date="1185451200">- changed libpcap to libpcap-devel in BuildRequires</changelog>
  <changelog author="coolo@suse.com" date="1322395200">- add libtool as buildrequire to avoid implicit dependency</changelog>
  <changelog author="coolo@suse.com" date="1327838400">- update config.* files - upstream is dead ;(</changelog>
  <changelog author="dimstar@opensuse.org" date="1435924800">- BuildRequires libpcap-devel-static instead of libpcap: the static
  library has been split out.</changelog>
  <changelog author="alarrosa@suse.com" date="1435924801">- Added a conditional build requirement to compile in versions
  other than Factory.</changelog>
  <changelog author="mlin@suse.com" date="1498737600">- Compile with libpcap-devel-static if Leap
  * Since pcap updated to new version in 42.3 too, ssldump need to
    compile with libpcap-devel-static.</changelog>
  <changelog author="Michael Calmer &lt;mc@suse.com&gt;" date="1585051200">- fix macro to fix build on openSUSE Leap 15.2</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1618228800">- Specfile overhaul
- Update source URL (original upstream is dead)
- Update to version 1.4
  * Add support for IPv6 traffic dump
  * Fix ja3(s) length of strings used in MD5 computation + update
    MD5 functions.
  * Add support for ja3 &amp; ja3s.
- Update to version 1.3
  * Avoid leak in TCP segment reassembly code.
  * Avoid client session_id related leak.
  * Avoid server_random related leak.
  * Avoid client_random related leak.
  * Check ssl_decode_enum() return code correctly.
  * Exit process_tcp_packet() in case TCP header is incomplete.
  * Check timestamp_diff return code correctly.
  * Cleanup before exit on error.
  * Fix for crash if length of captured frame is less than
    Ethernet header size.
  * Check packet size before looking at IP header.
  * Check return code after string extraction.
  * Limit length during server name decoding.
  * Decode ClientHello v2 properly.
  * Output error to stderr.
  * Avoid leak by freeing SSL decoding context properly.
  * Close everything properly in case of SIGINT.
  * Fix leak in associative array implementation.
  * First import of the JSON output code
  * Do not print information message when no connection is
    cleaned at shutdown.
  * Fix memory leak in ssl_process_server_session_id()
  * Close global pcap struct properly in case of SIGINT.
  * Add missing extension names
  * Code cleanup
  * Add save decrypted datato pcap. first alpha version.
  * Fix for use of deprecated OpenSSL HMAC functions.
  * Fix for type casting related warnings.
  * Add missing function prototype.
  * Remove definitions of unused variables.
  * Fix for uninitialized variables and possible overflow.
  * Remove unused RCSSTRING variable globally.
- Drop patches (not longer needed)
  * ssldump-0.9b3-libpcap.diff
  * random_return.patch
  * ssldump-0.9b3-aes.patch
  * implicit_def.patch
  * ssldump-0.9b3-newssl.patch
  * ssldump-cvs-06-19-2006.diff
  * update-config.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1653566400">- Update to version 1.5
  Changes
  * doc: An example use-case of JA3.
  Other
  * Add parentheses around MAX and MIN.
  * Add support for pcap output to FIFO.</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1675598400">- Update to version 1.6
  Changes:
  * Fix missing port # in pcap files
  * Print MAC keys only for non AEAD ciphers</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1697198400">- Update to version 1.8:
  * Add date to version output
  * Print meaningful error messages
  * use cmake as build tool
  * Add -z option for printing timestamps in front of TCP headers
- Update to version 1.7:
  * For Y2K38 on 32 bit systems time_t tv_sec can be long long
  * Adding tls1.3 decryption support</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1730635200">- Update to version 1.9
  Enhancements
  * Original PCAP Timestamps: Added support for original PCAP
    timestamps, replacing timeofday-generated timestamps for
    improved accuracy.
  * TLS 1.3 Handling: Introduced handling for TLS version 1.3.
  * RAW IP Capture Support: Implemented support for "raw IP"
    captures, allowing capture of packets without Layer 2 headers.
  * Connection Tracker Enhancements: Improved connection tracking
    with live list and purge functionality.
  Bug Fixes
  * Documentation Updates: Updated README layout and fixed command
    documentation.</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1749211200">- Stopped to use leap_version macro</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1760443200">- Dropped usage of libpcap-devel-static library</changelog>
</package>
<package pkgid="dc557b5e9f339f8e24e0fa4a243e8e3114b3a256137e0ab22a7d71f1e894ead4077e8828cb552511bcbfd6168f9defab5815947d15bf49716caa936d7d437798" name="ssldump-debuginfo" arch="s390x">
  <version epoch="0" ver="1.9" rel="518.7"/>
  <changelog author="alarrosa@suse.com" date="1435924800">- Added a conditional build requirement to compile in versions
  other than Factory.</changelog>
  <changelog author="mlin@suse.com" date="1498737600">- Compile with libpcap-devel-static if Leap
  * Since pcap updated to new version in 42.3 too, ssldump need to
    compile with libpcap-devel-static.</changelog>
  <changelog author="Michael Calmer &lt;mc@suse.com&gt;" date="1585051200">- fix macro to fix build on openSUSE Leap 15.2</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1618228800">- Specfile overhaul
- Update source URL (original upstream is dead)
- Update to version 1.4
  * Add support for IPv6 traffic dump
  * Fix ja3(s) length of strings used in MD5 computation + update
    MD5 functions.
  * Add support for ja3 &amp; ja3s.
- Update to version 1.3
  * Avoid leak in TCP segment reassembly code.
  * Avoid client session_id related leak.
  * Avoid server_random related leak.
  * Avoid client_random related leak.
  * Check ssl_decode_enum() return code correctly.
  * Exit process_tcp_packet() in case TCP header is incomplete.
  * Check timestamp_diff return code correctly.
  * Cleanup before exit on error.
  * Fix for crash if length of captured frame is less than
    Ethernet header size.
  * Check packet size before looking at IP header.
  * Check return code after string extraction.
  * Limit length during server name decoding.
  * Decode ClientHello v2 properly.
  * Output error to stderr.
  * Avoid leak by freeing SSL decoding context properly.
  * Close everything properly in case of SIGINT.
  * Fix leak in associative array implementation.
  * First import of the JSON output code
  * Do not print information message when no connection is
    cleaned at shutdown.
  * Fix memory leak in ssl_process_server_session_id()
  * Close global pcap struct properly in case of SIGINT.
  * Add missing extension names
  * Code cleanup
  * Add save decrypted datato pcap. first alpha version.
  * Fix for use of deprecated OpenSSL HMAC functions.
  * Fix for type casting related warnings.
  * Add missing function prototype.
  * Remove definitions of unused variables.
  * Fix for uninitialized variables and possible overflow.
  * Remove unused RCSSTRING variable globally.
- Drop patches (not longer needed)
  * ssldump-0.9b3-libpcap.diff
  * random_return.patch
  * ssldump-0.9b3-aes.patch
  * implicit_def.patch
  * ssldump-0.9b3-newssl.patch
  * ssldump-cvs-06-19-2006.diff
  * update-config.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1653566400">- Update to version 1.5
  Changes
  * doc: An example use-case of JA3.
  Other
  * Add parentheses around MAX and MIN.
  * Add support for pcap output to FIFO.</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1675598400">- Update to version 1.6
  Changes:
  * Fix missing port # in pcap files
  * Print MAC keys only for non AEAD ciphers</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1697198400">- Update to version 1.8:
  * Add date to version output
  * Print meaningful error messages
  * use cmake as build tool
  * Add -z option for printing timestamps in front of TCP headers
- Update to version 1.7:
  * For Y2K38 on 32 bit systems time_t tv_sec can be long long
  * Adding tls1.3 decryption support</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1730635200">- Update to version 1.9
  Enhancements
  * Original PCAP Timestamps: Added support for original PCAP
    timestamps, replacing timeofday-generated timestamps for
    improved accuracy.
  * TLS 1.3 Handling: Introduced handling for TLS version 1.3.
  * RAW IP Capture Support: Implemented support for "raw IP"
    captures, allowing capture of packets without Layer 2 headers.
  * Connection Tracker Enhancements: Improved connection tracking
    with live list and purge functionality.
  Bug Fixes
  * Documentation Updates: Updated README layout and fixed command
    documentation.</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1749211200">- Stopped to use leap_version macro</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1760443200">- Dropped usage of libpcap-devel-static library</changelog>
</package>
<package pkgid="579dc106ba0255c0ce3d07b1d719acec339307e502cec69ad982a5d720bf246816dc3957e5196761680525addd7ae140b584b48b0b8b75bab69e07b10afa62f1" name="ssldump-debugsource" arch="s390x">
  <version epoch="0" ver="1.9" rel="518.7"/>
  <changelog author="alarrosa@suse.com" date="1435924800">- Added a conditional build requirement to compile in versions
  other than Factory.</changelog>
  <changelog author="mlin@suse.com" date="1498737600">- Compile with libpcap-devel-static if Leap
  * Since pcap updated to new version in 42.3 too, ssldump need to
    compile with libpcap-devel-static.</changelog>
  <changelog author="Michael Calmer &lt;mc@suse.com&gt;" date="1585051200">- fix macro to fix build on openSUSE Leap 15.2</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1618228800">- Specfile overhaul
- Update source URL (original upstream is dead)
- Update to version 1.4
  * Add support for IPv6 traffic dump
  * Fix ja3(s) length of strings used in MD5 computation + update
    MD5 functions.
  * Add support for ja3 &amp; ja3s.
- Update to version 1.3
  * Avoid leak in TCP segment reassembly code.
  * Avoid client session_id related leak.
  * Avoid server_random related leak.
  * Avoid client_random related leak.
  * Check ssl_decode_enum() return code correctly.
  * Exit process_tcp_packet() in case TCP header is incomplete.
  * Check timestamp_diff return code correctly.
  * Cleanup before exit on error.
  * Fix for crash if length of captured frame is less than
    Ethernet header size.
  * Check packet size before looking at IP header.
  * Check return code after string extraction.
  * Limit length during server name decoding.
  * Decode ClientHello v2 properly.
  * Output error to stderr.
  * Avoid leak by freeing SSL decoding context properly.
  * Close everything properly in case of SIGINT.
  * Fix leak in associative array implementation.
  * First import of the JSON output code
  * Do not print information message when no connection is
    cleaned at shutdown.
  * Fix memory leak in ssl_process_server_session_id()
  * Close global pcap struct properly in case of SIGINT.
  * Add missing extension names
  * Code cleanup
  * Add save decrypted datato pcap. first alpha version.
  * Fix for use of deprecated OpenSSL HMAC functions.
  * Fix for type casting related warnings.
  * Add missing function prototype.
  * Remove definitions of unused variables.
  * Fix for uninitialized variables and possible overflow.
  * Remove unused RCSSTRING variable globally.
- Drop patches (not longer needed)
  * ssldump-0.9b3-libpcap.diff
  * random_return.patch
  * ssldump-0.9b3-aes.patch
  * implicit_def.patch
  * ssldump-0.9b3-newssl.patch
  * ssldump-cvs-06-19-2006.diff
  * update-config.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1653566400">- Update to version 1.5
  Changes
  * doc: An example use-case of JA3.
  Other
  * Add parentheses around MAX and MIN.
  * Add support for pcap output to FIFO.</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1675598400">- Update to version 1.6
  Changes:
  * Fix missing port # in pcap files
  * Print MAC keys only for non AEAD ciphers</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1697198400">- Update to version 1.8:
  * Add date to version output
  * Print meaningful error messages
  * use cmake as build tool
  * Add -z option for printing timestamps in front of TCP headers
- Update to version 1.7:
  * For Y2K38 on 32 bit systems time_t tv_sec can be long long
  * Adding tls1.3 decryption support</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1730635200">- Update to version 1.9
  Enhancements
  * Original PCAP Timestamps: Added support for original PCAP
    timestamps, replacing timeofday-generated timestamps for
    improved accuracy.
  * TLS 1.3 Handling: Introduced handling for TLS version 1.3.
  * RAW IP Capture Support: Implemented support for "raw IP"
    captures, allowing capture of packets without Layer 2 headers.
  * Connection Tracker Enhancements: Improved connection tracking
    with live list and purge functionality.
  Bug Fixes
  * Documentation Updates: Updated README layout and fixed command
    documentation.</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1749211200">- Stopped to use leap_version macro</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1760443200">- Dropped usage of libpcap-devel-static library</changelog>
</package>
<package pkgid="ecf5bc6958e2aa54e8e553b61af989e6a500465c6f6572bd0a099486909495cb63df57e43fe0312f441bbf68d7a02de788ec4d1b2ccd0266d1283384f9f5dad1" name="sslh" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="38.8"/>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1705060800">- Update to 2.0.1:
  * New semver-compatible version number
  * New sslh-ev: this is functionaly equivalent to sslh-select
    (mono-process, only forks for specified protocols), but based
    on libev, which should make it scalable to large numbers
    of connections.
  * New log system: instead of –verbose with arbitrary levels,
    there are now several message classes. Each message class
    can be set to go to stderr, syslog, or both. Classes are
    documented in example.cfg.
  * UDP connections are now managed in a hash to avoid linear
    searches. The downside is that the number of UDP connections
    is a hard limit, configurable with the ‘udp_max_connections’,
    which defaults to 1024. Timeouts are managed with lists.
  * inetd merges stderr output to what is sent to the client,
    which is a security issue as it might give information to an
    attacker. When inetd is activated, stderr is forcibly closed.
  * New protocol-level option resolve_on_forward, requests that
    target names are resolved at each connection instead of at
    startup. Useful for dynamic DNS situations.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1710417600">- Update to 2.1.0:
  * Support for the Landlock LSM. After initial setup,
    sslh gives up all local file access rights.
  * Reintroduced --ssl as an alias to --tls.
  * Introduce autoconf to adapt to landlock presence.
  * Close connexion without error message if remote
    client forcefully closes connexion, for Windows.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1711368000">- Update to 2.1.1:
  * Fix MacOS build error</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1715947200">- Update to 2.1.2:
  * Fix inetd</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1734350400">- Update to 2.1.3:
  * Landlock access fix</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1734350401">- Update to 2.1.4:
  * Fix release archive</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1744027200">- Update to 2.2.0:
  * Add a boolean setting "is_unix" for listen and
  protocol entries. This will use the 'host' setting
  as a path name to a socket file, and connections
  (listening or connecting) will be performed on Unix
  socket instead of Internet sockets.
  * Support HAProxy's proxyprotocol on the backend
    server side.
  * Lots of documentation about a new, simpler way to
    perform transparent proxying.
  * New "verbose" option that overrides all other
    verbose settings.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1744027201">- Update to 2.2.1:
  * Fix compilation when libproxyprotocol is not present</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1746705600">- Update to 2.2.2:
  * Fix potential vulnerability similar to CVE-2020-28935</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1746705601">- Update to 2.2.3:
  * Reverse older commit: version.h cannot be included without breaking
    the build (everything recompiles every time) and the release archive
    creation (which relies on git tags).</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1748865600">- Update to 2.2.4:
  * Fix CVE-2025-46806 (bsc#1243120) for "Misaligned Memory Accesses
    in `is_openvpn_protocol()`"
  * Fix CVE-2025-46807 (bsc#1243122) for "File Descriptor Exhaustion
    in sslh-select and sslh-ev"
  * Fix potential parsing of undefined data in syslog probe (no CVE assigned)</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1757678400">- Update to 2.3.0:
  * Added `max_connections` setting to `listen` and `protocol`
    configuration; see doc/max_connections.md for more information.
  * accept() is now disabled for some time when ulimit -n is reached.
  * Support proxyprotocol on incoming connections.
    See doc/proxyprotocol.md for information.
  * Fix proxyprotocol target field
  * Fix memory leak in regex probe.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1773230400">- Update to 2.3.1:
  * Add file access when using Landlock and Libwrap together.
  * Mixed IPv4/IPv6 proxyprotocol setups will move both addresses to IPv6
    format on the server side.
  * Add CAP_NET_RAW to systemd config so transparent
  proxying can work. Removed sslh-select systemd file:
  don't repeat the same configuration file!
  * Changed SNI matching log messages from
  `msg_probe_error` to `msg_probe_info`: beware if you
  happen to use them...
  * Close unused file descriptors upon forking a worker
  for a connection (in sslh-ev and sslh-select). In
  particular, this prevents forked processes to
  inherit the listen sockets and block a new main
  process from starting.
  * More configuration sanity checks (e.g. using regex
  or proxyprotocol options if libraries are not compiled in)
  * -V now outputs compile-time options so it is
  possible to know what is compiled in.</changelog>
</package>
<package pkgid="35eef27bd2c45f1191dc483ef97732a7cc40eab7929041b6eb27e8b73e9d4898a4d13dede40fb01b2ae6ab1785d116891fc00c8d45251abf67b53c2e25f42aa2" name="sslh" arch="src">
  <version epoch="0" ver="2.3.1" rel="38.8"/>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1596196800">- Update to 1.21c:
  * Removed support for 'ssl' and fix a related segfault bug.</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1617969600">- sslh-nopcreposix.patch: Using pcreposix is the wrong thing
  to do on any glibc based system, avoid linking it.</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1617969601">- remove unused tcpd-devel dependency</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1629288000">- Update to 1.22:
  * sslh-select now supports UDP protocols.
    Probes specified in the `protocols`
    configuration entry are tried on incoming packets,
    TCP or UDP, and forwarded based on the input
    protocol (an incoming TCP connection will be
    forwarded as TCP, and same with UDP).
    This has been tested with DNS as shown in udp.cfg:
    incoming packets that contain my domain name are
    assumed to be a DNS request and forwarded
    accordingly. Note this could cause problems if
    combined with incoming TLS with SNI.  UDP clients
    and servers need to agree on the IPv4/IPv6 they use:
    use the same protocol on all sides! Often, this
    means explicitely using 'ip4-localhost'.
    UDP sender-receiver pairs (connections, so to speak)
    are kept for 60s, which can be changed with
    `udp_timeout` in the configuration.
  * Added probes for UDP protocols QUICK and Teamspeak.
  * Added probes for syslog protocol.
  * sslh-select refactored to change linear searches
  through connections to linear searches through
  fd_set.
  * Fixed a libconfig call to support libconfig 1.7.3.
  * Added symbol to support libconfig 1.4.9, still in
  use in CentOS7.
  * Warn about unknown settings in the configuration
  file.
  * Added per-protocol `transparent` option. sslh-fork
  drops the capability after creating the server-side
  transparent socket. Transparent now uses CAP_NET_RAW
  instead of CAP_NET_ADMIN.
  * Removed compile-time option to use POSIX regex. Now
  regex must be PCRE2 (Perl-Compatible). This was in
  fact the case since v1.21, as PCRE are used to parse
  the config file.
- Drop sslh-nopcreposix.patch:
  pcre2 is a hard dependency now</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1629892800">- Update to 1.22b:
  * do not timeout TCP connections (fix #300)
  * remove obsolete usage string and added lost version option
  * be more defensive when allocating and extending gap</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1630929600">- Update to 1.22c:
  * Fix invalid size (#302)
  * Test aborted connections (#285)</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651579200">- switch to https source url</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1705060800">- Update to 2.0.1:
  * New semver-compatible version number
  * New sslh-ev: this is functionaly equivalent to sslh-select
    (mono-process, only forks for specified protocols), but based
    on libev, which should make it scalable to large numbers
    of connections.
  * New log system: instead of –verbose with arbitrary levels,
    there are now several message classes. Each message class
    can be set to go to stderr, syslog, or both. Classes are
    documented in example.cfg.
  * UDP connections are now managed in a hash to avoid linear
    searches. The downside is that the number of UDP connections
    is a hard limit, configurable with the ‘udp_max_connections’,
    which defaults to 1024. Timeouts are managed with lists.
  * inetd merges stderr output to what is sent to the client,
    which is a security issue as it might give information to an
    attacker. When inetd is activated, stderr is forcibly closed.
  * New protocol-level option resolve_on_forward, requests that
    target names are resolved at each connection instead of at
    startup. Useful for dynamic DNS situations.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1710417600">- Update to 2.1.0:
  * Support for the Landlock LSM. After initial setup,
    sslh gives up all local file access rights.
  * Reintroduced --ssl as an alias to --tls.
  * Introduce autoconf to adapt to landlock presence.
  * Close connexion without error message if remote
    client forcefully closes connexion, for Windows.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1711368000">- Update to 2.1.1:
  * Fix MacOS build error</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1715947200">- Update to 2.1.2:
  * Fix inetd</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1734350400">- Update to 2.1.3:
  * Landlock access fix</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1734350401">- Update to 2.1.4:
  * Fix release archive</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1744027200">- Update to 2.2.0:
  * Add a boolean setting "is_unix" for listen and
  protocol entries. This will use the 'host' setting
  as a path name to a socket file, and connections
  (listening or connecting) will be performed on Unix
  socket instead of Internet sockets.
  * Support HAProxy's proxyprotocol on the backend
    server side.
  * Lots of documentation about a new, simpler way to
    perform transparent proxying.
  * New "verbose" option that overrides all other
    verbose settings.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1744027201">- Update to 2.2.1:
  * Fix compilation when libproxyprotocol is not present</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1746705600">- Update to 2.2.2:
  * Fix potential vulnerability similar to CVE-2020-28935</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1746705601">- Update to 2.2.3:
  * Reverse older commit: version.h cannot be included without breaking
    the build (everything recompiles every time) and the release archive
    creation (which relies on git tags).</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1748865600">- Update to 2.2.4:
  * Fix CVE-2025-46806 (bsc#1243120) for "Misaligned Memory Accesses
    in `is_openvpn_protocol()`"
  * Fix CVE-2025-46807 (bsc#1243122) for "File Descriptor Exhaustion
    in sslh-select and sslh-ev"
  * Fix potential parsing of undefined data in syslog probe (no CVE assigned)</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1757678400">- Update to 2.3.0:
  * Added `max_connections` setting to `listen` and `protocol`
    configuration; see doc/max_connections.md for more information.
  * accept() is now disabled for some time when ulimit -n is reached.
  * Support proxyprotocol on incoming connections.
    See doc/proxyprotocol.md for information.
  * Fix proxyprotocol target field
  * Fix memory leak in regex probe.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1773230400">- Update to 2.3.1:
  * Add file access when using Landlock and Libwrap together.
  * Mixed IPv4/IPv6 proxyprotocol setups will move both addresses to IPv6
    format on the server side.
  * Add CAP_NET_RAW to systemd config so transparent
  proxying can work. Removed sslh-select systemd file:
  don't repeat the same configuration file!
  * Changed SNI matching log messages from
  `msg_probe_error` to `msg_probe_info`: beware if you
  happen to use them...
  * Close unused file descriptors upon forking a worker
  for a connection (in sslh-ev and sslh-select). In
  particular, this prevents forked processes to
  inherit the listen sockets and block a new main
  process from starting.
  * More configuration sanity checks (e.g. using regex
  or proxyprotocol options if libraries are not compiled in)
  * -V now outputs compile-time options so it is
  possible to know what is compiled in.</changelog>
</package>
<package pkgid="3d1bfb58d7cc67fcd61dfeaab500e478da0c077202450d1c474901dacc0cfa0b2fd8b68d508c5c3099953cb6dbfc10da61c94883f892a6c6a6f6a49aa52a6744" name="sslh-debuginfo" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="38.8"/>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1705060800">- Update to 2.0.1:
  * New semver-compatible version number
  * New sslh-ev: this is functionaly equivalent to sslh-select
    (mono-process, only forks for specified protocols), but based
    on libev, which should make it scalable to large numbers
    of connections.
  * New log system: instead of –verbose with arbitrary levels,
    there are now several message classes. Each message class
    can be set to go to stderr, syslog, or both. Classes are
    documented in example.cfg.
  * UDP connections are now managed in a hash to avoid linear
    searches. The downside is that the number of UDP connections
    is a hard limit, configurable with the ‘udp_max_connections’,
    which defaults to 1024. Timeouts are managed with lists.
  * inetd merges stderr output to what is sent to the client,
    which is a security issue as it might give information to an
    attacker. When inetd is activated, stderr is forcibly closed.
  * New protocol-level option resolve_on_forward, requests that
    target names are resolved at each connection instead of at
    startup. Useful for dynamic DNS situations.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1710417600">- Update to 2.1.0:
  * Support for the Landlock LSM. After initial setup,
    sslh gives up all local file access rights.
  * Reintroduced --ssl as an alias to --tls.
  * Introduce autoconf to adapt to landlock presence.
  * Close connexion without error message if remote
    client forcefully closes connexion, for Windows.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1711368000">- Update to 2.1.1:
  * Fix MacOS build error</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1715947200">- Update to 2.1.2:
  * Fix inetd</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1734350400">- Update to 2.1.3:
  * Landlock access fix</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1734350401">- Update to 2.1.4:
  * Fix release archive</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1744027200">- Update to 2.2.0:
  * Add a boolean setting "is_unix" for listen and
  protocol entries. This will use the 'host' setting
  as a path name to a socket file, and connections
  (listening or connecting) will be performed on Unix
  socket instead of Internet sockets.
  * Support HAProxy's proxyprotocol on the backend
    server side.
  * Lots of documentation about a new, simpler way to
    perform transparent proxying.
  * New "verbose" option that overrides all other
    verbose settings.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1744027201">- Update to 2.2.1:
  * Fix compilation when libproxyprotocol is not present</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1746705600">- Update to 2.2.2:
  * Fix potential vulnerability similar to CVE-2020-28935</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1746705601">- Update to 2.2.3:
  * Reverse older commit: version.h cannot be included without breaking
    the build (everything recompiles every time) and the release archive
    creation (which relies on git tags).</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1748865600">- Update to 2.2.4:
  * Fix CVE-2025-46806 (bsc#1243120) for "Misaligned Memory Accesses
    in `is_openvpn_protocol()`"
  * Fix CVE-2025-46807 (bsc#1243122) for "File Descriptor Exhaustion
    in sslh-select and sslh-ev"
  * Fix potential parsing of undefined data in syslog probe (no CVE assigned)</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1757678400">- Update to 2.3.0:
  * Added `max_connections` setting to `listen` and `protocol`
    configuration; see doc/max_connections.md for more information.
  * accept() is now disabled for some time when ulimit -n is reached.
  * Support proxyprotocol on incoming connections.
    See doc/proxyprotocol.md for information.
  * Fix proxyprotocol target field
  * Fix memory leak in regex probe.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1773230400">- Update to 2.3.1:
  * Add file access when using Landlock and Libwrap together.
  * Mixed IPv4/IPv6 proxyprotocol setups will move both addresses to IPv6
    format on the server side.
  * Add CAP_NET_RAW to systemd config so transparent
  proxying can work. Removed sslh-select systemd file:
  don't repeat the same configuration file!
  * Changed SNI matching log messages from
  `msg_probe_error` to `msg_probe_info`: beware if you
  happen to use them...
  * Close unused file descriptors upon forking a worker
  for a connection (in sslh-ev and sslh-select). In
  particular, this prevents forked processes to
  inherit the listen sockets and block a new main
  process from starting.
  * More configuration sanity checks (e.g. using regex
  or proxyprotocol options if libraries are not compiled in)
  * -V now outputs compile-time options so it is
  possible to know what is compiled in.</changelog>
</package>
<package pkgid="de9892096b8350b69a83f6530338127745eb8db3738cad201417ed8b2a6f2fd9e33f0d3fdd4ea1928c368eb1980b979a5b1e38f170ff8ba01ed50e27feae1dee" name="sslh-debugsource" arch="s390x">
  <version epoch="0" ver="2.3.1" rel="38.8"/>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1705060800">- Update to 2.0.1:
  * New semver-compatible version number
  * New sslh-ev: this is functionaly equivalent to sslh-select
    (mono-process, only forks for specified protocols), but based
    on libev, which should make it scalable to large numbers
    of connections.
  * New log system: instead of –verbose with arbitrary levels,
    there are now several message classes. Each message class
    can be set to go to stderr, syslog, or both. Classes are
    documented in example.cfg.
  * UDP connections are now managed in a hash to avoid linear
    searches. The downside is that the number of UDP connections
    is a hard limit, configurable with the ‘udp_max_connections’,
    which defaults to 1024. Timeouts are managed with lists.
  * inetd merges stderr output to what is sent to the client,
    which is a security issue as it might give information to an
    attacker. When inetd is activated, stderr is forcibly closed.
  * New protocol-level option resolve_on_forward, requests that
    target names are resolved at each connection instead of at
    startup. Useful for dynamic DNS situations.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1710417600">- Update to 2.1.0:
  * Support for the Landlock LSM. After initial setup,
    sslh gives up all local file access rights.
  * Reintroduced --ssl as an alias to --tls.
  * Introduce autoconf to adapt to landlock presence.
  * Close connexion without error message if remote
    client forcefully closes connexion, for Windows.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1711368000">- Update to 2.1.1:
  * Fix MacOS build error</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1715947200">- Update to 2.1.2:
  * Fix inetd</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1734350400">- Update to 2.1.3:
  * Landlock access fix</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1734350401">- Update to 2.1.4:
  * Fix release archive</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1744027200">- Update to 2.2.0:
  * Add a boolean setting "is_unix" for listen and
  protocol entries. This will use the 'host' setting
  as a path name to a socket file, and connections
  (listening or connecting) will be performed on Unix
  socket instead of Internet sockets.
  * Support HAProxy's proxyprotocol on the backend
    server side.
  * Lots of documentation about a new, simpler way to
    perform transparent proxying.
  * New "verbose" option that overrides all other
    verbose settings.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1744027201">- Update to 2.2.1:
  * Fix compilation when libproxyprotocol is not present</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1746705600">- Update to 2.2.2:
  * Fix potential vulnerability similar to CVE-2020-28935</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1746705601">- Update to 2.2.3:
  * Reverse older commit: version.h cannot be included without breaking
    the build (everything recompiles every time) and the release archive
    creation (which relies on git tags).</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1748865600">- Update to 2.2.4:
  * Fix CVE-2025-46806 (bsc#1243120) for "Misaligned Memory Accesses
    in `is_openvpn_protocol()`"
  * Fix CVE-2025-46807 (bsc#1243122) for "File Descriptor Exhaustion
    in sslh-select and sslh-ev"
  * Fix potential parsing of undefined data in syslog probe (no CVE assigned)</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1757678400">- Update to 2.3.0:
  * Added `max_connections` setting to `listen` and `protocol`
    configuration; see doc/max_connections.md for more information.
  * accept() is now disabled for some time when ulimit -n is reached.
  * Support proxyprotocol on incoming connections.
    See doc/proxyprotocol.md for information.
  * Fix proxyprotocol target field
  * Fix memory leak in regex probe.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1773230400">- Update to 2.3.1:
  * Add file access when using Landlock and Libwrap together.
  * Mixed IPv4/IPv6 proxyprotocol setups will move both addresses to IPv6
    format on the server side.
  * Add CAP_NET_RAW to systemd config so transparent
  proxying can work. Removed sslh-select systemd file:
  don't repeat the same configuration file!
  * Changed SNI matching log messages from
  `msg_probe_error` to `msg_probe_info`: beware if you
  happen to use them...
  * Close unused file descriptors upon forking a worker
  for a connection (in sslh-ev and sslh-select). In
  particular, this prevents forked processes to
  inherit the listen sockets and block a new main
  process from starting.
  * More configuration sanity checks (e.g. using regex
  or proxyprotocol options if libraries are not compiled in)
  * -V now outputs compile-time options so it is
  possible to know what is compiled in.</changelog>
</package>
<package pkgid="0a74327a297c663c351a19f0e25db3886919f01eb2f328bf368507de824f165455bd789099916a5481d84ed7c54de22437a7f4ff1f9727cecd062b36afe0853a" name="sslscan" arch="s390x">
  <version epoch="0" ver="2.2.2" rel="52.4"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1681646400">- update to 2.0.16:
  * Fix incorret detection of TLSv1.3 on Server 2019
  * Fix incorrect XML certificate output</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1694692800">- update to 2.1.0:
  * Build against OpenSSL 3.0 instead of 1.1.0 (credit jtesta)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1699617600">- update to 2.1.1:
  * Work around several dodgy TLS implementations</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1700913600">- update to 2.1.2:
  * Fix certificate and cipher enumeration when unsafe
    renegotiation is required</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1706356800">- update to 2.1.3:
  * Enable quiet shutdown for scanning
  * Fix Docked build on non-x64 architectures</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1721908800">- update to 2.1.4:
  * Display the full cert chain --show-certificates</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729684800">- update to 2.1.5:
  * Various build improvements</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1762948800">- update to 2.2.0:
  * OpenSSL 3.5 is now the minimum version to build against
  * Various code cleanup dropping support for legacy OpenSSL
    versions (credit tetlowgm)
  * Handle some servers that rejecting large ClientHello
    messages (credit jtesta)
  * Add support for new post-quantum groups (credit jtesta)
  * Update the output colouring of various ciphers/groups/etc
  * Flag CCM8 ciphers as weak and manually override their
    displayed bit strength to match newer versions of OpenSSL</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774440000">- update to 2.2.1:
  * Add the "strength" field to the XML output for groups
  * Add support for PQ hybrid key exchange groups (credit
    malhotrag)
  * Show Show PQ groups in cipher output (credit nuxi)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777896000">- update to 2.2.2:
  * Respect the -j option when building OpenSSL (credit hlein)</changelog>
</package>
<package pkgid="a8a6e13befe71436811aa61138b21370ac5f3806ad6421a74c62219e832c21c63aad56c29258f7ebd623790d9b66d5e73acc7f60aa49e2f0788897b52660b135" name="sslscan" arch="src">
  <version epoch="0" ver="2.2.2" rel="52.4"/>
  <changelog author="jweberhofer@weberhofer.at" date="1517572800">- Simplified requirements</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1595419200">- Upgrade to version 2.0.0-beta6
  * Various bugfixes
  * Added -4 and -6 options to force IPv4 and IPv6.
  * Added strength attribute to XML to reflect colouring in stdout
  * Checks for server signature algorithms.
  * Checks for server key exchange groups.
  * Support for SSLv2 and SSLv3 protocol detection regardless of OpenSSL
  * Support for TLSv1.3
  * Support for additional cipher suites.
  * Print curve name and key strength for ECC certs
  * Fix a bug with servers that return incorrect cipher IDs.
  * Add a new "&lt;certificates&gt;" element to the XML output.
  * Remove the "Signature Algorithm:" text and spacing from the XML.
  * Report servers that accept any signature algorithm in the XML
- Rebased fedora-sslscan-patents.patch
- OpenSSL dependency bumped to &gt;= 1.1</changelog>
  <changelog author="Johannes Weberhofer &lt;jweberhofer@weberhofer.at&gt;" date="1595505600">- Upgrade to version 2.0.0
  Version 2 of sslscan includes a major rewrite of the backend scanning code,
  which means that it is no longer reliant on the version of OpenSSL for many
  checks. This means that it is possible to support legacy protocols (SSLv2 and
  SSLv3), as well as supporting TLSv1.3 - regardless of the version of OpenSSL
  that it has been compiled against. It is still recommended to build statically
  where possible, but dynamically built version should be significantly more
  useful.
  Note that there are also some breaking changes to the XML output, which are
  documented in the readme file.
  This rewrite been made possible largely by the work of jtesta, who has been
  responsible for most of the backend rewrite.
- Cleaned up spec file</changelog>
  <changelog author="Johannes Weberhofer &lt;jweberhofer@weberhofer.at&gt;" date="1601294400">- Upgrade to version 2.0.1
  * Correctly set SNI name when using --targets. Fixes gh#rbsec/sslscan#215</changelog>
  <changelog author="Johannes Weberhofer &lt;jweberhofer@weberhofer.at&gt;" date="1608292800">- Upgrade to version 2.0.6
  * Add &lt;error&gt; element to XML output
  * Fix the extraneous padding of HTTP responses in XML
  * Update the HTTP request to HTTP/1.1
  * More robust checking the HTTP response is valid
  * Display "No response" when no HTTP response is returned
  * Remove the broken HTTP request scanning option (--http)
  * Fix --targets not working properly
  * Flag certificates in red if CN is the same as issuer</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1620734400">- update to 2.0.10:
  * Add the --connect-timeout option (credit alkalim)
  * Fix a typo in output
  * Warn on TLSv1.1, as it's now deprecated by RFC 8996
  * Fix a bug with LDAP STARTTLS
  * Fix certificate detection on some broken servers
  * Fix missing SCSV Fallback in XML output
  * Don't show server signature algorithms by default
  * Use --show-sigs to display them</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1641297600">- update to 2.0.11:
  * Add --iana-names option to use IANA/RFC cipher names
  * Improve signature algorithm detection</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1648382400">- update to 2.0.12:
  * Add &lt;not-yet-valid&gt; XML element (credit lucacapacci)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1659441600">- update to 2.0.15:
  * Obtain certificate info even if we can't connect properly
  * Strip out https:// from lines in a target file
  * Fix TLSv1.3 detection against Server 2022 (credit jtesta)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1681646400">- update to 2.0.16:
  * Fix incorret detection of TLSv1.3 on Server 2019
  * Fix incorrect XML certificate output</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1694692800">- update to 2.1.0:
  * Build against OpenSSL 3.0 instead of 1.1.0 (credit jtesta)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1699617600">- update to 2.1.1:
  * Work around several dodgy TLS implementations</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1700913600">- update to 2.1.2:
  * Fix certificate and cipher enumeration when unsafe
    renegotiation is required</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1706356800">- update to 2.1.3:
  * Enable quiet shutdown for scanning
  * Fix Docked build on non-x64 architectures</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1721908800">- update to 2.1.4:
  * Display the full cert chain --show-certificates</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729684800">- update to 2.1.5:
  * Various build improvements</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1762948800">- update to 2.2.0:
  * OpenSSL 3.5 is now the minimum version to build against
  * Various code cleanup dropping support for legacy OpenSSL
    versions (credit tetlowgm)
  * Handle some servers that rejecting large ClientHello
    messages (credit jtesta)
  * Add support for new post-quantum groups (credit jtesta)
  * Update the output colouring of various ciphers/groups/etc
  * Flag CCM8 ciphers as weak and manually override their
    displayed bit strength to match newer versions of OpenSSL</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774440000">- update to 2.2.1:
  * Add the "strength" field to the XML output for groups
  * Add support for PQ hybrid key exchange groups (credit
    malhotrag)
  * Show Show PQ groups in cipher output (credit nuxi)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777896000">- update to 2.2.2:
  * Respect the -j option when building OpenSSL (credit hlein)</changelog>
</package>
<package pkgid="80dbcc3b32f71bdf445d79a45cf0e4144857bc1c7aad73019ad0b8c2fe75d43e481db766d74190aef050d29142c95832ce996c4ec5495fc877b3b8f8e2b757ff" name="sslscan-debuginfo" arch="s390x">
  <version epoch="0" ver="2.2.2" rel="52.4"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1681646400">- update to 2.0.16:
  * Fix incorret detection of TLSv1.3 on Server 2019
  * Fix incorrect XML certificate output</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1694692800">- update to 2.1.0:
  * Build against OpenSSL 3.0 instead of 1.1.0 (credit jtesta)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1699617600">- update to 2.1.1:
  * Work around several dodgy TLS implementations</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1700913600">- update to 2.1.2:
  * Fix certificate and cipher enumeration when unsafe
    renegotiation is required</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1706356800">- update to 2.1.3:
  * Enable quiet shutdown for scanning
  * Fix Docked build on non-x64 architectures</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1721908800">- update to 2.1.4:
  * Display the full cert chain --show-certificates</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729684800">- update to 2.1.5:
  * Various build improvements</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1762948800">- update to 2.2.0:
  * OpenSSL 3.5 is now the minimum version to build against
  * Various code cleanup dropping support for legacy OpenSSL
    versions (credit tetlowgm)
  * Handle some servers that rejecting large ClientHello
    messages (credit jtesta)
  * Add support for new post-quantum groups (credit jtesta)
  * Update the output colouring of various ciphers/groups/etc
  * Flag CCM8 ciphers as weak and manually override their
    displayed bit strength to match newer versions of OpenSSL</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774440000">- update to 2.2.1:
  * Add the "strength" field to the XML output for groups
  * Add support for PQ hybrid key exchange groups (credit
    malhotrag)
  * Show Show PQ groups in cipher output (credit nuxi)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777896000">- update to 2.2.2:
  * Respect the -j option when building OpenSSL (credit hlein)</changelog>
</package>
<package pkgid="5901b2f966a79081b67cd94b1a2417b51d3d03d92e0c7b3ae92740f6cdc3fc9c848779409665f94d83c0d7f93cbd1f6ff1db739da3c5cd1340af2708e9645c76" name="sslscan-debugsource" arch="s390x">
  <version epoch="0" ver="2.2.2" rel="52.4"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1681646400">- update to 2.0.16:
  * Fix incorret detection of TLSv1.3 on Server 2019
  * Fix incorrect XML certificate output</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1694692800">- update to 2.1.0:
  * Build against OpenSSL 3.0 instead of 1.1.0 (credit jtesta)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1699617600">- update to 2.1.1:
  * Work around several dodgy TLS implementations</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1700913600">- update to 2.1.2:
  * Fix certificate and cipher enumeration when unsafe
    renegotiation is required</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1706356800">- update to 2.1.3:
  * Enable quiet shutdown for scanning
  * Fix Docked build on non-x64 architectures</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1708948800">- Use %patch -P N instead of deprecated %patchN.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1721908800">- update to 2.1.4:
  * Display the full cert chain --show-certificates</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729684800">- update to 2.1.5:
  * Various build improvements</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1762948800">- update to 2.2.0:
  * OpenSSL 3.5 is now the minimum version to build against
  * Various code cleanup dropping support for legacy OpenSSL
    versions (credit tetlowgm)
  * Handle some servers that rejecting large ClientHello
    messages (credit jtesta)
  * Add support for new post-quantum groups (credit jtesta)
  * Update the output colouring of various ciphers/groups/etc
  * Flag CCM8 ciphers as weak and manually override their
    displayed bit strength to match newer versions of OpenSSL</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774440000">- update to 2.2.1:
  * Add the "strength" field to the XML output for groups
  * Add support for PQ hybrid key exchange groups (credit
    malhotrag)
  * Show Show PQ groups in cipher output (credit nuxi)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777896000">- update to 2.2.2:
  * Respect the -j option when building OpenSSL (credit hlein)</changelog>
</package>
<package pkgid="691975acd4b19f8c7528def403edaaf5f1f37672c729d87fe35d35f605c1f81a061440a3d6bb71c6e421f3e56b4f5478259f1466cd29f5b9c0725b113d1554f9" name="sslsplit" arch="s390x">
  <version epoch="0" ver="0.5.5" rel="2.33"/>
  <changelog author="novell@tower-net.de" date="1421841600">- Initial SSLsplit version 0.4.10 from https://www.roe.ch/SSLsplit</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1592913600">- Update to version 0.5.5. No changes for 5 years, too many to list
  here, please check the upstream changelog:
  https://github.com/droe/sslsplit/blob/0.5.5/NEWS.md
- Dropped fix-GNUmakefile-install.patch</changelog>
</package>
<package pkgid="f9ad6ee038967c9d5185f5509750caed998254b0c3e24e9daab9ccba57e2ecfca0c321a7e27ad4b8aa08fd84a2ce42e3b92bf3073ae50258a8b75f0ba52e7879" name="sslsplit" arch="src">
  <version epoch="0" ver="0.5.5" rel="2.33"/>
  <changelog author="novell@tower-net.de" date="1421841600">- Initial SSLsplit version 0.4.10 from https://www.roe.ch/SSLsplit</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1592913600">- Update to version 0.5.5. No changes for 5 years, too many to list
  here, please check the upstream changelog:
  https://github.com/droe/sslsplit/blob/0.5.5/NEWS.md
- Dropped fix-GNUmakefile-install.patch</changelog>
</package>
<package pkgid="07743ef08600c840873703fa953f5fb2fa6d8ae016cfba09d03ea4214fb6f35172a5ab8a70515f12612f22d35ab60e588e4bac13e796b2d3609512381dd30d5f" name="sslsplit-debuginfo" arch="s390x">
  <version epoch="0" ver="0.5.5" rel="2.33"/>
  <changelog author="novell@tower-net.de" date="1421841600">- Initial SSLsplit version 0.4.10 from https://www.roe.ch/SSLsplit</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1592913600">- Update to version 0.5.5. No changes for 5 years, too many to list
  here, please check the upstream changelog:
  https://github.com/droe/sslsplit/blob/0.5.5/NEWS.md
- Dropped fix-GNUmakefile-install.patch</changelog>
</package>
<package pkgid="512049be3e24f0a3e5699e50d6b50bc922714e3e3b9199aea889fd104a6e10e8ef04e29294b76a02f9dadaf40c21bcee5ed2865273c0373b90c76feb3f89a328" name="sslsplit-debugsource" arch="s390x">
  <version epoch="0" ver="0.5.5" rel="2.33"/>
  <changelog author="novell@tower-net.de" date="1421841600">- Initial SSLsplit version 0.4.10 from https://www.roe.ch/SSLsplit</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1592913600">- Update to version 0.5.5. No changes for 5 years, too many to list
  here, please check the upstream changelog:
  https://github.com/droe/sslsplit/blob/0.5.5/NEWS.md
- Dropped fix-GNUmakefile-install.patch</changelog>
</package>
<package pkgid="c0e32adb11ae71141df58874d37836fe40eaae76ce64ff074b393d5a5208c59ee32f50588760508da02b1ae25e62654caf1dc1dd23605e1ed1f62b7ee954403d" name="step-ca" arch="s390x">
  <version epoch="0" ver="0.30.2" rel="1.11"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1706788800">- add missing user/group provides</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1711713600">- update to 0.26.0
  https://github.com/smallstep/certificates/releases/tag/v0.26.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1713873600">- update to 0.26.1
  https://github.com/smallstep/certificates/releases/tag/v0.26.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1718280000">- update to 0.26.2
  https://github.com/smallstep/certificates/releases/tag/v0.26.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1720785600">- update to 0.27.0
  https://github.com/smallstep/certificates/releases/tag/v0.27.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1720785601">- update to 0.27.1
  https://github.com/smallstep/certificates/releases/tag/v0.27.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1721304000">- update to 0.27.2
  https://github.com/smallstep/certificates/releases/tag/v0.27.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726228800">- update to 0.27.4
  https://github.com/smallstep/certificates/releases/tag/v0.27.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166400">- modernize spec file</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166401">- update to 0.27.5
  https://github.com/smallstep/certificates/releases/tag/v0.27.5</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729944000">- add service file for vendoring go modules</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1730289600">- update to 0.28.0
  https://github.com/smallstep/certificates/releases/tag/v0.28.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104000">- update to 0.28.1
  https://github.com/smallstep/certificates/releases/tag/v0.28.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1740225600">- update to 0.28.2
  https://github.com/smallstep/certificates/releases/tag/v0.28.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1741608000">- use %python3_fix_shebang to make path more stable</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1742299200">- update to 0.28.3
  https://github.com/smallstep/certificates/releases/tag/v0.28.3-rc1
  https://github.com/smallstep/certificates/releases/tag/v0.28.3</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752494400">- update to 0.28.4
  https://github.com/smallstep/certificates/releases/tag/v0.28.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764763200">- update to 0.29.0 (boo#1253520)
  https://github.com/smallstep/certificates/releases/tag/v0.29.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1773921600">- update to 0.30.1
  https://github.com/smallstep/certificates/releases/tag/v0.30.1
  https://github.com/smallstep/certificates/releases/tag/v0.30.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1774180800">- update to 0.30.2
  https://github.com/smallstep/certificates/releases/tag/v0.30.2</changelog>
</package>
<package pkgid="b2ebd1bec7eedd994c7c8a5c680dfc1e50659c702e51c82ace4000cde44c93bd8bea2bc3f33f6a3aeea920baa291631d391d253074cec873447eeed0a897fdfa" name="step-ca" arch="src">
  <version epoch="0" ver="0.30.2" rel="1.11"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1706788800">- add missing user/group provides</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1711713600">- update to 0.26.0
  https://github.com/smallstep/certificates/releases/tag/v0.26.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1713873600">- update to 0.26.1
  https://github.com/smallstep/certificates/releases/tag/v0.26.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1718280000">- update to 0.26.2
  https://github.com/smallstep/certificates/releases/tag/v0.26.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1720785600">- update to 0.27.0
  https://github.com/smallstep/certificates/releases/tag/v0.27.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1720785601">- update to 0.27.1
  https://github.com/smallstep/certificates/releases/tag/v0.27.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1721304000">- update to 0.27.2
  https://github.com/smallstep/certificates/releases/tag/v0.27.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726228800">- update to 0.27.4
  https://github.com/smallstep/certificates/releases/tag/v0.27.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166400">- modernize spec file</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166401">- update to 0.27.5
  https://github.com/smallstep/certificates/releases/tag/v0.27.5</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729944000">- add service file for vendoring go modules</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1730289600">- update to 0.28.0
  https://github.com/smallstep/certificates/releases/tag/v0.28.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104000">- update to 0.28.1
  https://github.com/smallstep/certificates/releases/tag/v0.28.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1740225600">- update to 0.28.2
  https://github.com/smallstep/certificates/releases/tag/v0.28.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1741608000">- use %python3_fix_shebang to make path more stable</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1742299200">- update to 0.28.3
  https://github.com/smallstep/certificates/releases/tag/v0.28.3-rc1
  https://github.com/smallstep/certificates/releases/tag/v0.28.3</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752494400">- update to 0.28.4
  https://github.com/smallstep/certificates/releases/tag/v0.28.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764763200">- update to 0.29.0 (boo#1253520)
  https://github.com/smallstep/certificates/releases/tag/v0.29.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1773921600">- update to 0.30.1
  https://github.com/smallstep/certificates/releases/tag/v0.30.1
  https://github.com/smallstep/certificates/releases/tag/v0.30.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1774180800">- update to 0.30.2
  https://github.com/smallstep/certificates/releases/tag/v0.30.2</changelog>
</package>
<package pkgid="54302133c191d687da2cb0f7495d7cd76d2f850f7afeaceed18abecc9e29ebb67b66f76e617603e096fd3fc70ebdfd77b89366b2dd7602f8e61953aaace61999" name="step-cli" arch="s390x">
  <version epoch="0" ver="0.30.6" rel="36.7"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1720785600">- update to 0.27.1
  https://github.com/smallstep/cli/releases/tag/v0.27.1
  https://github.com/smallstep/cli/releases/tag/v0.27.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1721304000">- update to 0.27.2
  https://github.com/smallstep/cli/releases/tag/v0.27.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726228800">- update to 0.27.4
  https://github.com/smallstep/cli/releases/tag/v0.27.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166400">- update to 0.27.5
  https://github.com/smallstep/cli/releases/tag/v0.27.5</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729944000">- add back the service file for vendoring modules</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1730289600">- update to 0.28.0
  https://github.com/smallstep/cli/releases/tag/v0.28.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104000">- update to 0.28.1
  https://github.com/smallstep/cli/releases/tag/v0.28.1</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1732104001">- use download_files service to download the tarball</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104002">- update to 0.28.2
  https://github.com/smallstep/cli/releases/tag/v0.28.2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1740052800">- update to 0.28.3:
  https://github.com/smallstep/cli/releases/tag/v0.28.3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741176000">- update to 0.28.4:
  https://github.com/smallstep/cli/releases/tag/v0.28.4
  * Added
  - Add the --set and --set-file flags to the step ca token
    command, allowing the user to set keys in the "user" claim in
    the resulting JWT. (#1375)
  - Support for downloading additional default settings when
    running 'step ssh config' (#1377) 'min-password-length' and
    'provisioner'</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741176001">- update to 0.28.5:
  https://github.com/smallstep/cli/releases/tag/v0.28.5
  * Merge pull request #1382 from smallstep/herman/crypto-v0.59.1
  * Merge pull request #1383 from
    smallstep/herman/fix-token-user-braces
  * Change .Token.user.field to not use curly braces
  * Upgrade go.step.sm/crypto to v0.59.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1742299200">- update to 0.28.6:
  https://github.com/smallstep/cli/releases/tag/v0.28.6</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752494400">- update to 0.28.7:
  https://github.com/smallstep/cli/releases/tag/v0.28.7</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764763200">- update to 0.29.0: (boo#1253520)
  https://github.com/smallstep/cli/releases/tag/v0.29.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773921600">- update to 0.30.1:
  * 1c10067 Bump certificates to v0.30.1 (#1598)
  * a46cdfb Merge pull request #1597 from
    smallstep/dependabot/go_modules/google.golang.org/grpc-1.79.3
  * bfa8de1 Bump google.golang.org/grpc from 1.79.2 to 1.79.3
- update to 0.30.0:
  apparently no code changes, only an empty commit</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1774180800">- update to 0.30.2:
  - Update certificates to v0.30.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092800">- update to 0.30.4:
  Mostly updating dependencies. For the whole list see:
  https://github.com/smallstep/cli/releases/tag/v0.30.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092801">- update to 0.30.5:
  - Fix release workflow to work with immutable releases setting
    (#1650)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092802">- update to 0.30.6:
  - bump for the build pipeline</changelog>
</package>
<package pkgid="5cdf105e2e238777480cb03fdc5621665985db64be16374186f486ef35254a232dc34db4e547e33393ef1069cf52a0774a44e4d094ad5e3f30432d028591d8c8" name="step-cli" arch="src">
  <version epoch="0" ver="0.30.6" rel="36.7"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1720785600">- update to 0.27.1
  https://github.com/smallstep/cli/releases/tag/v0.27.1
  https://github.com/smallstep/cli/releases/tag/v0.27.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1721304000">- update to 0.27.2
  https://github.com/smallstep/cli/releases/tag/v0.27.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726228800">- update to 0.27.4
  https://github.com/smallstep/cli/releases/tag/v0.27.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166400">- update to 0.27.5
  https://github.com/smallstep/cli/releases/tag/v0.27.5</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729944000">- add back the service file for vendoring modules</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1730289600">- update to 0.28.0
  https://github.com/smallstep/cli/releases/tag/v0.28.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104000">- update to 0.28.1
  https://github.com/smallstep/cli/releases/tag/v0.28.1</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1732104001">- use download_files service to download the tarball</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104002">- update to 0.28.2
  https://github.com/smallstep/cli/releases/tag/v0.28.2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1740052800">- update to 0.28.3:
  https://github.com/smallstep/cli/releases/tag/v0.28.3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741176000">- update to 0.28.4:
  https://github.com/smallstep/cli/releases/tag/v0.28.4
  * Added
  - Add the --set and --set-file flags to the step ca token
    command, allowing the user to set keys in the "user" claim in
    the resulting JWT. (#1375)
  - Support for downloading additional default settings when
    running 'step ssh config' (#1377) 'min-password-length' and
    'provisioner'</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741176001">- update to 0.28.5:
  https://github.com/smallstep/cli/releases/tag/v0.28.5
  * Merge pull request #1382 from smallstep/herman/crypto-v0.59.1
  * Merge pull request #1383 from
    smallstep/herman/fix-token-user-braces
  * Change .Token.user.field to not use curly braces
  * Upgrade go.step.sm/crypto to v0.59.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1742299200">- update to 0.28.6:
  https://github.com/smallstep/cli/releases/tag/v0.28.6</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752494400">- update to 0.28.7:
  https://github.com/smallstep/cli/releases/tag/v0.28.7</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764763200">- update to 0.29.0: (boo#1253520)
  https://github.com/smallstep/cli/releases/tag/v0.29.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773921600">- update to 0.30.1:
  * 1c10067 Bump certificates to v0.30.1 (#1598)
  * a46cdfb Merge pull request #1597 from
    smallstep/dependabot/go_modules/google.golang.org/grpc-1.79.3
  * bfa8de1 Bump google.golang.org/grpc from 1.79.2 to 1.79.3
- update to 0.30.0:
  apparently no code changes, only an empty commit</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1774180800">- update to 0.30.2:
  - Update certificates to v0.30.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092800">- update to 0.30.4:
  Mostly updating dependencies. For the whole list see:
  https://github.com/smallstep/cli/releases/tag/v0.30.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092801">- update to 0.30.5:
  - Fix release workflow to work with immutable releases setting
    (#1650)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092802">- update to 0.30.6:
  - bump for the build pipeline</changelog>
</package>
<package pkgid="c3ba27bff8691a5088fba69c14f519766253805d105406cb7a9af7c54edaf53f44e1c704e85c77a360e2914acda06be43b5f46a0124be08d3543a834e7c12dc1" name="step-cli-bash-completion" arch="noarch">
  <version epoch="0" ver="0.30.6" rel="36.7"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1720785600">- update to 0.27.1
  https://github.com/smallstep/cli/releases/tag/v0.27.1
  https://github.com/smallstep/cli/releases/tag/v0.27.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1721304000">- update to 0.27.2
  https://github.com/smallstep/cli/releases/tag/v0.27.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726228800">- update to 0.27.4
  https://github.com/smallstep/cli/releases/tag/v0.27.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166400">- update to 0.27.5
  https://github.com/smallstep/cli/releases/tag/v0.27.5</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729944000">- add back the service file for vendoring modules</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1730289600">- update to 0.28.0
  https://github.com/smallstep/cli/releases/tag/v0.28.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104000">- update to 0.28.1
  https://github.com/smallstep/cli/releases/tag/v0.28.1</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1732104001">- use download_files service to download the tarball</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104002">- update to 0.28.2
  https://github.com/smallstep/cli/releases/tag/v0.28.2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1740052800">- update to 0.28.3:
  https://github.com/smallstep/cli/releases/tag/v0.28.3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741176000">- update to 0.28.4:
  https://github.com/smallstep/cli/releases/tag/v0.28.4
  * Added
  - Add the --set and --set-file flags to the step ca token
    command, allowing the user to set keys in the "user" claim in
    the resulting JWT. (#1375)
  - Support for downloading additional default settings when
    running 'step ssh config' (#1377) 'min-password-length' and
    'provisioner'</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741176001">- update to 0.28.5:
  https://github.com/smallstep/cli/releases/tag/v0.28.5
  * Merge pull request #1382 from smallstep/herman/crypto-v0.59.1
  * Merge pull request #1383 from
    smallstep/herman/fix-token-user-braces
  * Change .Token.user.field to not use curly braces
  * Upgrade go.step.sm/crypto to v0.59.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1742299200">- update to 0.28.6:
  https://github.com/smallstep/cli/releases/tag/v0.28.6</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752494400">- update to 0.28.7:
  https://github.com/smallstep/cli/releases/tag/v0.28.7</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764763200">- update to 0.29.0: (boo#1253520)
  https://github.com/smallstep/cli/releases/tag/v0.29.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773921600">- update to 0.30.1:
  * 1c10067 Bump certificates to v0.30.1 (#1598)
  * a46cdfb Merge pull request #1597 from
    smallstep/dependabot/go_modules/google.golang.org/grpc-1.79.3
  * bfa8de1 Bump google.golang.org/grpc from 1.79.2 to 1.79.3
- update to 0.30.0:
  apparently no code changes, only an empty commit</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1774180800">- update to 0.30.2:
  - Update certificates to v0.30.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092800">- update to 0.30.4:
  Mostly updating dependencies. For the whole list see:
  https://github.com/smallstep/cli/releases/tag/v0.30.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092801">- update to 0.30.5:
  - Fix release workflow to work with immutable releases setting
    (#1650)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092802">- update to 0.30.6:
  - bump for the build pipeline</changelog>
</package>
<package pkgid="66da4e077f7de768b8d6d0b46e1e5adbcf5046de1491d7793033c5457a951ebc0af3a9c2d9ce71f6b25cf134d3ae13f81edd3b7153af518d90d25262f137d19e" name="step-cli-fish-completion" arch="noarch">
  <version epoch="0" ver="0.30.6" rel="36.7"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1720785600">- update to 0.27.1
  https://github.com/smallstep/cli/releases/tag/v0.27.1
  https://github.com/smallstep/cli/releases/tag/v0.27.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1721304000">- update to 0.27.2
  https://github.com/smallstep/cli/releases/tag/v0.27.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726228800">- update to 0.27.4
  https://github.com/smallstep/cli/releases/tag/v0.27.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166400">- update to 0.27.5
  https://github.com/smallstep/cli/releases/tag/v0.27.5</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729944000">- add back the service file for vendoring modules</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1730289600">- update to 0.28.0
  https://github.com/smallstep/cli/releases/tag/v0.28.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104000">- update to 0.28.1
  https://github.com/smallstep/cli/releases/tag/v0.28.1</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1732104001">- use download_files service to download the tarball</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104002">- update to 0.28.2
  https://github.com/smallstep/cli/releases/tag/v0.28.2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1740052800">- update to 0.28.3:
  https://github.com/smallstep/cli/releases/tag/v0.28.3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741176000">- update to 0.28.4:
  https://github.com/smallstep/cli/releases/tag/v0.28.4
  * Added
  - Add the --set and --set-file flags to the step ca token
    command, allowing the user to set keys in the "user" claim in
    the resulting JWT. (#1375)
  - Support for downloading additional default settings when
    running 'step ssh config' (#1377) 'min-password-length' and
    'provisioner'</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741176001">- update to 0.28.5:
  https://github.com/smallstep/cli/releases/tag/v0.28.5
  * Merge pull request #1382 from smallstep/herman/crypto-v0.59.1
  * Merge pull request #1383 from
    smallstep/herman/fix-token-user-braces
  * Change .Token.user.field to not use curly braces
  * Upgrade go.step.sm/crypto to v0.59.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1742299200">- update to 0.28.6:
  https://github.com/smallstep/cli/releases/tag/v0.28.6</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752494400">- update to 0.28.7:
  https://github.com/smallstep/cli/releases/tag/v0.28.7</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764763200">- update to 0.29.0: (boo#1253520)
  https://github.com/smallstep/cli/releases/tag/v0.29.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773921600">- update to 0.30.1:
  * 1c10067 Bump certificates to v0.30.1 (#1598)
  * a46cdfb Merge pull request #1597 from
    smallstep/dependabot/go_modules/google.golang.org/grpc-1.79.3
  * bfa8de1 Bump google.golang.org/grpc from 1.79.2 to 1.79.3
- update to 0.30.0:
  apparently no code changes, only an empty commit</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1774180800">- update to 0.30.2:
  - Update certificates to v0.30.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092800">- update to 0.30.4:
  Mostly updating dependencies. For the whole list see:
  https://github.com/smallstep/cli/releases/tag/v0.30.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092801">- update to 0.30.5:
  - Fix release workflow to work with immutable releases setting
    (#1650)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092802">- update to 0.30.6:
  - bump for the build pipeline</changelog>
</package>
<package pkgid="d0a1ee5720f0e0aed5359ef17211a0bdce0b77f3c0b2de3b366312fb1cea7ac9ddbe193b8db478b462d4e63003db2a83c1a4c1f6712dee6f7156b4b5e122607d" name="step-cli-zsh-completion" arch="noarch">
  <version epoch="0" ver="0.30.6" rel="36.7"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1720785600">- update to 0.27.1
  https://github.com/smallstep/cli/releases/tag/v0.27.1
  https://github.com/smallstep/cli/releases/tag/v0.27.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1721304000">- update to 0.27.2
  https://github.com/smallstep/cli/releases/tag/v0.27.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726228800">- update to 0.27.4
  https://github.com/smallstep/cli/releases/tag/v0.27.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166400">- update to 0.27.5
  https://github.com/smallstep/cli/releases/tag/v0.27.5</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729944000">- add back the service file for vendoring modules</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1730289600">- update to 0.28.0
  https://github.com/smallstep/cli/releases/tag/v0.28.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104000">- update to 0.28.1
  https://github.com/smallstep/cli/releases/tag/v0.28.1</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1732104001">- use download_files service to download the tarball</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104002">- update to 0.28.2
  https://github.com/smallstep/cli/releases/tag/v0.28.2</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1740052800">- update to 0.28.3:
  https://github.com/smallstep/cli/releases/tag/v0.28.3</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741176000">- update to 0.28.4:
  https://github.com/smallstep/cli/releases/tag/v0.28.4
  * Added
  - Add the --set and --set-file flags to the step ca token
    command, allowing the user to set keys in the "user" claim in
    the resulting JWT. (#1375)
  - Support for downloading additional default settings when
    running 'step ssh config' (#1377) 'min-password-length' and
    'provisioner'</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1741176001">- update to 0.28.5:
  https://github.com/smallstep/cli/releases/tag/v0.28.5
  * Merge pull request #1382 from smallstep/herman/crypto-v0.59.1
  * Merge pull request #1383 from
    smallstep/herman/fix-token-user-braces
  * Change .Token.user.field to not use curly braces
  * Upgrade go.step.sm/crypto to v0.59.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1742299200">- update to 0.28.6:
  https://github.com/smallstep/cli/releases/tag/v0.28.6</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752494400">- update to 0.28.7:
  https://github.com/smallstep/cli/releases/tag/v0.28.7</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764763200">- update to 0.29.0: (boo#1253520)
  https://github.com/smallstep/cli/releases/tag/v0.29.0</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773921600">- update to 0.30.1:
  * 1c10067 Bump certificates to v0.30.1 (#1598)
  * a46cdfb Merge pull request #1597 from
    smallstep/dependabot/go_modules/google.golang.org/grpc-1.79.3
  * bfa8de1 Bump google.golang.org/grpc from 1.79.2 to 1.79.3
- update to 0.30.0:
  apparently no code changes, only an empty commit</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1774180800">- update to 0.30.2:
  - Update certificates to v0.30.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092800">- update to 0.30.4:
  Mostly updating dependencies. For the whole list see:
  https://github.com/smallstep/cli/releases/tag/v0.30.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092801">- update to 0.30.5:
  - Fix release workflow to work with immutable releases setting
    (#1650)</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1781092802">- update to 0.30.6:
  - bump for the build pipeline</changelog>
</package>
<package pkgid="486fb69addf3ffccd5f70a48125cad6d712dfa10c524e12f2e75060231566a92c95fe879152a63dc82dce1ae4b74eeac479c36fe12b8e58d205563ffb7a9e864" name="step-kms-plugin" arch="s390x">
  <version epoch="0" ver="0.17.0" rel="1.10"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1720785600">- Update to 0.11.4:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726315200">- Update to 0.11.5:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.5</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166400">- Update to 0.11.6:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.6</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166401">- modernize spec file</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166402">- fix version output</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104000">- Update to 0.11.7:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.7</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1736942400">- Update to 0.11.8:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.8</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1738065600">- Update to 0.12.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1740052800">- Update to 0.12.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1742299200">- Update to 0.12.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1748088000">- Update to 0.13.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.13.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752494400">- Update to 0.13.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.13.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1753876800">- Update to 0.14.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.1
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754481600">- Update to 0.14.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1755777600">- Update to 0.15.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.1
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764763200">- Update to 0.15.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764849600">- Update to 0.16.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.16.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1773835200">- Update to 0.16.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.16.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1774180800">- Update to 0.16.2:
  - 956dd9f Bump google.golang.org/grpc from 1.79.2 to 1.79.3
  - cd36404 Merge pull request #314 from
    smallstep/dependabot/go_modules/google.golang.org/grpc-1.79.3
  - 9b57ca2 Merge pull request #315 from
    smallstep/max/certificates-v0.30.2
  - 479eb3a Update certificates to v0.30.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1775649600">- Update to 0.17.0:
  - 6a8c564 Bump github.com/fxamacker/cbor/v2 from 2.9.0 to 2.9.1
  - c66479f Bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5
  - 5cd1d7e Bump go.step.sm/crypto from 0.77.1 to 0.77.2
  - cf3b866 Merge pull request #316 from smallstep/mariano/delete
  - 9836ba3 Merge pull request #317 from
    smallstep/dependabot/go_modules/github.com/go-jose/go-jose/v3-3.0.5
  - 0ea42f5 Merge pull request #318 from
    smallstep/dependabot/go_modules/go.step.sm/crypto-0.77.2
  - 3463dc5 Merge pull request #319 from
    smallstep/dependabot/go_modules/github.com/fxamacker/cbor/v2-2.9.1
  - ade1d6c Merge pull request #320 from smallstep/mariano/go-1.26
  - f15e989 Prepare release with Go 1.26
  - 882f1c5 Remove bundle flag and use ctkEntry for json marshaling
  - 8dbc398 Remove unnecessary assignment
  - 120d066 add certificate subcommands, key delete, and ctk
    command for macOS</changelog>
</package>
<package pkgid="f045307434100aa021a086493232081f5df5cfbce6d225abaad38d4e3eaa625a82c50221cc69702f63aa5842d051c931ff724e5fdd00f8a65ad87cd3155af4c5" name="step-kms-plugin" arch="src">
  <version epoch="0" ver="0.17.0" rel="1.10"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1720785600">- Update to 0.11.4:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726315200">- Update to 0.11.5:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.5</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166400">- Update to 0.11.6:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.6</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166401">- modernize spec file</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166402">- fix version output</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104000">- Update to 0.11.7:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.7</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1736942400">- Update to 0.11.8:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.8</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1738065600">- Update to 0.12.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1740052800">- Update to 0.12.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1742299200">- Update to 0.12.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1748088000">- Update to 0.13.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.13.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752494400">- Update to 0.13.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.13.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1753876800">- Update to 0.14.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.1
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754481600">- Update to 0.14.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1755777600">- Update to 0.15.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.1
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764763200">- Update to 0.15.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764849600">- Update to 0.16.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.16.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1773835200">- Update to 0.16.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.16.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1774180800">- Update to 0.16.2:
  - 956dd9f Bump google.golang.org/grpc from 1.79.2 to 1.79.3
  - cd36404 Merge pull request #314 from
    smallstep/dependabot/go_modules/google.golang.org/grpc-1.79.3
  - 9b57ca2 Merge pull request #315 from
    smallstep/max/certificates-v0.30.2
  - 479eb3a Update certificates to v0.30.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1775649600">- Update to 0.17.0:
  - 6a8c564 Bump github.com/fxamacker/cbor/v2 from 2.9.0 to 2.9.1
  - c66479f Bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5
  - 5cd1d7e Bump go.step.sm/crypto from 0.77.1 to 0.77.2
  - cf3b866 Merge pull request #316 from smallstep/mariano/delete
  - 9836ba3 Merge pull request #317 from
    smallstep/dependabot/go_modules/github.com/go-jose/go-jose/v3-3.0.5
  - 0ea42f5 Merge pull request #318 from
    smallstep/dependabot/go_modules/go.step.sm/crypto-0.77.2
  - 3463dc5 Merge pull request #319 from
    smallstep/dependabot/go_modules/github.com/fxamacker/cbor/v2-2.9.1
  - ade1d6c Merge pull request #320 from smallstep/mariano/go-1.26
  - f15e989 Prepare release with Go 1.26
  - 882f1c5 Remove bundle flag and use ctkEntry for json marshaling
  - 8dbc398 Remove unnecessary assignment
  - 120d066 add certificate subcommands, key delete, and ctk
    command for macOS</changelog>
</package>
<package pkgid="3e551a5bd0269061ede1794f5098b4836763e576922a158731ccffac56089cb38d1f55c4db548d1113cb350823a93a4d6018f233c472d3af99d760a7b39dcfae" name="step-kms-plugin-bash-completion" arch="noarch">
  <version epoch="0" ver="0.17.0" rel="1.10"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1720785600">- Update to 0.11.4:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726315200">- Update to 0.11.5:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.5</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166400">- Update to 0.11.6:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.6</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166401">- modernize spec file</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166402">- fix version output</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104000">- Update to 0.11.7:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.7</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1736942400">- Update to 0.11.8:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.8</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1738065600">- Update to 0.12.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1740052800">- Update to 0.12.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1742299200">- Update to 0.12.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1748088000">- Update to 0.13.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.13.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752494400">- Update to 0.13.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.13.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1753876800">- Update to 0.14.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.1
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754481600">- Update to 0.14.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1755777600">- Update to 0.15.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.1
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764763200">- Update to 0.15.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764849600">- Update to 0.16.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.16.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1773835200">- Update to 0.16.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.16.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1774180800">- Update to 0.16.2:
  - 956dd9f Bump google.golang.org/grpc from 1.79.2 to 1.79.3
  - cd36404 Merge pull request #314 from
    smallstep/dependabot/go_modules/google.golang.org/grpc-1.79.3
  - 9b57ca2 Merge pull request #315 from
    smallstep/max/certificates-v0.30.2
  - 479eb3a Update certificates to v0.30.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1775649600">- Update to 0.17.0:
  - 6a8c564 Bump github.com/fxamacker/cbor/v2 from 2.9.0 to 2.9.1
  - c66479f Bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5
  - 5cd1d7e Bump go.step.sm/crypto from 0.77.1 to 0.77.2
  - cf3b866 Merge pull request #316 from smallstep/mariano/delete
  - 9836ba3 Merge pull request #317 from
    smallstep/dependabot/go_modules/github.com/go-jose/go-jose/v3-3.0.5
  - 0ea42f5 Merge pull request #318 from
    smallstep/dependabot/go_modules/go.step.sm/crypto-0.77.2
  - 3463dc5 Merge pull request #319 from
    smallstep/dependabot/go_modules/github.com/fxamacker/cbor/v2-2.9.1
  - ade1d6c Merge pull request #320 from smallstep/mariano/go-1.26
  - f15e989 Prepare release with Go 1.26
  - 882f1c5 Remove bundle flag and use ctkEntry for json marshaling
  - 8dbc398 Remove unnecessary assignment
  - 120d066 add certificate subcommands, key delete, and ctk
    command for macOS</changelog>
</package>
<package pkgid="906f8b9466334367b55ac0d4e76cc64ee6b20af52ae2fea5f7a84c10d88e60d0d700f072e87b3b5b2986d9f7f4393ec849cecb6103c31f041bd55acfe041ad1e" name="step-kms-plugin-fish-completion" arch="noarch">
  <version epoch="0" ver="0.17.0" rel="1.10"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1720785600">- Update to 0.11.4:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726315200">- Update to 0.11.5:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.5</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166400">- Update to 0.11.6:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.6</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166401">- modernize spec file</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166402">- fix version output</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104000">- Update to 0.11.7:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.7</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1736942400">- Update to 0.11.8:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.8</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1738065600">- Update to 0.12.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1740052800">- Update to 0.12.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1742299200">- Update to 0.12.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1748088000">- Update to 0.13.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.13.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752494400">- Update to 0.13.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.13.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1753876800">- Update to 0.14.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.1
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754481600">- Update to 0.14.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1755777600">- Update to 0.15.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.1
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764763200">- Update to 0.15.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764849600">- Update to 0.16.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.16.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1773835200">- Update to 0.16.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.16.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1774180800">- Update to 0.16.2:
  - 956dd9f Bump google.golang.org/grpc from 1.79.2 to 1.79.3
  - cd36404 Merge pull request #314 from
    smallstep/dependabot/go_modules/google.golang.org/grpc-1.79.3
  - 9b57ca2 Merge pull request #315 from
    smallstep/max/certificates-v0.30.2
  - 479eb3a Update certificates to v0.30.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1775649600">- Update to 0.17.0:
  - 6a8c564 Bump github.com/fxamacker/cbor/v2 from 2.9.0 to 2.9.1
  - c66479f Bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5
  - 5cd1d7e Bump go.step.sm/crypto from 0.77.1 to 0.77.2
  - cf3b866 Merge pull request #316 from smallstep/mariano/delete
  - 9836ba3 Merge pull request #317 from
    smallstep/dependabot/go_modules/github.com/go-jose/go-jose/v3-3.0.5
  - 0ea42f5 Merge pull request #318 from
    smallstep/dependabot/go_modules/go.step.sm/crypto-0.77.2
  - 3463dc5 Merge pull request #319 from
    smallstep/dependabot/go_modules/github.com/fxamacker/cbor/v2-2.9.1
  - ade1d6c Merge pull request #320 from smallstep/mariano/go-1.26
  - f15e989 Prepare release with Go 1.26
  - 882f1c5 Remove bundle flag and use ctkEntry for json marshaling
  - 8dbc398 Remove unnecessary assignment
  - 120d066 add certificate subcommands, key delete, and ctk
    command for macOS</changelog>
</package>
<package pkgid="8ba73baee813b3c55b72d19cbc4671987f7444560f9c1da43988eaad8762904f4727d3dd313bd59bb542e94aa393ed5a505e9b98b8cd0c7b83b027efff9c51d3" name="step-kms-plugin-zsh-completion" arch="noarch">
  <version epoch="0" ver="0.17.0" rel="1.10"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1720785600">- Update to 0.11.4:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.4</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1726315200">- Update to 0.11.5:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.5</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166400">- Update to 0.11.6:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.6</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166401">- modernize spec file</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1729166402">- fix version output</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1732104000">- Update to 0.11.7:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.7</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1736942400">- Update to 0.11.8:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.11.8</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1738065600">- Update to 0.12.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1740052800">- Update to 0.12.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1742299200">- Update to 0.12.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.12.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1748088000">- Update to 0.13.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.13.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1752494400">- Update to 0.13.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.13.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1753876800">- Update to 0.14.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.1
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1754481600">- Update to 0.14.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.14.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1755777600">- Update to 0.15.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.1
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764763200">- Update to 0.15.2:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.15.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1764849600">- Update to 0.16.0:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.16.0</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1773835200">- Update to 0.16.1:
  https://github.com/smallstep/step-kms-plugin/releases/tag/v0.16.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1774180800">- Update to 0.16.2:
  - 956dd9f Bump google.golang.org/grpc from 1.79.2 to 1.79.3
  - cd36404 Merge pull request #314 from
    smallstep/dependabot/go_modules/google.golang.org/grpc-1.79.3
  - 9b57ca2 Merge pull request #315 from
    smallstep/max/certificates-v0.30.2
  - 479eb3a Update certificates to v0.30.2</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1775649600">- Update to 0.17.0:
  - 6a8c564 Bump github.com/fxamacker/cbor/v2 from 2.9.0 to 2.9.1
  - c66479f Bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5
  - 5cd1d7e Bump go.step.sm/crypto from 0.77.1 to 0.77.2
  - cf3b866 Merge pull request #316 from smallstep/mariano/delete
  - 9836ba3 Merge pull request #317 from
    smallstep/dependabot/go_modules/github.com/go-jose/go-jose/v3-3.0.5
  - 0ea42f5 Merge pull request #318 from
    smallstep/dependabot/go_modules/go.step.sm/crypto-0.77.2
  - 3463dc5 Merge pull request #319 from
    smallstep/dependabot/go_modules/github.com/fxamacker/cbor/v2-2.9.1
  - ade1d6c Merge pull request #320 from smallstep/mariano/go-1.26
  - f15e989 Prepare release with Go 1.26
  - 882f1c5 Remove bundle flag and use ctkEntry for json marshaling
  - 8dbc398 Remove unnecessary assignment
  - 120d066 add certificate subcommands, key delete, and ctk
    command for macOS</changelog>
</package>
<package pkgid="ca076fd4d7077446bb06d5fee556aa0fb4e42b0625c32b3127c6476452d90bbc397bcb1cccdaf29049f5f604832889425e4369f6c2ff1e22c6a0771e6550af24" name="stoken" arch="s390x">
  <version epoch="0" ver="0.93" rel="18.29"/>
  <changelog author="rel-eng@lists.fedoraproject.org" date="1402228800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild</changelog>
  <changelog author="negativo17@gmail.com" date="1403524800">- Update to 0.6.</changelog>
  <changelog author="darin@darins.net" date="1403784000">- Initial inclusion in openSUSE
  * Ported .spec from Fedora</changelog>
  <changelog author="darin@darins.net" date="1403784001">- fix requires</changelog>
  <changelog author="darin@darins.net" date="1404388800">- set deps to libtomcrypt0 which is the correct package name</changelog>
  <changelog author="darin@darins.net" date="1404388801">- fix libtomcrypt dep due to rename</changelog>
  <changelog author="darin@darins.net" date="1405425600">- define BuildRoot
- add Group for all packages
- add --disable-static to %configure</changelog>
  <changelog author="p.drouand@gmail.com" date="1427371200">- Update to version 0.81
  * Fix "make check" failures in GMT+xx timezones (xx &gt;= 1)
- Changes from version 0.8
  * Update GUI from GTK+2 to GTK+3; use glade to define the layouts
  * Add next tokencode and other information to the full GUI (stoken-gui).
    The "stoken-gui --small" layout is unchanged.
  * Add a list of known GUIDs used to bind tokens to specific device classes
    (i.e. tokens can be bound to "any BlackBerry 10").  stoken will now try
    each one of these IDs when importing a new bound token.
  * Add new --qr and --show-qr export options to make it easy to pass tokens
    to a mobile device
  * Add "stoken --next" option to show the next tokencode
  * Support using nettle+gmp as an alternative to libtomcrypt
  * Generate valid TKNTrailer BatchSignature sections in .sdtid output files,
    allowing use with RSA's official TokenConverter utility
  * Fix parsing of RSA-supplied hard token seed files
  * Add "make check" and several test cases
  * Fix build errors on Mac OSX, enable OSX Travis builds, and submit a
    Homebrew formula
  * Fix build errors when using uClibc instead of glibc
  * Add experimental Windows build using MinGW (see README for instructions)
  * Relicense the JNI wrapper (BSD-3-clause) so that it is easier to incorporate
    into non-free Android apps
  * Various fixes for minor bugs, memory leaks, etc.
- Replace pkgconfig(gtk+-2.0) require with pkgconfig(gtk+-3.0);
  follow upstream changes
- Fix license to LGPL-2.0+ and BSD-3-Clause; upstream has relicensed
  the JNI wrapper
- Add pkgconfig(nettle) require; new upstream dependency
- Add CHANGES and TODO to copied documentation list</changelog>
  <changelog author="tchvatal@suse.com" date="1533729600">- Version update to 0.92:
  * Fix build with new libtomcrypt
  * support nette 3.x series
  * See CHANGES for details</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1695643200">- Version update to 0.93:
  * upstream moved to github
  * Drop support for versions of nettle older than 2014
  * Further v4 token work
  * fixes in README
  * Add --both option to print current and next token
  * Support for v4 token decode
  * Remove bashisms (Alon Bar-Lev)</changelog>
</package>
<package pkgid="570b77d13a1f96fa962f27233aa49e6bc9289434cff23ee59cd7ebf0296293e32a7b7ffa2000e5fa97010a9d4738746c376913c088fc28b80952e6b43190d9e7" name="stoken" arch="src">
  <version epoch="0" ver="0.93" rel="18.29"/>
  <changelog author="negativo17@gmail.com" date="1370260800">- First build.</changelog>
  <changelog author="negativo17@gmail.com" date="1370347200">- Add patch to avoid static CFLAGS.
- Require proper libtomcrypt version.</changelog>
  <changelog author="negativo17@gmail.com" date="1370433600">- Change gtk and libtomcrypt build requirements.
- Remove useless "--with-libtomcrypt" parameter from %%configure.</changelog>
  <changelog author="rel-eng@lists.fedoraproject.org" date="1375617600">- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild</changelog>
  <changelog author="negativo17@gmail.com" date="1395057600">- Update to 0.5.
- Removed upstreamed patch.</changelog>
  <changelog author="rel-eng@lists.fedoraproject.org" date="1402228800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild</changelog>
  <changelog author="negativo17@gmail.com" date="1403524800">- Update to 0.6.</changelog>
  <changelog author="darin@darins.net" date="1403784000">- Initial inclusion in openSUSE
  * Ported .spec from Fedora</changelog>
  <changelog author="darin@darins.net" date="1403784001">- fix requires</changelog>
  <changelog author="darin@darins.net" date="1404388800">- set deps to libtomcrypt0 which is the correct package name</changelog>
  <changelog author="darin@darins.net" date="1404388801">- fix libtomcrypt dep due to rename</changelog>
  <changelog author="darin@darins.net" date="1405425600">- define BuildRoot
- add Group for all packages
- add --disable-static to %configure</changelog>
  <changelog author="p.drouand@gmail.com" date="1427371200">- Update to version 0.81
  * Fix "make check" failures in GMT+xx timezones (xx &gt;= 1)
- Changes from version 0.8
  * Update GUI from GTK+2 to GTK+3; use glade to define the layouts
  * Add next tokencode and other information to the full GUI (stoken-gui).
    The "stoken-gui --small" layout is unchanged.
  * Add a list of known GUIDs used to bind tokens to specific device classes
    (i.e. tokens can be bound to "any BlackBerry 10").  stoken will now try
    each one of these IDs when importing a new bound token.
  * Add new --qr and --show-qr export options to make it easy to pass tokens
    to a mobile device
  * Add "stoken --next" option to show the next tokencode
  * Support using nettle+gmp as an alternative to libtomcrypt
  * Generate valid TKNTrailer BatchSignature sections in .sdtid output files,
    allowing use with RSA's official TokenConverter utility
  * Fix parsing of RSA-supplied hard token seed files
  * Add "make check" and several test cases
  * Fix build errors on Mac OSX, enable OSX Travis builds, and submit a
    Homebrew formula
  * Fix build errors when using uClibc instead of glibc
  * Add experimental Windows build using MinGW (see README for instructions)
  * Relicense the JNI wrapper (BSD-3-clause) so that it is easier to incorporate
    into non-free Android apps
  * Various fixes for minor bugs, memory leaks, etc.
- Replace pkgconfig(gtk+-2.0) require with pkgconfig(gtk+-3.0);
  follow upstream changes
- Fix license to LGPL-2.0+ and BSD-3-Clause; upstream has relicensed
  the JNI wrapper
- Add pkgconfig(nettle) require; new upstream dependency
- Add CHANGES and TODO to copied documentation list</changelog>
  <changelog author="tchvatal@suse.com" date="1533729600">- Version update to 0.92:
  * Fix build with new libtomcrypt
  * support nette 3.x series
  * See CHANGES for details</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1695643200">- Version update to 0.93:
  * upstream moved to github
  * Drop support for versions of nettle older than 2014
  * Further v4 token work
  * fixes in README
  * Add --both option to print current and next token
  * Support for v4 token decode
  * Remove bashisms (Alon Bar-Lev)</changelog>
</package>
<package pkgid="aedeeb02ad8f4c70deb65c2408cdc7ac1a3b1b62cdbb2d8d178b7100ad6f793941e02f921fcd41c062ddeac3fd31c04507e2617c90010632d4af38408c69e293" name="stoken-debuginfo" arch="s390x">
  <version epoch="0" ver="0.93" rel="18.29"/>
  <changelog author="rel-eng@lists.fedoraproject.org" date="1402228800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild</changelog>
  <changelog author="negativo17@gmail.com" date="1403524800">- Update to 0.6.</changelog>
  <changelog author="darin@darins.net" date="1403784000">- Initial inclusion in openSUSE
  * Ported .spec from Fedora</changelog>
  <changelog author="darin@darins.net" date="1403784001">- fix requires</changelog>
  <changelog author="darin@darins.net" date="1404388800">- set deps to libtomcrypt0 which is the correct package name</changelog>
  <changelog author="darin@darins.net" date="1404388801">- fix libtomcrypt dep due to rename</changelog>
  <changelog author="darin@darins.net" date="1405425600">- define BuildRoot
- add Group for all packages
- add --disable-static to %configure</changelog>
  <changelog author="p.drouand@gmail.com" date="1427371200">- Update to version 0.81
  * Fix "make check" failures in GMT+xx timezones (xx &gt;= 1)
- Changes from version 0.8
  * Update GUI from GTK+2 to GTK+3; use glade to define the layouts
  * Add next tokencode and other information to the full GUI (stoken-gui).
    The "stoken-gui --small" layout is unchanged.
  * Add a list of known GUIDs used to bind tokens to specific device classes
    (i.e. tokens can be bound to "any BlackBerry 10").  stoken will now try
    each one of these IDs when importing a new bound token.
  * Add new --qr and --show-qr export options to make it easy to pass tokens
    to a mobile device
  * Add "stoken --next" option to show the next tokencode
  * Support using nettle+gmp as an alternative to libtomcrypt
  * Generate valid TKNTrailer BatchSignature sections in .sdtid output files,
    allowing use with RSA's official TokenConverter utility
  * Fix parsing of RSA-supplied hard token seed files
  * Add "make check" and several test cases
  * Fix build errors on Mac OSX, enable OSX Travis builds, and submit a
    Homebrew formula
  * Fix build errors when using uClibc instead of glibc
  * Add experimental Windows build using MinGW (see README for instructions)
  * Relicense the JNI wrapper (BSD-3-clause) so that it is easier to incorporate
    into non-free Android apps
  * Various fixes for minor bugs, memory leaks, etc.
- Replace pkgconfig(gtk+-2.0) require with pkgconfig(gtk+-3.0);
  follow upstream changes
- Fix license to LGPL-2.0+ and BSD-3-Clause; upstream has relicensed
  the JNI wrapper
- Add pkgconfig(nettle) require; new upstream dependency
- Add CHANGES and TODO to copied documentation list</changelog>
  <changelog author="tchvatal@suse.com" date="1533729600">- Version update to 0.92:
  * Fix build with new libtomcrypt
  * support nette 3.x series
  * See CHANGES for details</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1695643200">- Version update to 0.93:
  * upstream moved to github
  * Drop support for versions of nettle older than 2014
  * Further v4 token work
  * fixes in README
  * Add --both option to print current and next token
  * Support for v4 token decode
  * Remove bashisms (Alon Bar-Lev)</changelog>
</package>
<package pkgid="2cc875f87220a7488dd0c5e4663d131c8f38575504145bc33b41648d449ad9e495456bfe91621abc222b42b77625658bf757f38b5fc5c9127b34a7800327d735" name="stoken-debugsource" arch="s390x">
  <version epoch="0" ver="0.93" rel="18.29"/>
  <changelog author="rel-eng@lists.fedoraproject.org" date="1402228800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild</changelog>
  <changelog author="negativo17@gmail.com" date="1403524800">- Update to 0.6.</changelog>
  <changelog author="darin@darins.net" date="1403784000">- Initial inclusion in openSUSE
  * Ported .spec from Fedora</changelog>
  <changelog author="darin@darins.net" date="1403784001">- fix requires</changelog>
  <changelog author="darin@darins.net" date="1404388800">- set deps to libtomcrypt0 which is the correct package name</changelog>
  <changelog author="darin@darins.net" date="1404388801">- fix libtomcrypt dep due to rename</changelog>
  <changelog author="darin@darins.net" date="1405425600">- define BuildRoot
- add Group for all packages
- add --disable-static to %configure</changelog>
  <changelog author="p.drouand@gmail.com" date="1427371200">- Update to version 0.81
  * Fix "make check" failures in GMT+xx timezones (xx &gt;= 1)
- Changes from version 0.8
  * Update GUI from GTK+2 to GTK+3; use glade to define the layouts
  * Add next tokencode and other information to the full GUI (stoken-gui).
    The "stoken-gui --small" layout is unchanged.
  * Add a list of known GUIDs used to bind tokens to specific device classes
    (i.e. tokens can be bound to "any BlackBerry 10").  stoken will now try
    each one of these IDs when importing a new bound token.
  * Add new --qr and --show-qr export options to make it easy to pass tokens
    to a mobile device
  * Add "stoken --next" option to show the next tokencode
  * Support using nettle+gmp as an alternative to libtomcrypt
  * Generate valid TKNTrailer BatchSignature sections in .sdtid output files,
    allowing use with RSA's official TokenConverter utility
  * Fix parsing of RSA-supplied hard token seed files
  * Add "make check" and several test cases
  * Fix build errors on Mac OSX, enable OSX Travis builds, and submit a
    Homebrew formula
  * Fix build errors when using uClibc instead of glibc
  * Add experimental Windows build using MinGW (see README for instructions)
  * Relicense the JNI wrapper (BSD-3-clause) so that it is easier to incorporate
    into non-free Android apps
  * Various fixes for minor bugs, memory leaks, etc.
- Replace pkgconfig(gtk+-2.0) require with pkgconfig(gtk+-3.0);
  follow upstream changes
- Fix license to LGPL-2.0+ and BSD-3-Clause; upstream has relicensed
  the JNI wrapper
- Add pkgconfig(nettle) require; new upstream dependency
- Add CHANGES and TODO to copied documentation list</changelog>
  <changelog author="tchvatal@suse.com" date="1533729600">- Version update to 0.92:
  * Fix build with new libtomcrypt
  * support nette 3.x series
  * See CHANGES for details</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1695643200">- Version update to 0.93:
  * upstream moved to github
  * Drop support for versions of nettle older than 2014
  * Further v4 token work
  * fixes in README
  * Add --both option to print current and next token
  * Support for v4 token decode
  * Remove bashisms (Alon Bar-Lev)</changelog>
</package>
<package pkgid="0c2644022070f5962b9950684670260b2db277640bf3c073bfc5cd28d77f814e0d942c400063e6be41547cd28edd5bb73c4b526f305b89b7cb907a3eb099e7b9" name="stoken-devel" arch="s390x">
  <version epoch="0" ver="0.93" rel="18.29"/>
  <changelog author="rel-eng@lists.fedoraproject.org" date="1402228800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild</changelog>
  <changelog author="negativo17@gmail.com" date="1403524800">- Update to 0.6.</changelog>
  <changelog author="darin@darins.net" date="1403784000">- Initial inclusion in openSUSE
  * Ported .spec from Fedora</changelog>
  <changelog author="darin@darins.net" date="1403784001">- fix requires</changelog>
  <changelog author="darin@darins.net" date="1404388800">- set deps to libtomcrypt0 which is the correct package name</changelog>
  <changelog author="darin@darins.net" date="1404388801">- fix libtomcrypt dep due to rename</changelog>
  <changelog author="darin@darins.net" date="1405425600">- define BuildRoot
- add Group for all packages
- add --disable-static to %configure</changelog>
  <changelog author="p.drouand@gmail.com" date="1427371200">- Update to version 0.81
  * Fix "make check" failures in GMT+xx timezones (xx &gt;= 1)
- Changes from version 0.8
  * Update GUI from GTK+2 to GTK+3; use glade to define the layouts
  * Add next tokencode and other information to the full GUI (stoken-gui).
    The "stoken-gui --small" layout is unchanged.
  * Add a list of known GUIDs used to bind tokens to specific device classes
    (i.e. tokens can be bound to "any BlackBerry 10").  stoken will now try
    each one of these IDs when importing a new bound token.
  * Add new --qr and --show-qr export options to make it easy to pass tokens
    to a mobile device
  * Add "stoken --next" option to show the next tokencode
  * Support using nettle+gmp as an alternative to libtomcrypt
  * Generate valid TKNTrailer BatchSignature sections in .sdtid output files,
    allowing use with RSA's official TokenConverter utility
  * Fix parsing of RSA-supplied hard token seed files
  * Add "make check" and several test cases
  * Fix build errors on Mac OSX, enable OSX Travis builds, and submit a
    Homebrew formula
  * Fix build errors when using uClibc instead of glibc
  * Add experimental Windows build using MinGW (see README for instructions)
  * Relicense the JNI wrapper (BSD-3-clause) so that it is easier to incorporate
    into non-free Android apps
  * Various fixes for minor bugs, memory leaks, etc.
- Replace pkgconfig(gtk+-2.0) require with pkgconfig(gtk+-3.0);
  follow upstream changes
- Fix license to LGPL-2.0+ and BSD-3-Clause; upstream has relicensed
  the JNI wrapper
- Add pkgconfig(nettle) require; new upstream dependency
- Add CHANGES and TODO to copied documentation list</changelog>
  <changelog author="tchvatal@suse.com" date="1533729600">- Version update to 0.92:
  * Fix build with new libtomcrypt
  * support nette 3.x series
  * See CHANGES for details</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1695643200">- Version update to 0.93:
  * upstream moved to github
  * Drop support for versions of nettle older than 2014
  * Further v4 token work
  * fixes in README
  * Add --both option to print current and next token
  * Support for v4 token decode
  * Remove bashisms (Alon Bar-Lev)</changelog>
</package>
<package pkgid="420ad0e3ec2b513110a6ba4c7fb236ab1485359a0d073fbd81e0f4f98d3716c0d72f1e496950e8938357a9b844d1d719ee2e7545dafc6bc3b2c4f9a71f027e35" name="stoken-gui" arch="s390x">
  <version epoch="0" ver="0.93" rel="18.29"/>
  <changelog author="rel-eng@lists.fedoraproject.org" date="1402228800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild</changelog>
  <changelog author="negativo17@gmail.com" date="1403524800">- Update to 0.6.</changelog>
  <changelog author="darin@darins.net" date="1403784000">- Initial inclusion in openSUSE
  * Ported .spec from Fedora</changelog>
  <changelog author="darin@darins.net" date="1403784001">- fix requires</changelog>
  <changelog author="darin@darins.net" date="1404388800">- set deps to libtomcrypt0 which is the correct package name</changelog>
  <changelog author="darin@darins.net" date="1404388801">- fix libtomcrypt dep due to rename</changelog>
  <changelog author="darin@darins.net" date="1405425600">- define BuildRoot
- add Group for all packages
- add --disable-static to %configure</changelog>
  <changelog author="p.drouand@gmail.com" date="1427371200">- Update to version 0.81
  * Fix "make check" failures in GMT+xx timezones (xx &gt;= 1)
- Changes from version 0.8
  * Update GUI from GTK+2 to GTK+3; use glade to define the layouts
  * Add next tokencode and other information to the full GUI (stoken-gui).
    The "stoken-gui --small" layout is unchanged.
  * Add a list of known GUIDs used to bind tokens to specific device classes
    (i.e. tokens can be bound to "any BlackBerry 10").  stoken will now try
    each one of these IDs when importing a new bound token.
  * Add new --qr and --show-qr export options to make it easy to pass tokens
    to a mobile device
  * Add "stoken --next" option to show the next tokencode
  * Support using nettle+gmp as an alternative to libtomcrypt
  * Generate valid TKNTrailer BatchSignature sections in .sdtid output files,
    allowing use with RSA's official TokenConverter utility
  * Fix parsing of RSA-supplied hard token seed files
  * Add "make check" and several test cases
  * Fix build errors on Mac OSX, enable OSX Travis builds, and submit a
    Homebrew formula
  * Fix build errors when using uClibc instead of glibc
  * Add experimental Windows build using MinGW (see README for instructions)
  * Relicense the JNI wrapper (BSD-3-clause) so that it is easier to incorporate
    into non-free Android apps
  * Various fixes for minor bugs, memory leaks, etc.
- Replace pkgconfig(gtk+-2.0) require with pkgconfig(gtk+-3.0);
  follow upstream changes
- Fix license to LGPL-2.0+ and BSD-3-Clause; upstream has relicensed
  the JNI wrapper
- Add pkgconfig(nettle) require; new upstream dependency
- Add CHANGES and TODO to copied documentation list</changelog>
  <changelog author="tchvatal@suse.com" date="1533729600">- Version update to 0.92:
  * Fix build with new libtomcrypt
  * support nette 3.x series
  * See CHANGES for details</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1695643200">- Version update to 0.93:
  * upstream moved to github
  * Drop support for versions of nettle older than 2014
  * Further v4 token work
  * fixes in README
  * Add --both option to print current and next token
  * Support for v4 token decode
  * Remove bashisms (Alon Bar-Lev)</changelog>
</package>
<package pkgid="8e998ad0598068826d3e4777eae5e43b70e003d894b8c84d2993e4cf061164314e48dfe7b83dacbb9018a83b97a4685add0cae49074ab67c55a0f75976e34daf" name="stoken-gui-debuginfo" arch="s390x">
  <version epoch="0" ver="0.93" rel="18.29"/>
  <changelog author="rel-eng@lists.fedoraproject.org" date="1402228800">- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild</changelog>
  <changelog author="negativo17@gmail.com" date="1403524800">- Update to 0.6.</changelog>
  <changelog author="darin@darins.net" date="1403784000">- Initial inclusion in openSUSE
  * Ported .spec from Fedora</changelog>
  <changelog author="darin@darins.net" date="1403784001">- fix requires</changelog>
  <changelog author="darin@darins.net" date="1404388800">- set deps to libtomcrypt0 which is the correct package name</changelog>
  <changelog author="darin@darins.net" date="1404388801">- fix libtomcrypt dep due to rename</changelog>
  <changelog author="darin@darins.net" date="1405425600">- define BuildRoot
- add Group for all packages
- add --disable-static to %configure</changelog>
  <changelog author="p.drouand@gmail.com" date="1427371200">- Update to version 0.81
  * Fix "make check" failures in GMT+xx timezones (xx &gt;= 1)
- Changes from version 0.8
  * Update GUI from GTK+2 to GTK+3; use glade to define the layouts
  * Add next tokencode and other information to the full GUI (stoken-gui).
    The "stoken-gui --small" layout is unchanged.
  * Add a list of known GUIDs used to bind tokens to specific device classes
    (i.e. tokens can be bound to "any BlackBerry 10").  stoken will now try
    each one of these IDs when importing a new bound token.
  * Add new --qr and --show-qr export options to make it easy to pass tokens
    to a mobile device
  * Add "stoken --next" option to show the next tokencode
  * Support using nettle+gmp as an alternative to libtomcrypt
  * Generate valid TKNTrailer BatchSignature sections in .sdtid output files,
    allowing use with RSA's official TokenConverter utility
  * Fix parsing of RSA-supplied hard token seed files
  * Add "make check" and several test cases
  * Fix build errors on Mac OSX, enable OSX Travis builds, and submit a
    Homebrew formula
  * Fix build errors when using uClibc instead of glibc
  * Add experimental Windows build using MinGW (see README for instructions)
  * Relicense the JNI wrapper (BSD-3-clause) so that it is easier to incorporate
    into non-free Android apps
  * Various fixes for minor bugs, memory leaks, etc.
- Replace pkgconfig(gtk+-2.0) require with pkgconfig(gtk+-3.0);
  follow upstream changes
- Fix license to LGPL-2.0+ and BSD-3-Clause; upstream has relicensed
  the JNI wrapper
- Add pkgconfig(nettle) require; new upstream dependency
- Add CHANGES and TODO to copied documentation list</changelog>
  <changelog author="tchvatal@suse.com" date="1533729600">- Version update to 0.92:
  * Fix build with new libtomcrypt
  * support nette 3.x series
  * See CHANGES for details</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1695643200">- Version update to 0.93:
  * upstream moved to github
  * Drop support for versions of nettle older than 2014
  * Further v4 token work
  * fixes in README
  * Add --both option to print current and next token
  * Support for v4 token decode
  * Remove bashisms (Alon Bar-Lev)</changelog>
</package>
<package pkgid="1ad0c4cd091993e431958830183f5e90f97b6fae9e48c7be4f800cc54b7d1e1bef85000b1c75b860bfe28d68b873dc4cf6c7cd2205246e5c90e1b5955ed70b5d" name="swtpm" arch="s390x">
  <version epoch="0" ver="0.10.1" rel="62.2"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104000">- Update to version 0.8.0:
  * swtpm:
    + Implement release-lock-outgoing parameter for --migration option
    + Introduce --migration option and 'incoming' parameter
    + Implement terminate parameter for ctrl channel loss
    + Add a chroot option
    + Introduce disable-auto-shutdown flag for --flags option
    + If necessary send TPM2_Shutdown() before TPMLIB_Terminate()
    + Add some more recent syscalls to seccomp profile
    + Disable OpenSSL FIPS mode to avoid libtpms failures
    + Avoid locking directory multiple times
    + Remove support for pre-v0.1 state files without header
    + Use uint64_t in tlv_data_append() to avoid integer overflows
    + Use uint64_t to avoid integer wrap-around when adding a uint32_t
    + Do not chdir(/) when using --daemon
    + Check header size indicator against expected size (CVE-2022-23645 bsc#1196240)
    + Fixes for gcc 12.2.1 -fanalyzer
  * build-sys:
    + Fix configure script to support _FORTIFY_SOURCE=3
    + Define __USE_LINUX_IOCTL_DEFS in header file (Cygwin)
  * swtpm-localca:
    + Re-implement variable resolution for swtpm-localca.conf
    + Test for available issuercert before creating CA
  * swtpm_setup:
    + Configure swtpm to log to stdout/err if needed (glib &gt;=2.74)
  * tests:
    + Use ${WORKDIR} in config files to test env. var replacement
    + Patch IBM TSS2 test suite for OpenSSL 3.x
  * build-sys:
    + Add probing for -fstack-protector</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104001">- Drop trousers requirement</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1679400000">- swtpm-fix-build.patch: disable -Wstack-protector, it fails on s390x
  bsc#1209117</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1683028800">- remove python3 dependency, no longer needed after rewrite (bsc#1211010)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1686916800">- Make selinux optional to allow building this package for Leap, too.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1694865600">- Update to version 0.8.1:
  - swtpm:
  - Restore logging to stderr on log open failure
  - swtpm_setup:
  - Exit with '0' upon --version rather than '1'.
  - Initialized @argv in get_swtpm_capabilities()
  - swtpm_localca:
  - Add missing NULL option to end of array
  - SELinux:
  - Add rules for user_tpm_t:sockfile to allow unlink
  - Add rules for sock_file on user_tmp_t</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1697716800">- Add missing requires for certtool</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1722513600">- update to 0.9.0:
  - fixes: boo#1226398
  - swtpm:
  - Use umask() to create/truncated state file rather than fchmod()
  - Use fchmod to set mode bits provided by user
  - Replace mkstemp with g_mkstemp_full (Coverity)
  - fix typo in help message
  - cuse: Fix Coverity complaints regarding locks
  - Fix double free in error path
  - Close fd after main loop
  - Restore logging to stderr on log open failure
  - swtpm_setup:
  - Fail --pcr-banks without --tpm2
  - Fail --decryption or --allow-signing without --tpm2
  - Initialized argv in get_swtpm_capabilities()
  - Flush spk after persisting to create room for another key
  - Refactor duplicate code into swtpm_tpm2_write_cert_nvram
  - Move persisting of certificate into tpm2_persist_certificate
  - Pass key_type to function creating filename for key
  - Add scheme parameter before curveid to createprimary_ecc
  - Rename is_ek to preserve for future extension
  - Mask-out EK and plaform certificate flags and set cert_flags
  - Move common code into new function read_certificate_file()
  - Exit with '0' upon --version rather than '1'
  - Close file descriptors passed to swtpm process on parent side
  - Make stdout unbuffered
  - Use medium duration on TSC_PhysicalPresence to avoid timeouts
  - Add poll() after write() and before read() to detect errors
  - swtpm_localca:
  - Add support for up to 20 bytes serial numbers
  - Introduce --key as more generic alias for --ek
  - Add missing NULL option to end of array
  - Make stdout unbuffered
  - swtpm_cert:
  - Add support for serial numbers up to 20 bytes long
  - swtpm_ioctl:
  - Separate return code from flags
  - Repeatedly call PTM_GET_INFO for long responses
  - selinux:
  - Re-add rule for svirt_tcg_t and user_tmp_t:sock_file (virt-install)
  - New SELinux policy that requires Fedora 40 or later
  - tests:
  - Fixed occurrences of stray '' before '-'
  - Rearrange order of test cases to run some also as 'root'
  - Add tests for command line options and combinations of options
  - Add softhsm_setup to shellcheck'ed files and fix issues
  - Add missing 'exit 1' on unexpected file size on --reconfigure
  - Add test cases for swtpm_cert with max serial number
  - Fix spelling mistakes
  - reformat regexs for easier readability and extension
  - ibmtss2: Add patch to disable x509 test with older libtpms
  - Upgrade to ibmtss2 v2.0.1
  - Fixed several issues detected by shellcheck
  - build-sys:
  - Add support for --disable-tests to disable tests
  - Display GMP_LIBS and GMP_CFLAGS
  - Only display warning if pkg-config for gmp fails
  - Add gmp library and devel package as dependency
  - use PKG_CHECK_MODULES to check libtpms version</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1726747200">- Fix swtpm custom module (bsc#1229131)
  - Add patch: 1229131-fix-swtpm-selinux-policy-mismatch.patch
  - this can be removed once swtpm upstream sorts out their custom selinux module.
    see: https://github.com/stefanberger/swtpm/issues/885
    there were a couple changes in the selinux-policy libvirt handling
    which causes the logfile in /var/log/swtpm/libvirt/qemu/*.log to be labeled
    virt_log_t instead of var_log_t. this patch allows swtpm_t to open the virt_log_t</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1733313600">- Update to 0.10.0:
  + swtpm:
  * Requires libtpms v0.10.0
  * Display tpmstate-opt-lock as a new capability
  * Add support for lock option parameter to tpmstate option
  * nvstore_linear: Add support for file-backend locking
  * Remove broken logic to check for neither dir nor file backend
  * Use ptm_cap_n to build PTM_GET_CAPABILITY response
  * Define a structure to return PTM_GET_CAPABILITY result
  * Implement --print-info to run TPMLIB_GetInfo with flags
  * Support --profile fd= to read profile from file descriptor
  * Support --profile file= to read profile from file
  * Ignore remove-disabled parameter on non-'custom' profile
  * Check for good entropy source in chroot environment
  * Implement a check for HMAC+sha1 for testing future restriction
  * Implement function to check whether a crypto algorithm is
    disabled
  * Print cmdarg-print-profiles as part of capabilities
  * Check whether SHA1 signature support is disabled in profile
  * Use TPMLIB_WasManufactured to check whether profile was applied
  * Determine whether OpenSSL needs to be configured (FIPs, SHA1
    signature)
  * Add support for --print-profiles option
  * Print profile names as part of capabilities JSON
  * Display new capability to allow setting a profile
  * Add support for --profile option to set a profile on TPM 2
  + swtpm_setup:
  * Comment flags for storage primary key and deprecate --create-spk
  * Implement --print-profiles to display all profile
  * Add profile entries to swtpm_setup.conf written by swtpm_setup
  * Add support for --profile-name option
  * Accept profiles with name starting with 'custom:'
  * Support default profile from file in swtpm_setup.conf
  * Support --profile-file-fd to read profile from file descriptor
  * Support --profile-file to read profile from file
  * Always log the active profile
  * Implement --profile-remove-fips-disabled option
  * Read default profile from swtpm_setup.conf
  * Print profile names as part of capabilities JSON
  * Add support for --profile parameter
  * Get default rsa keysize from setup_setup.conf if not given
  + swtpm_ioctl:
  * Use ptm_cap_n for non-CUSE PTM_GET_CAPABILITY response
  + selinux:
  * Change write to append for appending to log
  * Add rule for logging to svirt_image_t labeled files from swtpm_t
  + tests:
  * Update IBMTSS2 test suite to v2.4.0
  * Test activation of PCR banks when not all are available
  * Enable SWTPM_TEST_PROFILE for running test_tpm2_ibmtss2 with
    profile
  * Add a check for OPENSSL_ENABLE_SHA1_SIGNATURES in log file
  * Consolidate custom profile test cases and check for
    StateFormatLevel
  * Convert test_samples_create_tpmca to run installed
  * Mention test_tpm2_libtpms_versions_profiles requiring
    env. variables
  * allow running ibmtss2 tests against installed version
  * Derive support for CUSE from SWTPM_EXE help screen
  * Set OPENSSL_ENABLE_SHA1_SIGNATURES=1 for IBMTSS2 test
  * Extend test case testing across libtpms versions
  * Add test case for testing profiles across libtpms versions
  * Test the --profile option of swtpm_setup and swtpm
  * teach them to run installed
  * add installed-runner.sh
  * install tests on the system
  * lookup system binaries if INSTALLED is set
  + build-sys:
  * enable 64-bit file API on 32-bit systems
  * Add -Wshadow to the CFLAGS
  * Require that libtpms v0.10 is available for TPMLIB_SetProfile</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1733572800">- Fix build without %check (boo#1227364)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1750075200">- Update to version 0.10.1:
  + swtpm: Fix build error on 32bit systems due to inconsistent
    _FILE_OFFSET_BITS.
  + swtpm_setup:
  - Use DISTRO_PROFILES_DIR when listing profiles (fix path
    issue).
  - Do not pass a TPM 2 profile to swtpm when reconfiguring.
  + selinux:
  - Add rule for swtpm to be able to read password from pipe.
  - allow to map state file.
  - add NFS permissions for swtpm_t.
  - Add rule to allow swtpm_t opening of virt_log_t files.
- Drop 1229131-fix-swtpm-selinux-policy-mismatch.patch: fixed
  upstream.
- Add 1027.patch: tests: Retry NVWrite command after 0x922 return
  code and inc lockout counter.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1761912000">- Also load swtpm_libvirt in the selinux subpackage (bsc#1251789)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1784116800">- Drop tunable in require to avoid policy loading issues
  with toolchain 3.11 (bsc#1271417).
  Can be dropped, once this is accepted upstream:
  https://github.com/stefanberger/swtpm/pull/1139
  - Add patch: 1271417-drop-tunable-requires.patch</changelog>
  <changelog author="Jehu Marcos Herrera Puentes &lt;jehuherrerap@hotmail.com&gt;" date="1785412800">- Fix SELinux policy for virtqemud_t swtpm_t setsched
  process and unix socket interactions. Allows virtqemud_t to: Signal and
  control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched),
  create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339).
  Already accepted on upstream:
  https://github.com/stefanberger/swtpm/pull/1132
- Add patch: 1132.patch</changelog>
</package>
<package pkgid="db8d8a178ca13cea98fc035408a7924a4b1f5f41fe549d704e03227073fd800710c8ab7a442529f8d6c669f5bbf67e5a3f3c7f3db0ab684a4cf569411aedf693" name="swtpm" arch="src">
  <version epoch="0" ver="0.10.1" rel="62.2"/>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1645444800">- Update to version 0.7.1:
  - swtpm:
  - Check header size indicator against expected size (CVE-2022-23645 bsc#1196240)
  - swtpm_localca:
  - Test for available issuercert before creating CA</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1646827200">- Update to version 0.7.2:
  - swtpm:
  - Do not chdir(/) when using --daemon
  - swtpm-localca:
  - Re-implement variable resolution for swtpm-localca.conf
  - tests:
  - Use ${WORKDIR} in config files to test env. var replacement
  - man pages:
  - Add missing .config directory to path description when using ${HOME}
  - build-sys:
  - Add probing for -fstack-protector</changelog>
  <changelog author="Martin Li&#x161;ka &lt;mliska@suse.cz&gt;" date="1649246400">- Cheery-pick upstream patch allow-FORTIFY_SOURCE=3.patch.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1651233600">- Updated to version 0.7.3:
  - swtpm:
  - Use uint64_t in tlv_data_append() to avoid integer overflows
  - Use uint64_t to avoid integer wrap-around when adding a uint32_t
- removed allow-FORTIFY_SOURCE=3.patch (upstreamed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104000">- Update to version 0.8.0:
  * swtpm:
    + Implement release-lock-outgoing parameter for --migration option
    + Introduce --migration option and 'incoming' parameter
    + Implement terminate parameter for ctrl channel loss
    + Add a chroot option
    + Introduce disable-auto-shutdown flag for --flags option
    + If necessary send TPM2_Shutdown() before TPMLIB_Terminate()
    + Add some more recent syscalls to seccomp profile
    + Disable OpenSSL FIPS mode to avoid libtpms failures
    + Avoid locking directory multiple times
    + Remove support for pre-v0.1 state files without header
    + Use uint64_t in tlv_data_append() to avoid integer overflows
    + Use uint64_t to avoid integer wrap-around when adding a uint32_t
    + Do not chdir(/) when using --daemon
    + Check header size indicator against expected size (CVE-2022-23645 bsc#1196240)
    + Fixes for gcc 12.2.1 -fanalyzer
  * build-sys:
    + Fix configure script to support _FORTIFY_SOURCE=3
    + Define __USE_LINUX_IOCTL_DEFS in header file (Cygwin)
  * swtpm-localca:
    + Re-implement variable resolution for swtpm-localca.conf
    + Test for available issuercert before creating CA
  * swtpm_setup:
    + Configure swtpm to log to stdout/err if needed (glib &gt;=2.74)
  * tests:
    + Use ${WORKDIR} in config files to test env. var replacement
    + Patch IBM TSS2 test suite for OpenSSL 3.x
  * build-sys:
    + Add probing for -fstack-protector</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104001">- Drop trousers requirement</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1679400000">- swtpm-fix-build.patch: disable -Wstack-protector, it fails on s390x
  bsc#1209117</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1683028800">- remove python3 dependency, no longer needed after rewrite (bsc#1211010)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1686916800">- Make selinux optional to allow building this package for Leap, too.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1694865600">- Update to version 0.8.1:
  - swtpm:
  - Restore logging to stderr on log open failure
  - swtpm_setup:
  - Exit with '0' upon --version rather than '1'.
  - Initialized @argv in get_swtpm_capabilities()
  - swtpm_localca:
  - Add missing NULL option to end of array
  - SELinux:
  - Add rules for user_tpm_t:sockfile to allow unlink
  - Add rules for sock_file on user_tmp_t</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1697716800">- Add missing requires for certtool</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1722513600">- update to 0.9.0:
  - fixes: boo#1226398
  - swtpm:
  - Use umask() to create/truncated state file rather than fchmod()
  - Use fchmod to set mode bits provided by user
  - Replace mkstemp with g_mkstemp_full (Coverity)
  - fix typo in help message
  - cuse: Fix Coverity complaints regarding locks
  - Fix double free in error path
  - Close fd after main loop
  - Restore logging to stderr on log open failure
  - swtpm_setup:
  - Fail --pcr-banks without --tpm2
  - Fail --decryption or --allow-signing without --tpm2
  - Initialized argv in get_swtpm_capabilities()
  - Flush spk after persisting to create room for another key
  - Refactor duplicate code into swtpm_tpm2_write_cert_nvram
  - Move persisting of certificate into tpm2_persist_certificate
  - Pass key_type to function creating filename for key
  - Add scheme parameter before curveid to createprimary_ecc
  - Rename is_ek to preserve for future extension
  - Mask-out EK and plaform certificate flags and set cert_flags
  - Move common code into new function read_certificate_file()
  - Exit with '0' upon --version rather than '1'
  - Close file descriptors passed to swtpm process on parent side
  - Make stdout unbuffered
  - Use medium duration on TSC_PhysicalPresence to avoid timeouts
  - Add poll() after write() and before read() to detect errors
  - swtpm_localca:
  - Add support for up to 20 bytes serial numbers
  - Introduce --key as more generic alias for --ek
  - Add missing NULL option to end of array
  - Make stdout unbuffered
  - swtpm_cert:
  - Add support for serial numbers up to 20 bytes long
  - swtpm_ioctl:
  - Separate return code from flags
  - Repeatedly call PTM_GET_INFO for long responses
  - selinux:
  - Re-add rule for svirt_tcg_t and user_tmp_t:sock_file (virt-install)
  - New SELinux policy that requires Fedora 40 or later
  - tests:
  - Fixed occurrences of stray '' before '-'
  - Rearrange order of test cases to run some also as 'root'
  - Add tests for command line options and combinations of options
  - Add softhsm_setup to shellcheck'ed files and fix issues
  - Add missing 'exit 1' on unexpected file size on --reconfigure
  - Add test cases for swtpm_cert with max serial number
  - Fix spelling mistakes
  - reformat regexs for easier readability and extension
  - ibmtss2: Add patch to disable x509 test with older libtpms
  - Upgrade to ibmtss2 v2.0.1
  - Fixed several issues detected by shellcheck
  - build-sys:
  - Add support for --disable-tests to disable tests
  - Display GMP_LIBS and GMP_CFLAGS
  - Only display warning if pkg-config for gmp fails
  - Add gmp library and devel package as dependency
  - use PKG_CHECK_MODULES to check libtpms version</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1726747200">- Fix swtpm custom module (bsc#1229131)
  - Add patch: 1229131-fix-swtpm-selinux-policy-mismatch.patch
  - this can be removed once swtpm upstream sorts out their custom selinux module.
    see: https://github.com/stefanberger/swtpm/issues/885
    there were a couple changes in the selinux-policy libvirt handling
    which causes the logfile in /var/log/swtpm/libvirt/qemu/*.log to be labeled
    virt_log_t instead of var_log_t. this patch allows swtpm_t to open the virt_log_t</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1733313600">- Update to 0.10.0:
  + swtpm:
  * Requires libtpms v0.10.0
  * Display tpmstate-opt-lock as a new capability
  * Add support for lock option parameter to tpmstate option
  * nvstore_linear: Add support for file-backend locking
  * Remove broken logic to check for neither dir nor file backend
  * Use ptm_cap_n to build PTM_GET_CAPABILITY response
  * Define a structure to return PTM_GET_CAPABILITY result
  * Implement --print-info to run TPMLIB_GetInfo with flags
  * Support --profile fd= to read profile from file descriptor
  * Support --profile file= to read profile from file
  * Ignore remove-disabled parameter on non-'custom' profile
  * Check for good entropy source in chroot environment
  * Implement a check for HMAC+sha1 for testing future restriction
  * Implement function to check whether a crypto algorithm is
    disabled
  * Print cmdarg-print-profiles as part of capabilities
  * Check whether SHA1 signature support is disabled in profile
  * Use TPMLIB_WasManufactured to check whether profile was applied
  * Determine whether OpenSSL needs to be configured (FIPs, SHA1
    signature)
  * Add support for --print-profiles option
  * Print profile names as part of capabilities JSON
  * Display new capability to allow setting a profile
  * Add support for --profile option to set a profile on TPM 2
  + swtpm_setup:
  * Comment flags for storage primary key and deprecate --create-spk
  * Implement --print-profiles to display all profile
  * Add profile entries to swtpm_setup.conf written by swtpm_setup
  * Add support for --profile-name option
  * Accept profiles with name starting with 'custom:'
  * Support default profile from file in swtpm_setup.conf
  * Support --profile-file-fd to read profile from file descriptor
  * Support --profile-file to read profile from file
  * Always log the active profile
  * Implement --profile-remove-fips-disabled option
  * Read default profile from swtpm_setup.conf
  * Print profile names as part of capabilities JSON
  * Add support for --profile parameter
  * Get default rsa keysize from setup_setup.conf if not given
  + swtpm_ioctl:
  * Use ptm_cap_n for non-CUSE PTM_GET_CAPABILITY response
  + selinux:
  * Change write to append for appending to log
  * Add rule for logging to svirt_image_t labeled files from swtpm_t
  + tests:
  * Update IBMTSS2 test suite to v2.4.0
  * Test activation of PCR banks when not all are available
  * Enable SWTPM_TEST_PROFILE for running test_tpm2_ibmtss2 with
    profile
  * Add a check for OPENSSL_ENABLE_SHA1_SIGNATURES in log file
  * Consolidate custom profile test cases and check for
    StateFormatLevel
  * Convert test_samples_create_tpmca to run installed
  * Mention test_tpm2_libtpms_versions_profiles requiring
    env. variables
  * allow running ibmtss2 tests against installed version
  * Derive support for CUSE from SWTPM_EXE help screen
  * Set OPENSSL_ENABLE_SHA1_SIGNATURES=1 for IBMTSS2 test
  * Extend test case testing across libtpms versions
  * Add test case for testing profiles across libtpms versions
  * Test the --profile option of swtpm_setup and swtpm
  * teach them to run installed
  * add installed-runner.sh
  * install tests on the system
  * lookup system binaries if INSTALLED is set
  + build-sys:
  * enable 64-bit file API on 32-bit systems
  * Add -Wshadow to the CFLAGS
  * Require that libtpms v0.10 is available for TPMLIB_SetProfile</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1733572800">- Fix build without %check (boo#1227364)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1750075200">- Update to version 0.10.1:
  + swtpm: Fix build error on 32bit systems due to inconsistent
    _FILE_OFFSET_BITS.
  + swtpm_setup:
  - Use DISTRO_PROFILES_DIR when listing profiles (fix path
    issue).
  - Do not pass a TPM 2 profile to swtpm when reconfiguring.
  + selinux:
  - Add rule for swtpm to be able to read password from pipe.
  - allow to map state file.
  - add NFS permissions for swtpm_t.
  - Add rule to allow swtpm_t opening of virt_log_t files.
- Drop 1229131-fix-swtpm-selinux-policy-mismatch.patch: fixed
  upstream.
- Add 1027.patch: tests: Retry NVWrite command after 0x922 return
  code and inc lockout counter.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1761912000">- Also load swtpm_libvirt in the selinux subpackage (bsc#1251789)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1784116800">- Drop tunable in require to avoid policy loading issues
  with toolchain 3.11 (bsc#1271417).
  Can be dropped, once this is accepted upstream:
  https://github.com/stefanberger/swtpm/pull/1139
  - Add patch: 1271417-drop-tunable-requires.patch</changelog>
  <changelog author="Jehu Marcos Herrera Puentes &lt;jehuherrerap@hotmail.com&gt;" date="1785412800">- Fix SELinux policy for virtqemud_t swtpm_t setsched
  process and unix socket interactions. Allows virtqemud_t to: Signal and
  control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched),
  create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339).
  Already accepted on upstream:
  https://github.com/stefanberger/swtpm/pull/1132
- Add patch: 1132.patch</changelog>
</package>
<package pkgid="83518b067effdd9a19fb7b7c4399c368a595fae35d7e61331cc5876886309a8684a0362cd7523b26cf5ca663589286efa2722e3c03183794082905a8c357945c" name="swtpm-debuginfo" arch="s390x">
  <version epoch="0" ver="0.10.1" rel="62.2"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104000">- Update to version 0.8.0:
  * swtpm:
    + Implement release-lock-outgoing parameter for --migration option
    + Introduce --migration option and 'incoming' parameter
    + Implement terminate parameter for ctrl channel loss
    + Add a chroot option
    + Introduce disable-auto-shutdown flag for --flags option
    + If necessary send TPM2_Shutdown() before TPMLIB_Terminate()
    + Add some more recent syscalls to seccomp profile
    + Disable OpenSSL FIPS mode to avoid libtpms failures
    + Avoid locking directory multiple times
    + Remove support for pre-v0.1 state files without header
    + Use uint64_t in tlv_data_append() to avoid integer overflows
    + Use uint64_t to avoid integer wrap-around when adding a uint32_t
    + Do not chdir(/) when using --daemon
    + Check header size indicator against expected size (CVE-2022-23645 bsc#1196240)
    + Fixes for gcc 12.2.1 -fanalyzer
  * build-sys:
    + Fix configure script to support _FORTIFY_SOURCE=3
    + Define __USE_LINUX_IOCTL_DEFS in header file (Cygwin)
  * swtpm-localca:
    + Re-implement variable resolution for swtpm-localca.conf
    + Test for available issuercert before creating CA
  * swtpm_setup:
    + Configure swtpm to log to stdout/err if needed (glib &gt;=2.74)
  * tests:
    + Use ${WORKDIR} in config files to test env. var replacement
    + Patch IBM TSS2 test suite for OpenSSL 3.x
  * build-sys:
    + Add probing for -fstack-protector</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104001">- Drop trousers requirement</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1679400000">- swtpm-fix-build.patch: disable -Wstack-protector, it fails on s390x
  bsc#1209117</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1683028800">- remove python3 dependency, no longer needed after rewrite (bsc#1211010)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1686916800">- Make selinux optional to allow building this package for Leap, too.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1694865600">- Update to version 0.8.1:
  - swtpm:
  - Restore logging to stderr on log open failure
  - swtpm_setup:
  - Exit with '0' upon --version rather than '1'.
  - Initialized @argv in get_swtpm_capabilities()
  - swtpm_localca:
  - Add missing NULL option to end of array
  - SELinux:
  - Add rules for user_tpm_t:sockfile to allow unlink
  - Add rules for sock_file on user_tmp_t</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1697716800">- Add missing requires for certtool</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1722513600">- update to 0.9.0:
  - fixes: boo#1226398
  - swtpm:
  - Use umask() to create/truncated state file rather than fchmod()
  - Use fchmod to set mode bits provided by user
  - Replace mkstemp with g_mkstemp_full (Coverity)
  - fix typo in help message
  - cuse: Fix Coverity complaints regarding locks
  - Fix double free in error path
  - Close fd after main loop
  - Restore logging to stderr on log open failure
  - swtpm_setup:
  - Fail --pcr-banks without --tpm2
  - Fail --decryption or --allow-signing without --tpm2
  - Initialized argv in get_swtpm_capabilities()
  - Flush spk after persisting to create room for another key
  - Refactor duplicate code into swtpm_tpm2_write_cert_nvram
  - Move persisting of certificate into tpm2_persist_certificate
  - Pass key_type to function creating filename for key
  - Add scheme parameter before curveid to createprimary_ecc
  - Rename is_ek to preserve for future extension
  - Mask-out EK and plaform certificate flags and set cert_flags
  - Move common code into new function read_certificate_file()
  - Exit with '0' upon --version rather than '1'
  - Close file descriptors passed to swtpm process on parent side
  - Make stdout unbuffered
  - Use medium duration on TSC_PhysicalPresence to avoid timeouts
  - Add poll() after write() and before read() to detect errors
  - swtpm_localca:
  - Add support for up to 20 bytes serial numbers
  - Introduce --key as more generic alias for --ek
  - Add missing NULL option to end of array
  - Make stdout unbuffered
  - swtpm_cert:
  - Add support for serial numbers up to 20 bytes long
  - swtpm_ioctl:
  - Separate return code from flags
  - Repeatedly call PTM_GET_INFO for long responses
  - selinux:
  - Re-add rule for svirt_tcg_t and user_tmp_t:sock_file (virt-install)
  - New SELinux policy that requires Fedora 40 or later
  - tests:
  - Fixed occurrences of stray '' before '-'
  - Rearrange order of test cases to run some also as 'root'
  - Add tests for command line options and combinations of options
  - Add softhsm_setup to shellcheck'ed files and fix issues
  - Add missing 'exit 1' on unexpected file size on --reconfigure
  - Add test cases for swtpm_cert with max serial number
  - Fix spelling mistakes
  - reformat regexs for easier readability and extension
  - ibmtss2: Add patch to disable x509 test with older libtpms
  - Upgrade to ibmtss2 v2.0.1
  - Fixed several issues detected by shellcheck
  - build-sys:
  - Add support for --disable-tests to disable tests
  - Display GMP_LIBS and GMP_CFLAGS
  - Only display warning if pkg-config for gmp fails
  - Add gmp library and devel package as dependency
  - use PKG_CHECK_MODULES to check libtpms version</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1726747200">- Fix swtpm custom module (bsc#1229131)
  - Add patch: 1229131-fix-swtpm-selinux-policy-mismatch.patch
  - this can be removed once swtpm upstream sorts out their custom selinux module.
    see: https://github.com/stefanberger/swtpm/issues/885
    there were a couple changes in the selinux-policy libvirt handling
    which causes the logfile in /var/log/swtpm/libvirt/qemu/*.log to be labeled
    virt_log_t instead of var_log_t. this patch allows swtpm_t to open the virt_log_t</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1733313600">- Update to 0.10.0:
  + swtpm:
  * Requires libtpms v0.10.0
  * Display tpmstate-opt-lock as a new capability
  * Add support for lock option parameter to tpmstate option
  * nvstore_linear: Add support for file-backend locking
  * Remove broken logic to check for neither dir nor file backend
  * Use ptm_cap_n to build PTM_GET_CAPABILITY response
  * Define a structure to return PTM_GET_CAPABILITY result
  * Implement --print-info to run TPMLIB_GetInfo with flags
  * Support --profile fd= to read profile from file descriptor
  * Support --profile file= to read profile from file
  * Ignore remove-disabled parameter on non-'custom' profile
  * Check for good entropy source in chroot environment
  * Implement a check for HMAC+sha1 for testing future restriction
  * Implement function to check whether a crypto algorithm is
    disabled
  * Print cmdarg-print-profiles as part of capabilities
  * Check whether SHA1 signature support is disabled in profile
  * Use TPMLIB_WasManufactured to check whether profile was applied
  * Determine whether OpenSSL needs to be configured (FIPs, SHA1
    signature)
  * Add support for --print-profiles option
  * Print profile names as part of capabilities JSON
  * Display new capability to allow setting a profile
  * Add support for --profile option to set a profile on TPM 2
  + swtpm_setup:
  * Comment flags for storage primary key and deprecate --create-spk
  * Implement --print-profiles to display all profile
  * Add profile entries to swtpm_setup.conf written by swtpm_setup
  * Add support for --profile-name option
  * Accept profiles with name starting with 'custom:'
  * Support default profile from file in swtpm_setup.conf
  * Support --profile-file-fd to read profile from file descriptor
  * Support --profile-file to read profile from file
  * Always log the active profile
  * Implement --profile-remove-fips-disabled option
  * Read default profile from swtpm_setup.conf
  * Print profile names as part of capabilities JSON
  * Add support for --profile parameter
  * Get default rsa keysize from setup_setup.conf if not given
  + swtpm_ioctl:
  * Use ptm_cap_n for non-CUSE PTM_GET_CAPABILITY response
  + selinux:
  * Change write to append for appending to log
  * Add rule for logging to svirt_image_t labeled files from swtpm_t
  + tests:
  * Update IBMTSS2 test suite to v2.4.0
  * Test activation of PCR banks when not all are available
  * Enable SWTPM_TEST_PROFILE for running test_tpm2_ibmtss2 with
    profile
  * Add a check for OPENSSL_ENABLE_SHA1_SIGNATURES in log file
  * Consolidate custom profile test cases and check for
    StateFormatLevel
  * Convert test_samples_create_tpmca to run installed
  * Mention test_tpm2_libtpms_versions_profiles requiring
    env. variables
  * allow running ibmtss2 tests against installed version
  * Derive support for CUSE from SWTPM_EXE help screen
  * Set OPENSSL_ENABLE_SHA1_SIGNATURES=1 for IBMTSS2 test
  * Extend test case testing across libtpms versions
  * Add test case for testing profiles across libtpms versions
  * Test the --profile option of swtpm_setup and swtpm
  * teach them to run installed
  * add installed-runner.sh
  * install tests on the system
  * lookup system binaries if INSTALLED is set
  + build-sys:
  * enable 64-bit file API on 32-bit systems
  * Add -Wshadow to the CFLAGS
  * Require that libtpms v0.10 is available for TPMLIB_SetProfile</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1733572800">- Fix build without %check (boo#1227364)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1750075200">- Update to version 0.10.1:
  + swtpm: Fix build error on 32bit systems due to inconsistent
    _FILE_OFFSET_BITS.
  + swtpm_setup:
  - Use DISTRO_PROFILES_DIR when listing profiles (fix path
    issue).
  - Do not pass a TPM 2 profile to swtpm when reconfiguring.
  + selinux:
  - Add rule for swtpm to be able to read password from pipe.
  - allow to map state file.
  - add NFS permissions for swtpm_t.
  - Add rule to allow swtpm_t opening of virt_log_t files.
- Drop 1229131-fix-swtpm-selinux-policy-mismatch.patch: fixed
  upstream.
- Add 1027.patch: tests: Retry NVWrite command after 0x922 return
  code and inc lockout counter.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1761912000">- Also load swtpm_libvirt in the selinux subpackage (bsc#1251789)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1784116800">- Drop tunable in require to avoid policy loading issues
  with toolchain 3.11 (bsc#1271417).
  Can be dropped, once this is accepted upstream:
  https://github.com/stefanberger/swtpm/pull/1139
  - Add patch: 1271417-drop-tunable-requires.patch</changelog>
  <changelog author="Jehu Marcos Herrera Puentes &lt;jehuherrerap@hotmail.com&gt;" date="1785412800">- Fix SELinux policy for virtqemud_t swtpm_t setsched
  process and unix socket interactions. Allows virtqemud_t to: Signal and
  control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched),
  create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339).
  Already accepted on upstream:
  https://github.com/stefanberger/swtpm/pull/1132
- Add patch: 1132.patch</changelog>
</package>
<package pkgid="e666a456f6440ac313e024cfd021ec228e26bfda8a70845b24a0eb788b11b10990c16e9e8120962f52ecbcf656ac9620293411d8abde6d6c27458d5d514a93fb" name="swtpm-debugsource" arch="s390x">
  <version epoch="0" ver="0.10.1" rel="62.2"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104000">- Update to version 0.8.0:
  * swtpm:
    + Implement release-lock-outgoing parameter for --migration option
    + Introduce --migration option and 'incoming' parameter
    + Implement terminate parameter for ctrl channel loss
    + Add a chroot option
    + Introduce disable-auto-shutdown flag for --flags option
    + If necessary send TPM2_Shutdown() before TPMLIB_Terminate()
    + Add some more recent syscalls to seccomp profile
    + Disable OpenSSL FIPS mode to avoid libtpms failures
    + Avoid locking directory multiple times
    + Remove support for pre-v0.1 state files without header
    + Use uint64_t in tlv_data_append() to avoid integer overflows
    + Use uint64_t to avoid integer wrap-around when adding a uint32_t
    + Do not chdir(/) when using --daemon
    + Check header size indicator against expected size (CVE-2022-23645 bsc#1196240)
    + Fixes for gcc 12.2.1 -fanalyzer
  * build-sys:
    + Fix configure script to support _FORTIFY_SOURCE=3
    + Define __USE_LINUX_IOCTL_DEFS in header file (Cygwin)
  * swtpm-localca:
    + Re-implement variable resolution for swtpm-localca.conf
    + Test for available issuercert before creating CA
  * swtpm_setup:
    + Configure swtpm to log to stdout/err if needed (glib &gt;=2.74)
  * tests:
    + Use ${WORKDIR} in config files to test env. var replacement
    + Patch IBM TSS2 test suite for OpenSSL 3.x
  * build-sys:
    + Add probing for -fstack-protector</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104001">- Drop trousers requirement</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1679400000">- swtpm-fix-build.patch: disable -Wstack-protector, it fails on s390x
  bsc#1209117</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1683028800">- remove python3 dependency, no longer needed after rewrite (bsc#1211010)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1686916800">- Make selinux optional to allow building this package for Leap, too.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1694865600">- Update to version 0.8.1:
  - swtpm:
  - Restore logging to stderr on log open failure
  - swtpm_setup:
  - Exit with '0' upon --version rather than '1'.
  - Initialized @argv in get_swtpm_capabilities()
  - swtpm_localca:
  - Add missing NULL option to end of array
  - SELinux:
  - Add rules for user_tpm_t:sockfile to allow unlink
  - Add rules for sock_file on user_tmp_t</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1697716800">- Add missing requires for certtool</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1722513600">- update to 0.9.0:
  - fixes: boo#1226398
  - swtpm:
  - Use umask() to create/truncated state file rather than fchmod()
  - Use fchmod to set mode bits provided by user
  - Replace mkstemp with g_mkstemp_full (Coverity)
  - fix typo in help message
  - cuse: Fix Coverity complaints regarding locks
  - Fix double free in error path
  - Close fd after main loop
  - Restore logging to stderr on log open failure
  - swtpm_setup:
  - Fail --pcr-banks without --tpm2
  - Fail --decryption or --allow-signing without --tpm2
  - Initialized argv in get_swtpm_capabilities()
  - Flush spk after persisting to create room for another key
  - Refactor duplicate code into swtpm_tpm2_write_cert_nvram
  - Move persisting of certificate into tpm2_persist_certificate
  - Pass key_type to function creating filename for key
  - Add scheme parameter before curveid to createprimary_ecc
  - Rename is_ek to preserve for future extension
  - Mask-out EK and plaform certificate flags and set cert_flags
  - Move common code into new function read_certificate_file()
  - Exit with '0' upon --version rather than '1'
  - Close file descriptors passed to swtpm process on parent side
  - Make stdout unbuffered
  - Use medium duration on TSC_PhysicalPresence to avoid timeouts
  - Add poll() after write() and before read() to detect errors
  - swtpm_localca:
  - Add support for up to 20 bytes serial numbers
  - Introduce --key as more generic alias for --ek
  - Add missing NULL option to end of array
  - Make stdout unbuffered
  - swtpm_cert:
  - Add support for serial numbers up to 20 bytes long
  - swtpm_ioctl:
  - Separate return code from flags
  - Repeatedly call PTM_GET_INFO for long responses
  - selinux:
  - Re-add rule for svirt_tcg_t and user_tmp_t:sock_file (virt-install)
  - New SELinux policy that requires Fedora 40 or later
  - tests:
  - Fixed occurrences of stray '' before '-'
  - Rearrange order of test cases to run some also as 'root'
  - Add tests for command line options and combinations of options
  - Add softhsm_setup to shellcheck'ed files and fix issues
  - Add missing 'exit 1' on unexpected file size on --reconfigure
  - Add test cases for swtpm_cert with max serial number
  - Fix spelling mistakes
  - reformat regexs for easier readability and extension
  - ibmtss2: Add patch to disable x509 test with older libtpms
  - Upgrade to ibmtss2 v2.0.1
  - Fixed several issues detected by shellcheck
  - build-sys:
  - Add support for --disable-tests to disable tests
  - Display GMP_LIBS and GMP_CFLAGS
  - Only display warning if pkg-config for gmp fails
  - Add gmp library and devel package as dependency
  - use PKG_CHECK_MODULES to check libtpms version</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1726747200">- Fix swtpm custom module (bsc#1229131)
  - Add patch: 1229131-fix-swtpm-selinux-policy-mismatch.patch
  - this can be removed once swtpm upstream sorts out their custom selinux module.
    see: https://github.com/stefanberger/swtpm/issues/885
    there were a couple changes in the selinux-policy libvirt handling
    which causes the logfile in /var/log/swtpm/libvirt/qemu/*.log to be labeled
    virt_log_t instead of var_log_t. this patch allows swtpm_t to open the virt_log_t</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1733313600">- Update to 0.10.0:
  + swtpm:
  * Requires libtpms v0.10.0
  * Display tpmstate-opt-lock as a new capability
  * Add support for lock option parameter to tpmstate option
  * nvstore_linear: Add support for file-backend locking
  * Remove broken logic to check for neither dir nor file backend
  * Use ptm_cap_n to build PTM_GET_CAPABILITY response
  * Define a structure to return PTM_GET_CAPABILITY result
  * Implement --print-info to run TPMLIB_GetInfo with flags
  * Support --profile fd= to read profile from file descriptor
  * Support --profile file= to read profile from file
  * Ignore remove-disabled parameter on non-'custom' profile
  * Check for good entropy source in chroot environment
  * Implement a check for HMAC+sha1 for testing future restriction
  * Implement function to check whether a crypto algorithm is
    disabled
  * Print cmdarg-print-profiles as part of capabilities
  * Check whether SHA1 signature support is disabled in profile
  * Use TPMLIB_WasManufactured to check whether profile was applied
  * Determine whether OpenSSL needs to be configured (FIPs, SHA1
    signature)
  * Add support for --print-profiles option
  * Print profile names as part of capabilities JSON
  * Display new capability to allow setting a profile
  * Add support for --profile option to set a profile on TPM 2
  + swtpm_setup:
  * Comment flags for storage primary key and deprecate --create-spk
  * Implement --print-profiles to display all profile
  * Add profile entries to swtpm_setup.conf written by swtpm_setup
  * Add support for --profile-name option
  * Accept profiles with name starting with 'custom:'
  * Support default profile from file in swtpm_setup.conf
  * Support --profile-file-fd to read profile from file descriptor
  * Support --profile-file to read profile from file
  * Always log the active profile
  * Implement --profile-remove-fips-disabled option
  * Read default profile from swtpm_setup.conf
  * Print profile names as part of capabilities JSON
  * Add support for --profile parameter
  * Get default rsa keysize from setup_setup.conf if not given
  + swtpm_ioctl:
  * Use ptm_cap_n for non-CUSE PTM_GET_CAPABILITY response
  + selinux:
  * Change write to append for appending to log
  * Add rule for logging to svirt_image_t labeled files from swtpm_t
  + tests:
  * Update IBMTSS2 test suite to v2.4.0
  * Test activation of PCR banks when not all are available
  * Enable SWTPM_TEST_PROFILE for running test_tpm2_ibmtss2 with
    profile
  * Add a check for OPENSSL_ENABLE_SHA1_SIGNATURES in log file
  * Consolidate custom profile test cases and check for
    StateFormatLevel
  * Convert test_samples_create_tpmca to run installed
  * Mention test_tpm2_libtpms_versions_profiles requiring
    env. variables
  * allow running ibmtss2 tests against installed version
  * Derive support for CUSE from SWTPM_EXE help screen
  * Set OPENSSL_ENABLE_SHA1_SIGNATURES=1 for IBMTSS2 test
  * Extend test case testing across libtpms versions
  * Add test case for testing profiles across libtpms versions
  * Test the --profile option of swtpm_setup and swtpm
  * teach them to run installed
  * add installed-runner.sh
  * install tests on the system
  * lookup system binaries if INSTALLED is set
  + build-sys:
  * enable 64-bit file API on 32-bit systems
  * Add -Wshadow to the CFLAGS
  * Require that libtpms v0.10 is available for TPMLIB_SetProfile</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1733572800">- Fix build without %check (boo#1227364)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1750075200">- Update to version 0.10.1:
  + swtpm: Fix build error on 32bit systems due to inconsistent
    _FILE_OFFSET_BITS.
  + swtpm_setup:
  - Use DISTRO_PROFILES_DIR when listing profiles (fix path
    issue).
  - Do not pass a TPM 2 profile to swtpm when reconfiguring.
  + selinux:
  - Add rule for swtpm to be able to read password from pipe.
  - allow to map state file.
  - add NFS permissions for swtpm_t.
  - Add rule to allow swtpm_t opening of virt_log_t files.
- Drop 1229131-fix-swtpm-selinux-policy-mismatch.patch: fixed
  upstream.
- Add 1027.patch: tests: Retry NVWrite command after 0x922 return
  code and inc lockout counter.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1761912000">- Also load swtpm_libvirt in the selinux subpackage (bsc#1251789)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1784116800">- Drop tunable in require to avoid policy loading issues
  with toolchain 3.11 (bsc#1271417).
  Can be dropped, once this is accepted upstream:
  https://github.com/stefanberger/swtpm/pull/1139
  - Add patch: 1271417-drop-tunable-requires.patch</changelog>
  <changelog author="Jehu Marcos Herrera Puentes &lt;jehuherrerap@hotmail.com&gt;" date="1785412800">- Fix SELinux policy for virtqemud_t swtpm_t setsched
  process and unix socket interactions. Allows virtqemud_t to: Signal and
  control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched),
  create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339).
  Already accepted on upstream:
  https://github.com/stefanberger/swtpm/pull/1132
- Add patch: 1132.patch</changelog>
</package>
<package pkgid="a19c37ec50b2429cf38dec8c39ebaf632d0771da88832cecdd23ffee79ce8fc8aca6cdff821fc219ea6139160b24b208be23f6309027e1a99d541b90d6060601" name="swtpm-devel" arch="s390x">
  <version epoch="0" ver="0.10.1" rel="62.2"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104000">- Update to version 0.8.0:
  * swtpm:
    + Implement release-lock-outgoing parameter for --migration option
    + Introduce --migration option and 'incoming' parameter
    + Implement terminate parameter for ctrl channel loss
    + Add a chroot option
    + Introduce disable-auto-shutdown flag for --flags option
    + If necessary send TPM2_Shutdown() before TPMLIB_Terminate()
    + Add some more recent syscalls to seccomp profile
    + Disable OpenSSL FIPS mode to avoid libtpms failures
    + Avoid locking directory multiple times
    + Remove support for pre-v0.1 state files without header
    + Use uint64_t in tlv_data_append() to avoid integer overflows
    + Use uint64_t to avoid integer wrap-around when adding a uint32_t
    + Do not chdir(/) when using --daemon
    + Check header size indicator against expected size (CVE-2022-23645 bsc#1196240)
    + Fixes for gcc 12.2.1 -fanalyzer
  * build-sys:
    + Fix configure script to support _FORTIFY_SOURCE=3
    + Define __USE_LINUX_IOCTL_DEFS in header file (Cygwin)
  * swtpm-localca:
    + Re-implement variable resolution for swtpm-localca.conf
    + Test for available issuercert before creating CA
  * swtpm_setup:
    + Configure swtpm to log to stdout/err if needed (glib &gt;=2.74)
  * tests:
    + Use ${WORKDIR} in config files to test env. var replacement
    + Patch IBM TSS2 test suite for OpenSSL 3.x
  * build-sys:
    + Add probing for -fstack-protector</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104001">- Drop trousers requirement</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1679400000">- swtpm-fix-build.patch: disable -Wstack-protector, it fails on s390x
  bsc#1209117</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1683028800">- remove python3 dependency, no longer needed after rewrite (bsc#1211010)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1686916800">- Make selinux optional to allow building this package for Leap, too.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1694865600">- Update to version 0.8.1:
  - swtpm:
  - Restore logging to stderr on log open failure
  - swtpm_setup:
  - Exit with '0' upon --version rather than '1'.
  - Initialized @argv in get_swtpm_capabilities()
  - swtpm_localca:
  - Add missing NULL option to end of array
  - SELinux:
  - Add rules for user_tpm_t:sockfile to allow unlink
  - Add rules for sock_file on user_tmp_t</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1697716800">- Add missing requires for certtool</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1722513600">- update to 0.9.0:
  - fixes: boo#1226398
  - swtpm:
  - Use umask() to create/truncated state file rather than fchmod()
  - Use fchmod to set mode bits provided by user
  - Replace mkstemp with g_mkstemp_full (Coverity)
  - fix typo in help message
  - cuse: Fix Coverity complaints regarding locks
  - Fix double free in error path
  - Close fd after main loop
  - Restore logging to stderr on log open failure
  - swtpm_setup:
  - Fail --pcr-banks without --tpm2
  - Fail --decryption or --allow-signing without --tpm2
  - Initialized argv in get_swtpm_capabilities()
  - Flush spk after persisting to create room for another key
  - Refactor duplicate code into swtpm_tpm2_write_cert_nvram
  - Move persisting of certificate into tpm2_persist_certificate
  - Pass key_type to function creating filename for key
  - Add scheme parameter before curveid to createprimary_ecc
  - Rename is_ek to preserve for future extension
  - Mask-out EK and plaform certificate flags and set cert_flags
  - Move common code into new function read_certificate_file()
  - Exit with '0' upon --version rather than '1'
  - Close file descriptors passed to swtpm process on parent side
  - Make stdout unbuffered
  - Use medium duration on TSC_PhysicalPresence to avoid timeouts
  - Add poll() after write() and before read() to detect errors
  - swtpm_localca:
  - Add support for up to 20 bytes serial numbers
  - Introduce --key as more generic alias for --ek
  - Add missing NULL option to end of array
  - Make stdout unbuffered
  - swtpm_cert:
  - Add support for serial numbers up to 20 bytes long
  - swtpm_ioctl:
  - Separate return code from flags
  - Repeatedly call PTM_GET_INFO for long responses
  - selinux:
  - Re-add rule for svirt_tcg_t and user_tmp_t:sock_file (virt-install)
  - New SELinux policy that requires Fedora 40 or later
  - tests:
  - Fixed occurrences of stray '' before '-'
  - Rearrange order of test cases to run some also as 'root'
  - Add tests for command line options and combinations of options
  - Add softhsm_setup to shellcheck'ed files and fix issues
  - Add missing 'exit 1' on unexpected file size on --reconfigure
  - Add test cases for swtpm_cert with max serial number
  - Fix spelling mistakes
  - reformat regexs for easier readability and extension
  - ibmtss2: Add patch to disable x509 test with older libtpms
  - Upgrade to ibmtss2 v2.0.1
  - Fixed several issues detected by shellcheck
  - build-sys:
  - Add support for --disable-tests to disable tests
  - Display GMP_LIBS and GMP_CFLAGS
  - Only display warning if pkg-config for gmp fails
  - Add gmp library and devel package as dependency
  - use PKG_CHECK_MODULES to check libtpms version</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1726747200">- Fix swtpm custom module (bsc#1229131)
  - Add patch: 1229131-fix-swtpm-selinux-policy-mismatch.patch
  - this can be removed once swtpm upstream sorts out their custom selinux module.
    see: https://github.com/stefanberger/swtpm/issues/885
    there were a couple changes in the selinux-policy libvirt handling
    which causes the logfile in /var/log/swtpm/libvirt/qemu/*.log to be labeled
    virt_log_t instead of var_log_t. this patch allows swtpm_t to open the virt_log_t</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1733313600">- Update to 0.10.0:
  + swtpm:
  * Requires libtpms v0.10.0
  * Display tpmstate-opt-lock as a new capability
  * Add support for lock option parameter to tpmstate option
  * nvstore_linear: Add support for file-backend locking
  * Remove broken logic to check for neither dir nor file backend
  * Use ptm_cap_n to build PTM_GET_CAPABILITY response
  * Define a structure to return PTM_GET_CAPABILITY result
  * Implement --print-info to run TPMLIB_GetInfo with flags
  * Support --profile fd= to read profile from file descriptor
  * Support --profile file= to read profile from file
  * Ignore remove-disabled parameter on non-'custom' profile
  * Check for good entropy source in chroot environment
  * Implement a check for HMAC+sha1 for testing future restriction
  * Implement function to check whether a crypto algorithm is
    disabled
  * Print cmdarg-print-profiles as part of capabilities
  * Check whether SHA1 signature support is disabled in profile
  * Use TPMLIB_WasManufactured to check whether profile was applied
  * Determine whether OpenSSL needs to be configured (FIPs, SHA1
    signature)
  * Add support for --print-profiles option
  * Print profile names as part of capabilities JSON
  * Display new capability to allow setting a profile
  * Add support for --profile option to set a profile on TPM 2
  + swtpm_setup:
  * Comment flags for storage primary key and deprecate --create-spk
  * Implement --print-profiles to display all profile
  * Add profile entries to swtpm_setup.conf written by swtpm_setup
  * Add support for --profile-name option
  * Accept profiles with name starting with 'custom:'
  * Support default profile from file in swtpm_setup.conf
  * Support --profile-file-fd to read profile from file descriptor
  * Support --profile-file to read profile from file
  * Always log the active profile
  * Implement --profile-remove-fips-disabled option
  * Read default profile from swtpm_setup.conf
  * Print profile names as part of capabilities JSON
  * Add support for --profile parameter
  * Get default rsa keysize from setup_setup.conf if not given
  + swtpm_ioctl:
  * Use ptm_cap_n for non-CUSE PTM_GET_CAPABILITY response
  + selinux:
  * Change write to append for appending to log
  * Add rule for logging to svirt_image_t labeled files from swtpm_t
  + tests:
  * Update IBMTSS2 test suite to v2.4.0
  * Test activation of PCR banks when not all are available
  * Enable SWTPM_TEST_PROFILE for running test_tpm2_ibmtss2 with
    profile
  * Add a check for OPENSSL_ENABLE_SHA1_SIGNATURES in log file
  * Consolidate custom profile test cases and check for
    StateFormatLevel
  * Convert test_samples_create_tpmca to run installed
  * Mention test_tpm2_libtpms_versions_profiles requiring
    env. variables
  * allow running ibmtss2 tests against installed version
  * Derive support for CUSE from SWTPM_EXE help screen
  * Set OPENSSL_ENABLE_SHA1_SIGNATURES=1 for IBMTSS2 test
  * Extend test case testing across libtpms versions
  * Add test case for testing profiles across libtpms versions
  * Test the --profile option of swtpm_setup and swtpm
  * teach them to run installed
  * add installed-runner.sh
  * install tests on the system
  * lookup system binaries if INSTALLED is set
  + build-sys:
  * enable 64-bit file API on 32-bit systems
  * Add -Wshadow to the CFLAGS
  * Require that libtpms v0.10 is available for TPMLIB_SetProfile</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1733572800">- Fix build without %check (boo#1227364)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1750075200">- Update to version 0.10.1:
  + swtpm: Fix build error on 32bit systems due to inconsistent
    _FILE_OFFSET_BITS.
  + swtpm_setup:
  - Use DISTRO_PROFILES_DIR when listing profiles (fix path
    issue).
  - Do not pass a TPM 2 profile to swtpm when reconfiguring.
  + selinux:
  - Add rule for swtpm to be able to read password from pipe.
  - allow to map state file.
  - add NFS permissions for swtpm_t.
  - Add rule to allow swtpm_t opening of virt_log_t files.
- Drop 1229131-fix-swtpm-selinux-policy-mismatch.patch: fixed
  upstream.
- Add 1027.patch: tests: Retry NVWrite command after 0x922 return
  code and inc lockout counter.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1761912000">- Also load swtpm_libvirt in the selinux subpackage (bsc#1251789)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1784116800">- Drop tunable in require to avoid policy loading issues
  with toolchain 3.11 (bsc#1271417).
  Can be dropped, once this is accepted upstream:
  https://github.com/stefanberger/swtpm/pull/1139
  - Add patch: 1271417-drop-tunable-requires.patch</changelog>
  <changelog author="Jehu Marcos Herrera Puentes &lt;jehuherrerap@hotmail.com&gt;" date="1785412800">- Fix SELinux policy for virtqemud_t swtpm_t setsched
  process and unix socket interactions. Allows virtqemud_t to: Signal and
  control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched),
  create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339).
  Already accepted on upstream:
  https://github.com/stefanberger/swtpm/pull/1132
- Add patch: 1132.patch</changelog>
</package>
<package pkgid="3612148fdcda327e7913a7487028ff706212e6a86348c93ca671405f8e46b1a25ed93fdd076a6042b0ee80579a45e7dd9b11d7ff1bbc19c03c30ec59e044e815" name="swtpm-selinux" arch="noarch">
  <version epoch="0" ver="0.10.1" rel="62.2"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104000">- Update to version 0.8.0:
  * swtpm:
    + Implement release-lock-outgoing parameter for --migration option
    + Introduce --migration option and 'incoming' parameter
    + Implement terminate parameter for ctrl channel loss
    + Add a chroot option
    + Introduce disable-auto-shutdown flag for --flags option
    + If necessary send TPM2_Shutdown() before TPMLIB_Terminate()
    + Add some more recent syscalls to seccomp profile
    + Disable OpenSSL FIPS mode to avoid libtpms failures
    + Avoid locking directory multiple times
    + Remove support for pre-v0.1 state files without header
    + Use uint64_t in tlv_data_append() to avoid integer overflows
    + Use uint64_t to avoid integer wrap-around when adding a uint32_t
    + Do not chdir(/) when using --daemon
    + Check header size indicator against expected size (CVE-2022-23645 bsc#1196240)
    + Fixes for gcc 12.2.1 -fanalyzer
  * build-sys:
    + Fix configure script to support _FORTIFY_SOURCE=3
    + Define __USE_LINUX_IOCTL_DEFS in header file (Cygwin)
  * swtpm-localca:
    + Re-implement variable resolution for swtpm-localca.conf
    + Test for available issuercert before creating CA
  * swtpm_setup:
    + Configure swtpm to log to stdout/err if needed (glib &gt;=2.74)
  * tests:
    + Use ${WORKDIR} in config files to test env. var replacement
    + Patch IBM TSS2 test suite for OpenSSL 3.x
  * build-sys:
    + Add probing for -fstack-protector</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1678104001">- Drop trousers requirement</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1679400000">- swtpm-fix-build.patch: disable -Wstack-protector, it fails on s390x
  bsc#1209117</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1683028800">- remove python3 dependency, no longer needed after rewrite (bsc#1211010)</changelog>
  <changelog author="Manfred Hollstein &lt;manfred.h@gmx.net&gt;" date="1686916800">- Make selinux optional to allow building this package for Leap, too.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1694865600">- Update to version 0.8.1:
  - swtpm:
  - Restore logging to stderr on log open failure
  - swtpm_setup:
  - Exit with '0' upon --version rather than '1'.
  - Initialized @argv in get_swtpm_capabilities()
  - swtpm_localca:
  - Add missing NULL option to end of array
  - SELinux:
  - Add rules for user_tpm_t:sockfile to allow unlink
  - Add rules for sock_file on user_tmp_t</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1697716800">- Add missing requires for certtool</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1722513600">- update to 0.9.0:
  - fixes: boo#1226398
  - swtpm:
  - Use umask() to create/truncated state file rather than fchmod()
  - Use fchmod to set mode bits provided by user
  - Replace mkstemp with g_mkstemp_full (Coverity)
  - fix typo in help message
  - cuse: Fix Coverity complaints regarding locks
  - Fix double free in error path
  - Close fd after main loop
  - Restore logging to stderr on log open failure
  - swtpm_setup:
  - Fail --pcr-banks without --tpm2
  - Fail --decryption or --allow-signing without --tpm2
  - Initialized argv in get_swtpm_capabilities()
  - Flush spk after persisting to create room for another key
  - Refactor duplicate code into swtpm_tpm2_write_cert_nvram
  - Move persisting of certificate into tpm2_persist_certificate
  - Pass key_type to function creating filename for key
  - Add scheme parameter before curveid to createprimary_ecc
  - Rename is_ek to preserve for future extension
  - Mask-out EK and plaform certificate flags and set cert_flags
  - Move common code into new function read_certificate_file()
  - Exit with '0' upon --version rather than '1'
  - Close file descriptors passed to swtpm process on parent side
  - Make stdout unbuffered
  - Use medium duration on TSC_PhysicalPresence to avoid timeouts
  - Add poll() after write() and before read() to detect errors
  - swtpm_localca:
  - Add support for up to 20 bytes serial numbers
  - Introduce --key as more generic alias for --ek
  - Add missing NULL option to end of array
  - Make stdout unbuffered
  - swtpm_cert:
  - Add support for serial numbers up to 20 bytes long
  - swtpm_ioctl:
  - Separate return code from flags
  - Repeatedly call PTM_GET_INFO for long responses
  - selinux:
  - Re-add rule for svirt_tcg_t and user_tmp_t:sock_file (virt-install)
  - New SELinux policy that requires Fedora 40 or later
  - tests:
  - Fixed occurrences of stray '' before '-'
  - Rearrange order of test cases to run some also as 'root'
  - Add tests for command line options and combinations of options
  - Add softhsm_setup to shellcheck'ed files and fix issues
  - Add missing 'exit 1' on unexpected file size on --reconfigure
  - Add test cases for swtpm_cert with max serial number
  - Fix spelling mistakes
  - reformat regexs for easier readability and extension
  - ibmtss2: Add patch to disable x509 test with older libtpms
  - Upgrade to ibmtss2 v2.0.1
  - Fixed several issues detected by shellcheck
  - build-sys:
  - Add support for --disable-tests to disable tests
  - Display GMP_LIBS and GMP_CFLAGS
  - Only display warning if pkg-config for gmp fails
  - Add gmp library and devel package as dependency
  - use PKG_CHECK_MODULES to check libtpms version</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1726747200">- Fix swtpm custom module (bsc#1229131)
  - Add patch: 1229131-fix-swtpm-selinux-policy-mismatch.patch
  - this can be removed once swtpm upstream sorts out their custom selinux module.
    see: https://github.com/stefanberger/swtpm/issues/885
    there were a couple changes in the selinux-policy libvirt handling
    which causes the logfile in /var/log/swtpm/libvirt/qemu/*.log to be labeled
    virt_log_t instead of var_log_t. this patch allows swtpm_t to open the virt_log_t</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1733313600">- Update to 0.10.0:
  + swtpm:
  * Requires libtpms v0.10.0
  * Display tpmstate-opt-lock as a new capability
  * Add support for lock option parameter to tpmstate option
  * nvstore_linear: Add support for file-backend locking
  * Remove broken logic to check for neither dir nor file backend
  * Use ptm_cap_n to build PTM_GET_CAPABILITY response
  * Define a structure to return PTM_GET_CAPABILITY result
  * Implement --print-info to run TPMLIB_GetInfo with flags
  * Support --profile fd= to read profile from file descriptor
  * Support --profile file= to read profile from file
  * Ignore remove-disabled parameter on non-'custom' profile
  * Check for good entropy source in chroot environment
  * Implement a check for HMAC+sha1 for testing future restriction
  * Implement function to check whether a crypto algorithm is
    disabled
  * Print cmdarg-print-profiles as part of capabilities
  * Check whether SHA1 signature support is disabled in profile
  * Use TPMLIB_WasManufactured to check whether profile was applied
  * Determine whether OpenSSL needs to be configured (FIPs, SHA1
    signature)
  * Add support for --print-profiles option
  * Print profile names as part of capabilities JSON
  * Display new capability to allow setting a profile
  * Add support for --profile option to set a profile on TPM 2
  + swtpm_setup:
  * Comment flags for storage primary key and deprecate --create-spk
  * Implement --print-profiles to display all profile
  * Add profile entries to swtpm_setup.conf written by swtpm_setup
  * Add support for --profile-name option
  * Accept profiles with name starting with 'custom:'
  * Support default profile from file in swtpm_setup.conf
  * Support --profile-file-fd to read profile from file descriptor
  * Support --profile-file to read profile from file
  * Always log the active profile
  * Implement --profile-remove-fips-disabled option
  * Read default profile from swtpm_setup.conf
  * Print profile names as part of capabilities JSON
  * Add support for --profile parameter
  * Get default rsa keysize from setup_setup.conf if not given
  + swtpm_ioctl:
  * Use ptm_cap_n for non-CUSE PTM_GET_CAPABILITY response
  + selinux:
  * Change write to append for appending to log
  * Add rule for logging to svirt_image_t labeled files from swtpm_t
  + tests:
  * Update IBMTSS2 test suite to v2.4.0
  * Test activation of PCR banks when not all are available
  * Enable SWTPM_TEST_PROFILE for running test_tpm2_ibmtss2 with
    profile
  * Add a check for OPENSSL_ENABLE_SHA1_SIGNATURES in log file
  * Consolidate custom profile test cases and check for
    StateFormatLevel
  * Convert test_samples_create_tpmca to run installed
  * Mention test_tpm2_libtpms_versions_profiles requiring
    env. variables
  * allow running ibmtss2 tests against installed version
  * Derive support for CUSE from SWTPM_EXE help screen
  * Set OPENSSL_ENABLE_SHA1_SIGNATURES=1 for IBMTSS2 test
  * Extend test case testing across libtpms versions
  * Add test case for testing profiles across libtpms versions
  * Test the --profile option of swtpm_setup and swtpm
  * teach them to run installed
  * add installed-runner.sh
  * install tests on the system
  * lookup system binaries if INSTALLED is set
  + build-sys:
  * enable 64-bit file API on 32-bit systems
  * Add -Wshadow to the CFLAGS
  * Require that libtpms v0.10 is available for TPMLIB_SetProfile</changelog>
  <changelog author="Bernhard Wiedemann &lt;bwiedemann@suse.com&gt;" date="1733572800">- Fix build without %check (boo#1227364)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1750075200">- Update to version 0.10.1:
  + swtpm: Fix build error on 32bit systems due to inconsistent
    _FILE_OFFSET_BITS.
  + swtpm_setup:
  - Use DISTRO_PROFILES_DIR when listing profiles (fix path
    issue).
  - Do not pass a TPM 2 profile to swtpm when reconfiguring.
  + selinux:
  - Add rule for swtpm to be able to read password from pipe.
  - allow to map state file.
  - add NFS permissions for swtpm_t.
  - Add rule to allow swtpm_t opening of virt_log_t files.
- Drop 1229131-fix-swtpm-selinux-policy-mismatch.patch: fixed
  upstream.
- Add 1027.patch: tests: Retry NVWrite command after 0x922 return
  code and inc lockout counter.</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1761912000">- Also load swtpm_libvirt in the selinux subpackage (bsc#1251789)</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1784116800">- Drop tunable in require to avoid policy loading issues
  with toolchain 3.11 (bsc#1271417).
  Can be dropped, once this is accepted upstream:
  https://github.com/stefanberger/swtpm/pull/1139
  - Add patch: 1271417-drop-tunable-requires.patch</changelog>
  <changelog author="Jehu Marcos Herrera Puentes &lt;jehuherrerap@hotmail.com&gt;" date="1785412800">- Fix SELinux policy for virtqemud_t swtpm_t setsched
  process and unix socket interactions. Allows virtqemud_t to: Signal and
  control swtpm_t processes (noatsecure, rlimitinh, siginh, signull, setsched),
  create and listen on Unix stream sockets with swtpm_t processes (bsc#1266339).
  Already accepted on upstream:
  https://github.com/stefanberger/swtpm/pull/1132
- Add patch: 1132.patch</changelog>
</package>
<package pkgid="8243b9490ee1287963f4db520998e307a8f670bb1b0d4ad915f7551d4360bb001db81ba66855f7b6c3a22462a7eb6e7846d951b209bbe8de28d3f8f1921a8034" name="system-group-audit" arch="noarch">
  <version epoch="0" ver="4.0.2" rel="186.7"/>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676894400">- Update to 3.1:
  * Disable ProtectControlGroups in auditd.service by default
  * Fix rule checking for exclude filter
  * Make audit_rule_syscallbyname_data work correctly outside of auditctl
  * Add new record types
  * Add io_uring support
  * Add support for new FANOTIFY record fields
  * Add keyword, this-hour, to ausearch/report start/end options
  * Add Requires.private to audit.pc file
  * Try to interpret OPENAT2 fields correctly</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1683201600">- Add _multibuild to define additional spec files as additional
  flavors.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1688385600">- Update to 3.1.1:
  * Add user friendly keywords for signals to auditctl
  * In ausearch, parse up URINGOP and DM_CTRL records
  * Harden auparse to better handle corrupt logs
  * Fix a CFLAGS propogation problem in the common directory
  * Move the audispd af_unix plugin to a standalone program</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1722859200">- Remove rcaudit symlink [jsc#PED-266]</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1726574400">- Update to 4.0
  - Drop python2 support
  - Drop auvirt and autrace programs
  - Drop SysVinit support
  - Require the use of the 5.0 or later kernel headers
  - New README.md file
  - Rewrite legacy service functions in terms of systemctl
  - Consolidate and update end of event detection to a common function
  - Split off rule loading from auditd.service into audit-rules.service
  - Refactor libaudit.h to split out logging functions and record numbers
  - Speed up aureport --summary reports
  - Limit libaudit python bindings to logging functions
  - Add a metrics function for auparse
  - Change auditctl to use pidfd_send_signal for signaling auditd
  - Adjust watches to optimize syscalls hooked when watch file access
  - Drop nispom rules
  - Add intepretations for fsconfig, fsopen, fsmount, &amp; move_mount
  - Many code fixups (cgzones)
  - Update syscall and interpretation tables to the 6.8 kernel
  (from v3.1.2)
  - When processing a run level change, make auditd exit
  - In auditd, fix return code when rules added in immutable mode
  - In auparse, when files are given, also consider EUID for access
  - Auparse now interprets unnamed/anonymous sockets (Enzo Matsumiya)
  - Disable Python bindings from setting rules due to swig bug (S. Trofimovich)
  - Update all lookup tables for the 6.5 kernel
  - Don't be as paranoid about auditctl -R file permissions
  - In ausearch, correct subject/object search to be an and if both are given
  - Adjust formats for 64 bit time_t
  - Fix segfault in python bindings around the feed API
  - Add feed_has_data, get_record_num, and get/goto_field_num to python bindings
- Update spec:
  * Move rules-related files into new subpackage `audit-rules':
  * Files moved:
  - /sbin/auditctl, /sbin/augenrules,
  /etc/audit/{audit.rules,rules.d/audit.rules,audit-stop.rules}
  - manpages for auditctl, augenrules, and audit.rules
  - /etc/audit is now owned by `audit-rules' as well
  * Add new file /usr/lib/systemd/system/audit-rules.service
  * Remove in-house create-augenrules-service.patch that generated
    augenrules.service systemd unit service
  * Remove ownership of /usr/share/audit
  * Create /usr/share/audit-rules directory on %install
  * Remove audit-userspace-517-compat.patch (fixed upstream)
  * Remove libev-werror.patch (fixed upstream)
  * Remove audit-allow-manual-stop.patch (fixed upstream)
  * Add fix-auparse-test.patch (downstream):
    Upstream tests uses a static value (42) for 'gdm' uid/gid (based
    on Fedora values, apparently).  Replace these occurrences with
    'unknown(123456)'
  * Replace '--with-python' with '--with-python3' on %configure
  * Remove autrace and auvirt references (upstream)
  * Replace README with README.md
- Drop `--enable-systemd' from %configure as SysV-style scripts
  aren't supported in upstream since
  113ae191758c ("Drop support for SysVinit")</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727352000">- Update audit-secondary.spec:
  * Add "Requires: audit-rules" for audit package
  * Remove preun/postun handling of audit-rules.service</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727784000">- Fix plugin termination when using systemd service units (bsc#1215377)
  * add auditd.service-fix-plugin-termination.patch</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1727870400">- Readd audit-allow-manual-stop.patch (removed by mistake)</changelog>
  <changelog author="Enzo Matsumiya &lt;ematsumiya@suse.com&gt;" date="1728043200">- Update audit.spec (bsc#1231236):
  * add requirement for 'awk' package
  * move some %post logic from audit to audit-rules</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- Refresh systemd service patches:
  - audit-allow-manual-stop.patch
  - auditd.service-fix-plugin-termination.patch
  - enable-stop-rules.patch
  - fix-hardened-service.patch
  - harden_auditd.service.patch
- Update to 4.0.2
  - Fix musl C builds
  - Many code cleanups (Yugend)
  - Use atomic variables if available for signal related flags
  - Dont rotate audit logs when auditd is in debug mode
  - Fix a couple memory leaks on error paths
  - Correct output when displaying rules with exe/path/dir (Attila Lakatos)
  - Fix auparse lookup test to not use the system libaupaurse
  - Improve auparse metrics
  - Update auparse normalizer for recent syscalls
  - Make status report uniform
- Update to 4.0.1
  - Update TRUSTED_APP interpretation to look for known fields
  - In auditd plugins, allow variable amount of arguments (Attila Lakatos)
  - Fix augenrules to work correctly when kernel is in immutable mode
  - Add ausearch_cur_event to auparse library (Attila Lakatos)
  - Add audisp-filter plugin (Attila Lakatos)
  - Improve sorting speed of aureport --summary reports
  - auditd &amp; audit-rules.service pick up paths automatically (Laurent Bigonville)
  - Update auparse normalizer for new syscalls</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1769428800">- Move all /var/spool, /var/log directories to systemd-tmpfiles</changelog>
  <changelog author="Thorsten Kukuk &lt;kukuk@suse.com&gt;" date="1770120000">- Configure runstatedir as "/run" to get rid of systemd deprecation
  warnings.</changelog>
</package>
<package pkgid="0c8bc3b354f976207b3884f38525c443dfd0599991420474f2015ecddf37435804e1e64479ad6cc8326a52bf0b0b65ea564e9be656bb0fdf1a25711a6e26d3bc" name="system-user-openbao" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="3.12"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1712318400">- new package system-user-openbao: user for OpenBao</changelog>
</package>
<package pkgid="0e4e68c4f87dc2aaaa2faa3b148f404d9ea5bab63bf15d8afc31427ab3c2a3697051c5a6afc3e77950c4d018e2ef847557e77117369f0ec4124f7dc673810b6a" name="system-user-openbao" arch="src">
  <version epoch="0" ver="1.0.0" rel="3.12"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1712318400">- new package system-user-openbao: user for OpenBao</changelog>
</package>
<package pkgid="47f74621410c5d0d0f77205f94b5dfad520d974347e3f06139765ed74f2ed00ae2d1a8a5b58ed3adaa1e21090b4392e5e996d5f6b8626faf7ebf30652d868793" name="system-user-vault" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="2.12"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1707220800">- new package system-user-vault: user for Hashicorp Vault and
  OpenBao</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1712145600">- add $HOME directory /var/lib/vault/</changelog>
</package>
<package pkgid="7bb8785d6fa0a313a129936b87f314ac649e1efbd15f6860e0e0baa6ccf5b455db56c71127f025515418d4b7a06c18f35252f4586369122d5087e2d0b432d918" name="system-user-vault" arch="src">
  <version epoch="0" ver="1.0.0" rel="2.12"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1707220800">- new package system-user-vault: user for Hashicorp Vault and
  OpenBao</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1712145600">- add $HOME directory /var/lib/vault/</changelog>
</package>
<package pkgid="e5f254cb4e0c23dfeae63b0e0df7a7c374e6be55e118832df3529a7c059c82b62664f2dfdcf10dcb89b13cf27100d2c8b9ece3362452454260858fff48d6cf6f" name="system-user-vault-sync" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="3.12"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1718020800">- system user for vault-sync</changelog>
</package>
<package pkgid="c01da7969e67a6a98393132df402a43797834ed8184d7c277ec328df0da833e14978b33bf2faf4e831eaca8c88bff6ee59678b137389c2415c018f351679e09f" name="system-user-vault-sync" arch="src">
  <version epoch="0" ver="1.0.0" rel="3.12"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1718020800">- system user for vault-sync</changelog>
</package>
<package pkgid="9cac12c3e1beb30e8786e8fd6681eec782b50665c51124a705c0c6fd01d115cbd11f0ea7758652ffeab6e414242b5856b1ce6de22b62fa1aa716d70dd39ecef1" name="tarsnap" arch="s390x">
  <version epoch="0" ver="1.0.41" rel="1.10"/>
  <changelog author="crrodriguez@opensuse.org" date="1300449600">- remove SSE2 hackish spec file detection, just tell the
  compiler to enable it.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1301486400">- make it a i686 package right away</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1315224000">- Update to version 1.0.30, many bugfixes</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1317556800">- Explicit BuildRequires on libbz2-devel</changelog>
  <changelog author="gregkh@opensuse.org" date="1344859200">- update to version 1.0.33, many bugfixes</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1382356800">- Tarsnap 1.0.35
  * A bug in tarsnap 1.0.34 which could cause tarsnap to crash
  (segmentation fault or bus error) when encountering network
  glitches  or outages is fixed.
  * deal with pseudofilesystems such as proc more gracefully.
  * support IPV6
  * other bugfixes</changelog>
  <changelog author="dmacvicar@suse.de" date="1469966400">- Update to version 1.0.37
- Changes since 1.0.36
  * tarsnap-key(gen|mgmt|regen) now accept a --passphrase-time
    option, which specifies the duration to be spent on computing
    the derived keys used for encrypting the tarsnap key file.
  * tarsnap now accepts a --keep-going option when deleting or
    printing statistics about multiple archives.
  * tarsnap-keymgmt now accepts a --print-key-permissions option
    for listing the permissions contained in a key file.
  * tarsnap --print-stats now accepts a --csv-file option for
    printing statistics in comma-separated-value format.
  * tarsnap now accepts a --verify-config command which exits
    silently after checking the configuration file(s) for syntax
    errors.
  * tarsnap now looks for a server named "v1-0-0-server.tarsnap.com"
    instead of the historic "betatest-server.tarsnap.com" hostname.
    This should have no user-visible effect in most configurations.
  * tarsnap now correctly warns if a sparse extract fails due to
    hardlinks.
  * tarsnap now prints a warning if creating an empty archive.
- Changes since 1.0.35
  * A theoretically exploitable one-byte buffer overflow when
    archiving objects with long path names is fixed.
  * A vulnerability which allowed a corrupt archive to cause
    tarsnap to allocate a large amount of memory upon listing
    archives or reading the corrupt archive is fixed.
  * Tarsnap no longer crashes if its first DNS lookup fails.
  * Tarsnap no longer exits with "Callbacks uninitialized" when
    running on a dual-stack network if the first IP stack it
    attempts fails to connect.
  * tarsnap -c --dry-run can now run without a keyfile,
    allowing users to predict how much Tarsnap will cost before
    signing up.
  * Tarsnap now includes bash completion scripts.
  * Tarsnap now automatically detects and uses AESNI and SSE2
    cpu features.
- clean spec file</changelog>
  <changelog author="dmacvicar@suse.de" date="1510401600">- Update to version 1.0.39
- Changes since 1.0.38
  * Fix a division-by-zero crash when reading corrupt password-encrypted tarsnap
    key files.
  * Fix a crash in reading corrupt "cpio newc" format archives included via the
    tarsnap @archive directive, on 32-bit systems.
  * Fix a bug in the handling of corrupt "ar" format archives included via the
    tarsnap @archive directive.
  * Fix an abort trap which complained about files with a negative modification
    time.  (This assertion occured after the archive is stored, so no user data
    was at risk.)
- Changes since 1.0.37
  * tarsnap now accepts an --initialize-cachedir command, which is intended for
    the GUI and is not needed for command-line usage.
  * tarsnap now applies --humanize-numbers to the SIGINFO "progress" output.
  * tarsnap now gives a warning for --configfile /nosuchfile.
  * tarsnap now accepts --iso-dates, which prints file and directory dates as
    yyyy-mm-dd hh:mm:ss in "list archive" mode.  This can be cancelled with
  - -no-iso-dates.
  * the ./configure --with-conf-no-sample flag causes in the sample config file
    to be installed as tarsnap.conf instead of tarsnap.conf.sample.  This may
    result in overwriting an existing tarsnap.conf file.
  * tarsnap now accepts --force-resources to force the decryption of a
    passphrase-encrypted key file to proceed even if it is anticipated to require
    an excessive amount of memory or CPU time.  This can be cancelled with
  - -no-force-resources.
  * tarsnap now supports OpenSSL 1.1.
  * tarsnap now displays 'Deleting archive "foo"' when deleting a single archive
    in verbose mode.  (The former behaviour was to print that message only when
    multiple archives were being deleted by a single tarsnap command.)
  * tarsnap now accepts --archive-names filename, which reads a list of
    archive names from a file in addition to any -f options.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1627819200">- more precise description
- install bash-completion to /usr/, not /etc/
- spec-cleaner run</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1757246400">- update to version 1.0.41:
  * tarsnap now has mitigations to defend against information leakage
  * tarsnap -c now accepts --dry-run-metadata
  * tarsnap now accepts --noatime with -c mode
  * If the server-side state was modified and tarsnap exits with an error, it
    will now have an exit code of 2
  * tarsnap will read a config file in $XDG_CONFIG_HOME/tarsnap/tarsnap.conf
  * tarsnap now accepts --null-input as a synonym for --null
  * tarsnap now accepts --null-output
  * tarsnap now accepts --null-output with -x and -t
  * tarsnap now accepts --null-output with --print-stats
  * tarsnap now accepts --hashes, which causes --list-archives to print hashes
    of archive names
  * tarsnap now accepts -f TAPEHASH with --list-archives --hashes
  * Fixed a problem with strict aliasing if somebody compiled with gcc11 or
    higher using -O3, does not have SSE2, and is using a passphrase-protected
    keyfile
- update to version 1.0.40:
  * tarsnap now accepts a --dump-config option
  * tarsnap now gives an error if there are unused command-line arguments
  * Use RDRAND as an additional source of entropy on CPUs which support it
  * Use SHANI instructions on CPUs which support them
  * When sent SIGINFO or SIGUSR1, tarsnap now prints the number of files and
    the number of uncompressed bytes processed
  * tarsnap now accepts a --passphrase method:arg option
  * tarsnap now accepts a --resume-extract option
  * tarsnap now accepts --progress-bytes SIZE
- update license to NonFree
- use pkgconfig rather than package names
- seperate out the bash completions and generate zsh completions
- add tests
- be more explicit in the files section</changelog>
</package>
<package pkgid="b96f8e07db9c4c2e5e461ccfc72323a96ab5bdf9ae4ebc9e5fddfc38b1af785149041b28fcd6195b456f071a9886f3120d039d7cc46968cf9ccea62ade55a6f5" name="tarsnap" arch="src">
  <version epoch="0" ver="1.0.41" rel="1.10"/>
  <changelog author="gregkh@suse.de" date="1295697600">- 1.0.28 release</changelog>
  <changelog author="cristian.rodriguez@opensuse.org" date="1297512000">- Version 1.0.29</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1299153600">- enable sse2 code</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1300449600">- remove SSE2 hackish spec file detection, just tell the
  compiler to enable it.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1301486400">- make it a i686 package right away</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1315224000">- Update to version 1.0.30, many bugfixes</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1317556800">- Explicit BuildRequires on libbz2-devel</changelog>
  <changelog author="gregkh@opensuse.org" date="1344859200">- update to version 1.0.33, many bugfixes</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1382356800">- Tarsnap 1.0.35
  * A bug in tarsnap 1.0.34 which could cause tarsnap to crash
  (segmentation fault or bus error) when encountering network
  glitches  or outages is fixed.
  * deal with pseudofilesystems such as proc more gracefully.
  * support IPV6
  * other bugfixes</changelog>
  <changelog author="dmacvicar@suse.de" date="1469966400">- Update to version 1.0.37
- Changes since 1.0.36
  * tarsnap-key(gen|mgmt|regen) now accept a --passphrase-time
    option, which specifies the duration to be spent on computing
    the derived keys used for encrypting the tarsnap key file.
  * tarsnap now accepts a --keep-going option when deleting or
    printing statistics about multiple archives.
  * tarsnap-keymgmt now accepts a --print-key-permissions option
    for listing the permissions contained in a key file.
  * tarsnap --print-stats now accepts a --csv-file option for
    printing statistics in comma-separated-value format.
  * tarsnap now accepts a --verify-config command which exits
    silently after checking the configuration file(s) for syntax
    errors.
  * tarsnap now looks for a server named "v1-0-0-server.tarsnap.com"
    instead of the historic "betatest-server.tarsnap.com" hostname.
    This should have no user-visible effect in most configurations.
  * tarsnap now correctly warns if a sparse extract fails due to
    hardlinks.
  * tarsnap now prints a warning if creating an empty archive.
- Changes since 1.0.35
  * A theoretically exploitable one-byte buffer overflow when
    archiving objects with long path names is fixed.
  * A vulnerability which allowed a corrupt archive to cause
    tarsnap to allocate a large amount of memory upon listing
    archives or reading the corrupt archive is fixed.
  * Tarsnap no longer crashes if its first DNS lookup fails.
  * Tarsnap no longer exits with "Callbacks uninitialized" when
    running on a dual-stack network if the first IP stack it
    attempts fails to connect.
  * tarsnap -c --dry-run can now run without a keyfile,
    allowing users to predict how much Tarsnap will cost before
    signing up.
  * Tarsnap now includes bash completion scripts.
  * Tarsnap now automatically detects and uses AESNI and SSE2
    cpu features.
- clean spec file</changelog>
  <changelog author="dmacvicar@suse.de" date="1510401600">- Update to version 1.0.39
- Changes since 1.0.38
  * Fix a division-by-zero crash when reading corrupt password-encrypted tarsnap
    key files.
  * Fix a crash in reading corrupt "cpio newc" format archives included via the
    tarsnap @archive directive, on 32-bit systems.
  * Fix a bug in the handling of corrupt "ar" format archives included via the
    tarsnap @archive directive.
  * Fix an abort trap which complained about files with a negative modification
    time.  (This assertion occured after the archive is stored, so no user data
    was at risk.)
- Changes since 1.0.37
  * tarsnap now accepts an --initialize-cachedir command, which is intended for
    the GUI and is not needed for command-line usage.
  * tarsnap now applies --humanize-numbers to the SIGINFO "progress" output.
  * tarsnap now gives a warning for --configfile /nosuchfile.
  * tarsnap now accepts --iso-dates, which prints file and directory dates as
    yyyy-mm-dd hh:mm:ss in "list archive" mode.  This can be cancelled with
  - -no-iso-dates.
  * the ./configure --with-conf-no-sample flag causes in the sample config file
    to be installed as tarsnap.conf instead of tarsnap.conf.sample.  This may
    result in overwriting an existing tarsnap.conf file.
  * tarsnap now accepts --force-resources to force the decryption of a
    passphrase-encrypted key file to proceed even if it is anticipated to require
    an excessive amount of memory or CPU time.  This can be cancelled with
  - -no-force-resources.
  * tarsnap now supports OpenSSL 1.1.
  * tarsnap now displays 'Deleting archive "foo"' when deleting a single archive
    in verbose mode.  (The former behaviour was to print that message only when
    multiple archives were being deleted by a single tarsnap command.)
  * tarsnap now accepts --archive-names filename, which reads a list of
    archive names from a file in addition to any -f options.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1627819200">- more precise description
- install bash-completion to /usr/, not /etc/
- spec-cleaner run</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1757246400">- update to version 1.0.41:
  * tarsnap now has mitigations to defend against information leakage
  * tarsnap -c now accepts --dry-run-metadata
  * tarsnap now accepts --noatime with -c mode
  * If the server-side state was modified and tarsnap exits with an error, it
    will now have an exit code of 2
  * tarsnap will read a config file in $XDG_CONFIG_HOME/tarsnap/tarsnap.conf
  * tarsnap now accepts --null-input as a synonym for --null
  * tarsnap now accepts --null-output
  * tarsnap now accepts --null-output with -x and -t
  * tarsnap now accepts --null-output with --print-stats
  * tarsnap now accepts --hashes, which causes --list-archives to print hashes
    of archive names
  * tarsnap now accepts -f TAPEHASH with --list-archives --hashes
  * Fixed a problem with strict aliasing if somebody compiled with gcc11 or
    higher using -O3, does not have SSE2, and is using a passphrase-protected
    keyfile
- update to version 1.0.40:
  * tarsnap now accepts a --dump-config option
  * tarsnap now gives an error if there are unused command-line arguments
  * Use RDRAND as an additional source of entropy on CPUs which support it
  * Use SHANI instructions on CPUs which support them
  * When sent SIGINFO or SIGUSR1, tarsnap now prints the number of files and
    the number of uncompressed bytes processed
  * tarsnap now accepts a --passphrase method:arg option
  * tarsnap now accepts a --resume-extract option
  * tarsnap now accepts --progress-bytes SIZE
- update license to NonFree
- use pkgconfig rather than package names
- seperate out the bash completions and generate zsh completions
- add tests
- be more explicit in the files section</changelog>
</package>
<package pkgid="d493376a0235234609eab5e34e1a2f621127bc984ae56362a609fc15358179b2aa24bea26ddd513ba0b27032021de7bee0338d56a79c32f1009abf6cb196bbdf" name="tarsnap-bash-completion" arch="noarch">
  <version epoch="0" ver="1.0.41" rel="1.10"/>
  <changelog author="crrodriguez@opensuse.org" date="1300449600">- remove SSE2 hackish spec file detection, just tell the
  compiler to enable it.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1301486400">- make it a i686 package right away</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1315224000">- Update to version 1.0.30, many bugfixes</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1317556800">- Explicit BuildRequires on libbz2-devel</changelog>
  <changelog author="gregkh@opensuse.org" date="1344859200">- update to version 1.0.33, many bugfixes</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1382356800">- Tarsnap 1.0.35
  * A bug in tarsnap 1.0.34 which could cause tarsnap to crash
  (segmentation fault or bus error) when encountering network
  glitches  or outages is fixed.
  * deal with pseudofilesystems such as proc more gracefully.
  * support IPV6
  * other bugfixes</changelog>
  <changelog author="dmacvicar@suse.de" date="1469966400">- Update to version 1.0.37
- Changes since 1.0.36
  * tarsnap-key(gen|mgmt|regen) now accept a --passphrase-time
    option, which specifies the duration to be spent on computing
    the derived keys used for encrypting the tarsnap key file.
  * tarsnap now accepts a --keep-going option when deleting or
    printing statistics about multiple archives.
  * tarsnap-keymgmt now accepts a --print-key-permissions option
    for listing the permissions contained in a key file.
  * tarsnap --print-stats now accepts a --csv-file option for
    printing statistics in comma-separated-value format.
  * tarsnap now accepts a --verify-config command which exits
    silently after checking the configuration file(s) for syntax
    errors.
  * tarsnap now looks for a server named "v1-0-0-server.tarsnap.com"
    instead of the historic "betatest-server.tarsnap.com" hostname.
    This should have no user-visible effect in most configurations.
  * tarsnap now correctly warns if a sparse extract fails due to
    hardlinks.
  * tarsnap now prints a warning if creating an empty archive.
- Changes since 1.0.35
  * A theoretically exploitable one-byte buffer overflow when
    archiving objects with long path names is fixed.
  * A vulnerability which allowed a corrupt archive to cause
    tarsnap to allocate a large amount of memory upon listing
    archives or reading the corrupt archive is fixed.
  * Tarsnap no longer crashes if its first DNS lookup fails.
  * Tarsnap no longer exits with "Callbacks uninitialized" when
    running on a dual-stack network if the first IP stack it
    attempts fails to connect.
  * tarsnap -c --dry-run can now run without a keyfile,
    allowing users to predict how much Tarsnap will cost before
    signing up.
  * Tarsnap now includes bash completion scripts.
  * Tarsnap now automatically detects and uses AESNI and SSE2
    cpu features.
- clean spec file</changelog>
  <changelog author="dmacvicar@suse.de" date="1510401600">- Update to version 1.0.39
- Changes since 1.0.38
  * Fix a division-by-zero crash when reading corrupt password-encrypted tarsnap
    key files.
  * Fix a crash in reading corrupt "cpio newc" format archives included via the
    tarsnap @archive directive, on 32-bit systems.
  * Fix a bug in the handling of corrupt "ar" format archives included via the
    tarsnap @archive directive.
  * Fix an abort trap which complained about files with a negative modification
    time.  (This assertion occured after the archive is stored, so no user data
    was at risk.)
- Changes since 1.0.37
  * tarsnap now accepts an --initialize-cachedir command, which is intended for
    the GUI and is not needed for command-line usage.
  * tarsnap now applies --humanize-numbers to the SIGINFO "progress" output.
  * tarsnap now gives a warning for --configfile /nosuchfile.
  * tarsnap now accepts --iso-dates, which prints file and directory dates as
    yyyy-mm-dd hh:mm:ss in "list archive" mode.  This can be cancelled with
  - -no-iso-dates.
  * the ./configure --with-conf-no-sample flag causes in the sample config file
    to be installed as tarsnap.conf instead of tarsnap.conf.sample.  This may
    result in overwriting an existing tarsnap.conf file.
  * tarsnap now accepts --force-resources to force the decryption of a
    passphrase-encrypted key file to proceed even if it is anticipated to require
    an excessive amount of memory or CPU time.  This can be cancelled with
  - -no-force-resources.
  * tarsnap now supports OpenSSL 1.1.
  * tarsnap now displays 'Deleting archive "foo"' when deleting a single archive
    in verbose mode.  (The former behaviour was to print that message only when
    multiple archives were being deleted by a single tarsnap command.)
  * tarsnap now accepts --archive-names filename, which reads a list of
    archive names from a file in addition to any -f options.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1627819200">- more precise description
- install bash-completion to /usr/, not /etc/
- spec-cleaner run</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1757246400">- update to version 1.0.41:
  * tarsnap now has mitigations to defend against information leakage
  * tarsnap -c now accepts --dry-run-metadata
  * tarsnap now accepts --noatime with -c mode
  * If the server-side state was modified and tarsnap exits with an error, it
    will now have an exit code of 2
  * tarsnap will read a config file in $XDG_CONFIG_HOME/tarsnap/tarsnap.conf
  * tarsnap now accepts --null-input as a synonym for --null
  * tarsnap now accepts --null-output
  * tarsnap now accepts --null-output with -x and -t
  * tarsnap now accepts --null-output with --print-stats
  * tarsnap now accepts --hashes, which causes --list-archives to print hashes
    of archive names
  * tarsnap now accepts -f TAPEHASH with --list-archives --hashes
  * Fixed a problem with strict aliasing if somebody compiled with gcc11 or
    higher using -O3, does not have SSE2, and is using a passphrase-protected
    keyfile
- update to version 1.0.40:
  * tarsnap now accepts a --dump-config option
  * tarsnap now gives an error if there are unused command-line arguments
  * Use RDRAND as an additional source of entropy on CPUs which support it
  * Use SHANI instructions on CPUs which support them
  * When sent SIGINFO or SIGUSR1, tarsnap now prints the number of files and
    the number of uncompressed bytes processed
  * tarsnap now accepts a --passphrase method:arg option
  * tarsnap now accepts a --resume-extract option
  * tarsnap now accepts --progress-bytes SIZE
- update license to NonFree
- use pkgconfig rather than package names
- seperate out the bash completions and generate zsh completions
- add tests
- be more explicit in the files section</changelog>
</package>
<package pkgid="f2ef2510c378aee034da7a6bf1589fd4b5cde29c044ed4a4159f59dea6114cbdbfef59583b9e9e8ee3b8ad6463117195b8ceef046b07520ef0373a9816cfbf15" name="tarsnap-debuginfo" arch="s390x">
  <version epoch="0" ver="1.0.41" rel="1.10"/>
  <changelog author="crrodriguez@opensuse.org" date="1300449600">- remove SSE2 hackish spec file detection, just tell the
  compiler to enable it.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1301486400">- make it a i686 package right away</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1315224000">- Update to version 1.0.30, many bugfixes</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1317556800">- Explicit BuildRequires on libbz2-devel</changelog>
  <changelog author="gregkh@opensuse.org" date="1344859200">- update to version 1.0.33, many bugfixes</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1382356800">- Tarsnap 1.0.35
  * A bug in tarsnap 1.0.34 which could cause tarsnap to crash
  (segmentation fault or bus error) when encountering network
  glitches  or outages is fixed.
  * deal with pseudofilesystems such as proc more gracefully.
  * support IPV6
  * other bugfixes</changelog>
  <changelog author="dmacvicar@suse.de" date="1469966400">- Update to version 1.0.37
- Changes since 1.0.36
  * tarsnap-key(gen|mgmt|regen) now accept a --passphrase-time
    option, which specifies the duration to be spent on computing
    the derived keys used for encrypting the tarsnap key file.
  * tarsnap now accepts a --keep-going option when deleting or
    printing statistics about multiple archives.
  * tarsnap-keymgmt now accepts a --print-key-permissions option
    for listing the permissions contained in a key file.
  * tarsnap --print-stats now accepts a --csv-file option for
    printing statistics in comma-separated-value format.
  * tarsnap now accepts a --verify-config command which exits
    silently after checking the configuration file(s) for syntax
    errors.
  * tarsnap now looks for a server named "v1-0-0-server.tarsnap.com"
    instead of the historic "betatest-server.tarsnap.com" hostname.
    This should have no user-visible effect in most configurations.
  * tarsnap now correctly warns if a sparse extract fails due to
    hardlinks.
  * tarsnap now prints a warning if creating an empty archive.
- Changes since 1.0.35
  * A theoretically exploitable one-byte buffer overflow when
    archiving objects with long path names is fixed.
  * A vulnerability which allowed a corrupt archive to cause
    tarsnap to allocate a large amount of memory upon listing
    archives or reading the corrupt archive is fixed.
  * Tarsnap no longer crashes if its first DNS lookup fails.
  * Tarsnap no longer exits with "Callbacks uninitialized" when
    running on a dual-stack network if the first IP stack it
    attempts fails to connect.
  * tarsnap -c --dry-run can now run without a keyfile,
    allowing users to predict how much Tarsnap will cost before
    signing up.
  * Tarsnap now includes bash completion scripts.
  * Tarsnap now automatically detects and uses AESNI and SSE2
    cpu features.
- clean spec file</changelog>
  <changelog author="dmacvicar@suse.de" date="1510401600">- Update to version 1.0.39
- Changes since 1.0.38
  * Fix a division-by-zero crash when reading corrupt password-encrypted tarsnap
    key files.
  * Fix a crash in reading corrupt "cpio newc" format archives included via the
    tarsnap @archive directive, on 32-bit systems.
  * Fix a bug in the handling of corrupt "ar" format archives included via the
    tarsnap @archive directive.
  * Fix an abort trap which complained about files with a negative modification
    time.  (This assertion occured after the archive is stored, so no user data
    was at risk.)
- Changes since 1.0.37
  * tarsnap now accepts an --initialize-cachedir command, which is intended for
    the GUI and is not needed for command-line usage.
  * tarsnap now applies --humanize-numbers to the SIGINFO "progress" output.
  * tarsnap now gives a warning for --configfile /nosuchfile.
  * tarsnap now accepts --iso-dates, which prints file and directory dates as
    yyyy-mm-dd hh:mm:ss in "list archive" mode.  This can be cancelled with
  - -no-iso-dates.
  * the ./configure --with-conf-no-sample flag causes in the sample config file
    to be installed as tarsnap.conf instead of tarsnap.conf.sample.  This may
    result in overwriting an existing tarsnap.conf file.
  * tarsnap now accepts --force-resources to force the decryption of a
    passphrase-encrypted key file to proceed even if it is anticipated to require
    an excessive amount of memory or CPU time.  This can be cancelled with
  - -no-force-resources.
  * tarsnap now supports OpenSSL 1.1.
  * tarsnap now displays 'Deleting archive "foo"' when deleting a single archive
    in verbose mode.  (The former behaviour was to print that message only when
    multiple archives were being deleted by a single tarsnap command.)
  * tarsnap now accepts --archive-names filename, which reads a list of
    archive names from a file in addition to any -f options.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1627819200">- more precise description
- install bash-completion to /usr/, not /etc/
- spec-cleaner run</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1757246400">- update to version 1.0.41:
  * tarsnap now has mitigations to defend against information leakage
  * tarsnap -c now accepts --dry-run-metadata
  * tarsnap now accepts --noatime with -c mode
  * If the server-side state was modified and tarsnap exits with an error, it
    will now have an exit code of 2
  * tarsnap will read a config file in $XDG_CONFIG_HOME/tarsnap/tarsnap.conf
  * tarsnap now accepts --null-input as a synonym for --null
  * tarsnap now accepts --null-output
  * tarsnap now accepts --null-output with -x and -t
  * tarsnap now accepts --null-output with --print-stats
  * tarsnap now accepts --hashes, which causes --list-archives to print hashes
    of archive names
  * tarsnap now accepts -f TAPEHASH with --list-archives --hashes
  * Fixed a problem with strict aliasing if somebody compiled with gcc11 or
    higher using -O3, does not have SSE2, and is using a passphrase-protected
    keyfile
- update to version 1.0.40:
  * tarsnap now accepts a --dump-config option
  * tarsnap now gives an error if there are unused command-line arguments
  * Use RDRAND as an additional source of entropy on CPUs which support it
  * Use SHANI instructions on CPUs which support them
  * When sent SIGINFO or SIGUSR1, tarsnap now prints the number of files and
    the number of uncompressed bytes processed
  * tarsnap now accepts a --passphrase method:arg option
  * tarsnap now accepts a --resume-extract option
  * tarsnap now accepts --progress-bytes SIZE
- update license to NonFree
- use pkgconfig rather than package names
- seperate out the bash completions and generate zsh completions
- add tests
- be more explicit in the files section</changelog>
</package>
<package pkgid="00040d94efd98157fc990c6bd552b7d5b781bb1924039edb1a6c5ffa9d084d3ea1b0c769daca79131ac2073f7853b5cf74a73c89f8df3796bde5d62a311d5e6d" name="tarsnap-debugsource" arch="s390x">
  <version epoch="0" ver="1.0.41" rel="1.10"/>
  <changelog author="crrodriguez@opensuse.org" date="1300449600">- remove SSE2 hackish spec file detection, just tell the
  compiler to enable it.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1301486400">- make it a i686 package right away</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1315224000">- Update to version 1.0.30, many bugfixes</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1317556800">- Explicit BuildRequires on libbz2-devel</changelog>
  <changelog author="gregkh@opensuse.org" date="1344859200">- update to version 1.0.33, many bugfixes</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1382356800">- Tarsnap 1.0.35
  * A bug in tarsnap 1.0.34 which could cause tarsnap to crash
  (segmentation fault or bus error) when encountering network
  glitches  or outages is fixed.
  * deal with pseudofilesystems such as proc more gracefully.
  * support IPV6
  * other bugfixes</changelog>
  <changelog author="dmacvicar@suse.de" date="1469966400">- Update to version 1.0.37
- Changes since 1.0.36
  * tarsnap-key(gen|mgmt|regen) now accept a --passphrase-time
    option, which specifies the duration to be spent on computing
    the derived keys used for encrypting the tarsnap key file.
  * tarsnap now accepts a --keep-going option when deleting or
    printing statistics about multiple archives.
  * tarsnap-keymgmt now accepts a --print-key-permissions option
    for listing the permissions contained in a key file.
  * tarsnap --print-stats now accepts a --csv-file option for
    printing statistics in comma-separated-value format.
  * tarsnap now accepts a --verify-config command which exits
    silently after checking the configuration file(s) for syntax
    errors.
  * tarsnap now looks for a server named "v1-0-0-server.tarsnap.com"
    instead of the historic "betatest-server.tarsnap.com" hostname.
    This should have no user-visible effect in most configurations.
  * tarsnap now correctly warns if a sparse extract fails due to
    hardlinks.
  * tarsnap now prints a warning if creating an empty archive.
- Changes since 1.0.35
  * A theoretically exploitable one-byte buffer overflow when
    archiving objects with long path names is fixed.
  * A vulnerability which allowed a corrupt archive to cause
    tarsnap to allocate a large amount of memory upon listing
    archives or reading the corrupt archive is fixed.
  * Tarsnap no longer crashes if its first DNS lookup fails.
  * Tarsnap no longer exits with "Callbacks uninitialized" when
    running on a dual-stack network if the first IP stack it
    attempts fails to connect.
  * tarsnap -c --dry-run can now run without a keyfile,
    allowing users to predict how much Tarsnap will cost before
    signing up.
  * Tarsnap now includes bash completion scripts.
  * Tarsnap now automatically detects and uses AESNI and SSE2
    cpu features.
- clean spec file</changelog>
  <changelog author="dmacvicar@suse.de" date="1510401600">- Update to version 1.0.39
- Changes since 1.0.38
  * Fix a division-by-zero crash when reading corrupt password-encrypted tarsnap
    key files.
  * Fix a crash in reading corrupt "cpio newc" format archives included via the
    tarsnap @archive directive, on 32-bit systems.
  * Fix a bug in the handling of corrupt "ar" format archives included via the
    tarsnap @archive directive.
  * Fix an abort trap which complained about files with a negative modification
    time.  (This assertion occured after the archive is stored, so no user data
    was at risk.)
- Changes since 1.0.37
  * tarsnap now accepts an --initialize-cachedir command, which is intended for
    the GUI and is not needed for command-line usage.
  * tarsnap now applies --humanize-numbers to the SIGINFO "progress" output.
  * tarsnap now gives a warning for --configfile /nosuchfile.
  * tarsnap now accepts --iso-dates, which prints file and directory dates as
    yyyy-mm-dd hh:mm:ss in "list archive" mode.  This can be cancelled with
  - -no-iso-dates.
  * the ./configure --with-conf-no-sample flag causes in the sample config file
    to be installed as tarsnap.conf instead of tarsnap.conf.sample.  This may
    result in overwriting an existing tarsnap.conf file.
  * tarsnap now accepts --force-resources to force the decryption of a
    passphrase-encrypted key file to proceed even if it is anticipated to require
    an excessive amount of memory or CPU time.  This can be cancelled with
  - -no-force-resources.
  * tarsnap now supports OpenSSL 1.1.
  * tarsnap now displays 'Deleting archive "foo"' when deleting a single archive
    in verbose mode.  (The former behaviour was to print that message only when
    multiple archives were being deleted by a single tarsnap command.)
  * tarsnap now accepts --archive-names filename, which reads a list of
    archive names from a file in addition to any -f options.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1627819200">- more precise description
- install bash-completion to /usr/, not /etc/
- spec-cleaner run</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1757246400">- update to version 1.0.41:
  * tarsnap now has mitigations to defend against information leakage
  * tarsnap -c now accepts --dry-run-metadata
  * tarsnap now accepts --noatime with -c mode
  * If the server-side state was modified and tarsnap exits with an error, it
    will now have an exit code of 2
  * tarsnap will read a config file in $XDG_CONFIG_HOME/tarsnap/tarsnap.conf
  * tarsnap now accepts --null-input as a synonym for --null
  * tarsnap now accepts --null-output
  * tarsnap now accepts --null-output with -x and -t
  * tarsnap now accepts --null-output with --print-stats
  * tarsnap now accepts --hashes, which causes --list-archives to print hashes
    of archive names
  * tarsnap now accepts -f TAPEHASH with --list-archives --hashes
  * Fixed a problem with strict aliasing if somebody compiled with gcc11 or
    higher using -O3, does not have SSE2, and is using a passphrase-protected
    keyfile
- update to version 1.0.40:
  * tarsnap now accepts a --dump-config option
  * tarsnap now gives an error if there are unused command-line arguments
  * Use RDRAND as an additional source of entropy on CPUs which support it
  * Use SHANI instructions on CPUs which support them
  * When sent SIGINFO or SIGUSR1, tarsnap now prints the number of files and
    the number of uncompressed bytes processed
  * tarsnap now accepts a --passphrase method:arg option
  * tarsnap now accepts a --resume-extract option
  * tarsnap now accepts --progress-bytes SIZE
- update license to NonFree
- use pkgconfig rather than package names
- seperate out the bash completions and generate zsh completions
- add tests
- be more explicit in the files section</changelog>
</package>
<package pkgid="bcb17fe7fd9a2d5e21bdac0c973ac9e73f48e06fda2f23a14b189c7d9f7dc1658c40b3cb1576f68c60b96e56ab38af30960a441f6addcea7aa2991b1815640bf" name="tarsnap-zsh-completion" arch="noarch">
  <version epoch="0" ver="1.0.41" rel="1.10"/>
  <changelog author="crrodriguez@opensuse.org" date="1300449600">- remove SSE2 hackish spec file detection, just tell the
  compiler to enable it.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1301486400">- make it a i686 package right away</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1315224000">- Update to version 1.0.30, many bugfixes</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1317556800">- Explicit BuildRequires on libbz2-devel</changelog>
  <changelog author="gregkh@opensuse.org" date="1344859200">- update to version 1.0.33, many bugfixes</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1382356800">- Tarsnap 1.0.35
  * A bug in tarsnap 1.0.34 which could cause tarsnap to crash
  (segmentation fault or bus error) when encountering network
  glitches  or outages is fixed.
  * deal with pseudofilesystems such as proc more gracefully.
  * support IPV6
  * other bugfixes</changelog>
  <changelog author="dmacvicar@suse.de" date="1469966400">- Update to version 1.0.37
- Changes since 1.0.36
  * tarsnap-key(gen|mgmt|regen) now accept a --passphrase-time
    option, which specifies the duration to be spent on computing
    the derived keys used for encrypting the tarsnap key file.
  * tarsnap now accepts a --keep-going option when deleting or
    printing statistics about multiple archives.
  * tarsnap-keymgmt now accepts a --print-key-permissions option
    for listing the permissions contained in a key file.
  * tarsnap --print-stats now accepts a --csv-file option for
    printing statistics in comma-separated-value format.
  * tarsnap now accepts a --verify-config command which exits
    silently after checking the configuration file(s) for syntax
    errors.
  * tarsnap now looks for a server named "v1-0-0-server.tarsnap.com"
    instead of the historic "betatest-server.tarsnap.com" hostname.
    This should have no user-visible effect in most configurations.
  * tarsnap now correctly warns if a sparse extract fails due to
    hardlinks.
  * tarsnap now prints a warning if creating an empty archive.
- Changes since 1.0.35
  * A theoretically exploitable one-byte buffer overflow when
    archiving objects with long path names is fixed.
  * A vulnerability which allowed a corrupt archive to cause
    tarsnap to allocate a large amount of memory upon listing
    archives or reading the corrupt archive is fixed.
  * Tarsnap no longer crashes if its first DNS lookup fails.
  * Tarsnap no longer exits with "Callbacks uninitialized" when
    running on a dual-stack network if the first IP stack it
    attempts fails to connect.
  * tarsnap -c --dry-run can now run without a keyfile,
    allowing users to predict how much Tarsnap will cost before
    signing up.
  * Tarsnap now includes bash completion scripts.
  * Tarsnap now automatically detects and uses AESNI and SSE2
    cpu features.
- clean spec file</changelog>
  <changelog author="dmacvicar@suse.de" date="1510401600">- Update to version 1.0.39
- Changes since 1.0.38
  * Fix a division-by-zero crash when reading corrupt password-encrypted tarsnap
    key files.
  * Fix a crash in reading corrupt "cpio newc" format archives included via the
    tarsnap @archive directive, on 32-bit systems.
  * Fix a bug in the handling of corrupt "ar" format archives included via the
    tarsnap @archive directive.
  * Fix an abort trap which complained about files with a negative modification
    time.  (This assertion occured after the archive is stored, so no user data
    was at risk.)
- Changes since 1.0.37
  * tarsnap now accepts an --initialize-cachedir command, which is intended for
    the GUI and is not needed for command-line usage.
  * tarsnap now applies --humanize-numbers to the SIGINFO "progress" output.
  * tarsnap now gives a warning for --configfile /nosuchfile.
  * tarsnap now accepts --iso-dates, which prints file and directory dates as
    yyyy-mm-dd hh:mm:ss in "list archive" mode.  This can be cancelled with
  - -no-iso-dates.
  * the ./configure --with-conf-no-sample flag causes in the sample config file
    to be installed as tarsnap.conf instead of tarsnap.conf.sample.  This may
    result in overwriting an existing tarsnap.conf file.
  * tarsnap now accepts --force-resources to force the decryption of a
    passphrase-encrypted key file to proceed even if it is anticipated to require
    an excessive amount of memory or CPU time.  This can be cancelled with
  - -no-force-resources.
  * tarsnap now supports OpenSSL 1.1.
  * tarsnap now displays 'Deleting archive "foo"' when deleting a single archive
    in verbose mode.  (The former behaviour was to print that message only when
    multiple archives were being deleted by a single tarsnap command.)
  * tarsnap now accepts --archive-names filename, which reads a list of
    archive names from a file in addition to any -f options.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1627819200">- more precise description
- install bash-completion to /usr/, not /etc/
- spec-cleaner run</changelog>
  <changelog author="Richard Rahl &lt;rrahl0@opensuse.org&gt;" date="1757246400">- update to version 1.0.41:
  * tarsnap now has mitigations to defend against information leakage
  * tarsnap -c now accepts --dry-run-metadata
  * tarsnap now accepts --noatime with -c mode
  * If the server-side state was modified and tarsnap exits with an error, it
    will now have an exit code of 2
  * tarsnap will read a config file in $XDG_CONFIG_HOME/tarsnap/tarsnap.conf
  * tarsnap now accepts --null-input as a synonym for --null
  * tarsnap now accepts --null-output
  * tarsnap now accepts --null-output with -x and -t
  * tarsnap now accepts --null-output with --print-stats
  * tarsnap now accepts --hashes, which causes --list-archives to print hashes
    of archive names
  * tarsnap now accepts -f TAPEHASH with --list-archives --hashes
  * Fixed a problem with strict aliasing if somebody compiled with gcc11 or
    higher using -O3, does not have SSE2, and is using a passphrase-protected
    keyfile
- update to version 1.0.40:
  * tarsnap now accepts a --dump-config option
  * tarsnap now gives an error if there are unused command-line arguments
  * Use RDRAND as an additional source of entropy on CPUs which support it
  * Use SHANI instructions on CPUs which support them
  * When sent SIGINFO or SIGUSR1, tarsnap now prints the number of files and
    the number of uncompressed bytes processed
  * tarsnap now accepts a --passphrase method:arg option
  * tarsnap now accepts a --resume-extract option
  * tarsnap now accepts --progress-bytes SIZE
- update license to NonFree
- use pkgconfig rather than package names
- seperate out the bash completions and generate zsh completions
- add tests
- be more explicit in the files section</changelog>
</package>
<package pkgid="2410bc15d78d8b256ff876a9417b3bd4dfb52769d741a18bb4262058fae6032e128181640904fc91dbb695c90fea55acd46d72046bbca2fb2c729aec9bc5a03e" name="tcpflow" arch="s390x">
  <version epoch="0" ver="1.6.1" rel="26.89"/>
  <changelog author="Greg.Freemyer@gmail.com" date="1345636800">Upgrade to v1.3.0
  - converted code from c to c++
  * various fixes and additional features
  * src/tcpip.cpp (tcpip::close_file): added support for FUTIMENS, but I don't yet have a system on which to test it. Hope that it's good.
  * src/main.cpp (main): -r option now allows for multiple files to be specified.
  * src/main.cpp (main): -R option now allows for incomplete tcp connections to be finished.
  * src/tcpip.cpp (tcpdemux::tcpdemux): default outdir is now "."
  * src/xml.cpp (xml::add_cpuid): better handling of CPUID instruction. Now it really should not show up on non-Intel architectures.
  * src/main.cpp (main): added printing stats for debug level 3.
  * src/tcpip.cpp (tcpdemux::close_all): Jeremey's FD ring has been replaced with an unordere dset.
  * COPYING: updated to GPLv3
  * src/flow.cpp (flow::filename): completely rewrote to support templates.
  (flow::print_usage): added to give information on templates.
  * src/main.cpp (main): fixed option parsing bug.
  (class ipaddr): created class for IP addresses
  (class flow_state_struct): created class from struct
  * src/main.cpp (print_usage): -X added for XML output.
  * src/main.cpp (main): changed bytes_per_flow from int to uint64_t
  progname is now a global.
  * src/main.cpp (main): added -B option to force binary output.
  * src/util.cpp: removed copy_argv(); replaced with a simple std::string manipulation.
  (flow_filename): modified to work with outdir
  * src/tcpip.c (print_packet): modified to respect bytes_per_flow
  * src/main.c (main): removed prepending of (ip or ip6 or vlan) from user expressions. We now just use what the user provided.</changelog>
  <changelog author="cfarrell@suse.com" date="1345809600">- license update: GPL-3.0+
  Source code files state that they are ^GPL^ licensed and to refer back to
  the ^LICENSE^ file for details. There is no ^LICENSE^ file but there is a
  ^COPYING^ file and that is clearly GPL-3.0</changelog>
  <changelog author="p.drouand@gmail.com" date="1427803200">- Update to version 1.4.4
  * The ChangeLog/NEWS file has not been updated for this release
- Use the download Url provided by upstream
- Add openssl-devel and boost-devel build require; new upstream dependency</changelog>
  <changelog author="adam.majer@suse.de" date="1486036800">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="dimstar@opensuse.org" date="1518782400">- Update to version 1.4.5:
  + Handles RFC1122 keepalive packets.
  + Fixed wifi selection and added wifi viz.
  + New option -0 to omit extra new lines.
  + Various build fixes.
- Replace openssl-devel BuildRequires with pkgconfig(openssl),
  limited to versions &lt; 1.1: tcpflow is not yet compatible to
  openssl-1.1.
- Package COPYING as license, not as doc.</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1539086400">- Update to version 1.5.0
  + Supports openssl 1.1
  + option for setting the libpcap update timeout</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1539172800">- Use noun phrase in summary.</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1558353600">- Add the missing zlib requirement.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1613822400">- Update to version 1.6.1:
  - Here is release v1.6.1. Does not use the new be13 API that is updated for C++17. That's coming.
  - Some problems with the checks, but they are problems with the test harness, not the tests themselves. Help from volunteers is appreciated!
- No changelog for version 1.6.0 available.
- Update to version 1.5.2:
  - fixed sizeof(addr1) and sizeof(addr2) error in un_pair
- Update to version 1.5.1:
  - updated for pcap_findalldevs
  - added -Wno-address-of-packed-member to avoid error</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https urls</changelog>
</package>
<package pkgid="d2d9e8fb2216edddd714f38dfd3c81a549e5f2cb14fe4942130b00bdd66dfc8decabef3cbfb8713005d783a7d1bfb3f929703c58c43ca02135ffb4fc83430eb6" name="tcpflow" arch="src">
  <version epoch="0" ver="1.6.1" rel="26.89"/>
  <changelog author="sebastien@sebbraun.de" date="1324209600">- Initial packaging attempt</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1345636800">Upgrade to v1.3.0
  - converted code from c to c++
  * various fixes and additional features
  * src/tcpip.cpp (tcpip::close_file): added support for FUTIMENS, but I don't yet have a system on which to test it. Hope that it's good.
  * src/main.cpp (main): -r option now allows for multiple files to be specified.
  * src/main.cpp (main): -R option now allows for incomplete tcp connections to be finished.
  * src/tcpip.cpp (tcpdemux::tcpdemux): default outdir is now "."
  * src/xml.cpp (xml::add_cpuid): better handling of CPUID instruction. Now it really should not show up on non-Intel architectures.
  * src/main.cpp (main): added printing stats for debug level 3.
  * src/tcpip.cpp (tcpdemux::close_all): Jeremey's FD ring has been replaced with an unordere dset.
  * COPYING: updated to GPLv3
  * src/flow.cpp (flow::filename): completely rewrote to support templates.
  (flow::print_usage): added to give information on templates.
  * src/main.cpp (main): fixed option parsing bug.
  (class ipaddr): created class for IP addresses
  (class flow_state_struct): created class from struct
  * src/main.cpp (print_usage): -X added for XML output.
  * src/main.cpp (main): changed bytes_per_flow from int to uint64_t
  progname is now a global.
  * src/main.cpp (main): added -B option to force binary output.
  * src/util.cpp: removed copy_argv(); replaced with a simple std::string manipulation.
  (flow_filename): modified to work with outdir
  * src/tcpip.c (print_packet): modified to respect bytes_per_flow
  * src/main.c (main): removed prepending of (ip or ip6 or vlan) from user expressions. We now just use what the user provided.</changelog>
  <changelog author="cfarrell@suse.com" date="1345809600">- license update: GPL-3.0+
  Source code files state that they are ^GPL^ licensed and to refer back to
  the ^LICENSE^ file for details. There is no ^LICENSE^ file but there is a
  ^COPYING^ file and that is clearly GPL-3.0</changelog>
  <changelog author="p.drouand@gmail.com" date="1427803200">- Update to version 1.4.4
  * The ChangeLog/NEWS file has not been updated for this release
- Use the download Url provided by upstream
- Add openssl-devel and boost-devel build require; new upstream dependency</changelog>
  <changelog author="adam.majer@suse.de" date="1486036800">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="dimstar@opensuse.org" date="1518782400">- Update to version 1.4.5:
  + Handles RFC1122 keepalive packets.
  + Fixed wifi selection and added wifi viz.
  + New option -0 to omit extra new lines.
  + Various build fixes.
- Replace openssl-devel BuildRequires with pkgconfig(openssl),
  limited to versions &lt; 1.1: tcpflow is not yet compatible to
  openssl-1.1.
- Package COPYING as license, not as doc.</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1539086400">- Update to version 1.5.0
  + Supports openssl 1.1
  + option for setting the libpcap update timeout</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1539172800">- Use noun phrase in summary.</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1558353600">- Add the missing zlib requirement.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1613822400">- Update to version 1.6.1:
  - Here is release v1.6.1. Does not use the new be13 API that is updated for C++17. That's coming.
  - Some problems with the checks, but they are problems with the test harness, not the tests themselves. Help from volunteers is appreciated!
- No changelog for version 1.6.0 available.
- Update to version 1.5.2:
  - fixed sizeof(addr1) and sizeof(addr2) error in un_pair
- Update to version 1.5.1:
  - updated for pcap_findalldevs
  - added -Wno-address-of-packed-member to avoid error</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https urls</changelog>
</package>
<package pkgid="5cdd8b1d7a7c3f343b073e2e60964c36463d56ac333b34bae273674c1fb096c9b9854a115243e249c4f6bf89d47f77bbbba38986cb2a694d2706868fc95c9e10" name="tcpflow-debuginfo" arch="s390x">
  <version epoch="0" ver="1.6.1" rel="26.89"/>
  <changelog author="Greg.Freemyer@gmail.com" date="1345636800">Upgrade to v1.3.0
  - converted code from c to c++
  * various fixes and additional features
  * src/tcpip.cpp (tcpip::close_file): added support for FUTIMENS, but I don't yet have a system on which to test it. Hope that it's good.
  * src/main.cpp (main): -r option now allows for multiple files to be specified.
  * src/main.cpp (main): -R option now allows for incomplete tcp connections to be finished.
  * src/tcpip.cpp (tcpdemux::tcpdemux): default outdir is now "."
  * src/xml.cpp (xml::add_cpuid): better handling of CPUID instruction. Now it really should not show up on non-Intel architectures.
  * src/main.cpp (main): added printing stats for debug level 3.
  * src/tcpip.cpp (tcpdemux::close_all): Jeremey's FD ring has been replaced with an unordere dset.
  * COPYING: updated to GPLv3
  * src/flow.cpp (flow::filename): completely rewrote to support templates.
  (flow::print_usage): added to give information on templates.
  * src/main.cpp (main): fixed option parsing bug.
  (class ipaddr): created class for IP addresses
  (class flow_state_struct): created class from struct
  * src/main.cpp (print_usage): -X added for XML output.
  * src/main.cpp (main): changed bytes_per_flow from int to uint64_t
  progname is now a global.
  * src/main.cpp (main): added -B option to force binary output.
  * src/util.cpp: removed copy_argv(); replaced with a simple std::string manipulation.
  (flow_filename): modified to work with outdir
  * src/tcpip.c (print_packet): modified to respect bytes_per_flow
  * src/main.c (main): removed prepending of (ip or ip6 or vlan) from user expressions. We now just use what the user provided.</changelog>
  <changelog author="cfarrell@suse.com" date="1345809600">- license update: GPL-3.0+
  Source code files state that they are ^GPL^ licensed and to refer back to
  the ^LICENSE^ file for details. There is no ^LICENSE^ file but there is a
  ^COPYING^ file and that is clearly GPL-3.0</changelog>
  <changelog author="p.drouand@gmail.com" date="1427803200">- Update to version 1.4.4
  * The ChangeLog/NEWS file has not been updated for this release
- Use the download Url provided by upstream
- Add openssl-devel and boost-devel build require; new upstream dependency</changelog>
  <changelog author="adam.majer@suse.de" date="1486036800">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="dimstar@opensuse.org" date="1518782400">- Update to version 1.4.5:
  + Handles RFC1122 keepalive packets.
  + Fixed wifi selection and added wifi viz.
  + New option -0 to omit extra new lines.
  + Various build fixes.
- Replace openssl-devel BuildRequires with pkgconfig(openssl),
  limited to versions &lt; 1.1: tcpflow is not yet compatible to
  openssl-1.1.
- Package COPYING as license, not as doc.</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1539086400">- Update to version 1.5.0
  + Supports openssl 1.1
  + option for setting the libpcap update timeout</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1539172800">- Use noun phrase in summary.</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1558353600">- Add the missing zlib requirement.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1613822400">- Update to version 1.6.1:
  - Here is release v1.6.1. Does not use the new be13 API that is updated for C++17. That's coming.
  - Some problems with the checks, but they are problems with the test harness, not the tests themselves. Help from volunteers is appreciated!
- No changelog for version 1.6.0 available.
- Update to version 1.5.2:
  - fixed sizeof(addr1) and sizeof(addr2) error in un_pair
- Update to version 1.5.1:
  - updated for pcap_findalldevs
  - added -Wno-address-of-packed-member to avoid error</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https urls</changelog>
</package>
<package pkgid="8d7238a379aea84d6d667bafa4af015c30701abe007489dddcc4d86a2a644ee72561d5f5b1f2af3877d400a4c046717593db5d7346bf56fdb8c182cd2a8aa955" name="tcpflow-debugsource" arch="s390x">
  <version epoch="0" ver="1.6.1" rel="26.89"/>
  <changelog author="Greg.Freemyer@gmail.com" date="1345636800">Upgrade to v1.3.0
  - converted code from c to c++
  * various fixes and additional features
  * src/tcpip.cpp (tcpip::close_file): added support for FUTIMENS, but I don't yet have a system on which to test it. Hope that it's good.
  * src/main.cpp (main): -r option now allows for multiple files to be specified.
  * src/main.cpp (main): -R option now allows for incomplete tcp connections to be finished.
  * src/tcpip.cpp (tcpdemux::tcpdemux): default outdir is now "."
  * src/xml.cpp (xml::add_cpuid): better handling of CPUID instruction. Now it really should not show up on non-Intel architectures.
  * src/main.cpp (main): added printing stats for debug level 3.
  * src/tcpip.cpp (tcpdemux::close_all): Jeremey's FD ring has been replaced with an unordere dset.
  * COPYING: updated to GPLv3
  * src/flow.cpp (flow::filename): completely rewrote to support templates.
  (flow::print_usage): added to give information on templates.
  * src/main.cpp (main): fixed option parsing bug.
  (class ipaddr): created class for IP addresses
  (class flow_state_struct): created class from struct
  * src/main.cpp (print_usage): -X added for XML output.
  * src/main.cpp (main): changed bytes_per_flow from int to uint64_t
  progname is now a global.
  * src/main.cpp (main): added -B option to force binary output.
  * src/util.cpp: removed copy_argv(); replaced with a simple std::string manipulation.
  (flow_filename): modified to work with outdir
  * src/tcpip.c (print_packet): modified to respect bytes_per_flow
  * src/main.c (main): removed prepending of (ip or ip6 or vlan) from user expressions. We now just use what the user provided.</changelog>
  <changelog author="cfarrell@suse.com" date="1345809600">- license update: GPL-3.0+
  Source code files state that they are ^GPL^ licensed and to refer back to
  the ^LICENSE^ file for details. There is no ^LICENSE^ file but there is a
  ^COPYING^ file and that is clearly GPL-3.0</changelog>
  <changelog author="p.drouand@gmail.com" date="1427803200">- Update to version 1.4.4
  * The ChangeLog/NEWS file has not been updated for this release
- Use the download Url provided by upstream
- Add openssl-devel and boost-devel build require; new upstream dependency</changelog>
  <changelog author="adam.majer@suse.de" date="1486036800">- use individual libboost-*-devel packages instead of boost-devel</changelog>
  <changelog author="dimstar@opensuse.org" date="1518782400">- Update to version 1.4.5:
  + Handles RFC1122 keepalive packets.
  + Fixed wifi selection and added wifi viz.
  + New option -0 to omit extra new lines.
  + Various build fixes.
- Replace openssl-devel BuildRequires with pkgconfig(openssl),
  limited to versions &lt; 1.1: tcpflow is not yet compatible to
  openssl-1.1.
- Package COPYING as license, not as doc.</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1539086400">- Update to version 1.5.0
  + Supports openssl 1.1
  + option for setting the libpcap update timeout</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1539172800">- Use noun phrase in summary.</changelog>
  <changelog author="Christophe Giboudeaux &lt;christophe@krop.fr&gt;" date="1558353600">- Add the missing zlib requirement.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1613822400">- Update to version 1.6.1:
  - Here is release v1.6.1. Does not use the new be13 API that is updated for C++17. That's coming.
  - Some problems with the checks, but they are problems with the test harness, not the tests themselves. Help from volunteers is appreciated!
- No changelog for version 1.6.0 available.
- Update to version 1.5.2:
  - fixed sizeof(addr1) and sizeof(addr2) error in un_pair
- Update to version 1.5.1:
  - updated for pcap_findalldevs
  - added -Wno-address-of-packed-member to avoid error</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- https urls</changelog>
</package>
<package pkgid="76ed03105f8555c66d5d0daff9babaf027c3bfa2e36e4a5e7648061fa3becc6a1690452fcf0c8d203d1f0fe1d1f31fa48d135518a667f9e29161408a3b98a6de" name="termotp" arch="s390x">
  <version epoch="0" ver="0.0.11" rel="11.39"/>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1676203200">- Initial package of termotp 0.0.4 for openSUSE</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1708171200">- Update to 0.0.5:
  * d914359: Improve README.md.
  * 00fd244: Fix repo name for installer in README.md
  * b089391: More documentation improvements.
  * 282bca9: Added why termotp section and similar programs.
  * 5f63c38: Fix tipo in a comment.
  * 05bc615: Add goreportcard badge.
  * 4eb742c: Add fzf support</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1708430400">- Update to 0.0.6:
  * 47870d6: Add darwin/amd64 and darwin/arm64 builds.
  * 6af0316: Update README with new flags.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1709812800">- Update to 0.0.7:
  * cc2eee8: Add support to save/read password to/from keyring.
  * 691479f: Small text improvement.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1710504000">- Update to 0.0.8:
  * b082c57: Also accept passwords from stdin.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1710763200">- Update to 0.0.9:
  * 68f5fdb: Turn off automerge in --plain mode.
  * 28cf034: Add JSON output support.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1727697600">- Update to 0.0.10:
  * 74848fa Change references to termotp.
  * 303edfe Fix install bug with double digit versions.
  * 569a353 Fixed lint complaints about error messages.
  * 95a2b35 Regex typo fix.
  * 20a51e8 Use goreleaser to create releases.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1732795200">- Update to 0.0.11:
  * 45175e7 Remove upx compression (causes issues with MacOS).</changelog>
</package>
<package pkgid="6d3bd567aa26a1a361d8a3318d25de16e7c9c1463317bcbb014cbf97e73d5270d8d1e37f356cc6fbf52212fb30665ccbee172fa101c27b901e9697a4e9c34430" name="termotp" arch="src">
  <version epoch="0" ver="0.0.11" rel="11.39"/>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1676203200">- Initial package of termotp 0.0.4 for openSUSE</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1708171200">- Update to 0.0.5:
  * d914359: Improve README.md.
  * 00fd244: Fix repo name for installer in README.md
  * b089391: More documentation improvements.
  * 282bca9: Added why termotp section and similar programs.
  * 5f63c38: Fix tipo in a comment.
  * 05bc615: Add goreportcard badge.
  * 4eb742c: Add fzf support</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1708430400">- Update to 0.0.6:
  * 47870d6: Add darwin/amd64 and darwin/arm64 builds.
  * 6af0316: Update README with new flags.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1709812800">- Update to 0.0.7:
  * cc2eee8: Add support to save/read password to/from keyring.
  * 691479f: Small text improvement.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1710504000">- Update to 0.0.8:
  * b082c57: Also accept passwords from stdin.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1710763200">- Update to 0.0.9:
  * 68f5fdb: Turn off automerge in --plain mode.
  * 28cf034: Add JSON output support.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1727697600">- Update to 0.0.10:
  * 74848fa Change references to termotp.
  * 303edfe Fix install bug with double digit versions.
  * 569a353 Fixed lint complaints about error messages.
  * 95a2b35 Regex typo fix.
  * 20a51e8 Use goreleaser to create releases.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1732795200">- Update to 0.0.11:
  * 45175e7 Remove upx compression (causes issues with MacOS).</changelog>
</package>
<package pkgid="90c699c67d04602443de033612ab52572358b67b37100ec9fdb9c36e92b812fb77230a9bf1886fdaa97cb108719907f690e49486965bf315a6d5cba8306a3e37" name="termotp-debuginfo" arch="s390x">
  <version epoch="0" ver="0.0.11" rel="11.39"/>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1676203200">- Initial package of termotp 0.0.4 for openSUSE</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1708171200">- Update to 0.0.5:
  * d914359: Improve README.md.
  * 00fd244: Fix repo name for installer in README.md
  * b089391: More documentation improvements.
  * 282bca9: Added why termotp section and similar programs.
  * 5f63c38: Fix tipo in a comment.
  * 05bc615: Add goreportcard badge.
  * 4eb742c: Add fzf support</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1708430400">- Update to 0.0.6:
  * 47870d6: Add darwin/amd64 and darwin/arm64 builds.
  * 6af0316: Update README with new flags.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1709812800">- Update to 0.0.7:
  * cc2eee8: Add support to save/read password to/from keyring.
  * 691479f: Small text improvement.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1710504000">- Update to 0.0.8:
  * b082c57: Also accept passwords from stdin.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1710763200">- Update to 0.0.9:
  * 68f5fdb: Turn off automerge in --plain mode.
  * 28cf034: Add JSON output support.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1727697600">- Update to 0.0.10:
  * 74848fa Change references to termotp.
  * 303edfe Fix install bug with double digit versions.
  * 569a353 Fixed lint complaints about error messages.
  * 95a2b35 Regex typo fix.
  * 20a51e8 Use goreleaser to create releases.</changelog>
  <changelog author="Michael Vetter &lt;mvetter@suse.com&gt;" date="1732795200">- Update to 0.0.11:
  * 45175e7 Remove upx compression (causes issues with MacOS).</changelog>
</package>
<package pkgid="b6ca8dee7d29c6b6483a64793fdbccf0cf21fd31845878ef7c0cff6397412d7f1419b511fe4806d85d34faf2a05a8fb81be6ce496b6f85f6717aa71b32c5b864" name="thc-ipv6" arch="s390x">
  <version epoch="0" ver="3.8" rel="1.65"/>
  <changelog author="Sven Uebelacker &lt;sven@uebelacker.net&gt; 1.9" date="1348488000">- updated to version 1.9
  - new tools: detect_sniffer6, fake_router26, dnsrevenum6,
    inverse_lookup6, fake_solicitate6, address6, passive_discovery6
  - updated tools
  - code cleanup
- detailed Changelog here: /usr/share/doc/packages/thc-ipv6/CHANGES</changelog>
  <changelog author="Sven Uebelacker &lt;sven@uebelacker.net&gt; 2.0" date="1350302400">- updated to version 2.0
  - new tools: alive6, flood_router26
  - enhancement of trace6, thcping6, etc.
- patch for Makefile added (thcping6 double definition)</changelog>
  <changelog author="Sven Uebelacker &lt;sven@uebelacker.net&gt; 2.1" date="1356696000">- updated to version 2.1
  - added new tool: dnssecwalk - performs NSEC walking including IPv6+IPv4
    resolving
  - added new tool: firewall6 - various TCP/UDP ACL bypass test cases
  - added new tool: fake_pim6 - send fake hello and join/prune pim messages
  - added new tool: ndpexhaust26 - very performant ndp exhauster based on ICMP
    error toobig messages but can send many types of packets
  - alive6: ranges are now supported in the input file too
  - parasite6: enhancements to make it way more effective
  - fake_router26: added overlap RA guard evasion type (-E o, -E O)
  - dos-new-ip6: fix that only DAD replies are sent, not full NDP spoofing :-)
    (thanks to Johannes Weber for reporting)
  - flood_router26: Added local LAN privacy extension prevention attack by
    George Kargiotakis
  - randicmp6:
  - added function which dumps icmp answers received
  - added funtionality to send a specific type (and also code)
  - dnsdict6: added SRV result address resolving
  - trace6: fix for routers which add padding to the packets
  - fuzz_ip6: added -X option for not sending a transport layer
  - inject_alive6: added -a option to allow selective active alive sending
  - fake_advertise6: when no srcmac was specified, it was sent as all zeroes
    instead of the real mac (thanks to Jannes Weber for reporting)
  - fixed various injection issues (mostly too large packets for MTU on
    interface)
  - thc-ipv6-lib: added function thc_send_as_overlapping_{first,last}_fragment6
  - Added GPL exception clause to license to allow linking to OpenSSL - debian
    people need this
  - Makefile: added patch from gentoo maintainers</changelog>
  <changelog author="Sven Uebelacker &lt;sven@uebelacker.net&gt; 2.3" date="1381924800">- updated to version 2.3
  - Added new tool: thcsyn5 - a TCP flooding tool
  - Added new tool: redirsniff6 - redirects traffic (sniff variant to redir6)
  - Added new script: thc-ipv6-setup.sh - configuring Linux for thc-ipv6
  - Added new script: 6to4test.sh - check an ipv4 address for dynamic 6to4 tunnel setup
  - flood_router26: added -s option for small lifetime which makes the attack even more devasting
  - trace6:
  - added -B option for sending echo reply packets (will not show the destination)
  - added -E option for sending destination headers with invalid option
  - thcping6:
  - -U/-S port options now also set the source port
  - -U/-S options now also send data if given
  - -f fragment option can now be used multiple times
  - implementation6:
  - fixed bug in test case
  - added icmp6 type/code printing for error replies
  - toobig6: added -u option to allow testing for unrelated ICMPv6 packet firewall bypasses
  - firewall6: added more test cases
  - thc-ipv6-lib:
  - fixed address selection bug if global and ULA addresses are present
  - change NDP to use ff02::1:ffxx:xxx limited multicast addresses
  - thc_resolve6 ignores now anything after a "/" or in before/after "[]"</changelog>
  <changelog author="Sven Uebelacker &lt;sven@uebelacker.net&gt; - 2.7" date="1421409600">- updated to version 2.7
- changes from 2.3 to 2.7
  - All flood_* tools:
  - changed destination so that targets can be remote.
    Yes this should not work, but sometimes it does :-)
  - New tool: fuzz_dhcpc6 - DHCPv6 client fuzzer, submitted by Darrell Ambro, thanks a lot!
  - Added new script: six2four.sh - send an IPv6 packet via a 6to4 gateway
  - Added new script: grep6.pl - extracts an IPv6 in all possible notations from a file (from Eric Vyncke)
  - alive6:
  - setting -C twice increases the common address search space significantly
  - fixed from-to definition implementation
  - added "-y step" option, to define the step range when performing from-to
    scans (e.g. 2001:1::0-ff), default step range is of course 1, max is 256
  - selects the source IPv6 address for every new target now; waiting, if no
    fitting IPv6 address is present on the interface until one is
  - if you use -s for alive scanning, the new "one packet fingerprinting" functionality
    is automatically used, courtesy of warlord @ nologin from his poison tool
  - error message if a packet can not be send for &gt;50ms, and waiting for 60 seconds
  - cleaned up help output and add -hh more help/options output
  - thcsyn6:
  - added -m dstmac option (good for DOSing local, esp. hot standby addresses)
  - added -d dst hdr option
  - documented -a hbh-ra option
  - denial6:
  - added five more test cases with HBH-RA and AH headers
  - flood_router26
  - added -a hopbyhop with router alert option
  - changed a default so the attacks do not show up in Snort IDS
  - flood_redir6
  - added -a hopbyhop with router alert option
  - flood_solicitate6
  - added query address parameter option
  - added -a hopbyhop with router alert option
  - fuzz_ip6:
  - fixes for HBH and DST EH fuzzing
  - thcping6:
  - added -x flood option
  - added -e ethertype option
  - added -V IP version option
  - added -L payload length option
  - added -N next header option
  - now prints fragID of fragmented replies
  - implementation6:
  - a few more test cases and fixes
  - dump_dhcp6
  - more option decoding, better solicitate packet
  - added sending information request packet
  - four2six:
  - support for source port and ping ID (required for AFTR)
  - trace6:
  - support for MTU sizes &gt; 2500 added
  - implementation6
  - fixed to test cases where the wrong fragment nxt header was set (thanks to Gabriel Bertram for reporting)
  - inverse_lookup6
  - fixed to display only the IPv6 addresses (and not interpret other data as such)
  - thc-ipv6-lib
  - global addresses are now prefered over unique local if no destination is set
  - fixed a bug in IPv4 CRC calculation function
  - cppcheck and Coverity issues checked and fixed
  - added spelling fixes by Debian maintainers
  - Moved the license from GPLv3 to AGPLv3 (see LICENSE file)
  - Support for big endian processors added
  - Added new tool: fuzz_dhcps6 - DHCPv6 server fuzzer. Submitted by Brandon
    Hutcheson and Graeme Neilson - great job, thanks!
  - Added new tool: flood_redir6 - flooding with ICMPv6 redirects
  - Added new tool: flood_rs6 - flooding with ICMPv6 Router Soliciations
  - Added new tool: four2six - send an IPv4 packet via a 4to6 gateway
  - Added new tool: dump_dhcp6 - show all DHCP6 servers and their config
  - Added new script: six2four.sh - send an IPv6 packet via a 6to4 gateway
  - All flooding tools:
  - support now a specific target instead of all local nodes
  - printing a dot for each 1000 packets sent (before: 100)
  - alive6:
  - renamed option -D to -C (common address scan), -D still works too
  - added -4 IPv6address/range option
  - added -H option to print the hop count value of received packets
  - added -L option to only report local alive systems
  - added -P option to only print addresses that would be scanned, but no scanning
  - added -R option to not consider TCP-RST packets as alive signals
  - NDP alives now also get their MAC addresses printed
  - reworked help output, simple help screen with no option, full help with -h parameter
  - clarified that ranges (from-to) should not be used together with -D -M or -4
  - -W option waited for micro not milliseconds, fixed
  - flood_router26
  - added -S slow start option which makes the flooding a bit more effective
  - added -G gigantic packet option (64kb, fragmented)
  - increased number of route/prefix entries in normal (non -G option) packets
  - rewrote the help screen
  - thcsyn6:
  - changed to also allow syn flooding on link local
  - parasite6:
  - added ROUTER flag to all packets to prevent being removed from the routing list
  - trace6:
  - added -u UDP switch
  - fixed bug that showed targets sometimes too far away</changelog>
  <changelog author="mardnh@gmx.de" date="1460721600">- update to version 3.0
  - fragrouter6 (NEW TOOL)
  - evade IDS easily and use all your favorite IPv6 attack tools
  - connsplit6 (NEW TOOL)
  - split up a connection so that replies are sent to a different IPv6 address
  - *.sh
  - added a lot of shell helper scripted for zone transfers, creating maps, etc.
  - 6to4test.sh, create_network_map.sh, extract_hosts6.sh, six2four.sh,
    axfr-reverse.sh, axfr.sh, dnsrevenum6.sh, extract_networks6.sh,
    thc-ipv6-setup.sh, dnssecwalk.sh, trace62list.sh, dos_mld6.sh, local_discovery6.sh
  - alive26:
  - -r renew option was accidently always on by default
  - added -I /mask random source option
  - restructured the -h help output
  - fake_router26:
  - option -X removes router entry from targets on exit (patch from Dan Luedtke, thanks)
  - flood_router26:
  - Fix - the source mac was always null bytes without evasion, thank to Christopher Werny for reporting
  - ndpexaust26:
  - option -m generates maximum size packets
  - dump_router6:
  - fixed route option parsing
  - support for new RA options
  - dump_dhcp6
  - added vendorid support for request
  - thcping6:
  - added -O TCP Fast Open cookie request option
  - fuzz_dhcps6
  - enhancements to the help output
  - added -w sec wait between packets option
  - added more options to the solicitate request to fuzz
  - thcping6:
  - added -O TCP Fast Open cookie request option
  - thcsyn6
  - added -O TCP Fast Open fake cookie sending option
  - fixed memory leak
  - connect6:
  - will now print the known MTU path to the destination upon succesful connect
  - Renamed dos_mld.sh to dos_mld6.sh and local_discovery.sh to local_discovery6.sh
- ran spec-cleaner
- add patches:
  - thc-ipv6-obey-cflags.diff
  - thc-ipv6-use-pkgconfig-for-libnetfilter_queue-cflags.diff
  - thc-ipv6-fix-implicit-pointer-declaration.diff</changelog>
  <changelog author="mardnh@gmx.de" date="1484827200">- update to version 3.2
  * added toobigsniff6: send ICMPv6 toobig messages for sniffed traffic
  * added alive2map.sh script to create a network map (graphviz-&gt;jpg)
    from a list of alive hosts
  * alive6: fixed displaying right source of one packet type
  * dump_router6: added -S option to specify an IPv6 source address
  * fake_router26: new -f option to specify the sending mac address
  * thcsyn6: added -f and -d options
  * flood_router26:
  - added -m option to force DHCPv6 managed and other configuration
  - reduced lifetime for -s option to 1s
  * dnssecwalk: added TCP mode (-t)
  * dnsrevenum6: added TCP mode (-t)
  * fake_advertise6: a second packet always was sent with no flags. fixed.
  * flood_rs6 and thcping6: small fixes
  * re-enabled raw mode, works now with modern kernels it seems
  * small reliability patches by Benjamin Kellermann, thanks!
  * added man page auto generator by Benjamin Kellermann, thanks!
  * small change to the Makefile to allow installation even if not
    everything could be compiled (libraries missing)
- rebased patches
  * thc-ipv6-obey-cflags.diff</changelog>
  <changelog author="mardnh@gmx.de" date="1515067200">- Update to version 3.4
  * Added new function to thc-ipv6-lib: thc_send_raguard_bypass6()
    bypass attack found by ERNW in one easy function.
  * Added RA guard bypass attack (F option) to:
  - fake_router26
  - flood_router26
  - fake_advertise6
  * added new tool: flood_unreach6 (black nurse attack)
  * fake_pim6:
  - added bootstrap and assert support
  - added loop mode
  - added flood mode
  - rewrote help output
  - some fixes
  * fuzz_ip6: added PIM hello, bootstrap and assert support
  * alive6: fix for IPv6 address display for unreachable dst reason
  * implementation6: large fragmentation EH test added
  * covert_send6d: fixed receiving multiple packets
  * better automatic source adress type selection
  * added patch to support the horrible openssl-1.1 release
  * some minor enhancements and fixes
- Fix URL
- Minor specfile cleanup
- Add patch:
  * thc-ipv6-fix-build-with-recent-glibc.diff</changelog>
  <changelog author="mardnh@gmx.de" date="1546430400">- Update to version 3.6
  * long interface names are now supported.
  * added error check for openssl BN_ functions
  * added support for global destinations for dump_dhcp6
  * added new tool: connect6, useful for tcp6 connect pings
  * added -i microseconds interval option for smurf6 and thcsyn6
  * added -w timeout option to thcping6
  v3.4/v3.3-dev
  * Added new function to thc-ipv6-lib: thc_send_raguard_bypass6()
    bypass attack found by ERNW in one easy function.
  * Added RA guard bypass attack (F option) to:
  - fake_router26
  - flood_router26
  - fake_advertise6
  * added new tool: flood_unreach6 (black nurse attack)
  * fake_pim6:
  - added bootstrap and assert support
  - added loop mode
  - added flood mode
  - rewrote help output
  - some fixes
  * fuzz_ip6: added PIM hello, bootstrap and assert support
  * alive6: fix for IPv6 address display for unreachable dst reason
  * implementation6: large fragmentation EH test added
  * covert_send6d: fixed receiving multiple packets
  * better automatic source adress type selection
  * added patch to support the horrible openssl-1.1 release
  * some minor enhancements and fixes
- Removed patches:
  * thc-ipv6-obey-cflags.diff
  * thc-ipv6-fix-build-with-recent-glibc.diff</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1606737600">- Update to version 3.8
  * fixed crash in thcping6 with -n 0 or larger values
  * fixed minor issues
  * honors now CC and CLAGS environment variables and compiles
    with clang
  * fixed various issues
  * new code indention
- Drop not longer needed patches:
  * thc-ipv6-use-pkgconfig-for-libnetfilter_queue-cflags.diff
  * thc-ipv6-fix-implicit-pointer-declaration.diff</changelog>
</package>
<package pkgid="3e1cb640155442653f19f8ec6dbf026428a512130a8805fccf395f41fde3c48741a78792851231966855d9876c0def693e4041572e2ef41a9bf2e6b75f32d7b4" name="thc-ipv6" arch="src">
  <version epoch="0" ver="3.8" rel="1.65"/>
  <changelog author="Sven Uebelacker &lt;sven@uebelacker.net&gt; 1.6" date="1305806400">- initial openSUSE port</changelog>
  <changelog author="Sven Uebelacker &lt;sven@uebelacker.net&gt; 1.8" date="1314014400">- updated to version 1.8: new tools, manpages, and options
- detailed Changelog here: /usr/share/doc/packages/thc-ipv6/CHANGES</changelog>
  <changelog author="Sven Uebelacker &lt;sven@uebelacker.net&gt; 1.9" date="1348488000">- updated to version 1.9
  - new tools: detect_sniffer6, fake_router26, dnsrevenum6,
    inverse_lookup6, fake_solicitate6, address6, passive_discovery6
  - updated tools
  - code cleanup
- detailed Changelog here: /usr/share/doc/packages/thc-ipv6/CHANGES</changelog>
  <changelog author="Sven Uebelacker &lt;sven@uebelacker.net&gt; 2.0" date="1350302400">- updated to version 2.0
  - new tools: alive6, flood_router26
  - enhancement of trace6, thcping6, etc.
- patch for Makefile added (thcping6 double definition)</changelog>
  <changelog author="Sven Uebelacker &lt;sven@uebelacker.net&gt; 2.1" date="1356696000">- updated to version 2.1
  - added new tool: dnssecwalk - performs NSEC walking including IPv6+IPv4
    resolving
  - added new tool: firewall6 - various TCP/UDP ACL bypass test cases
  - added new tool: fake_pim6 - send fake hello and join/prune pim messages
  - added new tool: ndpexhaust26 - very performant ndp exhauster based on ICMP
    error toobig messages but can send many types of packets
  - alive6: ranges are now supported in the input file too
  - parasite6: enhancements to make it way more effective
  - fake_router26: added overlap RA guard evasion type (-E o, -E O)
  - dos-new-ip6: fix that only DAD replies are sent, not full NDP spoofing :-)
    (thanks to Johannes Weber for reporting)
  - flood_router26: Added local LAN privacy extension prevention attack by
    George Kargiotakis
  - randicmp6:
  - added function which dumps icmp answers received
  - added funtionality to send a specific type (and also code)
  - dnsdict6: added SRV result address resolving
  - trace6: fix for routers which add padding to the packets
  - fuzz_ip6: added -X option for not sending a transport layer
  - inject_alive6: added -a option to allow selective active alive sending
  - fake_advertise6: when no srcmac was specified, it was sent as all zeroes
    instead of the real mac (thanks to Jannes Weber for reporting)
  - fixed various injection issues (mostly too large packets for MTU on
    interface)
  - thc-ipv6-lib: added function thc_send_as_overlapping_{first,last}_fragment6
  - Added GPL exception clause to license to allow linking to OpenSSL - debian
    people need this
  - Makefile: added patch from gentoo maintainers</changelog>
  <changelog author="Sven Uebelacker &lt;sven@uebelacker.net&gt; 2.3" date="1381924800">- updated to version 2.3
  - Added new tool: thcsyn5 - a TCP flooding tool
  - Added new tool: redirsniff6 - redirects traffic (sniff variant to redir6)
  - Added new script: thc-ipv6-setup.sh - configuring Linux for thc-ipv6
  - Added new script: 6to4test.sh - check an ipv4 address for dynamic 6to4 tunnel setup
  - flood_router26: added -s option for small lifetime which makes the attack even more devasting
  - trace6:
  - added -B option for sending echo reply packets (will not show the destination)
  - added -E option for sending destination headers with invalid option
  - thcping6:
  - -U/-S port options now also set the source port
  - -U/-S options now also send data if given
  - -f fragment option can now be used multiple times
  - implementation6:
  - fixed bug in test case
  - added icmp6 type/code printing for error replies
  - toobig6: added -u option to allow testing for unrelated ICMPv6 packet firewall bypasses
  - firewall6: added more test cases
  - thc-ipv6-lib:
  - fixed address selection bug if global and ULA addresses are present
  - change NDP to use ff02::1:ffxx:xxx limited multicast addresses
  - thc_resolve6 ignores now anything after a "/" or in before/after "[]"</changelog>
  <changelog author="Sven Uebelacker &lt;sven@uebelacker.net&gt; - 2.7" date="1421409600">- updated to version 2.7
- changes from 2.3 to 2.7
  - All flood_* tools:
  - changed destination so that targets can be remote.
    Yes this should not work, but sometimes it does :-)
  - New tool: fuzz_dhcpc6 - DHCPv6 client fuzzer, submitted by Darrell Ambro, thanks a lot!
  - Added new script: six2four.sh - send an IPv6 packet via a 6to4 gateway
  - Added new script: grep6.pl - extracts an IPv6 in all possible notations from a file (from Eric Vyncke)
  - alive6:
  - setting -C twice increases the common address search space significantly
  - fixed from-to definition implementation
  - added "-y step" option, to define the step range when performing from-to
    scans (e.g. 2001:1::0-ff), default step range is of course 1, max is 256
  - selects the source IPv6 address for every new target now; waiting, if no
    fitting IPv6 address is present on the interface until one is
  - if you use -s for alive scanning, the new "one packet fingerprinting" functionality
    is automatically used, courtesy of warlord @ nologin from his poison tool
  - error message if a packet can not be send for &gt;50ms, and waiting for 60 seconds
  - cleaned up help output and add -hh more help/options output
  - thcsyn6:
  - added -m dstmac option (good for DOSing local, esp. hot standby addresses)
  - added -d dst hdr option
  - documented -a hbh-ra option
  - denial6:
  - added five more test cases with HBH-RA and AH headers
  - flood_router26
  - added -a hopbyhop with router alert option
  - changed a default so the attacks do not show up in Snort IDS
  - flood_redir6
  - added -a hopbyhop with router alert option
  - flood_solicitate6
  - added query address parameter option
  - added -a hopbyhop with router alert option
  - fuzz_ip6:
  - fixes for HBH and DST EH fuzzing
  - thcping6:
  - added -x flood option
  - added -e ethertype option
  - added -V IP version option
  - added -L payload length option
  - added -N next header option
  - now prints fragID of fragmented replies
  - implementation6:
  - a few more test cases and fixes
  - dump_dhcp6
  - more option decoding, better solicitate packet
  - added sending information request packet
  - four2six:
  - support for source port and ping ID (required for AFTR)
  - trace6:
  - support for MTU sizes &gt; 2500 added
  - implementation6
  - fixed to test cases where the wrong fragment nxt header was set (thanks to Gabriel Bertram for reporting)
  - inverse_lookup6
  - fixed to display only the IPv6 addresses (and not interpret other data as such)
  - thc-ipv6-lib
  - global addresses are now prefered over unique local if no destination is set
  - fixed a bug in IPv4 CRC calculation function
  - cppcheck and Coverity issues checked and fixed
  - added spelling fixes by Debian maintainers
  - Moved the license from GPLv3 to AGPLv3 (see LICENSE file)
  - Support for big endian processors added
  - Added new tool: fuzz_dhcps6 - DHCPv6 server fuzzer. Submitted by Brandon
    Hutcheson and Graeme Neilson - great job, thanks!
  - Added new tool: flood_redir6 - flooding with ICMPv6 redirects
  - Added new tool: flood_rs6 - flooding with ICMPv6 Router Soliciations
  - Added new tool: four2six - send an IPv4 packet via a 4to6 gateway
  - Added new tool: dump_dhcp6 - show all DHCP6 servers and their config
  - Added new script: six2four.sh - send an IPv6 packet via a 6to4 gateway
  - All flooding tools:
  - support now a specific target instead of all local nodes
  - printing a dot for each 1000 packets sent (before: 100)
  - alive6:
  - renamed option -D to -C (common address scan), -D still works too
  - added -4 IPv6address/range option
  - added -H option to print the hop count value of received packets
  - added -L option to only report local alive systems
  - added -P option to only print addresses that would be scanned, but no scanning
  - added -R option to not consider TCP-RST packets as alive signals
  - NDP alives now also get their MAC addresses printed
  - reworked help output, simple help screen with no option, full help with -h parameter
  - clarified that ranges (from-to) should not be used together with -D -M or -4
  - -W option waited for micro not milliseconds, fixed
  - flood_router26
  - added -S slow start option which makes the flooding a bit more effective
  - added -G gigantic packet option (64kb, fragmented)
  - increased number of route/prefix entries in normal (non -G option) packets
  - rewrote the help screen
  - thcsyn6:
  - changed to also allow syn flooding on link local
  - parasite6:
  - added ROUTER flag to all packets to prevent being removed from the routing list
  - trace6:
  - added -u UDP switch
  - fixed bug that showed targets sometimes too far away</changelog>
  <changelog author="mardnh@gmx.de" date="1460721600">- update to version 3.0
  - fragrouter6 (NEW TOOL)
  - evade IDS easily and use all your favorite IPv6 attack tools
  - connsplit6 (NEW TOOL)
  - split up a connection so that replies are sent to a different IPv6 address
  - *.sh
  - added a lot of shell helper scripted for zone transfers, creating maps, etc.
  - 6to4test.sh, create_network_map.sh, extract_hosts6.sh, six2four.sh,
    axfr-reverse.sh, axfr.sh, dnsrevenum6.sh, extract_networks6.sh,
    thc-ipv6-setup.sh, dnssecwalk.sh, trace62list.sh, dos_mld6.sh, local_discovery6.sh
  - alive26:
  - -r renew option was accidently always on by default
  - added -I /mask random source option
  - restructured the -h help output
  - fake_router26:
  - option -X removes router entry from targets on exit (patch from Dan Luedtke, thanks)
  - flood_router26:
  - Fix - the source mac was always null bytes without evasion, thank to Christopher Werny for reporting
  - ndpexaust26:
  - option -m generates maximum size packets
  - dump_router6:
  - fixed route option parsing
  - support for new RA options
  - dump_dhcp6
  - added vendorid support for request
  - thcping6:
  - added -O TCP Fast Open cookie request option
  - fuzz_dhcps6
  - enhancements to the help output
  - added -w sec wait between packets option
  - added more options to the solicitate request to fuzz
  - thcping6:
  - added -O TCP Fast Open cookie request option
  - thcsyn6
  - added -O TCP Fast Open fake cookie sending option
  - fixed memory leak
  - connect6:
  - will now print the known MTU path to the destination upon succesful connect
  - Renamed dos_mld.sh to dos_mld6.sh and local_discovery.sh to local_discovery6.sh
- ran spec-cleaner
- add patches:
  - thc-ipv6-obey-cflags.diff
  - thc-ipv6-use-pkgconfig-for-libnetfilter_queue-cflags.diff
  - thc-ipv6-fix-implicit-pointer-declaration.diff</changelog>
  <changelog author="mardnh@gmx.de" date="1484827200">- update to version 3.2
  * added toobigsniff6: send ICMPv6 toobig messages for sniffed traffic
  * added alive2map.sh script to create a network map (graphviz-&gt;jpg)
    from a list of alive hosts
  * alive6: fixed displaying right source of one packet type
  * dump_router6: added -S option to specify an IPv6 source address
  * fake_router26: new -f option to specify the sending mac address
  * thcsyn6: added -f and -d options
  * flood_router26:
  - added -m option to force DHCPv6 managed and other configuration
  - reduced lifetime for -s option to 1s
  * dnssecwalk: added TCP mode (-t)
  * dnsrevenum6: added TCP mode (-t)
  * fake_advertise6: a second packet always was sent with no flags. fixed.
  * flood_rs6 and thcping6: small fixes
  * re-enabled raw mode, works now with modern kernels it seems
  * small reliability patches by Benjamin Kellermann, thanks!
  * added man page auto generator by Benjamin Kellermann, thanks!
  * small change to the Makefile to allow installation even if not
    everything could be compiled (libraries missing)
- rebased patches
  * thc-ipv6-obey-cflags.diff</changelog>
  <changelog author="mardnh@gmx.de" date="1515067200">- Update to version 3.4
  * Added new function to thc-ipv6-lib: thc_send_raguard_bypass6()
    bypass attack found by ERNW in one easy function.
  * Added RA guard bypass attack (F option) to:
  - fake_router26
  - flood_router26
  - fake_advertise6
  * added new tool: flood_unreach6 (black nurse attack)
  * fake_pim6:
  - added bootstrap and assert support
  - added loop mode
  - added flood mode
  - rewrote help output
  - some fixes
  * fuzz_ip6: added PIM hello, bootstrap and assert support
  * alive6: fix for IPv6 address display for unreachable dst reason
  * implementation6: large fragmentation EH test added
  * covert_send6d: fixed receiving multiple packets
  * better automatic source adress type selection
  * added patch to support the horrible openssl-1.1 release
  * some minor enhancements and fixes
- Fix URL
- Minor specfile cleanup
- Add patch:
  * thc-ipv6-fix-build-with-recent-glibc.diff</changelog>
  <changelog author="mardnh@gmx.de" date="1546430400">- Update to version 3.6
  * long interface names are now supported.
  * added error check for openssl BN_ functions
  * added support for global destinations for dump_dhcp6
  * added new tool: connect6, useful for tcp6 connect pings
  * added -i microseconds interval option for smurf6 and thcsyn6
  * added -w timeout option to thcping6
  v3.4/v3.3-dev
  * Added new function to thc-ipv6-lib: thc_send_raguard_bypass6()
    bypass attack found by ERNW in one easy function.
  * Added RA guard bypass attack (F option) to:
  - fake_router26
  - flood_router26
  - fake_advertise6
  * added new tool: flood_unreach6 (black nurse attack)
  * fake_pim6:
  - added bootstrap and assert support
  - added loop mode
  - added flood mode
  - rewrote help output
  - some fixes
  * fuzz_ip6: added PIM hello, bootstrap and assert support
  * alive6: fix for IPv6 address display for unreachable dst reason
  * implementation6: large fragmentation EH test added
  * covert_send6d: fixed receiving multiple packets
  * better automatic source adress type selection
  * added patch to support the horrible openssl-1.1 release
  * some minor enhancements and fixes
- Removed patches:
  * thc-ipv6-obey-cflags.diff
  * thc-ipv6-fix-build-with-recent-glibc.diff</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1606737600">- Update to version 3.8
  * fixed crash in thcping6 with -n 0 or larger values
  * fixed minor issues
  * honors now CC and CLAGS environment variables and compiles
    with clang
  * fixed various issues
  * new code indention
- Drop not longer needed patches:
  * thc-ipv6-use-pkgconfig-for-libnetfilter_queue-cflags.diff
  * thc-ipv6-fix-implicit-pointer-declaration.diff</changelog>
</package>
<package pkgid="fde9cbbfe0f657dea130b6e187f9ff2c820761422f2174dd6afb44e8749e8e62fa2ebedec4ecc2368f18a16fe8ffc767af6aa4cca1c66d367736257711d40a08" name="tinyca2" arch="noarch">
  <version epoch="0" ver="0.7.5" rel="128.5"/>
  <changelog author="lnussel@suse.de" date="1121083200">- update to tinyca2 version 0.7.0</changelog>
  <changelog author="mmarek@suse.cz" date="1125403200">- Use the OO interface of Locale::gettext, which converts strings
  into Perl's internal encoding, so that Gtk widgets are displayed
  correctly (#95903).</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="lnussel@suse.de" date="1152014400">- new version 0.7.4
  * fix some crashes
  * fix problems with umlauts
  * fix crl handling with different openssl versions</changelog>
  <changelog author="crrodriguez@suse.de" date="1205668800">- fix file-not-in-lang rpmlint warnings</changelog>
  <changelog author="lnussel@suse.de" date="1295092800">- add support for Microsoft extendedKeyUsage attributes
- fix combobox strings for extended key usage</changelog>
  <changelog author="lnussel@suse.de" date="1309867200">- move locales to system dir to avoid not owned directories</changelog>
  <changelog author="lnussel@suse.de" date="1385726400">- fix tinyca not starting up (bnc#848907) and some deprecation warnings
  0001-fix-paranthesis-use.diff
  0002-fix-deprecation-warning.diff
  0003-fix-compatibility-with-openssl-1.0.1.diff</changelog>
  <changelog author="gatherer@rursee.net" date="1538740800">- fix perl decprecation defined on hash/array types (boo#1072060,
  0004-fix-perl-deprecation-defined.diff)</changelog>
  <changelog author="lnussel@suse.de" date="1538740801">- run spec-cleaner</changelog>
</package>
<package pkgid="b892d5773cd2f883482b3b142f561db11926de6e50dc9ccf6055e811b8513b4ba88d7e428b424e9af946aa530bf0402dcf7450d28761773a56f89aa3a7159cf5" name="tinyca2" arch="src">
  <version epoch="0" ver="0.7.5" rel="128.5"/>
  <changelog author="lnussel@suse.de" date="1061985600">- new version 0.5.1</changelog>
  <changelog author="lnussel@suse.de" date="1062504000">- new version 0.5.2 allows renewal of certificates</changelog>
  <changelog author="adrian@suse.de" date="1062936000">- add Categories</changelog>
  <changelog author="lnussel@suse.de" date="1065700800">- new version 0.5.4</changelog>
  <changelog author="hmacht@suse.de" date="1076068800">- building as non-root (#norootforbuild)</changelog>
  <changelog author="lnussel@suse.de" date="1090238400">- new version 0.6.4</changelog>
  <changelog author="lnussel@suse.de" date="1091707200">- new version 0.6.5</changelog>
  <changelog author="mskibbe@suse.de" date="1096027200">- change desktop files</changelog>
  <changelog author="lnussel@suse.de" date="1101729600">- new version 0.6.6</changelog>
  <changelog author="lnussel@suse.de" date="1110974400">- Use desktop file from package (fixes #72277)</changelog>
  <changelog author="lnussel@suse.de" date="1121083200">- update to tinyca2 version 0.7.0</changelog>
  <changelog author="mmarek@suse.cz" date="1125403200">- Use the OO interface of Locale::gettext, which converts strings
  into Perl's internal encoding, so that Gtk widgets are displayed
  correctly (#95903).</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="lnussel@suse.de" date="1152014400">- new version 0.7.4
  * fix some crashes
  * fix problems with umlauts
  * fix crl handling with different openssl versions</changelog>
  <changelog author="crrodriguez@suse.de" date="1205668800">- fix file-not-in-lang rpmlint warnings</changelog>
  <changelog author="lnussel@suse.de" date="1295092800">- add support for Microsoft extendedKeyUsage attributes
- fix combobox strings for extended key usage</changelog>
  <changelog author="lnussel@suse.de" date="1309867200">- move locales to system dir to avoid not owned directories</changelog>
  <changelog author="lnussel@suse.de" date="1385726400">- fix tinyca not starting up (bnc#848907) and some deprecation warnings
  0001-fix-paranthesis-use.diff
  0002-fix-deprecation-warning.diff
  0003-fix-compatibility-with-openssl-1.0.1.diff</changelog>
  <changelog author="gatherer@rursee.net" date="1538740800">- fix perl decprecation defined on hash/array types (boo#1072060,
  0004-fix-perl-deprecation-defined.diff)</changelog>
  <changelog author="lnussel@suse.de" date="1538740801">- run spec-cleaner</changelog>
</package>
<package pkgid="77a8f507bde0feb4590764c5e9d42be75bc3c08dc7ce75f8863e759a2c2384550c0315c29157b426cc699e9727cff6f03756ce9068135383d43b54b3fc4e9bf8" name="tomb" arch="noarch">
  <version epoch="0" ver="2.10" rel="1.7"/>
  <changelog author="fcastelli@suse.com" date="1421236800">- Created initial package (2.0.1)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1422446400">- verify source signature
- add source URLs
- run spec cleaner</changelog>
  <changelog author="fcastelli@suse.com" date="1452859200">- Update to version 2.2:
  * Better resizing procedure recovers from failure without starting over with
    a new dig.
  * Fixes for correct handling of bind-hooks mountpoints containing whitespaces,
    implying a refactoring of how the mtab is parsed, along with workaround for
    Debian bugs.
  * Updated all strings to report MiB sizes.
  * Fix to correctly show last time opened.
  * Fix to EUID detection and to installed manpage permissions.
- Changes introduced by version 2.1.1:
  * Added translations to Italian and Swedish. Minor documentation updates.
- Changes introduced by version 2.1.0:
  * This new stable release including several bugfixes to smooth the user
    experience in various situations.
  * Documentation is reviewed and extended and translations are updated.
  * Fixes to: mountpoint removal, language localization, gtk-2 pinentry
    themeing, udisk2 compatibility (/run/media/$USER mountpoint support),
    handling of key failures, kdf documentation, swish-e file contents search
    and encrypted swap detection.
  * Deniability is improved by allowing any filename to be used for tombs
    (also without .tomb extension).
  * Code has been overall cleaned up.</changelog>
  <changelog author="aavindraa@gmail.com" date="1508328000">- Packaging changes:
  * Upstream URL casing has changed, fix download urls to reflect this.
  * Use Makefile to install
  * lint with spec-cleaner
- Update to version 2.4:
  * Support for asymmetric encryption of Tomb keys using public/private
  GPG key pairs.
  * It is now possible to protect a Tomb key using a GPG key
  (which can also be password-less for automations) as well encrypt a
  Tomb key for multiple recipients (list of GPG ids).
  * Fix to the 'slam' command with better detection of running programs
  using 'lsof' (new optional dependency)
  * Fix to 'forge' key creation to really use 512 bits long keys to really
  trigger usage of AES256; correct support for opening tombs in read-only
  mode; update of the Tomber python wrapper in extras.
  * Documentation updates.
- Changes introduced by version 2.3:
  * Fix bug occurring when using ZSh version 5.3 or higher.
  * Fix inclusion of final newline in keys generated with 2.2, only affecting
  third-party software.
  * Removed chmod/chown of tombs when open.
  * Improved parser and post-hooks to avoid usage of external binaries (grep and
  cat)
  * Improved security when decrypting keys.
  * Fix for clean execution via sudo nopasswd.
  * Updated extras/gtomb to latest stable version.
  * Various documentation updates about kdf, using images as keys, deniability
  and gpg-agent usage.
  * New experimental port to Android platforms in extras.</changelog>
  <changelog author="avindra@opensuse.org" date="1515067200">- Update to version 2.5:
  * Restore (from v2.3) ownership change of all files inside tombs,
    to facilitate single user usage, which is now default and can
    be prevented using the '-p' flag on 'open' commands.
  * 'post-hooks' now renamed to 'exec-hooks' and launched on 'open'
    and 'close' commands with a defined set of arguments
  * Use 'findmnt' instead of parsing the output of 'mount -l',
    which grants compatibility with more recent util-linux versions
  * fix: the 'slam' command has better process detection and the
    a new 'ps' command to list processes using tombs
  * fix: support tomb hidden filenames (starting with a dot) that
    lack an extension
  * minor fixes to messaging and translations
- bump year in SUSE copyright</changelog>
  <changelog author="Flavio Castelli &lt;fcastelli@suse.com&gt;" date="1594123200">- Update to version 2.7:
  * Fixed getent parsing of passwd and notation of conditionals
    normalised.  A few other minor fixes and documentation improvements.
- Changes from version 2.6:
  * This release adds new features and provides an important fix for usage
    of Tomb with cryptsetup 2.1 and future versions
  * fixes a whitespace bug in KDF passwords, all fixes are documented in
    KNOWN_BUGS.
  * A notable new feature is the libsphinx integration for
    password-authenticated key agreement (PAKE).
  * Integration of cloakify to support new cloak/uncloak commands that
    hide keys inside long text files. Also support for gpg sub-keys has
    been added and overall gpg asymmetric key protection is improved.
- Bump year in SUSE copyright
- Add patch `fix-env-script-interpreter-rpm-error.patch`: needed to
  solve a RPM lint error of type `fix-env-script-interpreter`</changelog>
  <changelog author="Flavio Castelli &lt;fcastelli@suse.com&gt;" date="1697544000">- Update to 2.10:
  * This release adds optional support for Argon2 KDF brute-force
    protection and introduces support for doas as an alternative to sudo
    for privilege escalation. It also improves support for BTRFS formatted
    Tombs, adds zram detection as swap memory, updates documentation and
    translations and cleans up the script code.
- Update to 2.9:
  * This release fixes all bugs introduced by the unfortunate 2.8 release
    series in 2020 as well introduces support for BTRFS formatted
    Tombs. The fixes are for password insertion to work on all desktops,
    as well the fix to a regression when using old Zsh versions. The new
    feature is activated by the '--filesystem' flag on 'lock' commands.
    It only supports BTRFS as internal filesystem of a Tomb instead of the
    default EXT4; resizing works as well to create and send or receive
    subvolumes and snapshots inside a Tomb. There are also some cleanups,
    small error handling improvements and no more need for suid actions by
    'forge' and 'dig' commands.
- Update to 2.8.1:
  * This is a minor bugfix release. It fixes two bugs introduced by the
    previous release: the release of loopback devices and a typo affecting
    password insertion in text-only mode. It also provides a cosmetic fix
    for the output of 'tomb list' that now displays correct sizes. At
    last, the docker wrapper has been included in extras/ to be shipped in
    Tomb. The span of CVE-2020-28638 has been assessed with more precision
    and KNOWN_BUGS updated accordingly.
- Update to 2.8:
  * This new release updates the documentation, improves usability and
    fixes two bugs. A bug has been found (CVE-2020-28638) to corrupt
    passwords entered using pinentry-curses on desktops using a X11
    DISPLAY, the documentation in KNOWN_BUGS outlines how to fix
    regressions. Another bug has been fixed to prevent mounting tombs that
    are already opened, a situation leading to potential data loss.
    Changes mentioned lead to a small internal refactoring and cleanup,
    leading to a change in the way volumes appear in /dev/mapper. Along
    the usability improvements are the support of GNUPGHOME environment
    variable to support non-standard GnuPG home locations as well updated
    translations and the fact that debug messages are now written to
    stderr, making it easier to parse stdout.</changelog>
</package>
<package pkgid="ed3ec511293edcb6fb9402911b3364e6608437de1d753b82361256b859cde1eba981e3ce6f517356542179f1f7ad9b98c63ef585269978afe2fd81264ad009f6" name="tomb" arch="src">
  <version epoch="0" ver="2.10" rel="1.7"/>
  <changelog author="fcastelli@suse.com" date="1421236800">- Created initial package (2.0.1)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1422446400">- verify source signature
- add source URLs
- run spec cleaner</changelog>
  <changelog author="fcastelli@suse.com" date="1452859200">- Update to version 2.2:
  * Better resizing procedure recovers from failure without starting over with
    a new dig.
  * Fixes for correct handling of bind-hooks mountpoints containing whitespaces,
    implying a refactoring of how the mtab is parsed, along with workaround for
    Debian bugs.
  * Updated all strings to report MiB sizes.
  * Fix to correctly show last time opened.
  * Fix to EUID detection and to installed manpage permissions.
- Changes introduced by version 2.1.1:
  * Added translations to Italian and Swedish. Minor documentation updates.
- Changes introduced by version 2.1.0:
  * This new stable release including several bugfixes to smooth the user
    experience in various situations.
  * Documentation is reviewed and extended and translations are updated.
  * Fixes to: mountpoint removal, language localization, gtk-2 pinentry
    themeing, udisk2 compatibility (/run/media/$USER mountpoint support),
    handling of key failures, kdf documentation, swish-e file contents search
    and encrypted swap detection.
  * Deniability is improved by allowing any filename to be used for tombs
    (also without .tomb extension).
  * Code has been overall cleaned up.</changelog>
  <changelog author="aavindraa@gmail.com" date="1508328000">- Packaging changes:
  * Upstream URL casing has changed, fix download urls to reflect this.
  * Use Makefile to install
  * lint with spec-cleaner
- Update to version 2.4:
  * Support for asymmetric encryption of Tomb keys using public/private
  GPG key pairs.
  * It is now possible to protect a Tomb key using a GPG key
  (which can also be password-less for automations) as well encrypt a
  Tomb key for multiple recipients (list of GPG ids).
  * Fix to the 'slam' command with better detection of running programs
  using 'lsof' (new optional dependency)
  * Fix to 'forge' key creation to really use 512 bits long keys to really
  trigger usage of AES256; correct support for opening tombs in read-only
  mode; update of the Tomber python wrapper in extras.
  * Documentation updates.
- Changes introduced by version 2.3:
  * Fix bug occurring when using ZSh version 5.3 or higher.
  * Fix inclusion of final newline in keys generated with 2.2, only affecting
  third-party software.
  * Removed chmod/chown of tombs when open.
  * Improved parser and post-hooks to avoid usage of external binaries (grep and
  cat)
  * Improved security when decrypting keys.
  * Fix for clean execution via sudo nopasswd.
  * Updated extras/gtomb to latest stable version.
  * Various documentation updates about kdf, using images as keys, deniability
  and gpg-agent usage.
  * New experimental port to Android platforms in extras.</changelog>
  <changelog author="avindra@opensuse.org" date="1515067200">- Update to version 2.5:
  * Restore (from v2.3) ownership change of all files inside tombs,
    to facilitate single user usage, which is now default and can
    be prevented using the '-p' flag on 'open' commands.
  * 'post-hooks' now renamed to 'exec-hooks' and launched on 'open'
    and 'close' commands with a defined set of arguments
  * Use 'findmnt' instead of parsing the output of 'mount -l',
    which grants compatibility with more recent util-linux versions
  * fix: the 'slam' command has better process detection and the
    a new 'ps' command to list processes using tombs
  * fix: support tomb hidden filenames (starting with a dot) that
    lack an extension
  * minor fixes to messaging and translations
- bump year in SUSE copyright</changelog>
  <changelog author="Flavio Castelli &lt;fcastelli@suse.com&gt;" date="1594123200">- Update to version 2.7:
  * Fixed getent parsing of passwd and notation of conditionals
    normalised.  A few other minor fixes and documentation improvements.
- Changes from version 2.6:
  * This release adds new features and provides an important fix for usage
    of Tomb with cryptsetup 2.1 and future versions
  * fixes a whitespace bug in KDF passwords, all fixes are documented in
    KNOWN_BUGS.
  * A notable new feature is the libsphinx integration for
    password-authenticated key agreement (PAKE).
  * Integration of cloakify to support new cloak/uncloak commands that
    hide keys inside long text files. Also support for gpg sub-keys has
    been added and overall gpg asymmetric key protection is improved.
- Bump year in SUSE copyright
- Add patch `fix-env-script-interpreter-rpm-error.patch`: needed to
  solve a RPM lint error of type `fix-env-script-interpreter`</changelog>
  <changelog author="Flavio Castelli &lt;fcastelli@suse.com&gt;" date="1697544000">- Update to 2.10:
  * This release adds optional support for Argon2 KDF brute-force
    protection and introduces support for doas as an alternative to sudo
    for privilege escalation. It also improves support for BTRFS formatted
    Tombs, adds zram detection as swap memory, updates documentation and
    translations and cleans up the script code.
- Update to 2.9:
  * This release fixes all bugs introduced by the unfortunate 2.8 release
    series in 2020 as well introduces support for BTRFS formatted
    Tombs. The fixes are for password insertion to work on all desktops,
    as well the fix to a regression when using old Zsh versions. The new
    feature is activated by the '--filesystem' flag on 'lock' commands.
    It only supports BTRFS as internal filesystem of a Tomb instead of the
    default EXT4; resizing works as well to create and send or receive
    subvolumes and snapshots inside a Tomb. There are also some cleanups,
    small error handling improvements and no more need for suid actions by
    'forge' and 'dig' commands.
- Update to 2.8.1:
  * This is a minor bugfix release. It fixes two bugs introduced by the
    previous release: the release of loopback devices and a typo affecting
    password insertion in text-only mode. It also provides a cosmetic fix
    for the output of 'tomb list' that now displays correct sizes. At
    last, the docker wrapper has been included in extras/ to be shipped in
    Tomb. The span of CVE-2020-28638 has been assessed with more precision
    and KNOWN_BUGS updated accordingly.
- Update to 2.8:
  * This new release updates the documentation, improves usability and
    fixes two bugs. A bug has been found (CVE-2020-28638) to corrupt
    passwords entered using pinentry-curses on desktops using a X11
    DISPLAY, the documentation in KNOWN_BUGS outlines how to fix
    regressions. Another bug has been fixed to prevent mounting tombs that
    are already opened, a situation leading to potential data loss.
    Changes mentioned lead to a small internal refactoring and cleanup,
    leading to a change in the way volumes appear in /dev/mapper. Along
    the usability improvements are the support of GNUPGHOME environment
    variable to support non-standard GnuPG home locations as well updated
    translations and the fact that debug messages are now written to
    stderr, making it easier to parse stdout.</changelog>
</package>
<package pkgid="06b19e759a9d656a05581c64cff70682c8ae9b9c2571d0ea1dab50c8d80b466fe37a8d9dd2bfeb42b37a18cc26f3b70031517fae4f07d797f0c55bbaa7daca2f" name="tomoyo-tools" arch="s390x">
  <version epoch="0" ver="2.6.1.20210910" rel="186.64"/>
  <changelog author="meissner@suse.de" date="1295092800">- initial packaging of the tomoyo userland utilities.</changelog>
  <changelog author="meissner@suse.de" date="1309262400">- Update to 20110511 snapshot:
  * Version 2.3.0p1 2011/02/11   Bugfix release.
    /sbin/tomoyo-init
    Mount sysfs when /sys/kernel/security/ does not exist rather than when /sys/kernel/ does not exist, for some distributions have /sys/kernel/debug/ on root device.
    Wait for /etc/tomoyo/tomoyo-post-init in a more reliable way.
    /usr/sbin/tomoyo-diffpolicy
    Fix regression introduced when fixing old/new inversion bug.
  * Version 2.3.0p2 2011/05/11   Minor update release.
    Fix build error on parallel build.
    /usr/lib/libtomoyotools.so.1
    Fix wrong domainname validation.
    /usr/sbin/tomoyo-editpolicy
    Allow configuring background color.</changelog>
  <changelog author="aj@suse.de" date="1314619200">- _GNU_SOURCE needs to be defined first, fix build
  (patch tomoyo-clone.patch)</changelog>
  <changelog author="meissner@suse.com" date="1319025600">- Updated to 2.4.0-20110929 snapshot necessary to work with 12.1
  - lots of bugfixes
  - adjustments to current kernel
  - auditing helps</changelog>
  <changelog author="sbrabec@suse.cz" date="1354190400">- Verify GPG signature.</changelog>
  <changelog author="meissner@suse.com" date="1359460800">- Updated to 2.5.0-20120805 snapshot to work with newer kernels
  bnc#800993
  - Rebased using ccs-tools-1.8.3.
  - /usr/sbin/tomoyo-queryd
    Use query id rather than global PID when reading or updating target
    process's domain policy.
  - /usr/lib/tomoyo/init_policy
    Add "socket:[family=\\$:type=\\$:protocol=\\$]" to ANY_PATHNAME group.
  - /sbin/tomoyo-init
    Parse statistics lines correctly.
  - /usr/sbin/tomoyo-editpolicy
    Print number of selected entries if any.
  - /usr/lib/libtomoyotools.so
    Fix IP address parsing.
  - /usr/sbin/tomoyo-checkpolicy
    Fix namespace prefix parsing in exception policy.
  - Rename manpage for init_policy to tomoyo_init_policy
    (to allow parallel installation of ccs-tools package).</changelog>
  <changelog author="p.drouand@gmail.com" date="1428408000">- Update to version 2.5.0-20140601
  * /usr/sbin/tomoyo-editpolicy
    Print "acl_group $N" correctly when using offline mode.
- Changes from version 20140105
  * /usr/lib/tomoyo/init_policy
    Add path to systemd.
  * /usr/sbin/tomoyo-queryd
    Use poll() rather than select().
- Changes from version 20130406
  * Fix compile warning from clang.
- Changes from version 20130214
  * Change Makefile's build flags (fix bdo#674723)
  * Change / to /* in rpm's %files section because Fedora 18 complains
    conflicts.
- Remove gpg verify requirement; obs handles it</changelog>
  <changelog author="dgutu@suse.com" date="1432641600">- Spec-cleaner cleanup</changelog>
  <changelog author="meissner@suse.com" date="1433851200">- tomoyo-tools.keyring: use new key from upstream maintainer</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1632916800">- updated to 2.6.1-20210910
  - Add -DNCURSES_WIDECHAR=0 to programs using ncurses library.
  - Loosen pathname/domainname validation.
  - Limit wildcard recursion depth.
  - Remove "socket:[family=\\$:type=\\$:protocol=\\$]" from ANY_PATHNAME group.
  - Adjust to TOMOYO 2.6.
  - Rebase to ccs-tools 1.8.5-2.
- moved /sbin/tomoyo-init binary to /usr/sbin/tomoyo-init (bsc#1191101)</changelog>
</package>
<package pkgid="cd6a3f0cba65d2579b2f35b748c5d90213cfa76623bd26235da3a7bf7516854b36a9c333851a8b156562aad72a664a2fee0cb37c9ca5a130be4fc37581c6f54d" name="tomoyo-tools" arch="src">
  <version epoch="0" ver="2.6.1.20210910" rel="186.64"/>
  <changelog author="meissner@suse.de" date="1295092800">- initial packaging of the tomoyo userland utilities.</changelog>
  <changelog author="meissner@suse.de" date="1309262400">- Update to 20110511 snapshot:
  * Version 2.3.0p1 2011/02/11   Bugfix release.
    /sbin/tomoyo-init
    Mount sysfs when /sys/kernel/security/ does not exist rather than when /sys/kernel/ does not exist, for some distributions have /sys/kernel/debug/ on root device.
    Wait for /etc/tomoyo/tomoyo-post-init in a more reliable way.
    /usr/sbin/tomoyo-diffpolicy
    Fix regression introduced when fixing old/new inversion bug.
  * Version 2.3.0p2 2011/05/11   Minor update release.
    Fix build error on parallel build.
    /usr/lib/libtomoyotools.so.1
    Fix wrong domainname validation.
    /usr/sbin/tomoyo-editpolicy
    Allow configuring background color.</changelog>
  <changelog author="aj@suse.de" date="1314619200">- _GNU_SOURCE needs to be defined first, fix build
  (patch tomoyo-clone.patch)</changelog>
  <changelog author="meissner@suse.com" date="1319025600">- Updated to 2.4.0-20110929 snapshot necessary to work with 12.1
  - lots of bugfixes
  - adjustments to current kernel
  - auditing helps</changelog>
  <changelog author="sbrabec@suse.cz" date="1354190400">- Verify GPG signature.</changelog>
  <changelog author="meissner@suse.com" date="1359460800">- Updated to 2.5.0-20120805 snapshot to work with newer kernels
  bnc#800993
  - Rebased using ccs-tools-1.8.3.
  - /usr/sbin/tomoyo-queryd
    Use query id rather than global PID when reading or updating target
    process's domain policy.
  - /usr/lib/tomoyo/init_policy
    Add "socket:[family=\\$:type=\\$:protocol=\\$]" to ANY_PATHNAME group.
  - /sbin/tomoyo-init
    Parse statistics lines correctly.
  - /usr/sbin/tomoyo-editpolicy
    Print number of selected entries if any.
  - /usr/lib/libtomoyotools.so
    Fix IP address parsing.
  - /usr/sbin/tomoyo-checkpolicy
    Fix namespace prefix parsing in exception policy.
  - Rename manpage for init_policy to tomoyo_init_policy
    (to allow parallel installation of ccs-tools package).</changelog>
  <changelog author="p.drouand@gmail.com" date="1428408000">- Update to version 2.5.0-20140601
  * /usr/sbin/tomoyo-editpolicy
    Print "acl_group $N" correctly when using offline mode.
- Changes from version 20140105
  * /usr/lib/tomoyo/init_policy
    Add path to systemd.
  * /usr/sbin/tomoyo-queryd
    Use poll() rather than select().
- Changes from version 20130406
  * Fix compile warning from clang.
- Changes from version 20130214
  * Change Makefile's build flags (fix bdo#674723)
  * Change / to /* in rpm's %files section because Fedora 18 complains
    conflicts.
- Remove gpg verify requirement; obs handles it</changelog>
  <changelog author="dgutu@suse.com" date="1432641600">- Spec-cleaner cleanup</changelog>
  <changelog author="meissner@suse.com" date="1433851200">- tomoyo-tools.keyring: use new key from upstream maintainer</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1632916800">- updated to 2.6.1-20210910
  - Add -DNCURSES_WIDECHAR=0 to programs using ncurses library.
  - Loosen pathname/domainname validation.
  - Limit wildcard recursion depth.
  - Remove "socket:[family=\\$:type=\\$:protocol=\\$]" from ANY_PATHNAME group.
  - Adjust to TOMOYO 2.6.
  - Rebase to ccs-tools 1.8.5-2.
- moved /sbin/tomoyo-init binary to /usr/sbin/tomoyo-init (bsc#1191101)</changelog>
</package>
<package pkgid="9b443d801179ce0a2feaec093bb5992fc6b01dc1df415afffe9f5b5883904c50eb54b65aec4190634566c109165fb7c1c81fe755c8b813ceebcd0202baa6061b" name="tomoyo-tools-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.1.20210910" rel="186.64"/>
  <changelog author="meissner@suse.de" date="1295092800">- initial packaging of the tomoyo userland utilities.</changelog>
  <changelog author="meissner@suse.de" date="1309262400">- Update to 20110511 snapshot:
  * Version 2.3.0p1 2011/02/11   Bugfix release.
    /sbin/tomoyo-init
    Mount sysfs when /sys/kernel/security/ does not exist rather than when /sys/kernel/ does not exist, for some distributions have /sys/kernel/debug/ on root device.
    Wait for /etc/tomoyo/tomoyo-post-init in a more reliable way.
    /usr/sbin/tomoyo-diffpolicy
    Fix regression introduced when fixing old/new inversion bug.
  * Version 2.3.0p2 2011/05/11   Minor update release.
    Fix build error on parallel build.
    /usr/lib/libtomoyotools.so.1
    Fix wrong domainname validation.
    /usr/sbin/tomoyo-editpolicy
    Allow configuring background color.</changelog>
  <changelog author="aj@suse.de" date="1314619200">- _GNU_SOURCE needs to be defined first, fix build
  (patch tomoyo-clone.patch)</changelog>
  <changelog author="meissner@suse.com" date="1319025600">- Updated to 2.4.0-20110929 snapshot necessary to work with 12.1
  - lots of bugfixes
  - adjustments to current kernel
  - auditing helps</changelog>
  <changelog author="sbrabec@suse.cz" date="1354190400">- Verify GPG signature.</changelog>
  <changelog author="meissner@suse.com" date="1359460800">- Updated to 2.5.0-20120805 snapshot to work with newer kernels
  bnc#800993
  - Rebased using ccs-tools-1.8.3.
  - /usr/sbin/tomoyo-queryd
    Use query id rather than global PID when reading or updating target
    process's domain policy.
  - /usr/lib/tomoyo/init_policy
    Add "socket:[family=\\$:type=\\$:protocol=\\$]" to ANY_PATHNAME group.
  - /sbin/tomoyo-init
    Parse statistics lines correctly.
  - /usr/sbin/tomoyo-editpolicy
    Print number of selected entries if any.
  - /usr/lib/libtomoyotools.so
    Fix IP address parsing.
  - /usr/sbin/tomoyo-checkpolicy
    Fix namespace prefix parsing in exception policy.
  - Rename manpage for init_policy to tomoyo_init_policy
    (to allow parallel installation of ccs-tools package).</changelog>
  <changelog author="p.drouand@gmail.com" date="1428408000">- Update to version 2.5.0-20140601
  * /usr/sbin/tomoyo-editpolicy
    Print "acl_group $N" correctly when using offline mode.
- Changes from version 20140105
  * /usr/lib/tomoyo/init_policy
    Add path to systemd.
  * /usr/sbin/tomoyo-queryd
    Use poll() rather than select().
- Changes from version 20130406
  * Fix compile warning from clang.
- Changes from version 20130214
  * Change Makefile's build flags (fix bdo#674723)
  * Change / to /* in rpm's %files section because Fedora 18 complains
    conflicts.
- Remove gpg verify requirement; obs handles it</changelog>
  <changelog author="dgutu@suse.com" date="1432641600">- Spec-cleaner cleanup</changelog>
  <changelog author="meissner@suse.com" date="1433851200">- tomoyo-tools.keyring: use new key from upstream maintainer</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1632916800">- updated to 2.6.1-20210910
  - Add -DNCURSES_WIDECHAR=0 to programs using ncurses library.
  - Loosen pathname/domainname validation.
  - Limit wildcard recursion depth.
  - Remove "socket:[family=\\$:type=\\$:protocol=\\$]" from ANY_PATHNAME group.
  - Adjust to TOMOYO 2.6.
  - Rebase to ccs-tools 1.8.5-2.
- moved /sbin/tomoyo-init binary to /usr/sbin/tomoyo-init (bsc#1191101)</changelog>
</package>
<package pkgid="740ca53105a3427ed769e35c3adfa3d3748887abfa3413dc732e296732197398939d8a9e6487af91b63f90d9c9efba6d7dc622cf6a771af80c5c26e048ee0657" name="tomoyo-tools-debugsource" arch="s390x">
  <version epoch="0" ver="2.6.1.20210910" rel="186.64"/>
  <changelog author="meissner@suse.de" date="1295092800">- initial packaging of the tomoyo userland utilities.</changelog>
  <changelog author="meissner@suse.de" date="1309262400">- Update to 20110511 snapshot:
  * Version 2.3.0p1 2011/02/11   Bugfix release.
    /sbin/tomoyo-init
    Mount sysfs when /sys/kernel/security/ does not exist rather than when /sys/kernel/ does not exist, for some distributions have /sys/kernel/debug/ on root device.
    Wait for /etc/tomoyo/tomoyo-post-init in a more reliable way.
    /usr/sbin/tomoyo-diffpolicy
    Fix regression introduced when fixing old/new inversion bug.
  * Version 2.3.0p2 2011/05/11   Minor update release.
    Fix build error on parallel build.
    /usr/lib/libtomoyotools.so.1
    Fix wrong domainname validation.
    /usr/sbin/tomoyo-editpolicy
    Allow configuring background color.</changelog>
  <changelog author="aj@suse.de" date="1314619200">- _GNU_SOURCE needs to be defined first, fix build
  (patch tomoyo-clone.patch)</changelog>
  <changelog author="meissner@suse.com" date="1319025600">- Updated to 2.4.0-20110929 snapshot necessary to work with 12.1
  - lots of bugfixes
  - adjustments to current kernel
  - auditing helps</changelog>
  <changelog author="sbrabec@suse.cz" date="1354190400">- Verify GPG signature.</changelog>
  <changelog author="meissner@suse.com" date="1359460800">- Updated to 2.5.0-20120805 snapshot to work with newer kernels
  bnc#800993
  - Rebased using ccs-tools-1.8.3.
  - /usr/sbin/tomoyo-queryd
    Use query id rather than global PID when reading or updating target
    process's domain policy.
  - /usr/lib/tomoyo/init_policy
    Add "socket:[family=\\$:type=\\$:protocol=\\$]" to ANY_PATHNAME group.
  - /sbin/tomoyo-init
    Parse statistics lines correctly.
  - /usr/sbin/tomoyo-editpolicy
    Print number of selected entries if any.
  - /usr/lib/libtomoyotools.so
    Fix IP address parsing.
  - /usr/sbin/tomoyo-checkpolicy
    Fix namespace prefix parsing in exception policy.
  - Rename manpage for init_policy to tomoyo_init_policy
    (to allow parallel installation of ccs-tools package).</changelog>
  <changelog author="p.drouand@gmail.com" date="1428408000">- Update to version 2.5.0-20140601
  * /usr/sbin/tomoyo-editpolicy
    Print "acl_group $N" correctly when using offline mode.
- Changes from version 20140105
  * /usr/lib/tomoyo/init_policy
    Add path to systemd.
  * /usr/sbin/tomoyo-queryd
    Use poll() rather than select().
- Changes from version 20130406
  * Fix compile warning from clang.
- Changes from version 20130214
  * Change Makefile's build flags (fix bdo#674723)
  * Change / to /* in rpm's %files section because Fedora 18 complains
    conflicts.
- Remove gpg verify requirement; obs handles it</changelog>
  <changelog author="dgutu@suse.com" date="1432641600">- Spec-cleaner cleanup</changelog>
  <changelog author="meissner@suse.com" date="1433851200">- tomoyo-tools.keyring: use new key from upstream maintainer</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1632916800">- updated to 2.6.1-20210910
  - Add -DNCURSES_WIDECHAR=0 to programs using ncurses library.
  - Loosen pathname/domainname validation.
  - Limit wildcard recursion depth.
  - Remove "socket:[family=\\$:type=\\$:protocol=\\$]" from ANY_PATHNAME group.
  - Adjust to TOMOYO 2.6.
  - Rebase to ccs-tools 1.8.5-2.
- moved /sbin/tomoyo-init binary to /usr/sbin/tomoyo-init (bsc#1191101)</changelog>
</package>
<package pkgid="0eef4406ac676cac15180f61e0592bd230a0bf3710a90616297ec76243806741bdceaffaea1bf9e2ba68edaf275ded081953576ae2c21fe6d2bd2922fa412ad3" name="tpm-quote-tools" arch="s390x">
  <version epoch="0" ver="1.0.4" rel="6.51"/>
  <changelog author="matthias.gerstner@suse.com" date="1495108800">- initial package, version 1.0.3</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1497873600">- fix license specification, it's BSD-3-Clause, not BSD</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1509624000">- update to upstream version 1.0.4:
  - this version fixes an issue with 'mkaik' when an SRK secret was
  required. 'mkaik' always used the well-known secret as SRK.</changelog>
</package>
<package pkgid="23caecd0c925e28dc3fdd3caee841a57deda3730fecca90317126c635e5e0e47ed66bd3812388e7a31dcb66f5c246ebb5b5e37b521dd8767eccb32f87da996b6" name="tpm-quote-tools" arch="src">
  <version epoch="0" ver="1.0.4" rel="6.51"/>
  <changelog author="matthias.gerstner@suse.com" date="1495108800">- initial package, version 1.0.3</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1497873600">- fix license specification, it's BSD-3-Clause, not BSD</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1509624000">- update to upstream version 1.0.4:
  - this version fixes an issue with 'mkaik' when an SRK secret was
  required. 'mkaik' always used the well-known secret as SRK.</changelog>
</package>
<package pkgid="4f7cc344d5edc1d01c59d58212e4abcbc654237e4d766f5718e7f9d0ae5e080197bee33f5bb67762637ec47ce7aee9f530fa09f983df9c0d399ee08865989017" name="tpm-quote-tools-debuginfo" arch="s390x">
  <version epoch="0" ver="1.0.4" rel="6.51"/>
  <changelog author="matthias.gerstner@suse.com" date="1495108800">- initial package, version 1.0.3</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1497873600">- fix license specification, it's BSD-3-Clause, not BSD</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1509624000">- update to upstream version 1.0.4:
  - this version fixes an issue with 'mkaik' when an SRK secret was
  required. 'mkaik' always used the well-known secret as SRK.</changelog>
</package>
<package pkgid="8f8a0ec59dbd4a49e9df19d9298ab5675b2a3585d35ab22fbea5a9c3634c7c8a12d17b1aff19a415c3c4903123249d5d6ec561194c5f7f2b0167a78f58889b43" name="tpm-quote-tools-debugsource" arch="s390x">
  <version epoch="0" ver="1.0.4" rel="6.51"/>
  <changelog author="matthias.gerstner@suse.com" date="1495108800">- initial package, version 1.0.3</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1497873600">- fix license specification, it's BSD-3-Clause, not BSD</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1509624000">- update to upstream version 1.0.4:
  - this version fixes an issue with 'mkaik' when an SRK secret was
  required. 'mkaik' always used the well-known secret as SRK.</changelog>
</package>
<package pkgid="0138a43836ba67cc510dbd6c20b85ea40e3fedace42885ec6dbaa48e3e56781e13686418314b9a69d4565697adb32cf650990fb3095466ff4794f9d1084becd0" name="tpm-tools" arch="s390x">
  <version epoch="0" ver="1.3.9.2" rel="54.42"/>
  <changelog author="meissner@suse.com" date="1339502400">- Updated to 1.3.8
  - bugfixes
  - pcr/nvram sealing options</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1412251200">- Remove a number of unused build requires, probably copy/paste
  error, never used.</changelog>
  <changelog author="mpluskal@suse.com" date="1427976000">- Cleanup spec file with spec-cleaner
- Remove tpm-tools-rpmlintrc
- Use automake and autoconf as recomended by upstream
- Split library, devel adn pkcs11 package</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1434715200">- Do not use -Werror.</changelog>
  <changelog author="mailaender@opensuse.org" date="1483272000">- Update to version 1.3.9</changelog>
  <changelog author="meissner@suse.com" date="1488369600">- updated to 1.3.9.1 (FATE#321450)
  - bugfixes after openssl 1.1 porting</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1510228800">- 0001-Fix-build-against-OpenSSL-1.1.0.patch: fix openssl 1.1.0 build in the
  P11 code. Upstream has not reacted to a pull request to fix this for some
  months now. This is my own patch (that doesn't violate C89 declaration rules
  and is backward compatible to openssl. 1.0.x)).
  For comparison see: https://sourceforge.net/p/trousers/tpm-tools/merge-requests/2/</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- upgrade to minor version 1.3.9.2:
  - upstream now provide openssl 1.1 compatibility on their own
- dropped 0001-Fix-build-against-OpenSSL-1.1.0.patch since the tarbal is now
  compatible.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- fix undefined and binary data being output in the tpm_version command
  (bsc#1114793)
  - add 0001-tpm_version-avoid-outputting-NULL-bytes-from-tpmVend.patch
  - add 0001-tpm_version-avoid-outputting-undefined-data-on-stder.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed source url to https</changelog>
</package>
<package pkgid="a45e91243a665dc450a3a99e49ffe8b4b38e55c3b41ff81c4e8c6dd582257fcc7a1c6c13b02685aa6bcf61502a938c7c7a7ea65b3fde0ba7e70f04dd4593fb2c" name="tpm-tools" arch="src">
  <version epoch="0" ver="1.3.9.2" rel="54.42"/>
  <changelog author="meissner@suse.de" date="1208347200">- disable static
- make check added, even if it does nothing currently.</changelog>
  <changelog author="meissner@suse.de" date="1251374400">- updated to 1.3.2 upstream.</changelog>
  <changelog author="meissner@suse.de" date="1268913600">- updated to 1.3.5 upstream
  - small bugfixes mostly, nothing new</changelog>
  <changelog author="meissner@suse.de" date="1285588800">- add opencryptoki support (bnc#641919)</changelog>
  <changelog author="idonmez@novell.com" date="1306497600">- Disable gcc's new unused-but-set-variable warnings, these are just
  noise as BIO_*(...) functions returns a value and needs to
  be handled</changelog>
  <changelog author="meissner@suse.de" date="1308571200">- Update to 1.3.6
  - some unsealing fixes, do not unseal much</changelog>
  <changelog author="pgajdos@suse.com" date="1314705600">- build with --no-copy-dt-needed-entries</changelog>
  <changelog author="meissner@suse.de" date="1315483200">- Updated to 1.3.7
  - NVRAM support, new binaries: tpm_nvdefine tpm_nvinfo tpm_nvrelease
    tpm_nvread tpm_nvwrite</changelog>
  <changelog author="coolo@suse.com" date="1329134400">- patch license to follow spdx.org standard</changelog>
  <changelog author="meissner@suse.com" date="1331726400">- Updated to 1.3.7.1
  - smaller bugfixes from last release</changelog>
  <changelog author="meissner@suse.com" date="1339502400">- Updated to 1.3.8
  - bugfixes
  - pcr/nvram sealing options</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1412251200">- Remove a number of unused build requires, probably copy/paste
  error, never used.</changelog>
  <changelog author="mpluskal@suse.com" date="1427976000">- Cleanup spec file with spec-cleaner
- Remove tpm-tools-rpmlintrc
- Use automake and autoconf as recomended by upstream
- Split library, devel adn pkcs11 package</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1434715200">- Do not use -Werror.</changelog>
  <changelog author="mailaender@opensuse.org" date="1483272000">- Update to version 1.3.9</changelog>
  <changelog author="meissner@suse.com" date="1488369600">- updated to 1.3.9.1 (FATE#321450)
  - bugfixes after openssl 1.1 porting</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1510228800">- 0001-Fix-build-against-OpenSSL-1.1.0.patch: fix openssl 1.1.0 build in the
  P11 code. Upstream has not reacted to a pull request to fix this for some
  months now. This is my own patch (that doesn't violate C89 declaration rules
  and is backward compatible to openssl. 1.0.x)).
  For comparison see: https://sourceforge.net/p/trousers/tpm-tools/merge-requests/2/</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- upgrade to minor version 1.3.9.2:
  - upstream now provide openssl 1.1 compatibility on their own
- dropped 0001-Fix-build-against-OpenSSL-1.1.0.patch since the tarbal is now
  compatible.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- fix undefined and binary data being output in the tpm_version command
  (bsc#1114793)
  - add 0001-tpm_version-avoid-outputting-NULL-bytes-from-tpmVend.patch
  - add 0001-tpm_version-avoid-outputting-undefined-data-on-stder.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed source url to https</changelog>
</package>
<package pkgid="c69b13efcff7e43b2be8b8cafe110d83dd1bd238f74d5984b4ad7a30ac40d44d2189c4429bf9700c2cd803f13673e9451f3c67ef01d38c6bf0298375a83d4a7d" name="tpm-tools-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3.9.2" rel="54.42"/>
  <changelog author="meissner@suse.com" date="1339502400">- Updated to 1.3.8
  - bugfixes
  - pcr/nvram sealing options</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1412251200">- Remove a number of unused build requires, probably copy/paste
  error, never used.</changelog>
  <changelog author="mpluskal@suse.com" date="1427976000">- Cleanup spec file with spec-cleaner
- Remove tpm-tools-rpmlintrc
- Use automake and autoconf as recomended by upstream
- Split library, devel adn pkcs11 package</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1434715200">- Do not use -Werror.</changelog>
  <changelog author="mailaender@opensuse.org" date="1483272000">- Update to version 1.3.9</changelog>
  <changelog author="meissner@suse.com" date="1488369600">- updated to 1.3.9.1 (FATE#321450)
  - bugfixes after openssl 1.1 porting</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1510228800">- 0001-Fix-build-against-OpenSSL-1.1.0.patch: fix openssl 1.1.0 build in the
  P11 code. Upstream has not reacted to a pull request to fix this for some
  months now. This is my own patch (that doesn't violate C89 declaration rules
  and is backward compatible to openssl. 1.0.x)).
  For comparison see: https://sourceforge.net/p/trousers/tpm-tools/merge-requests/2/</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- upgrade to minor version 1.3.9.2:
  - upstream now provide openssl 1.1 compatibility on their own
- dropped 0001-Fix-build-against-OpenSSL-1.1.0.patch since the tarbal is now
  compatible.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- fix undefined and binary data being output in the tpm_version command
  (bsc#1114793)
  - add 0001-tpm_version-avoid-outputting-NULL-bytes-from-tpmVend.patch
  - add 0001-tpm_version-avoid-outputting-undefined-data-on-stder.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed source url to https</changelog>
</package>
<package pkgid="c2d074c542fcd54d8ae07e87d0f7e8a7f9a8ca541bd3bb57ac09bb706bbcf48e59259f5bf018989450820a07248fc60e6c82500808d80a8372321db96cb79afe" name="tpm-tools-debugsource" arch="s390x">
  <version epoch="0" ver="1.3.9.2" rel="54.42"/>
  <changelog author="meissner@suse.com" date="1339502400">- Updated to 1.3.8
  - bugfixes
  - pcr/nvram sealing options</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1412251200">- Remove a number of unused build requires, probably copy/paste
  error, never used.</changelog>
  <changelog author="mpluskal@suse.com" date="1427976000">- Cleanup spec file with spec-cleaner
- Remove tpm-tools-rpmlintrc
- Use automake and autoconf as recomended by upstream
- Split library, devel adn pkcs11 package</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1434715200">- Do not use -Werror.</changelog>
  <changelog author="mailaender@opensuse.org" date="1483272000">- Update to version 1.3.9</changelog>
  <changelog author="meissner@suse.com" date="1488369600">- updated to 1.3.9.1 (FATE#321450)
  - bugfixes after openssl 1.1 porting</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1510228800">- 0001-Fix-build-against-OpenSSL-1.1.0.patch: fix openssl 1.1.0 build in the
  P11 code. Upstream has not reacted to a pull request to fix this for some
  months now. This is my own patch (that doesn't violate C89 declaration rules
  and is backward compatible to openssl. 1.0.x)).
  For comparison see: https://sourceforge.net/p/trousers/tpm-tools/merge-requests/2/</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- upgrade to minor version 1.3.9.2:
  - upstream now provide openssl 1.1 compatibility on their own
- dropped 0001-Fix-build-against-OpenSSL-1.1.0.patch since the tarbal is now
  compatible.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- fix undefined and binary data being output in the tpm_version command
  (bsc#1114793)
  - add 0001-tpm_version-avoid-outputting-NULL-bytes-from-tpmVend.patch
  - add 0001-tpm_version-avoid-outputting-undefined-data-on-stder.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed source url to https</changelog>
</package>
<package pkgid="8dac0e2bbc093dd9ab340f6ff55439ef6dc1c167c6cf9bc312a23e0be7200108871379c6f21e9fe1e4c78a9e4a5faf3108f0c4c8b97e30332152998cd30cc01f" name="tpm-tools-devel" arch="s390x">
  <version epoch="0" ver="1.3.9.2" rel="54.42"/>
  <changelog author="meissner@suse.com" date="1339502400">- Updated to 1.3.8
  - bugfixes
  - pcr/nvram sealing options</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1412251200">- Remove a number of unused build requires, probably copy/paste
  error, never used.</changelog>
  <changelog author="mpluskal@suse.com" date="1427976000">- Cleanup spec file with spec-cleaner
- Remove tpm-tools-rpmlintrc
- Use automake and autoconf as recomended by upstream
- Split library, devel adn pkcs11 package</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1434715200">- Do not use -Werror.</changelog>
  <changelog author="mailaender@opensuse.org" date="1483272000">- Update to version 1.3.9</changelog>
  <changelog author="meissner@suse.com" date="1488369600">- updated to 1.3.9.1 (FATE#321450)
  - bugfixes after openssl 1.1 porting</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1510228800">- 0001-Fix-build-against-OpenSSL-1.1.0.patch: fix openssl 1.1.0 build in the
  P11 code. Upstream has not reacted to a pull request to fix this for some
  months now. This is my own patch (that doesn't violate C89 declaration rules
  and is backward compatible to openssl. 1.0.x)).
  For comparison see: https://sourceforge.net/p/trousers/tpm-tools/merge-requests/2/</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- upgrade to minor version 1.3.9.2:
  - upstream now provide openssl 1.1 compatibility on their own
- dropped 0001-Fix-build-against-OpenSSL-1.1.0.patch since the tarbal is now
  compatible.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- fix undefined and binary data being output in the tpm_version command
  (bsc#1114793)
  - add 0001-tpm_version-avoid-outputting-NULL-bytes-from-tpmVend.patch
  - add 0001-tpm_version-avoid-outputting-undefined-data-on-stder.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed source url to https</changelog>
</package>
<package pkgid="3b5a3fb3ad79097504f3acdf353e11cc835f3b6031c4c0d15eac0bf73d5f4b0a7ef28dd8ecd28a4cf2f0c734ae90b16fd092ee6392d81a3811fcbbcf93e9d57b" name="tpm-tools-pkcs11" arch="s390x">
  <version epoch="0" ver="1.3.9.2" rel="54.42"/>
  <changelog author="meissner@suse.com" date="1339502400">- Updated to 1.3.8
  - bugfixes
  - pcr/nvram sealing options</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1412251200">- Remove a number of unused build requires, probably copy/paste
  error, never used.</changelog>
  <changelog author="mpluskal@suse.com" date="1427976000">- Cleanup spec file with spec-cleaner
- Remove tpm-tools-rpmlintrc
- Use automake and autoconf as recomended by upstream
- Split library, devel adn pkcs11 package</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1434715200">- Do not use -Werror.</changelog>
  <changelog author="mailaender@opensuse.org" date="1483272000">- Update to version 1.3.9</changelog>
  <changelog author="meissner@suse.com" date="1488369600">- updated to 1.3.9.1 (FATE#321450)
  - bugfixes after openssl 1.1 porting</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1510228800">- 0001-Fix-build-against-OpenSSL-1.1.0.patch: fix openssl 1.1.0 build in the
  P11 code. Upstream has not reacted to a pull request to fix this for some
  months now. This is my own patch (that doesn't violate C89 declaration rules
  and is backward compatible to openssl. 1.0.x)).
  For comparison see: https://sourceforge.net/p/trousers/tpm-tools/merge-requests/2/</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- upgrade to minor version 1.3.9.2:
  - upstream now provide openssl 1.1 compatibility on their own
- dropped 0001-Fix-build-against-OpenSSL-1.1.0.patch since the tarbal is now
  compatible.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- fix undefined and binary data being output in the tpm_version command
  (bsc#1114793)
  - add 0001-tpm_version-avoid-outputting-NULL-bytes-from-tpmVend.patch
  - add 0001-tpm_version-avoid-outputting-undefined-data-on-stder.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed source url to https</changelog>
</package>
<package pkgid="1df644027e6993c5e0c5d4454fb68d1c0b040b7d69b631854307b93998023480b831598f649b6129316e37fcc943ef2d33e8b4230ecad6403eebacc8c25422c0" name="tpm-tools-pkcs11-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3.9.2" rel="54.42"/>
  <changelog author="meissner@suse.com" date="1339502400">- Updated to 1.3.8
  - bugfixes
  - pcr/nvram sealing options</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1412251200">- Remove a number of unused build requires, probably copy/paste
  error, never used.</changelog>
  <changelog author="mpluskal@suse.com" date="1427976000">- Cleanup spec file with spec-cleaner
- Remove tpm-tools-rpmlintrc
- Use automake and autoconf as recomended by upstream
- Split library, devel adn pkcs11 package</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1434715200">- Do not use -Werror.</changelog>
  <changelog author="mailaender@opensuse.org" date="1483272000">- Update to version 1.3.9</changelog>
  <changelog author="meissner@suse.com" date="1488369600">- updated to 1.3.9.1 (FATE#321450)
  - bugfixes after openssl 1.1 porting</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1510228800">- 0001-Fix-build-against-OpenSSL-1.1.0.patch: fix openssl 1.1.0 build in the
  P11 code. Upstream has not reacted to a pull request to fix this for some
  months now. This is my own patch (that doesn't violate C89 declaration rules
  and is backward compatible to openssl. 1.0.x)).
  For comparison see: https://sourceforge.net/p/trousers/tpm-tools/merge-requests/2/</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- upgrade to minor version 1.3.9.2:
  - upstream now provide openssl 1.1 compatibility on their own
- dropped 0001-Fix-build-against-OpenSSL-1.1.0.patch since the tarbal is now
  compatible.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- fix undefined and binary data being output in the tpm_version command
  (bsc#1114793)
  - add 0001-tpm_version-avoid-outputting-NULL-bytes-from-tpmVend.patch
  - add 0001-tpm_version-avoid-outputting-undefined-data-on-stder.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed source url to https</changelog>
</package>
<package pkgid="9de8e4a163c5e34acd289d9bd68673acedb08e870e6d0eb659b58dbb8c631dea09fadd819f184a2d1f23eecac1a763bc1241c7342c38d0e141c055862b525843" name="tpm2-0-tss" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="b2922cffcd1784e9dfe7cfb69382430ced1ad483931d23311eeac80a9e187bf78327a6c58e2f2d60da680a0e3e4f1fb37154edbcf8cdf34b233909474b4199bd" name="tpm2-0-tss" arch="src">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1582113600">- Update to version 2.3.3
  * Fixed mixing salted and unsalted sessions in the same ESAPI
    context
  * Removed use of VLAs from TPML marshal code
  * Added check for object node before calling compute_session_value
    function
  * Fixed auth calculation in Esys_StartAuthSession called with
    optional parameters
  * Fixed compute_encrypted_salt error handling in
    Esys_StartAuthSession
  * Fixed exported symbols map for libtss2-mu</changelog>
  <changelog author="Guillaume GARDET &lt;guillaume.gardet@opensuse.org&gt;" date="1603108800">- Update to 3.0.1, changelog at:
  https://github.com/tpm2-software/tpm2-tss/blob/3.0.x/CHANGELOG.md
- Update libtss2-sys0 to libtss2-sys1
- Add new libs:
  * libtss2-fapi1
  * libtss2-tcti-cmd0
  * libtss2-tcti-swtpm0</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1603368000">- move the tcti-fapi tmpfiles.d config file into the libtss2-fapi1 sub-package.
- improve the descriptions of new libraries (fapi1, cmd0, swtpm0)
- adjust baselibs.conf to match new library versions and added libraries</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1611835200">- update to 3.0.3:
  - changes in 3.0.3:
  * Fix Regression in Fapi_List
  * Fix memory leak in policy calculation
  - changes in 3.0.2:
  * FAPI: Fix setting of the system flag of NV objects
  * This will let NV object metadata be created system-wide always instead of
  * locally in the user. Existing metadata will remain in the user directory.
  * It can be moved to the corresponding systemstore manually if needed.
  * FAPI: Fix policy searching, when a policyRef was provided
  * FAPI: Accept EK-Certs without CRL dist point
  * FAPI: Fix return codes of Fapi_List
  * FAPI: Fix memleak in policy execution
  * FAPI: Fix coverity NULL-pointer check
  * FAPI: Set the written flag of NV objects in FAPI PolicyNV commands
  * FAPI: Fix deleting of policy files.
  * FAPI: Fix wrong file loading during object search.
  * Fapi: Fix memory leak
  * Fapi: Fix potential NULL-Dereference
  * Fapi: Remove superfluous NULL check
  * Fix a memory leak in async keystore load.</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1624881600">- small services fixes and comments</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1626264000">- Clean spec file
- Add new library libtss2-tcti-pcap0
- Update to 3.1.0:
  * Fix FAPI PolicyPCR not instatiating correctly (CVE-2020-24455)
  * Fixed possible access outside the array in ifapi_calculate_tree
  * Added pcap TCTI
  * Added GlobalSign TPM Root CA certs to FAPI cert store
  * Changed EncryptDecrypt mode type to align with TPM2.0 spec 1.59
  * Added two new TPM commands TPM2_CC_CertifyX509,
    and TPM2_CC_ACT_SetTimeout</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1626350400">- Remove conflicting sysusers.d file</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1638964800">- Version 3.1.0 includes:
  + cover update to 2.4.5 (jsc#SLE-17366)
  + cover update to 2.3.0 (jsc#SLE-9515)
  + fix policy session for TPM2_PolicyAuthValue (bsc#1160736)
- Add version the configuration file tpm2-tss-fapi.conf</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Update to 3.2.0
  + Fixed
  * FAPI: fix curl_url_set call
  * FAPI: Fix usage of curl url (Should fix Ubuntu 22.04)
  * Fix buffer upcast leading to misalignment
  * Fix check whether SM3 is available
  * Update git.mk to support R/O src-dir
  * Fixed file descriptor leak when tcti initialization failed.
  * 32 Bit builds of the integration tests.
  * Primary key creation, in some cases the unique field was not
    cleared before calling create primary.
  * Primary keys was used for signing the object were cleared after
    loading. So access e.g. to the certificate did not work.
  * Primary keys created with Fapi_Create with an auth value, the
    auth_value was not used in inSensitive to recreate the primary
    key. Now the auth value callback is used to initialize
    inSensitive.
  * The not possible usage of policies for primary keys generated
    with Fapi_CreatePrimary has been fixed.
  * An infinite loop when parsing erroneous JSON was fixed in FAPI.
  * A buffer overflow in ESAPI xor parameter obfuscation was fixed.
  * Certificates could be read only once in one application The
    setting the init state of the state automaton for getting
    certificates was fixed.
  * A double free when executing policy action was fixed.
  * A leak in Fapi_Quote was fixed.
  * The wrong file locking in FAPI IO was fixed.
  * Enable creation of tss group and user on systems with busybox
    for fapi.
  * One fapi integration test did change the auth value of the
    storage hierarchy.
  * A leak in fapi crypto with ossl3 was fixed.
  * Add initial camelia support to FAPI
  * Fix tests of fapi PCR
  * Fix tests of ACT functionality if not supported by pTPM
  * Fix compiler (unused) warning when building without debug
    logging
  * Fix leaks in error cases of integration tests
  * Fix memory leak after ifapi_init_primary_finish failed
  * Fix double-close of stream in FAPI
  * Fix segfault when ESYS_TR_NONE is passed to Esys_TR_GetName
  * Fix the authorization of hierarchy objects used in policy
    secret.
  * Fix check of qualifying data in Fapi_VerifyQuote.
  * Fix some leaks in FAPI error cases.
  * Make scripts compatible with non-posix shells where test does
    not know -a and -o.
  * Fix usage of variable not initialized when fapi keystore is
    empty.
  + Added
  * Add additional IFX root CAs
  * Added support for SM2, SM3 and SM4.
  * Added support for OpenSSL 3.0.0.
  * Added authPolicy field to the TPMU_CAPABILITIES union.
  * Added actData field to the TPMU_CAPABILITIES union.
  * Added TPM2_CAP_AUTH_POLICIES
  * Added TPM2_CAP_ACT constants.
  * Added updates to the marshalling and unmarshalling of the
    TPMU_CAPABILITIES union.
  * Added updated to the FAPI serializations and deserializations of
    the TPMU_CAPABILITIES union and associated types.
  * Add CODE_OF_CONDUCT
  * tcti-mssim and tcti-swtpm gained support for UDX communication
  * Missing constant for TPM2_RH_PW
  + Removed
  * Removed support for OpenSSL &lt; 1.1.0.
  * Marked TPMS_ALGORITHM_DESCRIPTION and corresponding MU routines
    as deprecated.
  * Those were errorous typedefs that are not use and not useful. So
    we will remove this with 3.3
  * Marked TPM2_RS_PW as deprecated. Use TPM2_RH_PW instead.
- Update to 3.1.1
  + Fixed
  * Fixed file descriptor leak when tcti initialization failed.
  * Primary key creation, in some cases the unique field was not
    cleared before calling create primary.
  * Primary keys was used for signing the object were cleared after
    loading. So access e.g. to the certificate did not work.
  * Primary keys created with Fapi_Create with an auth value, the
    auth_value was not used in inSensitive to recreate the primary
    key. Now the auth value callback is used to initialize
    inSensitive.
  * The not possible usage of policies for primary keys generated
    with Fapi_CreatePrimary has been fixed.
  * An infinite loop when parsing erroneous JSON was fixed in FAPI.
  * A buffer overflow in ESAPI xor parameter obfuscation was fixed.
  * Certificates could be read only once in one application The
    setting the init state of the state automaton for getting
    certificates was fixed.
  * A double free when executing policy action was fixed.
  * A leak in Fapi_Quote was fixed.
  * The wrong file locking in FAPI IO was fixed.
  * One fapi integration test did change the auth value of the
    storage hierarchy.
  * Fix test of FAPI PCR
  * Fix leaks in error cases of integration tests
  * Fix segfault when ESYS_TR_NONE is passed to Esys_TR_GetName
  * Fix the authorization of hierarchy objects used in policy
    secret.
  * Fix check of qualifying data in Fapi_VerifyQuote.
  * Fix some leaks in FAPI error cases.
  * Fix usage of variable not initialized when fapi keystore is
    empty.
  + Added
  * Add additional IFX root CAs</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="a93eeb5d7deeafc8ecd91311642c9d534efe1b3fdca41c4a87ae5e28ece37e6027c387a0fcb4c17f1d7b26bb3c5d3d021cf3d3755187b857ddfbc69550e4fd85" name="tpm2-0-tss-debugsource" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="c961b1f8154e4399c405c02ce7cca1828ac3ad6f75f05645dd4914008ff3d6c4cf9bec6787eae9f0ba8cc8211912727f1ff8406a5548d8bbac67a7e0690c2e81" name="tpm2-0-tss-devel" arch="s390x">
  <version epoch="0" ver="4.1.3" rel="150.16"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657540800">- Revert "Add version the configuration file tpm2-tss-fapi.conf"
  This generate whitelist problems in rpmlint.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1674216000">- add 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch: fixes
  CVE-2023-22745 (bsc#1207325): Buffer Overlow in TSS2_RC_Decode. Overly large
  RC values passed to the TSS2 function could lead to memory overread or
  memory overread.
  This patch is not yet part of any upstream git tag.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Drop 0001-tss2_rc-ensure-layer-number-is-in-bounds.patch as was
  already merged upstream
- Update to 4.0.1
  + Fixed:
  * A buffer overflow in tss2-rc as CVE-2023-22745.
- Update to 4.0.0
  + Fixed:
  * tcti-ldr: Use heap instead of stack when tcti initialize
  * Fix usage of NULL pointer if Esys_TR_SetAuth is calles with
    ESYS_TR_NONE.
  * Conditionally check user/group manipulation commands.
  * Store VERSION into the release tarball.
  * When using DESTDIR for make einstall, do not invoke
    systemd-sysusers and systemd-tmpfiles.
  * esys_iutil: fix possible NPD.
  * Tss2_Sys_Flushcontext: flushHandle was encoded as a handleArea
    handle and not as parameter one, this affected the contents of
    cpHash.
  * esys: fix allow usage of HMAC sessions for
    Esys_TR_FromTPMPublic.
  * fapi: fix usage of policy_nv with a TPM nv index.
  * linking tcti for libtpms against tss2-tctildr. It should be
    linked against tss2-mu.
  * build: Remove erroneous trailing comma in linker option. Bug
    [#2391].
  * fapi: fix encoding of complex tpm2bs in authorize nv,
    duplication select and policy template policies. Now the complex
    and TPMT or TPMS representations can be used. Bug #2383
  * The error message for unsupported FAPI curves was in hex without
    a leading 0x, make it integer output to clarify.
  * Documentation that had various scalar out pointers as "callee
    allocated".
  * test: build with opaque FILE structure like in musl libc.
  * Transient endorsement keys were not recreated according to the
    EK credential profile.
  * Evict control for a persistent EK failed during provisioning if
    an auth value for the storage hierarchy was set.
  * The authorization of the storage hierarchy is now added. Fixes
    FAPI: Provisioning error if an auth value is needed for the
    storage hierarchy #2438.
  * Usage of a second profile in a path was not possible because the
    default profile was always used.
  * The setting of an empty auth value for Fapi_Provision was fixed.
  * JSON encoding of a structure TPMS_POLICYAUTHORIZATION used the
    field keyPEMhashAlg instead of hashAlg as defined in "TCG TSS
    2.0 JSON Data Types and Policy Language Specification". Rename
    to hashAlg but preserve support for reading keyPEMhashAlg for
    backwards compatibility.
  * fapi: PolicySecret did not work with keys as secret object.
  * Esys_PCR_SetAuthValue: remembers the auth like other SetAutg
    ESAPI functions.
  * tests: esys-pcr-auth-value.int moved to destructive tests.
  * FAPI: Fix double free if keystore is corrupted.
  * Marshaling of TPMU_CAPABILITIES data, only field
    intelPttProperty was broken before.a
  * Spec deviation in Fapi_GetDescription caused description to be
    NULL when it should be empty string. This is API breaking but
    considered a bug since it deviated from the FAPI spec.
  * FAPI: undefined reference to curl_url_strerror when using curl
    less than 7.80.0.
  * FAPI: Fixed support for EK templates in NV inidices per the
    spec, see #2518 for details.
  * FAPI: fix NPD in ifapi_curl logging.
  * FAPI: Improve documentation fapi-profile
  * FAPI: Fix CURL HTTP handling.
  * FAPI: Return FAPI_RC_IO_ERROR if a policy does not exist in
    keystore.
  + Added:
  * TPM version 1.59 support.
  * ci: ubuntu-22.04 added.
  * mbedTLS 3.0 is supported by ESAPI.
  * Add CreationHash to JSON output for usage between applications
    not using the FAPI keystore, like command line tools.
  * Reduced code size for SAPI.
  * Support for Runtime Switchable ESAPI Crypto Backend via
    Esys_SetCryptoCallbacks.
  * Testing for TCG EK Credential Profile TPM 2.0, Version 2.4
    Rev. 3, 2021 for the low and high address range of EK templates.
  * tss2-rc: Tss2_RC_DecodeInfo function for parsing TSS2_RC into
    the various bit fields.
  * FAPI support for P_ECC384 profile.
  * tss2-rc: Tss2_RC_DecodeInfoError: Function to get a human
    readable error from a TSS2_RC_INFO returned by
    Tss2_RC_DecodeInfo
  * tcti: Generic SPI driver, implementors only need to connect to
    acquire/release, transmit/receive, and sleep/timeout functions.
  * FAPI: Add event logging for Firmware and IMA Events. See #2170
    for details.
  * FAPI: Fix Fapi_ChangeAuth updates on hierarchy objects not being
    reflected across profiles.
  * FAPI: Allow keyedhash keys in PolicySigned.
  * ESAPI: Support sha512 for mbedtls crypto backend.
  * TPM2B_MAX_CAP_BUFFER and mu routines
  * vendor field to TPMU_CAPABILTIIES
  * FAPI: support for PolicyTemplate
  + Changed
  * libmu soname from 0:0:0 to 0:1:0.
  * tss2-sys soname from 1:0:0 to 1:1:0
  * tss2-esys: from 0:0:0 to 0:1:0
  * FAPI ignores vendor properties on Fapi_GetInfo
  * FAPI Event Logging JSON format, See #2170 for details.
  + Removed
  * Dead struct TPMS_ALGORITHM_DESCRIPTION
  * Dead field intelPttProperty from TPMU_CAPABILITIES
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Marshal
  * Dead code Tss2_MU_TPMS_ALGORITHM_DESCRIPTION_Unmarshal</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1690200000">- Require openssl-3 over openssl-1 to assist migration of applications
  to newer openssl-3.</changelog>
  <changelog author="Ludwig Nussel &lt;lnussel@suse.com&gt;" date="1701086400">- libtss2-fapi1 requires system-user-tss for tmpfile creation</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1702728000">- Move tmpfiles config to different package:
  * tmpfiles_create was being called with bad input (version ?)
  * it avoids breaking SLPP for libtss2-fapi1 (hence the prior
    warning in spec)
- tss sysusers requires should be pre not post</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1705147200">- Fix tmpfiles %ghost file names</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 4.1:
  + Security
  - Fixed CVE-2024-29040 (bsc#1223690)
  + Fixed
  - fapi: Fix length check on FAPI auth callbacks
  - mu: Correct error message for errors
  - tss2-rc: fix unknown laer handler dropping bits.
  - fapi: Fix deviation from CEL specification (template_value was used instead of template_data).
  - fapi: Fix json syntax error in FAPI profiles which was ignored by json-c.
  - build: fix build fail after make clean.
  - mu: Fix unneeded size check in TPM2B unmarshaling.
  - fapi: Fix missing parameter encryption.
  - build: Fix failed build with --disable-vendor.
  - fapi: Fix flush of persistent handles.
  - fapi: Fix test provisioning with template with self generated certificate disabled.
  - fapi: Fix error in Fapi_GetInfo it TPM supports SHA3 hash algs.
  - fapi: Revert pcr extension for EV_NO_ACTION events.
  - fapi: Fix strange error messages if nv, ext, or policy path does not exits.
  - fapi: Fix segfault caused by wrong allocation of pcr policy.
  - esys: Fix leak in Esys_EvictControl for persistent handles.
  - tss2-tcti: tcti-libtpms: fix test failure on big-endian platform.
  - esys: Add reference counting for Esys_TR_FromTPMPublic.
  - esys: Fix HMAC error if session bind key has an auth value with a trailing 0.
  - fapi: fix usage of self signed certificates in TPM.
  - fapi: Usage of self signed certificates.
  - fapi: A segfault after the error handling of non existing keys.
  - fapi: Fix several leaks.
  - fapi: Fix error handling for policy execution.
  - fapi: Fix usage of persistent handles (should not be flushed)
  - fapi: Fix test provisioning with template (skip test without self generated certificate).
  - fapi: Fix pcr extension for EV_NO_ACTION
  - test: Fix fapi-key-create-policy-signed-keyedhash with P_ECC384 profile
  - tcti_spi_helper_transmit: ensure FIFO is accessed only after TPM reports commandReady bit is set
  - fapi: Fix read large system eventlog (&gt; UINT16_MAX).
  - esys tests: Fix layer check for TPM2_RC_COMMAND_CODE (for /dev/tpmrm0)
  - test: unit: tcti-libtpms: fix test failed at 32-bit platforms.
  - fapi: Fix possible null pointer dereferencing in Fapi_List.
  - sys: Fix size check in Tss2_Sys_GetCapability.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  - esys: fix unchecked return value in esys crypto.
  - fapi: Fix wrong usage of local variable in provisioning.
  - fapi: Fix memset 0 in ifapi_json_TPMS_POLICYNV_deserialize.
  - fapi: Fix possible out of bound array access in IMA parser.
  - tcti device: Fix possible unmarshalling from uninitialized variable.
  - fapi: Fix error checking authorization of signing key.
  - fapi: Fix cleanup of policy sessions.
  - fapi: Eventlog H-CRTM events and different localities.
  - fapi: Fix missing synchronization of quote and eventlog.
  - faii: Fix invalid free in Fapi_Quote with empty eventlog.
  + Added
  - tcti: LetsTrust-TPM2Go TCTI module spi-ltt2go.
  - mbedtls: add sha512 hmac.
  - fapi: Enable usage of external keys for Fapi_Encrypt.
  - fapi: Support download of AMD certificates.
  - tcti: Add USB TPM (FTDI MPSSE USB to SPI bridge) TCTI module.
  - fapi: The recreation of primaries (except EK) in the owner hierarchy instead the endorsement hierarchy is fixed.
  - rc: New TPM return codes added.
  - fapi: Further Nuvoton certificates added.
  - tpm_types/esys: Add support for Attestable TPM changes in latest TPM spec.
  - tcti: Add '/dev/tcm0' to default conf
  - fapi: New Nuvoton certificates added.
  - esys: Fix leak in Esys_TR_FromTPMPublic.
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).
- tpm2-tss.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.
- add new sub-package libtss2-tcti-spidev0: TCTI for communicating with a TPM
  connected directly via SPI.
- add new sub-package libtss2-tcti-i2c-helper0: TCTI for communicating with a
  TPM connected directly via I2C.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1734091200">- the post scriptlet calls udevadm but Requires(post): udev is missing,
  adding it</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1754308800">- Update to 4.1.3:
  * Fix name collisions during dlopen() on some linkers
- Update to 4.1.2:
  * configure.ac: Fix test of == to = to be POSIX comliant
  * Remove use of which in favor of command -v
- Update to 4.1.1:
  * Fixed inclusion of .map and .def files in release tar balls</changelog>
</package>
<package pkgid="e9c4a197f3dbd27213ab1975fd3b09332e5b70bd99e8f7278106cdf72299997faeb58ff8ddcf135de3112efe17248669a9b0a81a5dfe68878d5567981fc2960e" name="tpm2-openssl" arch="s390x">
  <version epoch="0" ver="1.3.0" rel="7.12"/>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1685966400">- Initial commit of tpm2-openssl</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1697544000">[#]# Added
  * Added support for ECDH with a KDF, which is used by ECC-based CMS (S/MIME).
  * Added retrieval of OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY for EC keys and retrieval
  of TLS-GROUP provider capabilities to enable mTLS authentication (thanks to @rshearman).
  * Added mTLS example to documentation (thanks to @hoinmic).
  * Added missing RAND parameters: 'state' and 'strength' (thanks to @mccarey).
  * Added ability to run tests in a container (thanks to @afreof).
  * Added Visual Studio properties to simplify the Windows build (thanks to @philippun1).
  [#]# Changed
  * Symmetric operations are disabled by default. In most situations these are not needed and
  cause a huge performance penalty. To enable, configure with --enable-op-digest or
  - -enable-op-cipher.
  [#]# Removed
  * Removed unofficial support for tpm2-tss &lt; 3.2.0, which do not support the openssl 3.x.
  [#]# Fixed
  * Fixed key export: the private keys are not exportable, which shall fix some TPM-based sign
  operations (thanks to @fhars).
  * Fixed handle related operations on 32b machines (thanks to @dezgeg).
  * Fixed OSSL_FUNC_KEYMGMT_HAS operations with NULL keys.
  * Fixed a heap exception on some machines (thanks to @philippun1).
  * Fixed build warnings when building on the Fedora Linux.
  * In documentation and tests applied a correct order of providers (thanks to @hoinmic).
  * Modified documentation: the user-space resource manager (abrmd) is almost mandatory for complex
  scenarios such as SSL or X.509 operations.</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1738152000">- Update to 1.3.0:
  * Added support for RSA-OAEP decryption.
  * Added 'xof' and 'algid-absent' parameters to digests.
  * Added Parent to textual information printed by 'openssl pkey -text'.
  * Fixed multi-threaded operation, preventing the 'Esys called in bad
    sequence' errors (thanks to @Danigaralfo, @famez, and @AndreasFuchsTPM).
  * Fixed retrieval of OSSL_PKEY_PARAM_MAX_SIZE for RSA keys. The exact value
    is returned instead of a fixed TPM2_MAX_RSA_KEY_BYTES.
  * Fixed handling of absent emptyAuth value in the TSS2 PRIVATE KEY file.
  * Set authorization value of newly generated keys. This allows users of the C
    API to direcly use just generated EVP_PKEY.
- Add tpm2-openssl.keyring
- Don't install libtool archives</changelog>
</package>
<package pkgid="4646af50243b44cb9c1067cad882383f7be1e4c79435afcf3f98d421c8242d8ac1faca36fdac4b693049e94cab12b1c8a614f9ea5c2d1d3c1b96786eec3266ad" name="tpm2-openssl" arch="src">
  <version epoch="0" ver="1.3.0" rel="7.12"/>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1685966400">- Initial commit of tpm2-openssl</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1697544000">[#]# Added
  * Added support for ECDH with a KDF, which is used by ECC-based CMS (S/MIME).
  * Added retrieval of OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY for EC keys and retrieval
  of TLS-GROUP provider capabilities to enable mTLS authentication (thanks to @rshearman).
  * Added mTLS example to documentation (thanks to @hoinmic).
  * Added missing RAND parameters: 'state' and 'strength' (thanks to @mccarey).
  * Added ability to run tests in a container (thanks to @afreof).
  * Added Visual Studio properties to simplify the Windows build (thanks to @philippun1).
  [#]# Changed
  * Symmetric operations are disabled by default. In most situations these are not needed and
  cause a huge performance penalty. To enable, configure with --enable-op-digest or
  - -enable-op-cipher.
  [#]# Removed
  * Removed unofficial support for tpm2-tss &lt; 3.2.0, which do not support the openssl 3.x.
  [#]# Fixed
  * Fixed key export: the private keys are not exportable, which shall fix some TPM-based sign
  operations (thanks to @fhars).
  * Fixed handle related operations on 32b machines (thanks to @dezgeg).
  * Fixed OSSL_FUNC_KEYMGMT_HAS operations with NULL keys.
  * Fixed a heap exception on some machines (thanks to @philippun1).
  * Fixed build warnings when building on the Fedora Linux.
  * In documentation and tests applied a correct order of providers (thanks to @hoinmic).
  * Modified documentation: the user-space resource manager (abrmd) is almost mandatory for complex
  scenarios such as SSL or X.509 operations.</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1738152000">- Update to 1.3.0:
  * Added support for RSA-OAEP decryption.
  * Added 'xof' and 'algid-absent' parameters to digests.
  * Added Parent to textual information printed by 'openssl pkey -text'.
  * Fixed multi-threaded operation, preventing the 'Esys called in bad
    sequence' errors (thanks to @Danigaralfo, @famez, and @AndreasFuchsTPM).
  * Fixed retrieval of OSSL_PKEY_PARAM_MAX_SIZE for RSA keys. The exact value
    is returned instead of a fixed TPM2_MAX_RSA_KEY_BYTES.
  * Fixed handling of absent emptyAuth value in the TSS2 PRIVATE KEY file.
  * Set authorization value of newly generated keys. This allows users of the C
    API to direcly use just generated EVP_PKEY.
- Add tpm2-openssl.keyring
- Don't install libtool archives</changelog>
</package>
<package pkgid="f209275aac4af3b98492ed83f20c5888c713bc69ce224f689f324c724d0699fc18a856e801b6494bb18e11244663b5de50506d7d486c4186187adf239b003282" name="tpm2-openssl-debuginfo" arch="s390x">
  <version epoch="0" ver="1.3.0" rel="7.12"/>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1685966400">- Initial commit of tpm2-openssl</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1697544000">[#]# Added
  * Added support for ECDH with a KDF, which is used by ECC-based CMS (S/MIME).
  * Added retrieval of OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY for EC keys and retrieval
  of TLS-GROUP provider capabilities to enable mTLS authentication (thanks to @rshearman).
  * Added mTLS example to documentation (thanks to @hoinmic).
  * Added missing RAND parameters: 'state' and 'strength' (thanks to @mccarey).
  * Added ability to run tests in a container (thanks to @afreof).
  * Added Visual Studio properties to simplify the Windows build (thanks to @philippun1).
  [#]# Changed
  * Symmetric operations are disabled by default. In most situations these are not needed and
  cause a huge performance penalty. To enable, configure with --enable-op-digest or
  - -enable-op-cipher.
  [#]# Removed
  * Removed unofficial support for tpm2-tss &lt; 3.2.0, which do not support the openssl 3.x.
  [#]# Fixed
  * Fixed key export: the private keys are not exportable, which shall fix some TPM-based sign
  operations (thanks to @fhars).
  * Fixed handle related operations on 32b machines (thanks to @dezgeg).
  * Fixed OSSL_FUNC_KEYMGMT_HAS operations with NULL keys.
  * Fixed a heap exception on some machines (thanks to @philippun1).
  * Fixed build warnings when building on the Fedora Linux.
  * In documentation and tests applied a correct order of providers (thanks to @hoinmic).
  * Modified documentation: the user-space resource manager (abrmd) is almost mandatory for complex
  scenarios such as SSL or X.509 operations.</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1738152000">- Update to 1.3.0:
  * Added support for RSA-OAEP decryption.
  * Added 'xof' and 'algid-absent' parameters to digests.
  * Added Parent to textual information printed by 'openssl pkey -text'.
  * Fixed multi-threaded operation, preventing the 'Esys called in bad
    sequence' errors (thanks to @Danigaralfo, @famez, and @AndreasFuchsTPM).
  * Fixed retrieval of OSSL_PKEY_PARAM_MAX_SIZE for RSA keys. The exact value
    is returned instead of a fixed TPM2_MAX_RSA_KEY_BYTES.
  * Fixed handling of absent emptyAuth value in the TSS2 PRIVATE KEY file.
  * Set authorization value of newly generated keys. This allows users of the C
    API to direcly use just generated EVP_PKEY.
- Add tpm2-openssl.keyring
- Don't install libtool archives</changelog>
</package>
<package pkgid="958f0220d1c15e515fcda4aec7ed2c4cca221fa45c70627b726e2f569876abccd501e1abf40f9256b304e8429ecfcb84d809f88b20d4c109df1a9ff2ff877564" name="tpm2-openssl-debugsource" arch="s390x">
  <version epoch="0" ver="1.3.0" rel="7.12"/>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1685966400">- Initial commit of tpm2-openssl</changelog>
  <changelog author="William Brown &lt;william.brown@suse.com&gt;" date="1697544000">[#]# Added
  * Added support for ECDH with a KDF, which is used by ECC-based CMS (S/MIME).
  * Added retrieval of OSSL_PKEY_PARAM_ENCODED_PUBLIC_KEY for EC keys and retrieval
  of TLS-GROUP provider capabilities to enable mTLS authentication (thanks to @rshearman).
  * Added mTLS example to documentation (thanks to @hoinmic).
  * Added missing RAND parameters: 'state' and 'strength' (thanks to @mccarey).
  * Added ability to run tests in a container (thanks to @afreof).
  * Added Visual Studio properties to simplify the Windows build (thanks to @philippun1).
  [#]# Changed
  * Symmetric operations are disabled by default. In most situations these are not needed and
  cause a huge performance penalty. To enable, configure with --enable-op-digest or
  - -enable-op-cipher.
  [#]# Removed
  * Removed unofficial support for tpm2-tss &lt; 3.2.0, which do not support the openssl 3.x.
  [#]# Fixed
  * Fixed key export: the private keys are not exportable, which shall fix some TPM-based sign
  operations (thanks to @fhars).
  * Fixed handle related operations on 32b machines (thanks to @dezgeg).
  * Fixed OSSL_FUNC_KEYMGMT_HAS operations with NULL keys.
  * Fixed a heap exception on some machines (thanks to @philippun1).
  * Fixed build warnings when building on the Fedora Linux.
  * In documentation and tests applied a correct order of providers (thanks to @hoinmic).
  * Modified documentation: the user-space resource manager (abrmd) is almost mandatory for complex
  scenarios such as SSL or X.509 operations.</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1738152000">- Update to 1.3.0:
  * Added support for RSA-OAEP decryption.
  * Added 'xof' and 'algid-absent' parameters to digests.
  * Added Parent to textual information printed by 'openssl pkey -text'.
  * Fixed multi-threaded operation, preventing the 'Esys called in bad
    sequence' errors (thanks to @Danigaralfo, @famez, and @AndreasFuchsTPM).
  * Fixed retrieval of OSSL_PKEY_PARAM_MAX_SIZE for RSA keys. The exact value
    is returned instead of a fixed TPM2_MAX_RSA_KEY_BYTES.
  * Fixed handling of absent emptyAuth value in the TSS2 PRIVATE KEY file.
  * Set authorization value of newly generated keys. This allows users of the C
    API to direcly use just generated EVP_PKEY.
- Add tpm2-openssl.keyring
- Don't install libtool archives</changelog>
</package>
<package pkgid="be07d39dea6679a80e0d92224a1072514e7b8d7d7c282e071882afcfea54da2061b100c689f2032db43fe28f31c5d15c403dec58992ac53c24b64bdc965d8756" name="tpm2-pkcs11" arch="s390x">
  <version epoch="0" ver="1.9.1" rel="23.3"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1629633600">- Use definite tense in %description.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1634731200">- Update to 1.7.0
  + DB Schema Change from 5 to 7.
  * Backup your DB before upgrading
  + Fixed compilation issues with GCC11.
  + Fixed errors on releases due to newer compilers from failing by
    only adding -Werror for non-release builds.
  + Fixed error message when the DB is too new in tpm2_ptool.
  + Added support for tpm2_ptool import with ssh-keygen format
    keys. Note: Requires cryptography &gt;= 3.0.
  + Changed default long level from error to warning.
  + Added better error message for FAPI backend errors along with
    docs/FAPI.md document.
  + Changed tpm2_ptool make --algorithm optional.
  + Fixed error message of wrong attribute name on expected attribute
    check to be false.
  + Added support for ECDSA 256, 384 and 512.
  + Fixed a bug in the Python code DB upgrade path from 4 to 5 where
    it didn't add AES mode CTR to CKA_ALLOWED_MECHANISMS.
  + Added tpm2_ptool support for ECC key size 192.
  + Added support passwordless login for tokens, ie not setting
    CKF_LOGIN_REQUIRED.
  + Fixed Running integration tests when Java version has the -ea,
    like on Debian 11 and OpenJDK 17.
  + Added support for HMAC keys using tpm2_ptool and the C_Sign and
    C_Verify interfaces. The following interfaces in ptool have
    support:
  * addkey: previous working versions of tpm2-tools will support
    this.
  * link: previous working versions of tpm2-tools will support this.
  * import: requires tpm2-tools 5.2+ for support.
  + Fixed leaking of temp file descriptors in tpm2_ptool.
  + Fixed wrong free in tpm code, should use Esys_Free.
  + Fixed a space formatting issue in tpm2_ptool verify.
  + Fixed leaked file descriptor in tpm2_ptool.
  + Fixed a few suspicious sizeof usages in str_padded_copy
  + Fixed a memory leak of the token list on a failure condition in
    initialization.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1634731201">- Add keyring &amp; use source verification</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1645876800">- Use hardlinks in %fdupes for python files</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Update to 1.8.0
  + Fixed
  * Fix GetRandom Memory Leak
  * Fix some spelling mistakes
  * Fix unit test test_parser
  * Fix importing of RSA private key through pkcs11 interface should
    fail.
  * Fix ECDSA signature length calculation.
  * Fix memory leak of tokens.
  * Fix suspicious sizeof usage in _str_padded_copy
  * Fix encoding errors when importing a certificate into the pkcs11
    store.
  * Fix try/finally scope issues in tpm2_ptool.
  * Fix, an OOB access in db upgrade path.
  * Fix ECDSA length calculation that was causing issues with Mutual
    TLS in Firefox and Chrome.
  + Changed
  * remove unused macro set_safe_rc
  + Added
  * Add support for OpenSSL 3. Note that calls through engine are no
    longer supported on OpenSSL3.
  * Add tpm2_ptool export commandlet for exporting token keys into
    PEM and TPM blob format.
- Add new dependencies to PyYAML, cryptography, pyasn1 and tpm2-pytss</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to 1.9.0
  + Fixed
  * Fix autoconf invocation on a release tarball not being a git
    repo for VERSION. VERSION file now generated and packaged as
    part of the release tarball from the git version information.
  * Fix TPM2_PKCS11_OWNER_AUTH not being used when a persistent SRK
    is needed in the C_InitToken path.
  * During an upgrade of the database to version 4, the config key
    'persistent' is added instead of 'transient', causing KeyError
    when using the upgraded database.
  * Leave the original db on upgrade failure, a bug caused the
    original db to be unlinked not the upgraded db.
  * A bug prevented the use of CreateLoaded if the TPM supports the
    command.
  * A bug when creating keys through the PKCS11 interface (not
    tpm2-ptool), the attributes for CKA_ALLOWED_MECHANISMS were
    encoded as a hex string and not a sequence of ints within the
    YAML. Correcting this will trigger a db upgrade to 8
  + Added
  * Env varibale PKCS11_SQL_LOCK to allow setting a lock directory,
    eg for temprary directory so lock files do not persist across
    reboots.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684411200">- Merge subpackages lib and devel into the main one</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1733918400">- Update to 1.9.1
  + Fixed
  * configure:
    Change mistaken += to =.
    use user supplied --prefix even when p11kit is detected.
  * Remove warning about unable to find FAPI when it's is not-compiled in and not chosen as the beckend.
  * Fix memory leaks in tpm_create_transient_primary_from_template.
  * Fix NULL pointer dereference in db.c on uses of CKA_ALLOWED_MECHANISMS.
  * Fix offset miscalculation in FAPI backend that was corrupting data.
  * Support CKM_ECDH1_DERIVE via C_DeriveKey.
  * Fix usages of tpm2-ptool for its wrapped tpm2_ptool in tests.
  * Fix failing db upgrades on double conversion to int.
  * Fix db lock file due to missing parenthesis and order of operations.
  * documentation:
    Fix use of objects where tokens was meant.
  + Changed
  * --enable-fapi to --with-fapi. Note this is not a major version bump as its internal to builders only. However --enable-fapi left in place for backwards compat.
  + Add maintainer public key:
    tpm2-pkcs11.keyring</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734004800">- Enable unit testing</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1781092800">- Use pyproject macros to build and install the tools.</changelog>
</package>
<package pkgid="0a24a534641add8753b70e4acb30b702e9db9db4a089c7fdc4dbfed70972a9ba24c2467482ff6f12e30e45281dd7f8401e4df7ec078d1a2c3f8aa49c8a67472e" name="tpm2-pkcs11" arch="src">
  <version epoch="0" ver="1.9.1" rel="23.3"/>
  <changelog author="Alexander Evseev &lt;aevseev@gmail.com&gt; - 1.3.1" date="1596456000">- First build. Version - 1.3.1</changelog>
  <changelog author="Alexander Evseev &lt;aevseev@gmail.com&gt; - 1.4.0" date="1599652800">- New upstream version - 1.4.0</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1629460800">- Clean spec file
- Use better source URL
- Split library
- Don't package .la files
- Create store directory
- Move devel library to devel subpackage</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1629547200">- Build and install python tools</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1629633600">- Use definite tense in %description.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1634731200">- Update to 1.7.0
  + DB Schema Change from 5 to 7.
  * Backup your DB before upgrading
  + Fixed compilation issues with GCC11.
  + Fixed errors on releases due to newer compilers from failing by
    only adding -Werror for non-release builds.
  + Fixed error message when the DB is too new in tpm2_ptool.
  + Added support for tpm2_ptool import with ssh-keygen format
    keys. Note: Requires cryptography &gt;= 3.0.
  + Changed default long level from error to warning.
  + Added better error message for FAPI backend errors along with
    docs/FAPI.md document.
  + Changed tpm2_ptool make --algorithm optional.
  + Fixed error message of wrong attribute name on expected attribute
    check to be false.
  + Added support for ECDSA 256, 384 and 512.
  + Fixed a bug in the Python code DB upgrade path from 4 to 5 where
    it didn't add AES mode CTR to CKA_ALLOWED_MECHANISMS.
  + Added tpm2_ptool support for ECC key size 192.
  + Added support passwordless login for tokens, ie not setting
    CKF_LOGIN_REQUIRED.
  + Fixed Running integration tests when Java version has the -ea,
    like on Debian 11 and OpenJDK 17.
  + Added support for HMAC keys using tpm2_ptool and the C_Sign and
    C_Verify interfaces. The following interfaces in ptool have
    support:
  * addkey: previous working versions of tpm2-tools will support
    this.
  * link: previous working versions of tpm2-tools will support this.
  * import: requires tpm2-tools 5.2+ for support.
  + Fixed leaking of temp file descriptors in tpm2_ptool.
  + Fixed wrong free in tpm code, should use Esys_Free.
  + Fixed a space formatting issue in tpm2_ptool verify.
  + Fixed leaked file descriptor in tpm2_ptool.
  + Fixed a few suspicious sizeof usages in str_padded_copy
  + Fixed a memory leak of the token list on a failure condition in
    initialization.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1634731201">- Add keyring &amp; use source verification</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1645876800">- Use hardlinks in %fdupes for python files</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Update to 1.8.0
  + Fixed
  * Fix GetRandom Memory Leak
  * Fix some spelling mistakes
  * Fix unit test test_parser
  * Fix importing of RSA private key through pkcs11 interface should
    fail.
  * Fix ECDSA signature length calculation.
  * Fix memory leak of tokens.
  * Fix suspicious sizeof usage in _str_padded_copy
  * Fix encoding errors when importing a certificate into the pkcs11
    store.
  * Fix try/finally scope issues in tpm2_ptool.
  * Fix, an OOB access in db upgrade path.
  * Fix ECDSA length calculation that was causing issues with Mutual
    TLS in Firefox and Chrome.
  + Changed
  * remove unused macro set_safe_rc
  + Added
  * Add support for OpenSSL 3. Note that calls through engine are no
    longer supported on OpenSSL3.
  * Add tpm2_ptool export commandlet for exporting token keys into
    PEM and TPM blob format.
- Add new dependencies to PyYAML, cryptography, pyasn1 and tpm2-pytss</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to 1.9.0
  + Fixed
  * Fix autoconf invocation on a release tarball not being a git
    repo for VERSION. VERSION file now generated and packaged as
    part of the release tarball from the git version information.
  * Fix TPM2_PKCS11_OWNER_AUTH not being used when a persistent SRK
    is needed in the C_InitToken path.
  * During an upgrade of the database to version 4, the config key
    'persistent' is added instead of 'transient', causing KeyError
    when using the upgraded database.
  * Leave the original db on upgrade failure, a bug caused the
    original db to be unlinked not the upgraded db.
  * A bug prevented the use of CreateLoaded if the TPM supports the
    command.
  * A bug when creating keys through the PKCS11 interface (not
    tpm2-ptool), the attributes for CKA_ALLOWED_MECHANISMS were
    encoded as a hex string and not a sequence of ints within the
    YAML. Correcting this will trigger a db upgrade to 8
  + Added
  * Env varibale PKCS11_SQL_LOCK to allow setting a lock directory,
    eg for temprary directory so lock files do not persist across
    reboots.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684411200">- Merge subpackages lib and devel into the main one</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1733918400">- Update to 1.9.1
  + Fixed
  * configure:
    Change mistaken += to =.
    use user supplied --prefix even when p11kit is detected.
  * Remove warning about unable to find FAPI when it's is not-compiled in and not chosen as the beckend.
  * Fix memory leaks in tpm_create_transient_primary_from_template.
  * Fix NULL pointer dereference in db.c on uses of CKA_ALLOWED_MECHANISMS.
  * Fix offset miscalculation in FAPI backend that was corrupting data.
  * Support CKM_ECDH1_DERIVE via C_DeriveKey.
  * Fix usages of tpm2-ptool for its wrapped tpm2_ptool in tests.
  * Fix failing db upgrades on double conversion to int.
  * Fix db lock file due to missing parenthesis and order of operations.
  * documentation:
    Fix use of objects where tokens was meant.
  + Changed
  * --enable-fapi to --with-fapi. Note this is not a major version bump as its internal to builders only. However --enable-fapi left in place for backwards compat.
  + Add maintainer public key:
    tpm2-pkcs11.keyring</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734004800">- Enable unit testing</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1781092800">- Use pyproject macros to build and install the tools.</changelog>
</package>
<package pkgid="0b4dececb04026e32973a6f127042b48e88e7f10efe930cd3ac2eb9c3570e36cf7f54516de72f75fceb0ab2e4f7594cba13195bd03bef834886c82b885315a3a" name="tpm2-pkcs11-debuginfo" arch="s390x">
  <version epoch="0" ver="1.9.1" rel="23.3"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1629633600">- Use definite tense in %description.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1634731200">- Update to 1.7.0
  + DB Schema Change from 5 to 7.
  * Backup your DB before upgrading
  + Fixed compilation issues with GCC11.
  + Fixed errors on releases due to newer compilers from failing by
    only adding -Werror for non-release builds.
  + Fixed error message when the DB is too new in tpm2_ptool.
  + Added support for tpm2_ptool import with ssh-keygen format
    keys. Note: Requires cryptography &gt;= 3.0.
  + Changed default long level from error to warning.
  + Added better error message for FAPI backend errors along with
    docs/FAPI.md document.
  + Changed tpm2_ptool make --algorithm optional.
  + Fixed error message of wrong attribute name on expected attribute
    check to be false.
  + Added support for ECDSA 256, 384 and 512.
  + Fixed a bug in the Python code DB upgrade path from 4 to 5 where
    it didn't add AES mode CTR to CKA_ALLOWED_MECHANISMS.
  + Added tpm2_ptool support for ECC key size 192.
  + Added support passwordless login for tokens, ie not setting
    CKF_LOGIN_REQUIRED.
  + Fixed Running integration tests when Java version has the -ea,
    like on Debian 11 and OpenJDK 17.
  + Added support for HMAC keys using tpm2_ptool and the C_Sign and
    C_Verify interfaces. The following interfaces in ptool have
    support:
  * addkey: previous working versions of tpm2-tools will support
    this.
  * link: previous working versions of tpm2-tools will support this.
  * import: requires tpm2-tools 5.2+ for support.
  + Fixed leaking of temp file descriptors in tpm2_ptool.
  + Fixed wrong free in tpm code, should use Esys_Free.
  + Fixed a space formatting issue in tpm2_ptool verify.
  + Fixed leaked file descriptor in tpm2_ptool.
  + Fixed a few suspicious sizeof usages in str_padded_copy
  + Fixed a memory leak of the token list on a failure condition in
    initialization.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1634731201">- Add keyring &amp; use source verification</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1645876800">- Use hardlinks in %fdupes for python files</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Update to 1.8.0
  + Fixed
  * Fix GetRandom Memory Leak
  * Fix some spelling mistakes
  * Fix unit test test_parser
  * Fix importing of RSA private key through pkcs11 interface should
    fail.
  * Fix ECDSA signature length calculation.
  * Fix memory leak of tokens.
  * Fix suspicious sizeof usage in _str_padded_copy
  * Fix encoding errors when importing a certificate into the pkcs11
    store.
  * Fix try/finally scope issues in tpm2_ptool.
  * Fix, an OOB access in db upgrade path.
  * Fix ECDSA length calculation that was causing issues with Mutual
    TLS in Firefox and Chrome.
  + Changed
  * remove unused macro set_safe_rc
  + Added
  * Add support for OpenSSL 3. Note that calls through engine are no
    longer supported on OpenSSL3.
  * Add tpm2_ptool export commandlet for exporting token keys into
    PEM and TPM blob format.
- Add new dependencies to PyYAML, cryptography, pyasn1 and tpm2-pytss</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to 1.9.0
  + Fixed
  * Fix autoconf invocation on a release tarball not being a git
    repo for VERSION. VERSION file now generated and packaged as
    part of the release tarball from the git version information.
  * Fix TPM2_PKCS11_OWNER_AUTH not being used when a persistent SRK
    is needed in the C_InitToken path.
  * During an upgrade of the database to version 4, the config key
    'persistent' is added instead of 'transient', causing KeyError
    when using the upgraded database.
  * Leave the original db on upgrade failure, a bug caused the
    original db to be unlinked not the upgraded db.
  * A bug prevented the use of CreateLoaded if the TPM supports the
    command.
  * A bug when creating keys through the PKCS11 interface (not
    tpm2-ptool), the attributes for CKA_ALLOWED_MECHANISMS were
    encoded as a hex string and not a sequence of ints within the
    YAML. Correcting this will trigger a db upgrade to 8
  + Added
  * Env varibale PKCS11_SQL_LOCK to allow setting a lock directory,
    eg for temprary directory so lock files do not persist across
    reboots.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684411200">- Merge subpackages lib and devel into the main one</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1733918400">- Update to 1.9.1
  + Fixed
  * configure:
    Change mistaken += to =.
    use user supplied --prefix even when p11kit is detected.
  * Remove warning about unable to find FAPI when it's is not-compiled in and not chosen as the beckend.
  * Fix memory leaks in tpm_create_transient_primary_from_template.
  * Fix NULL pointer dereference in db.c on uses of CKA_ALLOWED_MECHANISMS.
  * Fix offset miscalculation in FAPI backend that was corrupting data.
  * Support CKM_ECDH1_DERIVE via C_DeriveKey.
  * Fix usages of tpm2-ptool for its wrapped tpm2_ptool in tests.
  * Fix failing db upgrades on double conversion to int.
  * Fix db lock file due to missing parenthesis and order of operations.
  * documentation:
    Fix use of objects where tokens was meant.
  + Changed
  * --enable-fapi to --with-fapi. Note this is not a major version bump as its internal to builders only. However --enable-fapi left in place for backwards compat.
  + Add maintainer public key:
    tpm2-pkcs11.keyring</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734004800">- Enable unit testing</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1781092800">- Use pyproject macros to build and install the tools.</changelog>
</package>
<package pkgid="2a2c35bbc9f2d2d2384f597378971c22bde1471d4be56471eb77ee5fdd6c9f6ec64c2fb4a276cdb56bc1ed2c6a05ae529453e366fb9518227aa8790841005ae9" name="tpm2-pkcs11-debugsource" arch="s390x">
  <version epoch="0" ver="1.9.1" rel="23.3"/>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1629633600">- Use definite tense in %description.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1634731200">- Update to 1.7.0
  + DB Schema Change from 5 to 7.
  * Backup your DB before upgrading
  + Fixed compilation issues with GCC11.
  + Fixed errors on releases due to newer compilers from failing by
    only adding -Werror for non-release builds.
  + Fixed error message when the DB is too new in tpm2_ptool.
  + Added support for tpm2_ptool import with ssh-keygen format
    keys. Note: Requires cryptography &gt;= 3.0.
  + Changed default long level from error to warning.
  + Added better error message for FAPI backend errors along with
    docs/FAPI.md document.
  + Changed tpm2_ptool make --algorithm optional.
  + Fixed error message of wrong attribute name on expected attribute
    check to be false.
  + Added support for ECDSA 256, 384 and 512.
  + Fixed a bug in the Python code DB upgrade path from 4 to 5 where
    it didn't add AES mode CTR to CKA_ALLOWED_MECHANISMS.
  + Added tpm2_ptool support for ECC key size 192.
  + Added support passwordless login for tokens, ie not setting
    CKF_LOGIN_REQUIRED.
  + Fixed Running integration tests when Java version has the -ea,
    like on Debian 11 and OpenJDK 17.
  + Added support for HMAC keys using tpm2_ptool and the C_Sign and
    C_Verify interfaces. The following interfaces in ptool have
    support:
  * addkey: previous working versions of tpm2-tools will support
    this.
  * link: previous working versions of tpm2-tools will support this.
  * import: requires tpm2-tools 5.2+ for support.
  + Fixed leaking of temp file descriptors in tpm2_ptool.
  + Fixed wrong free in tpm code, should use Esys_Free.
  + Fixed a space formatting issue in tpm2_ptool verify.
  + Fixed leaked file descriptor in tpm2_ptool.
  + Fixed a few suspicious sizeof usages in str_padded_copy
  + Fixed a memory leak of the token list on a failure condition in
    initialization.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1634731201">- Add keyring &amp; use source verification</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1645876800">- Use hardlinks in %fdupes for python files</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Update to 1.8.0
  + Fixed
  * Fix GetRandom Memory Leak
  * Fix some spelling mistakes
  * Fix unit test test_parser
  * Fix importing of RSA private key through pkcs11 interface should
    fail.
  * Fix ECDSA signature length calculation.
  * Fix memory leak of tokens.
  * Fix suspicious sizeof usage in _str_padded_copy
  * Fix encoding errors when importing a certificate into the pkcs11
    store.
  * Fix try/finally scope issues in tpm2_ptool.
  * Fix, an OOB access in db upgrade path.
  * Fix ECDSA length calculation that was causing issues with Mutual
    TLS in Firefox and Chrome.
  + Changed
  * remove unused macro set_safe_rc
  + Added
  * Add support for OpenSSL 3. Note that calls through engine are no
    longer supported on OpenSSL3.
  * Add tpm2_ptool export commandlet for exporting token keys into
    PEM and TPM blob format.
- Add new dependencies to PyYAML, cryptography, pyasn1 and tpm2-pytss</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to 1.9.0
  + Fixed
  * Fix autoconf invocation on a release tarball not being a git
    repo for VERSION. VERSION file now generated and packaged as
    part of the release tarball from the git version information.
  * Fix TPM2_PKCS11_OWNER_AUTH not being used when a persistent SRK
    is needed in the C_InitToken path.
  * During an upgrade of the database to version 4, the config key
    'persistent' is added instead of 'transient', causing KeyError
    when using the upgraded database.
  * Leave the original db on upgrade failure, a bug caused the
    original db to be unlinked not the upgraded db.
  * A bug prevented the use of CreateLoaded if the TPM supports the
    command.
  * A bug when creating keys through the PKCS11 interface (not
    tpm2-ptool), the attributes for CKA_ALLOWED_MECHANISMS were
    encoded as a hex string and not a sequence of ints within the
    YAML. Correcting this will trigger a db upgrade to 8
  + Added
  * Env varibale PKCS11_SQL_LOCK to allow setting a lock directory,
    eg for temprary directory so lock files do not persist across
    reboots.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684411200">- Merge subpackages lib and devel into the main one</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1733918400">- Update to 1.9.1
  + Fixed
  * configure:
    Change mistaken += to =.
    use user supplied --prefix even when p11kit is detected.
  * Remove warning about unable to find FAPI when it's is not-compiled in and not chosen as the beckend.
  * Fix memory leaks in tpm_create_transient_primary_from_template.
  * Fix NULL pointer dereference in db.c on uses of CKA_ALLOWED_MECHANISMS.
  * Fix offset miscalculation in FAPI backend that was corrupting data.
  * Support CKM_ECDH1_DERIVE via C_DeriveKey.
  * Fix usages of tpm2-ptool for its wrapped tpm2_ptool in tests.
  * Fix failing db upgrades on double conversion to int.
  * Fix db lock file due to missing parenthesis and order of operations.
  * documentation:
    Fix use of objects where tokens was meant.
  + Changed
  * --enable-fapi to --with-fapi. Note this is not a major version bump as its internal to builders only. However --enable-fapi left in place for backwards compat.
  + Add maintainer public key:
    tpm2-pkcs11.keyring</changelog>
  <changelog author="Lucas Mulling &lt;lucas.mulling@suse.com&gt;" date="1734004800">- Enable unit testing</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1781092800">- Use pyproject macros to build and install the tools.</changelog>
</package>
<package pkgid="80b9adb2ac1e47dd1e29a4358540e546416403dda27750299c3b7bfc7b3ba7252b0db59a80ff6e8126b893eb6f6e8fb9f59488befc0818ebebc4ba471fcd6316" name="tpm2-totp" arch="s390x">
  <version epoch="0" ver="20240326.33e1986" rel="13.1"/>
  <changelog author="Dominik Heidler &lt;dheidler@suse.de&gt;" date="1749211200">- Initial checkin</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1749816000">- Do not (ever) use Epoch; it has devestating effects on version
  comparisons. As Epoch was set to 1, removing indicates a
  downgrade for installations, but better bite the bullet than keep
  it.</changelog>
</package>
<package pkgid="50ed59156331b63c3668e7e513d0177f1665792084e0beca1800aa61714d30b42c5ccb96edfa2c83930891d6b0b1a097c97ce818061ceba95a203532e5ff4b66" name="tpm2-totp" arch="src">
  <version epoch="0" ver="20240326.33e1986" rel="13.1"/>
  <changelog author="Dominik Heidler &lt;dheidler@suse.de&gt;" date="1749211200">- Initial checkin</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1749816000">- Do not (ever) use Epoch; it has devestating effects on version
  comparisons. As Epoch was set to 1, removing indicates a
  downgrade for installations, but better bite the bullet than keep
  it.</changelog>
</package>
<package pkgid="85d22d1ba0e465d23e677453f36180a1634f775a0b350a3a21ce134ce27a80f88fa49b1644e4371391ccd389f914de16800b38afa1fcff444108cfe928768fd5" name="tpm2-totp-debuginfo" arch="s390x">
  <version epoch="0" ver="20240326.33e1986" rel="13.1"/>
  <changelog author="Dominik Heidler &lt;dheidler@suse.de&gt;" date="1749211200">- Initial checkin</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1749816000">- Do not (ever) use Epoch; it has devestating effects on version
  comparisons. As Epoch was set to 1, removing indicates a
  downgrade for installations, but better bite the bullet than keep
  it.</changelog>
</package>
<package pkgid="18b68d88e75ab50a5e888afdbddf873ff531728e353f2c158e9a56dfa1a5083c1ef498027bb7ac75bcd30c43938419946edb961da62c2722e6842602e475165f" name="tpm2-totp-debugsource" arch="s390x">
  <version epoch="0" ver="20240326.33e1986" rel="13.1"/>
  <changelog author="Dominik Heidler &lt;dheidler@suse.de&gt;" date="1749211200">- Initial checkin</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1749816000">- Do not (ever) use Epoch; it has devestating effects on version
  comparisons. As Epoch was set to 1, removing indicates a
  downgrade for installations, but better bite the bullet than keep
  it.</changelog>
</package>
<package pkgid="7765b3f0e6dbafed2ac679033af42d2f6516500c51c7615249078b2726b09512a4c090dc91f4e20aa742109ca1aa9b0e7c30d2e572a96063a8475590e2ae1b32" name="tpm2-tss-engine" arch="s390x">
  <version epoch="0" ver="1.2.0" rel="36.16"/>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="f9518e645f9bfc9803c7476a093393b038983b282382372e298175e546013c29e9516ffea3c84c95bbfa52e638f439a91b0b50852a279648d2308e6ce48b7e6e" name="tpm2-tss-engine" arch="src">
  <version epoch="0" ver="1.2.0" rel="36.16"/>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1545652800">- Initial import
  * version 0.0+git20181128.c9061a7
  * FATE 325619</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1548244800">- Update to version 0+git20190115.6cfaeb7:
  * Initialize/Finalize TCTI based on opts
  * init_tpm_parent: use ESYS_AUXCONTEXT as 1st argument
  * init_tpm_key: use ESYS_AUXCONTEXT as 1st argument
  * tpm2-tss-engine-ecc.c: use ESYS_AUXCONTEXT
  * tpm2-tss-engine-rsa.c: use ESYS_AUXCONTEXT
  * tpm2-tss-engine-rand.c: use ESYS_AUXCONTEXT
  * tpm2tss_tpm2data_readtpm: use ESYS_AUXCONTEXT
  * tpm2-tss-engine-common.(c/h): Add ESYS_AUXCONTEXT
  * Set TCTI option through an environment variable
  * Add new engine control to set the TCTI option</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1548244801">- Build bash-completion as noarch.</changelog>
  <changelog author="Jason Sikes &lt;jsikes@suse.de&gt;" date="1548936000">- Now tpm2-tss-engine-bash-completion auto-installs only when bash-completion
  is present.
- Changed author of comment dated "Wed Jan 23 04:39:01 UTC 2019" from
  opensuse-packaging@opensuse.org to me.</changelog>
  <changelog author="jsikes@suse.de" date="1551614400">- Update to version 0+git20190222.cef2c43:
  * build: install existing man pages even if pandoc is not available
  * Updated organizational files in preparation for release
  * Add configure switch for unit and integration tests
  * Silence clang warning on field initializers
  * Fix parallel connections to TPM.
  * Fix segfault on non-null auth'd persistent keys.
  * Update tests to also run on physical TPMs
  * build: install aclocal files
  * build: update for ax_code_coverage.m4 version 2019.01.06
  * ECDSA truncation and s_server test</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="23d95b24101dede438073cb3848c1a826257d3cbbfdddbf0d927a3151e0f15c6e566e043bb7c116f4613f2551f929a49647df32df18d334c0c70828cd23c4634" name="tpm2-tss-engine-bash-completion" arch="noarch">
  <version epoch="0" ver="1.2.0" rel="36.16"/>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="acd9094b3f8ee01f76a295258914020711681bcb19bef81833a9403eb1b8fb1ebc077efdcd264d6bb2e2d60c96c603876fed94a547cf03bf06780b7d11b6d747" name="tpm2-tss-engine-debuginfo" arch="s390x">
  <version epoch="0" ver="1.2.0" rel="36.16"/>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="eea3ad322e468d79408e614465f7c39948e5a48392a281effbab75d6c9b2c133210b167c54c60478f482d380065bd8e6e67ea1c1f1fb080421cf69af95585a3d" name="tpm2-tss-engine-debugsource" arch="s390x">
  <version epoch="0" ver="1.2.0" rel="36.16"/>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="3be175d4e0b394897109f72676c477e0d1e4b41d397f43cc4b344bfa53b6650cd3fc890cae834866a6a7813326d1cc96737bb3a57332ad350d61081f8831b0eb" name="tpm2-tss-engine-devel" arch="s390x">
  <version epoch="0" ver="1.2.0" rel="36.16"/>
  <changelog author="matthias.gerstner@suse.com" date="1576843200">- move *.so files into the main package, not -devel. libtpm2tss.so is actually
  the engine library itself, not a symlink. It's needed to actually use the
  package. tpm2tss.so is probably a (backwards) compatiblity symlink. Both are
  not intended for linking and therefore not suitable for the -devel package.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578398400">- Update to stable upstream version v1.0.1:
  * Release v1.0.1
  * test: use tpm2-tools 3.X
  * Tests: Fix for latest tools
  * Tests: Use long parameters for tpm2-tools
  * test: migrate tpm2_create option from -A to -b
  * build: link against tss2-mu
  * Release v1.0.0
  * Release v1.0.0-rc3
  * Docu: Update Install.md
  * Updates for 1.0.0-rc2
  * TESTS: Add test for client auth
  * Bump required version of tpm2-tss to &gt;=2.2.2
  * Build: Bump required tpm2-tss to 2.2
  * Update for v1.0.0-rc1
  * Dead code removal
- This fixes the build against tpm2-0-tss version &gt;= 2.3 (bsc#1160123)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1578657600">- switch the _service approach from using tar_scm to using download_files. We
  need to use the actual release tarball which contains the generated man
  pages. The reason is that on SLE we can't generate the man pages using
  pandoc, since pandoc is not available on SLE.
- for the same reason make the pandoc BuildRequires conditional for openSUSE
  vs. SLE.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578657601">- remove the _service file as requested in declined OBS sr#762653.
  download_files seems to work also without the _service file.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1587643200">- remove conditional pandoc BuildRequires for openSUSE. Nothing much is gained
  from rebuilding the man pages. This shall help synchronizing SLE and
  openSUSE package builds. (jsc#SLE-12137).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772800">- Update to upstream version 1.1.0:
  * Added:
  - Configure option for ptpm tests
  - Configure script AX_CHECK_ENABLE_DEBUG
  - Option for setting tcti on executable
  - TCTI-env variable used by default
  - Support for parent key passwords
  - openssl.cnf sample file
  * Changed:
  - Fix several build system, autotools and testing related issues
    Now adhere to CFLAGS conventions
  - Include pkg-config dependecy on libtss2-mu in order to work with tpm2-tss 2.3
  - Enables parallel testing of integration tests:
    Make integration tests use TPM simulator; instead of first TPM it finds
    Use of different port numbers for TCP based tests
  - Fix EC param info (using named curve format)
  - Use tpm2-tools 4.X stable branch for integration tests
  - Use libtss2-tctildr.so instead of custom code for tcti setup
  - Fix manpages for -P/--parent option and correct engine name
  - Fix TCTI env variable handling
  - Set parent handle to OWNER</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1614772801">- pass --disable-defaultflags to avoid breakage of our gcc-PIE profile (-&gt;
  resulted in non-position-independent executable) (bsc#1183895).</changelog>
  <changelog author="Pedro Monreal &lt;pmonreal@suse.com&gt;" date="1675684800">- Update to upstream version 1.2.0:
  * Fixed:
  - Updated minimal version of tpm2-tss to 2.4.x
  - Fix encoding of emptyauth
  - Fix some memory leaks
  - Parent handle issues with signed representation by switching
    parent handle to BIGNUM.
  - Fixed RSA_NO_PADDING modes with OpenSSL 1.1.1
  - Fixed autogen (bootstrap) call from release package by
    embedding VERSION file.
  * Added:
  - Use of restricted keys for signing
  - StirRandom
  - Run tests using swtpm
  - The ability to import key blobs from things like the
    tpm2-tools project.
  - Compatibility with openssl &gt;=1.1.x
  - Support for ECDH
  - QNX support.
  - Only set -Werror for non-release builds.
  - Additional checks on TPM responses
  - CODE_OF_CONDUCT
  - SECURITY reporting instructions</changelog>
  <changelog author="Frederic Crozat &lt;fcrozat@suse.com&gt;" date="1685620800">- Fix download url and add gpg signature for tarball.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714996800">- Add gcc14-fixes.patch: Building with gcc14 fails due to a mismatch in
  OpenSSL function declarations. Provided PR# to upstream here:
  https://github.com/tpm2-software/tpm2-tss-engine/pull/283
- Add tpm2-tss-engine.keyring: needed for validation of the tarball signature.
  This keyring is taken over from tpm2-0-tss which has the same (or very
  similar) maintainers.</changelog>
</package>
<package pkgid="2c715eb9ee7e414e24eabb3444546ed4a20fd7e84619ca3fd8afe65a9a99164618be660441a7a1054aaeda283179f56fa0e8175225e969a4b9391164db2d3932" name="tpm2.0-abrmd" arch="s390x">
  <version epoch="0" ver="3.0.0" rel="101.36"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="bae31756d337c2c548e7b047cfd59c02d56513aafb8f34a044b984d16c848bee40c6d8823169b1b743c070b9b0707b8fef9d7bbc3b5f8550841355ac1c323ca0" name="tpm2.0-abrmd" arch="src">
  <version epoch="0" ver="3.0.0" rel="101.36"/>
  <changelog author="mgerstner &lt;matthias.gerstner@suse.com&gt;" date="1566820800">- update to version 2.1.1:
  - changes in version 2.1.1:
  - Unit tests accessing dbus have been fixed to use mock functions. Unit
    tests no longer depend on dbus.
  - Race condition between client connections and dbus proxy object
    creation by registering bus name after instantiation of the proxy object.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1576065600">- update to version 2.3.0:
  - changes in version 2.3.0:
  - Add '--enable-debug' flag to configure script to simplify debug builds.
    This relies on the AX_CHECK_ENABLE_DEBUG autoconf archive macro.
  - Replaced custom dynamic TCTI loading code with libtss2-tctildr from
    upstream tpm2-tss repo. (requires tpm2-0-tss version 2.3.0)
  - Explicitly set '-O2' optimization when using FORTIFY_SOURCE as required.
  - changes in version 2.2.0:
  - New configuration option `--disable-defaultflags/ added. This is
    for use for packaging for targets that do not support the default
    compilation / linking flags.
  - Use private dependencies properly in pkg-config metadata for TCTI.
  - Refactor daemon main module to enable better handling of error
    conditions and enable more thorough unit testing.
  - Updated dependencies to ensure compatibility with pkg-config fixes
    in tpm2-tss.
  - Fixed bug causing TCTI to block when used by libtss2-sys built with
    partial reads enabled.
  - Removed unnecessary libs / flags for pthreads in the TCTI pkg-config.
  - Output from configure script now accurately describes the state of the
    flags that govern the integration tests.
- drop fix_dlopen.patch: no longer necessary since abrmd not uses the tctildr
  shared library. This one hopefully now does the right thing.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1603368000">- update to version 2.3.3:
  - changes in version 2.3.1:
  - Fixed handle resource leak exhausting TPM resources.
  - changes in version 2.3.2:
  - Added cirrus CI specific config files to enable FreeBSD builds.
  - Changed test scripts to be more portable.
  - Changed include header paths specific to FreeBSD.
  - changes in version 2.3.1:
  - Provide meaningful exit codes on initialization failures.
  - Prevent systemd from starting the daemon before udev changes ownership
    of the TPM device node.
  - Prevent systemd from starting the daemon if there is no TPM device node.
  - Prevent systemd from restarting the daemon if it fails.
  - Add SELinux policy to allow daemon to resolve names.
  - Add SELinux policy boolean (disabled by default) to allow daemon to
    connect to all unreserved ports.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1623240000">- Requires libtss2-tcti-{device0,tabrmd0} (bsc#1187077).
  In MicroOS systems the recommendations are not installed, making the
  service fail to initialize: Failed to instantiate TCTI</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1626264000">- Update to version 2.4.0:
  - Service start depends on systemd device unit: dev-tpm0.device.
  - Numerous memory leaks.
  - udev settle service deprecation warnings.
  - StandardOutput=syslog deprecation warnings.
- Add selinux module files
- Move dbus files out of /etc</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1626523200">- Move selinux devel file to devel subpackage</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1637841600">- Added hardening to systemd service(s) (bsc#1181400). Added patch(es):
  * harden_tpm2-abrmd.service.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1638187200">- Warp selinux into a bcond</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1638964800">- Version 2.4.0
  + remover syslog deprecation warning (bsc#1185154)
  + cover update to 2.3.3 (jsc#SLE-17366)
  + contains reload fix (bsc#1166936)
  + fix tcti loading using short / long names (bsc#1159176)</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1649073600">- dbus-access.patch: restrict D-Bus access to tpm2-abrmd to members of the tss
  group (bsc#1197532). This prevents arbitrary users from meddling with TPM
  state and thus potential denial-of-service vectors.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="ca71f27127c4c7e7c377bb491afb8abafa466c36ce8d87f599605bc57c28c20a1da541f9926fac9b22111c4bf9187a9514cf3f70ab21594bd0621f2ba93089d3" name="tpm2.0-abrmd-debuginfo" arch="s390x">
  <version epoch="0" ver="3.0.0" rel="101.36"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="4e72f4289e7b69a1cd0482e87657f3f9e7a1d4297798badac2c5f80a5e781a0f319b94e0aedb04a4c17e4ad9af85c2226a115bb799cb2e3b6c5df1840e7c19f5" name="tpm2.0-abrmd-debugsource" arch="s390x">
  <version epoch="0" ver="3.0.0" rel="101.36"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="d7c04a94e6deae9b637f1753368bcf325f3614963128ddcae71ef75bceaf0b25e3da1e469d9ba9149721b58e6567d2630d270b8b21cf512b6199a267f76e4bd1" name="tpm2.0-abrmd-devel" arch="s390x">
  <version epoch="0" ver="3.0.0" rel="101.36"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="e9223dad43a3f03d0f16bd6f8e3bb4ab06c32214146d22a80aef2377f58ec86ea5406be0e1dfdfb9014986405c3f47a88f03501cef063c143b82fd88d6f60f3d" name="tpm2.0-abrmd-selinux" arch="noarch">
  <version epoch="0" ver="3.0.0" rel="101.36"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Version 2.4.1
  + Added
    Contributor Covenant Code of Conduct.
  + Fixed
  * superflous warning messages about tcti status.
    WARNING **: 11:00:56.205: tcti_conf before: "(null)"
    WARNING **: 11:00:56.205: tcti_conf after: "mssim"
  * GCC 11 build error: error: argument 2 of __atomic_load’ discards
    'volatile' qualifier
  * Initialize gerror pointer variable to NULL to fix use of
    unitialized memory and segfault.
  * Updated missing defaults in manpage.
  * Port CI to composite actions in tpm2-software/ci.
  + Removed
    Dependency on 'which' utility in configure.ac.
    ubuntu-16.04 from CI.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Version 3.0.0
  + Fixed
  * A bug in special command processing in TPM2_GetCapability when
    an audit session is in use cuased tpm2-abrmd to abort.
  + Added
  * New SELinux interfaces for communication with keylime
  + Changed
  * DBUS permissions in tpm2-abrmd.conf to match the in-kernel RM,
    ie /dev/tpmrm0, permissions. Now users MUST be in the tss group
    to send to tpm2-abrmd over DBUS.
- Drop dbus-access.patch (merged in PR#805)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684843200">- Cover ALP via the %{suse_version} macro</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1722513600">- Update harden_tpm2-abrmd.service.patch to contain necessary SELinux
  changes (bsc#1209831)</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1723550400">- Fix SELinux sbin/bin merge (bsc#1229047)
  1229047-fix-bin-sbin-selinux.patch
  Can be dropped once https://github.com/tpm2-software/tpm2-abrmd/pull/846
  is merged upstream</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1737547200">- Drop rcFOO symlinks for CODE16 (PED-266).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1742990400">- also enable SELinux features for SLE-16 (bsc#1240070). On SLE-16 abrmd does
  not work, because the SELinux configuration is missing and thus its
  operations are denied. Include SLE-16 to fix this.</changelog>
  <changelog author="Cathy Hu &lt;cathy.hu@suse.com&gt;" date="1757332800">- Move tabrmd interface file from /usr/share/selinux/devel/include/contrib/tabrmd.if
  to /usr/share/selinux/devel/include/distributed/tabrmd.if
  This is necessary to allow upstream drop-in interface replacements:
  https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/tabrmd.if</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1757419200">- also package new /usr/share/selinux/devel/include/distributed directory to
  fix build error.</changelog>
  <changelog author="Zdenek Kubala &lt;zkubala@suse.com&gt;" date="1763553600">- Update SELinux module dir as macro to allow root path move from /var/lib/selinux
  to /etc/selinux (bsc#1221342)</changelog>
</package>
<package pkgid="47c30ec8c1f338c00f221d144c47e1fad875adc93f91e5cb91077a16ba69a199d19a868da4bbc08523d84a966871b79ac4a7fea6202906530c38f82f103e7196" name="tpm2.0-tools" arch="s390x">
  <version epoch="0" ver="5.7" rel="118.4"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Add missing dependencies for testing.
- Add patch to properly skip getekcertificate if curl is missing
  0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657713600">- Add patch to fix leakage of TPM simulator process
  add_missing_shut_down_call_on_cleanup.patch
- Add patch to fix fapi-quote-verify[_ecc].sh test
  fix_check_of_qualifying_data.patch
- Enable test execution by default</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657800000">- Disable tests in some architectures (ppc, ppc64, s390x)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Update to version 5.4
  + Added:
  * tpm2_policyrestart: Added option --cphash to output the cpHash
    for the command PM2_CC_PolicyRestart.
  * tpm2_policynvwritten: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyNvWritten.
  * tpm2_policylocality: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyLocality.
  * tpm2_policycountertimer: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCounterTimer.
  * tpm2_policycommandcode: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCommandCode.
  * tpm2_policypassword: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyPassword.
  * tpm2_policyauthvalue: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthValue.
  * tpm2_policyauthorize: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthorize.
  * tpm2_print: Support printing serialized ESYS_TR's
  * tpm2_create: Add a clarifying message to usage of -c when
    TPM2_CreateLoaded is not supported.
  * tpm2_getcap: Add support for vendor agnostic
    capabilites. Requires tpm2-tss version 4.0 and higher to enable.
  * Add a script, check_endorsement_cert.sh, to validate the
    endorsement certificate chain. It takes two inputs - A
    TPM2B_PUBLIC format EKpublic and a PEM format EKcertificate
    specified in that order as arguments.
- Update to version 5.3
  +  Features:
  * lib/tpm2_tool.c: add --help=no-man for tpm2 option. Prior to
    this change the tool parsed no-man as an unrecognized option and
    errored out. Now it lists all the available tool options.
  * tpm2_encodeobject: New tool to encode TPM2 object. It takes
    public and private portions of an object and encode them in a
    combined PEM form called tssprivkey used by tpm2-tss-engine and
    other applications.
  * Support alternative ECC curves for which default EK templates
    exist (NIST_P256, NIST_P384, NIST_P521, and SM2_P256).
  * tools/misc/tpm2_checkquote: add sm2 verification of signature.
  * crypto: support the TPM2_ECC_SM2_P256 curveID.
  * fapi: add new command to enable the use of fapi objects for tpm2
    tools. The new command tss2_gettpm2object was added. With this
    command context files which can be used for tpm2 tool commands
    can be created.
  * Support for sign and verify with sm2 algorithms.
  * tools/tpm2_startauthsession: add sym-algorithm argument for
    supported symmetric algorithm.
  * Attestation (certify, command audit, sessionaudit and quote):
    add scheme argument for supported signature schemes. This also
    enable support for SM signing.
  * tpm2_flushcontext: support all options at a time. Support the
  - t/-l/-s options all at once so folks don't have to call it
    multiple times.
  * tools/tpm2_nvread: add human readable output for NV content
    Enable parsing and YAML-style output for the different NV index
    types.
  * New event types in tpm2_eventlog:
    EV_EFI_PLATFORM_FIRMWARE_BLOB2, EV_EFI_HANDOFF_TABLES2,
    EV_EFI_VARIABLE_BOOT2
  * VERSION: add version file - Generate the version file with
    bootstrap and include in the DIST tarball so endusers can call
    autoreconf on a dist tarball which doesn't have git. This
    alleviates git describe errors on release tarballs in the
    autoreconf case.
  * import: support restricted parents - Support a restricted parent
    with an aes128cfb symmetric parameter.
  * tpm2_load - Added capability to load pem files in
    TSS2-Private-Key format for interoperability with
    tpm2-tss-engine, tpm2-openssl provider tpm2-pkcs11, and
    tpm2-pytss.
  * tpm2_print - Added capability to parse out and print the public
    portion of a TSS Private Key in the PEM format with the arg
    option TSSPRIVKEY_OBJ.
  * tpm2_loadexternal: Added support to tpm2_loadexternal for
    parsing and loading the public portion of a TSS2 Privkey PEM
    file. The path to the PEM file must be specified using the -r
    option while skipping the -G option for key type.
  * Support added for calculating cpHash, rpHash, sessions for
    parameter encryption and auditing in: tpm2_nvwrite,
    tpm2_nvcertify, tpm2_nvincrement, tpm2_nvwritelock,
    tpm2_nvreadlock, tpm2_nvundefine and tpm2_nvreadpublic.
  * Support added for calculating cpHash in: tpm2_clear,
    tpm2_dictionarylockout, tpm2_clearcontrol, tpm2_sign,
    tpm2_setprimarypolicy, tpm2_setclock, tpm2_rsadecrypt,
    tpm2_duplicate, tpm2_clockrateadjust, tpm2_createprimary,
    tpm2_quote, tpm2_policysecret, tpm2_policynv,
    tpm2_policyauthorizenv, tpm2_import, tpm2_hmac,
    tpm2_hierarchycontrol, tpm2_load, tpm2_gettime,
    tpm2_evictcontrol, tpm2_encryptdecrypt, tpm2_getpolicydigest,
    tpm2_loadexternal, tpm2_commit, tpm2_ecdhkeygen, tpm2_ecdhzgen,
    tpm2_ecephemeral, tpm2_geteccparameters, tpm2_flushcontext,
    tpm2_pcrallocate, tpm2_pcrevent, tpm2_pcrreset, tpm2_pcrread.
  * Support for using tcti=none for cpHash calculations to avoid
    invoking checks for active TPM in: tpm2_nvreadpublic,
    tpm2_nvundefine, tpm2_nvreadlock, tpm2_nvwritelock,
    tpm2_nvincrement, tpm2_nvcertify, tpm2_nvdefine, tpm2_nvwrite.
  + Known issue:
  * FAPI tools will not work on 32bit user-static qemu on 64bit host
    because readdir returns NULL. Follow the issue on
    https://gitlab.com/qemu-project/qemu/-/issues/263
  + Bug fixes:
  * tools/tpm2_pcrreset.c: fix build errors in 32bit systems.
  * Fix tssprivkey formatted PEM generation and load errors on 32
    bit systems.
  * CI: Add testing of 32bit systems with multiarch/qemu-user-static
    containers.
  * tools/tpm2_evictcontrol: fix for calls to Esys_TR_Close on bad
    handles.
  * tools/tpm2_nvextend: fix for ESYS_TR handle not being used in
    calculating the object name.
  * tools/tpm2_nvwrite, tools/tpm2_nvread: Policy authorization must
    be re-instantiated on each iteration of the read/ write when
    size exceeds the allowed operating size
    (TPM2_PT_NV_BUFFER_MAX). However, information on the compounded
    policies cannot be retrieved from the only policy digest read
    from the session and hence the session cannot be
    re-instantiated. To avoid this scenario only a single iteration
    is allowed when policy authorization is in use.
  * Fix argument parsing in tpm2_policylocality to fix an issue
    causing almost always to generate PolicyLocality(0). There was a
    logical inversion that caused almost any argument (including
    invalid ones) to be interpreted as zero, except “zero" would be
    interpreted as one.
  * test/fapi/fapi-quote-verify.sh Fix check of qualifying
    data. Because of a bug in Fapi_VerifyQuote the qualifying data
    was not checked correctly. Errors that were not recognized
    before occur now. The order of the tests was cleaned up and for
    every quote and verify quote now the correct combination of the
    qualifying data and quote info containing the nonce is used.
  * tpm2_nvdefine: set TPMA_NV_PLATFORMCREATE when authenticating
    with the platform hierarchy.
  * tools/tpm2_getekcertificate: fixed the url link to
    ekop.intel.com. There were two places where the fix was needed:
    o In the tool source code where a forward slash was always
    appended irrespective of it already being part of the link
    specified by the user and
    o In the integration test where curl tests the link to the
    ekop.intel.com backend. It now requires the full link to
    include the base64 encoded ek pub hash.
  * tools/tpm2_tool.c: Fix an issue where LOG_WARN is always
    displayed Despite setting the 'quiet' flag with -Q.
  * fapi: fix usage of parameter pcrLog for tss2_quote. pcrLog is an
    optional parameter. If pcrLog is not used as parameter currently
    the pcr log is still calculated in Fapi_Quote. To avoid this
    calculation a NULL pointer will be passed to Fapi_Quote if the
    parameter pcrLog is not passed. So tss2_quote can be executed
    for a user which has no access rights to the files with the
    system measurements.
  * import: fix bug on using scheme wherein if scheme is specified
    in the template, the openssl load functions clobber the scheme
    value and set it to TPM2_ALG_NULL.
  * tools/tpm2_sign and tpm2_verifysignature: fix sm2 sign and
    verifysignature bugs : (1.) sm2 sign could not get output
    signature. (2.) sm2 verify tss format signature failed.
  * lib/tpm2.c: added workaround for a system api bug where in the
    flush handle is erroneously placed in the handle area instead of
    the parameter area.
  * nvreadpublic: drop ntoh on attributes The attributes get
    marshalled to correct endianess by libmu and don’t need to be
    changed again.
  * Removing unused '-i' option from tpm2_print
  * tpm2_policyor: fix unallocated policy list The TPML_DIGEST
    policy list was calloc'd for some reason, however it could just
    be statically allocated in the context. The side effect is that
    when no options or arguments were given a NPD occured when
    checking the count of the policy list.
  * tools/tpm2_certify: fix man page for short options and add tests
    The short options for the signing-key-auth and
    certified-key-auth were swapped. The case fix in the man page
    makes it less intuitive but have to go through with the change
    so that we don't break any existing scripts. This change does
    not affect the long options. Tests have been added to ensure the
    functionality.
  + CI:
  * ci: add ubuntu-22.04. This also requires the min tpm2-tss
    version to be at 3.2.0 to support the openSSL major version 3.
  * cirrus.yml: update freebsd version to 13.1
  * .ci/download-deps.sh: update tpm2-abrmd dependency version to
    2.4.1
- Drop 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch
  (merged)
- Drop add_missing_shut_down_call_on_cleanup.patch (merged)
- Drop fix_check_of_qualifying_data.patch (merged)
- Add echo_tcti_call_python3_binary.patch (upstreamed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1672833600">- Re-disable tests in PPC, PPC64 and S390X and reference issues about
  endianness unsafe API</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to version 5.5
  + Added:
  * tpm2_createek: SM2 EK Support
  * misc: SM2 support to internal OSSL format key routines. Fixes
  - -format flags for conversions.
  + Fixed:
  * echo_tcti.py: set to use python3 named executable in shebang.
- Drop already merged patches
  + fix_bogus_warning.patch
  + echo_tcti_call_python3_binary.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684324800">- Disable tests.  Some tests randomly fails, maybe dependening on the
  OBS worker assigned during the build (not confirmed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1703160000">- Update to version 5.6
  + tpm2_eventlog:
  * add H-CRTM event support
  * add support of efivar versions less than 38
  * Add support to check for efivar/efivar.h manually
  * Minor formatting fixes
  * tpm2_eventlog: add support for replay with different
    StartupLocality
  * Fix pcr extension for EV_NO_ACTION
  * Extend test of yaml string representation
  * Use helper for printing a string dump
  * Fix upper bound on unique data size
  * Fix YAML string formatting
  + tpm2_policy:
  * Add support for parsing forward seal TPM values
  * Use forward seal values in creating policies
  * Move dgst_size in evaluate_populate_pcr_digests()
  * Allow more than 8 PCRs for sealing
  * Move dgst_size in evaluate_populate_pcr_digests
  * Allow more than 8 PCRs for sealing
  * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more
    PCRs
  + tpm2_encryptdecrypt: Fix pkcs7 padding stripping
  + tpm2_duplicate:
  * Support -a option for attributes
  * Add --key-algorithm option
  + tpm2_encodeobject: Use the correct -O option instead of -C
  + tpm2_unseal: Add qualifier static to enhance the privacy of unseal
    function
  + tpm2_sign:
  * Remove -m option which was added mistakenly
  * Revert sm2 sign and verifysignature
  + tpm2_createek:
  * Correct man page example
  * Fix usage of nonce
  * Fix integrating nonce
  + tpm2_clear: add more details about the action
  + tpm2_startauthsession: allow the file attribute for policy
    authorization.
  + tpm2_getekcertificate: Add AMD EK support
  + tpm2_ecdhzgen: Add public-key parameter
  + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure
  + Bug-fixes:
  * The readthedocs build failed with module 'jinja2' has no
    attribute 'contextfilter' a requirement file was added to fix
    this problem
  * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa
    implementation. This error can be avoided by switching off the
    optimization with pragma
  * Changed wrong function name of "Esys_Load" to "Esys_Load"
  * Function names beginning with Esys_ are wrongly written as Eys_
  * Reading and writing a serialized persistent ESYS_TR handles
  * cirrus-ci update image-family to freebsd-13-2 from 13-1
  + misc:
  * Change the default Python version to Python3 in the helper's
    code
  * Skip test which uses the sign operator for comparison in
    abrmd_policynv.sh
  * tools/tr_encode: Add a tool that can encode serialized ESYS_TR
    for persistent handles from the TPM2B_PUBLIC and the raw
    persistent TPM2_HANDLE
  * Add safe directory in config</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 5.7:
  + Security
  - Fixed CVE-2024-29038 (bsc#1223687)
  - Fixed CVE-2024-29039 (bsc#1223689)
  + Fixed
  - Fix eventlog test
  - Fix issues with reading NV indexes
  - Fix context save error on tpm2_create
  - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail
  - when attempting to context save a flushed session.
  - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto.
  - tpm2_send: fix EOF detection on input stream.
  - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
  - Auth file: Ensure 0-termination when reading auths from a file.
  - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh.
  - cirrus.yml fix tss compilation with libtpms for FreeBSD.
  - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd.
  - options: fix TCTI handling to avoid failures for commands that should work with no options.
  - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed.
  + Added
  - Add the possibility for autoflush (environment variable "TPM2TOOLS_AUTOFLUSH", or -R option)
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
- tpm2-tools.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1778846400">- Remove dependency to the abrmd broker service</changelog>
</package>
<package pkgid="6faa7f990e237e19fe449559453a5c8d6612e45028625bf9f8b8bd5c3411d47be4839a48fdf5384e5350ffceb71f0a66d1aa73efff6b753d7bac2d6a79e36ece" name="tpm2.0-tools" arch="src">
  <version epoch="0" ver="5.7" rel="118.4"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1623758400">- Disable lto to fix tpm2_checkquote error (boo#1187316)
- Update service file to point to the correct revision</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1623931200">- Add 0001-tpm2_checkquote-fix-uninitialized-variable.patch for a better
  fix of boo#1187316
- Re-enable lto</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1624017600">- Add 0001-tpm2_eventlog-read-eventlog-file-in-chunks.patch to fix the
  tpm2_eventlog command (boo#1187360)</changelog>
  <changelog author="Fabian Vogt &lt;fvogt@suse.com&gt;" date="1624881600">- update to version 5.1.1:
  - tpm2_import: fix fixed AES key CVE-2021-3565
  - tpm2_import used a fixed AES key for the inner wrapper, which means that
    a MITM attack would be able to unwrap the imported key. To fix this,
    ensure the key size is 16 bytes or bigger and use OpenSSL to generate a
    secure random AES key.
- Avoid pandoc build dependency, use prebuilt man pages everywhere
- Drop 0001-tpm2_import-fix-fixed-AES-key-CVE-2021-3565.patch, now upstream
- Drop _service, unused
- Drop unused unzip build dependency
- Drop autoreconfigure call, no longer necessary
- Use %autosetup
- Verify tarball signature
- Build against efivar
- Drop %check section, tests weren't built, so that was a noop</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1625745600">- prepare running the test suite via %check, but leave it commented out,
  because it is broken due to LTO linking.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1627560000">- Add 0001-tpm2_eventlog-fix-buffer-offset-when-reading-the-eve.patch to
  fix the offset of the read buffer</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1634731200">- Update to version 5.2:
  + tpm2_nvextend:
  * Added option -n, --name to specify the name of the nvindex in
    hex bytes. This is used when cpHash ought to be calculated
    without dispatching the TPM2_NV_Extend command to the TPM.
  + tpm2_nvread:
  * Added option --rphash=FILE to specify ile path to record the
    hash of the response parameters. This is commonly termed as
    rpHash.
  * Added option -n, --name to specify the name of the nvindex in
    hex bytes. This is used when cpHash ought to be calculated
    without dispatching the TPM2_NVRead command to the TPM.
  * Added option -S, --session to specify to specify an auxiliary
    session for auditing and or encryption/decryption of the
    parameters.
  + tpm2_nvsetbits:
  * Added option --rphash=FILE to specify file path to record the
    hash of the response parameters. This is commonly termed as
    rpHash.
  * Added option -S, --session to specify to specify an auxiliary
    session for auditing and or encryption/decryption of the
    parameters.
  * Added option -n, --name to specify the name of the nvindex in
    hex bytes. This is used when cpHash ought to be calculated
    without dispatching the TPM2_NV_SetBits command to the TPM.
  + tpm2_createprimary:
  * Support public-key output at creation time in various public-key
    formats.
  + tpm2_create:
  * Support public-key output at creation time in various public-key
    formats.
  + tpm2_print:
  * Support outputing public key in various public key formats over
    the default YAML output. Supports taking -u output from
    tpm2_create and converting it to a PEM or DER file format.
  + tpm2_import:
  * Add support for importing keys with sealed-data-blobs.
  + tpm2_rsaencrypt, tpm2_rsadecrypt:
  * Add support for specifying the hash algorithm with oaep.
  + tpm2_pcrread, tpm2_quote:
  * Add option -F, --pcrs_format to specify PCR format selection for
    the binary blob in the PCR output file. 'values' will output a
    binary blob of the PCR values. 'serialized' will output a binary
    blob of the PCR values in the form of serialized data structure
    in little endian format.
  + tpm2_eventlog:
  * Add support for decoding StartupLocality.
  * Add support for printing the partition information.
  * Add support for reading eventlogs longer than 64kb including
    from /sys/kernel/security/tpm0/binary_bios-measurements.
  + tpm2_duplicate:
  * Add option -L, --policy to specify an authorization policy to be
    associated with the duplicated object.
  * Added support for external key duplication without needing the
    TCTI.
  + tools:
  * Enhance error message on invalid passwords when sessions cannot
    be used.
  + lib/tpm2_options:
  * Add option to specify fake tcti which is required in cases where
    sapi ctx is required to be initialized for retrieving command
    parameters without invoking the tcti to talk to the TPM.
  + openssl:
  * Dropped support for OpenSSL &lt; 1.1.0
  * Add support for OpenSSL 3.0.0
  + Support added to make the repository documentation and man pages
    available live on readthedocs.
  + Bug-fixes:
  * tpm2_import: Don't allow setting passwords for imported object
    with -p option as the tool doesn't modify the TPM2B_SENSITIVE
    structure. Added appropriate logging to indicate using
    tpm2_changeauth after import.
  * lib/tpm2_util.c: The function to calculate pHash algorithm
    returned error when input session is a password session and the
    only session in the command.
  * lib/tpm2_alg_util.c: Fix an error where oaep was parsed under
    ECC.
  * tpm2_sign: Fix segfaults when tool does not find TPM resources
    (TPM or RM).
  * tpm2_makecredential: Fix an issue where reading input from stdin
    could result in unsupported data size larger than the largest
    digest size.
  * tpm2_loadexternal: Fix an issue where restricted attribute could
    not be set.
  * lib/tpm2_nv_util.h: The NV index size is dependent on different
    data sets read from the GetCapability structures because there
    is a dependency on the NV operation type: Define vs Read vs
    Write vs Extend. Fix a sane default in the case where
    GetCapability fails or fails to report the specific property/
    data set. This is especially true because some properties are
    TPM implementation dependent.
  * tpm2_createpolicy: Fix an issue where tool exited silently
    without reporting an error if wrong pcr string is specified.
  * lib/tpm2_alg_util: add error message on public init to prevent
    tools from dying silently, add an error message.
  * tpm2_import: fix an issue where an imported hmac object scheme
    was NULL. While allowed, it was inconsistent with other tools
    like tpm2_create which set the scheme as hmac-&gt;sha256 when
    generating a keyedhash object.
- Drop patches already in upstream:
  + 0001-tpm2_checkquote-fix-uninitialized-variable.patch
  + 0001-tpm2_eventlog-fix-buffer-offset-when-reading-the-eve.patch
  + 0001-tpm2_eventlog-read-eventlog-file-in-chunks.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1638187200">- Fix python3-PyYAML requirement
- Move the tests inside a bcond.  Disabled by default.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1638964800">- The update to 5.2 fill also jsc#SLE-9515 (4.1) and jsc#SLE-17366 (4.3.0)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657195200">- Disable LTO for 5.2, to fix tpm2_makecredential with "-T none"
  (bsc#1201291)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Add missing dependencies for testing.
- Add patch to properly skip getekcertificate if curl is missing
  0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657713600">- Add patch to fix leakage of TPM simulator process
  add_missing_shut_down_call_on_cleanup.patch
- Add patch to fix fapi-quote-verify[_ecc].sh test
  fix_check_of_qualifying_data.patch
- Enable test execution by default</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657800000">- Disable tests in some architectures (ppc, ppc64, s390x)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Update to version 5.4
  + Added:
  * tpm2_policyrestart: Added option --cphash to output the cpHash
    for the command PM2_CC_PolicyRestart.
  * tpm2_policynvwritten: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyNvWritten.
  * tpm2_policylocality: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyLocality.
  * tpm2_policycountertimer: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCounterTimer.
  * tpm2_policycommandcode: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCommandCode.
  * tpm2_policypassword: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyPassword.
  * tpm2_policyauthvalue: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthValue.
  * tpm2_policyauthorize: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthorize.
  * tpm2_print: Support printing serialized ESYS_TR's
  * tpm2_create: Add a clarifying message to usage of -c when
    TPM2_CreateLoaded is not supported.
  * tpm2_getcap: Add support for vendor agnostic
    capabilites. Requires tpm2-tss version 4.0 and higher to enable.
  * Add a script, check_endorsement_cert.sh, to validate the
    endorsement certificate chain. It takes two inputs - A
    TPM2B_PUBLIC format EKpublic and a PEM format EKcertificate
    specified in that order as arguments.
- Update to version 5.3
  +  Features:
  * lib/tpm2_tool.c: add --help=no-man for tpm2 option. Prior to
    this change the tool parsed no-man as an unrecognized option and
    errored out. Now it lists all the available tool options.
  * tpm2_encodeobject: New tool to encode TPM2 object. It takes
    public and private portions of an object and encode them in a
    combined PEM form called tssprivkey used by tpm2-tss-engine and
    other applications.
  * Support alternative ECC curves for which default EK templates
    exist (NIST_P256, NIST_P384, NIST_P521, and SM2_P256).
  * tools/misc/tpm2_checkquote: add sm2 verification of signature.
  * crypto: support the TPM2_ECC_SM2_P256 curveID.
  * fapi: add new command to enable the use of fapi objects for tpm2
    tools. The new command tss2_gettpm2object was added. With this
    command context files which can be used for tpm2 tool commands
    can be created.
  * Support for sign and verify with sm2 algorithms.
  * tools/tpm2_startauthsession: add sym-algorithm argument for
    supported symmetric algorithm.
  * Attestation (certify, command audit, sessionaudit and quote):
    add scheme argument for supported signature schemes. This also
    enable support for SM signing.
  * tpm2_flushcontext: support all options at a time. Support the
  - t/-l/-s options all at once so folks don't have to call it
    multiple times.
  * tools/tpm2_nvread: add human readable output for NV content
    Enable parsing and YAML-style output for the different NV index
    types.
  * New event types in tpm2_eventlog:
    EV_EFI_PLATFORM_FIRMWARE_BLOB2, EV_EFI_HANDOFF_TABLES2,
    EV_EFI_VARIABLE_BOOT2
  * VERSION: add version file - Generate the version file with
    bootstrap and include in the DIST tarball so endusers can call
    autoreconf on a dist tarball which doesn't have git. This
    alleviates git describe errors on release tarballs in the
    autoreconf case.
  * import: support restricted parents - Support a restricted parent
    with an aes128cfb symmetric parameter.
  * tpm2_load - Added capability to load pem files in
    TSS2-Private-Key format for interoperability with
    tpm2-tss-engine, tpm2-openssl provider tpm2-pkcs11, and
    tpm2-pytss.
  * tpm2_print - Added capability to parse out and print the public
    portion of a TSS Private Key in the PEM format with the arg
    option TSSPRIVKEY_OBJ.
  * tpm2_loadexternal: Added support to tpm2_loadexternal for
    parsing and loading the public portion of a TSS2 Privkey PEM
    file. The path to the PEM file must be specified using the -r
    option while skipping the -G option for key type.
  * Support added for calculating cpHash, rpHash, sessions for
    parameter encryption and auditing in: tpm2_nvwrite,
    tpm2_nvcertify, tpm2_nvincrement, tpm2_nvwritelock,
    tpm2_nvreadlock, tpm2_nvundefine and tpm2_nvreadpublic.
  * Support added for calculating cpHash in: tpm2_clear,
    tpm2_dictionarylockout, tpm2_clearcontrol, tpm2_sign,
    tpm2_setprimarypolicy, tpm2_setclock, tpm2_rsadecrypt,
    tpm2_duplicate, tpm2_clockrateadjust, tpm2_createprimary,
    tpm2_quote, tpm2_policysecret, tpm2_policynv,
    tpm2_policyauthorizenv, tpm2_import, tpm2_hmac,
    tpm2_hierarchycontrol, tpm2_load, tpm2_gettime,
    tpm2_evictcontrol, tpm2_encryptdecrypt, tpm2_getpolicydigest,
    tpm2_loadexternal, tpm2_commit, tpm2_ecdhkeygen, tpm2_ecdhzgen,
    tpm2_ecephemeral, tpm2_geteccparameters, tpm2_flushcontext,
    tpm2_pcrallocate, tpm2_pcrevent, tpm2_pcrreset, tpm2_pcrread.
  * Support for using tcti=none for cpHash calculations to avoid
    invoking checks for active TPM in: tpm2_nvreadpublic,
    tpm2_nvundefine, tpm2_nvreadlock, tpm2_nvwritelock,
    tpm2_nvincrement, tpm2_nvcertify, tpm2_nvdefine, tpm2_nvwrite.
  + Known issue:
  * FAPI tools will not work on 32bit user-static qemu on 64bit host
    because readdir returns NULL. Follow the issue on
    https://gitlab.com/qemu-project/qemu/-/issues/263
  + Bug fixes:
  * tools/tpm2_pcrreset.c: fix build errors in 32bit systems.
  * Fix tssprivkey formatted PEM generation and load errors on 32
    bit systems.
  * CI: Add testing of 32bit systems with multiarch/qemu-user-static
    containers.
  * tools/tpm2_evictcontrol: fix for calls to Esys_TR_Close on bad
    handles.
  * tools/tpm2_nvextend: fix for ESYS_TR handle not being used in
    calculating the object name.
  * tools/tpm2_nvwrite, tools/tpm2_nvread: Policy authorization must
    be re-instantiated on each iteration of the read/ write when
    size exceeds the allowed operating size
    (TPM2_PT_NV_BUFFER_MAX). However, information on the compounded
    policies cannot be retrieved from the only policy digest read
    from the session and hence the session cannot be
    re-instantiated. To avoid this scenario only a single iteration
    is allowed when policy authorization is in use.
  * Fix argument parsing in tpm2_policylocality to fix an issue
    causing almost always to generate PolicyLocality(0). There was a
    logical inversion that caused almost any argument (including
    invalid ones) to be interpreted as zero, except “zero" would be
    interpreted as one.
  * test/fapi/fapi-quote-verify.sh Fix check of qualifying
    data. Because of a bug in Fapi_VerifyQuote the qualifying data
    was not checked correctly. Errors that were not recognized
    before occur now. The order of the tests was cleaned up and for
    every quote and verify quote now the correct combination of the
    qualifying data and quote info containing the nonce is used.
  * tpm2_nvdefine: set TPMA_NV_PLATFORMCREATE when authenticating
    with the platform hierarchy.
  * tools/tpm2_getekcertificate: fixed the url link to
    ekop.intel.com. There were two places where the fix was needed:
    o In the tool source code where a forward slash was always
    appended irrespective of it already being part of the link
    specified by the user and
    o In the integration test where curl tests the link to the
    ekop.intel.com backend. It now requires the full link to
    include the base64 encoded ek pub hash.
  * tools/tpm2_tool.c: Fix an issue where LOG_WARN is always
    displayed Despite setting the 'quiet' flag with -Q.
  * fapi: fix usage of parameter pcrLog for tss2_quote. pcrLog is an
    optional parameter. If pcrLog is not used as parameter currently
    the pcr log is still calculated in Fapi_Quote. To avoid this
    calculation a NULL pointer will be passed to Fapi_Quote if the
    parameter pcrLog is not passed. So tss2_quote can be executed
    for a user which has no access rights to the files with the
    system measurements.
  * import: fix bug on using scheme wherein if scheme is specified
    in the template, the openssl load functions clobber the scheme
    value and set it to TPM2_ALG_NULL.
  * tools/tpm2_sign and tpm2_verifysignature: fix sm2 sign and
    verifysignature bugs : (1.) sm2 sign could not get output
    signature. (2.) sm2 verify tss format signature failed.
  * lib/tpm2.c: added workaround for a system api bug where in the
    flush handle is erroneously placed in the handle area instead of
    the parameter area.
  * nvreadpublic: drop ntoh on attributes The attributes get
    marshalled to correct endianess by libmu and don’t need to be
    changed again.
  * Removing unused '-i' option from tpm2_print
  * tpm2_policyor: fix unallocated policy list The TPML_DIGEST
    policy list was calloc'd for some reason, however it could just
    be statically allocated in the context. The side effect is that
    when no options or arguments were given a NPD occured when
    checking the count of the policy list.
  * tools/tpm2_certify: fix man page for short options and add tests
    The short options for the signing-key-auth and
    certified-key-auth were swapped. The case fix in the man page
    makes it less intuitive but have to go through with the change
    so that we don't break any existing scripts. This change does
    not affect the long options. Tests have been added to ensure the
    functionality.
  + CI:
  * ci: add ubuntu-22.04. This also requires the min tpm2-tss
    version to be at 3.2.0 to support the openSSL major version 3.
  * cirrus.yml: update freebsd version to 13.1
  * .ci/download-deps.sh: update tpm2-abrmd dependency version to
    2.4.1
- Drop 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch
  (merged)
- Drop add_missing_shut_down_call_on_cleanup.patch (merged)
- Drop fix_check_of_qualifying_data.patch (merged)
- Add echo_tcti_call_python3_binary.patch (upstreamed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1672833600">- Re-disable tests in PPC, PPC64 and S390X and reference issues about
  endianness unsafe API</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to version 5.5
  + Added:
  * tpm2_createek: SM2 EK Support
  * misc: SM2 support to internal OSSL format key routines. Fixes
  - -format flags for conversions.
  + Fixed:
  * echo_tcti.py: set to use python3 named executable in shebang.
- Drop already merged patches
  + fix_bogus_warning.patch
  + echo_tcti_call_python3_binary.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684324800">- Disable tests.  Some tests randomly fails, maybe dependening on the
  OBS worker assigned during the build (not confirmed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1703160000">- Update to version 5.6
  + tpm2_eventlog:
  * add H-CRTM event support
  * add support of efivar versions less than 38
  * Add support to check for efivar/efivar.h manually
  * Minor formatting fixes
  * tpm2_eventlog: add support for replay with different
    StartupLocality
  * Fix pcr extension for EV_NO_ACTION
  * Extend test of yaml string representation
  * Use helper for printing a string dump
  * Fix upper bound on unique data size
  * Fix YAML string formatting
  + tpm2_policy:
  * Add support for parsing forward seal TPM values
  * Use forward seal values in creating policies
  * Move dgst_size in evaluate_populate_pcr_digests()
  * Allow more than 8 PCRs for sealing
  * Move dgst_size in evaluate_populate_pcr_digests
  * Allow more than 8 PCRs for sealing
  * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more
    PCRs
  + tpm2_encryptdecrypt: Fix pkcs7 padding stripping
  + tpm2_duplicate:
  * Support -a option for attributes
  * Add --key-algorithm option
  + tpm2_encodeobject: Use the correct -O option instead of -C
  + tpm2_unseal: Add qualifier static to enhance the privacy of unseal
    function
  + tpm2_sign:
  * Remove -m option which was added mistakenly
  * Revert sm2 sign and verifysignature
  + tpm2_createek:
  * Correct man page example
  * Fix usage of nonce
  * Fix integrating nonce
  + tpm2_clear: add more details about the action
  + tpm2_startauthsession: allow the file attribute for policy
    authorization.
  + tpm2_getekcertificate: Add AMD EK support
  + tpm2_ecdhzgen: Add public-key parameter
  + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure
  + Bug-fixes:
  * The readthedocs build failed with module 'jinja2' has no
    attribute 'contextfilter' a requirement file was added to fix
    this problem
  * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa
    implementation. This error can be avoided by switching off the
    optimization with pragma
  * Changed wrong function name of "Esys_Load" to "Esys_Load"
  * Function names beginning with Esys_ are wrongly written as Eys_
  * Reading and writing a serialized persistent ESYS_TR handles
  * cirrus-ci update image-family to freebsd-13-2 from 13-1
  + misc:
  * Change the default Python version to Python3 in the helper's
    code
  * Skip test which uses the sign operator for comparison in
    abrmd_policynv.sh
  * tools/tr_encode: Add a tool that can encode serialized ESYS_TR
    for persistent handles from the TPM2B_PUBLIC and the raw
    persistent TPM2_HANDLE
  * Add safe directory in config</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 5.7:
  + Security
  - Fixed CVE-2024-29038 (bsc#1223687)
  - Fixed CVE-2024-29039 (bsc#1223689)
  + Fixed
  - Fix eventlog test
  - Fix issues with reading NV indexes
  - Fix context save error on tpm2_create
  - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail
  - when attempting to context save a flushed session.
  - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto.
  - tpm2_send: fix EOF detection on input stream.
  - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
  - Auth file: Ensure 0-termination when reading auths from a file.
  - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh.
  - cirrus.yml fix tss compilation with libtpms for FreeBSD.
  - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd.
  - options: fix TCTI handling to avoid failures for commands that should work with no options.
  - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed.
  + Added
  - Add the possibility for autoflush (environment variable "TPM2TOOLS_AUTOFLUSH", or -R option)
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
- tpm2-tools.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1778846400">- Remove dependency to the abrmd broker service</changelog>
</package>
<package pkgid="0fa4fb79ee7dedfebc822074230107d2b825105a1351210be7b176aa889d3f4bd7be78f54e4dd7645c441e344d16c8f4e1edc5552ec0d3a84a0cfae480027fcf" name="tpm2.0-tools-debuginfo" arch="s390x">
  <version epoch="0" ver="5.7" rel="118.4"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Add missing dependencies for testing.
- Add patch to properly skip getekcertificate if curl is missing
  0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657713600">- Add patch to fix leakage of TPM simulator process
  add_missing_shut_down_call_on_cleanup.patch
- Add patch to fix fapi-quote-verify[_ecc].sh test
  fix_check_of_qualifying_data.patch
- Enable test execution by default</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657800000">- Disable tests in some architectures (ppc, ppc64, s390x)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Update to version 5.4
  + Added:
  * tpm2_policyrestart: Added option --cphash to output the cpHash
    for the command PM2_CC_PolicyRestart.
  * tpm2_policynvwritten: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyNvWritten.
  * tpm2_policylocality: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyLocality.
  * tpm2_policycountertimer: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCounterTimer.
  * tpm2_policycommandcode: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCommandCode.
  * tpm2_policypassword: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyPassword.
  * tpm2_policyauthvalue: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthValue.
  * tpm2_policyauthorize: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthorize.
  * tpm2_print: Support printing serialized ESYS_TR's
  * tpm2_create: Add a clarifying message to usage of -c when
    TPM2_CreateLoaded is not supported.
  * tpm2_getcap: Add support for vendor agnostic
    capabilites. Requires tpm2-tss version 4.0 and higher to enable.
  * Add a script, check_endorsement_cert.sh, to validate the
    endorsement certificate chain. It takes two inputs - A
    TPM2B_PUBLIC format EKpublic and a PEM format EKcertificate
    specified in that order as arguments.
- Update to version 5.3
  +  Features:
  * lib/tpm2_tool.c: add --help=no-man for tpm2 option. Prior to
    this change the tool parsed no-man as an unrecognized option and
    errored out. Now it lists all the available tool options.
  * tpm2_encodeobject: New tool to encode TPM2 object. It takes
    public and private portions of an object and encode them in a
    combined PEM form called tssprivkey used by tpm2-tss-engine and
    other applications.
  * Support alternative ECC curves for which default EK templates
    exist (NIST_P256, NIST_P384, NIST_P521, and SM2_P256).
  * tools/misc/tpm2_checkquote: add sm2 verification of signature.
  * crypto: support the TPM2_ECC_SM2_P256 curveID.
  * fapi: add new command to enable the use of fapi objects for tpm2
    tools. The new command tss2_gettpm2object was added. With this
    command context files which can be used for tpm2 tool commands
    can be created.
  * Support for sign and verify with sm2 algorithms.
  * tools/tpm2_startauthsession: add sym-algorithm argument for
    supported symmetric algorithm.
  * Attestation (certify, command audit, sessionaudit and quote):
    add scheme argument for supported signature schemes. This also
    enable support for SM signing.
  * tpm2_flushcontext: support all options at a time. Support the
  - t/-l/-s options all at once so folks don't have to call it
    multiple times.
  * tools/tpm2_nvread: add human readable output for NV content
    Enable parsing and YAML-style output for the different NV index
    types.
  * New event types in tpm2_eventlog:
    EV_EFI_PLATFORM_FIRMWARE_BLOB2, EV_EFI_HANDOFF_TABLES2,
    EV_EFI_VARIABLE_BOOT2
  * VERSION: add version file - Generate the version file with
    bootstrap and include in the DIST tarball so endusers can call
    autoreconf on a dist tarball which doesn't have git. This
    alleviates git describe errors on release tarballs in the
    autoreconf case.
  * import: support restricted parents - Support a restricted parent
    with an aes128cfb symmetric parameter.
  * tpm2_load - Added capability to load pem files in
    TSS2-Private-Key format for interoperability with
    tpm2-tss-engine, tpm2-openssl provider tpm2-pkcs11, and
    tpm2-pytss.
  * tpm2_print - Added capability to parse out and print the public
    portion of a TSS Private Key in the PEM format with the arg
    option TSSPRIVKEY_OBJ.
  * tpm2_loadexternal: Added support to tpm2_loadexternal for
    parsing and loading the public portion of a TSS2 Privkey PEM
    file. The path to the PEM file must be specified using the -r
    option while skipping the -G option for key type.
  * Support added for calculating cpHash, rpHash, sessions for
    parameter encryption and auditing in: tpm2_nvwrite,
    tpm2_nvcertify, tpm2_nvincrement, tpm2_nvwritelock,
    tpm2_nvreadlock, tpm2_nvundefine and tpm2_nvreadpublic.
  * Support added for calculating cpHash in: tpm2_clear,
    tpm2_dictionarylockout, tpm2_clearcontrol, tpm2_sign,
    tpm2_setprimarypolicy, tpm2_setclock, tpm2_rsadecrypt,
    tpm2_duplicate, tpm2_clockrateadjust, tpm2_createprimary,
    tpm2_quote, tpm2_policysecret, tpm2_policynv,
    tpm2_policyauthorizenv, tpm2_import, tpm2_hmac,
    tpm2_hierarchycontrol, tpm2_load, tpm2_gettime,
    tpm2_evictcontrol, tpm2_encryptdecrypt, tpm2_getpolicydigest,
    tpm2_loadexternal, tpm2_commit, tpm2_ecdhkeygen, tpm2_ecdhzgen,
    tpm2_ecephemeral, tpm2_geteccparameters, tpm2_flushcontext,
    tpm2_pcrallocate, tpm2_pcrevent, tpm2_pcrreset, tpm2_pcrread.
  * Support for using tcti=none for cpHash calculations to avoid
    invoking checks for active TPM in: tpm2_nvreadpublic,
    tpm2_nvundefine, tpm2_nvreadlock, tpm2_nvwritelock,
    tpm2_nvincrement, tpm2_nvcertify, tpm2_nvdefine, tpm2_nvwrite.
  + Known issue:
  * FAPI tools will not work on 32bit user-static qemu on 64bit host
    because readdir returns NULL. Follow the issue on
    https://gitlab.com/qemu-project/qemu/-/issues/263
  + Bug fixes:
  * tools/tpm2_pcrreset.c: fix build errors in 32bit systems.
  * Fix tssprivkey formatted PEM generation and load errors on 32
    bit systems.
  * CI: Add testing of 32bit systems with multiarch/qemu-user-static
    containers.
  * tools/tpm2_evictcontrol: fix for calls to Esys_TR_Close on bad
    handles.
  * tools/tpm2_nvextend: fix for ESYS_TR handle not being used in
    calculating the object name.
  * tools/tpm2_nvwrite, tools/tpm2_nvread: Policy authorization must
    be re-instantiated on each iteration of the read/ write when
    size exceeds the allowed operating size
    (TPM2_PT_NV_BUFFER_MAX). However, information on the compounded
    policies cannot be retrieved from the only policy digest read
    from the session and hence the session cannot be
    re-instantiated. To avoid this scenario only a single iteration
    is allowed when policy authorization is in use.
  * Fix argument parsing in tpm2_policylocality to fix an issue
    causing almost always to generate PolicyLocality(0). There was a
    logical inversion that caused almost any argument (including
    invalid ones) to be interpreted as zero, except “zero" would be
    interpreted as one.
  * test/fapi/fapi-quote-verify.sh Fix check of qualifying
    data. Because of a bug in Fapi_VerifyQuote the qualifying data
    was not checked correctly. Errors that were not recognized
    before occur now. The order of the tests was cleaned up and for
    every quote and verify quote now the correct combination of the
    qualifying data and quote info containing the nonce is used.
  * tpm2_nvdefine: set TPMA_NV_PLATFORMCREATE when authenticating
    with the platform hierarchy.
  * tools/tpm2_getekcertificate: fixed the url link to
    ekop.intel.com. There were two places where the fix was needed:
    o In the tool source code where a forward slash was always
    appended irrespective of it already being part of the link
    specified by the user and
    o In the integration test where curl tests the link to the
    ekop.intel.com backend. It now requires the full link to
    include the base64 encoded ek pub hash.
  * tools/tpm2_tool.c: Fix an issue where LOG_WARN is always
    displayed Despite setting the 'quiet' flag with -Q.
  * fapi: fix usage of parameter pcrLog for tss2_quote. pcrLog is an
    optional parameter. If pcrLog is not used as parameter currently
    the pcr log is still calculated in Fapi_Quote. To avoid this
    calculation a NULL pointer will be passed to Fapi_Quote if the
    parameter pcrLog is not passed. So tss2_quote can be executed
    for a user which has no access rights to the files with the
    system measurements.
  * import: fix bug on using scheme wherein if scheme is specified
    in the template, the openssl load functions clobber the scheme
    value and set it to TPM2_ALG_NULL.
  * tools/tpm2_sign and tpm2_verifysignature: fix sm2 sign and
    verifysignature bugs : (1.) sm2 sign could not get output
    signature. (2.) sm2 verify tss format signature failed.
  * lib/tpm2.c: added workaround for a system api bug where in the
    flush handle is erroneously placed in the handle area instead of
    the parameter area.
  * nvreadpublic: drop ntoh on attributes The attributes get
    marshalled to correct endianess by libmu and don’t need to be
    changed again.
  * Removing unused '-i' option from tpm2_print
  * tpm2_policyor: fix unallocated policy list The TPML_DIGEST
    policy list was calloc'd for some reason, however it could just
    be statically allocated in the context. The side effect is that
    when no options or arguments were given a NPD occured when
    checking the count of the policy list.
  * tools/tpm2_certify: fix man page for short options and add tests
    The short options for the signing-key-auth and
    certified-key-auth were swapped. The case fix in the man page
    makes it less intuitive but have to go through with the change
    so that we don't break any existing scripts. This change does
    not affect the long options. Tests have been added to ensure the
    functionality.
  + CI:
  * ci: add ubuntu-22.04. This also requires the min tpm2-tss
    version to be at 3.2.0 to support the openSSL major version 3.
  * cirrus.yml: update freebsd version to 13.1
  * .ci/download-deps.sh: update tpm2-abrmd dependency version to
    2.4.1
- Drop 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch
  (merged)
- Drop add_missing_shut_down_call_on_cleanup.patch (merged)
- Drop fix_check_of_qualifying_data.patch (merged)
- Add echo_tcti_call_python3_binary.patch (upstreamed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1672833600">- Re-disable tests in PPC, PPC64 and S390X and reference issues about
  endianness unsafe API</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to version 5.5
  + Added:
  * tpm2_createek: SM2 EK Support
  * misc: SM2 support to internal OSSL format key routines. Fixes
  - -format flags for conversions.
  + Fixed:
  * echo_tcti.py: set to use python3 named executable in shebang.
- Drop already merged patches
  + fix_bogus_warning.patch
  + echo_tcti_call_python3_binary.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684324800">- Disable tests.  Some tests randomly fails, maybe dependening on the
  OBS worker assigned during the build (not confirmed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1703160000">- Update to version 5.6
  + tpm2_eventlog:
  * add H-CRTM event support
  * add support of efivar versions less than 38
  * Add support to check for efivar/efivar.h manually
  * Minor formatting fixes
  * tpm2_eventlog: add support for replay with different
    StartupLocality
  * Fix pcr extension for EV_NO_ACTION
  * Extend test of yaml string representation
  * Use helper for printing a string dump
  * Fix upper bound on unique data size
  * Fix YAML string formatting
  + tpm2_policy:
  * Add support for parsing forward seal TPM values
  * Use forward seal values in creating policies
  * Move dgst_size in evaluate_populate_pcr_digests()
  * Allow more than 8 PCRs for sealing
  * Move dgst_size in evaluate_populate_pcr_digests
  * Allow more than 8 PCRs for sealing
  * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more
    PCRs
  + tpm2_encryptdecrypt: Fix pkcs7 padding stripping
  + tpm2_duplicate:
  * Support -a option for attributes
  * Add --key-algorithm option
  + tpm2_encodeobject: Use the correct -O option instead of -C
  + tpm2_unseal: Add qualifier static to enhance the privacy of unseal
    function
  + tpm2_sign:
  * Remove -m option which was added mistakenly
  * Revert sm2 sign and verifysignature
  + tpm2_createek:
  * Correct man page example
  * Fix usage of nonce
  * Fix integrating nonce
  + tpm2_clear: add more details about the action
  + tpm2_startauthsession: allow the file attribute for policy
    authorization.
  + tpm2_getekcertificate: Add AMD EK support
  + tpm2_ecdhzgen: Add public-key parameter
  + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure
  + Bug-fixes:
  * The readthedocs build failed with module 'jinja2' has no
    attribute 'contextfilter' a requirement file was added to fix
    this problem
  * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa
    implementation. This error can be avoided by switching off the
    optimization with pragma
  * Changed wrong function name of "Esys_Load" to "Esys_Load"
  * Function names beginning with Esys_ are wrongly written as Eys_
  * Reading and writing a serialized persistent ESYS_TR handles
  * cirrus-ci update image-family to freebsd-13-2 from 13-1
  + misc:
  * Change the default Python version to Python3 in the helper's
    code
  * Skip test which uses the sign operator for comparison in
    abrmd_policynv.sh
  * tools/tr_encode: Add a tool that can encode serialized ESYS_TR
    for persistent handles from the TPM2B_PUBLIC and the raw
    persistent TPM2_HANDLE
  * Add safe directory in config</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 5.7:
  + Security
  - Fixed CVE-2024-29038 (bsc#1223687)
  - Fixed CVE-2024-29039 (bsc#1223689)
  + Fixed
  - Fix eventlog test
  - Fix issues with reading NV indexes
  - Fix context save error on tpm2_create
  - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail
  - when attempting to context save a flushed session.
  - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto.
  - tpm2_send: fix EOF detection on input stream.
  - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
  - Auth file: Ensure 0-termination when reading auths from a file.
  - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh.
  - cirrus.yml fix tss compilation with libtpms for FreeBSD.
  - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd.
  - options: fix TCTI handling to avoid failures for commands that should work with no options.
  - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed.
  + Added
  - Add the possibility for autoflush (environment variable "TPM2TOOLS_AUTOFLUSH", or -R option)
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
- tpm2-tools.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1778846400">- Remove dependency to the abrmd broker service</changelog>
</package>
<package pkgid="a9365f4259709fe8dcfeef0be57eddf92c0acdc7b3240461781a36671da5288e3b746f3f85cb0bfa7f4b61afd5a2bcba88d5028f47e052fa225c90fa47184f40" name="tpm2.0-tools-debugsource" arch="s390x">
  <version epoch="0" ver="5.7" rel="118.4"/>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657281600">- Add missing dependencies for testing.
- Add patch to properly skip getekcertificate if curl is missing
  0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657713600">- Add patch to fix leakage of TPM simulator process
  add_missing_shut_down_call_on_cleanup.patch
- Add patch to fix fapi-quote-verify[_ecc].sh test
  fix_check_of_qualifying_data.patch
- Enable test execution by default</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1657800000">- Disable tests in some architectures (ppc, ppc64, s390x)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1670500800">- Update to version 5.4
  + Added:
  * tpm2_policyrestart: Added option --cphash to output the cpHash
    for the command PM2_CC_PolicyRestart.
  * tpm2_policynvwritten: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyNvWritten.
  * tpm2_policylocality: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyLocality.
  * tpm2_policycountertimer: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCounterTimer.
  * tpm2_policycommandcode: Added option --cphash to output the
    cpHash for the command TPM2_CC_PolicyCommandCode.
  * tpm2_policypassword: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyPassword.
  * tpm2_policyauthvalue: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthValue.
  * tpm2_policyauthorize: Added option --cphash to output the cpHash
    for the command TPM2_CC_PolicyAuthorize.
  * tpm2_print: Support printing serialized ESYS_TR's
  * tpm2_create: Add a clarifying message to usage of -c when
    TPM2_CreateLoaded is not supported.
  * tpm2_getcap: Add support for vendor agnostic
    capabilites. Requires tpm2-tss version 4.0 and higher to enable.
  * Add a script, check_endorsement_cert.sh, to validate the
    endorsement certificate chain. It takes two inputs - A
    TPM2B_PUBLIC format EKpublic and a PEM format EKcertificate
    specified in that order as arguments.
- Update to version 5.3
  +  Features:
  * lib/tpm2_tool.c: add --help=no-man for tpm2 option. Prior to
    this change the tool parsed no-man as an unrecognized option and
    errored out. Now it lists all the available tool options.
  * tpm2_encodeobject: New tool to encode TPM2 object. It takes
    public and private portions of an object and encode them in a
    combined PEM form called tssprivkey used by tpm2-tss-engine and
    other applications.
  * Support alternative ECC curves for which default EK templates
    exist (NIST_P256, NIST_P384, NIST_P521, and SM2_P256).
  * tools/misc/tpm2_checkquote: add sm2 verification of signature.
  * crypto: support the TPM2_ECC_SM2_P256 curveID.
  * fapi: add new command to enable the use of fapi objects for tpm2
    tools. The new command tss2_gettpm2object was added. With this
    command context files which can be used for tpm2 tool commands
    can be created.
  * Support for sign and verify with sm2 algorithms.
  * tools/tpm2_startauthsession: add sym-algorithm argument for
    supported symmetric algorithm.
  * Attestation (certify, command audit, sessionaudit and quote):
    add scheme argument for supported signature schemes. This also
    enable support for SM signing.
  * tpm2_flushcontext: support all options at a time. Support the
  - t/-l/-s options all at once so folks don't have to call it
    multiple times.
  * tools/tpm2_nvread: add human readable output for NV content
    Enable parsing and YAML-style output for the different NV index
    types.
  * New event types in tpm2_eventlog:
    EV_EFI_PLATFORM_FIRMWARE_BLOB2, EV_EFI_HANDOFF_TABLES2,
    EV_EFI_VARIABLE_BOOT2
  * VERSION: add version file - Generate the version file with
    bootstrap and include in the DIST tarball so endusers can call
    autoreconf on a dist tarball which doesn't have git. This
    alleviates git describe errors on release tarballs in the
    autoreconf case.
  * import: support restricted parents - Support a restricted parent
    with an aes128cfb symmetric parameter.
  * tpm2_load - Added capability to load pem files in
    TSS2-Private-Key format for interoperability with
    tpm2-tss-engine, tpm2-openssl provider tpm2-pkcs11, and
    tpm2-pytss.
  * tpm2_print - Added capability to parse out and print the public
    portion of a TSS Private Key in the PEM format with the arg
    option TSSPRIVKEY_OBJ.
  * tpm2_loadexternal: Added support to tpm2_loadexternal for
    parsing and loading the public portion of a TSS2 Privkey PEM
    file. The path to the PEM file must be specified using the -r
    option while skipping the -G option for key type.
  * Support added for calculating cpHash, rpHash, sessions for
    parameter encryption and auditing in: tpm2_nvwrite,
    tpm2_nvcertify, tpm2_nvincrement, tpm2_nvwritelock,
    tpm2_nvreadlock, tpm2_nvundefine and tpm2_nvreadpublic.
  * Support added for calculating cpHash in: tpm2_clear,
    tpm2_dictionarylockout, tpm2_clearcontrol, tpm2_sign,
    tpm2_setprimarypolicy, tpm2_setclock, tpm2_rsadecrypt,
    tpm2_duplicate, tpm2_clockrateadjust, tpm2_createprimary,
    tpm2_quote, tpm2_policysecret, tpm2_policynv,
    tpm2_policyauthorizenv, tpm2_import, tpm2_hmac,
    tpm2_hierarchycontrol, tpm2_load, tpm2_gettime,
    tpm2_evictcontrol, tpm2_encryptdecrypt, tpm2_getpolicydigest,
    tpm2_loadexternal, tpm2_commit, tpm2_ecdhkeygen, tpm2_ecdhzgen,
    tpm2_ecephemeral, tpm2_geteccparameters, tpm2_flushcontext,
    tpm2_pcrallocate, tpm2_pcrevent, tpm2_pcrreset, tpm2_pcrread.
  * Support for using tcti=none for cpHash calculations to avoid
    invoking checks for active TPM in: tpm2_nvreadpublic,
    tpm2_nvundefine, tpm2_nvreadlock, tpm2_nvwritelock,
    tpm2_nvincrement, tpm2_nvcertify, tpm2_nvdefine, tpm2_nvwrite.
  + Known issue:
  * FAPI tools will not work on 32bit user-static qemu on 64bit host
    because readdir returns NULL. Follow the issue on
    https://gitlab.com/qemu-project/qemu/-/issues/263
  + Bug fixes:
  * tools/tpm2_pcrreset.c: fix build errors in 32bit systems.
  * Fix tssprivkey formatted PEM generation and load errors on 32
    bit systems.
  * CI: Add testing of 32bit systems with multiarch/qemu-user-static
    containers.
  * tools/tpm2_evictcontrol: fix for calls to Esys_TR_Close on bad
    handles.
  * tools/tpm2_nvextend: fix for ESYS_TR handle not being used in
    calculating the object name.
  * tools/tpm2_nvwrite, tools/tpm2_nvread: Policy authorization must
    be re-instantiated on each iteration of the read/ write when
    size exceeds the allowed operating size
    (TPM2_PT_NV_BUFFER_MAX). However, information on the compounded
    policies cannot be retrieved from the only policy digest read
    from the session and hence the session cannot be
    re-instantiated. To avoid this scenario only a single iteration
    is allowed when policy authorization is in use.
  * Fix argument parsing in tpm2_policylocality to fix an issue
    causing almost always to generate PolicyLocality(0). There was a
    logical inversion that caused almost any argument (including
    invalid ones) to be interpreted as zero, except “zero" would be
    interpreted as one.
  * test/fapi/fapi-quote-verify.sh Fix check of qualifying
    data. Because of a bug in Fapi_VerifyQuote the qualifying data
    was not checked correctly. Errors that were not recognized
    before occur now. The order of the tests was cleaned up and for
    every quote and verify quote now the correct combination of the
    qualifying data and quote info containing the nonce is used.
  * tpm2_nvdefine: set TPMA_NV_PLATFORMCREATE when authenticating
    with the platform hierarchy.
  * tools/tpm2_getekcertificate: fixed the url link to
    ekop.intel.com. There were two places where the fix was needed:
    o In the tool source code where a forward slash was always
    appended irrespective of it already being part of the link
    specified by the user and
    o In the integration test where curl tests the link to the
    ekop.intel.com backend. It now requires the full link to
    include the base64 encoded ek pub hash.
  * tools/tpm2_tool.c: Fix an issue where LOG_WARN is always
    displayed Despite setting the 'quiet' flag with -Q.
  * fapi: fix usage of parameter pcrLog for tss2_quote. pcrLog is an
    optional parameter. If pcrLog is not used as parameter currently
    the pcr log is still calculated in Fapi_Quote. To avoid this
    calculation a NULL pointer will be passed to Fapi_Quote if the
    parameter pcrLog is not passed. So tss2_quote can be executed
    for a user which has no access rights to the files with the
    system measurements.
  * import: fix bug on using scheme wherein if scheme is specified
    in the template, the openssl load functions clobber the scheme
    value and set it to TPM2_ALG_NULL.
  * tools/tpm2_sign and tpm2_verifysignature: fix sm2 sign and
    verifysignature bugs : (1.) sm2 sign could not get output
    signature. (2.) sm2 verify tss format signature failed.
  * lib/tpm2.c: added workaround for a system api bug where in the
    flush handle is erroneously placed in the handle area instead of
    the parameter area.
  * nvreadpublic: drop ntoh on attributes The attributes get
    marshalled to correct endianess by libmu and don’t need to be
    changed again.
  * Removing unused '-i' option from tpm2_print
  * tpm2_policyor: fix unallocated policy list The TPML_DIGEST
    policy list was calloc'd for some reason, however it could just
    be statically allocated in the context. The side effect is that
    when no options or arguments were given a NPD occured when
    checking the count of the policy list.
  * tools/tpm2_certify: fix man page for short options and add tests
    The short options for the signing-key-auth and
    certified-key-auth were swapped. The case fix in the man page
    makes it less intuitive but have to go through with the change
    so that we don't break any existing scripts. This change does
    not affect the long options. Tests have been added to ensure the
    functionality.
  + CI:
  * ci: add ubuntu-22.04. This also requires the min tpm2-tss
    version to be at 3.2.0 to support the openSSL major version 3.
  * cirrus.yml: update freebsd version to 13.1
  * .ci/download-deps.sh: update tpm2-abrmd dependency version to
    2.4.1
- Drop 0001-tests-getekcertificate.sh-Skip-the-test-if-curl-is-n.patch
  (merged)
- Drop add_missing_shut_down_call_on_cleanup.patch (merged)
- Drop fix_check_of_qualifying_data.patch (merged)
- Add echo_tcti_call_python3_binary.patch (upstreamed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1672833600">- Re-disable tests in PPC, PPC64 and S390X and reference issues about
  endianness unsafe API</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1676548800">- Update to version 5.5
  + Added:
  * tpm2_createek: SM2 EK Support
  * misc: SM2 support to internal OSSL format key routines. Fixes
  - -format flags for conversions.
  + Fixed:
  * echo_tcti.py: set to use python3 named executable in shebang.
- Drop already merged patches
  + fix_bogus_warning.patch
  + echo_tcti_call_python3_binary.patch</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1684324800">- Disable tests.  Some tests randomly fails, maybe dependening on the
  OBS worker assigned during the build (not confirmed)</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1703160000">- Update to version 5.6
  + tpm2_eventlog:
  * add H-CRTM event support
  * add support of efivar versions less than 38
  * Add support to check for efivar/efivar.h manually
  * Minor formatting fixes
  * tpm2_eventlog: add support for replay with different
    StartupLocality
  * Fix pcr extension for EV_NO_ACTION
  * Extend test of yaml string representation
  * Use helper for printing a string dump
  * Fix upper bound on unique data size
  * Fix YAML string formatting
  + tpm2_policy:
  * Add support for parsing forward seal TPM values
  * Use forward seal values in creating policies
  * Move dgst_size in evaluate_populate_pcr_digests()
  * Allow more than 8 PCRs for sealing
  * Move dgst_size in evaluate_populate_pcr_digests
  * Allow more than 8 PCRs for sealing
  * Make __wrap_Esys_PCR_Read() more dynamic to enable testing more
    PCRs
  + tpm2_encryptdecrypt: Fix pkcs7 padding stripping
  + tpm2_duplicate:
  * Support -a option for attributes
  * Add --key-algorithm option
  + tpm2_encodeobject: Use the correct -O option instead of -C
  + tpm2_unseal: Add qualifier static to enhance the privacy of unseal
    function
  + tpm2_sign:
  * Remove -m option which was added mistakenly
  * Revert sm2 sign and verifysignature
  + tpm2_createek:
  * Correct man page example
  * Fix usage of nonce
  * Fix integrating nonce
  + tpm2_clear: add more details about the action
  + tpm2_startauthsession: allow the file attribute for policy
    authorization.
  + tpm2_getekcertificate: Add AMD EK support
  + tpm2_ecdhzgen: Add public-key parameter
  + tpm2_nvreadpublic: Prevent free of unallocated pointers on failure
  + Bug-fixes:
  * The readthedocs build failed with module 'jinja2' has no
    attribute 'contextfilter' a requirement file was added to fix
    this problem
  * An error caused by the flags -flto -_FORTIFY_SOURCE=3 in kdfa
    implementation. This error can be avoided by switching off the
    optimization with pragma
  * Changed wrong function name of "Esys_Load" to "Esys_Load"
  * Function names beginning with Esys_ are wrongly written as Eys_
  * Reading and writing a serialized persistent ESYS_TR handles
  * cirrus-ci update image-family to freebsd-13-2 from 13-1
  + misc:
  * Change the default Python version to Python3 in the helper's
    code
  * Skip test which uses the sign operator for comparison in
    abrmd_policynv.sh
  * tools/tr_encode: Add a tool that can encode serialized ESYS_TR
    for persistent handles from the TPM2B_PUBLIC and the raw
    persistent TPM2_HANDLE
  * Add safe directory in config</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1714737600">Update to version 5.7:
  + Security
  - Fixed CVE-2024-29038 (bsc#1223687)
  - Fixed CVE-2024-29039 (bsc#1223689)
  + Fixed
  - Fix eventlog test
  - Fix issues with reading NV indexes
  - Fix context save error on tpm2_create
  - tpm2_sessionconfig: fix handling of --disable-continue session so that the subsequent command will not fail
  - when attempting to context save a flushed session.
  - detection of functions within libcrypto when CRYPTO_LIBS is set and system has install libcrypto.
  - tpm2_send: fix EOF detection on input stream.
  - tpm2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
  - Auth file: Ensure 0-termination when reading auths from a file.
  - configure.ac: fix bashisms. configure scripts need to be runnable with a POSIX-compliant /bin/sh.
  - cirrus.yml fix tss compilation with libtpms for FreeBSD.
  - tpm2_tool.c Fix missing include for basename to enable compilation on netbsd.
  - options: fix TCTI handling to avoid failures for commands that should work with no options.
  - tpm2_getekcertificate.c Fix leak. ek_uri was not freed if get_ek_server_address failed.
  + Added
  - Add the possibility for autoflush (environment variable "TPM2TOOLS_AUTOFLUSH", or -R option)
  + Removed
  - Testing on Ubuntu 18.04 as it's near EOL (May 2023).m2_policy.c fix compilation error caused by format directive for size_t on 32 bit systems.
  - tpm2_nvread: fix input handling no nv index.
- tpm2-tools.keyring: added Andreas Fuchs 0x8F4F9A45D7FFEE74 key, documented
  in upstream repo, which was used for signing this new release tarball.</changelog>
  <changelog author="Alberto Planas Dominguez &lt;aplanas@suse.com&gt;" date="1778846400">- Remove dependency to the abrmd broker service</changelog>
</package>
<package pkgid="4121370beb9f7d506a7cade741422859cf0621635758336d4484c7707379e68ee37ac7e4e59550c0c144ba99d4ed1c360ee15fb29b5842ddee002cc876571935" name="tripwire" arch="s390x">
  <version epoch="0" ver="2.4.3.7" rel="17.28"/>
  <changelog author="poeml@suse.de" date="1244116800">- fix paths in the sample twpol-Linux.txt
- remove obsolete patches
- update README.SuSE a bit
- package config directory and database directory to be readable
  only for root</changelog>
  <changelog author="poeml@suse.de" date="1244116801">- support large files (&gt;2GB), by defining the correct type for file
  sizes.
    tripwire-2.4.1.2-src-off_t.patch
- fix build failure due to compile warning about undefined
  behaviour when incrementing variables
    tripwire-2.4.1.2-src-undefined-operation.patch
- make sure that RPM_OPT_FLAGS are used when compiling.</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346328000">- added gcc47 patch to allow build to work
- upgrade to 2.4.2.2
  * Bumping version to 2.4.2.2
  * Updated version revision in reports and all
  * Added experimental policy creation (see policy/policy_generator_readme.txt)
  * Fixed report formating and sendmail issues
  * Added Debian patches for crypto and hostnames
  * Fixed compiling issue on recent GCC compilers (-fpermissive)
  * Added patch to fix bug [ 1962485 ] Cannot change or expect-script</changelog>
  <changelog author="meissner@suse.com" date="1486641600">- Updated to 2.4.3.2 (bsc#1024442)
  See:
  https://github.com/Tripwire/tripwire-open-source/releases
- tripwire-2.4.1.2-src-off_t.patch: fixed upstream
- tripwire-2.4.1.2-src-undefined-operation.patch: fixed upstream
- README.SuSE -&gt; README.SUSE</changelog>
  <changelog author="meissner@suse.com" date="1488542400">- removed author credits from description.</changelog>
  <changelog author="jengelh@inai.de" date="1490270400">- Replace old $RPM_* shell variables by macros.
- Provide "Tripwire" with full version
- Trim manual from description.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1553342400">- Update to version 2.4.3.7
- Changes from 2.4.3.2 to 2.4.3.7
  * Run Clang static analyzer &amp; fix some of its quibbles
  * Fix compilation error on Alpine Linux 3.x (Issue #15)
  * Fix file permissions on a couple of source files (Issue #14)
  * Fix some errors w/ make install/uninstall/dist (Issue #15)
  * Fix a new issue with level 2 report printing ( Issue #19 )
  * Fix 'make install-strip' target, which wasn't actually
    stripping binaries (Issue #20)
  * Updated release to include archives with curl/wget-friendly names (Issue #22)
  * Buildsys: 'install-strip', 'uninstall', 'check', and 'distcheck'
    make targets now do useful things. (the install-strip change
    addresses the remaining bit of issue #18.)
  * Buildsys: To support old flavors of gcc, add "--disable-extrawarnings"
    configure option for compilers that don't understand -Wextra arg, and
    detect if the local g++ happens to be called c++.
  * Fix various new warnings w/ GCC 7.
  * Use std::unique_ptr instead of deprecated std::auto_ptr, where available.
  * Clean up / enable more twtest unit tests, &amp; tweak the framework for clarity.
  * Remove more dead code and strip out a bunch of uses of the always-true IS_UNIX ifdef.
  * Address some static analysis warnings from CppCheck &amp; Flawfinder
  * Add a sanity check in fcodatasourceiterimpl to address a unit test that failed on some platforms.
  * Update old policy test files in src/parser/testfiles to use current policy syntax.
  * Fix &amp; expand tests in Perl acceptance test framework
  * Fix &amp; expand twtest unit tests, &amp; rework unit test mini-framework so they’re
    referenced by name, not some numeric ID, and list tests as “skipped" if
    they don’t make any test assertions.
  * Add configure options to enable coverage, profiling, &amp; use
    /dev/urandom as RNG (all off by default)
  * Add a ‘list’ make target to list all make targets
  * Remove dead code &amp; add test coverage per gcov+lcov results
  * Fix various memory issues pointed out by valgrind
  * In examine-encryption mode, better reporting (&amp; nonzero exit) if we can't find a
    keyfile for the examined file.
  * More exception handling around individual objects &amp; init/IC as a whole,
    since there have been occasional reports of uncaught exceptions during init or check,
    and so far haven’t been able to repro or figure out what circumstances
    it occurs under. (e.g. Github issue #25)
  * Tweak install.sh so it can be run directly, not just thru 'make install'
    if you want. (Github issue #26)
  * Improve native (non-Posixy) path handling on platforms that need it (DOS, AROS, RISC OS, Redox)
  * New platforms: MirOS BSD, Bitrig, LibertyBSD, RISC OS, Redox
  * Add default policies for HP-UX &amp; various BSDs
  * Fix &amp; expand tests in Perl acceptance test framework
  * Fix &amp; expand twtest unit tests, &amp; rework unit test mini-framework so they’re
    referenced by name, not some numeric ID, and list tests as “skipped" if they
    don’t make any test assertions.
  * Add configure options to enable coverage, profiling, &amp; use /dev/urandom as RNG (all off by default)
  * Add a ‘list’ make target to list all make targets
  * Remove dead code &amp; add test coverage per gcov+lcov results
  * Fix various memory issues pointed out by valgrind
  * In examine-encryption mode, better reporting (&amp; nonzero exit) if we can't find
    a keyfile for the examined file.
  * More exception handling around individual objects &amp; init/IC as a whole,
    since there have been occasional reports of uncaught exceptions during
    init or check, and so far haven’t been able to repro or figure out what
    circumstances it occurs under. (e.g. Github issue #25)
  * Tweak install.sh so it can be run directly, not just thru
    'make install' if you want. (Github issue #26)
  * Improve native (non-Posixy) path handling on platforms that
    need it (DOS, AROS, RISC OS, Redox)
  * New platforms: MirOS BSD, Bitrig, LibertyBSD, RISC OS, Redox
  * Add default policies for HP-UX &amp; various BSDs
  * twprint can now print reports for individual objects.
  * twprint now has verbosity levels for --print-dbfile mode.
  * Provide a useful README.md (issue #17 ).
  * Document return codes in man pages (issue #28 ).
  * Update install script after testing on additional platforms.
  * Provide default policies for more operating systems, and update some
    existing policies
  * Usability tweaks to twtest.
  * Clean up code style with clang-format, &amp; add a custom style that
    approximates existing OST usage.
  * Update copyright dates to 2018.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1561723200">- Fix bug Bug 1096636 - tripwire looks for the configuration file in
  /etc instead of /etc/tripwire. Now tw.cfg will really appead in /etc/tripwire
  * add patch 'tripwire-2.4.3.7-config-dir-location.patch'
    which update config dir to /etc/tripwire.
  * add build require libtool (which pulls automake and autoconf)
  * add 'autoreconf -a -i' to make sure automake is overwritten
  * Move /etc/tw.cfg to /etc/tripwire/tw.cfg in %post as make transition smoother</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt; - 2.4.3.7" date="1627905600">- fix build with gcc11</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="716c5cb91730db7d9639b0d0befa27a3e8fb31396920ed0a03be80f5c390b7939f86d8add55ee7602f66754b767997a6226a856e9e8970bc2dfc29f8ae1a2f5c" name="tripwire" arch="src">
  <version epoch="0" ver="2.4.3.7" rel="17.28"/>
  <changelog author="tcrhak@suse.cz" date="1016193600">- added dir /usr/share/lib/tripwire to filelist</changelog>
  <changelog author="stepan@suse.de" date="1017057600">- fix 64bit overflow bug</changelog>
  <changelog author="ro@suse.de" date="1037188800">- fix for current bison (end all rules with ";")</changelog>
  <changelog author="tcrhak@suse.cz" date="1041854400">- update to version 2.3.1
- created README.SuSE and twcfg.txt</changelog>
  <changelog author="ro@suse.de" date="1043668800">- use stdarg</changelog>
  <changelog author="adrian@suse.de" date="1073736000">- build as user</changelog>
  <changelog author="tcrhak@suse.cz" date="1080561600">- fixed for x86_64 (bug #36050, patch types)</changelog>
  <changelog author="tcrhak@suse.cz" date="1080734400">- fixed for big endian archs (patch endian)</changelog>
  <changelog author="tcrhak@suse.cz" date="1087560000">- format string fix (patch format, bug #41622)</changelog>
  <changelog author="poeml@suse.de" date="1244116800">- take SLES9 package and update it to 2.4.1.2</changelog>
  <changelog author="poeml@suse.de" date="1244116801">- fix paths in the sample twpol-Linux.txt
- remove obsolete patches
- update README.SuSE a bit
- package config directory and database directory to be readable
  only for root</changelog>
  <changelog author="poeml@suse.de" date="1244116802">- support large files (&gt;2GB), by defining the correct type for file
  sizes.
    tripwire-2.4.1.2-src-off_t.patch
- fix build failure due to compile warning about undefined
  behaviour when incrementing variables
    tripwire-2.4.1.2-src-undefined-operation.patch
- make sure that RPM_OPT_FLAGS are used when compiling.</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346328000">- added gcc47 patch to allow build to work
- upgrade to 2.4.2.2
  * Bumping version to 2.4.2.2
  * Updated version revision in reports and all
  * Added experimental policy creation (see policy/policy_generator_readme.txt)
  * Fixed report formating and sendmail issues
  * Added Debian patches for crypto and hostnames
  * Fixed compiling issue on recent GCC compilers (-fpermissive)
  * Added patch to fix bug [ 1962485 ] Cannot change or expect-script</changelog>
  <changelog author="meissner@suse.com" date="1486641600">- Updated to 2.4.3.2 (bsc#1024442)
  See:
  https://github.com/Tripwire/tripwire-open-source/releases
- tripwire-2.4.1.2-src-off_t.patch: fixed upstream
- tripwire-2.4.1.2-src-undefined-operation.patch: fixed upstream
- README.SuSE -&gt; README.SUSE</changelog>
  <changelog author="meissner@suse.com" date="1488542400">- removed author credits from description.</changelog>
  <changelog author="jengelh@inai.de" date="1490270400">- Replace old $RPM_* shell variables by macros.
- Provide "Tripwire" with full version
- Trim manual from description.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1553342400">- Update to version 2.4.3.7
- Changes from 2.4.3.2 to 2.4.3.7
  * Run Clang static analyzer &amp; fix some of its quibbles
  * Fix compilation error on Alpine Linux 3.x (Issue #15)
  * Fix file permissions on a couple of source files (Issue #14)
  * Fix some errors w/ make install/uninstall/dist (Issue #15)
  * Fix a new issue with level 2 report printing ( Issue #19 )
  * Fix 'make install-strip' target, which wasn't actually
    stripping binaries (Issue #20)
  * Updated release to include archives with curl/wget-friendly names (Issue #22)
  * Buildsys: 'install-strip', 'uninstall', 'check', and 'distcheck'
    make targets now do useful things. (the install-strip change
    addresses the remaining bit of issue #18.)
  * Buildsys: To support old flavors of gcc, add "--disable-extrawarnings"
    configure option for compilers that don't understand -Wextra arg, and
    detect if the local g++ happens to be called c++.
  * Fix various new warnings w/ GCC 7.
  * Use std::unique_ptr instead of deprecated std::auto_ptr, where available.
  * Clean up / enable more twtest unit tests, &amp; tweak the framework for clarity.
  * Remove more dead code and strip out a bunch of uses of the always-true IS_UNIX ifdef.
  * Address some static analysis warnings from CppCheck &amp; Flawfinder
  * Add a sanity check in fcodatasourceiterimpl to address a unit test that failed on some platforms.
  * Update old policy test files in src/parser/testfiles to use current policy syntax.
  * Fix &amp; expand tests in Perl acceptance test framework
  * Fix &amp; expand twtest unit tests, &amp; rework unit test mini-framework so they’re
    referenced by name, not some numeric ID, and list tests as “skipped" if
    they don’t make any test assertions.
  * Add configure options to enable coverage, profiling, &amp; use
    /dev/urandom as RNG (all off by default)
  * Add a ‘list’ make target to list all make targets
  * Remove dead code &amp; add test coverage per gcov+lcov results
  * Fix various memory issues pointed out by valgrind
  * In examine-encryption mode, better reporting (&amp; nonzero exit) if we can't find a
    keyfile for the examined file.
  * More exception handling around individual objects &amp; init/IC as a whole,
    since there have been occasional reports of uncaught exceptions during init or check,
    and so far haven’t been able to repro or figure out what circumstances
    it occurs under. (e.g. Github issue #25)
  * Tweak install.sh so it can be run directly, not just thru 'make install'
    if you want. (Github issue #26)
  * Improve native (non-Posixy) path handling on platforms that need it (DOS, AROS, RISC OS, Redox)
  * New platforms: MirOS BSD, Bitrig, LibertyBSD, RISC OS, Redox
  * Add default policies for HP-UX &amp; various BSDs
  * Fix &amp; expand tests in Perl acceptance test framework
  * Fix &amp; expand twtest unit tests, &amp; rework unit test mini-framework so they’re
    referenced by name, not some numeric ID, and list tests as “skipped" if they
    don’t make any test assertions.
  * Add configure options to enable coverage, profiling, &amp; use /dev/urandom as RNG (all off by default)
  * Add a ‘list’ make target to list all make targets
  * Remove dead code &amp; add test coverage per gcov+lcov results
  * Fix various memory issues pointed out by valgrind
  * In examine-encryption mode, better reporting (&amp; nonzero exit) if we can't find
    a keyfile for the examined file.
  * More exception handling around individual objects &amp; init/IC as a whole,
    since there have been occasional reports of uncaught exceptions during
    init or check, and so far haven’t been able to repro or figure out what
    circumstances it occurs under. (e.g. Github issue #25)
  * Tweak install.sh so it can be run directly, not just thru
    'make install' if you want. (Github issue #26)
  * Improve native (non-Posixy) path handling on platforms that
    need it (DOS, AROS, RISC OS, Redox)
  * New platforms: MirOS BSD, Bitrig, LibertyBSD, RISC OS, Redox
  * Add default policies for HP-UX &amp; various BSDs
  * twprint can now print reports for individual objects.
  * twprint now has verbosity levels for --print-dbfile mode.
  * Provide a useful README.md (issue #17 ).
  * Document return codes in man pages (issue #28 ).
  * Update install script after testing on additional platforms.
  * Provide default policies for more operating systems, and update some
    existing policies
  * Usability tweaks to twtest.
  * Clean up code style with clang-format, &amp; add a custom style that
    approximates existing OST usage.
  * Update copyright dates to 2018.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1561723200">- Fix bug Bug 1096636 - tripwire looks for the configuration file in
  /etc instead of /etc/tripwire. Now tw.cfg will really appead in /etc/tripwire
  * add patch 'tripwire-2.4.3.7-config-dir-location.patch'
    which update config dir to /etc/tripwire.
  * add build require libtool (which pulls automake and autoconf)
  * add 'autoreconf -a -i' to make sure automake is overwritten
  * Move /etc/tw.cfg to /etc/tripwire/tw.cfg in %post as make transition smoother</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt; - 2.4.3.7" date="1627905600">- fix build with gcc11</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="c819097168f5db54ef6b264d991408ba9d1ed1554c396c1274e2956da97ea559ace2cca949780a8b4408f6592f1e255fdeaf81fb94d12d8270726200451b7012" name="tripwire-debuginfo" arch="s390x">
  <version epoch="0" ver="2.4.3.7" rel="17.28"/>
  <changelog author="poeml@suse.de" date="1244116800">- fix paths in the sample twpol-Linux.txt
- remove obsolete patches
- update README.SuSE a bit
- package config directory and database directory to be readable
  only for root</changelog>
  <changelog author="poeml@suse.de" date="1244116801">- support large files (&gt;2GB), by defining the correct type for file
  sizes.
    tripwire-2.4.1.2-src-off_t.patch
- fix build failure due to compile warning about undefined
  behaviour when incrementing variables
    tripwire-2.4.1.2-src-undefined-operation.patch
- make sure that RPM_OPT_FLAGS are used when compiling.</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346328000">- added gcc47 patch to allow build to work
- upgrade to 2.4.2.2
  * Bumping version to 2.4.2.2
  * Updated version revision in reports and all
  * Added experimental policy creation (see policy/policy_generator_readme.txt)
  * Fixed report formating and sendmail issues
  * Added Debian patches for crypto and hostnames
  * Fixed compiling issue on recent GCC compilers (-fpermissive)
  * Added patch to fix bug [ 1962485 ] Cannot change or expect-script</changelog>
  <changelog author="meissner@suse.com" date="1486641600">- Updated to 2.4.3.2 (bsc#1024442)
  See:
  https://github.com/Tripwire/tripwire-open-source/releases
- tripwire-2.4.1.2-src-off_t.patch: fixed upstream
- tripwire-2.4.1.2-src-undefined-operation.patch: fixed upstream
- README.SuSE -&gt; README.SUSE</changelog>
  <changelog author="meissner@suse.com" date="1488542400">- removed author credits from description.</changelog>
  <changelog author="jengelh@inai.de" date="1490270400">- Replace old $RPM_* shell variables by macros.
- Provide "Tripwire" with full version
- Trim manual from description.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1553342400">- Update to version 2.4.3.7
- Changes from 2.4.3.2 to 2.4.3.7
  * Run Clang static analyzer &amp; fix some of its quibbles
  * Fix compilation error on Alpine Linux 3.x (Issue #15)
  * Fix file permissions on a couple of source files (Issue #14)
  * Fix some errors w/ make install/uninstall/dist (Issue #15)
  * Fix a new issue with level 2 report printing ( Issue #19 )
  * Fix 'make install-strip' target, which wasn't actually
    stripping binaries (Issue #20)
  * Updated release to include archives with curl/wget-friendly names (Issue #22)
  * Buildsys: 'install-strip', 'uninstall', 'check', and 'distcheck'
    make targets now do useful things. (the install-strip change
    addresses the remaining bit of issue #18.)
  * Buildsys: To support old flavors of gcc, add "--disable-extrawarnings"
    configure option for compilers that don't understand -Wextra arg, and
    detect if the local g++ happens to be called c++.
  * Fix various new warnings w/ GCC 7.
  * Use std::unique_ptr instead of deprecated std::auto_ptr, where available.
  * Clean up / enable more twtest unit tests, &amp; tweak the framework for clarity.
  * Remove more dead code and strip out a bunch of uses of the always-true IS_UNIX ifdef.
  * Address some static analysis warnings from CppCheck &amp; Flawfinder
  * Add a sanity check in fcodatasourceiterimpl to address a unit test that failed on some platforms.
  * Update old policy test files in src/parser/testfiles to use current policy syntax.
  * Fix &amp; expand tests in Perl acceptance test framework
  * Fix &amp; expand twtest unit tests, &amp; rework unit test mini-framework so they’re
    referenced by name, not some numeric ID, and list tests as “skipped" if
    they don’t make any test assertions.
  * Add configure options to enable coverage, profiling, &amp; use
    /dev/urandom as RNG (all off by default)
  * Add a ‘list’ make target to list all make targets
  * Remove dead code &amp; add test coverage per gcov+lcov results
  * Fix various memory issues pointed out by valgrind
  * In examine-encryption mode, better reporting (&amp; nonzero exit) if we can't find a
    keyfile for the examined file.
  * More exception handling around individual objects &amp; init/IC as a whole,
    since there have been occasional reports of uncaught exceptions during init or check,
    and so far haven’t been able to repro or figure out what circumstances
    it occurs under. (e.g. Github issue #25)
  * Tweak install.sh so it can be run directly, not just thru 'make install'
    if you want. (Github issue #26)
  * Improve native (non-Posixy) path handling on platforms that need it (DOS, AROS, RISC OS, Redox)
  * New platforms: MirOS BSD, Bitrig, LibertyBSD, RISC OS, Redox
  * Add default policies for HP-UX &amp; various BSDs
  * Fix &amp; expand tests in Perl acceptance test framework
  * Fix &amp; expand twtest unit tests, &amp; rework unit test mini-framework so they’re
    referenced by name, not some numeric ID, and list tests as “skipped" if they
    don’t make any test assertions.
  * Add configure options to enable coverage, profiling, &amp; use /dev/urandom as RNG (all off by default)
  * Add a ‘list’ make target to list all make targets
  * Remove dead code &amp; add test coverage per gcov+lcov results
  * Fix various memory issues pointed out by valgrind
  * In examine-encryption mode, better reporting (&amp; nonzero exit) if we can't find
    a keyfile for the examined file.
  * More exception handling around individual objects &amp; init/IC as a whole,
    since there have been occasional reports of uncaught exceptions during
    init or check, and so far haven’t been able to repro or figure out what
    circumstances it occurs under. (e.g. Github issue #25)
  * Tweak install.sh so it can be run directly, not just thru
    'make install' if you want. (Github issue #26)
  * Improve native (non-Posixy) path handling on platforms that
    need it (DOS, AROS, RISC OS, Redox)
  * New platforms: MirOS BSD, Bitrig, LibertyBSD, RISC OS, Redox
  * Add default policies for HP-UX &amp; various BSDs
  * twprint can now print reports for individual objects.
  * twprint now has verbosity levels for --print-dbfile mode.
  * Provide a useful README.md (issue #17 ).
  * Document return codes in man pages (issue #28 ).
  * Update install script after testing on additional platforms.
  * Provide default policies for more operating systems, and update some
    existing policies
  * Usability tweaks to twtest.
  * Clean up code style with clang-format, &amp; add a custom style that
    approximates existing OST usage.
  * Update copyright dates to 2018.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1561723200">- Fix bug Bug 1096636 - tripwire looks for the configuration file in
  /etc instead of /etc/tripwire. Now tw.cfg will really appead in /etc/tripwire
  * add patch 'tripwire-2.4.3.7-config-dir-location.patch'
    which update config dir to /etc/tripwire.
  * add build require libtool (which pulls automake and autoconf)
  * add 'autoreconf -a -i' to make sure automake is overwritten
  * Move /etc/tw.cfg to /etc/tripwire/tw.cfg in %post as make transition smoother</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt; - 2.4.3.7" date="1627905600">- fix build with gcc11</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="a7c3b3d00f41487dff51e6886fca0006b10a5aece98f68ac7b8b381a05ce6d6731eb4255df9e60ebe0b7c66e5b807ee3fa73b750da456dd4801062c14d83d772" name="tripwire-debugsource" arch="s390x">
  <version epoch="0" ver="2.4.3.7" rel="17.28"/>
  <changelog author="poeml@suse.de" date="1244116800">- fix paths in the sample twpol-Linux.txt
- remove obsolete patches
- update README.SuSE a bit
- package config directory and database directory to be readable
  only for root</changelog>
  <changelog author="poeml@suse.de" date="1244116801">- support large files (&gt;2GB), by defining the correct type for file
  sizes.
    tripwire-2.4.1.2-src-off_t.patch
- fix build failure due to compile warning about undefined
  behaviour when incrementing variables
    tripwire-2.4.1.2-src-undefined-operation.patch
- make sure that RPM_OPT_FLAGS are used when compiling.</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1346328000">- added gcc47 patch to allow build to work
- upgrade to 2.4.2.2
  * Bumping version to 2.4.2.2
  * Updated version revision in reports and all
  * Added experimental policy creation (see policy/policy_generator_readme.txt)
  * Fixed report formating and sendmail issues
  * Added Debian patches for crypto and hostnames
  * Fixed compiling issue on recent GCC compilers (-fpermissive)
  * Added patch to fix bug [ 1962485 ] Cannot change or expect-script</changelog>
  <changelog author="meissner@suse.com" date="1486641600">- Updated to 2.4.3.2 (bsc#1024442)
  See:
  https://github.com/Tripwire/tripwire-open-source/releases
- tripwire-2.4.1.2-src-off_t.patch: fixed upstream
- tripwire-2.4.1.2-src-undefined-operation.patch: fixed upstream
- README.SuSE -&gt; README.SUSE</changelog>
  <changelog author="meissner@suse.com" date="1488542400">- removed author credits from description.</changelog>
  <changelog author="jengelh@inai.de" date="1490270400">- Replace old $RPM_* shell variables by macros.
- Provide "Tripwire" with full version
- Trim manual from description.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1553342400">- Update to version 2.4.3.7
- Changes from 2.4.3.2 to 2.4.3.7
  * Run Clang static analyzer &amp; fix some of its quibbles
  * Fix compilation error on Alpine Linux 3.x (Issue #15)
  * Fix file permissions on a couple of source files (Issue #14)
  * Fix some errors w/ make install/uninstall/dist (Issue #15)
  * Fix a new issue with level 2 report printing ( Issue #19 )
  * Fix 'make install-strip' target, which wasn't actually
    stripping binaries (Issue #20)
  * Updated release to include archives with curl/wget-friendly names (Issue #22)
  * Buildsys: 'install-strip', 'uninstall', 'check', and 'distcheck'
    make targets now do useful things. (the install-strip change
    addresses the remaining bit of issue #18.)
  * Buildsys: To support old flavors of gcc, add "--disable-extrawarnings"
    configure option for compilers that don't understand -Wextra arg, and
    detect if the local g++ happens to be called c++.
  * Fix various new warnings w/ GCC 7.
  * Use std::unique_ptr instead of deprecated std::auto_ptr, where available.
  * Clean up / enable more twtest unit tests, &amp; tweak the framework for clarity.
  * Remove more dead code and strip out a bunch of uses of the always-true IS_UNIX ifdef.
  * Address some static analysis warnings from CppCheck &amp; Flawfinder
  * Add a sanity check in fcodatasourceiterimpl to address a unit test that failed on some platforms.
  * Update old policy test files in src/parser/testfiles to use current policy syntax.
  * Fix &amp; expand tests in Perl acceptance test framework
  * Fix &amp; expand twtest unit tests, &amp; rework unit test mini-framework so they’re
    referenced by name, not some numeric ID, and list tests as “skipped" if
    they don’t make any test assertions.
  * Add configure options to enable coverage, profiling, &amp; use
    /dev/urandom as RNG (all off by default)
  * Add a ‘list’ make target to list all make targets
  * Remove dead code &amp; add test coverage per gcov+lcov results
  * Fix various memory issues pointed out by valgrind
  * In examine-encryption mode, better reporting (&amp; nonzero exit) if we can't find a
    keyfile for the examined file.
  * More exception handling around individual objects &amp; init/IC as a whole,
    since there have been occasional reports of uncaught exceptions during init or check,
    and so far haven’t been able to repro or figure out what circumstances
    it occurs under. (e.g. Github issue #25)
  * Tweak install.sh so it can be run directly, not just thru 'make install'
    if you want. (Github issue #26)
  * Improve native (non-Posixy) path handling on platforms that need it (DOS, AROS, RISC OS, Redox)
  * New platforms: MirOS BSD, Bitrig, LibertyBSD, RISC OS, Redox
  * Add default policies for HP-UX &amp; various BSDs
  * Fix &amp; expand tests in Perl acceptance test framework
  * Fix &amp; expand twtest unit tests, &amp; rework unit test mini-framework so they’re
    referenced by name, not some numeric ID, and list tests as “skipped" if they
    don’t make any test assertions.
  * Add configure options to enable coverage, profiling, &amp; use /dev/urandom as RNG (all off by default)
  * Add a ‘list’ make target to list all make targets
  * Remove dead code &amp; add test coverage per gcov+lcov results
  * Fix various memory issues pointed out by valgrind
  * In examine-encryption mode, better reporting (&amp; nonzero exit) if we can't find
    a keyfile for the examined file.
  * More exception handling around individual objects &amp; init/IC as a whole,
    since there have been occasional reports of uncaught exceptions during
    init or check, and so far haven’t been able to repro or figure out what
    circumstances it occurs under. (e.g. Github issue #25)
  * Tweak install.sh so it can be run directly, not just thru
    'make install' if you want. (Github issue #26)
  * Improve native (non-Posixy) path handling on platforms that
    need it (DOS, AROS, RISC OS, Redox)
  * New platforms: MirOS BSD, Bitrig, LibertyBSD, RISC OS, Redox
  * Add default policies for HP-UX &amp; various BSDs
  * twprint can now print reports for individual objects.
  * twprint now has verbosity levels for --print-dbfile mode.
  * Provide a useful README.md (issue #17 ).
  * Document return codes in man pages (issue #28 ).
  * Update install script after testing on additional platforms.
  * Provide default policies for more operating systems, and update some
    existing policies
  * Usability tweaks to twtest.
  * Clean up code style with clang-format, &amp; add a custom style that
    approximates existing OST usage.
  * Update copyright dates to 2018.</changelog>
  <changelog author="Tuukka Pasanen &lt;tuukka.pasanen@ilmi.fi&gt;" date="1561723200">- Fix bug Bug 1096636 - tripwire looks for the configuration file in
  /etc instead of /etc/tripwire. Now tw.cfg will really appead in /etc/tripwire
  * add patch 'tripwire-2.4.3.7-config-dir-location.patch'
    which update config dir to /etc/tripwire.
  * add build require libtool (which pulls automake and autoconf)
  * add 'autoreconf -a -i' to make sure automake is overwritten
  * Move /etc/tw.cfg to /etc/tripwire/tw.cfg in %post as make transition smoother</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt; - 2.4.3.7" date="1627905600">- fix build with gcc11</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
</package>
<package pkgid="38d7f5dc7864bc0bdfd1053a5021f0498b892e6551fe2182dcbf0530703d506b61d83a53a60956dc3d17e35c6ba3f10ca3b64041f27894d92ee814617ac58501" name="trousers" arch="s390x">
  <version epoch="0" ver="0.3.15" rel="124.10"/>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1591099200">- add gcc-10.patch: fixes the build on gcc 10 by removing unused global
  variables. This patch was posted on the TrouSerS mailing list [1].
  [1]: https://sourceforge.net/p/trousers/mailman/message/36951419/</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1595851200">- In a previous commit the Requires line for the tss user got accidentally
  dropped. This change reintroduces it.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1604577600">- update to new upstream version 0.3.15:
  - Corrected mutliple security issues that existed if the tcsd is started by
    root instead of the tss user. CVE-2020-24332, CVE-2020-24330, CVE-2020-24331
  - Replaced use of _no_optimize with asm memory barrier
  - Fixed multiple potential instances of use after free memory handling
  - Removed unused global variables which caused build issue on some distros
- drop gcc-10.patch: now contained in upstream tarball
- drop bsc1164472.patch: now contained in upstream tarball
- adjusted %setup macro invocation which seemed to be wrong</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- move libraries to /usr/lib (bsc#1191102)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1637841600">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * tcsd.service</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed urls to https (except main URL which has no https)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1661169600">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1703937600">- add Requires(post): udev, Requires(post): coreutils
  * the post scriptlet uses udevamd and chown</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1776686400">- add setid-hardening.patch (bsc#1262318): detect privilege drop errors, also
  drop supplementary group membership.</changelog>
</package>
<package pkgid="cc6ed92a0bfa76a824a8977aa75455a6c0f1bbe1889dead1bdcf4d79d8ef46f98e6ac99275a668da701531dbe3a6fa96e49804a7dc7036819f4da11795af1124" name="trousers" arch="src">
  <version epoch="0" ver="0.3.15" rel="124.10"/>
  <changelog author="matthias.gerstner@suse.com" date="1540382400">- fix wrong installation of system.data.{auth,noauth} into /var/lib/tpm. These
  files are only sample files that *can* be used to fake that ownership was
  already taken by trousers, when other TPM stacks did that already. These
  files should not be there by default. Therefore install them into
  /usr/share/trousers instead, to allow the user to use them at his own
  discretion (fixes bsc#1111381).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1540555200">- fix mode of /var/lib/tpm, was missing the execute bit in the previous
  version.
- implement a backup and restore logic for /var/lib/tpm/system.data.* to
  prevent removal of validly stored trousers state during update. See previous
  comment for the packaging error that leads to this requirement.</changelog>
  <changelog author="mvetter@suse.com" date="1556280000">- bsc#1130588: Require shadow instead of old pwdutils</changelog>
  <changelog author="mgerstner &lt;matthias.gerstner@suse.com&gt;" date="1568030400">- add fix-lto.patch: This fixes the rpmlint error:
  trousers-devel.x86_64: E: lto-no-text-in-archive (Badness: 10000) /usr/lib64/libtddl.a
  objcopy/strip seem not to support the LTO linking and discard the actual
  text section from libtddl.a. By passing -ffat-lto-objects the object format
  is kept compatible with unaware tools and fixes the error.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1574769600">- Fix a local symlink attack problem with the %posttrans scriptlet
  (bsc#1157651, CVE-2019-18898). A rogue tss user could have used this attack
  to gain ownership of arbitrary files in the system during
  installation/update of the trousers package.</changelog>
  <changelog author="Michal Suchanek &lt;msuchanek@suse.com&gt;" date="1580472000">- Use system-users for tss user creation (boo#1162360).</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1582113600">- leave creation of /var/lib/tpm to the new system-user-tss package. Otherwise
  we're getting conflicts in packages depending on trousers (bsc#1162360).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1589371200">- add correct Requires(pre) and change %pretrans and %posttrans into %pre and
  %post. %pretrans can't have any dependencies and therefore can only be
  %implemented in lua. This currently leads to build errors "/bin/sh: no such
  file or directory".</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1589976000">- fix a potential tss user to root privilege escalation when running tcsd
  (bsc#1164472). To do this run tcsd as the 'tss' user right away to prevent
  badly designed privilege drop and initialization code to run.
- add bsc1164472.patch: additionally harden operation of tcsd when running as
  root. No longer follow symlinks in /var/lib/tpm. Drop gid to tss main group.
  require /etc/tcsd.conf to be owned by root:tss mode 0640.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1589976001">- get rid of %pre/%post logic that fixes the old packaging bug. Turns out
  %pretrans and %posttrans had their purpose before, because the logic needed
  to run before old files owned by the package got deleted. But I'm not
  reimplementing this strange logic in Lua ... users that didn't get the fix
  yet will have to live with it.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1591099200">- add gcc-10.patch: fixes the build on gcc 10 by removing unused global
  variables. This patch was posted on the TrouSerS mailing list [1].
  [1]: https://sourceforge.net/p/trousers/mailman/message/36951419/</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1595851200">- In a previous commit the Requires line for the tss user got accidentally
  dropped. This change reintroduces it.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1604577600">- update to new upstream version 0.3.15:
  - Corrected mutliple security issues that existed if the tcsd is started by
    root instead of the tss user. CVE-2020-24332, CVE-2020-24330, CVE-2020-24331
  - Replaced use of _no_optimize with asm memory barrier
  - Fixed multiple potential instances of use after free memory handling
  - Removed unused global variables which caused build issue on some distros
- drop gcc-10.patch: now contained in upstream tarball
- drop bsc1164472.patch: now contained in upstream tarball
- adjusted %setup macro invocation which seemed to be wrong</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- move libraries to /usr/lib (bsc#1191102)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1637841600">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * tcsd.service</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed urls to https (except main URL which has no https)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1661169600">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1703937600">- add Requires(post): udev, Requires(post): coreutils
  * the post scriptlet uses udevamd and chown</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1776686400">- add setid-hardening.patch (bsc#1262318): detect privilege drop errors, also
  drop supplementary group membership.</changelog>
</package>
<package pkgid="11c1b488fed9e19f4805801e82caff5767187c25243facad9cc418c5c0d9e0808ad9804c936201af3735f8f66064d42ccc873565b4925eff6926a279f0e9bd25" name="trousers-debuginfo" arch="s390x">
  <version epoch="0" ver="0.3.15" rel="124.10"/>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1591099200">- add gcc-10.patch: fixes the build on gcc 10 by removing unused global
  variables. This patch was posted on the TrouSerS mailing list [1].
  [1]: https://sourceforge.net/p/trousers/mailman/message/36951419/</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1595851200">- In a previous commit the Requires line for the tss user got accidentally
  dropped. This change reintroduces it.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1604577600">- update to new upstream version 0.3.15:
  - Corrected mutliple security issues that existed if the tcsd is started by
    root instead of the tss user. CVE-2020-24332, CVE-2020-24330, CVE-2020-24331
  - Replaced use of _no_optimize with asm memory barrier
  - Fixed multiple potential instances of use after free memory handling
  - Removed unused global variables which caused build issue on some distros
- drop gcc-10.patch: now contained in upstream tarball
- drop bsc1164472.patch: now contained in upstream tarball
- adjusted %setup macro invocation which seemed to be wrong</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- move libraries to /usr/lib (bsc#1191102)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1637841600">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * tcsd.service</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed urls to https (except main URL which has no https)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1661169600">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1703937600">- add Requires(post): udev, Requires(post): coreutils
  * the post scriptlet uses udevamd and chown</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1776686400">- add setid-hardening.patch (bsc#1262318): detect privilege drop errors, also
  drop supplementary group membership.</changelog>
</package>
<package pkgid="d1521ad2ed8158af697ee16412edfeda94f47b5fcfb328799bb9b252af549f91f98e56b2575d2f012dd4e96fe6f90df8081768f7fd17be80b126c1ab49590adb" name="trousers-debugsource" arch="s390x">
  <version epoch="0" ver="0.3.15" rel="124.10"/>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1591099200">- add gcc-10.patch: fixes the build on gcc 10 by removing unused global
  variables. This patch was posted on the TrouSerS mailing list [1].
  [1]: https://sourceforge.net/p/trousers/mailman/message/36951419/</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1595851200">- In a previous commit the Requires line for the tss user got accidentally
  dropped. This change reintroduces it.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1604577600">- update to new upstream version 0.3.15:
  - Corrected mutliple security issues that existed if the tcsd is started by
    root instead of the tss user. CVE-2020-24332, CVE-2020-24330, CVE-2020-24331
  - Replaced use of _no_optimize with asm memory barrier
  - Fixed multiple potential instances of use after free memory handling
  - Removed unused global variables which caused build issue on some distros
- drop gcc-10.patch: now contained in upstream tarball
- drop bsc1164472.patch: now contained in upstream tarball
- adjusted %setup macro invocation which seemed to be wrong</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- move libraries to /usr/lib (bsc#1191102)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1637841600">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * tcsd.service</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed urls to https (except main URL which has no https)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1661169600">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1703937600">- add Requires(post): udev, Requires(post): coreutils
  * the post scriptlet uses udevamd and chown</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1776686400">- add setid-hardening.patch (bsc#1262318): detect privilege drop errors, also
  drop supplementary group membership.</changelog>
</package>
<package pkgid="b0d4003e0e93dce491415f3de3a6e50c492a8fe93e1fabf8314c40483e4eee7263412c18d58b093dd846e2284771497af18914023409eb6f6bcb994c02333096" name="trousers-devel" arch="s390x">
  <version epoch="0" ver="0.3.15" rel="124.10"/>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1591099200">- add gcc-10.patch: fixes the build on gcc 10 by removing unused global
  variables. This patch was posted on the TrouSerS mailing list [1].
  [1]: https://sourceforge.net/p/trousers/mailman/message/36951419/</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1595851200">- In a previous commit the Requires line for the tss user got accidentally
  dropped. This change reintroduces it.</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1604577600">- update to new upstream version 0.3.15:
  - Corrected mutliple security issues that existed if the tcsd is started by
    root instead of the tss user. CVE-2020-24332, CVE-2020-24330, CVE-2020-24331
  - Replaced use of _no_optimize with asm memory barrier
  - Fixed multiple potential instances of use after free memory handling
  - Removed unused global variables which caused build issue on some distros
- drop gcc-10.patch: now contained in upstream tarball
- drop bsc1164472.patch: now contained in upstream tarball
- adjusted %setup macro invocation which seemed to be wrong</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1633435200">- move libraries to /usr/lib (bsc#1191102)</changelog>
  <changelog author="Johannes Segitz &lt;jsegitz@suse.com&gt;" date="1637841600">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * tcsd.service</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- changed urls to https (except main URL which has no https)</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1661169600">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="Giacomo Comes &lt;gcomes.obs@gmail.com&gt;" date="1703937600">- add Requires(post): udev, Requires(post): coreutils
  * the post scriptlet uses udevamd and chown</changelog>
  <changelog author="pgajdos@suse.com" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  %patchN</changelog>
  <changelog author="Matthias Gerstner &lt;matthias.gerstner@suse.com&gt;" date="1776686400">- add setid-hardening.patch (bsc#1262318): detect privilege drop errors, also
  drop supplementary group membership.</changelog>
</package>
<package pkgid="484a006968d4f7ba4a59381d92f4314435bb96a149a2896106b4290402a07d32a95a7728cd57fc81ad86ebb12a98e363c357dbdf53ea0df3ac2ea614316e3ff5" name="tss2" arch="s390x">
  <version epoch="0" ver="886" rel="6.32"/>
  <changelog author="meissner@suse.com" date="1484222400">- Initial IBM TPM 2.0 TSS stack imported, taken from
  James Bottonley package.
- 0001-libtss-add-correct-soname.patch: libtss: add correct soname
- 0002-tssProperties-add-TPM_USE_RESOURCE_MANAGER.patch: tssProperties: add TPM_USE_RESOURCE_MANAGER
- build.patch: do not build pprovison</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url switched to https</changelog>
</package>
<package pkgid="c88f37c8fbee08787d38ee798277422d0b0e68415afa462fcad4030d90e197ae9454fef3cb38c92664bfebf0146a5a2792dd51c1b5711d5e082b72b227b02f8c" name="tss2" arch="src">
  <version epoch="0" ver="886" rel="6.32"/>
  <changelog author="meissner@suse.com" date="1484222400">- Initial IBM TPM 2.0 TSS stack imported, taken from
  James Bottonley package.
- 0001-libtss-add-correct-soname.patch: libtss: add correct soname
- 0002-tssProperties-add-TPM_USE_RESOURCE_MANAGER.patch: tssProperties: add TPM_USE_RESOURCE_MANAGER
- build.patch: do not build pprovison</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url switched to https</changelog>
</package>
<package pkgid="30db0363ea004368fd201e0018267acb995e6538adde0d803322911858d6a362e65c67b6d95ff1471ce8c2e15964c607b4e72e2aeb93586aa9ca9fae21ad8b55" name="tss2-debuginfo" arch="s390x">
  <version epoch="0" ver="886" rel="6.32"/>
  <changelog author="meissner@suse.com" date="1484222400">- Initial IBM TPM 2.0 TSS stack imported, taken from
  James Bottonley package.
- 0001-libtss-add-correct-soname.patch: libtss: add correct soname
- 0002-tssProperties-add-TPM_USE_RESOURCE_MANAGER.patch: tssProperties: add TPM_USE_RESOURCE_MANAGER
- build.patch: do not build pprovison</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url switched to https</changelog>
</package>
<package pkgid="5909c2770b0b7813497c320cf2e1fb35ca3756f94bc65f1a4ffa14597861c9dc4748ac4c87512bbee8ec2103c001dc0533721f4be39b9f90d085d95e0fff9d0c" name="tss2-debugsource" arch="s390x">
  <version epoch="0" ver="886" rel="6.32"/>
  <changelog author="meissner@suse.com" date="1484222400">- Initial IBM TPM 2.0 TSS stack imported, taken from
  James Bottonley package.
- 0001-libtss-add-correct-soname.patch: libtss: add correct soname
- 0002-tssProperties-add-TPM_USE_RESOURCE_MANAGER.patch: tssProperties: add TPM_USE_RESOURCE_MANAGER
- build.patch: do not build pprovison</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url switched to https</changelog>
</package>
<package pkgid="2fbb12598719b582965e0859a14a473a772fbb2aaf309250f81fab43c3dcb4ab42e28ad3f8dfca0dd4e0a95bf765b847fc3a10888ea0a49942ab878ae3204cb8" name="tss2-devel" arch="s390x">
  <version epoch="0" ver="886" rel="6.32"/>
  <changelog author="meissner@suse.com" date="1484222400">- Initial IBM TPM 2.0 TSS stack imported, taken from
  James Bottonley package.
- 0001-libtss-add-correct-soname.patch: libtss: add correct soname
- 0002-tssProperties-add-TPM_USE_RESOURCE_MANAGER.patch: tssProperties: add TPM_USE_RESOURCE_MANAGER
- build.patch: do not build pprovison</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1650542400">- url switched to https</changelog>
</package>
<package pkgid="b9cc65c515b2540cc1c4c635a4dec9aba2ebde008c1c2f50c9070903b19ce3e3db53594af83b964fd7ff0aff843d61e34c7558dc1cda45e975a04c83ccb73267" name="u2f-utils" arch="s390x">
  <version epoch="0" ver="0.0.0+git1420732548.8af92a2" rel="2.242"/>
  <changelog author="mrueckert@suse.de" date="1421668800">- initial package</changelog>
  <changelog author="mrueckert@suse.de" date="1421668801">- split out the pam module in case we need a 32bit version of it</changelog>
</package>
<package pkgid="8c4d807df033347853773ca966fbeac6e992c7b5e7a03bcbbfb8b5939b51283cb634443f7dcef617545f7c194bd1e9ffbab1eedf4f821462f8d7577d725ebaf2" name="u2f-utils" arch="src">
  <version epoch="0" ver="0.0.0+git1420732548.8af92a2" rel="2.242"/>
  <changelog author="mrueckert@suse.de" date="1421668800">- initial package</changelog>
  <changelog author="mrueckert@suse.de" date="1421668801">- split out the pam module in case we need a 32bit version of it</changelog>
</package>
<package pkgid="7752bb5c80d8ac98c87769026dbdf65d989fbc6ad271de02996b78888ecf984c85e9bb52563ac4921da4d27cbdea9f6620bec7064bddbe519184d0102c7844ea" name="u2f-utils-debuginfo" arch="s390x">
  <version epoch="0" ver="0.0.0+git1420732548.8af92a2" rel="2.242"/>
  <changelog author="mrueckert@suse.de" date="1421668800">- initial package</changelog>
  <changelog author="mrueckert@suse.de" date="1421668801">- split out the pam module in case we need a 32bit version of it</changelog>
</package>
<package pkgid="31488e799fa5617efd2f8616a88ba6f4a4a8804bf87ebf95b5f178c0ae4e4c7fe6ec6acaa19eb2f5cea64ee4cf06828efc09893892489f5ee7c5865f08f83ddb" name="u2f-utils-debugsource" arch="s390x">
  <version epoch="0" ver="0.0.0+git1420732548.8af92a2" rel="2.242"/>
  <changelog author="mrueckert@suse.de" date="1421668800">- initial package</changelog>
  <changelog author="mrueckert@suse.de" date="1421668801">- split out the pam module in case we need a 32bit version of it</changelog>
</package>
<package pkgid="62b2c116acd16837270e24c55a9a9a39d698b7b66fa64c6991775ca8309cf42f327ea8381ae42b2d50cad60b38763f24baa592d85042947dcdbdb2f0e7aeb0cc" name="ufw" arch="noarch">
  <version epoch="0" ver="0.36.2" rel="31.12"/>
  <changelog author="johann.luce@wanadoo.fr" date="1347883200">- Update in 0.33
  fix dependance python-base
  fix lang zh_TW</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1350388800">-fix systemd tag to start automaticaly ufw</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1352462400">-fix problem systemd move in /usr
  fix various warning OBS</changelog>
  <changelog author="p.drouand@gmail.com" date="1428408000">- Remove obsolete macros
- Drop sysvinit support; ufw doesn't build for SLE11 anyway
- Cleanup specfile
- Split out translation files
- Use download Url as source</changelog>
  <changelog author="p.drouand@gmail.com" date="1449057600">- Update to version 0.34
  * refactor capabilities checks and only call when needed
  * error out early instead of tracing back with iptables errors in
    get_netfilter_capabilities() (LP: #1044361)
  * fix TypeError which somehow only manifested itself when using zh_CN
  * add 'reload' to help (LP: #1059060)
  * check-requirements now gives iptables output on failure. Patch thanks to
    S. Nizio.
  * use conntrack instead of state module. Patch based on work by S. Nizio.
    (LP: #1065297)
  * don't use get_netfilter_capabilities() with ipv6 if ipv6 is disabled
    (LP: #1039729, LP: #1062521)
  * fix parse error when finding PPID (LP: #1101304)
  * implement before and after hooks in /etc/ufw/(before|after).init
    (LP: #1075975) TODO: add tests
  * add unit test framework and cleanup, remove dead and refactor some code
  * honor UFW_SKIP_CHECKS=1 environment variable with setup.py, which eases
    testing
  * tests/check-requirements: add a check for -m rt --rt-type 0 (LP: #1191197)
  * match simple rule syntax and don't allow ports with esp and ah protocols
    with extended rule syntax
  * when displaying extended rules via parser.get_command(), show "out" if the
    direction is "out" and there is no corresponding interface
  * fix return of various invalid extended rules in parser.get_command()
  * clarify 'limit' command in man page (LP: #1089262)
  * implement route rules (ie, manage FORWARD, LP: #262421). See man page for
    details. This change reworked interface parsing and we now allow
    interfaces with '_' in the name (LP: #1098472)
  * add state RELATED,ESTABLISHED rule to ufw-before-forward in before*.rules
    like we do with ufw-before-input. This will only affect systems with ip
    forwarding enabled via sysctl
  * add ufw[6]-track-forward chain and handle it the same as for
    ufw[6]track-input and ufw[6]-track-output
  * document ufw[6]-track-* in README (dropped in previous commit)
  * fix for 'status' not distingushing between some v4/v6 targets
    (LP: #1078665)
  * add safe icmp packets packets to ufw-before-forward in before*.rules like
    we do for ufw-before-input. This will only affect systems with ip
    forwarding enabled via sysctl
  * update check-requirements for python 3.3 and 3.4
  * add 5269/tcp to XMPP (LP: #1327162)
  * fix traceback with forward rule
  * import new and updated Launchpad translations:
  - po/ar.po, po/ast.po, po/bg.po, po/bs.po, po/ca.po, po/ce.po, po/cs.po,
    po/da.po, po/de.po, po/el.po, po/en_AU.po, po/en_GB.po, po/es.po,
    po/et.po, po/fi.po, po/fr.po, po/he.po, po/hu.po, po/id.po, po/it.po,
    po/ja.po, po/ko.po, po/lv.po, po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po,
    po/pt.po, po/ru.po, po/se.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po,
    po/tl.po, po/tr.po, po/uk.po, po/ur.po, po/zh_CN.po, po/zh_TW.po
  * also use .lower() on translations for 'yes' (LP: #1438647)
  * adjust/rearrange before6.rules for rfc4890 'must not be blocked' and
    'should not be blocked' (LP: #1434525, LP: #1030214)
  * doc/systemd.example: add service file from Ubuntu (LP: #1341083)
  * correctly spell qBittorrent (LP: #1273965)
  * update man page for app rules (LP: #1155292)
  * support igmp protocol (LP: #946322)
  * adjust testsuite for systems supporting smtp/udp (LP: #815982)
  * enforce that basic commands don't have arguments (LP: #1155250)
  * update command completion for --dry-run, --force, --help and route
    (LP: #1225666)
  * support gre protocol (LP: #1418879)
  * support ./setup.py build (LP: #819600)
  * doc/ufw.8:
  - clarify log level behavior (LP: #1461701)
  - add app profile syntax
  - add protocol support
  * skip profiles with invalid port declarations (LP: #1201934)
  * tests/check-locales: skip locales that fail to install or generate</changelog>
  <changelog author="mardnh@gmx.de" date="1483099200">- Update to version 0.35
  * update check-requirements and README for python 3.5
  * update unit tests to not fail when /proc/net/* has no useful information
    (Closes: 797020)
  * update rsyslog example to use 'stop' instead of the deprecated '~'
    (Closes: 798100)
  * add --rootdir and --datadir options to ufw and ufw-init to make
    relocatable
  * files owned by 'clickpkg' are ok too
  * add preliminary snappy packaging
  * add support for comments (LP: #448503)
  * don't allow 'route delete NUM' and suggest 'delete NUM' instead
  * move user[6].rules to /etc/ufw (LP: #728128)
  * update README: python3 &lt; 3.4 is no longer supported
- remove Source2: ufw.service
  * replaced with upstream provided proper systemd-service file
- add support for bash completion
- minor specfile cleanup</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1546948800">- Update to version 0.36
  * adds snap packaging
  * concurrent updates
  * many bug fixes
  * a new 'prepend' command to better support IPS and dynamic firewalls.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1643457600">- Update to version 0.36.1:
  * update man page for limit since IPv6 has been supported since
    0.33 (LP: #1831186).
  * add direction when no interfaces specified in get_app_tuple()
    (LP: #1838764).
  * various testsuite adjustments for iptables 1.8
  * doc/ufw.8:
  - ::/0 is also a synonym for 'Anywhere'
  - document --force with 'ufw delete NUM'
  * prefer python3
  * empty out IPT_MODULES and update documentation (LP: #1556419)
  * adjust check-requirements to look for other firewall software
  * src/backend_iptables.py: unconditionally reload user rules
    with 'delete' (LP: #1933117).
- Switch to using default python3 for build and use appropriate
  python macros (BuildRequires: python3-devel, python-rpm-macros).
- Move bash completions to %_datadir/bash-completion/completions.
- Fix env dependent hashbangs.</changelog>
  <changelog author="Jonas Kvinge &lt;jonaski@opensuse.org&gt;" date="1717675200">- Update to version 0.36.2
  * src/ufw-init-functions: set default policy after loading rules. Thanks to
    Mauricio Faria de Oliveira. (LP: #1946804)
  * doc/ufw.8:
  - document 'insert' and 'prepend' can't be used to update comments
    (LP: #1927737)
  * src/backend_iptables.py: remove unreachable code (LP: #1927734)
  * src/util.py:
  - properly parse /proc/pid/stat for WSL (LP: #2015645)
  - mitigate odd length string with unhexlify (Closes: 1034568)
  - support vrrp protocol (LP: #1996636)
  * add locales/po/ro.po. Thanks Remus-Gabriel Chelu (Closes: 1034119)
  * add '-h' and show help with no args (LP: #1965462)
  * src/backend.py: add get_rules_ipv4() and get_rules_ipv6() (LP: #1951018)
  * tests/check-requirements: update for python 3.10+
  * tests/root: normalize 'ACCEPT {all,tcp}' and 'ACCEPT N' for newer systems</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1741780800">- Add BuildRequires: python3-setuptools to fix building with
  python 3.13.
- Run fdupes to link duplicate pycache files.</changelog>
</package>
<package pkgid="c3d69253e29e451d9c99d3f4f51ba178d8eaca34cbc1d4694117b9bb285b8ec501a2983676e3d92d0ce154b6e880a5b60510530e8ae64526118eb8636bd101f4" name="ufw" arch="src">
  <version epoch="0" ver="0.36.2" rel="31.12"/>
  <changelog author="johann.luce@wanadoo.fr" date="1317729600">Errors in spec file -</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1317729601">Changes on buildarch -</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1317729602">Changes in spec file for python version -</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1317816000">Changes in spec file for lang-</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1317816001">Delete patch commit.py-</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1317816002">OpenSuSE Factory-</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1317902400">add %lang tag in spec file-</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1318248000">add opensuse init script -</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1318334400">bug on restart in init file-</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1333540800">- Updated in 0.31.1
  fix various warning OBS
  add script init file for systemd</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1347883200">- Update in 0.33
  fix dependance python-base
  fix lang zh_TW</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1350388800">-fix systemd tag to start automaticaly ufw</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1352462400">-fix problem systemd move in /usr
  fix various warning OBS</changelog>
  <changelog author="p.drouand@gmail.com" date="1428408000">- Remove obsolete macros
- Drop sysvinit support; ufw doesn't build for SLE11 anyway
- Cleanup specfile
- Split out translation files
- Use download Url as source</changelog>
  <changelog author="p.drouand@gmail.com" date="1449057600">- Update to version 0.34
  * refactor capabilities checks and only call when needed
  * error out early instead of tracing back with iptables errors in
    get_netfilter_capabilities() (LP: #1044361)
  * fix TypeError which somehow only manifested itself when using zh_CN
  * add 'reload' to help (LP: #1059060)
  * check-requirements now gives iptables output on failure. Patch thanks to
    S. Nizio.
  * use conntrack instead of state module. Patch based on work by S. Nizio.
    (LP: #1065297)
  * don't use get_netfilter_capabilities() with ipv6 if ipv6 is disabled
    (LP: #1039729, LP: #1062521)
  * fix parse error when finding PPID (LP: #1101304)
  * implement before and after hooks in /etc/ufw/(before|after).init
    (LP: #1075975) TODO: add tests
  * add unit test framework and cleanup, remove dead and refactor some code
  * honor UFW_SKIP_CHECKS=1 environment variable with setup.py, which eases
    testing
  * tests/check-requirements: add a check for -m rt --rt-type 0 (LP: #1191197)
  * match simple rule syntax and don't allow ports with esp and ah protocols
    with extended rule syntax
  * when displaying extended rules via parser.get_command(), show "out" if the
    direction is "out" and there is no corresponding interface
  * fix return of various invalid extended rules in parser.get_command()
  * clarify 'limit' command in man page (LP: #1089262)
  * implement route rules (ie, manage FORWARD, LP: #262421). See man page for
    details. This change reworked interface parsing and we now allow
    interfaces with '_' in the name (LP: #1098472)
  * add state RELATED,ESTABLISHED rule to ufw-before-forward in before*.rules
    like we do with ufw-before-input. This will only affect systems with ip
    forwarding enabled via sysctl
  * add ufw[6]-track-forward chain and handle it the same as for
    ufw[6]track-input and ufw[6]-track-output
  * document ufw[6]-track-* in README (dropped in previous commit)
  * fix for 'status' not distingushing between some v4/v6 targets
    (LP: #1078665)
  * add safe icmp packets packets to ufw-before-forward in before*.rules like
    we do for ufw-before-input. This will only affect systems with ip
    forwarding enabled via sysctl
  * update check-requirements for python 3.3 and 3.4
  * add 5269/tcp to XMPP (LP: #1327162)
  * fix traceback with forward rule
  * import new and updated Launchpad translations:
  - po/ar.po, po/ast.po, po/bg.po, po/bs.po, po/ca.po, po/ce.po, po/cs.po,
    po/da.po, po/de.po, po/el.po, po/en_AU.po, po/en_GB.po, po/es.po,
    po/et.po, po/fi.po, po/fr.po, po/he.po, po/hu.po, po/id.po, po/it.po,
    po/ja.po, po/ko.po, po/lv.po, po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po,
    po/pt.po, po/ru.po, po/se.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po,
    po/tl.po, po/tr.po, po/uk.po, po/ur.po, po/zh_CN.po, po/zh_TW.po
  * also use .lower() on translations for 'yes' (LP: #1438647)
  * adjust/rearrange before6.rules for rfc4890 'must not be blocked' and
    'should not be blocked' (LP: #1434525, LP: #1030214)
  * doc/systemd.example: add service file from Ubuntu (LP: #1341083)
  * correctly spell qBittorrent (LP: #1273965)
  * update man page for app rules (LP: #1155292)
  * support igmp protocol (LP: #946322)
  * adjust testsuite for systems supporting smtp/udp (LP: #815982)
  * enforce that basic commands don't have arguments (LP: #1155250)
  * update command completion for --dry-run, --force, --help and route
    (LP: #1225666)
  * support gre protocol (LP: #1418879)
  * support ./setup.py build (LP: #819600)
  * doc/ufw.8:
  - clarify log level behavior (LP: #1461701)
  - add app profile syntax
  - add protocol support
  * skip profiles with invalid port declarations (LP: #1201934)
  * tests/check-locales: skip locales that fail to install or generate</changelog>
  <changelog author="mardnh@gmx.de" date="1483099200">- Update to version 0.35
  * update check-requirements and README for python 3.5
  * update unit tests to not fail when /proc/net/* has no useful information
    (Closes: 797020)
  * update rsyslog example to use 'stop' instead of the deprecated '~'
    (Closes: 798100)
  * add --rootdir and --datadir options to ufw and ufw-init to make
    relocatable
  * files owned by 'clickpkg' are ok too
  * add preliminary snappy packaging
  * add support for comments (LP: #448503)
  * don't allow 'route delete NUM' and suggest 'delete NUM' instead
  * move user[6].rules to /etc/ufw (LP: #728128)
  * update README: python3 &lt; 3.4 is no longer supported
- remove Source2: ufw.service
  * replaced with upstream provided proper systemd-service file
- add support for bash completion
- minor specfile cleanup</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1546948800">- Update to version 0.36
  * adds snap packaging
  * concurrent updates
  * many bug fixes
  * a new 'prepend' command to better support IPS and dynamic firewalls.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1643457600">- Update to version 0.36.1:
  * update man page for limit since IPv6 has been supported since
    0.33 (LP: #1831186).
  * add direction when no interfaces specified in get_app_tuple()
    (LP: #1838764).
  * various testsuite adjustments for iptables 1.8
  * doc/ufw.8:
  - ::/0 is also a synonym for 'Anywhere'
  - document --force with 'ufw delete NUM'
  * prefer python3
  * empty out IPT_MODULES and update documentation (LP: #1556419)
  * adjust check-requirements to look for other firewall software
  * src/backend_iptables.py: unconditionally reload user rules
    with 'delete' (LP: #1933117).
- Switch to using default python3 for build and use appropriate
  python macros (BuildRequires: python3-devel, python-rpm-macros).
- Move bash completions to %_datadir/bash-completion/completions.
- Fix env dependent hashbangs.</changelog>
  <changelog author="Jonas Kvinge &lt;jonaski@opensuse.org&gt;" date="1717675200">- Update to version 0.36.2
  * src/ufw-init-functions: set default policy after loading rules. Thanks to
    Mauricio Faria de Oliveira. (LP: #1946804)
  * doc/ufw.8:
  - document 'insert' and 'prepend' can't be used to update comments
    (LP: #1927737)
  * src/backend_iptables.py: remove unreachable code (LP: #1927734)
  * src/util.py:
  - properly parse /proc/pid/stat for WSL (LP: #2015645)
  - mitigate odd length string with unhexlify (Closes: 1034568)
  - support vrrp protocol (LP: #1996636)
  * add locales/po/ro.po. Thanks Remus-Gabriel Chelu (Closes: 1034119)
  * add '-h' and show help with no args (LP: #1965462)
  * src/backend.py: add get_rules_ipv4() and get_rules_ipv6() (LP: #1951018)
  * tests/check-requirements: update for python 3.10+
  * tests/root: normalize 'ACCEPT {all,tcp}' and 'ACCEPT N' for newer systems</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1741780800">- Add BuildRequires: python3-setuptools to fix building with
  python 3.13.
- Run fdupes to link duplicate pycache files.</changelog>
</package>
<package pkgid="09be5a175c8c3e87f353376b8fd430800892e4f79ad28321df478f873d855737dc0e916d31bb176ad13f226346802170f9f4b13517d05be97a7fa65c155b7fc3" name="ufw-lang" arch="noarch">
  <version epoch="0" ver="0.36.2" rel="31.12"/>
  <changelog author="johann.luce@wanadoo.fr" date="1347883200">- Update in 0.33
  fix dependance python-base
  fix lang zh_TW</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1350388800">-fix systemd tag to start automaticaly ufw</changelog>
  <changelog author="johann.luce@wanadoo.fr" date="1352462400">-fix problem systemd move in /usr
  fix various warning OBS</changelog>
  <changelog author="p.drouand@gmail.com" date="1428408000">- Remove obsolete macros
- Drop sysvinit support; ufw doesn't build for SLE11 anyway
- Cleanup specfile
- Split out translation files
- Use download Url as source</changelog>
  <changelog author="p.drouand@gmail.com" date="1449057600">- Update to version 0.34
  * refactor capabilities checks and only call when needed
  * error out early instead of tracing back with iptables errors in
    get_netfilter_capabilities() (LP: #1044361)
  * fix TypeError which somehow only manifested itself when using zh_CN
  * add 'reload' to help (LP: #1059060)
  * check-requirements now gives iptables output on failure. Patch thanks to
    S. Nizio.
  * use conntrack instead of state module. Patch based on work by S. Nizio.
    (LP: #1065297)
  * don't use get_netfilter_capabilities() with ipv6 if ipv6 is disabled
    (LP: #1039729, LP: #1062521)
  * fix parse error when finding PPID (LP: #1101304)
  * implement before and after hooks in /etc/ufw/(before|after).init
    (LP: #1075975) TODO: add tests
  * add unit test framework and cleanup, remove dead and refactor some code
  * honor UFW_SKIP_CHECKS=1 environment variable with setup.py, which eases
    testing
  * tests/check-requirements: add a check for -m rt --rt-type 0 (LP: #1191197)
  * match simple rule syntax and don't allow ports with esp and ah protocols
    with extended rule syntax
  * when displaying extended rules via parser.get_command(), show "out" if the
    direction is "out" and there is no corresponding interface
  * fix return of various invalid extended rules in parser.get_command()
  * clarify 'limit' command in man page (LP: #1089262)
  * implement route rules (ie, manage FORWARD, LP: #262421). See man page for
    details. This change reworked interface parsing and we now allow
    interfaces with '_' in the name (LP: #1098472)
  * add state RELATED,ESTABLISHED rule to ufw-before-forward in before*.rules
    like we do with ufw-before-input. This will only affect systems with ip
    forwarding enabled via sysctl
  * add ufw[6]-track-forward chain and handle it the same as for
    ufw[6]track-input and ufw[6]-track-output
  * document ufw[6]-track-* in README (dropped in previous commit)
  * fix for 'status' not distingushing between some v4/v6 targets
    (LP: #1078665)
  * add safe icmp packets packets to ufw-before-forward in before*.rules like
    we do for ufw-before-input. This will only affect systems with ip
    forwarding enabled via sysctl
  * update check-requirements for python 3.3 and 3.4
  * add 5269/tcp to XMPP (LP: #1327162)
  * fix traceback with forward rule
  * import new and updated Launchpad translations:
  - po/ar.po, po/ast.po, po/bg.po, po/bs.po, po/ca.po, po/ce.po, po/cs.po,
    po/da.po, po/de.po, po/el.po, po/en_AU.po, po/en_GB.po, po/es.po,
    po/et.po, po/fi.po, po/fr.po, po/he.po, po/hu.po, po/id.po, po/it.po,
    po/ja.po, po/ko.po, po/lv.po, po/nb.po, po/nl.po, po/pl.po, po/pt_BR.po,
    po/pt.po, po/ru.po, po/se.po, po/sk.po, po/sl.po, po/sr.po, po/sv.po,
    po/tl.po, po/tr.po, po/uk.po, po/ur.po, po/zh_CN.po, po/zh_TW.po
  * also use .lower() on translations for 'yes' (LP: #1438647)
  * adjust/rearrange before6.rules for rfc4890 'must not be blocked' and
    'should not be blocked' (LP: #1434525, LP: #1030214)
  * doc/systemd.example: add service file from Ubuntu (LP: #1341083)
  * correctly spell qBittorrent (LP: #1273965)
  * update man page for app rules (LP: #1155292)
  * support igmp protocol (LP: #946322)
  * adjust testsuite for systems supporting smtp/udp (LP: #815982)
  * enforce that basic commands don't have arguments (LP: #1155250)
  * update command completion for --dry-run, --force, --help and route
    (LP: #1225666)
  * support gre protocol (LP: #1418879)
  * support ./setup.py build (LP: #819600)
  * doc/ufw.8:
  - clarify log level behavior (LP: #1461701)
  - add app profile syntax
  - add protocol support
  * skip profiles with invalid port declarations (LP: #1201934)
  * tests/check-locales: skip locales that fail to install or generate</changelog>
  <changelog author="mardnh@gmx.de" date="1483099200">- Update to version 0.35
  * update check-requirements and README for python 3.5
  * update unit tests to not fail when /proc/net/* has no useful information
    (Closes: 797020)
  * update rsyslog example to use 'stop' instead of the deprecated '~'
    (Closes: 798100)
  * add --rootdir and --datadir options to ufw and ufw-init to make
    relocatable
  * files owned by 'clickpkg' are ok too
  * add preliminary snappy packaging
  * add support for comments (LP: #448503)
  * don't allow 'route delete NUM' and suggest 'delete NUM' instead
  * move user[6].rules to /etc/ufw (LP: #728128)
  * update README: python3 &lt; 3.4 is no longer supported
- remove Source2: ufw.service
  * replaced with upstream provided proper systemd-service file
- add support for bash completion
- minor specfile cleanup</changelog>
  <changelog author="alexander_naumov@opensuse.org" date="1546948800">- Update to version 0.36
  * adds snap packaging
  * concurrent updates
  * many bug fixes
  * a new 'prepend' command to better support IPS and dynamic firewalls.</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1643457600">- Update to version 0.36.1:
  * update man page for limit since IPv6 has been supported since
    0.33 (LP: #1831186).
  * add direction when no interfaces specified in get_app_tuple()
    (LP: #1838764).
  * various testsuite adjustments for iptables 1.8
  * doc/ufw.8:
  - ::/0 is also a synonym for 'Anywhere'
  - document --force with 'ufw delete NUM'
  * prefer python3
  * empty out IPT_MODULES and update documentation (LP: #1556419)
  * adjust check-requirements to look for other firewall software
  * src/backend_iptables.py: unconditionally reload user rules
    with 'delete' (LP: #1933117).
- Switch to using default python3 for build and use appropriate
  python macros (BuildRequires: python3-devel, python-rpm-macros).
- Move bash completions to %_datadir/bash-completion/completions.
- Fix env dependent hashbangs.</changelog>
  <changelog author="Jonas Kvinge &lt;jonaski@opensuse.org&gt;" date="1717675200">- Update to version 0.36.2
  * src/ufw-init-functions: set default policy after loading rules. Thanks to
    Mauricio Faria de Oliveira. (LP: #1946804)
  * doc/ufw.8:
  - document 'insert' and 'prepend' can't be used to update comments
    (LP: #1927737)
  * src/backend_iptables.py: remove unreachable code (LP: #1927734)
  * src/util.py:
  - properly parse /proc/pid/stat for WSL (LP: #2015645)
  - mitigate odd length string with unhexlify (Closes: 1034568)
  - support vrrp protocol (LP: #1996636)
  * add locales/po/ro.po. Thanks Remus-Gabriel Chelu (Closes: 1034119)
  * add '-h' and show help with no args (LP: #1965462)
  * src/backend.py: add get_rules_ipv4() and get_rules_ipv6() (LP: #1951018)
  * tests/check-requirements: update for python 3.10+
  * tests/root: normalize 'ACCEPT {all,tcp}' and 'ACCEPT N' for newer systems</changelog>
  <changelog author="Atri Bhattacharya &lt;badshah400@gmail.com&gt;" date="1741780800">- Add BuildRequires: python3-setuptools to fix building with
  python 3.13.
- Run fdupes to link duplicate pycache files.</changelog>
</package>
<package pkgid="8807d87e47d584905d2d51e9ac9f543e5ba73dc8a8d4317c55487ea0529e1e0d5fa6f3bd2cf0e87f5f945c578f046e896d01d0ad8a7649ae56faed6635a6c115" name="unhide_rb" arch="noarch">
  <version epoch="0" ver="22" rel="1.33"/>
  <changelog author="pascal.bleser@opensuse.org" date="1305720000">- initial version (0.12)</changelog>
  <changelog author="meissner@suse.com" date="1508846400">- update to 22 from launchpad</changelog>
</package>
<package pkgid="039d74f2ed0b578424ef95022383dcb9331dae91502bd18409fccb94be4a4617a6776292f501046309f9247171e00554ff72da0f75ed5af0ef80f2eaa7ef85f4" name="unhide_rb" arch="src">
  <version epoch="0" ver="22" rel="1.33"/>
  <changelog author="pascal.bleser@opensuse.org" date="1305720000">- initial version (0.12)</changelog>
  <changelog author="meissner@suse.com" date="1508846400">- update to 22 from launchpad</changelog>
</package>
<package pkgid="2e9130aea2fd127cfb6d3e7fc5d4bf6d8a4086a6b32d8f9b15c6f1aa2b09f8c25365da12c245caf0bcf7c5d14a7af091b25f8a60184830b94ebef0432ea280d0" name="usbauth" arch="s390x">
  <version epoch="0" ver="1.0.5" rel="36.24"/>
  <changelog author="meissner@suse.com" date="1507809600">- initial package, a USB device authentication tool that avoids
  BadUSB style attacks.</changelog>
  <changelog author="meissner@suse.com" date="1517486400">- do not do groupdel</changelog>
  <changelog author="meissner@suse.com" date="1517832000">- updated to current git</changelog>
  <changelog author="stefan.koch10@gmail.com" date="1518523200">- update outdated source (fix dbus group)
- remove group creation within spec file</changelog>
  <changelog author="Stefan Koch &lt;stefan.koch10@gmail.com&gt;" date="1548158400">- update to 1.0.1:
  * Fix string comparing
  * Support string quoting</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1550664000">- Use a full Source URL and original tarball.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1576756800">- BuildRequire pkgconfig(libudev) instead of libudev-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1609502400">- Update to version 1.0.2:
  * Log dbus_error only when debug logging is enabled
  * Correct man page location</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1651579200">- Update to version 1.0.3
  * Improve logging of dbus errors</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678795200">- update to 1.0.5:
  * Support devpath comparisation
  * Support explicit value type comparisation
  * Add default value types</changelog>
</package>
<package pkgid="06df3912665adae631c7abf9b03b71bdaf5354004c25894c73cd0900a2e033583428394110a97407e195276523a1ebb79e79444ba60892a52f250935194d34a6" name="usbauth" arch="src">
  <version epoch="0" ver="1.0.5" rel="36.24"/>
  <changelog author="meissner@suse.com" date="1507809600">- initial package, a USB device authentication tool that avoids
  BadUSB style attacks.</changelog>
  <changelog author="meissner@suse.com" date="1517486400">- do not do groupdel</changelog>
  <changelog author="meissner@suse.com" date="1517832000">- updated to current git</changelog>
  <changelog author="stefan.koch10@gmail.com" date="1518523200">- update outdated source (fix dbus group)
- remove group creation within spec file</changelog>
  <changelog author="Stefan Koch &lt;stefan.koch10@gmail.com&gt;" date="1548158400">- update to 1.0.1:
  * Fix string comparing
  * Support string quoting</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1550664000">- Use a full Source URL and original tarball.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1576756800">- BuildRequire pkgconfig(libudev) instead of libudev-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1609502400">- Update to version 1.0.2:
  * Log dbus_error only when debug logging is enabled
  * Correct man page location</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1651579200">- Update to version 1.0.3
  * Improve logging of dbus errors</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678795200">- update to 1.0.5:
  * Support devpath comparisation
  * Support explicit value type comparisation
  * Add default value types</changelog>
</package>
<package pkgid="9ddb0ad4a72149ebbe5d54a82a9b56332a4d5b9de2c74d512c2abdcf3468032c58ff562b3da4426cb82eb9a3d7e41df1aaaef05f8ad7b2c1e23fac0495d59489" name="usbauth-debuginfo" arch="s390x">
  <version epoch="0" ver="1.0.5" rel="36.24"/>
  <changelog author="meissner@suse.com" date="1507809600">- initial package, a USB device authentication tool that avoids
  BadUSB style attacks.</changelog>
  <changelog author="meissner@suse.com" date="1517486400">- do not do groupdel</changelog>
  <changelog author="meissner@suse.com" date="1517832000">- updated to current git</changelog>
  <changelog author="stefan.koch10@gmail.com" date="1518523200">- update outdated source (fix dbus group)
- remove group creation within spec file</changelog>
  <changelog author="Stefan Koch &lt;stefan.koch10@gmail.com&gt;" date="1548158400">- update to 1.0.1:
  * Fix string comparing
  * Support string quoting</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1550664000">- Use a full Source URL and original tarball.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1576756800">- BuildRequire pkgconfig(libudev) instead of libudev-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1609502400">- Update to version 1.0.2:
  * Log dbus_error only when debug logging is enabled
  * Correct man page location</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1651579200">- Update to version 1.0.3
  * Improve logging of dbus errors</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678795200">- update to 1.0.5:
  * Support devpath comparisation
  * Support explicit value type comparisation
  * Add default value types</changelog>
</package>
<package pkgid="e14ec8cb2574b040a04c6547ebac3640243811c752529802be6c39f1ac3180283aee7d52a75bbd7817ba15150ce59684322b00e24b31290373f7f62ba6aff59b" name="usbauth-debugsource" arch="s390x">
  <version epoch="0" ver="1.0.5" rel="36.24"/>
  <changelog author="meissner@suse.com" date="1507809600">- initial package, a USB device authentication tool that avoids
  BadUSB style attacks.</changelog>
  <changelog author="meissner@suse.com" date="1517486400">- do not do groupdel</changelog>
  <changelog author="meissner@suse.com" date="1517832000">- updated to current git</changelog>
  <changelog author="stefan.koch10@gmail.com" date="1518523200">- update outdated source (fix dbus group)
- remove group creation within spec file</changelog>
  <changelog author="Stefan Koch &lt;stefan.koch10@gmail.com&gt;" date="1548158400">- update to 1.0.1:
  * Fix string comparing
  * Support string quoting</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1550664000">- Use a full Source URL and original tarball.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1576756800">- BuildRequire pkgconfig(libudev) instead of libudev-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1609502400">- Update to version 1.0.2:
  * Log dbus_error only when debug logging is enabled
  * Correct man page location</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1651579200">- Update to version 1.0.3
  * Improve logging of dbus errors</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678795200">- update to 1.0.5:
  * Support devpath comparisation
  * Support explicit value type comparisation
  * Add default value types</changelog>
</package>
<package pkgid="d3197c03703606ff6df287a2ed68e7b61d28070f44f2c987b66902a94d28c996a56754218a5a87c18b86c665eedc05e0319b4cab159f9b8d3615e620b8e3c5db" name="usbauth-notifier" arch="s390x">
  <version epoch="0" ver="1.0.4" rel="37.23"/>
  <changelog author="meissner@suse.com" date="1507809600">- UI notifications for new USB devices to be authenticated</changelog>
  <changelog author="meissner@suse.com" date="1507809601">- susefied spec file. correct permission handling added.</changelog>
  <changelog author="stefan.koch10@gmail.com" date="1518523200">- buildrequires usbauth not needed, we create both
  groups here.
- fix group creation within spec file</changelog>
  <changelog author="stefan.koch10@gmail.com" date="1519646400">- fix formatting of notifications
- fix group name in manpage/README
- use XDG autostart instead of xinitrc.d</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580731200">- BuildRequire pkgconfig(libudev) instead of libudev-devel: Allow
  OBS to shortcut through -mini flavors.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1609070400">- Update to version 1.0.2:
  * move usbauth-npriv from bindir to libexecdir
  * move usbauth-notifier from libdir to libexecdir
- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)
- Create lang package</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1651579200">- Update to version 1.0.4
  * Fix libexecdir expansion for usbauth-notifier.desktop</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1707220800">- provide group(usbauth) group(usbauth-notifier) for rpm 4.19</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707220801">- Fix lang subpackage</changelog>
</package>
<package pkgid="195ba978c3e3eff10eb7476712b7138633c69e3b53b926687806852e021479eb4fc1492df7fca7e504a82c483a38486724ab680774a82a2803ea6eea40519b13" name="usbauth-notifier" arch="src">
  <version epoch="0" ver="1.0.4" rel="37.23"/>
  <changelog author="meissner@suse.com" date="1507809600">- UI notifications for new USB devices to be authenticated</changelog>
  <changelog author="meissner@suse.com" date="1507809601">- susefied spec file. correct permission handling added.</changelog>
  <changelog author="stefan.koch10@gmail.com" date="1518523200">- buildrequires usbauth not needed, we create both
  groups here.
- fix group creation within spec file</changelog>
  <changelog author="stefan.koch10@gmail.com" date="1519646400">- fix formatting of notifications
- fix group name in manpage/README
- use XDG autostart instead of xinitrc.d</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580731200">- BuildRequire pkgconfig(libudev) instead of libudev-devel: Allow
  OBS to shortcut through -mini flavors.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1609070400">- Update to version 1.0.2:
  * move usbauth-npriv from bindir to libexecdir
  * move usbauth-notifier from libdir to libexecdir
- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)
- Create lang package</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1651579200">- Update to version 1.0.4
  * Fix libexecdir expansion for usbauth-notifier.desktop</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1707220800">- provide group(usbauth) group(usbauth-notifier) for rpm 4.19</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707220801">- Fix lang subpackage</changelog>
</package>
<package pkgid="36a1b480a090e80a2eecca2b4ec4527f92e669a434ffb40a63632a3c4db6a5597440dee443bfc99ce38ff1a0f3d547f4d5af7fed25a62d42002fdf7cce82a2cc" name="usbauth-notifier-debuginfo" arch="s390x">
  <version epoch="0" ver="1.0.4" rel="37.23"/>
  <changelog author="meissner@suse.com" date="1507809600">- UI notifications for new USB devices to be authenticated</changelog>
  <changelog author="meissner@suse.com" date="1507809601">- susefied spec file. correct permission handling added.</changelog>
  <changelog author="stefan.koch10@gmail.com" date="1518523200">- buildrequires usbauth not needed, we create both
  groups here.
- fix group creation within spec file</changelog>
  <changelog author="stefan.koch10@gmail.com" date="1519646400">- fix formatting of notifications
- fix group name in manpage/README
- use XDG autostart instead of xinitrc.d</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580731200">- BuildRequire pkgconfig(libudev) instead of libudev-devel: Allow
  OBS to shortcut through -mini flavors.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1609070400">- Update to version 1.0.2:
  * move usbauth-npriv from bindir to libexecdir
  * move usbauth-notifier from libdir to libexecdir
- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)
- Create lang package</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1651579200">- Update to version 1.0.4
  * Fix libexecdir expansion for usbauth-notifier.desktop</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1707220800">- provide group(usbauth) group(usbauth-notifier) for rpm 4.19</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707220801">- Fix lang subpackage</changelog>
</package>
<package pkgid="5b86ab9d4039587cccdcbecbf3165c312c06e1a09fe4205c22431fa9cc1b66fc80e45ba86677678c9c448b69c798b418276ff4ad7cbc45afabc36b0bb3c0b8fa" name="usbauth-notifier-debugsource" arch="s390x">
  <version epoch="0" ver="1.0.4" rel="37.23"/>
  <changelog author="meissner@suse.com" date="1507809600">- UI notifications for new USB devices to be authenticated</changelog>
  <changelog author="meissner@suse.com" date="1507809601">- susefied spec file. correct permission handling added.</changelog>
  <changelog author="stefan.koch10@gmail.com" date="1518523200">- buildrequires usbauth not needed, we create both
  groups here.
- fix group creation within spec file</changelog>
  <changelog author="stefan.koch10@gmail.com" date="1519646400">- fix formatting of notifications
- fix group name in manpage/README
- use XDG autostart instead of xinitrc.d</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580731200">- BuildRequire pkgconfig(libudev) instead of libudev-devel: Allow
  OBS to shortcut through -mini flavors.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1609070400">- Update to version 1.0.2:
  * move usbauth-npriv from bindir to libexecdir
  * move usbauth-notifier from libdir to libexecdir
- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)
- Create lang package</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1651579200">- Update to version 1.0.4
  * Fix libexecdir expansion for usbauth-notifier.desktop</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1707220800">- provide group(usbauth) group(usbauth-notifier) for rpm 4.19</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707220801">- Fix lang subpackage</changelog>
</package>
<package pkgid="7f52e15f80673c729b78c0ff308a3de60f2dadd6462b834bd2d391f88bb3ec88c36da5a70f7961a1bbc80394a26301aad6a7378ebfb049e1fe4b71250e24a286" name="usbauth-notifier-lang" arch="noarch">
  <version epoch="0" ver="1.0.4" rel="37.23"/>
  <changelog author="meissner@suse.com" date="1507809600">- UI notifications for new USB devices to be authenticated</changelog>
  <changelog author="meissner@suse.com" date="1507809601">- susefied spec file. correct permission handling added.</changelog>
  <changelog author="stefan.koch10@gmail.com" date="1518523200">- buildrequires usbauth not needed, we create both
  groups here.
- fix group creation within spec file</changelog>
  <changelog author="stefan.koch10@gmail.com" date="1519646400">- fix formatting of notifications
- fix group name in manpage/README
- use XDG autostart instead of xinitrc.d</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1580731200">- BuildRequire pkgconfig(libudev) instead of libudev-devel: Allow
  OBS to shortcut through -mini flavors.</changelog>
  <changelog author="Callum Farmer &lt;gmbr3@opensuse.org&gt;" date="1609070400">- Update to version 1.0.2:
  * move usbauth-npriv from bindir to libexecdir
  * move usbauth-notifier from libdir to libexecdir
- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)
- Create lang package</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1651579200">- Update to version 1.0.4
  * Fix libexecdir expansion for usbauth-notifier.desktop</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1707220800">- provide group(usbauth) group(usbauth-notifier) for rpm 4.19</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707220801">- Fix lang subpackage</changelog>
</package>
<package pkgid="9e16144b811a4153250ea31e79e79b86796874b2b8490af1da8297471337048ae0f697076d1e49651c7ab1d644eecfd89657523ba5c6c1328c2d4cb6a329ce01" name="vault-sync" arch="s390x">
  <version epoch="0" ver="0.11.0" rel="10.20"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717761600">- new package vault-sync: synchronize secrets between HashiCorp
  Vault instances</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741953600">- Update to version 0.10.0:
  * Breaking changes
  - The default value for dst.backend has changed. Previously the
    default value was "secret", now the corresponding
    configuration for src will be used also for dst, if
    dst.backend not specified.
  * What's Changed
  - Add kubernetes job by @pbchekin in #15
  - Helm chart 0.1.3 by @pbchekin in #16
  - Rust 1.85.0, update Cargo.lock by @pbchekin in #19
  - Document CA certificates by @pbchekin in #18
  - Fix compilation warnings by @pbchekin in #20
  - Multiple backends by @pbchekin in #21</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746273600">- Update to version 0.11.0:
  * Prepare for 0.11.0 (#24)
  * Add Support for namespace Configuration (#23)</changelog>
</package>
<package pkgid="d2ca7a307912fcfec0e3124d921c5391ceb94f7a4e813e10f1d722eb343ebf5685d21f7f02b197a50262f8600ea9d6a375712e8dba99464a1fa4f9a4a9f7bb9c" name="vault-sync" arch="src">
  <version epoch="0" ver="0.11.0" rel="10.20"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717761600">- new package vault-sync: synchronize secrets between HashiCorp
  Vault instances</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741953600">- Update to version 0.10.0:
  * Breaking changes
  - The default value for dst.backend has changed. Previously the
    default value was "secret", now the corresponding
    configuration for src will be used also for dst, if
    dst.backend not specified.
  * What's Changed
  - Add kubernetes job by @pbchekin in #15
  - Helm chart 0.1.3 by @pbchekin in #16
  - Rust 1.85.0, update Cargo.lock by @pbchekin in #19
  - Document CA certificates by @pbchekin in #18
  - Fix compilation warnings by @pbchekin in #20
  - Multiple backends by @pbchekin in #21</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746273600">- Update to version 0.11.0:
  * Prepare for 0.11.0 (#24)
  * Add Support for namespace Configuration (#23)</changelog>
</package>
<package pkgid="f6efa40a8bd628ff938b1cbd075eeed5f2e2e0b5b3e108c92ea83b9f2c6da8f55ceecde5c98e6d075adca1d7af150ea7df17cfe973fe1e793eae6bd7367be9fb" name="vault-sync-debuginfo" arch="s390x">
  <version epoch="0" ver="0.11.0" rel="10.20"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717761600">- new package vault-sync: synchronize secrets between HashiCorp
  Vault instances</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741953600">- Update to version 0.10.0:
  * Breaking changes
  - The default value for dst.backend has changed. Previously the
    default value was "secret", now the corresponding
    configuration for src will be used also for dst, if
    dst.backend not specified.
  * What's Changed
  - Add kubernetes job by @pbchekin in #15
  - Helm chart 0.1.3 by @pbchekin in #16
  - Rust 1.85.0, update Cargo.lock by @pbchekin in #19
  - Document CA certificates by @pbchekin in #18
  - Fix compilation warnings by @pbchekin in #20
  - Multiple backends by @pbchekin in #21</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746273600">- Update to version 0.11.0:
  * Prepare for 0.11.0 (#24)
  * Add Support for namespace Configuration (#23)</changelog>
</package>
<package pkgid="6634bf0ef38013c45f3383656315d082c49581736f15e85152578142dfb81a6afea0752d06e25c36d43e6740065ef7c93e2e4644afebc2c61a7a6b4d28335966" name="vault-sync-debugsource" arch="s390x">
  <version epoch="0" ver="0.11.0" rel="10.20"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1717761600">- new package vault-sync: synchronize secrets between HashiCorp
  Vault instances</changelog>
  <changelog author="opensuse_buildservice@ojkastl.de" date="1741953600">- Update to version 0.10.0:
  * Breaking changes
  - The default value for dst.backend has changed. Previously the
    default value was "secret", now the corresponding
    configuration for src will be used also for dst, if
    dst.backend not specified.
  * What's Changed
  - Add kubernetes job by @pbchekin in #15
  - Helm chart 0.1.3 by @pbchekin in #16
  - Rust 1.85.0, update Cargo.lock by @pbchekin in #19
  - Document CA certificates by @pbchekin in #18
  - Fix compilation warnings by @pbchekin in #20
  - Multiple backends by @pbchekin in #21</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1746273600">- Update to version 0.11.0:
  * Prepare for 0.11.0 (#24)
  * Add Support for namespace Configuration (#23)</changelog>
</package>
<package pkgid="2f3a7353feae8f9844e7ad1ec9c94ded7cca05e96c8b658e735cb277308987fff69fbbc862de38355dafddebfdda91b083d3b4195da1df978d63f04356bb16cc" name="wafw00f" arch="src">
  <version epoch="0" ver="2.4.2" rel="9.4"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1625486400">- First import from upstream</changelog>
  <changelog author="Matthias Eliasson &lt;elimat@opensuse.org&gt;" date="1661342400">- Update to version 2.2.0
  * New features like docker support and output format fixes.
  * Several new bug fixes and stability to the existing code.
  * Few new WAF detections.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1767355200">- update to 2.3.2:
  * New WAF detections:
  * Baffin Bay
  * Link11 WAAP
  * A10 Networks WAF
  * PanYun WAF
  * More specific cookie matching for F5 ASM
- update to 2.3.1:
  * setup.py installs wafw00f binary twice
- update to 2.3.0:
  * We dropped support for Python 2 completely.
  * PIP 24.3 compatibility.
  * Couple of new interesting WAFs detections!</changelog>
  <changelog author="munix9@googlemail.com" date="1780401600">- Update to version 2.4.2:
  * Removes setup.py to fix tool installations when building locally.
  * Updated the latest supported versions of Python (≥3.10)
  * New WAF signature updates:
  - Vercel WAF
  - Reflected Networks WAF
  * Improvements to existing signatures:
  - Tencent WAF
- Update to version 2.4.1:
  * Fix timeout enforcement during response body reading to properly
    handle slow streaming servers.
  * Timeout enforcement: The --timeout parameter is now properly
    enforced during response body reading, not just during connection
    establishment. This fixes the issue where slow-streaming servers
    could cause scans to take over 2 minutes instead of respecting
    the user-specified timeout.
  * Track elapsed time during chunk reading loop
  * Break out of reading loop if timeout is exceeded during reading
  * Add test documenting timeout enforcement behavior
- Update to version 2.4.0:
  * New WAF detections
  - Anubis (Techaro)
  - Scutum (Secure Sky Technology)
  - 360PanYun (360 Technologies)
  - ThreatX (A10 Networks)
  - Link11 WAAP
  * Improvements
  - Fastly detection improvements (tighter regex for X-Served-By)
  - Added pytest test framework with 45 tests
  - Added pyproject.toml for modern Python packaging
  - Removed pluginbase dependency (use stdlib importlib)
  * Fixes
  - Fixed infinite hang on streaming responses (#246)
  - Improved -t option help text (#243)
  * Other
  - Updated copyright years to 2026
  - Updated Python requirement to 3.8+
- Add fix-request-path.patch based on commit af3eca1:
  Noticed that path attacks like LFI were being ignored. Changed
  the way requests were done to ensure that the path is not normalized
  by creating a prepared request and overwrite the url.
- Use source from github to get complete tests
- Switch to wheel/pip build
- Add %check/%pytest
- Clean up spec file</changelog>
</package>
<package pkgid="27b5c0bb6cbd514398cf72617b097eb3a40223595eb4642731e67233618e1a7b16310bfae6e85568a9b85ceb13d361ffc467a1cc0d3fc6e2123442c053e04398" name="wapiti" arch="noarch">
  <version epoch="0" ver="3.0.0" rel="1.52"/>
  <changelog author="johann.luce@wanadoo.fr" date="1382702400">- first in 2.3.0 for openSUSE</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1515931200">- Update to version 3.0.0:
  * This new release now relies on Python 3.
  * A session mechanism using sqlite3 allows you to stop the scan
    or/and attacks and resume them later.
  * The new behavior, when you stop Wapiti during the attack
    process (with Ctrl+C), is to let you choose between continuing,
    moving to the next attack-module, exiting with or without
    generating the report.
  * A total of 9 options can now help you to finely control the
    scanner by fixing the maximum allowed depth of crawling,
    skipping parameter names of your choice in URLs and forms,
    setting the maximum delay for scanning, choosing between 6
    modes of scan force, and more!
  * The SOCKS5 proxy support is also back in this release.
  * Improvements have been made to existing attack modules. For
    example by reducing false-positives for the blind sqli attack
    module.
  * Two new attack modules were added: buster (for
    directory/filename brute forcing) and shellshock (not really
    new but here it is).
  * Some options changed. The base URL must now be given through
    the -u option.
- New runtime dependencies:
  * python3-Mako
  * python3-PySocks
  * python3-lxml
  * python3-tld
  * python3-yaswfp
- Clean spec file with spec-cleaner.</changelog>
</package>
<package pkgid="98b4dd17ad7596232fe2f16f2ae851f30acdf73a933028d0a2043c66c49a6e073b877f5fcc03e5a1b22ba87164dfd8fc1a72857193ea4c64edcfc4a74b31bde5" name="wapiti" arch="src">
  <version epoch="0" ver="3.0.0" rel="1.52"/>
  <changelog author="johann.luce@wanadoo.fr" date="1382702400">- first in 2.3.0 for openSUSE</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1515931200">- Update to version 3.0.0:
  * This new release now relies on Python 3.
  * A session mechanism using sqlite3 allows you to stop the scan
    or/and attacks and resume them later.
  * The new behavior, when you stop Wapiti during the attack
    process (with Ctrl+C), is to let you choose between continuing,
    moving to the next attack-module, exiting with or without
    generating the report.
  * A total of 9 options can now help you to finely control the
    scanner by fixing the maximum allowed depth of crawling,
    skipping parameter names of your choice in URLs and forms,
    setting the maximum delay for scanning, choosing between 6
    modes of scan force, and more!
  * The SOCKS5 proxy support is also back in this release.
  * Improvements have been made to existing attack modules. For
    example by reducing false-positives for the blind sqli attack
    module.
  * Two new attack modules were added: buster (for
    directory/filename brute forcing) and shellshock (not really
    new but here it is).
  * Some options changed. The base URL must now be given through
    the -u option.
- New runtime dependencies:
  * python3-Mako
  * python3-PySocks
  * python3-lxml
  * python3-tld
  * python3-yaswfp
- Clean spec file with spec-cleaner.</changelog>
</package>
<package pkgid="7aed3aad97fb6cbc07b0954b72bbdce72c8031f5ab1dbb8844e4c24ca5459e318f4bc321c11bc52dcdf36a17da0529782b135b4d44545aedf1dc4c5ecdb6870c" name="wapiti-lang" arch="noarch">
  <version epoch="0" ver="3.0.0" rel="1.52"/>
  <changelog author="johann.luce@wanadoo.fr" date="1382702400">- first in 2.3.0 for openSUSE</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1515931200">- Update to version 3.0.0:
  * This new release now relies on Python 3.
  * A session mechanism using sqlite3 allows you to stop the scan
    or/and attacks and resume them later.
  * The new behavior, when you stop Wapiti during the attack
    process (with Ctrl+C), is to let you choose between continuing,
    moving to the next attack-module, exiting with or without
    generating the report.
  * A total of 9 options can now help you to finely control the
    scanner by fixing the maximum allowed depth of crawling,
    skipping parameter names of your choice in URLs and forms,
    setting the maximum delay for scanning, choosing between 6
    modes of scan force, and more!
  * The SOCKS5 proxy support is also back in this release.
  * Improvements have been made to existing attack modules. For
    example by reducing false-positives for the blind sqli attack
    module.
  * Two new attack modules were added: buster (for
    directory/filename brute forcing) and shellshock (not really
    new but here it is).
  * Some options changed. The base URL must now be given through
    the -u option.
- New runtime dependencies:
  * python3-Mako
  * python3-PySocks
  * python3-lxml
  * python3-tld
  * python3-yaswfp
- Clean spec file with spec-cleaner.</changelog>
</package>
<package pkgid="a44e0ed82e589a334c6805ff4fba3b5606e9cefe160596658a660a97cd7d4d5c0b4e849d6357d4f2364f0e9c404afdd0210f808682bf83f94ebfd09b8ae1bbc4" name="wardstone" arch="s390x">
  <version epoch="0" ver="0.2.0~0" rel="10.34"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1692532800">- Initial commit of wardstone
  * use an older C compiler standard
  * add cbindgen
  * create basic CI workflow
  * fix syntax errors and avoid running on push
  * remove nightly rustfmt config options
  * update cbindgen configuration
  * create issue templates
  * update build script
  * recommend alternatives for invalid primitives
  * add check for documentation
  * add FFI-compiling to CI
  * minor cosmetic changes to CI
  * add finite field cryptography primitives
  * add integer factorisation primitives
  * add elliptic-curve cryptography primitives
  * add the SHAKE extendable-output functions
  * update build script
  * add more crate types
  * complete NIST Special Publication 800-57 Part 1 Revision 5 module
  * factor in context security and update ranges in NIST module
  * add SHAKE XOFs
  * create BSI TR-02102-1 Cryptographic Mechanisms: Recommendations and Key Lengths module
  * create CNSA module
  * create ECRYPT module
  * complete Lenstra module
  * split the crate into two
  * implement interfaces custom standards
  * update example in wardstone_core README
  * create mock standards
  * allow use of NIST curves in the BSI guide
  * create wardstone command line program
  * add some polish around validating elliptic curve signed certificates in the command-line application
  * remove references
  * update documentation
  * decode primitives using their ASN1 encoding
  * add more OID to primitive mappings in the table
  * update OIDs
  * support RSA PSS keys
  * update documentation
  * commit Cargo lock file for OBS builds
  * note openssl-dev requirement
  * support auditing SSH keys
  * handle multiple files as input, and support optional JSON-format when reporting
  * update handling multiple files</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1698148800">- Update to 0.2.0
  * feat: enable user set context
    The caller can now set the context year that they want
    to assess a cryptographic primitive to be assessed against.
    This allows them to override the default option which is
    current based on the year 2023 with an average horizon of
    about 4 to 8 years.
  * refactor: update elliptic curve display strings
    Some primitives do not have a unique name which may
    make it difficult to someone unfamiliar with the
    distinctions to interpret the results of an audit. The
    output for these primitives now mentions all known names
    so that the user does not have to access a secondary
    source for this information.
  * refactor: update the name of the library
    Object libraries generated no longer have a _ffi prefix.</changelog>
  <changelog author="Dennis Knorr &lt;dennis.knorr@suse.com&gt;" date="1731067200">- updating github links
- updating cargo dependencies to fix the build</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1746705600">- Update dependencies to fix bsc#1242602</changelog>
</package>
<package pkgid="dcd4e4bda843e0e4fd9f0e07e0eb8ea0f772f13cbeb22f717e65aa61bc0135a35ddc0ab745c36f9194e4192239543d8d80787172991b8ed49207ffee6277e35d" name="wardstone" arch="src">
  <version epoch="0" ver="0.2.0~0" rel="10.34"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1692532800">- Initial commit of wardstone
  * use an older C compiler standard
  * add cbindgen
  * create basic CI workflow
  * fix syntax errors and avoid running on push
  * remove nightly rustfmt config options
  * update cbindgen configuration
  * create issue templates
  * update build script
  * recommend alternatives for invalid primitives
  * add check for documentation
  * add FFI-compiling to CI
  * minor cosmetic changes to CI
  * add finite field cryptography primitives
  * add integer factorisation primitives
  * add elliptic-curve cryptography primitives
  * add the SHAKE extendable-output functions
  * update build script
  * add more crate types
  * complete NIST Special Publication 800-57 Part 1 Revision 5 module
  * factor in context security and update ranges in NIST module
  * add SHAKE XOFs
  * create BSI TR-02102-1 Cryptographic Mechanisms: Recommendations and Key Lengths module
  * create CNSA module
  * create ECRYPT module
  * complete Lenstra module
  * split the crate into two
  * implement interfaces custom standards
  * update example in wardstone_core README
  * create mock standards
  * allow use of NIST curves in the BSI guide
  * create wardstone command line program
  * add some polish around validating elliptic curve signed certificates in the command-line application
  * remove references
  * update documentation
  * decode primitives using their ASN1 encoding
  * add more OID to primitive mappings in the table
  * update OIDs
  * support RSA PSS keys
  * update documentation
  * commit Cargo lock file for OBS builds
  * note openssl-dev requirement
  * support auditing SSH keys
  * handle multiple files as input, and support optional JSON-format when reporting
  * update handling multiple files</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1698148800">- Update to 0.2.0
  * feat: enable user set context
    The caller can now set the context year that they want
    to assess a cryptographic primitive to be assessed against.
    This allows them to override the default option which is
    current based on the year 2023 with an average horizon of
    about 4 to 8 years.
  * refactor: update elliptic curve display strings
    Some primitives do not have a unique name which may
    make it difficult to someone unfamiliar with the
    distinctions to interpret the results of an audit. The
    output for these primitives now mentions all known names
    so that the user does not have to access a secondary
    source for this information.
  * refactor: update the name of the library
    Object libraries generated no longer have a _ffi prefix.</changelog>
  <changelog author="Dennis Knorr &lt;dennis.knorr@suse.com&gt;" date="1731067200">- updating github links
- updating cargo dependencies to fix the build</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1746705600">- Update dependencies to fix bsc#1242602</changelog>
</package>
<package pkgid="67f5bfd24999a644e552185a2fae8b518ca7926e4c08638c430d449c20efb3bfabbf27cbe8ffe30d2546d8f8f84db7e08ab60f8d70b661dfac9d9bc7237b29ab" name="wardstone-debuginfo" arch="s390x">
  <version epoch="0" ver="0.2.0~0" rel="10.34"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1692532800">- Initial commit of wardstone
  * use an older C compiler standard
  * add cbindgen
  * create basic CI workflow
  * fix syntax errors and avoid running on push
  * remove nightly rustfmt config options
  * update cbindgen configuration
  * create issue templates
  * update build script
  * recommend alternatives for invalid primitives
  * add check for documentation
  * add FFI-compiling to CI
  * minor cosmetic changes to CI
  * add finite field cryptography primitives
  * add integer factorisation primitives
  * add elliptic-curve cryptography primitives
  * add the SHAKE extendable-output functions
  * update build script
  * add more crate types
  * complete NIST Special Publication 800-57 Part 1 Revision 5 module
  * factor in context security and update ranges in NIST module
  * add SHAKE XOFs
  * create BSI TR-02102-1 Cryptographic Mechanisms: Recommendations and Key Lengths module
  * create CNSA module
  * create ECRYPT module
  * complete Lenstra module
  * split the crate into two
  * implement interfaces custom standards
  * update example in wardstone_core README
  * create mock standards
  * allow use of NIST curves in the BSI guide
  * create wardstone command line program
  * add some polish around validating elliptic curve signed certificates in the command-line application
  * remove references
  * update documentation
  * decode primitives using their ASN1 encoding
  * add more OID to primitive mappings in the table
  * update OIDs
  * support RSA PSS keys
  * update documentation
  * commit Cargo lock file for OBS builds
  * note openssl-dev requirement
  * support auditing SSH keys
  * handle multiple files as input, and support optional JSON-format when reporting
  * update handling multiple files</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1698148800">- Update to 0.2.0
  * feat: enable user set context
    The caller can now set the context year that they want
    to assess a cryptographic primitive to be assessed against.
    This allows them to override the default option which is
    current based on the year 2023 with an average horizon of
    about 4 to 8 years.
  * refactor: update elliptic curve display strings
    Some primitives do not have a unique name which may
    make it difficult to someone unfamiliar with the
    distinctions to interpret the results of an audit. The
    output for these primitives now mentions all known names
    so that the user does not have to access a secondary
    source for this information.
  * refactor: update the name of the library
    Object libraries generated no longer have a _ffi prefix.</changelog>
  <changelog author="Dennis Knorr &lt;dennis.knorr@suse.com&gt;" date="1731067200">- updating github links
- updating cargo dependencies to fix the build</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1746705600">- Update dependencies to fix bsc#1242602</changelog>
</package>
<package pkgid="127fa59cd94fcd79e67d56323d1693c43fdbd129f844bd46ca9e0a465a67361f354e782b884b9215a8bca68032422049bc4e058afb1fc6ac84fc6fc700fd703d" name="wardstone-debugsource" arch="s390x">
  <version epoch="0" ver="0.2.0~0" rel="10.34"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1692532800">- Initial commit of wardstone
  * use an older C compiler standard
  * add cbindgen
  * create basic CI workflow
  * fix syntax errors and avoid running on push
  * remove nightly rustfmt config options
  * update cbindgen configuration
  * create issue templates
  * update build script
  * recommend alternatives for invalid primitives
  * add check for documentation
  * add FFI-compiling to CI
  * minor cosmetic changes to CI
  * add finite field cryptography primitives
  * add integer factorisation primitives
  * add elliptic-curve cryptography primitives
  * add the SHAKE extendable-output functions
  * update build script
  * add more crate types
  * complete NIST Special Publication 800-57 Part 1 Revision 5 module
  * factor in context security and update ranges in NIST module
  * add SHAKE XOFs
  * create BSI TR-02102-1 Cryptographic Mechanisms: Recommendations and Key Lengths module
  * create CNSA module
  * create ECRYPT module
  * complete Lenstra module
  * split the crate into two
  * implement interfaces custom standards
  * update example in wardstone_core README
  * create mock standards
  * allow use of NIST curves in the BSI guide
  * create wardstone command line program
  * add some polish around validating elliptic curve signed certificates in the command-line application
  * remove references
  * update documentation
  * decode primitives using their ASN1 encoding
  * add more OID to primitive mappings in the table
  * update OIDs
  * support RSA PSS keys
  * update documentation
  * commit Cargo lock file for OBS builds
  * note openssl-dev requirement
  * support auditing SSH keys
  * handle multiple files as input, and support optional JSON-format when reporting
  * update handling multiple files</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1698148800">- Update to 0.2.0
  * feat: enable user set context
    The caller can now set the context year that they want
    to assess a cryptographic primitive to be assessed against.
    This allows them to override the default option which is
    current based on the year 2023 with an average horizon of
    about 4 to 8 years.
  * refactor: update elliptic curve display strings
    Some primitives do not have a unique name which may
    make it difficult to someone unfamiliar with the
    distinctions to interpret the results of an audit. The
    output for these primitives now mentions all known names
    so that the user does not have to access a secondary
    source for this information.
  * refactor: update the name of the library
    Object libraries generated no longer have a _ffi prefix.</changelog>
  <changelog author="Dennis Knorr &lt;dennis.knorr@suse.com&gt;" date="1731067200">- updating github links
- updating cargo dependencies to fix the build</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1746705600">- Update dependencies to fix bsc#1242602</changelog>
</package>
<package pkgid="ef39e37a59f0640661f32de16ef5f8939d069be43f359a84f5ba3c6d7143bb119cce1ca40cca63a76b4d73dddeea2f4e7b41f3a9a9cf2a8d9d71a60ab74b11a2" name="wardstone-devel" arch="s390x">
  <version epoch="0" ver="0.2.0~0" rel="10.34"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1692532800">- Initial commit of wardstone
  * use an older C compiler standard
  * add cbindgen
  * create basic CI workflow
  * fix syntax errors and avoid running on push
  * remove nightly rustfmt config options
  * update cbindgen configuration
  * create issue templates
  * update build script
  * recommend alternatives for invalid primitives
  * add check for documentation
  * add FFI-compiling to CI
  * minor cosmetic changes to CI
  * add finite field cryptography primitives
  * add integer factorisation primitives
  * add elliptic-curve cryptography primitives
  * add the SHAKE extendable-output functions
  * update build script
  * add more crate types
  * complete NIST Special Publication 800-57 Part 1 Revision 5 module
  * factor in context security and update ranges in NIST module
  * add SHAKE XOFs
  * create BSI TR-02102-1 Cryptographic Mechanisms: Recommendations and Key Lengths module
  * create CNSA module
  * create ECRYPT module
  * complete Lenstra module
  * split the crate into two
  * implement interfaces custom standards
  * update example in wardstone_core README
  * create mock standards
  * allow use of NIST curves in the BSI guide
  * create wardstone command line program
  * add some polish around validating elliptic curve signed certificates in the command-line application
  * remove references
  * update documentation
  * decode primitives using their ASN1 encoding
  * add more OID to primitive mappings in the table
  * update OIDs
  * support RSA PSS keys
  * update documentation
  * commit Cargo lock file for OBS builds
  * note openssl-dev requirement
  * support auditing SSH keys
  * handle multiple files as input, and support optional JSON-format when reporting
  * update handling multiple files</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1698148800">- Update to 0.2.0
  * feat: enable user set context
    The caller can now set the context year that they want
    to assess a cryptographic primitive to be assessed against.
    This allows them to override the default option which is
    current based on the year 2023 with an average horizon of
    about 4 to 8 years.
  * refactor: update elliptic curve display strings
    Some primitives do not have a unique name which may
    make it difficult to someone unfamiliar with the
    distinctions to interpret the results of an audit. The
    output for these primitives now mentions all known names
    so that the user does not have to access a secondary
    source for this information.
  * refactor: update the name of the library
    Object libraries generated no longer have a _ffi prefix.</changelog>
  <changelog author="Dennis Knorr &lt;dennis.knorr@suse.com&gt;" date="1731067200">- updating github links
- updating cargo dependencies to fix the build</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1746705600">- Update dependencies to fix bsc#1242602</changelog>
</package>
<package pkgid="c69b50267228e99ac2c2e326f60f9888524884432aaae7077265bbad8d3ea3f4564471cfe9ed37957b872ed15c9668a85b4f68c9f85d2709cc0f6d2b338fb329" name="wardstone-devel-debuginfo" arch="s390x">
  <version epoch="0" ver="0.2.0~0" rel="10.34"/>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1692532800">- Initial commit of wardstone
  * use an older C compiler standard
  * add cbindgen
  * create basic CI workflow
  * fix syntax errors and avoid running on push
  * remove nightly rustfmt config options
  * update cbindgen configuration
  * create issue templates
  * update build script
  * recommend alternatives for invalid primitives
  * add check for documentation
  * add FFI-compiling to CI
  * minor cosmetic changes to CI
  * add finite field cryptography primitives
  * add integer factorisation primitives
  * add elliptic-curve cryptography primitives
  * add the SHAKE extendable-output functions
  * update build script
  * add more crate types
  * complete NIST Special Publication 800-57 Part 1 Revision 5 module
  * factor in context security and update ranges in NIST module
  * add SHAKE XOFs
  * create BSI TR-02102-1 Cryptographic Mechanisms: Recommendations and Key Lengths module
  * create CNSA module
  * create ECRYPT module
  * complete Lenstra module
  * split the crate into two
  * implement interfaces custom standards
  * update example in wardstone_core README
  * create mock standards
  * allow use of NIST curves in the BSI guide
  * create wardstone command line program
  * add some polish around validating elliptic curve signed certificates in the command-line application
  * remove references
  * update documentation
  * decode primitives using their ASN1 encoding
  * add more OID to primitive mappings in the table
  * update OIDs
  * support RSA PSS keys
  * update documentation
  * commit Cargo lock file for OBS builds
  * note openssl-dev requirement
  * support auditing SSH keys
  * handle multiple files as input, and support optional JSON-format when reporting
  * update handling multiple files</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1698148800">- Update to 0.2.0
  * feat: enable user set context
    The caller can now set the context year that they want
    to assess a cryptographic primitive to be assessed against.
    This allows them to override the default option which is
    current based on the year 2023 with an average horizon of
    about 4 to 8 years.
  * refactor: update elliptic curve display strings
    Some primitives do not have a unique name which may
    make it difficult to someone unfamiliar with the
    distinctions to interpret the results of an audit. The
    output for these primitives now mentions all known names
    so that the user does not have to access a secondary
    source for this information.
  * refactor: update the name of the library
    Object libraries generated no longer have a _ffi prefix.</changelog>
  <changelog author="Dennis Knorr &lt;dennis.knorr@suse.com&gt;" date="1731067200">- updating github links
- updating cargo dependencies to fix the build</changelog>
  <changelog author="Martin Sirringhaus &lt;martin.sirringhaus@suse.com&gt;" date="1746705600">- Update dependencies to fix bsc#1242602</changelog>
</package>
<package pkgid="6a3ea1267a7bb2851cbc5b366c90d88632d26d0049ceb3a557e7ab1e99177efc0c9771bf1aa6b107b49169bc2178fab5a79f57918c19ce965561effa06933ba3" name="wfuzz" arch="src">
  <version epoch="0" ver="3.1.0" rel="14.12"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1624449600">- First version of wfuzz package.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1624622400">- Removed shebang to fix rpmlint warning</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1639656000">- Fixed URL in spec file</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1675252800">- Fixed a problem preventing this package to build in Factory</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1751025600">- Use pyproject macros to build and install.
- List directories under sitelib explicitly.</changelog>
</package>
<package pkgid="f5bbd432a11d2255c1d9b8e7fe55161faf251c1f4564de4ec2d153c39452a047598ab7fb21412634c6f1fe75463c75379d8f17afb3032913857e6c27224516c0" name="whatweb" arch="noarch">
  <version epoch="0" ver="0.5.5" rel="4.17"/>
  <changelog author="pascal.bleser@opensuse.org" date="1274702400">- initial package (0.4.3)</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1282219200">- update to 0.4.5:
  * 135 new plugins were added
  * some plugins were updated
  * Ruby 1.9 compatibility fixes were made
  * new types of matches for plugins include MD5 hashes, patterns of HTML tags, URL tests, added URL prefixes, suffixes and patterns, added cmdline custom plugin definitions, added spider file extension stuff, and more
- changes from 0.4.4:
  * plugin writing was simplified
  * a bug with ruby 1.8.5 was fixed
  * author names were added to plugin information
  * 67 plugins were added from Brendan Coles, bringing WhatWeb up to 163 plugins
  * references were added to Security-Assessment.com</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1619611200">- update to 0.5.5:
  * Over 1800 plugins
  * now requires ruby &gt;= 2.7 to work
  * tool has dramatically changed, so you can refer to included README.md for
    a comprehensive list of changes and new features.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1620993600">- Relaxing the constraint for ruby version</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- use github url</changelog>
</package>
<package pkgid="8f71925d443103052c71e017e8a5581efdada45b8b7f8fcb8ddbbb8d5f46fcf1f738b2d27af65ff595b9fbdcf184bbddc145169c16b0b8689835aef1f9aaa843" name="whatweb" arch="src">
  <version epoch="0" ver="0.5.5" rel="4.17"/>
  <changelog author="pascal.bleser@opensuse.org" date="1274702400">- initial package (0.4.3)</changelog>
  <changelog author="pascal.bleser@opensuse.org" date="1282219200">- update to 0.4.5:
  * 135 new plugins were added
  * some plugins were updated
  * Ruby 1.9 compatibility fixes were made
  * new types of matches for plugins include MD5 hashes, patterns of HTML tags, URL tests, added URL prefixes, suffixes and patterns, added cmdline custom plugin definitions, added spider file extension stuff, and more
- changes from 0.4.4:
  * plugin writing was simplified
  * a bug with ruby 1.8.5 was fixed
  * author names were added to plugin information
  * 67 plugins were added from Brendan Coles, bringing WhatWeb up to 163 plugins
  * references were added to Security-Assessment.com</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1619611200">- update to 0.5.5:
  * Over 1800 plugins
  * now requires ruby &gt;= 2.7 to work
  * tool has dramatically changed, so you can refer to included README.md for
    a comprehensive list of changes and new features.</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1620993600">- Relaxing the constraint for ruby version</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1649764800">- use github url</changelog>
</package>
<package pkgid="607b815727b543e09bd51949f4e3a1c947857e705b863e7b6b57e728535e64656ab0d33d910814ef57bca958746cd9977cd3f33245030149334d582242016715" name="xca" arch="s390x">
  <version epoch="0" ver="2.9.0" rel="39.2"/>
  <changelog author="ro@suse.de" date="1676894400">- change buildrequires for openssl on factory to use openssl-1.1
  openSSL 3 is not supported in xca-2.4.0 yet</changelog>
  <changelog author="Jonathan Brielmaier &lt;jbrielmaier@opensuse.org&gt;" date="1697803200">- Update to version 2.5.0:
  * Multiple bug fixes
  * Add Bulgarian, Indonesian and Persian translation
  * Switch from autotools/qmake to cmake
  * Add support for Qt6 and OpenSSL 3.x
  * Drop support for Qt4
  * Drop support for old XCA &lt; 2.0.0 databases
  * Drop support for OpenSSL &lt; 1.1.0
- Switch to cmake build system
- Update URL
- VERSION file got renamed to VERSION.txt
- Improve Supplements syntax to conform with linter
- Set buildrequires again to openssl as openSSL 3 is now supported</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1700136000">- Fix build error in Leap.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.0
  * Export certificates for ovpn file
  * SHA1 based MAC for PKCS12
  * Support legacy keys
    and automatically transform them if possible.
  * Renew Certificate freeze XCA
  * paste an encrypted private key results in a crash
  * Fix crash when deleting CA certificates
  * add flatpak build information and github action
  * Subject Alternative Name not filled by all CN
  * Improve import: Finish multi import when empty
  * Add File extensions in Info.plist supported by XCA
  * Quick view of certificates without trying to open XCA
  * pass private key password
  * Export PEM + Key in one File
  * Impossible to import PKCS#12 (RC40_CBC)
  * Make XCA AppStore compliant with -DAPPSTORE_COMPLIANT=ON
- modified patches
  % xca-desktop.patch (refreshed)</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1712232000">- Fix build error in Leap.</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1725537600">- version update to 2.7.0
  * Database Schema changed and is not backwards-compatible. Backup your database.
  * Drivers for SQL Servers must be installed separately since 2.5.0
  * full changelog at https://hohnstaedt.de/xca-doc/html/changelog.html#xca-2-7-0-tue-aug-27-2024
- switched to QT6
- added fdupes to handle duplicate files during package build</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1728820800">- Update to version 2.8.0
  Most notable new features:
  * Support for SHA3.
  * Name the MS CryptographicServiceProvider in the comment.
  * OpenSSL PURPOSE and validation results in the certificate
    details.
  * Support UniveralPrincipalName (UPN) and NameConstraints.
  * Support JSON Web Key (JWK) export format.
  * Hide unusable (expired / revoked) certificates.
  Full changelog
  * https://hohnstaedt.de/xca-doc/html/changelog.html#xca-2-8-0-sun-oct-13-2024
- Drop patch:
  * xca-desktop.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1743163200">- Update to version 2.9.0
  This release fixes some minor issues:
  * Do not revoke renewed certificate with same serial.
  * Fix default template finding on linux.</changelog>
  <changelog author="Christophe Marin &lt;christophe@krop.fr&gt;" date="1748001600">- Update build and runtime dependencies
- Use the qt6 macros to build</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1783339200">- Fix build error for Tumbleweed.
  Qt6Concurrent is needed to build.</changelog>
</package>
<package pkgid="76781f727e35b96a01ee722b7ac8edc1a14fa622c03ea352b9039ed224ec09ba8e0cc2d34f3e2bc011ed9501aaa8a6bbb82fc2b4a2bc008b822a0ff2b5d42205" name="xca" arch="src">
  <version epoch="0" ver="2.9.0" rel="39.2"/>
  <changelog author="Christian Wittmer &lt;chris@computersalat.de&gt;" date="1540900800">- update to 1.4.1
  * Replace links to XCA on Sourceforge in the software and
  * documentation by links to my Site.
  * SF Bug #122 isValid() tried to convert the serial to 64 bit
  * Beautify mandatory distinguished name entry errors
  * Support dragging certificates and other items as PEM text
  * Show User settings and installation path in the about dialog
  * Remove SPKAC support. Netscape is not of this world anymore.
  * SF bug #124 Wrong assumptions about slots returned by PKCS11 library
  * Cleanup and improve the OID text files, remove senseless aia.txt
  * Update HTML documentation
  * Refine and document Entropy gathering
  * Indicate development and release version by git commit hash
  * Fix dumping private keys during "Dump database"
  * Fix Null pointer exception when importing PKCS#12 with OpenSSL 1.1.0
  * SF Bug #110 Exported private key from 4096 bit SSH key is wrong
  * SF Bug #109 Revoked.png isn't a valid image
  * SF Bug #121 CA serial number is ignored in hierarchical view
  * Improve speed of Bulk import.
  * Fix starting xca with a database as first arg
- xca 1.4.0
  * Update OpenSSL version for MacOSX and W32 to 1.1.0g
  * Change default hash to SHA-256 and
  * add a warning if the default hash algorithm is SHA1 or less
  * Switch to Qt5 for Windows build and installation
  * Do not apply the default template when creating a similar cert
  * Close SF #120 Crash when importing CA certificate
  * Close SF #116 db_x509.cpp:521: Mismatching allocation and deallocation
  * Add support for OpenSSL 1.1 (by Patrick Monnerat)
  * Support generating an OpenSSL "index.txt" (by Adam Dawidowski)
  * Thales nCipher key generation changes for EC and DSA keys
  * Add Slovak translation
- remove obsolete
  * xca-1.3.2-openssl11.patch
  * xca-doc_Makefile.patch
- add xca-configure.patch
  * fix sgml2html command
- cleanup spec, fix deps</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1540987200">- Fix grammar in %description -l de.
- Throw out old %__-type macro indirections and $RPM_ shell vars.</changelog>
  <changelog author="liedke@rz.uni-mannheim.de" date="1548158400">-Update to 2.1.2
  * Close #40 macOS: Crash after xca v2.0.1 quit
  * Close #37: XCA 2: EVP_DecryptFinal_ex:bad decrypt
  * Close #74: Exiting XCA 2.1.1 corrupts database
  * Make PKCS11 libs, working dir and main-window size host-dependent
  * Support for XCA as portable App
  * Close #69 Library not loaded: @rpath/ contains local directory
  * Close #60: Fix MacOSX 2.1.1 binary
  * Add new maintained languages: Polish, Spanish, Portuguese
-Update to 2.1.1
  * Allow manual override of the CSR signed flag
  * Close #56: Duplicate Serials after Upgrade 2.1.0
  * Close #57: SAN IP not working in 2.1.0
  * Close #55: Calculate "CSR signed" information from legacy database
  * Close #55: Add Certificate counter column for CSR
  * Fix slovak translation
  * Close #50: Hang while importing 1.4.1 database into 2.1.0
-Update to 2.1.0
  * Close #48: The SKI tickbox isn't generating an SKI extension for CSRs
  * Fix translation of dates
  * Add private key icon to the key name
  * Inspired by #42: display dates relative (seconds ago, yesterday, ...)
    while column ordering is still strict by age. The ToolTip shows date
    and time.
  * Related to #39: Dynamically adjust explicit DN entries
  * Close #39: Subject entries shuffled
  * Close #36: Support adding CN to X509v3 SAN automatically
  * Close #35: Configurable size of serial number.
  * Close #34: Improve Mac OSX installation
  * Close #27: Configurable certificate expiry warning threshold
  * Generate calender (.ics) files for certificate and CRL expiries
-Update to 2.0.1
  * Close #32: Version field contains "Created by Qt/QMake" on MacOSX
  * Review and update russian ltranslation
  * Close #31: Closing certificate details window toggles tree folding
  * Close #25: Certificates are no longer coloured
  * Close #24: Add LibreSSL support. Tested with LibreSSL 2.7.2
  * Close #23: Improve limiting to pattern in certificate tree view
  * Close #20: Unable to chose remote database type (dropdown empty)
  * Close #19: Replace 3DES encryption by AES-256 during key export
-Update to 2.0.0
  * Open database before starting a transaction
  * Fix default hash during startup
  * Fix Importing PKCS#12 and PKCS#7 files
  * Improve automatic setting of the certificate internal name
  * Don't use remote DB descriptor as local database filename proposal
  * Usability: Preset remote database input values with previous ones
  * Add another missing windows postgres library
  * xca 2.0.0-pre04 Thu Mar 22 2018
  * Accept drivers that don't support transactions
  * Install MySQL and PostgreSQL drivers on windows
  * Closes #10: Warn if certificate without any extension is created
  * Add table prefix to be prepended to each table for remote SQL DB
  * Update translations
  * xca 2.0.0-pre03 Thu Mar 15 2018
  * Fix installation of sql plugins in the Windows installer
  * Fix opening, importing and dropping databases
  * xca 2.0.0-pre02 Tue Mar 13 2018
  * Fix crash during PKCS#12 export
  * Update HTTPS_server template and add example SAN
  * Acceppt empty password for private key decryption
  * Fix legacy database-without-password import
  * xca 2.0.0-pre01 Sun Mar 11 2018
  * Close GitHub Bug #5: Exporting a private key results in too-permissive
    permissions
  * Close GitHub Bug #4: Workaround QT bug of editing in QDateTimeEdit
  * Fix display of dates in the Certificate details (local time displayed a GMT)
  * The internal name is not neccessarily unique anymore and can be edited
    in the details dialog as well as the comment.
  * CSR signing is now statically stored in the database and the comment of the
    issued certificate.
  * Private keys in the database are PKCS#8 encrypted and can be exported and
    decrypted without XCA.
  * No more incrementing serials. Only unique random serial numbers.
  * "xca_db_stat" application removed. Use the SQLite3 browser "sqlitebrowser".
  * "xca extract" functionality removed. SQL views may be used instead.
  * Each item may be commented. XCA itself comments important events in the item.
  * Each item knows its time and origin of appearance.
  * Change database format to SQL(ite) and support MySQL and PostgreSQL.</changelog>
  <changelog author="Ismail D&#xF6;nmez &lt;idonmez@suse.com&gt;" date="1549281600">- Cleanup spec file
- Use Qt5
- Refresh patches</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1579521600">- Run spec-cleaner</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1580299200">- Update to version 2.2.0
  * Most notable improvements:
    + Support concurrent database access
    + Support ODBC database driver
  A detailled changelog can be found here:
  http://hohnstaedt.de/xca/index.php/software/changelog</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1580385600">- Update to version 2.2.1
  * This is a patch release, fixing Issue #159: "Opening existing
    database" which prevented the current version opening databases
    of XCA 2.1.2</changelog>
  <changelog author="chris@computersalat.de" date="1595764800">- xca 2.3.0 Wed Apr 29 2020
  * Close #191 OID LN differs warning popups at startup
  * Close #189 Database compaction #189
  * Improve PKCS11 library loading for portable app
  * Refactor native separators / and \ on windows.
  * Support TLS encrypted MariaDB and PostgreSQL connection
  * Close #182: UI not using Windows native theme in 2.2.1 portable
  * Close #70: cant open ics file in ical on macos mojave
  * Close #72: Add checkbox for OCSP staple feature
  * Use DESTDIR instead of destdir when installing. Follows autotools convention.
  * Close #172 #46: Multiple OCSP Responders
  * Close #170 xca-portable-2.2.1 cannot change language
  * Fix certificate assignment when importing a CA certificate
  * Close #163: Show key type/size on column of Certificates tab
- rebase patches</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1620907200">- Update to version 2.4.0
  * Unify XCA icon (certificate) on all platforms
  * Add Microsoft BitLocker extended key usage
  * Disregard OpenSSL 0.9.8 compatibility
  * Add bash completion script
  * Add context sensitive help
  * Convert documentation from linuxdoc/SGML to sphinxdoc
  * Close #258: xca aborts on exit and on access to own templates
  * Close #142: Support Ed25519 Import / Export private SSH2 key
  * Close #142: Support Ed25519: Key-generation, import, export
  * Close #251: AuthorityKeyIdentifier: use issuer:always
  * Change language maintainer of brazilian portuguese
  * Close #230: Change PKCS12 export extension from .p12 to .pfx
  * Close #208: XCA hung when importing EC keys. For example prime256v1
  * Close #210: Make dialog to edit SAN less strict
  * Close #224: Store original path/filename on import
  * Close #213: configure.ac: add description to AC_DEFINE_UNQUOTED
  * Close #172 #46: Multiple OCSP Responders
  * Store default database and recently opened file as UTF8
  * Close #157 Generate and export CRLs from commandline
  * Add command line support for creating CRLs, keys and analyzing items
- Drop patch:
  * xca-configure.patch (not longer needed)</changelog>
  <changelog author="ro@suse.de" date="1676894400">- change buildrequires for openssl on factory to use openssl-1.1
  openSSL 3 is not supported in xca-2.4.0 yet</changelog>
  <changelog author="Jonathan Brielmaier &lt;jbrielmaier@opensuse.org&gt;" date="1697803200">- Update to version 2.5.0:
  * Multiple bug fixes
  * Add Bulgarian, Indonesian and Persian translation
  * Switch from autotools/qmake to cmake
  * Add support for Qt6 and OpenSSL 3.x
  * Drop support for Qt4
  * Drop support for old XCA &lt; 2.0.0 databases
  * Drop support for OpenSSL &lt; 1.1.0
- Switch to cmake build system
- Update URL
- VERSION file got renamed to VERSION.txt
- Improve Supplements syntax to conform with linter
- Set buildrequires again to openssl as openSSL 3 is now supported</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1700136000">- Fix build error in Leap.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.0
  * Export certificates for ovpn file
  * SHA1 based MAC for PKCS12
  * Support legacy keys
    and automatically transform them if possible.
  * Renew Certificate freeze XCA
  * paste an encrypted private key results in a crash
  * Fix crash when deleting CA certificates
  * add flatpak build information and github action
  * Subject Alternative Name not filled by all CN
  * Improve import: Finish multi import when empty
  * Add File extensions in Info.plist supported by XCA
  * Quick view of certificates without trying to open XCA
  * pass private key password
  * Export PEM + Key in one File
  * Impossible to import PKCS#12 (RC40_CBC)
  * Make XCA AppStore compliant with -DAPPSTORE_COMPLIANT=ON
- modified patches
  % xca-desktop.patch (refreshed)</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1712232000">- Fix build error in Leap.</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1725537600">- version update to 2.7.0
  * Database Schema changed and is not backwards-compatible. Backup your database.
  * Drivers for SQL Servers must be installed separately since 2.5.0
  * full changelog at https://hohnstaedt.de/xca-doc/html/changelog.html#xca-2-7-0-tue-aug-27-2024
- switched to QT6
- added fdupes to handle duplicate files during package build</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1728820800">- Update to version 2.8.0
  Most notable new features:
  * Support for SHA3.
  * Name the MS CryptographicServiceProvider in the comment.
  * OpenSSL PURPOSE and validation results in the certificate
    details.
  * Support UniveralPrincipalName (UPN) and NameConstraints.
  * Support JSON Web Key (JWK) export format.
  * Hide unusable (expired / revoked) certificates.
  Full changelog
  * https://hohnstaedt.de/xca-doc/html/changelog.html#xca-2-8-0-sun-oct-13-2024
- Drop patch:
  * xca-desktop.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1743163200">- Update to version 2.9.0
  This release fixes some minor issues:
  * Do not revoke renewed certificate with same serial.
  * Fix default template finding on linux.</changelog>
  <changelog author="Christophe Marin &lt;christophe@krop.fr&gt;" date="1748001600">- Update build and runtime dependencies
- Use the qt6 macros to build</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1783339200">- Fix build error for Tumbleweed.
  Qt6Concurrent is needed to build.</changelog>
</package>
<package pkgid="aa115bd7153927d278e36880ee03a304a0e8ba45d0e222d7eda801d429959385a286e53bbd8018b2854d5f60f0edcb8470476e70328fed36c5f21299fe89f6a5" name="xca-bash-completion" arch="noarch">
  <version epoch="0" ver="2.9.0" rel="39.2"/>
  <changelog author="ro@suse.de" date="1676894400">- change buildrequires for openssl on factory to use openssl-1.1
  openSSL 3 is not supported in xca-2.4.0 yet</changelog>
  <changelog author="Jonathan Brielmaier &lt;jbrielmaier@opensuse.org&gt;" date="1697803200">- Update to version 2.5.0:
  * Multiple bug fixes
  * Add Bulgarian, Indonesian and Persian translation
  * Switch from autotools/qmake to cmake
  * Add support for Qt6 and OpenSSL 3.x
  * Drop support for Qt4
  * Drop support for old XCA &lt; 2.0.0 databases
  * Drop support for OpenSSL &lt; 1.1.0
- Switch to cmake build system
- Update URL
- VERSION file got renamed to VERSION.txt
- Improve Supplements syntax to conform with linter
- Set buildrequires again to openssl as openSSL 3 is now supported</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1700136000">- Fix build error in Leap.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.0
  * Export certificates for ovpn file
  * SHA1 based MAC for PKCS12
  * Support legacy keys
    and automatically transform them if possible.
  * Renew Certificate freeze XCA
  * paste an encrypted private key results in a crash
  * Fix crash when deleting CA certificates
  * add flatpak build information and github action
  * Subject Alternative Name not filled by all CN
  * Improve import: Finish multi import when empty
  * Add File extensions in Info.plist supported by XCA
  * Quick view of certificates without trying to open XCA
  * pass private key password
  * Export PEM + Key in one File
  * Impossible to import PKCS#12 (RC40_CBC)
  * Make XCA AppStore compliant with -DAPPSTORE_COMPLIANT=ON
- modified patches
  % xca-desktop.patch (refreshed)</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1712232000">- Fix build error in Leap.</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1725537600">- version update to 2.7.0
  * Database Schema changed and is not backwards-compatible. Backup your database.
  * Drivers for SQL Servers must be installed separately since 2.5.0
  * full changelog at https://hohnstaedt.de/xca-doc/html/changelog.html#xca-2-7-0-tue-aug-27-2024
- switched to QT6
- added fdupes to handle duplicate files during package build</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1728820800">- Update to version 2.8.0
  Most notable new features:
  * Support for SHA3.
  * Name the MS CryptographicServiceProvider in the comment.
  * OpenSSL PURPOSE and validation results in the certificate
    details.
  * Support UniveralPrincipalName (UPN) and NameConstraints.
  * Support JSON Web Key (JWK) export format.
  * Hide unusable (expired / revoked) certificates.
  Full changelog
  * https://hohnstaedt.de/xca-doc/html/changelog.html#xca-2-8-0-sun-oct-13-2024
- Drop patch:
  * xca-desktop.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1743163200">- Update to version 2.9.0
  This release fixes some minor issues:
  * Do not revoke renewed certificate with same serial.
  * Fix default template finding on linux.</changelog>
  <changelog author="Christophe Marin &lt;christophe@krop.fr&gt;" date="1748001600">- Update build and runtime dependencies
- Use the qt6 macros to build</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1783339200">- Fix build error for Tumbleweed.
  Qt6Concurrent is needed to build.</changelog>
</package>
<package pkgid="aa0945102b92caaf5d2f5de5141d7bd6222124e0a220d6c3449f317c84ae179936aaf89bfaf3ad31e28153b680504432581832f6cc3effbd9ad55688a1f81c30" name="xca-debuginfo" arch="s390x">
  <version epoch="0" ver="2.9.0" rel="39.2"/>
  <changelog author="ro@suse.de" date="1676894400">- change buildrequires for openssl on factory to use openssl-1.1
  openSSL 3 is not supported in xca-2.4.0 yet</changelog>
  <changelog author="Jonathan Brielmaier &lt;jbrielmaier@opensuse.org&gt;" date="1697803200">- Update to version 2.5.0:
  * Multiple bug fixes
  * Add Bulgarian, Indonesian and Persian translation
  * Switch from autotools/qmake to cmake
  * Add support for Qt6 and OpenSSL 3.x
  * Drop support for Qt4
  * Drop support for old XCA &lt; 2.0.0 databases
  * Drop support for OpenSSL &lt; 1.1.0
- Switch to cmake build system
- Update URL
- VERSION file got renamed to VERSION.txt
- Improve Supplements syntax to conform with linter
- Set buildrequires again to openssl as openSSL 3 is now supported</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1700136000">- Fix build error in Leap.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.0
  * Export certificates for ovpn file
  * SHA1 based MAC for PKCS12
  * Support legacy keys
    and automatically transform them if possible.
  * Renew Certificate freeze XCA
  * paste an encrypted private key results in a crash
  * Fix crash when deleting CA certificates
  * add flatpak build information and github action
  * Subject Alternative Name not filled by all CN
  * Improve import: Finish multi import when empty
  * Add File extensions in Info.plist supported by XCA
  * Quick view of certificates without trying to open XCA
  * pass private key password
  * Export PEM + Key in one File
  * Impossible to import PKCS#12 (RC40_CBC)
  * Make XCA AppStore compliant with -DAPPSTORE_COMPLIANT=ON
- modified patches
  % xca-desktop.patch (refreshed)</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1712232000">- Fix build error in Leap.</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1725537600">- version update to 2.7.0
  * Database Schema changed and is not backwards-compatible. Backup your database.
  * Drivers for SQL Servers must be installed separately since 2.5.0
  * full changelog at https://hohnstaedt.de/xca-doc/html/changelog.html#xca-2-7-0-tue-aug-27-2024
- switched to QT6
- added fdupes to handle duplicate files during package build</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1728820800">- Update to version 2.8.0
  Most notable new features:
  * Support for SHA3.
  * Name the MS CryptographicServiceProvider in the comment.
  * OpenSSL PURPOSE and validation results in the certificate
    details.
  * Support UniveralPrincipalName (UPN) and NameConstraints.
  * Support JSON Web Key (JWK) export format.
  * Hide unusable (expired / revoked) certificates.
  Full changelog
  * https://hohnstaedt.de/xca-doc/html/changelog.html#xca-2-8-0-sun-oct-13-2024
- Drop patch:
  * xca-desktop.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1743163200">- Update to version 2.9.0
  This release fixes some minor issues:
  * Do not revoke renewed certificate with same serial.
  * Fix default template finding on linux.</changelog>
  <changelog author="Christophe Marin &lt;christophe@krop.fr&gt;" date="1748001600">- Update build and runtime dependencies
- Use the qt6 macros to build</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1783339200">- Fix build error for Tumbleweed.
  Qt6Concurrent is needed to build.</changelog>
</package>
<package pkgid="fae99a38eb65fa4f1ffe003451a005dbf0a8431bdaabdd28a4174272dcf5f17def0acfea8dcac08ab7d7dee094e291e414d4c7dcfd12be5bef0385cc175c1e73" name="xca-debugsource" arch="s390x">
  <version epoch="0" ver="2.9.0" rel="39.2"/>
  <changelog author="ro@suse.de" date="1676894400">- change buildrequires for openssl on factory to use openssl-1.1
  openSSL 3 is not supported in xca-2.4.0 yet</changelog>
  <changelog author="Jonathan Brielmaier &lt;jbrielmaier@opensuse.org&gt;" date="1697803200">- Update to version 2.5.0:
  * Multiple bug fixes
  * Add Bulgarian, Indonesian and Persian translation
  * Switch from autotools/qmake to cmake
  * Add support for Qt6 and OpenSSL 3.x
  * Drop support for Qt4
  * Drop support for old XCA &lt; 2.0.0 databases
  * Drop support for OpenSSL &lt; 1.1.0
- Switch to cmake build system
- Update URL
- VERSION file got renamed to VERSION.txt
- Improve Supplements syntax to conform with linter
- Set buildrequires again to openssl as openSSL 3 is now supported</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1700136000">- Fix build error in Leap.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 2.6.0
  * Export certificates for ovpn file
  * SHA1 based MAC for PKCS12
  * Support legacy keys
    and automatically transform them if possible.
  * Renew Certificate freeze XCA
  * paste an encrypted private key results in a crash
  * Fix crash when deleting CA certificates
  * add flatpak build information and github action
  * Subject Alternative Name not filled by all CN
  * Improve import: Finish multi import when empty
  * Add File extensions in Info.plist supported by XCA
  * Quick view of certificates without trying to open XCA
  * pass private key password
  * Export PEM + Key in one File
  * Impossible to import PKCS#12 (RC40_CBC)
  * Make XCA AppStore compliant with -DAPPSTORE_COMPLIANT=ON
- modified patches
  % xca-desktop.patch (refreshed)</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1712232000">- Fix build error in Leap.</changelog>
  <changelog author="Andrea Manzini &lt;andrea.manzini@suse.com&gt;" date="1725537600">- version update to 2.7.0
  * Database Schema changed and is not backwards-compatible. Backup your database.
  * Drivers for SQL Servers must be installed separately since 2.5.0
  * full changelog at https://hohnstaedt.de/xca-doc/html/changelog.html#xca-2-7-0-tue-aug-27-2024
- switched to QT6
- added fdupes to handle duplicate files during package build</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1728820800">- Update to version 2.8.0
  Most notable new features:
  * Support for SHA3.
  * Name the MS CryptographicServiceProvider in the comment.
  * OpenSSL PURPOSE and validation results in the certificate
    details.
  * Support UniveralPrincipalName (UPN) and NameConstraints.
  * Support JSON Web Key (JWK) export format.
  * Hide unusable (expired / revoked) certificates.
  Full changelog
  * https://hohnstaedt.de/xca-doc/html/changelog.html#xca-2-8-0-sun-oct-13-2024
- Drop patch:
  * xca-desktop.patch</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1743163200">- Update to version 2.9.0
  This release fixes some minor issues:
  * Do not revoke renewed certificate with same serial.
  * Fix default template finding on linux.</changelog>
  <changelog author="Christophe Marin &lt;christophe@krop.fr&gt;" date="1748001600">- Update build and runtime dependencies
- Use the qt6 macros to build</changelog>
  <changelog author="Stanislav Brabec &lt;sbrabec@suse.com&gt;" date="1763812800">- Remove unused BuildRequires: update-desktop-files.</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1783339200">- Fix build error for Tumbleweed.
  Qt6Concurrent is needed to build.</changelog>
</package>
<package pkgid="94131e2f2e996e1c70e729751d094727813e664a9634677c9bf697315c87ab0beade367fc279f695908f7e4ec7f708a75dd175eb57883067c0b78767b7e205b2" name="xxteac" arch="s390x">
  <version epoch="0" ver="0.93" rel="4.68"/>
  <changelog author="Niko kiiskinen &lt;nkiiskin@yahoo.com&gt;" date="1401019200">- initial package created (Version 0.93)</changelog>
  <changelog author="Niko kiiskinen &lt;nkiiskin@yahoo.com&gt;" date="1401105600">- fixed a bug which caused a segfault when reading big keys</changelog>
</package>
<package pkgid="d31996836c107461a8e6c872487adc6d4c36a6a308ae5cc758cb3588970a6ef925d46fbbaaf86b161706ff9e50dbd3457d17c9a703096e7b0d740ae473baf437" name="xxteac" arch="src">
  <version epoch="0" ver="0.93" rel="4.68"/>
  <changelog author="Niko kiiskinen &lt;nkiiskin@yahoo.com&gt;" date="1401019200">- initial package created (Version 0.93)</changelog>
  <changelog author="Niko kiiskinen &lt;nkiiskin@yahoo.com&gt;" date="1401105600">- fixed a bug which caused a segfault when reading big keys</changelog>
</package>
<package pkgid="f0c6ebbb74a95f96fc6e04d6c843498dc1186203a6df0acae4d3937511769dc3300f4b0e28181f62d82a8ff146d06ca783bdc807e7f645ba84574eafae0e52f4" name="ykclient" arch="s390x">
  <version epoch="0" ver="2.15" rel="9.52"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial version</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1299153600">- Version 2.4</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1419336000">- update to v2.13
  * Required by current pam_yubico
- update license to BSD-2-Clause
- remove _service file
- add explicit tarball
- update Url and Source fields to valid URLs
- add BuildRequires for pkgconfig and help2man
- add man page to %files section
- add files to devel package
  * ykclient_errors.h
  * ykclient_server_response.h
  * ykclient_version.h</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 2.14 (released 2015-03-05)
  - Switch default templates to https.
  - Fixup call to curl_easy_escape() to use a easy handle.</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- change the group for the -devel project as requested.</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: remove redundant %clean section, remove implicit
  - -with-pic (only relevant for static libs).</changelog>
  <changelog author="t.gruner@katodev.de" date="1447329600">- Version 2.15 (released 2015-11-12)
  - Add ykclient_get_server_response() to the library.
  - Show more information from the commandline on debug.
  - Add proxy support via Curl.</changelog>
  <changelog author="t.gruner@katodev.de" date="1463486400">- Add .sig file to ykclient.spec</changelog>
</package>
<package pkgid="27c6ed36305193fcb306d2de45a99ea4b0438a16a9f98ddd002130a882e1baa32a1fe771c3886bf7a06606182ac9cfa986022400ade2ee731a9c2fe8ac51c4b4" name="ykclient" arch="src">
  <version epoch="0" ver="2.15" rel="9.52"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial version</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1299153600">- Version 2.4</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1419336000">- update to v2.13
  * Required by current pam_yubico
- update license to BSD-2-Clause
- remove _service file
- add explicit tarball
- update Url and Source fields to valid URLs
- add BuildRequires for pkgconfig and help2man
- add man page to %files section
- add files to devel package
  * ykclient_errors.h
  * ykclient_server_response.h
  * ykclient_version.h</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 2.14 (released 2015-03-05)
  - Switch default templates to https.
  - Fixup call to curl_easy_escape() to use a easy handle.</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- change the group for the -devel project as requested.</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: remove redundant %clean section, remove implicit
  - -with-pic (only relevant for static libs).</changelog>
  <changelog author="t.gruner@katodev.de" date="1447329600">- Version 2.15 (released 2015-11-12)
  - Add ykclient_get_server_response() to the library.
  - Show more information from the commandline on debug.
  - Add proxy support via Curl.</changelog>
  <changelog author="t.gruner@katodev.de" date="1463486400">- Add .sig file to ykclient.spec</changelog>
</package>
<package pkgid="a46f679049c9eab8cae8ae3b3e8deccd0c7167ca2c4f0bd1dcb67b015a999d482a1c99856159798d5b77f99c8f37a96e69a4ae12a2d12d2bbedfc12324d58434" name="ykclient-debuginfo" arch="s390x">
  <version epoch="0" ver="2.15" rel="9.52"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial version</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1299153600">- Version 2.4</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1419336000">- update to v2.13
  * Required by current pam_yubico
- update license to BSD-2-Clause
- remove _service file
- add explicit tarball
- update Url and Source fields to valid URLs
- add BuildRequires for pkgconfig and help2man
- add man page to %files section
- add files to devel package
  * ykclient_errors.h
  * ykclient_server_response.h
  * ykclient_version.h</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 2.14 (released 2015-03-05)
  - Switch default templates to https.
  - Fixup call to curl_easy_escape() to use a easy handle.</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- change the group for the -devel project as requested.</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: remove redundant %clean section, remove implicit
  - -with-pic (only relevant for static libs).</changelog>
  <changelog author="t.gruner@katodev.de" date="1447329600">- Version 2.15 (released 2015-11-12)
  - Add ykclient_get_server_response() to the library.
  - Show more information from the commandline on debug.
  - Add proxy support via Curl.</changelog>
  <changelog author="t.gruner@katodev.de" date="1463486400">- Add .sig file to ykclient.spec</changelog>
</package>
<package pkgid="5666d0953ba9a9c81526fa513091e7248aa1d197a161edfed45ae3536f0b5cf868cf7c71a241a6326ca1b99a05d26297c600508f25fc3b701f05b6457e7e07da" name="ykclient-debugsource" arch="s390x">
  <version epoch="0" ver="2.15" rel="9.52"/>
  <changelog author="cristian.rodriguez@opensuse.org" date="1296216000">- Initial version</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1299153600">- Version 2.4</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1419336000">- update to v2.13
  * Required by current pam_yubico
- update license to BSD-2-Clause
- remove _service file
- add explicit tarball
- update Url and Source fields to valid URLs
- add BuildRequires for pkgconfig and help2man
- add man page to %files section
- add files to devel package
  * ykclient_errors.h
  * ykclient_server_response.h
  * ykclient_version.h</changelog>
  <changelog author="t.gruner@katodev.de" date="1425556800">- Version 2.14 (released 2015-03-05)
  - Switch default templates to https.
  - Fixup call to curl_easy_escape() to use a easy handle.</changelog>
  <changelog author="meissner@suse.com" date="1427889600">- change the group for the -devel project as requested.</changelog>
  <changelog author="jengelh@inai.de" date="1429099200">- Cleanup: remove redundant %clean section, remove implicit
  - -with-pic (only relevant for static libs).</changelog>
  <changelog author="t.gruner@katodev.de" date="1447329600">- Version 2.15 (released 2015-11-12)
  - Add ykclient_get_server_response() to the library.
  - Show more information from the commandline on debug.
  - Add proxy support via Curl.</changelog>
  <changelog author="t.gruner@katodev.de" date="1463486400">- Add .sig file to ykclient.spec</changelog>
</package>
<package pkgid="8abce0eaee510d5d89d3bbb2a8a30fd552baf48830e685057f0f04e89dd0fef92e3a8536b790d5e5cf6414e3aa96a42e744b41c048816498c5876befc9285097" name="ykpers" arch="s390x">
  <version epoch="0" ver="1.20.0" rel="32.58"/>
  <changelog author="meissner@suse.com" date="1492603200">- updated to 1.18.0 (released 2017-01-27)
  - Let ykchalresp read challenge from a file.
  - Add support of working with a numbered key when many connected Thanks to Thomas Habets &lt;habets@google.com&gt;
  - Documentation clarifications.
  - Fixup argument parsing of flags with optional arguments on BSD platforms.
  - Fix a file descriptor leak on windows.</changelog>
  <changelog author="wr@rosenauer.org" date="1523188800">- updated to 1.18.1 (released 2018-01-16)
  - Support reading accesscode and private ID from stdin.
  - Parse optional arguments correctly.
  - Documentation fixes.
  - Fix for ykinfo modhex serial output when it ends with c.
  - Treat all firmware versions as supported.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1538049600">- Version 1.19.0 (released 2018-04-24)
  - Add yk_write_device_info().
  - Add ykpersonalize cli switch -D for device info.
  - Add code for handling personalization interface of major version 5.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1538136000">- Fix RPM groups.
- Use noun phrase in summary.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550577600">- Version 1.19.1 (released 2019-02-19)
  - Error out on json output with randomSeed.
  - Validate more length fields.
  - Use correct FormatMessage function on windows.
  - Overflow, bounds and error condition checks.
  - Try to zero sensitive memory better.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550577601">- Version 1.19.2 (released 2019-02-19)
  - Fix test on mac.
  - Fix serial read and challenge response.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550836800">- Version 1.19.3 (released 2019-02-22)
  - Fix capability read.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1563105600">- Version 1.20.0 (released 2019-07-03d)
  - Add yk_open_key_vid_pid() allowing vid and pid to be specified.
  - Documentation fixes.
  - Clear potentially sensitive material from buffers.
  - Fix potential buffer overwrite.
- Applied spec-cleaner</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1591617600">- Fix build with gcc 10 [gh#Yubico/yubikey-personalization#155]
- Fix boolean value with json-c 0.14 [gh#Yubico/yubikey-personalization#159]
  adds ykpers-json.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1623067200">- Drop --with-pic (no effect with --disable-static)</changelog>
</package>
<package pkgid="3a5ee7f52eb9be108b2657eeacbf9a9b39f0f498e019b4cf75946a4a2df2b86a4f1bdab376726d77b8b478acc63eab06120c960264b3afa4841f6ce584c45f89" name="ykpers" arch="src">
  <version epoch="0" ver="1.20.0" rel="32.58"/>
  <changelog author="mmarek@suse.cz" date="1412337600">- Update to version 1.16.0
  - lots bug and warning fixes
  - support for firmware version 2.3
  - new command ykinfo to show information about YubiKey
  - ykpersonalize -z to zap configuration on YubiKey
  - ykpersonalize -d for dry-run
  - let no -a given mean generate a random key
  - let -a without option mean ask for raw key on STDIN</changelog>
  <changelog author="t.gruner@katodev.de" date="1415188800">- Patch: Add group "user" to udev-rule
- Use libusb-1.0
- Version 1.16.1 (released 2014-10-30)
  - Fix udev rules so they contain four digits.
  - Only try to detach the kernel driver if it's attached.
    For libusb-1.0
  - Let import config report errors properly.</changelog>
  <changelog author="t.gruner@katodev.de" date="1418126400">- Version 1.16.2 (released 2014-11-28)
  - ykinfo: fix modhex printout when serial is an odd number of hex digits.
  - whitelist yubikey version 4.0.x
  - try to open more PIDs and add for udev.</changelog>
  <changelog author="Greg.Freemyer@gmail.com" date="1419336000">- merge subproject -doc into main package.  It was not big enough to justify.
- use pkgconfig(json-c) &gt;= 0.10 instead of BuildRequires: libjson-devel &gt;= 0.10</changelog>
  <changelog author="t.gruner@katodev.de" date="1426507200">- Version 1.16.3 (released 2015-03-10)
  - whitelist YubiKey version 3.4.x
  - only try to set libusb configuration if it’s unset on the device</changelog>
  <changelog author="t.gruner@katodev.de" date="1427371200">- Version 1.16.4 (released 2015-03-23)
  - change the tool to accept autoeject time as a short instead of a byte</changelog>
  <changelog author="t.gruner@katodev.de" date="1427889600">- Version 1.17.1 (released 2015-04-01)
  - Fixup of 1.17.0
- Version 1.17.0 (released 2015-04-01)
  - add yk_get_capabilities() to fetch capabilities.
  - add -c to ykinfo to fetch capabilities.
  - whitelist firmware 4.1.x</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430827200">- Remove all duplicated/unnecesary buildRequires
- Use %{_udevrulesdir}
- Enable verbose build
- Run udev_rules_update if defined in %post.
- Update to version 1.17.1
  * add yk_get_capabilities() to fetch capabilities.
  * add -c to ykinfo to fetch capabilities.
  * whitelist firmware 4.1.x
- fixed urls
- .sig and ykpers.keyring added</changelog>
  <changelog author="t.gruner@katodev.de" date="1443528000">- Version 1.17.2 (released 2015-09-22)
  - Let _yk_write() return an error if yk_wait_for_key_status() fails.
  - Fix a mistake in help, fixed is up to 16 bytes, 32 characters.
  - Add 4.2 as supported firmware.</changelog>
  <changelog author="t.gruner@katodev.de" date="1452168000">- Version 1.17.3 (released 2015-12-28)
  - Dont read to much if we don’t find a key.
  - Text updates to make options clearer.
  - Correct logic for question when mode switching to non-otp mode.
  - Add 4.3 as supported firmware.</changelog>
  <changelog author="meissner@suse.com" date="1492603200">- updated to 1.18.0 (released 2017-01-27)
  - Let ykchalresp read challenge from a file.
  - Add support of working with a numbered key when many connected Thanks to Thomas Habets &lt;habets@google.com&gt;
  - Documentation clarifications.
  - Fixup argument parsing of flags with optional arguments on BSD platforms.
  - Fix a file descriptor leak on windows.</changelog>
  <changelog author="wr@rosenauer.org" date="1523188800">- updated to 1.18.1 (released 2018-01-16)
  - Support reading accesscode and private ID from stdin.
  - Parse optional arguments correctly.
  - Documentation fixes.
  - Fix for ykinfo modhex serial output when it ends with c.
  - Treat all firmware versions as supported.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1538049600">- Version 1.19.0 (released 2018-04-24)
  - Add yk_write_device_info().
  - Add ykpersonalize cli switch -D for device info.
  - Add code for handling personalization interface of major version 5.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1538136000">- Fix RPM groups.
- Use noun phrase in summary.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550577600">- Version 1.19.1 (released 2019-02-19)
  - Error out on json output with randomSeed.
  - Validate more length fields.
  - Use correct FormatMessage function on windows.
  - Overflow, bounds and error condition checks.
  - Try to zero sensitive memory better.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550577601">- Version 1.19.2 (released 2019-02-19)
  - Fix test on mac.
  - Fix serial read and challenge response.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550836800">- Version 1.19.3 (released 2019-02-22)
  - Fix capability read.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1563105600">- Version 1.20.0 (released 2019-07-03d)
  - Add yk_open_key_vid_pid() allowing vid and pid to be specified.
  - Documentation fixes.
  - Clear potentially sensitive material from buffers.
  - Fix potential buffer overwrite.
- Applied spec-cleaner</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1591617600">- Fix build with gcc 10 [gh#Yubico/yubikey-personalization#155]
- Fix boolean value with json-c 0.14 [gh#Yubico/yubikey-personalization#159]
  adds ykpers-json.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1623067200">- Drop --with-pic (no effect with --disable-static)</changelog>
</package>
<package pkgid="d469cc31cbbc74acde57cede54b428c085f5555e6ec53bd4e1e28c8f5ecafd43828bb699d77c729097d6178065824134252ce96c8d14148b06fc6b074ac2802b" name="ykpers-debuginfo" arch="s390x">
  <version epoch="0" ver="1.20.0" rel="32.58"/>
  <changelog author="meissner@suse.com" date="1492603200">- updated to 1.18.0 (released 2017-01-27)
  - Let ykchalresp read challenge from a file.
  - Add support of working with a numbered key when many connected Thanks to Thomas Habets &lt;habets@google.com&gt;
  - Documentation clarifications.
  - Fixup argument parsing of flags with optional arguments on BSD platforms.
  - Fix a file descriptor leak on windows.</changelog>
  <changelog author="wr@rosenauer.org" date="1523188800">- updated to 1.18.1 (released 2018-01-16)
  - Support reading accesscode and private ID from stdin.
  - Parse optional arguments correctly.
  - Documentation fixes.
  - Fix for ykinfo modhex serial output when it ends with c.
  - Treat all firmware versions as supported.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1538049600">- Version 1.19.0 (released 2018-04-24)
  - Add yk_write_device_info().
  - Add ykpersonalize cli switch -D for device info.
  - Add code for handling personalization interface of major version 5.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1538136000">- Fix RPM groups.
- Use noun phrase in summary.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550577600">- Version 1.19.1 (released 2019-02-19)
  - Error out on json output with randomSeed.
  - Validate more length fields.
  - Use correct FormatMessage function on windows.
  - Overflow, bounds and error condition checks.
  - Try to zero sensitive memory better.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550577601">- Version 1.19.2 (released 2019-02-19)
  - Fix test on mac.
  - Fix serial read and challenge response.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550836800">- Version 1.19.3 (released 2019-02-22)
  - Fix capability read.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1563105600">- Version 1.20.0 (released 2019-07-03d)
  - Add yk_open_key_vid_pid() allowing vid and pid to be specified.
  - Documentation fixes.
  - Clear potentially sensitive material from buffers.
  - Fix potential buffer overwrite.
- Applied spec-cleaner</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1591617600">- Fix build with gcc 10 [gh#Yubico/yubikey-personalization#155]
- Fix boolean value with json-c 0.14 [gh#Yubico/yubikey-personalization#159]
  adds ykpers-json.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1623067200">- Drop --with-pic (no effect with --disable-static)</changelog>
</package>
<package pkgid="ce38fce5491970b16e9b86709fb5d6291bc7792444019b0e483f40e0131d6e937795e350a3289ed1aa2bd4aa4ff8aa1cd08abbd93f2e01479423c6be8aa91e64" name="ykpers-debugsource" arch="s390x">
  <version epoch="0" ver="1.20.0" rel="32.58"/>
  <changelog author="meissner@suse.com" date="1492603200">- updated to 1.18.0 (released 2017-01-27)
  - Let ykchalresp read challenge from a file.
  - Add support of working with a numbered key when many connected Thanks to Thomas Habets &lt;habets@google.com&gt;
  - Documentation clarifications.
  - Fixup argument parsing of flags with optional arguments on BSD platforms.
  - Fix a file descriptor leak on windows.</changelog>
  <changelog author="wr@rosenauer.org" date="1523188800">- updated to 1.18.1 (released 2018-01-16)
  - Support reading accesscode and private ID from stdin.
  - Parse optional arguments correctly.
  - Documentation fixes.
  - Fix for ykinfo modhex serial output when it ends with c.
  - Treat all firmware versions as supported.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1538049600">- Version 1.19.0 (released 2018-04-24)
  - Add yk_write_device_info().
  - Add ykpersonalize cli switch -D for device info.
  - Add code for handling personalization interface of major version 5.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1538136000">- Fix RPM groups.
- Use noun phrase in summary.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550577600">- Version 1.19.1 (released 2019-02-19)
  - Error out on json output with randomSeed.
  - Validate more length fields.
  - Use correct FormatMessage function on windows.
  - Overflow, bounds and error condition checks.
  - Try to zero sensitive memory better.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550577601">- Version 1.19.2 (released 2019-02-19)
  - Fix test on mac.
  - Fix serial read and challenge response.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1550836800">- Version 1.19.3 (released 2019-02-22)
  - Fix capability read.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1563105600">- Version 1.20.0 (released 2019-07-03d)
  - Add yk_open_key_vid_pid() allowing vid and pid to be specified.
  - Documentation fixes.
  - Clear potentially sensitive material from buffers.
  - Fix potential buffer overwrite.
- Applied spec-cleaner</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1591617600">- Fix build with gcc 10 [gh#Yubico/yubikey-personalization#155]
- Fix boolean value with json-c 0.14 [gh#Yubico/yubikey-personalization#159]
  adds ykpers-json.patch</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1623067200">- Drop --with-pic (no effect with --disable-static)</changelog>
</package>
<package pkgid="24ca46c9ad72928b29b28dc9f76cb1d8dc473e0235438ca2c463dd08c4357c19b26dd5712ee6fbfe3bcf02b9c411b647208ad2c16b91a416676c2ab6ac29e235" name="yubico-piv-tool" arch="s390x">
  <version epoch="0" ver="2.7.3" rel="57.4"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1677844800">- update to 2.3.1:
  * ykpiv: Add support for T=0 smartcards
  * ykpiv: ykcs11: Minor code optimization
  * ykpiv: ykcs11: Improve logging
  * ykpiv: ykcs11: Improve error handling
  * ykpiv: ykcs11: Fix minor bugs
  * ykcs11: Add support for several PKCS11 Attributes
  * ykcs11: Add support for CKM_ECDSA_SHA512 mechanism
  * ykcs11: Fix incorrect value for public key attributes
    CKA_PRIVATE, CKA_SENSITIVE, CKA_ALWAYS_SENSITIVE,
    CKA_EXTRACTABLE and CKA_NEVER_EXTRACTABLE
  * doc: Minor documentation improvement</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1702814400">- update to 2.4.2:
  * ykpiv: Fix potential type casting bug.
  * ykpiv: ykcs11: Fix building on certain architectures.
  * ykpiv: cmd: Add support for compressing certificate upon
    import
  * ykcs11: Increase maximum number of slots to handle
    overflow
  * ykcs11: Add support for CKA_COPYABLE and CKA_DESTROYABLE
    attributes</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707307200">- update to 2.5.0:
  * ykpiv: cmd: ykcs11: Add support for RSA3072 and RSA4096 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for ED25519 and X25519 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for deleting keys.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for moving keys between slots.
    Available in firmware 5.7.0 and newer
- add temporary-cmake-flags-fix.patch
  The included cmake modules are buggy. This patch should be removed once the
  root cause is fixed in upstream.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707912000">- update to 2.5.1:
  * ykpiv: cmd: ykcs11: Fix buffer size for key import.
- add cmake-flags-upstream-issue-474.patch:
  proper fix for the cmake flags issue
- remove temporary-cmake-flags-fix.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1715083200">- update to 2.5.2:
  * cmd: Fix signing selfsigned certificate for ED25519 key.
- update cmake-flags-upstream-issue-474.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1724673600">- update to 2.6.0:
  * cmd: Add support for biometric verification and match policy
  * ykcs11: Add support for PKCS11 3.0
  * ykpiv: cmd: ykcs11: Improve error traceability
  * ykpiv: cmd: ykcs11: Fix minor bugs
  * build: Make building with zlib optional</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1726142400">- update to 2.6.1:
  * cmd: Fix performing bio verification
  * ykcs11: Fix handling ED25519 and X25519 keys</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1734609600">- update to 2.7.0:
  * ykpiv: cmd: Add support for communication over a secure channel according
    to SCP11b specifications
  * ykpiv: cmd: Add support for device global reset</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1739102400">- update to 2.7.1:
  * ykpiv: Fix type casting issues affecting systems using
    Big-endian architecture</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1754568000">- update to 2.7.2:
  * ykcs11: Handle a silent verification failure when opening a PKCS11 session.
    No impact on authentication enforcement for the usage of credentials on the
    YubiKey
  * ykcs11: Use "VERIFY_NONE" as PIN to skip verification when using keys with
    PIN policy "never"
  * ykcs11: Use "VERIFY_BIO" as PIN to trigger bio verification on the YubiKey
  * cmd: Get public key of an existing private key
  * cmd: Improve output of the status command to include slots with only a
    private key stored
  * cmd: Fix OID for attestation cross-signature extensions
  * cmd: Deprecate the --scp11 flag and rename it to --enc</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773835200">- update to 2.7.3:
  * ykcs11: Add support for ECDH derivation with X25519 key
  * lib: Improve usability with Windows
  * lib: Improve integration with minidriver
  * lib: Fix length calculation when importing RSA keys
  * lib: Improve error handling when no readers are available
  * build: Upgrade CMake minimum required version to 3.15
- cmake-flags-upstream-issue-474.patch: refresh</changelog>
</package>
<package pkgid="88e0eb5f0c9aa37b7b973d59a29325b6799d67975db42b8cd339df8dd8570f7bc76e702e4489fde34acdd51f617fe939435952b5ed93d1848fa215ab67efa43b" name="yubico-piv-tool" arch="src">
  <version epoch="0" ver="2.7.3" rel="57.4"/>
  <changelog author="t.gruner@katodev.de" date="1512043200">- Version 1.5.0 (released 2017-11-29)
  - API additions: Higher-level "util" API added to libykpiv.
  - Added ykpiv_attest(), ykpiv_get_pin_retries(), ykpiv_set_pin_retries()
  - Added functions for using existing PCSC card handle.
  - Support using custom memory allocator.
  - Documentation updates. make doxygen for HTML format.
  - Expanded automated tests for hardware devices, moved to make hwcheck.
  - OpenSSL 1.1 support
  - Moderate internal refactoring. Many small bugs fixed.</changelog>
  <changelog author="kbabioch@suse.com" date="1535457600">- Version 1.6.1 (released 2018-08-17)
  - Compilation warning fixes for OpenSSL 1.1 builds
  - Fix length when encoding exactly 0xff bytes
  - Check length of objects correctly before storing in buffer
  - Check length of certificate correctly when storing
- Version 1.6.0 (released 2018-08-08)
  - Security release to mitigate YSA-2018-03 (YSA-2018-03, CVE-2018-14779,
    CVE-2018-14780, bsc#1104809, bsc#1104811)
  - Allow building against LibreSSL
  - Bugfixes in OpenSSL 1.1 code
  - Fix compilation warnings
  - Fix ykcs11 key generation to work with OpenSSL 1.1
  - Ykcs11 compatibility fixes
- Make use of %license macro instead of %doc for COPYING
- Applied spec-cleaner</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1538049600">- Version 1.6.2 (released 2018-09-14)
  - Compare reader names case insensitive
  - Fix certificate and certificate request signatures with OpenSSL 1.1</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1538136000">- Rename %soname to %sover to better reflect its use.
- Fix RPM groups.</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1559563200">- Version 1.7.0 (released 2019-04-03)
  * Add ykpiv_get_serial() to API.
  * Add version and serial to status output.
  * FASC-N fixes for CHUID.
  * ykcs11: Fix ECDSA signatures.
  * Make selfsigned X.509 extensions have correct extensions to match openssl.
  * Security fixes.
  * Documentation fixes.
  * Try to clear memory that might contain secrets.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1583064000">- Version 2.0.0
  - ykpiv: Added ykpiv_get_metadata and ykpiv_util_parse_metadata
    to read and parse private key metadata (supported from YK 5.3).
  - ykpiv: Fixed PCSC transaction handling when re-selecting PIV
    due to external card reset events.
  - ykpiv: Improved error reporting.
  - ykpiv: Correctly report YK5 devices, and NEO and YK5 over NFC.
  - ykpiv: MGM KEY (SO PIN) is cached (in addition to PIN).
  - ykpiv: Fixed resetting of cached serial / version when an
    application re-uses ykpiv_state.
  - ykpiv: ykpiv_get_pin_retries selects a different applet before
    re-selecting PIV since just re-selecting PIV is a no-op on YK5.
  - ykcs11: Shared library exports all PKCS11 functions per the
    spec (For applications that don’t use C_GetFunctionList).
  - ykcs11: Support for up to 16 simultaneous sessions, with
    support for multi-threaded access (if requested when calling
    C_Initialize).
  - ykcs11: Support for resetting the PIV application via
    C_initToken.  Requires knowledge of the MGMT KEY (SO PIN) per
    the PKCS11 spec.
  - ykcs11: Support for public-key operations not supported by PIV
    (C_Verify, C_Encrypt), implemented using OpenSSL.
  - ykcs11: Support for attestations, exposed as session objects of
    certificate class. Generated when opening the first session to
    a slot.
  - ykcs11: Support for forked processes on Linux and MacOS.
  - ykcs11: Support for RSA signatures using PKCS or PSS padding
    with optional digesting by the library. Raw signatures are also
    supported.
  - ykcs11: Support for ECDSA signatures with optional digesting by
    the library. Raw signatures are also supported.
  - ykcs11: Support for RSA encryption / decryption with PKCS or
    OAEP padding.
  - ykcs11: Makes use of key metadata when available (YK 5.3 and
    above), providing access to keys even if certificates are not
    present.
  - ykcs11: Supports SHA1, SHA256, SHA384 and SHA512 digesting,
    plus SHA224 digesting for ECDSA signatures and for the MGF1
    digest in PSS / OAEP, implemented using OpenSSL.
  - ykcs11: Supports C_Login with context-specific user type. This
    allows use cases that require both SO PIN and normal PIN in the
    same session.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1614513600">- update to 2.2.0:
  * ykpiv: Increased SO version
  * ykpiv: Fixed minor memory leaks
  * ykpiv: Improved error handling
  * ykpiv: Improved handling of PCSC card validation
  * ykcs11: Updated Cryptoki version
  * ykcs11: Support for CKM_ECDH1_DERIVE mechanism info
  * ykcs11: Support for destroying ECDH derived keys
  * ykcs11: Improved handling of PIN after device re-connection
  * ykcs11: Improved debug logging
  * cmd: Improved parsing of certificate Distinguished Name to allow an escape character
  * cmd: Warning to discourage generating RSA1024 keys
  * build: Use of platform standard installation path when building yubico-piv-tool
  * tests: Improved testing
  * Replaced building with autotool with building with cmake
  * Security update for YSA-2020-02
  * ykpiv: Fixed potential memory leaks
  * ykpiv: Use PIN-protected MGMT key if the device is configured that way
  * ykpiv: Added attestation to CSR if requested
  * ykpiv: Fixed compatibility with LibreSSL
  * ykcs11: Improved handling of error codes
  * ykcs11: Improved handling of examples in the PKCS11 specifications
  * ykcs11: Added the possibility to have debug output as a runtime setting
  * ykcs11: Added support to unblock PIN with PUK
  * ykcs11: Make C_SetPIN backwards compatible while also allowing unblock PIN
  * tests: Improved tests
- run tests
- add pthread-link.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1643630400">- update to 2.2.1:
  * ykpiv: Minor bug fixes
  * ykcs11: Improved handling of object attributes
  * ykcs11: Update flags for EC related mechanisms
  * ykcs11: Minor bug fixes
  * test: Improved testing
  * doc: Improved documentation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670068800">- update to 2.3.0:
  * ykpiv: Add support for AES management keys
  * ykpiv: Better handling of connection reset
  * ykpiv: Add support for T=0 protocol
  * ykcs11: Support YubiKeys in NFC readers
  * ykcs11: Support touch and PIN policies for imported private keys
  * ykcs11: Support touch and PIN policy when generating keys
  * ykcs11: Set length to -1 on function fail
  * ykcs11: Ignore CKA_NAME_HASH_ALGORITHM and CKA_HASH_OF_SUBJECT_PUBLIC_KEY for certificates
  * cmd: Support attestation in selfsign certificates
  * build: Compile cleanly with openssl 1.1 and 3
- add keyring</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1677844800">- update to 2.3.1:
  * ykpiv: Add support for T=0 smartcards
  * ykpiv: ykcs11: Minor code optimization
  * ykpiv: ykcs11: Improve logging
  * ykpiv: ykcs11: Improve error handling
  * ykpiv: ykcs11: Fix minor bugs
  * ykcs11: Add support for several PKCS11 Attributes
  * ykcs11: Add support for CKM_ECDSA_SHA512 mechanism
  * ykcs11: Fix incorrect value for public key attributes
    CKA_PRIVATE, CKA_SENSITIVE, CKA_ALWAYS_SENSITIVE,
    CKA_EXTRACTABLE and CKA_NEVER_EXTRACTABLE
  * doc: Minor documentation improvement</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1702814400">- update to 2.4.2:
  * ykpiv: Fix potential type casting bug.
  * ykpiv: ykcs11: Fix building on certain architectures.
  * ykpiv: cmd: Add support for compressing certificate upon
    import
  * ykcs11: Increase maximum number of slots to handle
    overflow
  * ykcs11: Add support for CKA_COPYABLE and CKA_DESTROYABLE
    attributes</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707307200">- update to 2.5.0:
  * ykpiv: cmd: ykcs11: Add support for RSA3072 and RSA4096 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for ED25519 and X25519 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for deleting keys.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for moving keys between slots.
    Available in firmware 5.7.0 and newer
- add temporary-cmake-flags-fix.patch
  The included cmake modules are buggy. This patch should be removed once the
  root cause is fixed in upstream.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707912000">- update to 2.5.1:
  * ykpiv: cmd: ykcs11: Fix buffer size for key import.
- add cmake-flags-upstream-issue-474.patch:
  proper fix for the cmake flags issue
- remove temporary-cmake-flags-fix.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1715083200">- update to 2.5.2:
  * cmd: Fix signing selfsigned certificate for ED25519 key.
- update cmake-flags-upstream-issue-474.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1724673600">- update to 2.6.0:
  * cmd: Add support for biometric verification and match policy
  * ykcs11: Add support for PKCS11 3.0
  * ykpiv: cmd: ykcs11: Improve error traceability
  * ykpiv: cmd: ykcs11: Fix minor bugs
  * build: Make building with zlib optional</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1726142400">- update to 2.6.1:
  * cmd: Fix performing bio verification
  * ykcs11: Fix handling ED25519 and X25519 keys</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1734609600">- update to 2.7.0:
  * ykpiv: cmd: Add support for communication over a secure channel according
    to SCP11b specifications
  * ykpiv: cmd: Add support for device global reset</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1739102400">- update to 2.7.1:
  * ykpiv: Fix type casting issues affecting systems using
    Big-endian architecture</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1754568000">- update to 2.7.2:
  * ykcs11: Handle a silent verification failure when opening a PKCS11 session.
    No impact on authentication enforcement for the usage of credentials on the
    YubiKey
  * ykcs11: Use "VERIFY_NONE" as PIN to skip verification when using keys with
    PIN policy "never"
  * ykcs11: Use "VERIFY_BIO" as PIN to trigger bio verification on the YubiKey
  * cmd: Get public key of an existing private key
  * cmd: Improve output of the status command to include slots with only a
    private key stored
  * cmd: Fix OID for attestation cross-signature extensions
  * cmd: Deprecate the --scp11 flag and rename it to --enc</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773835200">- update to 2.7.3:
  * ykcs11: Add support for ECDH derivation with X25519 key
  * lib: Improve usability with Windows
  * lib: Improve integration with minidriver
  * lib: Fix length calculation when importing RSA keys
  * lib: Improve error handling when no readers are available
  * build: Upgrade CMake minimum required version to 3.15
- cmake-flags-upstream-issue-474.patch: refresh</changelog>
</package>
<package pkgid="73213f53cfd9d69e9ac0380a90e313c8566dbe3a058244cb4a26aa03673e37f7f95891fe372645409ae40c8df887836654854157b0d6f0174b0f656f10330b99" name="yubico-piv-tool-debuginfo" arch="s390x">
  <version epoch="0" ver="2.7.3" rel="57.4"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1677844800">- update to 2.3.1:
  * ykpiv: Add support for T=0 smartcards
  * ykpiv: ykcs11: Minor code optimization
  * ykpiv: ykcs11: Improve logging
  * ykpiv: ykcs11: Improve error handling
  * ykpiv: ykcs11: Fix minor bugs
  * ykcs11: Add support for several PKCS11 Attributes
  * ykcs11: Add support for CKM_ECDSA_SHA512 mechanism
  * ykcs11: Fix incorrect value for public key attributes
    CKA_PRIVATE, CKA_SENSITIVE, CKA_ALWAYS_SENSITIVE,
    CKA_EXTRACTABLE and CKA_NEVER_EXTRACTABLE
  * doc: Minor documentation improvement</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1702814400">- update to 2.4.2:
  * ykpiv: Fix potential type casting bug.
  * ykpiv: ykcs11: Fix building on certain architectures.
  * ykpiv: cmd: Add support for compressing certificate upon
    import
  * ykcs11: Increase maximum number of slots to handle
    overflow
  * ykcs11: Add support for CKA_COPYABLE and CKA_DESTROYABLE
    attributes</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707307200">- update to 2.5.0:
  * ykpiv: cmd: ykcs11: Add support for RSA3072 and RSA4096 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for ED25519 and X25519 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for deleting keys.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for moving keys between slots.
    Available in firmware 5.7.0 and newer
- add temporary-cmake-flags-fix.patch
  The included cmake modules are buggy. This patch should be removed once the
  root cause is fixed in upstream.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707912000">- update to 2.5.1:
  * ykpiv: cmd: ykcs11: Fix buffer size for key import.
- add cmake-flags-upstream-issue-474.patch:
  proper fix for the cmake flags issue
- remove temporary-cmake-flags-fix.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1715083200">- update to 2.5.2:
  * cmd: Fix signing selfsigned certificate for ED25519 key.
- update cmake-flags-upstream-issue-474.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1724673600">- update to 2.6.0:
  * cmd: Add support for biometric verification and match policy
  * ykcs11: Add support for PKCS11 3.0
  * ykpiv: cmd: ykcs11: Improve error traceability
  * ykpiv: cmd: ykcs11: Fix minor bugs
  * build: Make building with zlib optional</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1726142400">- update to 2.6.1:
  * cmd: Fix performing bio verification
  * ykcs11: Fix handling ED25519 and X25519 keys</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1734609600">- update to 2.7.0:
  * ykpiv: cmd: Add support for communication over a secure channel according
    to SCP11b specifications
  * ykpiv: cmd: Add support for device global reset</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1739102400">- update to 2.7.1:
  * ykpiv: Fix type casting issues affecting systems using
    Big-endian architecture</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1754568000">- update to 2.7.2:
  * ykcs11: Handle a silent verification failure when opening a PKCS11 session.
    No impact on authentication enforcement for the usage of credentials on the
    YubiKey
  * ykcs11: Use "VERIFY_NONE" as PIN to skip verification when using keys with
    PIN policy "never"
  * ykcs11: Use "VERIFY_BIO" as PIN to trigger bio verification on the YubiKey
  * cmd: Get public key of an existing private key
  * cmd: Improve output of the status command to include slots with only a
    private key stored
  * cmd: Fix OID for attestation cross-signature extensions
  * cmd: Deprecate the --scp11 flag and rename it to --enc</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773835200">- update to 2.7.3:
  * ykcs11: Add support for ECDH derivation with X25519 key
  * lib: Improve usability with Windows
  * lib: Improve integration with minidriver
  * lib: Fix length calculation when importing RSA keys
  * lib: Improve error handling when no readers are available
  * build: Upgrade CMake minimum required version to 3.15
- cmake-flags-upstream-issue-474.patch: refresh</changelog>
</package>
<package pkgid="8c7201bec7e9a3e0d22632f09431a2e6ef7360361c5fc6f65e604d50de217b2e7e5b2286f8e0fefe3e1ccc60428ab6bc97651bf27115aca3855f2636286cf545" name="yubico-piv-tool-debugsource" arch="s390x">
  <version epoch="0" ver="2.7.3" rel="57.4"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1677844800">- update to 2.3.1:
  * ykpiv: Add support for T=0 smartcards
  * ykpiv: ykcs11: Minor code optimization
  * ykpiv: ykcs11: Improve logging
  * ykpiv: ykcs11: Improve error handling
  * ykpiv: ykcs11: Fix minor bugs
  * ykcs11: Add support for several PKCS11 Attributes
  * ykcs11: Add support for CKM_ECDSA_SHA512 mechanism
  * ykcs11: Fix incorrect value for public key attributes
    CKA_PRIVATE, CKA_SENSITIVE, CKA_ALWAYS_SENSITIVE,
    CKA_EXTRACTABLE and CKA_NEVER_EXTRACTABLE
  * doc: Minor documentation improvement</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1702814400">- update to 2.4.2:
  * ykpiv: Fix potential type casting bug.
  * ykpiv: ykcs11: Fix building on certain architectures.
  * ykpiv: cmd: Add support for compressing certificate upon
    import
  * ykcs11: Increase maximum number of slots to handle
    overflow
  * ykcs11: Add support for CKA_COPYABLE and CKA_DESTROYABLE
    attributes</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707307200">- update to 2.5.0:
  * ykpiv: cmd: ykcs11: Add support for RSA3072 and RSA4096 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for ED25519 and X25519 key types.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for deleting keys.
    Available in firmware 5.7.0 and newer
  * ykpiv: cmd: Add support for moving keys between slots.
    Available in firmware 5.7.0 and newer
- add temporary-cmake-flags-fix.patch
  The included cmake modules are buggy. This patch should be removed once the
  root cause is fixed in upstream.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1707912000">- update to 2.5.1:
  * ykpiv: cmd: ykcs11: Fix buffer size for key import.
- add cmake-flags-upstream-issue-474.patch:
  proper fix for the cmake flags issue
- remove temporary-cmake-flags-fix.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1715083200">- update to 2.5.2:
  * cmd: Fix signing selfsigned certificate for ED25519 key.
- update cmake-flags-upstream-issue-474.patch</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1724673600">- update to 2.6.0:
  * cmd: Add support for biometric verification and match policy
  * ykcs11: Add support for PKCS11 3.0
  * ykpiv: cmd: ykcs11: Improve error traceability
  * ykpiv: cmd: ykcs11: Fix minor bugs
  * build: Make building with zlib optional</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1726142400">- update to 2.6.1:
  * cmd: Fix performing bio verification
  * ykcs11: Fix handling ED25519 and X25519 keys</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1734609600">- update to 2.7.0:
  * ykpiv: cmd: Add support for communication over a secure channel according
    to SCP11b specifications
  * ykpiv: cmd: Add support for device global reset</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1739102400">- update to 2.7.1:
  * ykpiv: Fix type casting issues affecting systems using
    Big-endian architecture</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1754568000">- update to 2.7.2:
  * ykcs11: Handle a silent verification failure when opening a PKCS11 session.
    No impact on authentication enforcement for the usage of credentials on the
    YubiKey
  * ykcs11: Use "VERIFY_NONE" as PIN to skip verification when using keys with
    PIN policy "never"
  * ykcs11: Use "VERIFY_BIO" as PIN to trigger bio verification on the YubiKey
  * cmd: Get public key of an existing private key
  * cmd: Improve output of the status command to include slots with only a
    private key stored
  * cmd: Fix OID for attestation cross-signature extensions
  * cmd: Deprecate the --scp11 flag and rename it to --enc</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1773835200">- update to 2.7.3:
  * ykcs11: Add support for ECDH derivation with X25519 key
  * lib: Improve usability with Windows
  * lib: Improve integration with minidriver
  * lib: Fix length calculation when importing RSA keys
  * lib: Improve error handling when no readers are available
  * build: Upgrade CMake minimum required version to 3.15
- cmake-flags-upstream-issue-474.patch: refresh</changelog>
</package>
<package pkgid="7adf3dab3564f907b5f42a1947da628e916d2a50d7d973470852718f9adfd928ad5687b06464da074e02e16a217a22ef39467923bdadf4b37e79852503c11af6" name="yubihsm-connector" arch="s390x">
  <version epoch="0" ver="3.0.5" rel="1.103"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="916c0926493b356a8181ceddcc38169b5278632916eae16c44f3615f3baf11c1d4209ab7954b2a09104088e6d3d3bfe6a35826446a59669a48f5dcd71e9561ef" name="yubihsm-connector" arch="src">
  <version epoch="0" ver="3.0.5" rel="1.103"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="d85e08db97d73b06adf9274cf211e94260eb34b2358a3e3d897a05e7800396b3492e35c6ae4ad6c8b6db1e81faf4bad7ff4bd4006ea8f3389b9c1af5fbb38fe0" name="yubihsm-connector-debuginfo" arch="s390x">
  <version epoch="0" ver="3.0.5" rel="1.103"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="338eecad70a251c77bf425cae30521fd6484fc305c93809a0bcb84c13e5eb72a112ff2f9cab549e20093132f274aabd80ef3b1b4a1f6bbaa256e22d39ca4ee17" name="yubihsm-connector-debugsource" arch="s390x">
  <version epoch="0" ver="3.0.5" rel="1.103"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="1c82c648d09c5d48ea9b013ff9d42fba461a28714378570fc08344ef072c2461f0e8a6cb0647614a5165865a59ff65da87729eb27c3d83ffe4b40a55f40f8115" name="yubihsm-shell" arch="s390x">
  <version epoch="0" ver="2.6.0" rel="3.8"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="db4d0711f7a610bdb040fc58151267d419a72b9814c04f81a7031c92f62335a98546c4685a8fdce34365ea410616f5d44098262013ffb2fcd009ec3a9e471d3c" name="yubihsm-shell" arch="src">
  <version epoch="0" ver="2.6.0" rel="3.8"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="9dd96bfc8f0e645134b72af4733582fb0b6d6a3a27aaeec284a46147e064e44389711ca6cb1e9d22642e897adee1087451d6199fd881038ba49e4b3779aaa639" name="yubihsm-shell-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.0" rel="3.8"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="b2c2acaabe84b987811462ab5d327e92181c62de43c1c9ada2d9484ebda27ff765d24b7d4e2ccfec8e13695cd809a97fb99c29e50fefbb217f049c1ca7ed38a9" name="yubihsm-shell-debugsource" arch="s390x">
  <version epoch="0" ver="2.6.0" rel="3.8"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="632be09ba2b80d80ae12a084e2567727bd68f9efe209f6aa21ae9223b653b9cc90a9ad20f8cd7ed2c350448349b6e0e98ba625c1c854646975f2c46831fd2edf" name="yubihsm-shell-devel" arch="s390x">
  <version epoch="0" ver="2.6.0" rel="3.8"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="e8e0711158659549f04aead7861a99f4e310f8d5d6505f9ee8972638f2f5a1cb2fac95231c14d49d451b72b0ca85e56f77fa10edb3359ed66c2344188ed1e551" name="yubihsm-shell-pkcs11" arch="s390x">
  <version epoch="0" ver="2.6.0" rel="3.8"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="8d19eb0d0b544e76873b87303a1366db616cef1a392229464c5c49d7d2230c0a43fce494582382775b5f1b1c82d898a67267cba04533188dd37cfc0e860690fe" name="yubihsm-shell-pkcs11-debuginfo" arch="s390x">
  <version epoch="0" ver="2.6.0" rel="3.8"/>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1737979200">- initial package</changelog>
</package>
<package pkgid="456dd4061cf74817b81144297ad313d8b6fe80751f74f65e064174999a1dc448d3e4bb9976bb0468885356c8e249cd99c5fecf0eb30b833a06215c91fb7020fb" name="yubikey-manager" arch="noarch">
  <version epoch="0" ver="5.8.0" rel="65.10"/>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1671451200">- Keep this version until version 5.0.0 or
  yubikey-manager-qt v1.2.4 and yubioath-desktop v5.1.0 was fixed
- Some small .spec file fixes</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1701432000">- update to 5.2.1:
  * Add support for Python 3.12.
  * OATH: detect and remove corrupted credentials.
  * Bugfix: HSMAUTH: Fix order of CLI arguments.
  * PIV: Support for compressed certificates.
  * OpenPGP: Use InvalidPinError for wrong PIN.
  * Add YubiHSM Auth application support.
  * Improved API documentation.
  * Scripting: Add name attribute to device.
  * Bugfix: PIV: don't throw InvalidPasswordError on
    malformed PEM private key.
  * Bugfix: PIV: string representation of SLOT caused
    infinite loop on Python &lt;3.11.
  * Bugfix: Fix errors in 'ykman config nfc' on YubiKeys
    without NFC capability.
  * Bugfix: Fix error message shown when invalid modhex input
    length given for YubiOTP.
  * Add OpenPGP functionality to supported API.
  * Add PIV key info command to CLI.
  * PIV: Support signing prehashed data via API.
  * Bugfix: Fix signing PIV certificates/CSRs with key that
    always requires PIN.
  * Bugfix: Fix incorrect display name detection for certain
    keys over NFC.
  * Bugfix: Fix the interactive confirmation prompt for some
    CLI commands.
  * Bugfix: OpenPGP Signature PIN policy values were swapped.
  * Bugfix: FIDO: Handle discoverable credentials that are
    missing name or displayName.
  * Add support for Python 3.11.
  * Remove extra whitespace characters from CLI into command
    output.
  * Various cleanups and improvements to the API.
  * Improvements to the handling of YubiKeys and connections.
  * Command aliases for ykman 3.x (introduced in ykman 4.0)
    have now been dropped.
  * Installers for ykman are now provided for Windows (amd64)
    and MacOS (universal2).
  * Logging has been improved, and a new TRAFFIC level has
    been introduced.
  * The codebase has been improved for scripting usage,
    either directly as a Python module, or via the new
    "ykman script" command.
  * PIV: Add support for dotted-string OIDs when parsing
    RFC4514 strings.
  * PIV: Drop support for signing certificates and CSRs with
    SHA-1.
  * FIDO: Credential management commands have been improved
    to deal with ambiguity in certain cases.
  * OATH: Access Keys ("remembered" passwords) are now stored
    in the system keyring.
  * OpenPGP: Commands have been added to manage PINs.
- add keyring for offline validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1710676800">- update to 5.3.0:
  * FIDO: Add new CLI commands for PIN management and
    authenticator config
    (force-change, set-min-length, toggle-always-uv, enable-
    ep-attestation).
  * PIV: Support new key types on supported devices (RSA
    3072/4096, Curve25519).
  * PIV: Support for moving and deleting keys on supported
    devices.
  * PIV: Improve handling of legacy "PUK blocked" flag.
  * PIV: Improve handling of malformed certificates.
  * PIV: Display key information in "piv info" output on
    supported devices.
  * OTP: Fix some commands incorrectly showing errors when
    used over NFC/CCID.
  * Add tab-completion YubiKey serial numbers and NRC
    readers.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 5.4.0
  * Support for YubiKey Bio Multi-protocol Edition.
  * CLI: Improve error messages for several failures.
  * Attempt to send SIGHUP to yubikey-agent if it is blocking the connection.
  * Bugfix: Allow "fido config" to work when no PIN is set on the YubiKey.
  * Bugfix: MacOS - Fix race condition resulting in unneeded delay in fido commands over
    USB.
  * Bugfix: Linux - Fix error when listing OTP devices when no YubiKeys are attached.
  * Bugfix: OpenPGP - Fix RSA key generation on YubiKey NEO.</changelog>
  <changelog author="Frantisek Simorda &lt;frantisek.simorda@suse.com&gt;" date="1720008000">- Update to 5.5.1
  * Bugfix: CLI - Don’t use formatting that doesn’t work on older Python versions. Note: As the 5.5.0 installers bundle Python 3.12, this will be a source-only release.
- Update to 5.5.0
  * Version 5.5.0 (released 2024-06-26)
  * Add Secure Channel support to smartcard sessions.
  * Support extended APDUs in the "apdu" command (this is now the default).
  * HSMAuth: Treat management key as a PIN/password instead of a key, adding new CLI commands.
  * PIV: Deprecate explicit passing of management key type when authenticating.
  * CLI: Add "config nfc --restrict" command to set "NFC restricted mode".
  * CLI: Display more information about PIN complexity and FIPS status for compatible YubiKeys.
  * CLI: Improved error messages for illegal values of PIV PIN and PUK.
  * CLI: Drop error messages for old 3.x commands.
  * CLI: Removal of --upload for YubiCloud credentials. Export to CSV and upload via web instead.
  * CLI: Add more detailed information to the CLI output for several commands.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1742212800">- Update to 5.6.0
  * SCP: Add support for specifying Le (needed in OpenPGP get_challenge).
  * PIV: When writing a new CHUID, prefer to keep data from the old one if
    possible.
  * CLI: Specifying public-key is now optional when generating a PIV
    certificate, if a public key can be read from the YubiKey itself.
  * CLI: (YK FIPS) Disallow --protect for PIV when not in FIPS approved state.
  * CLI: Support specifying Le in "apdu" command.
  * CLI: Show OpenPGP key information in "openpgp info" and "openpgp keys info"
    commands.
  * CLI: Detect OpenPGP memory corruption, and correctly factory reset OpenPGP
    if needed.
  * CLI: Don’t fail on corrupted configuration files, instead show a warning.
  * Require Poetry &gt;= 2.0 for building and packaging of the library.
  * Bugfix: CLI - Don’t use extended APDUs in the "apdu" command on old
    YubiKeys which do not support it.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1742817600">- Update to 5.6.1
  * Fix: Version 5.6.0 uses Exclusive smart card connections, which caused
    connections to fail if another application was accessing the YubiKey. This
    version adds a fallback to use non-exclusive connections in case of such a
    failure.
  * Bugfix: APDU encoding was slightly incorrect for commands which specify Le,
    but no data body. This caused issued on some platforms.
  * CLI: The "fido info" command now shows the YubiKey AAGUID, when available.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1748520000">- update to 5.7.0:
  * Python 3.9 or later is now required.
  * PIV: Improve error handling for the Printed data slot.
  * PIV: Improve error handling when decompressing malformed
    certificates.
  * Fix incompatibility with pyscard 2.2.2.
  * Improve compatibility with NFC readers that don't support
    xtended APDUs.
  * Building the project now requires Poetry version 2.0 or
    later.
  * Windows and MacOS installers built with Python 3.13.3</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- update to 5.7.2:
  * Fix OTP connections for YubiKeys with all other USB interfaces
    deactivated.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1767355200">- update to 5.8.0:
  * Python 3.10 or later is now required.
  * CLI: The "otp settings" command now supports --serial-
    usb-visible.
  * CLI: List PIV "retired" key slots after normal slots.
  * CLI: Add --no-update-chuid to "piv certificate" commands.
  * CLI: Improve "fido" command error handing when FIDO2 is
    disabled/missing.
  * CLI: Support "fido reset" when multiple keys are
    connected.
  * Add "YkmanDevice.reinsert" method to simplify
    reconnecting a YubiKey.
  * PIV: Add "PivSession.get_serial" method.
  * Windows and MacOS installers built with Python 3.13.7</changelog>
</package>
<package pkgid="f0f2757d49d852f769686858fa90ec74da4f46f0518061b2bfe784067b8ad8d4ae9250cd201529017a11e3fafa2fc2ab26477e4b1f43296ab20e06651ca19898" name="yubikey-manager" arch="src">
  <version epoch="0" ver="5.8.0" rel="65.10"/>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1559131200">- Version 2.1.1 (released 2019-05-28)
  * OTP: Add initial support for uploading Yubico OTP credentials to YubiCloud
  * Don’t automatically select the U2F applet on YubiKey NEO, it might be
    blocked by the OS
  * ChalResp: Always pad challenge correctly
  * Bugfix: Don’t crash with older versions of cryptography
  * Bugfix: Password was always prompted in OATH command, even if sent as
    argument</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1561809600">- Version 3.0.0 (released 2019-06-24)
  * Add support for new YubiKey Preview and lightning form factor
  * FIDO: Support for credential management
  * OpenPGP: Support for OpenPGP attestation, cardholder certificates and
    cached touch policies
  * OTP: Add flag for using numeric keypad when sending digits</changelog>
  <changelog author="simmphonie@opensuse.org" date="1566388800">- Version 3.1.0 (released 2019-08-20)
  * Add support for YubiKey 5Ci
  * OpenPGP: the info command now prints OpenPGP specification version as well
  * OpenPGP: Update support for attestation to match OpenPGP v3.4
  * PIV: Use UTC time for self-signed certificates
  * OTP: Static password now supports the Norman keyboard layout</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1576584000">- Use modern python macros for building
- Run tests</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1580817600">- Update to 3.1.1
  * Add support for YubiKey 5C NFC
  * OpenPGP: set-touch now performs compatibility checks before prompting for PIN
  * OpenPGP: Improve error messages and documentation for set-touch
  * PIV: read-object command no longer adds a trailing newline
  * CLI: Hint at missing permissions when opening a device fails
  * Linux: Improve error handling when pcscd is not running
  * Windows: Improve how .DLL files are loaded, thanks to Marius Gabriel Mihai for reporting this!
  * Bugfix: set-touch now accepts the cached-fixed option
  * Bugfix: Fix crash in OtpController.prepare_upload_key() error parsing
  * Bugfix: Fix crash in piv info command when a certificate slot contains an invalid certificate
  * Library: PivController.read_certificate(slot) now wraps certificate parsing exceptions in new exception type InvalidCertificate
  * Library: PivController.list_certificates() now returns None for slots containing invalid certificate, instead of raising an exception</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620302400">- Update to version 4.0.2
  * Update device names
  * Add read_info output to the --diagnose command, and show
    exception types.
  * Bugfix: Fix read_info for YubiKey Plus.
  * Add support for YK5-based FIPS YubiKeys.
  * Bugfix: Fix OTP device enumeration on Win32.
  * Drop reliance on libusb and libykpersonalize.
  * Support the "fido" and "otp" subcommands over NFC
  * New "ykman --diagnose" command to aid in troubleshooting.
  * New "ykman apdu" command for sending raw APDUs over the smart
    card interface.
  * New "yubikit" package added for custom development and advanced
    scripting.
  * OpenPGP: Add support for KDF enabled YubiKeys.
  * Static password: Add support for FR, IT, UK and BEPO keyboard
    layouts.
- Drop now unneeded python3-six, python3-usb and
  libykpers-1-1 dependencies
- python3-pyOpenSSL is optional, so move from Requires to Recommends</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1621339200">- Update to version 4.0.3
  * Add support for fido reset over NFC.
  * Bugfix: The --touch argument to piv change-management-key was
    ignored.
  * Bugfix: Don’t prompt for password when importing PIV key/cert
    if file is invalid.
  * Bugfix: Fix setting touch-eject/auto-eject for YubiKey 4 and NEO.
  * Bugfix: Detect PKCS#12 format when outer sequence uses
    indefinite length.
  * Dependency: Add support for Click 8.</changelog>
  <changelog author="pgajdos@suse.com" date="1634212800">- version update to 4.0.7
  * Version 4.0.7 (released 2021-09-08)
  * * Bugfix release: Fix broken naming for "YubiKey 4", and a small OATH issue with
    touch Steam credentials.
  * Version 4.0.6 (released 2021-09-08)
  * * Improve handling of YubiKey device reboots.
  * * More consistently mask PIN/password input in prompts.
  * * Support switching mode over CCID for YubiKey Edge.
  * * Run pkill from PATH instead of fixed location.
  * Version 4.0.5 (released 2021-07-16)
  * * Bugfix: Fix PIV feature detection for some YubiKey NEO versions.
  * * Bugfix: Fix argument short form for --period when adding TOTP credentials.
  * * Bugfix: More strict validation for some arguments, resulting in better error messages.
  * * Bugfix: Correctly handle TOTP credentials using period != 30 AND touch_required.
  * * Bugfix: Fix prompting for access code in the otp settings command (now uses "-A -").</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1648468800">- Update to version 4.0.8 (released 2022-01-31)
  * Bugfix: Fix error message for invalid modhex when programing a YubiOTP credential.
  * Bugfix: Fix issue with displaying a Steam credential when it is the only account.
  * Bugfix: Prevent installation of files in site-packages root.
  * Bugfix: Fix cleanup logic in PIV for protected management key.
  * Add support for token identifier when programming slot-based HOTP.
  * Add support for programming NDEF in text mode.
  * Dependency: Add support for Cryptography ⇐ 38.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1664971200">- Update to version 4.0.9 (released 2022-06-17)
  * Dependency: Add support for python-fido2 1.x
  * Fix: Drop stated support for Click 6 as features from 7 are being used.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1671451200">- Keep this version until version 5.0.0 or
  yubikey-manager-qt v1.2.4 and yubioath-desktop v5.1.0 was fixed
- Some small .spec file fixes</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1701432000">- update to 5.2.1:
  * Add support for Python 3.12.
  * OATH: detect and remove corrupted credentials.
  * Bugfix: HSMAUTH: Fix order of CLI arguments.
  * PIV: Support for compressed certificates.
  * OpenPGP: Use InvalidPinError for wrong PIN.
  * Add YubiHSM Auth application support.
  * Improved API documentation.
  * Scripting: Add name attribute to device.
  * Bugfix: PIV: don't throw InvalidPasswordError on
    malformed PEM private key.
  * Bugfix: PIV: string representation of SLOT caused
    infinite loop on Python &lt;3.11.
  * Bugfix: Fix errors in 'ykman config nfc' on YubiKeys
    without NFC capability.
  * Bugfix: Fix error message shown when invalid modhex input
    length given for YubiOTP.
  * Add OpenPGP functionality to supported API.
  * Add PIV key info command to CLI.
  * PIV: Support signing prehashed data via API.
  * Bugfix: Fix signing PIV certificates/CSRs with key that
    always requires PIN.
  * Bugfix: Fix incorrect display name detection for certain
    keys over NFC.
  * Bugfix: Fix the interactive confirmation prompt for some
    CLI commands.
  * Bugfix: OpenPGP Signature PIN policy values were swapped.
  * Bugfix: FIDO: Handle discoverable credentials that are
    missing name or displayName.
  * Add support for Python 3.11.
  * Remove extra whitespace characters from CLI into command
    output.
  * Various cleanups and improvements to the API.
  * Improvements to the handling of YubiKeys and connections.
  * Command aliases for ykman 3.x (introduced in ykman 4.0)
    have now been dropped.
  * Installers for ykman are now provided for Windows (amd64)
    and MacOS (universal2).
  * Logging has been improved, and a new TRAFFIC level has
    been introduced.
  * The codebase has been improved for scripting usage,
    either directly as a Python module, or via the new
    "ykman script" command.
  * PIV: Add support for dotted-string OIDs when parsing
    RFC4514 strings.
  * PIV: Drop support for signing certificates and CSRs with
    SHA-1.
  * FIDO: Credential management commands have been improved
    to deal with ambiguity in certain cases.
  * OATH: Access Keys ("remembered" passwords) are now stored
    in the system keyring.
  * OpenPGP: Commands have been added to manage PINs.
- add keyring for offline validation</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1710676800">- update to 5.3.0:
  * FIDO: Add new CLI commands for PIN management and
    authenticator config
    (force-change, set-min-length, toggle-always-uv, enable-
    ep-attestation).
  * PIV: Support new key types on supported devices (RSA
    3072/4096, Curve25519).
  * PIV: Support for moving and deleting keys on supported
    devices.
  * PIV: Improve handling of legacy "PUK blocked" flag.
  * PIV: Improve handling of malformed certificates.
  * PIV: Display key information in "piv info" output on
    supported devices.
  * OTP: Fix some commands incorrectly showing errors when
    used over NFC/CCID.
  * Add tab-completion YubiKey serial numbers and NRC
    readers.</changelog>
  <changelog author="pgajdos@suse.com" date="1712145600">- version update to 5.4.0
  * Support for YubiKey Bio Multi-protocol Edition.
  * CLI: Improve error messages for several failures.
  * Attempt to send SIGHUP to yubikey-agent if it is blocking the connection.
  * Bugfix: Allow "fido config" to work when no PIN is set on the YubiKey.
  * Bugfix: MacOS - Fix race condition resulting in unneeded delay in fido commands over
    USB.
  * Bugfix: Linux - Fix error when listing OTP devices when no YubiKeys are attached.
  * Bugfix: OpenPGP - Fix RSA key generation on YubiKey NEO.</changelog>
  <changelog author="Frantisek Simorda &lt;frantisek.simorda@suse.com&gt;" date="1720008000">- Update to 5.5.1
  * Bugfix: CLI - Don’t use formatting that doesn’t work on older Python versions. Note: As the 5.5.0 installers bundle Python 3.12, this will be a source-only release.
- Update to 5.5.0
  * Version 5.5.0 (released 2024-06-26)
  * Add Secure Channel support to smartcard sessions.
  * Support extended APDUs in the "apdu" command (this is now the default).
  * HSMAuth: Treat management key as a PIN/password instead of a key, adding new CLI commands.
  * PIV: Deprecate explicit passing of management key type when authenticating.
  * CLI: Add "config nfc --restrict" command to set "NFC restricted mode".
  * CLI: Display more information about PIN complexity and FIPS status for compatible YubiKeys.
  * CLI: Improved error messages for illegal values of PIV PIN and PUK.
  * CLI: Drop error messages for old 3.x commands.
  * CLI: Removal of --upload for YubiCloud credentials. Export to CSV and upload via web instead.
  * CLI: Add more detailed information to the CLI output for several commands.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1742212800">- Update to 5.6.0
  * SCP: Add support for specifying Le (needed in OpenPGP get_challenge).
  * PIV: When writing a new CHUID, prefer to keep data from the old one if
    possible.
  * CLI: Specifying public-key is now optional when generating a PIV
    certificate, if a public key can be read from the YubiKey itself.
  * CLI: (YK FIPS) Disallow --protect for PIV when not in FIPS approved state.
  * CLI: Support specifying Le in "apdu" command.
  * CLI: Show OpenPGP key information in "openpgp info" and "openpgp keys info"
    commands.
  * CLI: Detect OpenPGP memory corruption, and correctly factory reset OpenPGP
    if needed.
  * CLI: Don’t fail on corrupted configuration files, instead show a warning.
  * Require Poetry &gt;= 2.0 for building and packaging of the library.
  * Bugfix: CLI - Don’t use extended APDUs in the "apdu" command on old
    YubiKeys which do not support it.</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1742817600">- Update to 5.6.1
  * Fix: Version 5.6.0 uses Exclusive smart card connections, which caused
    connections to fail if another application was accessing the YubiKey. This
    version adds a fallback to use non-exclusive connections in case of such a
    failure.
  * Bugfix: APDU encoding was slightly incorrect for commands which specify Le,
    but no data body. This caused issued on some platforms.
  * CLI: The "fido info" command now shows the YubiKey AAGUID, when available.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1748520000">- update to 5.7.0:
  * Python 3.9 or later is now required.
  * PIV: Improve error handling for the Printed data slot.
  * PIV: Improve error handling when decompressing malformed
    certificates.
  * Fix incompatibility with pyscard 2.2.2.
  * Improve compatibility with NFC readers that don't support
    xtended APDUs.
  * Building the project now requires Poetry version 2.0 or
    later.
  * Windows and MacOS installers built with Python 3.13.3</changelog>
  <changelog author="Wolfgang Frisch &lt;wolfgang.frisch@suse.com&gt;" date="1749556800">- update to 5.7.2:
  * Fix OTP connections for YubiKeys with all other USB interfaces
    deactivated.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1767355200">- update to 5.8.0:
  * Python 3.10 or later is now required.
  * CLI: The "otp settings" command now supports --serial-
    usb-visible.
  * CLI: List PIV "retired" key slots after normal slots.
  * CLI: Add --no-update-chuid to "piv certificate" commands.
  * CLI: Improve "fido" command error handing when FIDO2 is
    disabled/missing.
  * CLI: Support "fido reset" when multiple keys are
    connected.
  * Add "YkmanDevice.reinsert" method to simplify
    reconnecting a YubiKey.
  * PIV: Add "PivSession.get_serial" method.
  * Windows and MacOS installers built with Python 3.13.7</changelog>
</package>
<package pkgid="44370a5b1f5f7a892d4ceec0705354503d53ce57dcb29910ba3ac796f0ad337c8658d93b728baea5a63b2e5da09cb92333ad439cddaa281ff01c1d4d47d35049" name="yubikey-manager-qt" arch="s390x">
  <version epoch="0" ver="1.2.5" rel="51.1"/>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1561809600">- Version 1.1.2 (released 2019-06-24)
  * Add support for new YubiKey Preview
  * PIV: The popup for the management key now have a "Use default" option
  * Windows: Fix issue with importing PIV certificates
  * Bugfix: generate static password now works correctly</changelog>
  <changelog author="simmphonie@opensuse.org" date="1566388800">- Version 1.1.3 (released 2019-08-20)
  * Add suppport for YubiKey 5Ci
  * PIV: Use UTC time for self-signed certificates
- Version 1.1.2b (released 2019-06-26)
  * macOS: Fix build problem that caused communication with the OTP application to fail</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1582632000">- Update to version 1.1.4
  * OTP: Add option to upload YubiOTP credential to YubiCloud
  * Linux: Show hint about pcscd service if opening device fails
  * Bugfix: Signal handling now compatible with Python 3.8
- Set CONFIG=+hide_symbols so the compiler can generate better
  and smaller code knowing that no symbols need to be visible.</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1597665600">- update to 1.1.5
  * Add support for YubiKey 5C NFC</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620302400">- Update to version 1.2.2
  * Fix detection of YubiKey Plus
  * Compatibility update for yubikey-manager 4.0
  * Bugfix: Device caching with multiple devices
  * Drop dependencies on libusb and libykpers.
  * Add additional product names and images</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1621339200">- Update to version 1.2.3
  * Improved error handling when using Security Key Series devices.
  * PIV: Fix generation of certificate in slot 9c.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1635768000">- Update to version 1.2.4 (released 2021-10-26)
  * Update device names and images.
  * PIV: Fix import of certificate.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1677844800">- update to 1.2.5:
  * Compatibility update for ykman 5.0.1.
  * Update to Python 3.11.
  * Update product images.
- add keyring for gpg validation</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1722859200">- Added yubikey-manager-qt_work_with_newer_ykman.patch (boo#1228877)
  make it work with ykman 5.5.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1722859201">- switch to autosetup</changelog>
</package>
<package pkgid="324498f8c2c765da4b709ade1ac8fb9a0e5e67ef14b87c96b5d0226fd3940a6c1da42b8231c29c5c922597e1f97de720e11157d82603b0eb455795ceabfd32e9" name="yubikey-manager-qt" arch="src">
  <version epoch="0" ver="1.2.5" rel="51.1"/>
  <changelog author="t.gruner@katodev.de" date="1522756800">- Fix build for Leap 15 and SLE 15</changelog>
  <changelog author="kbabioch@suse.com" date="1523966400">- Version 0.5.0:
  * Support for configuring YubiKeys with FIDO2.
  * OTP: Configuring HOTP now correctly supports 8 or 6 characters.
  * Static password: Any character can now be used in a static password.
  * UI: New header with help-link added.
  * New icon.
- Cleaned up spec file (spec-cleaner)</changelog>
  <changelog author="kbabioch@suse.com" date="1525867200">- Version 0.5.1:
  * Support changing USB interfaces for YubiKey Preview.
  * OATH-HOTP: Show correct error message on too long secret keys.
  * CLI: Give correct exit codes.</changelog>
  <changelog author="kbabioch@suse.com" date="1531310400">- Version 0.5.2 (released 2018-07-09)
  * Support for YubiKey FIPS.-
- Applied spec-cleaner
- Adjusted setup macro, since source tarball does not contain a
  top-level directory (i.e. tar bomb)</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1538049600">- Version 1.0.0 (released 2018-09-24)
  * Completely new UI
  * Support for YubiKey 5 Series
  * Support for configuring NFC and USB interfaces
  * Linux: Release as AppImage (experimental)</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1539172800">- Version 1.0.1 (released 2018-10-10)
  * Support for YubiKey 5A
  * Bugfix: Show picture for FIDO U2F Security key
  * Bugfix: Swapping OTP slots or deleting OTP a slot configuration now reloads the view
  * Bugfix: Under some conditions the wrong device info was shown</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1539172801">- Bumped required version of yubikey-manager to 1.0.1</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1542110400">- Fixed dependency issues:
  * python3-pyotherside (explicitly require python3 module)
  * libqt5-qtgraphicaleffects (bsc#1115816)
  * libqt5-qtquickcontrols &amp; libqt5-qtquickcontrols2 (bsc#1115595)</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1547035200">- Update to version 1.1.0 (released 2019-01-09):
  * Add support for Security Key NFC
  * Add support for managing PIV Application
  * Bugfix: OATH-HOTP credentials was always configured with 6 digits
  * UI: Replace Succes-popups with Snackbar-messages
  * UX: Drop confirmation prompt for OTP Swap Slots</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1552305600">- Version 1.1.1 (released 2019-03-11)
  * PIV: On import, do not always verify that the certifcate and private key
    matches, since it may require the PIN
  * PIV: Report if private key or certificate was imported
  * PIV: Improve handling of malformed certificates
  * PIV: Allow uppercase characters in management key input field
- Fixed path issue with setup macro during build</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1561809600">- Version 1.1.2 (released 2019-06-24)
  * Add support for new YubiKey Preview
  * PIV: The popup for the management key now have a "Use default" option
  * Windows: Fix issue with importing PIV certificates
  * Bugfix: generate static password now works correctly</changelog>
  <changelog author="simmphonie@opensuse.org" date="1566388800">- Version 1.1.3 (released 2019-08-20)
  * Add suppport for YubiKey 5Ci
  * PIV: Use UTC time for self-signed certificates
- Version 1.1.2b (released 2019-06-26)
  * macOS: Fix build problem that caused communication with the OTP application to fail</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1582632000">- Update to version 1.1.4
  * OTP: Add option to upload YubiOTP credential to YubiCloud
  * Linux: Show hint about pcscd service if opening device fails
  * Bugfix: Signal handling now compatible with Python 3.8
- Set CONFIG=+hide_symbols so the compiler can generate better
  and smaller code knowing that no symbols need to be visible.</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1597665600">- update to 1.1.5
  * Add support for YubiKey 5C NFC</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620302400">- Update to version 1.2.2
  * Fix detection of YubiKey Plus
  * Compatibility update for yubikey-manager 4.0
  * Bugfix: Device caching with multiple devices
  * Drop dependencies on libusb and libykpers.
  * Add additional product names and images</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1621339200">- Update to version 1.2.3
  * Improved error handling when using Security Key Series devices.
  * PIV: Fix generation of certificate in slot 9c.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1635768000">- Update to version 1.2.4 (released 2021-10-26)
  * Update device names and images.
  * PIV: Fix import of certificate.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1677844800">- update to 1.2.5:
  * Compatibility update for ykman 5.0.1.
  * Update to Python 3.11.
  * Update product images.
- add keyring for gpg validation</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1722859200">- Added yubikey-manager-qt_work_with_newer_ykman.patch (boo#1228877)
  make it work with ykman 5.5.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1722859201">- switch to autosetup</changelog>
</package>
<package pkgid="0091b522256b62dd4f6c11f58cc7cc7cc062b6036d7ccb1401c4df5dd29e3ba6a5c34e13c16b92a8403c3d38a1fd754ae88621e5a65f54d43062ed8f95414d8d" name="yubikey-manager-qt-debuginfo" arch="s390x">
  <version epoch="0" ver="1.2.5" rel="51.1"/>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1561809600">- Version 1.1.2 (released 2019-06-24)
  * Add support for new YubiKey Preview
  * PIV: The popup for the management key now have a "Use default" option
  * Windows: Fix issue with importing PIV certificates
  * Bugfix: generate static password now works correctly</changelog>
  <changelog author="simmphonie@opensuse.org" date="1566388800">- Version 1.1.3 (released 2019-08-20)
  * Add suppport for YubiKey 5Ci
  * PIV: Use UTC time for self-signed certificates
- Version 1.1.2b (released 2019-06-26)
  * macOS: Fix build problem that caused communication with the OTP application to fail</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1582632000">- Update to version 1.1.4
  * OTP: Add option to upload YubiOTP credential to YubiCloud
  * Linux: Show hint about pcscd service if opening device fails
  * Bugfix: Signal handling now compatible with Python 3.8
- Set CONFIG=+hide_symbols so the compiler can generate better
  and smaller code knowing that no symbols need to be visible.</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1597665600">- update to 1.1.5
  * Add support for YubiKey 5C NFC</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620302400">- Update to version 1.2.2
  * Fix detection of YubiKey Plus
  * Compatibility update for yubikey-manager 4.0
  * Bugfix: Device caching with multiple devices
  * Drop dependencies on libusb and libykpers.
  * Add additional product names and images</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1621339200">- Update to version 1.2.3
  * Improved error handling when using Security Key Series devices.
  * PIV: Fix generation of certificate in slot 9c.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1635768000">- Update to version 1.2.4 (released 2021-10-26)
  * Update device names and images.
  * PIV: Fix import of certificate.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1677844800">- update to 1.2.5:
  * Compatibility update for ykman 5.0.1.
  * Update to Python 3.11.
  * Update product images.
- add keyring for gpg validation</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1722859200">- Added yubikey-manager-qt_work_with_newer_ykman.patch (boo#1228877)
  make it work with ykman 5.5.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1722859201">- switch to autosetup</changelog>
</package>
<package pkgid="f971994bdb789c68c6be2223544f993d51ebb7e437555247f41a3ba306a7d6a59c973389fa4cdc37937b63e320c5859b5f275187e2a4e413e8d9c2a225fed3d5" name="yubikey-manager-qt-debugsource" arch="s390x">
  <version epoch="0" ver="1.2.5" rel="51.1"/>
  <changelog author="Karol Babioch &lt;kbabioch@suse.com&gt;" date="1561809600">- Version 1.1.2 (released 2019-06-24)
  * Add support for new YubiKey Preview
  * PIV: The popup for the management key now have a "Use default" option
  * Windows: Fix issue with importing PIV certificates
  * Bugfix: generate static password now works correctly</changelog>
  <changelog author="simmphonie@opensuse.org" date="1566388800">- Version 1.1.3 (released 2019-08-20)
  * Add suppport for YubiKey 5Ci
  * PIV: Use UTC time for self-signed certificates
- Version 1.1.2b (released 2019-06-26)
  * macOS: Fix build problem that caused communication with the OTP application to fail</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1582632000">- Update to version 1.1.4
  * OTP: Add option to upload YubiOTP credential to YubiCloud
  * Linux: Show hint about pcscd service if opening device fails
  * Bugfix: Signal handling now compatible with Python 3.8
- Set CONFIG=+hide_symbols so the compiler can generate better
  and smaller code knowing that no symbols need to be visible.</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1597665600">- update to 1.1.5
  * Add support for YubiKey 5C NFC</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620302400">- Update to version 1.2.2
  * Fix detection of YubiKey Plus
  * Compatibility update for yubikey-manager 4.0
  * Bugfix: Device caching with multiple devices
  * Drop dependencies on libusb and libykpers.
  * Add additional product names and images</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1621339200">- Update to version 1.2.3
  * Improved error handling when using Security Key Series devices.
  * PIV: Fix generation of certificate in slot 9c.</changelog>
  <changelog author="Torsten Gruner &lt;simmphonie@opensuse.org&gt;" date="1635768000">- Update to version 1.2.4 (released 2021-10-26)
  * Update device names and images.
  * PIV: Fix import of certificate.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1677844800">- update to 1.2.5:
  * Compatibility update for ykman 5.0.1.
  * Update to Python 3.11.
  * Update product images.
- add keyring for gpg validation</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1722859200">- Added yubikey-manager-qt_work_with_newer_ykman.patch (boo#1228877)
  make it work with ykman 5.5.1</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1722859201">- switch to autosetup</changelog>
</package>
<package pkgid="1a42862d6a20fae006da8ba5c98eef5fc451205eaac03a98f1330cd62e6a6f045cfa0c6aa042959502c461b3b309d5ff1fe1bf4c3e6d8b2bf7a3d8292b765b0c" name="yubikey-personalization-gui" arch="s390x">
  <version epoch="0" ver="3.1.25" rel="11.68"/>
  <changelog author="t.gruner@katodev.de" date="1418126400">- Version 3.1.18 (released 2014-11-28)
  - Image and correct features for plus.</changelog>
  <changelog author="t.gruner@katodev.de" date="1426507200">- Version 3.1.19 (released 2015-03-13)
  - Remove build timestamp.
  - Add picture of Neo-N</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430395200">- Build againt QT5.
- Respect optflags</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430740800">- Testing of previous change, reveals this package
  can't work without ykpers main package, add requires.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430827200">- Version 3.1.20
  * Some new pictures.
  * Add some simplistic unit tests.
  * Fix bug with translation of | in scancode to text.</changelog>
  <changelog author="t.gruner@katodev.de" date="1433246400">- Version 3.1.21 (released 2015-05-29)
  - Fix a bug where decode functions where given src length instead of result.
  - Fix an issue where test cases where installed by default.
  - Update pictures.</changelog>
  <changelog author="t.gruner@katodev.de" date="1443614400">- Version 3.1.22 (released 2015-09-25)
  - Fix so version detection works correctly for versions with more than one digit.
  - Add german keyboard layout.
  - Fixup neo-n picture
- fixes #56 - make sure scanedit is initialized
  - ------------------------------------------------------------------</changelog>
  <changelog author="t.gruner@katodev.de" date="1443700800">- Version 3.1.23 (released 2015-10-01)
  - Fix a bug that caused a crash on selecting keyboard layout.</changelog>
  <changelog author="t.gruner@katodev.de" date="1452168000">- Version 3.1.24 (released 2016-01-04)
  - Fix a bug when doing consecutive programming that reset id to 0.
  - Fix a case where the image on an old key might be shown momentarily.
  - Updated icons and images.
  - Updated mac and windows builds to qt 5.5.</changelog>
  <changelog author="t.gruner@katodev.de" date="1519214400">- Version 3.1.25 (released 2018-01-16)
  - Add oath ID for PSKC output.
  - Add french scancode options.
  - Improve static password format validation.
  - Change about heading.</changelog>
</package>
<package pkgid="5514add4be5ba836bb82ea82f05d10a4a22432247bb399a97d74ea51539ebd46db63b10ae0dcc149dd6f69f91064065dc9813d5371866863ff4b1545911d71f1" name="yubikey-personalization-gui" arch="src">
  <version epoch="0" ver="3.1.25" rel="11.68"/>
  <changelog author="t.gruner@katodev.de" date="1406030400">- Initial version packaged - 3.1.14</changelog>
  <changelog author="t.gruner@katodev.de" date="1410868800">- Version 3.1.16 (released 2014-09-16)
  - Fix bug where no random numbers where generated on windows.
- Version 3.1.15 (released 2014-09-11)
  - Add logging output format PSKC.
  - Force selection of keyboard layout before programing scancode mode.
  - Text changes.
  - New picture for YubiKey 3.3.</changelog>
  <changelog author="t.gruner@katodev.de" date="1415188800">- Version 3.1.17 (released 2014-10-30)
  - Fixup the Yubico logformat so accesscode is padded out with 0
  - Make texts translatable.
  - Include the accessibility plugin in bundles.
  - Show U2F as a feature.
  - Switch the mac bundle to qt5.</changelog>
  <changelog author="t.gruner@katodev.de" date="1418126400">- Version 3.1.18 (released 2014-11-28)
  - Image and correct features for plus.</changelog>
  <changelog author="t.gruner@katodev.de" date="1426507200">- Version 3.1.19 (released 2015-03-13)
  - Remove build timestamp.
  - Add picture of Neo-N</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430395200">- Build againt QT5.
- Respect optflags</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430740800">- Testing of previous change, reveals this package
  can't work without ykpers main package, add requires.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430827200">- Version 3.1.20
  * Some new pictures.
  * Add some simplistic unit tests.
  * Fix bug with translation of | in scancode to text.</changelog>
  <changelog author="t.gruner@katodev.de" date="1433246400">- Version 3.1.21 (released 2015-05-29)
  - Fix a bug where decode functions where given src length instead of result.
  - Fix an issue where test cases where installed by default.
  - Update pictures.</changelog>
  <changelog author="t.gruner@katodev.de" date="1443614400">- Version 3.1.22 (released 2015-09-25)
  - Fix so version detection works correctly for versions with more than one digit.
  - Add german keyboard layout.
  - Fixup neo-n picture
- fixes #56 - make sure scanedit is initialized
  - ------------------------------------------------------------------</changelog>
  <changelog author="t.gruner@katodev.de" date="1443700800">- Version 3.1.23 (released 2015-10-01)
  - Fix a bug that caused a crash on selecting keyboard layout.</changelog>
  <changelog author="t.gruner@katodev.de" date="1452168000">- Version 3.1.24 (released 2016-01-04)
  - Fix a bug when doing consecutive programming that reset id to 0.
  - Fix a case where the image on an old key might be shown momentarily.
  - Updated icons and images.
  - Updated mac and windows builds to qt 5.5.</changelog>
  <changelog author="t.gruner@katodev.de" date="1519214400">- Version 3.1.25 (released 2018-01-16)
  - Add oath ID for PSKC output.
  - Add french scancode options.
  - Improve static password format validation.
  - Change about heading.</changelog>
</package>
<package pkgid="2cdaed3510f3f8e84425d0722ce18477f71d9b6edbd03cb0714b960e0580f738ff27004ac193e4433627a4acd91dfbbab50507f2eaa67d4d66928716fe0a5434" name="yubikey-personalization-gui-debuginfo" arch="s390x">
  <version epoch="0" ver="3.1.25" rel="11.68"/>
  <changelog author="t.gruner@katodev.de" date="1418126400">- Version 3.1.18 (released 2014-11-28)
  - Image and correct features for plus.</changelog>
  <changelog author="t.gruner@katodev.de" date="1426507200">- Version 3.1.19 (released 2015-03-13)
  - Remove build timestamp.
  - Add picture of Neo-N</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430395200">- Build againt QT5.
- Respect optflags</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430740800">- Testing of previous change, reveals this package
  can't work without ykpers main package, add requires.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430827200">- Version 3.1.20
  * Some new pictures.
  * Add some simplistic unit tests.
  * Fix bug with translation of | in scancode to text.</changelog>
  <changelog author="t.gruner@katodev.de" date="1433246400">- Version 3.1.21 (released 2015-05-29)
  - Fix a bug where decode functions where given src length instead of result.
  - Fix an issue where test cases where installed by default.
  - Update pictures.</changelog>
  <changelog author="t.gruner@katodev.de" date="1443614400">- Version 3.1.22 (released 2015-09-25)
  - Fix so version detection works correctly for versions with more than one digit.
  - Add german keyboard layout.
  - Fixup neo-n picture
- fixes #56 - make sure scanedit is initialized
  - ------------------------------------------------------------------</changelog>
  <changelog author="t.gruner@katodev.de" date="1443700800">- Version 3.1.23 (released 2015-10-01)
  - Fix a bug that caused a crash on selecting keyboard layout.</changelog>
  <changelog author="t.gruner@katodev.de" date="1452168000">- Version 3.1.24 (released 2016-01-04)
  - Fix a bug when doing consecutive programming that reset id to 0.
  - Fix a case where the image on an old key might be shown momentarily.
  - Updated icons and images.
  - Updated mac and windows builds to qt 5.5.</changelog>
  <changelog author="t.gruner@katodev.de" date="1519214400">- Version 3.1.25 (released 2018-01-16)
  - Add oath ID for PSKC output.
  - Add french scancode options.
  - Improve static password format validation.
  - Change about heading.</changelog>
</package>
<package pkgid="5a9cb50c5f03a3d48541fd429d06a295a438f764f007abca82c8922dda2e3fa1f53ca66f8b0310ebc231a02b3c4c08341554374d3b1d08164de06626cb6951aa" name="yubikey-personalization-gui-debugsource" arch="s390x">
  <version epoch="0" ver="3.1.25" rel="11.68"/>
  <changelog author="t.gruner@katodev.de" date="1418126400">- Version 3.1.18 (released 2014-11-28)
  - Image and correct features for plus.</changelog>
  <changelog author="t.gruner@katodev.de" date="1426507200">- Version 3.1.19 (released 2015-03-13)
  - Remove build timestamp.
  - Add picture of Neo-N</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430395200">- Build againt QT5.
- Respect optflags</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430740800">- Testing of previous change, reveals this package
  can't work without ykpers main package, add requires.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1430827200">- Version 3.1.20
  * Some new pictures.
  * Add some simplistic unit tests.
  * Fix bug with translation of | in scancode to text.</changelog>
  <changelog author="t.gruner@katodev.de" date="1433246400">- Version 3.1.21 (released 2015-05-29)
  - Fix a bug where decode functions where given src length instead of result.
  - Fix an issue where test cases where installed by default.
  - Update pictures.</changelog>
  <changelog author="t.gruner@katodev.de" date="1443614400">- Version 3.1.22 (released 2015-09-25)
  - Fix so version detection works correctly for versions with more than one digit.
  - Add german keyboard layout.
  - Fixup neo-n picture
- fixes #56 - make sure scanedit is initialized
  - ------------------------------------------------------------------</changelog>
  <changelog author="t.gruner@katodev.de" date="1443700800">- Version 3.1.23 (released 2015-10-01)
  - Fix a bug that caused a crash on selecting keyboard layout.</changelog>
  <changelog author="t.gruner@katodev.de" date="1452168000">- Version 3.1.24 (released 2016-01-04)
  - Fix a bug when doing consecutive programming that reset id to 0.
  - Fix a case where the image on an old key might be shown momentarily.
  - Updated icons and images.
  - Updated mac and windows builds to qt 5.5.</changelog>
  <changelog author="t.gruner@katodev.de" date="1519214400">- Version 3.1.25 (released 2018-01-16)
  - Add oath ID for PSKC output.
  - Add french scancode options.
  - Improve static password format validation.
  - Change about heading.</changelog>
</package>
<package pkgid="50fc936eeb6c70a09f37debac4f7406b31677c79a35a1803a56a78f0bc6ebd643c3e5eb471520833332d1dd364d60c056ef1eb13753e40f92caf02762e31b7ef" name="yubioath-desktop" arch="s390x">
  <version epoch="0" ver="5.1.0" rel="28.26"/>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1559563200">- Use %license macro for license file (instead of %doc)</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1559563201">- Add release dates and reference to bug to changes file</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1575633600">- Version 5.0.1 (released 2019-10-16)
  - New colors for the account icons.
  - Use Roboto font on all platforms.
  - Increase some text sizes for better readability.
  - Change icon for the Settings button and move it to the left.
  - SysTray: Open application on double-click.
  - Terminology: Use "Accounts" instead of "Credentials".
  - Bugfix: Clear old accounts correctly when switching between devices.
  - Add keyboard shortcut (Ctrl/Cmd + i) for info popup.
- Version 5.0.0 (released 2019-09-23)
  - New UI based on Material Design and Qt Quick Controls 2
  - Add Dark Mode and Light Mode
  - Feature: Allow switching between connected YubiKeys
  - Feature: Select favorite credentials, available from the System Tray/Menu Bar
  - Show some information about the connected YubiKey, such as firmware version and serial number
  - Add experimental support for external smart card readers, enabling the use of a YubiKey over NFC
  - Add initial accessability support
- Version 4.3.6b (released 2019-06-11)
  - Fixes problem where YubiKey was not being detected on macOS.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1583064000">- Version 5.0.2
  - Allow spaces in secret key when adding accounts
  - UI: Move favorite button to the credential card
  - UI: Improved scrolling behaviour</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1591617600">- Remove fix build for Leap 15 and SLE 15
- Version 5.0.4 (released 2020-05-14)
  - New app icons on all platforms
  - Adjust the behaviour of the search bar, do not search accounts without having focus
  - Bugfix: Fix keyboard shortcut to copy account code
  - Bugfix: Show firmware version for YubiKey NEO correctly
  - Windows: Show correct version number in .msi installers
  - macOS: Fix issue with window positioning
  - macOS: Fix occacional crashes on startup
  - Linux: Fix the app icon and desktop entry for the Snap package.
- Version 5.0.3 (released 2020-04-14)
  - macOS: Make the app available in the macOS App Store
  - Windows: Make the app available in the Microsoft Store (for Windows 10 20.04 and higher)
  - Linux: Make the app available in the Snap Store
  - Add support for YubiKey 5C NFC
  - Bugfix: Make sure the application is always visible on Windows</changelog>
  <changelog author="Duncan Mac-Vicar &lt;dmacvicar@suse.de&gt;" date="1604491200">- Add missing requires:
  libqt5-qtgraphicaleffects and libqt5-qtquickcontrols2</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620302400">- Update to version 5.0.5
  * Compatibility update for yubikey-manager 4.0
  * Add additional product names.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1638446400">- Update to version 5.1.0
  * Support and manage FIDO-enabled YubiKeys.
  * Toggle applications over USB and NFC.
  * Major UI improvements.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1680177600">- Use gcc11 to build the package for Tumbleweed</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1683633600">- Switch Tumbleweed back to using the default compiler (gcc13)
- Add yubioath-desktop-gcc13.patch: fix build using gcc 13.</changelog>
</package>
<package pkgid="1852e98e0d80fcc10f9ffe292c498a83d0bd077ebe564dc6d434d73890f8d5f0688e4bf5c7227f7c73a111adf8a0b7d0b1b273b2be864592040397d22a1b48dc" name="yubioath-desktop" arch="src">
  <version epoch="0" ver="5.1.0" rel="28.26"/>
  <changelog author="t.gruner@katodev.de" date="1438084800">- Add "Requires: python-pyside" in .spec file</changelog>
  <changelog author="t.gruner@katodev.de" date="1440417600">- Add Workaround  (https://github.com/Yubico/yubioath-desktop/issues/26)
- Version 2.2.1 (released 2015-08-20)
  - Bugfix release: Fix adding credentials via the UI.
- Version 2.2.0 (released 2015-08-18)
  - Allow spaces in OATH keys.
  - Don’t crash if smartcard subsystem isn’t available.
  - Disable systray icon by default.
  - Added a flag to start the application minimized to the systray.
  - Added the ability to scan QR codes from the screen.</changelog>
  <changelog author="t.gruner@katodev.de" date="1445774400">- Fix dependencive in .spec file</changelog>
  <changelog author="t.gruner@katodev.de" date="1448366400">- Version 2.3.0 (released 2015-11-20)
  - Re-schedule timer each time period based on system time to prevent Qt timer drift.
  - Clear password memory cache on minimize to prevent accidentally leaving the YubiKey unlocked unattended.
  - Support for credentials which require touch (YubiKey 4 only).</changelog>
  <changelog author="t.gruner@katodev.de" date="1511870400">- Version 4.2.0+deps.2 (de-published)
    Identical to release 4.2.0+deps except it unpacks to a directory with the same name as the archive
  Version 4.2.0+deps (de-published)
    Identical to release 4.2.0b, but renamed to a valid Semantic Versioning version number
  Version 4.2.0b (de-published)
    Source re-release with dependencies bundled in the archive
  Version 4.2.0+2 (released 2017-11-17)
    Identical to release 4.2.0 except it unpacks to a directory with the same name as the archive
  Version 4.2.0 (released 2017-09-14)
    Added support for 7 digit credentials.
    Added support for credentials with a non 30-second period.
    Moved "Scan QR code" functionality, now available directly from main view.
    Flip moving direction of the time left indicator.
    Win 7: Fixed issue with OpenGL rendering.
    macOS: Allow OpenGL to use integrated GPU.
    Bugfix: Issuer was not displayed correctly on Ubuntu.
  Version 4.1.4 (released 2017-08-17)
    Double-click on system tray icon now shows the credentials. Not supported on macOS.
    Windows: An issue with the video drivers on some machines have been resolved.
    The About dialog now closes when the ESC key is pressed.
    UI: The credential codes should now follow any font scaling done by the operating system.
    UI: Codes now have a space in them for better readability.
  Version 4.1.3 (released 2017-08-03)
    Feature: Double-click to generate a code and copy it to the clipboard.
    Feature: When searching, press the ESC key to clear the search field and press Enter to generate and copy a code.
    Added an error message for adding a credential when there is no storage space left on the device.
    Added an error message for adding a too large key when in Slot mode.
    Clicking outside the search field now removes focus from it.
    Names on new credentials can’t be longer than 64 bytes.
    UI: Don’t show timer when there is no credentials.
    The default button in the password prompt is now OK.
    Bugfix: Fixed crash caused by some QR codes.
    Bugfix: The selected credential was not being updated correctly.
    macOS: Remove sandbox entitlements to work better when running on a system with gpg-agent.
  Version 4.1.2 (released 2017-05-12)
    Ubuntu: Fixed crash after entering password on Ubuntu 17.04
    Windows: Fixed issue with window spawning outside desktop.
  Version 4.1.1 (released 2017-05-09)
    Windows: Fixed issue with missing OpenGL drivers, include ANGLE in windows build.
    macOS: Fixed issue with incorrect linking to OpenSSL, causing the application to freeze when reading credentials.
    Bugfix: Touch credentials were not being selected correctly.
    Bugfix: Steam credentials were incorrect when read from a YubiKey 4.
  Version 4.1.0 (released 2017-04-10)
    Added a optional system tray shortcut.
    Sort credentials based on name.
    Improved scrolling, keep scroll position when credentials are reloaded.
    Bugfix: new passwords was always being cleared.
    Removed custom coloring of progress bar, use system theming.
  Version 4.0.1 (released 2017-03-27)
    Bugfix: Follow color schemes better.
    Removed some spacing thath caused the layout to be slightly off.
    Improved focus switching betweeen search bar and credentials.
    Added keyboard shortcut (Ctrl/Cmd + F) for focus on the search bar.
    Select the top credential during search.
    Remember window location and dimensions between launches.
    Add a Edit menu in the menu bar for credentials.
    Improved error logging.
    macOS: Close app with Cmd + W.
    Windows installer: install Visual C++ redistributable packages if needed.
  Version 4.0.0 (released 2017-03-20)
    The UI has been completely rewritten, to allow us to use a more modern technology stack. All main functionality and concepts are kept the same.
    CLI version has been removed from this porject, the functionality is now found in the YubiKey Manager (ykman) tool.
    Slot mode and CCID mode are now kept separated, choose which mode to use under "Settings".
    Added keyboard shortcuts for copy code, generate code, delete credential, add credential and settings.
    Added support for reseting all OATH credentials and password.
  Version 3.1.0b (released 2016-12-16)
    Fix crash on macOS related to how the application was built. New installer for macOS based on previous release.
  Version 3.1.0 (released 2016-11-22)
    Added a search bar for credentials.
    Added support for adding SHA256 credentials in the GUI.
    Smart card is now being disconnected when the application is hidden.
    Bugfix: QR codes were sometimes not being parsed.
  Version 3.0.1 (released 2016-06-13)
    Bugfix release:
    Don’t import OSX libs outside of OSX.
    Packaging related fixes.
  Version 3.0.0 (released 2016-06-09)
    Added compatibility with Python 3 (Python 2 is still supported).
    Added support for generating alphanumeric Steam authenticator codes for entries prefixed with "Steam:".
    Added a confirmation dialog box when overwriting entries.
    Added the capability to delete slot-based credentials.
    UX enhancements: split up issuer and name; added larger OTP codes.
    CLI was rewritten using the "click" library.
    CLI gained a "gui" subcommand which launches the full GUI.
    Binaries were renamed (yubioath → yubioath-gui, yubioath-cli → yubioath).</changelog>
  <changelog author="t.gruner@katodev.de" date="1515153600">- Version 4.3.2 (released 2017-12-19)
  - Bugfix: Fixed crash on attempt to generate code for touch credential in YubiKey Slots mode
  - Bugfix: Fixed crash in QR scan
- Version 4.3.1 (released 2017-12-17)
  - Bugfix: Removed references to QML Array prototype methods added in Qt 5.9 (unavailable in Ubuntu Zesty and earlier)
- Version 4.3.0 (released 2017-12-15)
  - Now requires ykman version &gt;= 0.5.0
  - Feature: New icon
  - Feature: Remembered passwords are now shared with ykman.
  - Feature: Added option to hide window on launch
  - Thanks to Steven Stallion for contributing!
  - Feature: "About" dialog now shows OATH applet version instead of overall firmware version
  - Feature: Touch credentials generate a code for the next period if current period ends in less than 10s
  - Feature: Arrow keys now navigate the list while search field has focus
  - Thanks to Arthur Burkart for contributing!
  - Feature: Focus now starts on the search field, and ESC no longer removes focus from search field
  - Feature: Added --log-level CLI option with same function as --log-level option to ykman version 0.5.0; see ykman --help for usage
  - Bugfix: Reduced idle CPU usage
  - Bugfix: Improved error handling to prevent hanging UI
  - Bugfix: Fixed tray icon remaining after exit on Windows
  - Bugfix: Fixed sorting when some credentials have nonstandard periods
  - Bugfix: Selection now stable across refreshes and searches
  - Bugfix: Arrow keys now scroll the view only if the selection changes</changelog>
  <changelog author="t.gruner@katodev.de" date="1519214400">- Version 4.3.3 (released 2018-02-15)
  - Focus is not locked on the search field.
  - Pressing ESC now clears the search field and deselects all credentials.
  - Copying the code with a keyboard shortcut now works even if the search field has focus.
  - The top progress bar is now only displayed when needed.
  - Scanning QR codes should now work better on some multiple monitor setups.
  - Improve the handling of touch credentials when the YubiKey is never touched.
  - The application should no longer refresh credentials to often on slower systems.
  - Credentials with a custom time period should now autorefresh correctly.
  - Logging: The command line option --log-file is now supported, which writes the log to a file. The --log-file option is ignored unless preceded by the --log-level option.
  - Bugfix: The arrow key navigation is no longer broken after deleting a credential.
  - Windows: OpenGL rendering is now chosen dynamically. It’s possible to override it with the QT_OPENGL environment variable.</changelog>
  <changelog author="t.gruner@katodev.de" date="1522756800">- Fix build for Leap 15 and SLE 15</changelog>
  <changelog author="t.gruner@katodev.de" date="1530532800">- Version 4.3.4 (released 2018-05-07)
  - Support YubiKey Preview
  - Add credential: allow space in secret key.
  - Bugfix: Don’t show "No credentials found…" incorrectly.
  - Bugfix: Forget the password when removing the device.
  - Windows: 64-bit version added.</changelog>
  <changelog author="Wolfgang Rosenauer &lt;wr@rosenauer.org&gt;" date="1559476800">- Version 4.3.6 (released 2019-05-29) (bsc#1137070)
  - Windows: improve support for YubiKey NEO on Windows 10
- Version 4.3.5 (released 2019-01-02)
  - Bugfix: Show correct message when YubiKey doesn’t have the
    correct transport enabled
  - Improve error handling in Slot Mode
  - Linux: Add experimental support for .AppImage</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1559563200">- Use %license macro for license file (instead of %doc)</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1559563201">- Add release dates and reference to bug to changes file</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1575633600">- Version 5.0.1 (released 2019-10-16)
  - New colors for the account icons.
  - Use Roboto font on all platforms.
  - Increase some text sizes for better readability.
  - Change icon for the Settings button and move it to the left.
  - SysTray: Open application on double-click.
  - Terminology: Use "Accounts" instead of "Credentials".
  - Bugfix: Clear old accounts correctly when switching between devices.
  - Add keyboard shortcut (Ctrl/Cmd + i) for info popup.
- Version 5.0.0 (released 2019-09-23)
  - New UI based on Material Design and Qt Quick Controls 2
  - Add Dark Mode and Light Mode
  - Feature: Allow switching between connected YubiKeys
  - Feature: Select favorite credentials, available from the System Tray/Menu Bar
  - Show some information about the connected YubiKey, such as firmware version and serial number
  - Add experimental support for external smart card readers, enabling the use of a YubiKey over NFC
  - Add initial accessability support
- Version 4.3.6b (released 2019-06-11)
  - Fixes problem where YubiKey was not being detected on macOS.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1583064000">- Version 5.0.2
  - Allow spaces in secret key when adding accounts
  - UI: Move favorite button to the credential card
  - UI: Improved scrolling behaviour</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1591617600">- Remove fix build for Leap 15 and SLE 15
- Version 5.0.4 (released 2020-05-14)
  - New app icons on all platforms
  - Adjust the behaviour of the search bar, do not search accounts without having focus
  - Bugfix: Fix keyboard shortcut to copy account code
  - Bugfix: Show firmware version for YubiKey NEO correctly
  - Windows: Show correct version number in .msi installers
  - macOS: Fix issue with window positioning
  - macOS: Fix occacional crashes on startup
  - Linux: Fix the app icon and desktop entry for the Snap package.
- Version 5.0.3 (released 2020-04-14)
  - macOS: Make the app available in the macOS App Store
  - Windows: Make the app available in the Microsoft Store (for Windows 10 20.04 and higher)
  - Linux: Make the app available in the Snap Store
  - Add support for YubiKey 5C NFC
  - Bugfix: Make sure the application is always visible on Windows</changelog>
  <changelog author="Duncan Mac-Vicar &lt;dmacvicar@suse.de&gt;" date="1604491200">- Add missing requires:
  libqt5-qtgraphicaleffects and libqt5-qtquickcontrols2</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620302400">- Update to version 5.0.5
  * Compatibility update for yubikey-manager 4.0
  * Add additional product names.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1638446400">- Update to version 5.1.0
  * Support and manage FIDO-enabled YubiKeys.
  * Toggle applications over USB and NFC.
  * Major UI improvements.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1680177600">- Use gcc11 to build the package for Tumbleweed</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1683633600">- Switch Tumbleweed back to using the default compiler (gcc13)
- Add yubioath-desktop-gcc13.patch: fix build using gcc 13.</changelog>
</package>
<package pkgid="b3b3086adf0ea33562ec1446f40a768db5a2a05cd534e8cef5d069239ac219e68864b8e66e2f2db63b4993e8859667d5400ed89dfde0d27ab50d6f37db3c8e9b" name="yubioath-desktop-debuginfo" arch="s390x">
  <version epoch="0" ver="5.1.0" rel="28.26"/>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1559563200">- Use %license macro for license file (instead of %doc)</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1559563201">- Add release dates and reference to bug to changes file</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1575633600">- Version 5.0.1 (released 2019-10-16)
  - New colors for the account icons.
  - Use Roboto font on all platforms.
  - Increase some text sizes for better readability.
  - Change icon for the Settings button and move it to the left.
  - SysTray: Open application on double-click.
  - Terminology: Use "Accounts" instead of "Credentials".
  - Bugfix: Clear old accounts correctly when switching between devices.
  - Add keyboard shortcut (Ctrl/Cmd + i) for info popup.
- Version 5.0.0 (released 2019-09-23)
  - New UI based on Material Design and Qt Quick Controls 2
  - Add Dark Mode and Light Mode
  - Feature: Allow switching between connected YubiKeys
  - Feature: Select favorite credentials, available from the System Tray/Menu Bar
  - Show some information about the connected YubiKey, such as firmware version and serial number
  - Add experimental support for external smart card readers, enabling the use of a YubiKey over NFC
  - Add initial accessability support
- Version 4.3.6b (released 2019-06-11)
  - Fixes problem where YubiKey was not being detected on macOS.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1583064000">- Version 5.0.2
  - Allow spaces in secret key when adding accounts
  - UI: Move favorite button to the credential card
  - UI: Improved scrolling behaviour</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1591617600">- Remove fix build for Leap 15 and SLE 15
- Version 5.0.4 (released 2020-05-14)
  - New app icons on all platforms
  - Adjust the behaviour of the search bar, do not search accounts without having focus
  - Bugfix: Fix keyboard shortcut to copy account code
  - Bugfix: Show firmware version for YubiKey NEO correctly
  - Windows: Show correct version number in .msi installers
  - macOS: Fix issue with window positioning
  - macOS: Fix occacional crashes on startup
  - Linux: Fix the app icon and desktop entry for the Snap package.
- Version 5.0.3 (released 2020-04-14)
  - macOS: Make the app available in the macOS App Store
  - Windows: Make the app available in the Microsoft Store (for Windows 10 20.04 and higher)
  - Linux: Make the app available in the Snap Store
  - Add support for YubiKey 5C NFC
  - Bugfix: Make sure the application is always visible on Windows</changelog>
  <changelog author="Duncan Mac-Vicar &lt;dmacvicar@suse.de&gt;" date="1604491200">- Add missing requires:
  libqt5-qtgraphicaleffects and libqt5-qtquickcontrols2</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620302400">- Update to version 5.0.5
  * Compatibility update for yubikey-manager 4.0
  * Add additional product names.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1638446400">- Update to version 5.1.0
  * Support and manage FIDO-enabled YubiKeys.
  * Toggle applications over USB and NFC.
  * Major UI improvements.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1680177600">- Use gcc11 to build the package for Tumbleweed</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1683633600">- Switch Tumbleweed back to using the default compiler (gcc13)
- Add yubioath-desktop-gcc13.patch: fix build using gcc 13.</changelog>
</package>
<package pkgid="8bb469f725c70352bdf30bad8bcc8d476abe6e6624634dc5221a309a8572a57d7445f44990f24c2d1227351a41775ff9938b11c3c0633a83d41f8c84c770cf3b" name="yubioath-desktop-debugsource" arch="s390x">
  <version epoch="0" ver="5.1.0" rel="28.26"/>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1559563200">- Use %license macro for license file (instead of %doc)</changelog>
  <changelog author="Karol Babioch &lt;kbabioch@suse.de&gt;" date="1559563201">- Add release dates and reference to bug to changes file</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1575633600">- Version 5.0.1 (released 2019-10-16)
  - New colors for the account icons.
  - Use Roboto font on all platforms.
  - Increase some text sizes for better readability.
  - Change icon for the Settings button and move it to the left.
  - SysTray: Open application on double-click.
  - Terminology: Use "Accounts" instead of "Credentials".
  - Bugfix: Clear old accounts correctly when switching between devices.
  - Add keyboard shortcut (Ctrl/Cmd + i) for info popup.
- Version 5.0.0 (released 2019-09-23)
  - New UI based on Material Design and Qt Quick Controls 2
  - Add Dark Mode and Light Mode
  - Feature: Allow switching between connected YubiKeys
  - Feature: Select favorite credentials, available from the System Tray/Menu Bar
  - Show some information about the connected YubiKey, such as firmware version and serial number
  - Add experimental support for external smart card readers, enabling the use of a YubiKey over NFC
  - Add initial accessability support
- Version 4.3.6b (released 2019-06-11)
  - Fixes problem where YubiKey was not being detected on macOS.</changelog>
  <changelog author="Marcus Rueckert &lt;mrueckert@suse.de&gt;" date="1583064000">- Version 5.0.2
  - Allow spaces in secret key when adding accounts
  - UI: Move favorite button to the credential card
  - UI: Improved scrolling behaviour</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1591617600">- Remove fix build for Leap 15 and SLE 15
- Version 5.0.4 (released 2020-05-14)
  - New app icons on all platforms
  - Adjust the behaviour of the search bar, do not search accounts without having focus
  - Bugfix: Fix keyboard shortcut to copy account code
  - Bugfix: Show firmware version for YubiKey NEO correctly
  - Windows: Show correct version number in .msi installers
  - macOS: Fix issue with window positioning
  - macOS: Fix occacional crashes on startup
  - Linux: Fix the app icon and desktop entry for the Snap package.
- Version 5.0.3 (released 2020-04-14)
  - macOS: Make the app available in the macOS App Store
  - Windows: Make the app available in the Microsoft Store (for Windows 10 20.04 and higher)
  - Linux: Make the app available in the Snap Store
  - Add support for YubiKey 5C NFC
  - Bugfix: Make sure the application is always visible on Windows</changelog>
  <changelog author="Duncan Mac-Vicar &lt;dmacvicar@suse.de&gt;" date="1604491200">- Add missing requires:
  libqt5-qtgraphicaleffects and libqt5-qtquickcontrols2</changelog>
  <changelog author="Ferdinand Thiessen &lt;rpm@fthiessen.de&gt;" date="1620302400">- Update to version 5.0.5
  * Compatibility update for yubikey-manager 4.0
  * Add additional product names.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1638446400">- Update to version 5.1.0
  * Support and manage FIDO-enabled YubiKeys.
  * Toggle applications over USB and NFC.
  * Major UI improvements.</changelog>
  <changelog author="Torsten Gruner &lt;t.gruner@katodev.de&gt;" date="1680177600">- Use gcc11 to build the package for Tumbleweed</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1683633600">- Switch Tumbleweed back to using the default compiler (gcc13)
- Add yubioath-desktop-gcc13.patch: fix build using gcc 13.</changelog>
</package>
<package pkgid="7390553869f895f3a98ab8be1f986eec40d03ee0a67942229aea83fe45e2789523008ed14343e26ffbafcc1d551d536f5c888ec2180096c23ec3b07cbb27f16a" name="zap" arch="noarch">
  <version epoch="0" ver="2.16.0" rel="4.10"/>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1620648000">- Updated to 2.10.0
- Removed 'Draconic' category from Desktop file
- Updated Java requirement to allow version 1.8 and higher</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1633953600">- Updated to 2.11.0
- Removed no more needed patches: create_dummy_files.patch and fix_shebang.patch</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1666958400">- Update to version 2.12.0:
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.12.0/
  Dec 15 13:07:44 UTC 2021 - Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;
- Updated to 2.11.1
- This upgrades to use a non-vulnerable version of the Log4J library.
- This upgrades to use a non-vulnerable version of the Log4J library (CVE-2021-44228).</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1689163200">- Update to version 2.13.0:
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.13.0/</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1697112000">- Update to version 2.14.0:
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.14.0/</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1715342400">- Update to version 2.15.0:
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.15.0/</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1715688000">- Fixed accidentally deleted .changes file.</changelog>
  <changelog author="Felix Felix &lt;felix@dumbeck.net&gt;" date="1733140800">- zap requires java 11+</changelog>
  <changelog author="Felix Felix &lt;felix@dumbeck.net&gt;" date="1737115200">- Update to version 2.16.0
  * now requires &gt; java 17
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.16.0/</changelog>
  <changelog author="Felix Felix &lt;felix@dumbeck.net&gt;" date="1737892800">- make zap.desktop launchable for KDE plasma again and remove %clean section</changelog>
</package>
<package pkgid="e64ecf59404ff3f8619a5e44781d814c1d97608d22157869130e72ce5057fba8cc7d30160d4f5cfcc115f309fcba06a77d152bc1ff0cdb6c7f490434357e4f06" name="zap" arch="src">
  <version epoch="0" ver="2.16.0" rel="4.10"/>
  <changelog author="vpereira@suse.com" date="1436875200">-  Added new version</changelog>
  <changelog author="vpereira@suse.com" date="1441627200">- Updated to 2.4.1</changelog>
  <changelog author="vpereira@suse.com" date="1441627201">- Updated to use java openjdk 8</changelog>
  <changelog author="vpereira@suse.com" date="1470052800">- Updated owasp-zap.desktop command path (boo#983812)</changelog>
  <changelog author="vpereira@suse.com" date="1471262400">- Updated owasp-zap.desktop command path with full path from zap.sh(boo#983812)</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1620648000">- Updated to 2.10.0
- Removed 'Draconic' category from Desktop file
- Updated Java requirement to allow version 1.8 and higher</changelog>
  <changelog author="Paolo Perego &lt;paolo.perego@suse.com&gt;" date="1633953600">- Updated to 2.11.0
- Removed no more needed patches: create_dummy_files.patch and fix_shebang.patch</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1666958400">- Update to version 2.12.0:
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.12.0/
  Dec 15 13:07:44 UTC 2021 - Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;
- Updated to 2.11.1
- This upgrades to use a non-vulnerable version of the Log4J library.
- This upgrades to use a non-vulnerable version of the Log4J library (CVE-2021-44228).</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1689163200">- Update to version 2.13.0:
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.13.0/</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1697112000">- Update to version 2.14.0:
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.14.0/</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1715342400">- Update to version 2.15.0:
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.15.0/</changelog>
  <changelog author="Alessandro de Oliveira Faria &lt;cabelo@opensuse.org&gt;" date="1715688000">- Fixed accidentally deleted .changes file.</changelog>
  <changelog author="Felix Felix &lt;felix@dumbeck.net&gt;" date="1733140800">- zap requires java 11+</changelog>
  <changelog author="Felix Felix &lt;felix@dumbeck.net&gt;" date="1737115200">- Update to version 2.16.0
  * now requires &gt; java 17
  * Release notes: https://www.zaproxy.org/docs/desktop/releases/2.16.0/</changelog>
  <changelog author="Felix Felix &lt;felix@dumbeck.net&gt;" date="1737892800">- make zap.desktop launchable for KDE plasma again and remove %clean section</changelog>
</package>
<package pkgid="b192818508876ed7e722956b1b5792dbf02b138d120861270d5163ac7f8c37d98d355ddc5a73b66de0e26850b3b8ce5e9086d1db242be39d93cc2c1eb9d6d27b" name="zizmor" arch="s390x">
  <version epoch="0" ver="1.28.0" rel="74.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760443200">- Update to version 1.15.1:
  * Bug Fixes
  - Fixed a bug where zizmor would fail to parse Dependabot
    configuration files due to missing support for some package
    ecosystems (#1240)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- Update to version 1.15.2:
  * Bug Fixes
  - Fixed a bug where zizmor would fail to parse some Dependabot
    configuration files due to missing support for some schedule
    formats (#1247)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761307200">- Update to version 1.16.0:
  * New Features
  - New audit: concurrency-limits detects insufficient
    concurrency limits in workflows (#1227)
  - Many thanks to @jwallwork23 for proposing and implementing
    this audit!
  * Performance Improvements
  - zizmor's online mode is now significantly (40% to over 95%)
    faster on common workloads, thanks to a combination of
    caching improvements and conversion of GitHub API requests
    into Git remote lookups (#1257)
  - Many thanks to @Bo98 for implementing these improvements!
  * Enhancements
  - When running in --fix mode and all fixes are successfully
    applied, zizmor now has similar exit code behavior as the
  - -no-exit-codes and --format=sarif flags (#1242)
  - Many thanks to @cnaples79 for implementing this improvement!
  - The dependabot-cooldown audit now supports auto-fixes for
    many findings (#1229)
  - Many thanks to @mostafa for implementing this improvement!
  - The dependabot-execution audit now supports auto-fixes for
    many findings (#1229)
  - Many thanks to @mostafa for implementing this improvement!
  - zizmor now has limited, experimental support for handling
    inputs that contain YAML anchors (#1266)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761739200">- Update to version 1.16.1:
  * Enhancements
  - zizmor now produces a more useful error message when asked to
    indirectly access a nonexistent or private repository via a
    uses: clause (without a sufficiently privileged GitHub token)
    (#1293)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762084800">- Update to version 1.16.2:
  * Enhancements
  - The concurrency-limits audit no longer flags explicit user
    concurrency overrides, e.g. cancel-in-progress: false (#1302)
  - zizmor now detects CI environments and specializes its panic
    handling accordingly, improving the quality of panic reports
    when running in CI (#1307)
  * Bug Fixes
  - Fixed a bug where zizmor would reject some Dependabot
    configuration files with logically unsound schedules (but
    that are accepted by GitHub regardless) (#1308)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762344000">- Update to version 1.16.3:
  * Bug Fixes
  - Fixed a bug where zizmor would crash on an unexpected caching
    middleware state. zizmor will now exit with a controlled
    error instead (#1319)
  * Dependencies
  - chore(deps): bump the cargo group with 2 updates (#1316)
  - chore(deps): bump the github-actions group with 3 updates
    (#1317)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764158400">- Update to version 1.17.0:
  * Enhancements
  - zizmor now produces a more useful error message when asked to
    collect only workflows from a remote input that contains no
    workflows (#1324)
  - zizmor now produces more precise severities on
    actions/checkout versions that have more misuse-resistant
    credentials persistence behavior (#1353)
  - Many thanks to @ManuelLerchnerQC for proposing and
    implementing this improvement!
  - The use-trusted-publishing audit now correctly detecting more
    "dry-run" patterns, making it significantly more accurate
    (#1357)
  - The obfuscation audit now detects usages of shell: cmd and
    similar, as the Windows CMD shell lacks a formal grammar and
    limits analysis of run: blocks in other audits (#1361)
  * Performance Improvements
  - zizmor's core has been refactored to be asynchronous, making
    online and I/O-heavy audits significantly faster. Typical
    user workloads should see speedups of 40% to 70% (#1314)
  * Bug Fixes
  - Fixed a bug where auto-fixes would fail to preserve a
    document's final newline (#1323)
  - zizmor now uses the native (OS) TLS roots when performing
    HTTPS requests, improving compatibility with user
    environments that perform TLS interception (#1328)
  - The github-env audit now falls back to assuming bash-like
    shell syntax in run: blocks if it can't infer the shell being
    used (#1336)
  - The concurrency-limits audit now correctly detects job-level
    concurrency settings, in addition to workflow-level settings
    (#1338)
  - Fixed a bug where zizmor would fail to collect workflows with
    names that overlapped with other input types (e.g. action.yml
    and dependabot.yml) when passed explicitly by path (#1345)
  * Dependencies
  - chore(deps): bump github/codeql-action in the github-actions
    group (#1331)
  - chore(deps): bump the cargo group with 3 updates (#1358)
  - chore(deps): bump the cargo group with 8 updates (#1330)
  - chore(deps): bump the github-actions group with 2 updates
    (#1343)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764849600">- Update to version 1.18.0:
  * Enhancements
  - The use-trusted-publishing audit now detects NuGet publishing
    commands (#1369)
  - The dependabot-cooldown audit now flags cooldown periods of
    less than 7 days by default (#1375)
  - The dependabot-cooldown audit can now be configured with a
    custom minimum cooldown period via
    rules.dependabot-cooldown.config.days (#1377)
  - zizmor now produces slightly more useful error messages when
    the user supplies an invalid configuration for the
    forbidden-uses audit (#1381)
  * Bug Fixes
  - Fixed additional edge cases where auto-fixed would fail to
    preserve a document's final newline (#1372)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145600">- Update to version 1.19.0:
  * New Features
  - New audit: archived-uses detects usages of archived
    repositories in uses: clauses (#1411)
  * Enhancements
  - The use-trusted-publishing audit now detects additional
    publishing command patterns, including common "wrapped"
    patterns like bundle exec gem publish (#1394)
  - zizmor now produces better error messages on a handful of
    error cases involving invalid input files. Specifically, a
    subset of syntax and schema errors now produce more detailed
    and actionable error messages (#1396)
  - The use-trusted-publishing audit now detects additional
    publishing command patterns, including uv run ..., uvx ...,
    and poetry publish (#1402)
  - zizmor now produces more useful and less ambiguous spans for
    many findings, particularly those from the
    anonymous-definition audit (#1416)
  - zizmor now discovers configuration files named zizmor.yaml,
    in addition to zizmor.yml (#1431)
  - zizmor now produces a more useful error message when input
    collection yields no inputs (#1439)
  - The --render-links flag now allows users to control zizmor's
    OSC 8 terminal link rendering behavior. This is particularly
    useful in environments that advertise themselves as terminals
    but fail to correctly render or ignore OSC 8 links (#1454)
  * Performance Improvements
  - The [impostor-commit] audit is now significantly faster on
    true positives, making true positive detection virtually as
    fast as true negative detection. In practice, true positive
    runs are over 100 times faster than before (#1429)
  * Bug Fixes
  - Fixed a bug where the obfuscation audit would crash if it
    encountered a CMD shell that was defined outside of the
    current step block (i.e. as a job or workflow default)
    (#1418)
  - Fixed a bug where the opentofu ecosystem was not recognized
    in Dependabot configuration files (#1452)
  - --color=always no longer implies --render-links=always, as
    some environments (like GitHub Actions) support ANSI color
    codes but fail to handle OSC escapes gracefully (#1454)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 1.20.0:
  * Enhancements
  - The excessive-permissions audit is now aware of the
    artifact-metadata and models permissions (#1461)
  - The cache-poisoning audit is now aware of the
    ramsey/composer-install action (#1489)
  - The unpinned-images audit is now significantly more precise
    in the presence of matrix references, e.g. image: ${{
    matrix.image }} (#1482)
  * Changes
  - The default policy for the unpinned-uses audit has changed
    from allowing ref-pinning for first-party actions (those
    under actions/* and similar) to requiring hash-pinning. This
    makes the default policy more strict, as well as more
    consistent across the actions ecosystem.
    Users who with to retain the old (permissive policy) for
    first-party actions may configure it explicitly in their
    zizmor.yml:
    zizmor.yml
    rules:
    unpinned-uses:
    config:
    policies:
    actions/*: ref-pin
    github/*: ref-pin
    dependabot/*: ref-pin
  * Bug Fixes
  - The dependabot-cooldown audit no longer flags missing
    cooldowns on ecosystems that don't (yet) support cooldowns,
    such as opentofu (#1480)
  - Fixed a false positive in the cache-poisoning audit where
    zizmor would treat empty strings (e.g. cache: '') as enabling
    rather than disabling caching (#1482)
  - Fixed two gaps in the use-trusted-publishing audit's
    detection of common yarn publishing commands (#1495)
  * Miscellaneous
  - zizmor's configuration now has an official JSON schema that
    will be available via SchemaStore soon!  Many thanks to
    @kiwamizamurai for implementing this improvement!</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768564800">- Update to version 1.21.0:
  * New Features
  - New audit: misfeature detects usage of GitHub Actions
    features that are considered "misfeatures." (#1517)
  * Enhancements
  - zizmor now uses exit code 3 to signal an audit that has
    failed because no input files were collected. See the exit
    code documentation for details (#1515)
  - The unpinned-uses audit now supports auto-fixes for many
    findings (#1525)
  * Changes
  - The obfuscation audit no longer flags shell: cmd. That check
    has been moved to the new misfeature audit. Users may need to
    update their ignore comments and/or configuration (#1517)
  * Bug Fixes
  - The unpinned-uses audit now flags reusable workflows that are
    unpinned, in addition to actions (#1509)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768824000">- Update to version 1.22.0:
  * Changes
  - The misfeature audit now only shows non-"well known" shell:
    findings when running with the "auditor" persona (#1532)
  * Bug Fixes
  - Fixed a bug where inputs containing CRLF line endings were
    not patched correctly by the unpinned-uses audit (#1536)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773057600">- Update to version 1.23.1:
  * Bug Fixes
  - Fixed a bug where zizmor would error if given both a GH_TOKEN
    and a GITHUB_TOKEN (or ZIZMOR_GITHUB_TOKEN) via the
    environment (#1724)
- Update to version 1.23.0:
  * New Features
  - New audit: secrets-outside-env detects usage of the secrets
    context in jobs that don't have a corresponding environment
    (#1599)
  - New audit: superfluous-actions detects usage of actions that
    perform operations already provided by GitHub's own runner
    images (#1618)
  * Enhancements
  - zizmor's LSP mode is now configuration-aware, and will load
    configuration files relative to workspace roots (#1555)
  - zizmor now reads the GITHUB_TOKEN environment variable as an
    alias/equivalent for GH_TOKEN (#1566)
  - zizmor now supports inputs that contain duplicated anchor
    names (#1575)
  - zizmor now flags missing cooldowns on opentofu ecosystem
    definitions in Dependabot (again) (#1586)
  - zizmor now reads the ZIZMOR_GITHUB_TOKEN environment variable
    as an alias/equivalent for GH_TOKEN and GITHUB_TOKEN (#1641)
  - The SARIF output format now adds zizmor/confidence,
    zizmor/persona and zizmor/severity to the properties of
    findings (#1656)
  - Added awalsh128/cache-apt-pkgs-action as a cache-aware action
    to the cache-poisoning audit (#1708)
  * Changes
  - SARIF categories have been regraded. zizmor's "medium" is
    changed from SARIF's "warning" to "low" (#1635)
  * Bug Fixes
  - Fixed a bug where zizmor would crash on uses: clauses
    containing non-significant whitespace while performing the
    unpinned-uses audit (#1544)
  - Fixed a bug in yamlpath where sequences containing anchors
    were splatted instead of being properly nested (#1557)
  - Fixed a bug in yamlpath where anchor prefixes in sequences
    and mapping were not stripped during path queries (#1562)
  - Fixed a bug where "merge into" autofixes would produce
    incorrect patches in the presence of multi-byte Unicode
    characters (#1581)
  - Fixed a bug where the template-injection audit would produce
    duplicated pedantic-only findings (#1589)
  - Fixed a bug where the obfuscation audit would produce
    incorrect autofixes for a subset of constant-reducible
    expressions (#1597)
  - Fixed a bug where the obfuscation audit would fail to apply
    fixes to a subset of inputs with leading whitespace (#1597)
  - Fixed a bug where the concurrency-limits audit would
    incorrectly flag reusable-only workflows as needing a
    concurrency: key (#1620)
  - Fixed a bug where the known-vulnerable-actions audit would
    fail when applying some fixes (#1640)
  - Fixed a bug where the pre-commit ecosystem was not recognized
    in Dependabot configuration files (#1637)
  - Fixed a bug where the template-injection audit would
    incorrectly flag github.triggering_actor as an injection risk
    in the default persona (#1645)
  - Fixed a bug where zizmor's expression parser did not
    correctly handle number literals in GitHub Actions
    expressions (#1625)
  - Fixed a bug where the template-injection audit would crash on
    some forms of multi-line expressions (#1669)
  - Fixed a bug where deserialization of a workflow containing
    fractional minutes would fail (#1675)
  - Fixed a bug where deserialization of a workflow where a
    workflow_run with a scalar types would fail (#1676)
  - Fixed a bug where zizmor would crash on workflows containing
    bare numeric values in if: conditions (#1683)
  - Fixed a bug where GitHub Actions expression string
    comparisons were not case-insensitive (#1687)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776081600">- Update to version 1.24.0:
  * New Features
  - zizmor now allows users to audit from stdin, by passing
    zizmor - (#1611)
  * Enhancements
  - The use-trusted-publishing audit now detects bun publish and
    bunx npm publish patterns (#1737)
  - zizmor's CLI help and usage output now uses a custom color
    scheme for improved readability (#1747)
  - The secrets-outside-env audit is now configurable with an
    allowlist of secret names that should not be flagged, even
    when referenced outside of an environment (#1759)
  - The dependabot-cooldown audit now emits a pedantic finding
    whenever it encounters a cooldown used with a
    multi-ecosystem-group, as the two do not interact well
    (#1780)
  - Recommend gh release upload as a replacement for
    svenstaro/upload-release-action in superfluous-actions
    (#1801)
  - Recommend gh issue create as a replacement for
    dacbd/create-issue-action in superfluous-actions (#1873)
  - The obfuscation audit now emits a finding for with: ${{ expr
    }} clauses cannot be analyzed (#1772)
  - zizmor --help is now rendered with option groups for improved
    readability (#1831)
  - zizmor's SARIF output now uses codeflows instead of related
    locations, improving its rendering behavior on GitHub
    Advanced Security (#1843)
  - The ref-version-mismatch audit now uses a more useful audit
    description for its findings (#1843)
  - The unpinned-images audit now produces more precise findings
    for image references that are computed through expressions
    (#1756)
  - The ref-version-mismatch audit now detects missing version
    comments as well (#1849)
  * Bug Fixes
  - Fixed a bug where the concurrency-limits audit reported
    findings at the job level instead of the workflow level
    (#1627)
  - Fixed a bug where with: ${{ expr }} clauses would cause a
    crash. artipacked audit emits a pedantic finding on such
    clauses. (#1772)
  - Fixed a bug where auto-fixes for the template-injection audit
    would fail to preserve an environment variable's casing
    (#1766)
  - Fixed a bug where the secrets-outside-env audit would
    incorrectly flag reusable workflows (#1777)
  - Fixed a bug where expressions containing Infinity or NaN
    would fail to parse (#1778)
  - Fixed several bugs where some parenthetical forms in
    expressions would fail to parse (#1779, #1856)
  - Fixed a bug where expressions with invalid identifiers (such
    as -Inf) would be incorrectly accepted (#1794)
  - Fixed a bug where the known-vulnerable-actions audit would
    fail to handle multiple discrete packages in a single
    advisory (#1810)
  - Fixed a bug where the template-injection audit would
    incorrectly flag needs.*.result as an injection risk in the
    default persona (#1814)
  - Fixed a bug where the unpinned-uses audit would product
    incorrect auto-fixes for actions with subpaths (#1841)
  - Fixed a bug where the ref-version-mismatch audit would fail
    to produce findings for comments containing nonexistent refs
    (#1853)
  - Fixed a bug where expressions containing NaN would be
    constant-evaluated incorrectly (#1858)
  - Fixed a bug where nix would not be recognized as a
    package-ecosystem in dependabot.yml (#1867)
  - Fixed a bug where the ref-version-mismatch audit would
    incorrectly parse prerelease version comments (such as #
    v6-beta), causing some findings to appear unresolvable
    (#1870)
  - Fixed a bug where various string comparisons in expressions
    did not perfectly match GitHub's own special uppercasing
    semantics (#1879)
  - Fixed a bug where zizmor would incorrectly contact github.com
    instead of the user's requested --gh-hostname for some online
    requests (#1874)
  - Fixed a bug where the artipacked audit would fail to honor
    the --no-online-audits flag (#1874)
  * Changes
  - The secrets-outside-env audit now only flags findings with
    the 'auditor' persona, due to numerous false positives and
    negatives caused by GitHub's platform limitations (primarily
    around interactions between environment secrets and reusable
    workflows) (#1777)
  - zizmor's handling of GitHub Actions expressions has been made
    stricter, and now rejects unknown functions and function
    calls with incorrect arities (#1823, #1826)
  - The superfluous-actions audit now uses the "pedantic" persona
    for some findings along with a medium or low confidence
    marker to signal when a action may not be easily replaced
    with built-in functionality (#1822, #1859)
  - The unpinned-uses audit no longer suggests auto-fixes for Git
    references that don't look like version tags, such as main
    (#1860)
  - The template-injection audit now considers more "URL-shaped"
    contexts to be fully attacker-controllable, rather than
    partially controllable (#1868)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776513600">- Update to version 1.24.1:
  * Bug Fixes
  - Fixed a bug where the ref-version-mismatch audit would
    incorrectly flag some version comments as not containing an
    appropriate version (#1900)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778846400">- Update to version 1.25.0:
  * New Features
  - zizmor's finding severities can now be remapped on a
    per-audit basis. See the configuration for details (#1913)
  - New audit: github-app detects dangerous usages of GitHub App
    installation tokens (#1926)
  - New audit: [unpinned-tools] detects actions that install
    tools without pinning to a specific version (#1820)
  - zizmor now accepts the --no-ignores flag to disable all
    ignore comments and configurations when reporting findings
    (#1935)
  - zizmor's LSP now honors the --persona flag on the CLI (#1943)
  - zizmor is now aware of Docker-based action definitions, in
    addition to the pre-existing support for "composite" actions
    (#1965)
  * Enhancements
  - Recommend gh issue edit --add-label / gh pr edit --add-label
    as a replacement for actions-ecosystem/action-add-labels in
    superfluous-actions
  - Recommend gh issue edit --remove-label / gh pr edit
  - -remove-label as a replacement for
    actions-ecosystem/action-remove-labels in superfluous-actions
  - Recommend jq as a replacement for sergeysova/jq-action in
    superfluous-actions
  - Recommend git add, git commit, and git push as a replacement
    for stefanzweifel/git-auto-commit-action in
    superfluous-actions
  - Recommend git add, git commit, and git push as a replacement
    for EndBug/add-and-commit in superfluous-actions
  - tibdex/github-app-token is now recognized as an archived
    action by archived-uses (#1910)
  - The [dangerous-triggers] audit now explicitly exempts
    workflows that only invoke actions/labeler (#1956)
  - The unpinned-images audit now detects unpinned image
    references in Docker-based action definitions (#1965)
  - zizmor's SARIF output now provides slightly more detailed
    finding messages (#1972)
  - The archived-uses audit now detects more archived actions
    (#1978)
  - deno is now recognized as a package-ecosystem in
    dependabot.yml (#1991)
  * Performance Improvements
  - The impostor-commit audit is now significantly faster (in
    addition to being more correct) when the user has pinned
    their action to a tag SHA instead of a commit SHA (#1998)
  * Bug Fixes
  - Fixed a crash in the template-injection audit when a workflow
    uses a parenthesized compound expression in context position
    (#1904)
  - Fixed a bug where local directory input collection could miss
    workflows for relative-path invocations from within .github
    subdirectories (#1909)
  - Fixed a bug where the unpinned-images audit would miss images
    defined in container: clauses (#1944)
  - Fixed a bug where inline ignore comments could not be easily
    applied to superfluous-actions findings (#1945)
  - Fixed a bug where the cache-poisoning audit would fail to
    detect some release trigger patterns (#1946)
  - Fixed a bug where inline ignore comments could not be easily
    applied to cache-poisoning findings (#1962)
  - Fixed a class of imprecisions where the cache-poisoning audit
    would incorrectly flag cache usage that doesn't actually
    occur on release events (#1940)
  - Fixed a bug where dependabot.yml files containing a private
    cargo repository couldn't be parsed (#1976)
  - Fixed a bug where zizmor's input validation warnings lacked a
    mention of which files failed to validate (#1980)
  - Fixed a bug where the impostor-commit audit would falsely
    indicate impostor commits if an action was pinned to a tag
    SHA instead of a commit SHA (#1998)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 1.25.2:
  * Bug Fixes
  - Fixed a bug where the unpinned-tools audit would incorrectly
    flag the aquasecurity/trivy-action action as installing an
    unpinned tool version, rather than aquasecurity/setup-trivy
    (#2018)
- Update to version 1.25.1:
  * Bug Fixes
  - Fixed a bug where the cache-poisoning audit would fail to
    consider release events as exempt from cache usage findings
    when filtered by a tag condition (#2004)
  - Fixed a typo when suggesting --fix flags for findings (#2010)
  - Fixed a typo in unpinned-tools annotations (#2008)
  - Fixed a bug where the github-app audit would incorrectly flag
    some safe uses of actions/create-github-app-token as unsafe
    (#2011)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782043200">- Update to version 1.26.1:
  This is a small corrective release for 1.26.0.
- Update to version 1.26.0:
  * New Features
  - New audit: typosquat-uses detects uses: clauses that
    reference likely typoed actions (#1985)
  - New audit: unsound-ternary detects pseudo-ternary expressions
    that don't evaluate as expected (#2085)
  - New audit: adhoc-packages detects run: steps that install
    packages in an ad-hoc manner (#2061)
  * Enhancements
  - The cache-poisoning audit now detects additional cache
    disablement heuristics (#2053)
  - The known-vulnerable-actions audit is now configurable. See
    the configuration documentation for details (#2084)
  - The excessive-permissions audit is now aware of the
    code-quality permission (#2088)
  - The unpinned-uses audit's auto-fix now uses the fully
    qualified version tag (e.g. # v6.0.2) when fixing a
    major-version ref (e.g. @v6) (#2127)
  * Performance Improvements
  - Most online audits are significantly faster, thanks to more
    precise retry handling (#2036)
  * Bug Fixes
  - Fixed a bug where zizmor's LSP would not recognize
    dependabot.yaml files in its default configuration (#2026)
  - Fixed a bug where ref-version-mismatch would fail to fully
    match some version comments (#2040)
  - Fixed a bug where dependabot-cooldown would fail to honor the
    user's configured days when performing autofixes (#2055)
  - Steps and jobs gated by statically-false if: conditions (e.g.
    if: false, if: ${{ false }}) are now skipped during auditing,
    since they cannot execute (#2059, #2069)
  - Fixed a bug where ref-version-mismatch would fail to identify
    some valid version comments (#2073)
  - Fixed a bug where unpinned-images would incorrectly flag
    empty matrix expansions as unpinned container image
    references (#2102)
  - Fixed a bug where unpinned-images would incorrectly flag some
    matrix expansions as unpinned (#2098)
  - The SARIF (--format=sarif) and GitHub Annotations
    (--format=github) output formats now provide more
    correct/useful paths, particularly when the user provides a
    relative path as input to zizmor rather than zizmor . (#1748,
    [#2095])
  * Changes
  - The impostor-commit audit no longer suggests auto-fixes, to
    avoid incorrectly minimizing the amount of manual remediation
    work needed (#2054)
  - The JSON and SARIF outputs no longer contain a misleading
    prefix key (#2095)
  * Dependencies
  - chore(deps): bump http from 1.4.1 to 1.4.2 in the cargo group
    (#2125)
  - chore(deps): bump the github-actions group across 1 directory
    with 3 updates (#2119)
  - chore(deps): bump the cargo group across 1 directory with 2
    updates (#2118)
  - chore(deps): bump CodSpeedHQ/action from 4.15.1 to 4.17.0 in
    the github-actions group (#2109)
  - chore(deps): bump the github-actions group with 5 updates
    (#2091)
  - chore(deps): bump the cargo group with 5 updates (#2090)
  - chore(deps): bump the cargo group with 3 updates (#2066)
  - chore(deps): bump the github-actions group with 2 updates
    (#2067)
  - chore(deps): bump the cargo group with 3 updates (#2034)
  - chore(deps): bump the github-actions group with 2 updates
    (#2035)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784030400">- Update to version 1.27.0:
  * New Features
  - zizmor now has experimental support for workflows that
    specify parallel steps. See Usage - Parallel steps for more
    information (#2153)
  * Enhancements
  - zizmor's handling of paths is now more consistent,
    particularly when run on Windows (#2163)
  - zizmor now emits a helpful warning when being run in implicit
    offline mode (#2180)
  * Bug Fixes
  - Fixed a bug where the secrets-outside-env audit would not
    honor ignore comments within the same job scope (#2157)
  - Fixed a bug where the ref-version-mismatch audit would not
    honor ignore comments within the same steps scope (#2177)
  - Fixed a bug where --collect=[MODE] was not correctly handled
    when auditing remote inputs (#2185)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784721600">- Update to version 1.28.0:
  * Security
  - v1.27.0 contained a logging defect that would print any
    configured GitHub credentials as part of zizmor's cleartext
    logging. No versions other than v1.27.0 were affected. See
    GHSA-f42p-wjw5-97qh for full information.
  - Many thanks to @shaanmajid for finding and reporting this
    vulnerability.
  * Enhancements
  - The JSON (v1) output format now includes metadata for each
    finding's fixes, if the finding has fixes (#2186)
  - The dependabot-cooldown audit is now aware of GitHub's new
    three-day default cooldown (#2193)
  - sbt is now recognized as a package-ecosystem in
    dependabot.yml (#2211)
  * Bug Fixes
  - Fixed a bug where the template-injection audit would
    incorrectly flag steps..outcome and steps..conclusion as
    injection risks in the default persona (#2199)
  - Fixed a bug where the github-env audit would incorrectly flag
    some printf calls as exploitable (#2201)
  - Fixed a bug where zizmor would produce a misleading and
    confusing error message when asked to audit an ambiguous
    remote input (#2205)</changelog>
</package>
<package pkgid="d72500770a6ac59311078570dcddf1c12f425e13340dcad508d0ac3f35dd40ae36fee8ee689866db7ad942411df406727b787803031a7f4a11e1e8e133cce309" name="zizmor" arch="src">
  <version epoch="0" ver="1.28.0" rel="74.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760443200">- Update to version 1.15.1:
  * Bug Fixes
  - Fixed a bug where zizmor would fail to parse Dependabot
    configuration files due to missing support for some package
    ecosystems (#1240)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- Update to version 1.15.2:
  * Bug Fixes
  - Fixed a bug where zizmor would fail to parse some Dependabot
    configuration files due to missing support for some schedule
    formats (#1247)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761307200">- Update to version 1.16.0:
  * New Features
  - New audit: concurrency-limits detects insufficient
    concurrency limits in workflows (#1227)
  - Many thanks to @jwallwork23 for proposing and implementing
    this audit!
  * Performance Improvements
  - zizmor's online mode is now significantly (40% to over 95%)
    faster on common workloads, thanks to a combination of
    caching improvements and conversion of GitHub API requests
    into Git remote lookups (#1257)
  - Many thanks to @Bo98 for implementing these improvements!
  * Enhancements
  - When running in --fix mode and all fixes are successfully
    applied, zizmor now has similar exit code behavior as the
  - -no-exit-codes and --format=sarif flags (#1242)
  - Many thanks to @cnaples79 for implementing this improvement!
  - The dependabot-cooldown audit now supports auto-fixes for
    many findings (#1229)
  - Many thanks to @mostafa for implementing this improvement!
  - The dependabot-execution audit now supports auto-fixes for
    many findings (#1229)
  - Many thanks to @mostafa for implementing this improvement!
  - zizmor now has limited, experimental support for handling
    inputs that contain YAML anchors (#1266)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761739200">- Update to version 1.16.1:
  * Enhancements
  - zizmor now produces a more useful error message when asked to
    indirectly access a nonexistent or private repository via a
    uses: clause (without a sufficiently privileged GitHub token)
    (#1293)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762084800">- Update to version 1.16.2:
  * Enhancements
  - The concurrency-limits audit no longer flags explicit user
    concurrency overrides, e.g. cancel-in-progress: false (#1302)
  - zizmor now detects CI environments and specializes its panic
    handling accordingly, improving the quality of panic reports
    when running in CI (#1307)
  * Bug Fixes
  - Fixed a bug where zizmor would reject some Dependabot
    configuration files with logically unsound schedules (but
    that are accepted by GitHub regardless) (#1308)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762344000">- Update to version 1.16.3:
  * Bug Fixes
  - Fixed a bug where zizmor would crash on an unexpected caching
    middleware state. zizmor will now exit with a controlled
    error instead (#1319)
  * Dependencies
  - chore(deps): bump the cargo group with 2 updates (#1316)
  - chore(deps): bump the github-actions group with 3 updates
    (#1317)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764158400">- Update to version 1.17.0:
  * Enhancements
  - zizmor now produces a more useful error message when asked to
    collect only workflows from a remote input that contains no
    workflows (#1324)
  - zizmor now produces more precise severities on
    actions/checkout versions that have more misuse-resistant
    credentials persistence behavior (#1353)
  - Many thanks to @ManuelLerchnerQC for proposing and
    implementing this improvement!
  - The use-trusted-publishing audit now correctly detecting more
    "dry-run" patterns, making it significantly more accurate
    (#1357)
  - The obfuscation audit now detects usages of shell: cmd and
    similar, as the Windows CMD shell lacks a formal grammar and
    limits analysis of run: blocks in other audits (#1361)
  * Performance Improvements
  - zizmor's core has been refactored to be asynchronous, making
    online and I/O-heavy audits significantly faster. Typical
    user workloads should see speedups of 40% to 70% (#1314)
  * Bug Fixes
  - Fixed a bug where auto-fixes would fail to preserve a
    document's final newline (#1323)
  - zizmor now uses the native (OS) TLS roots when performing
    HTTPS requests, improving compatibility with user
    environments that perform TLS interception (#1328)
  - The github-env audit now falls back to assuming bash-like
    shell syntax in run: blocks if it can't infer the shell being
    used (#1336)
  - The concurrency-limits audit now correctly detects job-level
    concurrency settings, in addition to workflow-level settings
    (#1338)
  - Fixed a bug where zizmor would fail to collect workflows with
    names that overlapped with other input types (e.g. action.yml
    and dependabot.yml) when passed explicitly by path (#1345)
  * Dependencies
  - chore(deps): bump github/codeql-action in the github-actions
    group (#1331)
  - chore(deps): bump the cargo group with 3 updates (#1358)
  - chore(deps): bump the cargo group with 8 updates (#1330)
  - chore(deps): bump the github-actions group with 2 updates
    (#1343)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764849600">- Update to version 1.18.0:
  * Enhancements
  - The use-trusted-publishing audit now detects NuGet publishing
    commands (#1369)
  - The dependabot-cooldown audit now flags cooldown periods of
    less than 7 days by default (#1375)
  - The dependabot-cooldown audit can now be configured with a
    custom minimum cooldown period via
    rules.dependabot-cooldown.config.days (#1377)
  - zizmor now produces slightly more useful error messages when
    the user supplies an invalid configuration for the
    forbidden-uses audit (#1381)
  * Bug Fixes
  - Fixed additional edge cases where auto-fixed would fail to
    preserve a document's final newline (#1372)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145600">- Update to version 1.19.0:
  * New Features
  - New audit: archived-uses detects usages of archived
    repositories in uses: clauses (#1411)
  * Enhancements
  - The use-trusted-publishing audit now detects additional
    publishing command patterns, including common "wrapped"
    patterns like bundle exec gem publish (#1394)
  - zizmor now produces better error messages on a handful of
    error cases involving invalid input files. Specifically, a
    subset of syntax and schema errors now produce more detailed
    and actionable error messages (#1396)
  - The use-trusted-publishing audit now detects additional
    publishing command patterns, including uv run ..., uvx ...,
    and poetry publish (#1402)
  - zizmor now produces more useful and less ambiguous spans for
    many findings, particularly those from the
    anonymous-definition audit (#1416)
  - zizmor now discovers configuration files named zizmor.yaml,
    in addition to zizmor.yml (#1431)
  - zizmor now produces a more useful error message when input
    collection yields no inputs (#1439)
  - The --render-links flag now allows users to control zizmor's
    OSC 8 terminal link rendering behavior. This is particularly
    useful in environments that advertise themselves as terminals
    but fail to correctly render or ignore OSC 8 links (#1454)
  * Performance Improvements
  - The [impostor-commit] audit is now significantly faster on
    true positives, making true positive detection virtually as
    fast as true negative detection. In practice, true positive
    runs are over 100 times faster than before (#1429)
  * Bug Fixes
  - Fixed a bug where the obfuscation audit would crash if it
    encountered a CMD shell that was defined outside of the
    current step block (i.e. as a job or workflow default)
    (#1418)
  - Fixed a bug where the opentofu ecosystem was not recognized
    in Dependabot configuration files (#1452)
  - --color=always no longer implies --render-links=always, as
    some environments (like GitHub Actions) support ANSI color
    codes but fail to handle OSC escapes gracefully (#1454)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 1.20.0:
  * Enhancements
  - The excessive-permissions audit is now aware of the
    artifact-metadata and models permissions (#1461)
  - The cache-poisoning audit is now aware of the
    ramsey/composer-install action (#1489)
  - The unpinned-images audit is now significantly more precise
    in the presence of matrix references, e.g. image: ${{
    matrix.image }} (#1482)
  * Changes
  - The default policy for the unpinned-uses audit has changed
    from allowing ref-pinning for first-party actions (those
    under actions/* and similar) to requiring hash-pinning. This
    makes the default policy more strict, as well as more
    consistent across the actions ecosystem.
    Users who with to retain the old (permissive policy) for
    first-party actions may configure it explicitly in their
    zizmor.yml:
    zizmor.yml
    rules:
    unpinned-uses:
    config:
    policies:
    actions/*: ref-pin
    github/*: ref-pin
    dependabot/*: ref-pin
  * Bug Fixes
  - The dependabot-cooldown audit no longer flags missing
    cooldowns on ecosystems that don't (yet) support cooldowns,
    such as opentofu (#1480)
  - Fixed a false positive in the cache-poisoning audit where
    zizmor would treat empty strings (e.g. cache: '') as enabling
    rather than disabling caching (#1482)
  - Fixed two gaps in the use-trusted-publishing audit's
    detection of common yarn publishing commands (#1495)
  * Miscellaneous
  - zizmor's configuration now has an official JSON schema that
    will be available via SchemaStore soon!  Many thanks to
    @kiwamizamurai for implementing this improvement!</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768564800">- Update to version 1.21.0:
  * New Features
  - New audit: misfeature detects usage of GitHub Actions
    features that are considered "misfeatures." (#1517)
  * Enhancements
  - zizmor now uses exit code 3 to signal an audit that has
    failed because no input files were collected. See the exit
    code documentation for details (#1515)
  - The unpinned-uses audit now supports auto-fixes for many
    findings (#1525)
  * Changes
  - The obfuscation audit no longer flags shell: cmd. That check
    has been moved to the new misfeature audit. Users may need to
    update their ignore comments and/or configuration (#1517)
  * Bug Fixes
  - The unpinned-uses audit now flags reusable workflows that are
    unpinned, in addition to actions (#1509)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768824000">- Update to version 1.22.0:
  * Changes
  - The misfeature audit now only shows non-"well known" shell:
    findings when running with the "auditor" persona (#1532)
  * Bug Fixes
  - Fixed a bug where inputs containing CRLF line endings were
    not patched correctly by the unpinned-uses audit (#1536)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773057600">- Update to version 1.23.1:
  * Bug Fixes
  - Fixed a bug where zizmor would error if given both a GH_TOKEN
    and a GITHUB_TOKEN (or ZIZMOR_GITHUB_TOKEN) via the
    environment (#1724)
- Update to version 1.23.0:
  * New Features
  - New audit: secrets-outside-env detects usage of the secrets
    context in jobs that don't have a corresponding environment
    (#1599)
  - New audit: superfluous-actions detects usage of actions that
    perform operations already provided by GitHub's own runner
    images (#1618)
  * Enhancements
  - zizmor's LSP mode is now configuration-aware, and will load
    configuration files relative to workspace roots (#1555)
  - zizmor now reads the GITHUB_TOKEN environment variable as an
    alias/equivalent for GH_TOKEN (#1566)
  - zizmor now supports inputs that contain duplicated anchor
    names (#1575)
  - zizmor now flags missing cooldowns on opentofu ecosystem
    definitions in Dependabot (again) (#1586)
  - zizmor now reads the ZIZMOR_GITHUB_TOKEN environment variable
    as an alias/equivalent for GH_TOKEN and GITHUB_TOKEN (#1641)
  - The SARIF output format now adds zizmor/confidence,
    zizmor/persona and zizmor/severity to the properties of
    findings (#1656)
  - Added awalsh128/cache-apt-pkgs-action as a cache-aware action
    to the cache-poisoning audit (#1708)
  * Changes
  - SARIF categories have been regraded. zizmor's "medium" is
    changed from SARIF's "warning" to "low" (#1635)
  * Bug Fixes
  - Fixed a bug where zizmor would crash on uses: clauses
    containing non-significant whitespace while performing the
    unpinned-uses audit (#1544)
  - Fixed a bug in yamlpath where sequences containing anchors
    were splatted instead of being properly nested (#1557)
  - Fixed a bug in yamlpath where anchor prefixes in sequences
    and mapping were not stripped during path queries (#1562)
  - Fixed a bug where "merge into" autofixes would produce
    incorrect patches in the presence of multi-byte Unicode
    characters (#1581)
  - Fixed a bug where the template-injection audit would produce
    duplicated pedantic-only findings (#1589)
  - Fixed a bug where the obfuscation audit would produce
    incorrect autofixes for a subset of constant-reducible
    expressions (#1597)
  - Fixed a bug where the obfuscation audit would fail to apply
    fixes to a subset of inputs with leading whitespace (#1597)
  - Fixed a bug where the concurrency-limits audit would
    incorrectly flag reusable-only workflows as needing a
    concurrency: key (#1620)
  - Fixed a bug where the known-vulnerable-actions audit would
    fail when applying some fixes (#1640)
  - Fixed a bug where the pre-commit ecosystem was not recognized
    in Dependabot configuration files (#1637)
  - Fixed a bug where the template-injection audit would
    incorrectly flag github.triggering_actor as an injection risk
    in the default persona (#1645)
  - Fixed a bug where zizmor's expression parser did not
    correctly handle number literals in GitHub Actions
    expressions (#1625)
  - Fixed a bug where the template-injection audit would crash on
    some forms of multi-line expressions (#1669)
  - Fixed a bug where deserialization of a workflow containing
    fractional minutes would fail (#1675)
  - Fixed a bug where deserialization of a workflow where a
    workflow_run with a scalar types would fail (#1676)
  - Fixed a bug where zizmor would crash on workflows containing
    bare numeric values in if: conditions (#1683)
  - Fixed a bug where GitHub Actions expression string
    comparisons were not case-insensitive (#1687)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776081600">- Update to version 1.24.0:
  * New Features
  - zizmor now allows users to audit from stdin, by passing
    zizmor - (#1611)
  * Enhancements
  - The use-trusted-publishing audit now detects bun publish and
    bunx npm publish patterns (#1737)
  - zizmor's CLI help and usage output now uses a custom color
    scheme for improved readability (#1747)
  - The secrets-outside-env audit is now configurable with an
    allowlist of secret names that should not be flagged, even
    when referenced outside of an environment (#1759)
  - The dependabot-cooldown audit now emits a pedantic finding
    whenever it encounters a cooldown used with a
    multi-ecosystem-group, as the two do not interact well
    (#1780)
  - Recommend gh release upload as a replacement for
    svenstaro/upload-release-action in superfluous-actions
    (#1801)
  - Recommend gh issue create as a replacement for
    dacbd/create-issue-action in superfluous-actions (#1873)
  - The obfuscation audit now emits a finding for with: ${{ expr
    }} clauses cannot be analyzed (#1772)
  - zizmor --help is now rendered with option groups for improved
    readability (#1831)
  - zizmor's SARIF output now uses codeflows instead of related
    locations, improving its rendering behavior on GitHub
    Advanced Security (#1843)
  - The ref-version-mismatch audit now uses a more useful audit
    description for its findings (#1843)
  - The unpinned-images audit now produces more precise findings
    for image references that are computed through expressions
    (#1756)
  - The ref-version-mismatch audit now detects missing version
    comments as well (#1849)
  * Bug Fixes
  - Fixed a bug where the concurrency-limits audit reported
    findings at the job level instead of the workflow level
    (#1627)
  - Fixed a bug where with: ${{ expr }} clauses would cause a
    crash. artipacked audit emits a pedantic finding on such
    clauses. (#1772)
  - Fixed a bug where auto-fixes for the template-injection audit
    would fail to preserve an environment variable's casing
    (#1766)
  - Fixed a bug where the secrets-outside-env audit would
    incorrectly flag reusable workflows (#1777)
  - Fixed a bug where expressions containing Infinity or NaN
    would fail to parse (#1778)
  - Fixed several bugs where some parenthetical forms in
    expressions would fail to parse (#1779, #1856)
  - Fixed a bug where expressions with invalid identifiers (such
    as -Inf) would be incorrectly accepted (#1794)
  - Fixed a bug where the known-vulnerable-actions audit would
    fail to handle multiple discrete packages in a single
    advisory (#1810)
  - Fixed a bug where the template-injection audit would
    incorrectly flag needs.*.result as an injection risk in the
    default persona (#1814)
  - Fixed a bug where the unpinned-uses audit would product
    incorrect auto-fixes for actions with subpaths (#1841)
  - Fixed a bug where the ref-version-mismatch audit would fail
    to produce findings for comments containing nonexistent refs
    (#1853)
  - Fixed a bug where expressions containing NaN would be
    constant-evaluated incorrectly (#1858)
  - Fixed a bug where nix would not be recognized as a
    package-ecosystem in dependabot.yml (#1867)
  - Fixed a bug where the ref-version-mismatch audit would
    incorrectly parse prerelease version comments (such as #
    v6-beta), causing some findings to appear unresolvable
    (#1870)
  - Fixed a bug where various string comparisons in expressions
    did not perfectly match GitHub's own special uppercasing
    semantics (#1879)
  - Fixed a bug where zizmor would incorrectly contact github.com
    instead of the user's requested --gh-hostname for some online
    requests (#1874)
  - Fixed a bug where the artipacked audit would fail to honor
    the --no-online-audits flag (#1874)
  * Changes
  - The secrets-outside-env audit now only flags findings with
    the 'auditor' persona, due to numerous false positives and
    negatives caused by GitHub's platform limitations (primarily
    around interactions between environment secrets and reusable
    workflows) (#1777)
  - zizmor's handling of GitHub Actions expressions has been made
    stricter, and now rejects unknown functions and function
    calls with incorrect arities (#1823, #1826)
  - The superfluous-actions audit now uses the "pedantic" persona
    for some findings along with a medium or low confidence
    marker to signal when a action may not be easily replaced
    with built-in functionality (#1822, #1859)
  - The unpinned-uses audit no longer suggests auto-fixes for Git
    references that don't look like version tags, such as main
    (#1860)
  - The template-injection audit now considers more "URL-shaped"
    contexts to be fully attacker-controllable, rather than
    partially controllable (#1868)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776513600">- Update to version 1.24.1:
  * Bug Fixes
  - Fixed a bug where the ref-version-mismatch audit would
    incorrectly flag some version comments as not containing an
    appropriate version (#1900)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778846400">- Update to version 1.25.0:
  * New Features
  - zizmor's finding severities can now be remapped on a
    per-audit basis. See the configuration for details (#1913)
  - New audit: github-app detects dangerous usages of GitHub App
    installation tokens (#1926)
  - New audit: [unpinned-tools] detects actions that install
    tools without pinning to a specific version (#1820)
  - zizmor now accepts the --no-ignores flag to disable all
    ignore comments and configurations when reporting findings
    (#1935)
  - zizmor's LSP now honors the --persona flag on the CLI (#1943)
  - zizmor is now aware of Docker-based action definitions, in
    addition to the pre-existing support for "composite" actions
    (#1965)
  * Enhancements
  - Recommend gh issue edit --add-label / gh pr edit --add-label
    as a replacement for actions-ecosystem/action-add-labels in
    superfluous-actions
  - Recommend gh issue edit --remove-label / gh pr edit
  - -remove-label as a replacement for
    actions-ecosystem/action-remove-labels in superfluous-actions
  - Recommend jq as a replacement for sergeysova/jq-action in
    superfluous-actions
  - Recommend git add, git commit, and git push as a replacement
    for stefanzweifel/git-auto-commit-action in
    superfluous-actions
  - Recommend git add, git commit, and git push as a replacement
    for EndBug/add-and-commit in superfluous-actions
  - tibdex/github-app-token is now recognized as an archived
    action by archived-uses (#1910)
  - The [dangerous-triggers] audit now explicitly exempts
    workflows that only invoke actions/labeler (#1956)
  - The unpinned-images audit now detects unpinned image
    references in Docker-based action definitions (#1965)
  - zizmor's SARIF output now provides slightly more detailed
    finding messages (#1972)
  - The archived-uses audit now detects more archived actions
    (#1978)
  - deno is now recognized as a package-ecosystem in
    dependabot.yml (#1991)
  * Performance Improvements
  - The impostor-commit audit is now significantly faster (in
    addition to being more correct) when the user has pinned
    their action to a tag SHA instead of a commit SHA (#1998)
  * Bug Fixes
  - Fixed a crash in the template-injection audit when a workflow
    uses a parenthesized compound expression in context position
    (#1904)
  - Fixed a bug where local directory input collection could miss
    workflows for relative-path invocations from within .github
    subdirectories (#1909)
  - Fixed a bug where the unpinned-images audit would miss images
    defined in container: clauses (#1944)
  - Fixed a bug where inline ignore comments could not be easily
    applied to superfluous-actions findings (#1945)
  - Fixed a bug where the cache-poisoning audit would fail to
    detect some release trigger patterns (#1946)
  - Fixed a bug where inline ignore comments could not be easily
    applied to cache-poisoning findings (#1962)
  - Fixed a class of imprecisions where the cache-poisoning audit
    would incorrectly flag cache usage that doesn't actually
    occur on release events (#1940)
  - Fixed a bug where dependabot.yml files containing a private
    cargo repository couldn't be parsed (#1976)
  - Fixed a bug where zizmor's input validation warnings lacked a
    mention of which files failed to validate (#1980)
  - Fixed a bug where the impostor-commit audit would falsely
    indicate impostor commits if an action was pinned to a tag
    SHA instead of a commit SHA (#1998)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 1.25.2:
  * Bug Fixes
  - Fixed a bug where the unpinned-tools audit would incorrectly
    flag the aquasecurity/trivy-action action as installing an
    unpinned tool version, rather than aquasecurity/setup-trivy
    (#2018)
- Update to version 1.25.1:
  * Bug Fixes
  - Fixed a bug where the cache-poisoning audit would fail to
    consider release events as exempt from cache usage findings
    when filtered by a tag condition (#2004)
  - Fixed a typo when suggesting --fix flags for findings (#2010)
  - Fixed a typo in unpinned-tools annotations (#2008)
  - Fixed a bug where the github-app audit would incorrectly flag
    some safe uses of actions/create-github-app-token as unsafe
    (#2011)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782043200">- Update to version 1.26.1:
  This is a small corrective release for 1.26.0.
- Update to version 1.26.0:
  * New Features
  - New audit: typosquat-uses detects uses: clauses that
    reference likely typoed actions (#1985)
  - New audit: unsound-ternary detects pseudo-ternary expressions
    that don't evaluate as expected (#2085)
  - New audit: adhoc-packages detects run: steps that install
    packages in an ad-hoc manner (#2061)
  * Enhancements
  - The cache-poisoning audit now detects additional cache
    disablement heuristics (#2053)
  - The known-vulnerable-actions audit is now configurable. See
    the configuration documentation for details (#2084)
  - The excessive-permissions audit is now aware of the
    code-quality permission (#2088)
  - The unpinned-uses audit's auto-fix now uses the fully
    qualified version tag (e.g. # v6.0.2) when fixing a
    major-version ref (e.g. @v6) (#2127)
  * Performance Improvements
  - Most online audits are significantly faster, thanks to more
    precise retry handling (#2036)
  * Bug Fixes
  - Fixed a bug where zizmor's LSP would not recognize
    dependabot.yaml files in its default configuration (#2026)
  - Fixed a bug where ref-version-mismatch would fail to fully
    match some version comments (#2040)
  - Fixed a bug where dependabot-cooldown would fail to honor the
    user's configured days when performing autofixes (#2055)
  - Steps and jobs gated by statically-false if: conditions (e.g.
    if: false, if: ${{ false }}) are now skipped during auditing,
    since they cannot execute (#2059, #2069)
  - Fixed a bug where ref-version-mismatch would fail to identify
    some valid version comments (#2073)
  - Fixed a bug where unpinned-images would incorrectly flag
    empty matrix expansions as unpinned container image
    references (#2102)
  - Fixed a bug where unpinned-images would incorrectly flag some
    matrix expansions as unpinned (#2098)
  - The SARIF (--format=sarif) and GitHub Annotations
    (--format=github) output formats now provide more
    correct/useful paths, particularly when the user provides a
    relative path as input to zizmor rather than zizmor . (#1748,
    [#2095])
  * Changes
  - The impostor-commit audit no longer suggests auto-fixes, to
    avoid incorrectly minimizing the amount of manual remediation
    work needed (#2054)
  - The JSON and SARIF outputs no longer contain a misleading
    prefix key (#2095)
  * Dependencies
  - chore(deps): bump http from 1.4.1 to 1.4.2 in the cargo group
    (#2125)
  - chore(deps): bump the github-actions group across 1 directory
    with 3 updates (#2119)
  - chore(deps): bump the cargo group across 1 directory with 2
    updates (#2118)
  - chore(deps): bump CodSpeedHQ/action from 4.15.1 to 4.17.0 in
    the github-actions group (#2109)
  - chore(deps): bump the github-actions group with 5 updates
    (#2091)
  - chore(deps): bump the cargo group with 5 updates (#2090)
  - chore(deps): bump the cargo group with 3 updates (#2066)
  - chore(deps): bump the github-actions group with 2 updates
    (#2067)
  - chore(deps): bump the cargo group with 3 updates (#2034)
  - chore(deps): bump the github-actions group with 2 updates
    (#2035)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784030400">- Update to version 1.27.0:
  * New Features
  - zizmor now has experimental support for workflows that
    specify parallel steps. See Usage - Parallel steps for more
    information (#2153)
  * Enhancements
  - zizmor's handling of paths is now more consistent,
    particularly when run on Windows (#2163)
  - zizmor now emits a helpful warning when being run in implicit
    offline mode (#2180)
  * Bug Fixes
  - Fixed a bug where the secrets-outside-env audit would not
    honor ignore comments within the same job scope (#2157)
  - Fixed a bug where the ref-version-mismatch audit would not
    honor ignore comments within the same steps scope (#2177)
  - Fixed a bug where --collect=[MODE] was not correctly handled
    when auditing remote inputs (#2185)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784721600">- Update to version 1.28.0:
  * Security
  - v1.27.0 contained a logging defect that would print any
    configured GitHub credentials as part of zizmor's cleartext
    logging. No versions other than v1.27.0 were affected. See
    GHSA-f42p-wjw5-97qh for full information.
  - Many thanks to @shaanmajid for finding and reporting this
    vulnerability.
  * Enhancements
  - The JSON (v1) output format now includes metadata for each
    finding's fixes, if the finding has fixes (#2186)
  - The dependabot-cooldown audit is now aware of GitHub's new
    three-day default cooldown (#2193)
  - sbt is now recognized as a package-ecosystem in
    dependabot.yml (#2211)
  * Bug Fixes
  - Fixed a bug where the template-injection audit would
    incorrectly flag steps..outcome and steps..conclusion as
    injection risks in the default persona (#2199)
  - Fixed a bug where the github-env audit would incorrectly flag
    some printf calls as exploitable (#2201)
  - Fixed a bug where zizmor would produce a misleading and
    confusing error message when asked to audit an ambiguous
    remote input (#2205)</changelog>
</package>
<package pkgid="80dda448ca273dc35e4f39a091649b1b46a99b585d9876528eb0186c3e88351108b83566bff86e5e518e7b5ea00bd1a48f5d144d6448c67099f7110f2e625700" name="zizmor-bash-completion" arch="noarch">
  <version epoch="0" ver="1.28.0" rel="74.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760443200">- Update to version 1.15.1:
  * Bug Fixes
  - Fixed a bug where zizmor would fail to parse Dependabot
    configuration files due to missing support for some package
    ecosystems (#1240)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- Update to version 1.15.2:
  * Bug Fixes
  - Fixed a bug where zizmor would fail to parse some Dependabot
    configuration files due to missing support for some schedule
    formats (#1247)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761307200">- Update to version 1.16.0:
  * New Features
  - New audit: concurrency-limits detects insufficient
    concurrency limits in workflows (#1227)
  - Many thanks to @jwallwork23 for proposing and implementing
    this audit!
  * Performance Improvements
  - zizmor's online mode is now significantly (40% to over 95%)
    faster on common workloads, thanks to a combination of
    caching improvements and conversion of GitHub API requests
    into Git remote lookups (#1257)
  - Many thanks to @Bo98 for implementing these improvements!
  * Enhancements
  - When running in --fix mode and all fixes are successfully
    applied, zizmor now has similar exit code behavior as the
  - -no-exit-codes and --format=sarif flags (#1242)
  - Many thanks to @cnaples79 for implementing this improvement!
  - The dependabot-cooldown audit now supports auto-fixes for
    many findings (#1229)
  - Many thanks to @mostafa for implementing this improvement!
  - The dependabot-execution audit now supports auto-fixes for
    many findings (#1229)
  - Many thanks to @mostafa for implementing this improvement!
  - zizmor now has limited, experimental support for handling
    inputs that contain YAML anchors (#1266)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761739200">- Update to version 1.16.1:
  * Enhancements
  - zizmor now produces a more useful error message when asked to
    indirectly access a nonexistent or private repository via a
    uses: clause (without a sufficiently privileged GitHub token)
    (#1293)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762084800">- Update to version 1.16.2:
  * Enhancements
  - The concurrency-limits audit no longer flags explicit user
    concurrency overrides, e.g. cancel-in-progress: false (#1302)
  - zizmor now detects CI environments and specializes its panic
    handling accordingly, improving the quality of panic reports
    when running in CI (#1307)
  * Bug Fixes
  - Fixed a bug where zizmor would reject some Dependabot
    configuration files with logically unsound schedules (but
    that are accepted by GitHub regardless) (#1308)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762344000">- Update to version 1.16.3:
  * Bug Fixes
  - Fixed a bug where zizmor would crash on an unexpected caching
    middleware state. zizmor will now exit with a controlled
    error instead (#1319)
  * Dependencies
  - chore(deps): bump the cargo group with 2 updates (#1316)
  - chore(deps): bump the github-actions group with 3 updates
    (#1317)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764158400">- Update to version 1.17.0:
  * Enhancements
  - zizmor now produces a more useful error message when asked to
    collect only workflows from a remote input that contains no
    workflows (#1324)
  - zizmor now produces more precise severities on
    actions/checkout versions that have more misuse-resistant
    credentials persistence behavior (#1353)
  - Many thanks to @ManuelLerchnerQC for proposing and
    implementing this improvement!
  - The use-trusted-publishing audit now correctly detecting more
    "dry-run" patterns, making it significantly more accurate
    (#1357)
  - The obfuscation audit now detects usages of shell: cmd and
    similar, as the Windows CMD shell lacks a formal grammar and
    limits analysis of run: blocks in other audits (#1361)
  * Performance Improvements
  - zizmor's core has been refactored to be asynchronous, making
    online and I/O-heavy audits significantly faster. Typical
    user workloads should see speedups of 40% to 70% (#1314)
  * Bug Fixes
  - Fixed a bug where auto-fixes would fail to preserve a
    document's final newline (#1323)
  - zizmor now uses the native (OS) TLS roots when performing
    HTTPS requests, improving compatibility with user
    environments that perform TLS interception (#1328)
  - The github-env audit now falls back to assuming bash-like
    shell syntax in run: blocks if it can't infer the shell being
    used (#1336)
  - The concurrency-limits audit now correctly detects job-level
    concurrency settings, in addition to workflow-level settings
    (#1338)
  - Fixed a bug where zizmor would fail to collect workflows with
    names that overlapped with other input types (e.g. action.yml
    and dependabot.yml) when passed explicitly by path (#1345)
  * Dependencies
  - chore(deps): bump github/codeql-action in the github-actions
    group (#1331)
  - chore(deps): bump the cargo group with 3 updates (#1358)
  - chore(deps): bump the cargo group with 8 updates (#1330)
  - chore(deps): bump the github-actions group with 2 updates
    (#1343)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764849600">- Update to version 1.18.0:
  * Enhancements
  - The use-trusted-publishing audit now detects NuGet publishing
    commands (#1369)
  - The dependabot-cooldown audit now flags cooldown periods of
    less than 7 days by default (#1375)
  - The dependabot-cooldown audit can now be configured with a
    custom minimum cooldown period via
    rules.dependabot-cooldown.config.days (#1377)
  - zizmor now produces slightly more useful error messages when
    the user supplies an invalid configuration for the
    forbidden-uses audit (#1381)
  * Bug Fixes
  - Fixed additional edge cases where auto-fixed would fail to
    preserve a document's final newline (#1372)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145600">- Update to version 1.19.0:
  * New Features
  - New audit: archived-uses detects usages of archived
    repositories in uses: clauses (#1411)
  * Enhancements
  - The use-trusted-publishing audit now detects additional
    publishing command patterns, including common "wrapped"
    patterns like bundle exec gem publish (#1394)
  - zizmor now produces better error messages on a handful of
    error cases involving invalid input files. Specifically, a
    subset of syntax and schema errors now produce more detailed
    and actionable error messages (#1396)
  - The use-trusted-publishing audit now detects additional
    publishing command patterns, including uv run ..., uvx ...,
    and poetry publish (#1402)
  - zizmor now produces more useful and less ambiguous spans for
    many findings, particularly those from the
    anonymous-definition audit (#1416)
  - zizmor now discovers configuration files named zizmor.yaml,
    in addition to zizmor.yml (#1431)
  - zizmor now produces a more useful error message when input
    collection yields no inputs (#1439)
  - The --render-links flag now allows users to control zizmor's
    OSC 8 terminal link rendering behavior. This is particularly
    useful in environments that advertise themselves as terminals
    but fail to correctly render or ignore OSC 8 links (#1454)
  * Performance Improvements
  - The [impostor-commit] audit is now significantly faster on
    true positives, making true positive detection virtually as
    fast as true negative detection. In practice, true positive
    runs are over 100 times faster than before (#1429)
  * Bug Fixes
  - Fixed a bug where the obfuscation audit would crash if it
    encountered a CMD shell that was defined outside of the
    current step block (i.e. as a job or workflow default)
    (#1418)
  - Fixed a bug where the opentofu ecosystem was not recognized
    in Dependabot configuration files (#1452)
  - --color=always no longer implies --render-links=always, as
    some environments (like GitHub Actions) support ANSI color
    codes but fail to handle OSC escapes gracefully (#1454)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 1.20.0:
  * Enhancements
  - The excessive-permissions audit is now aware of the
    artifact-metadata and models permissions (#1461)
  - The cache-poisoning audit is now aware of the
    ramsey/composer-install action (#1489)
  - The unpinned-images audit is now significantly more precise
    in the presence of matrix references, e.g. image: ${{
    matrix.image }} (#1482)
  * Changes
  - The default policy for the unpinned-uses audit has changed
    from allowing ref-pinning for first-party actions (those
    under actions/* and similar) to requiring hash-pinning. This
    makes the default policy more strict, as well as more
    consistent across the actions ecosystem.
    Users who with to retain the old (permissive policy) for
    first-party actions may configure it explicitly in their
    zizmor.yml:
    zizmor.yml
    rules:
    unpinned-uses:
    config:
    policies:
    actions/*: ref-pin
    github/*: ref-pin
    dependabot/*: ref-pin
  * Bug Fixes
  - The dependabot-cooldown audit no longer flags missing
    cooldowns on ecosystems that don't (yet) support cooldowns,
    such as opentofu (#1480)
  - Fixed a false positive in the cache-poisoning audit where
    zizmor would treat empty strings (e.g. cache: '') as enabling
    rather than disabling caching (#1482)
  - Fixed two gaps in the use-trusted-publishing audit's
    detection of common yarn publishing commands (#1495)
  * Miscellaneous
  - zizmor's configuration now has an official JSON schema that
    will be available via SchemaStore soon!  Many thanks to
    @kiwamizamurai for implementing this improvement!</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768564800">- Update to version 1.21.0:
  * New Features
  - New audit: misfeature detects usage of GitHub Actions
    features that are considered "misfeatures." (#1517)
  * Enhancements
  - zizmor now uses exit code 3 to signal an audit that has
    failed because no input files were collected. See the exit
    code documentation for details (#1515)
  - The unpinned-uses audit now supports auto-fixes for many
    findings (#1525)
  * Changes
  - The obfuscation audit no longer flags shell: cmd. That check
    has been moved to the new misfeature audit. Users may need to
    update their ignore comments and/or configuration (#1517)
  * Bug Fixes
  - The unpinned-uses audit now flags reusable workflows that are
    unpinned, in addition to actions (#1509)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768824000">- Update to version 1.22.0:
  * Changes
  - The misfeature audit now only shows non-"well known" shell:
    findings when running with the "auditor" persona (#1532)
  * Bug Fixes
  - Fixed a bug where inputs containing CRLF line endings were
    not patched correctly by the unpinned-uses audit (#1536)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773057600">- Update to version 1.23.1:
  * Bug Fixes
  - Fixed a bug where zizmor would error if given both a GH_TOKEN
    and a GITHUB_TOKEN (or ZIZMOR_GITHUB_TOKEN) via the
    environment (#1724)
- Update to version 1.23.0:
  * New Features
  - New audit: secrets-outside-env detects usage of the secrets
    context in jobs that don't have a corresponding environment
    (#1599)
  - New audit: superfluous-actions detects usage of actions that
    perform operations already provided by GitHub's own runner
    images (#1618)
  * Enhancements
  - zizmor's LSP mode is now configuration-aware, and will load
    configuration files relative to workspace roots (#1555)
  - zizmor now reads the GITHUB_TOKEN environment variable as an
    alias/equivalent for GH_TOKEN (#1566)
  - zizmor now supports inputs that contain duplicated anchor
    names (#1575)
  - zizmor now flags missing cooldowns on opentofu ecosystem
    definitions in Dependabot (again) (#1586)
  - zizmor now reads the ZIZMOR_GITHUB_TOKEN environment variable
    as an alias/equivalent for GH_TOKEN and GITHUB_TOKEN (#1641)
  - The SARIF output format now adds zizmor/confidence,
    zizmor/persona and zizmor/severity to the properties of
    findings (#1656)
  - Added awalsh128/cache-apt-pkgs-action as a cache-aware action
    to the cache-poisoning audit (#1708)
  * Changes
  - SARIF categories have been regraded. zizmor's "medium" is
    changed from SARIF's "warning" to "low" (#1635)
  * Bug Fixes
  - Fixed a bug where zizmor would crash on uses: clauses
    containing non-significant whitespace while performing the
    unpinned-uses audit (#1544)
  - Fixed a bug in yamlpath where sequences containing anchors
    were splatted instead of being properly nested (#1557)
  - Fixed a bug in yamlpath where anchor prefixes in sequences
    and mapping were not stripped during path queries (#1562)
  - Fixed a bug where "merge into" autofixes would produce
    incorrect patches in the presence of multi-byte Unicode
    characters (#1581)
  - Fixed a bug where the template-injection audit would produce
    duplicated pedantic-only findings (#1589)
  - Fixed a bug where the obfuscation audit would produce
    incorrect autofixes for a subset of constant-reducible
    expressions (#1597)
  - Fixed a bug where the obfuscation audit would fail to apply
    fixes to a subset of inputs with leading whitespace (#1597)
  - Fixed a bug where the concurrency-limits audit would
    incorrectly flag reusable-only workflows as needing a
    concurrency: key (#1620)
  - Fixed a bug where the known-vulnerable-actions audit would
    fail when applying some fixes (#1640)
  - Fixed a bug where the pre-commit ecosystem was not recognized
    in Dependabot configuration files (#1637)
  - Fixed a bug where the template-injection audit would
    incorrectly flag github.triggering_actor as an injection risk
    in the default persona (#1645)
  - Fixed a bug where zizmor's expression parser did not
    correctly handle number literals in GitHub Actions
    expressions (#1625)
  - Fixed a bug where the template-injection audit would crash on
    some forms of multi-line expressions (#1669)
  - Fixed a bug where deserialization of a workflow containing
    fractional minutes would fail (#1675)
  - Fixed a bug where deserialization of a workflow where a
    workflow_run with a scalar types would fail (#1676)
  - Fixed a bug where zizmor would crash on workflows containing
    bare numeric values in if: conditions (#1683)
  - Fixed a bug where GitHub Actions expression string
    comparisons were not case-insensitive (#1687)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776081600">- Update to version 1.24.0:
  * New Features
  - zizmor now allows users to audit from stdin, by passing
    zizmor - (#1611)
  * Enhancements
  - The use-trusted-publishing audit now detects bun publish and
    bunx npm publish patterns (#1737)
  - zizmor's CLI help and usage output now uses a custom color
    scheme for improved readability (#1747)
  - The secrets-outside-env audit is now configurable with an
    allowlist of secret names that should not be flagged, even
    when referenced outside of an environment (#1759)
  - The dependabot-cooldown audit now emits a pedantic finding
    whenever it encounters a cooldown used with a
    multi-ecosystem-group, as the two do not interact well
    (#1780)
  - Recommend gh release upload as a replacement for
    svenstaro/upload-release-action in superfluous-actions
    (#1801)
  - Recommend gh issue create as a replacement for
    dacbd/create-issue-action in superfluous-actions (#1873)
  - The obfuscation audit now emits a finding for with: ${{ expr
    }} clauses cannot be analyzed (#1772)
  - zizmor --help is now rendered with option groups for improved
    readability (#1831)
  - zizmor's SARIF output now uses codeflows instead of related
    locations, improving its rendering behavior on GitHub
    Advanced Security (#1843)
  - The ref-version-mismatch audit now uses a more useful audit
    description for its findings (#1843)
  - The unpinned-images audit now produces more precise findings
    for image references that are computed through expressions
    (#1756)
  - The ref-version-mismatch audit now detects missing version
    comments as well (#1849)
  * Bug Fixes
  - Fixed a bug where the concurrency-limits audit reported
    findings at the job level instead of the workflow level
    (#1627)
  - Fixed a bug where with: ${{ expr }} clauses would cause a
    crash. artipacked audit emits a pedantic finding on such
    clauses. (#1772)
  - Fixed a bug where auto-fixes for the template-injection audit
    would fail to preserve an environment variable's casing
    (#1766)
  - Fixed a bug where the secrets-outside-env audit would
    incorrectly flag reusable workflows (#1777)
  - Fixed a bug where expressions containing Infinity or NaN
    would fail to parse (#1778)
  - Fixed several bugs where some parenthetical forms in
    expressions would fail to parse (#1779, #1856)
  - Fixed a bug where expressions with invalid identifiers (such
    as -Inf) would be incorrectly accepted (#1794)
  - Fixed a bug where the known-vulnerable-actions audit would
    fail to handle multiple discrete packages in a single
    advisory (#1810)
  - Fixed a bug where the template-injection audit would
    incorrectly flag needs.*.result as an injection risk in the
    default persona (#1814)
  - Fixed a bug where the unpinned-uses audit would product
    incorrect auto-fixes for actions with subpaths (#1841)
  - Fixed a bug where the ref-version-mismatch audit would fail
    to produce findings for comments containing nonexistent refs
    (#1853)
  - Fixed a bug where expressions containing NaN would be
    constant-evaluated incorrectly (#1858)
  - Fixed a bug where nix would not be recognized as a
    package-ecosystem in dependabot.yml (#1867)
  - Fixed a bug where the ref-version-mismatch audit would
    incorrectly parse prerelease version comments (such as #
    v6-beta), causing some findings to appear unresolvable
    (#1870)
  - Fixed a bug where various string comparisons in expressions
    did not perfectly match GitHub's own special uppercasing
    semantics (#1879)
  - Fixed a bug where zizmor would incorrectly contact github.com
    instead of the user's requested --gh-hostname for some online
    requests (#1874)
  - Fixed a bug where the artipacked audit would fail to honor
    the --no-online-audits flag (#1874)
  * Changes
  - The secrets-outside-env audit now only flags findings with
    the 'auditor' persona, due to numerous false positives and
    negatives caused by GitHub's platform limitations (primarily
    around interactions between environment secrets and reusable
    workflows) (#1777)
  - zizmor's handling of GitHub Actions expressions has been made
    stricter, and now rejects unknown functions and function
    calls with incorrect arities (#1823, #1826)
  - The superfluous-actions audit now uses the "pedantic" persona
    for some findings along with a medium or low confidence
    marker to signal when a action may not be easily replaced
    with built-in functionality (#1822, #1859)
  - The unpinned-uses audit no longer suggests auto-fixes for Git
    references that don't look like version tags, such as main
    (#1860)
  - The template-injection audit now considers more "URL-shaped"
    contexts to be fully attacker-controllable, rather than
    partially controllable (#1868)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776513600">- Update to version 1.24.1:
  * Bug Fixes
  - Fixed a bug where the ref-version-mismatch audit would
    incorrectly flag some version comments as not containing an
    appropriate version (#1900)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778846400">- Update to version 1.25.0:
  * New Features
  - zizmor's finding severities can now be remapped on a
    per-audit basis. See the configuration for details (#1913)
  - New audit: github-app detects dangerous usages of GitHub App
    installation tokens (#1926)
  - New audit: [unpinned-tools] detects actions that install
    tools without pinning to a specific version (#1820)
  - zizmor now accepts the --no-ignores flag to disable all
    ignore comments and configurations when reporting findings
    (#1935)
  - zizmor's LSP now honors the --persona flag on the CLI (#1943)
  - zizmor is now aware of Docker-based action definitions, in
    addition to the pre-existing support for "composite" actions
    (#1965)
  * Enhancements
  - Recommend gh issue edit --add-label / gh pr edit --add-label
    as a replacement for actions-ecosystem/action-add-labels in
    superfluous-actions
  - Recommend gh issue edit --remove-label / gh pr edit
  - -remove-label as a replacement for
    actions-ecosystem/action-remove-labels in superfluous-actions
  - Recommend jq as a replacement for sergeysova/jq-action in
    superfluous-actions
  - Recommend git add, git commit, and git push as a replacement
    for stefanzweifel/git-auto-commit-action in
    superfluous-actions
  - Recommend git add, git commit, and git push as a replacement
    for EndBug/add-and-commit in superfluous-actions
  - tibdex/github-app-token is now recognized as an archived
    action by archived-uses (#1910)
  - The [dangerous-triggers] audit now explicitly exempts
    workflows that only invoke actions/labeler (#1956)
  - The unpinned-images audit now detects unpinned image
    references in Docker-based action definitions (#1965)
  - zizmor's SARIF output now provides slightly more detailed
    finding messages (#1972)
  - The archived-uses audit now detects more archived actions
    (#1978)
  - deno is now recognized as a package-ecosystem in
    dependabot.yml (#1991)
  * Performance Improvements
  - The impostor-commit audit is now significantly faster (in
    addition to being more correct) when the user has pinned
    their action to a tag SHA instead of a commit SHA (#1998)
  * Bug Fixes
  - Fixed a crash in the template-injection audit when a workflow
    uses a parenthesized compound expression in context position
    (#1904)
  - Fixed a bug where local directory input collection could miss
    workflows for relative-path invocations from within .github
    subdirectories (#1909)
  - Fixed a bug where the unpinned-images audit would miss images
    defined in container: clauses (#1944)
  - Fixed a bug where inline ignore comments could not be easily
    applied to superfluous-actions findings (#1945)
  - Fixed a bug where the cache-poisoning audit would fail to
    detect some release trigger patterns (#1946)
  - Fixed a bug where inline ignore comments could not be easily
    applied to cache-poisoning findings (#1962)
  - Fixed a class of imprecisions where the cache-poisoning audit
    would incorrectly flag cache usage that doesn't actually
    occur on release events (#1940)
  - Fixed a bug where dependabot.yml files containing a private
    cargo repository couldn't be parsed (#1976)
  - Fixed a bug where zizmor's input validation warnings lacked a
    mention of which files failed to validate (#1980)
  - Fixed a bug where the impostor-commit audit would falsely
    indicate impostor commits if an action was pinned to a tag
    SHA instead of a commit SHA (#1998)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 1.25.2:
  * Bug Fixes
  - Fixed a bug where the unpinned-tools audit would incorrectly
    flag the aquasecurity/trivy-action action as installing an
    unpinned tool version, rather than aquasecurity/setup-trivy
    (#2018)
- Update to version 1.25.1:
  * Bug Fixes
  - Fixed a bug where the cache-poisoning audit would fail to
    consider release events as exempt from cache usage findings
    when filtered by a tag condition (#2004)
  - Fixed a typo when suggesting --fix flags for findings (#2010)
  - Fixed a typo in unpinned-tools annotations (#2008)
  - Fixed a bug where the github-app audit would incorrectly flag
    some safe uses of actions/create-github-app-token as unsafe
    (#2011)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782043200">- Update to version 1.26.1:
  This is a small corrective release for 1.26.0.
- Update to version 1.26.0:
  * New Features
  - New audit: typosquat-uses detects uses: clauses that
    reference likely typoed actions (#1985)
  - New audit: unsound-ternary detects pseudo-ternary expressions
    that don't evaluate as expected (#2085)
  - New audit: adhoc-packages detects run: steps that install
    packages in an ad-hoc manner (#2061)
  * Enhancements
  - The cache-poisoning audit now detects additional cache
    disablement heuristics (#2053)
  - The known-vulnerable-actions audit is now configurable. See
    the configuration documentation for details (#2084)
  - The excessive-permissions audit is now aware of the
    code-quality permission (#2088)
  - The unpinned-uses audit's auto-fix now uses the fully
    qualified version tag (e.g. # v6.0.2) when fixing a
    major-version ref (e.g. @v6) (#2127)
  * Performance Improvements
  - Most online audits are significantly faster, thanks to more
    precise retry handling (#2036)
  * Bug Fixes
  - Fixed a bug where zizmor's LSP would not recognize
    dependabot.yaml files in its default configuration (#2026)
  - Fixed a bug where ref-version-mismatch would fail to fully
    match some version comments (#2040)
  - Fixed a bug where dependabot-cooldown would fail to honor the
    user's configured days when performing autofixes (#2055)
  - Steps and jobs gated by statically-false if: conditions (e.g.
    if: false, if: ${{ false }}) are now skipped during auditing,
    since they cannot execute (#2059, #2069)
  - Fixed a bug where ref-version-mismatch would fail to identify
    some valid version comments (#2073)
  - Fixed a bug where unpinned-images would incorrectly flag
    empty matrix expansions as unpinned container image
    references (#2102)
  - Fixed a bug where unpinned-images would incorrectly flag some
    matrix expansions as unpinned (#2098)
  - The SARIF (--format=sarif) and GitHub Annotations
    (--format=github) output formats now provide more
    correct/useful paths, particularly when the user provides a
    relative path as input to zizmor rather than zizmor . (#1748,
    [#2095])
  * Changes
  - The impostor-commit audit no longer suggests auto-fixes, to
    avoid incorrectly minimizing the amount of manual remediation
    work needed (#2054)
  - The JSON and SARIF outputs no longer contain a misleading
    prefix key (#2095)
  * Dependencies
  - chore(deps): bump http from 1.4.1 to 1.4.2 in the cargo group
    (#2125)
  - chore(deps): bump the github-actions group across 1 directory
    with 3 updates (#2119)
  - chore(deps): bump the cargo group across 1 directory with 2
    updates (#2118)
  - chore(deps): bump CodSpeedHQ/action from 4.15.1 to 4.17.0 in
    the github-actions group (#2109)
  - chore(deps): bump the github-actions group with 5 updates
    (#2091)
  - chore(deps): bump the cargo group with 5 updates (#2090)
  - chore(deps): bump the cargo group with 3 updates (#2066)
  - chore(deps): bump the github-actions group with 2 updates
    (#2067)
  - chore(deps): bump the cargo group with 3 updates (#2034)
  - chore(deps): bump the github-actions group with 2 updates
    (#2035)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784030400">- Update to version 1.27.0:
  * New Features
  - zizmor now has experimental support for workflows that
    specify parallel steps. See Usage - Parallel steps for more
    information (#2153)
  * Enhancements
  - zizmor's handling of paths is now more consistent,
    particularly when run on Windows (#2163)
  - zizmor now emits a helpful warning when being run in implicit
    offline mode (#2180)
  * Bug Fixes
  - Fixed a bug where the secrets-outside-env audit would not
    honor ignore comments within the same job scope (#2157)
  - Fixed a bug where the ref-version-mismatch audit would not
    honor ignore comments within the same steps scope (#2177)
  - Fixed a bug where --collect=[MODE] was not correctly handled
    when auditing remote inputs (#2185)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784721600">- Update to version 1.28.0:
  * Security
  - v1.27.0 contained a logging defect that would print any
    configured GitHub credentials as part of zizmor's cleartext
    logging. No versions other than v1.27.0 were affected. See
    GHSA-f42p-wjw5-97qh for full information.
  - Many thanks to @shaanmajid for finding and reporting this
    vulnerability.
  * Enhancements
  - The JSON (v1) output format now includes metadata for each
    finding's fixes, if the finding has fixes (#2186)
  - The dependabot-cooldown audit is now aware of GitHub's new
    three-day default cooldown (#2193)
  - sbt is now recognized as a package-ecosystem in
    dependabot.yml (#2211)
  * Bug Fixes
  - Fixed a bug where the template-injection audit would
    incorrectly flag steps..outcome and steps..conclusion as
    injection risks in the default persona (#2199)
  - Fixed a bug where the github-env audit would incorrectly flag
    some printf calls as exploitable (#2201)
  - Fixed a bug where zizmor would produce a misleading and
    confusing error message when asked to audit an ambiguous
    remote input (#2205)</changelog>
</package>
<package pkgid="b457759ccd395325b15869e456cc953bc29d7d43b086a6a3ba02700defdc315d66fef3b37025bc4f0c92d35e06f89119cf0b206d8a5e9b97940dddf4e6e34a71" name="zizmor-debuginfo" arch="s390x">
  <version epoch="0" ver="1.28.0" rel="74.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760443200">- Update to version 1.15.1:
  * Bug Fixes
  - Fixed a bug where zizmor would fail to parse Dependabot
    configuration files due to missing support for some package
    ecosystems (#1240)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- Update to version 1.15.2:
  * Bug Fixes
  - Fixed a bug where zizmor would fail to parse some Dependabot
    configuration files due to missing support for some schedule
    formats (#1247)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761307200">- Update to version 1.16.0:
  * New Features
  - New audit: concurrency-limits detects insufficient
    concurrency limits in workflows (#1227)
  - Many thanks to @jwallwork23 for proposing and implementing
    this audit!
  * Performance Improvements
  - zizmor's online mode is now significantly (40% to over 95%)
    faster on common workloads, thanks to a combination of
    caching improvements and conversion of GitHub API requests
    into Git remote lookups (#1257)
  - Many thanks to @Bo98 for implementing these improvements!
  * Enhancements
  - When running in --fix mode and all fixes are successfully
    applied, zizmor now has similar exit code behavior as the
  - -no-exit-codes and --format=sarif flags (#1242)
  - Many thanks to @cnaples79 for implementing this improvement!
  - The dependabot-cooldown audit now supports auto-fixes for
    many findings (#1229)
  - Many thanks to @mostafa for implementing this improvement!
  - The dependabot-execution audit now supports auto-fixes for
    many findings (#1229)
  - Many thanks to @mostafa for implementing this improvement!
  - zizmor now has limited, experimental support for handling
    inputs that contain YAML anchors (#1266)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761739200">- Update to version 1.16.1:
  * Enhancements
  - zizmor now produces a more useful error message when asked to
    indirectly access a nonexistent or private repository via a
    uses: clause (without a sufficiently privileged GitHub token)
    (#1293)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762084800">- Update to version 1.16.2:
  * Enhancements
  - The concurrency-limits audit no longer flags explicit user
    concurrency overrides, e.g. cancel-in-progress: false (#1302)
  - zizmor now detects CI environments and specializes its panic
    handling accordingly, improving the quality of panic reports
    when running in CI (#1307)
  * Bug Fixes
  - Fixed a bug where zizmor would reject some Dependabot
    configuration files with logically unsound schedules (but
    that are accepted by GitHub regardless) (#1308)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762344000">- Update to version 1.16.3:
  * Bug Fixes
  - Fixed a bug where zizmor would crash on an unexpected caching
    middleware state. zizmor will now exit with a controlled
    error instead (#1319)
  * Dependencies
  - chore(deps): bump the cargo group with 2 updates (#1316)
  - chore(deps): bump the github-actions group with 3 updates
    (#1317)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764158400">- Update to version 1.17.0:
  * Enhancements
  - zizmor now produces a more useful error message when asked to
    collect only workflows from a remote input that contains no
    workflows (#1324)
  - zizmor now produces more precise severities on
    actions/checkout versions that have more misuse-resistant
    credentials persistence behavior (#1353)
  - Many thanks to @ManuelLerchnerQC for proposing and
    implementing this improvement!
  - The use-trusted-publishing audit now correctly detecting more
    "dry-run" patterns, making it significantly more accurate
    (#1357)
  - The obfuscation audit now detects usages of shell: cmd and
    similar, as the Windows CMD shell lacks a formal grammar and
    limits analysis of run: blocks in other audits (#1361)
  * Performance Improvements
  - zizmor's core has been refactored to be asynchronous, making
    online and I/O-heavy audits significantly faster. Typical
    user workloads should see speedups of 40% to 70% (#1314)
  * Bug Fixes
  - Fixed a bug where auto-fixes would fail to preserve a
    document's final newline (#1323)
  - zizmor now uses the native (OS) TLS roots when performing
    HTTPS requests, improving compatibility with user
    environments that perform TLS interception (#1328)
  - The github-env audit now falls back to assuming bash-like
    shell syntax in run: blocks if it can't infer the shell being
    used (#1336)
  - The concurrency-limits audit now correctly detects job-level
    concurrency settings, in addition to workflow-level settings
    (#1338)
  - Fixed a bug where zizmor would fail to collect workflows with
    names that overlapped with other input types (e.g. action.yml
    and dependabot.yml) when passed explicitly by path (#1345)
  * Dependencies
  - chore(deps): bump github/codeql-action in the github-actions
    group (#1331)
  - chore(deps): bump the cargo group with 3 updates (#1358)
  - chore(deps): bump the cargo group with 8 updates (#1330)
  - chore(deps): bump the github-actions group with 2 updates
    (#1343)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764849600">- Update to version 1.18.0:
  * Enhancements
  - The use-trusted-publishing audit now detects NuGet publishing
    commands (#1369)
  - The dependabot-cooldown audit now flags cooldown periods of
    less than 7 days by default (#1375)
  - The dependabot-cooldown audit can now be configured with a
    custom minimum cooldown period via
    rules.dependabot-cooldown.config.days (#1377)
  - zizmor now produces slightly more useful error messages when
    the user supplies an invalid configuration for the
    forbidden-uses audit (#1381)
  * Bug Fixes
  - Fixed additional edge cases where auto-fixed would fail to
    preserve a document's final newline (#1372)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145600">- Update to version 1.19.0:
  * New Features
  - New audit: archived-uses detects usages of archived
    repositories in uses: clauses (#1411)
  * Enhancements
  - The use-trusted-publishing audit now detects additional
    publishing command patterns, including common "wrapped"
    patterns like bundle exec gem publish (#1394)
  - zizmor now produces better error messages on a handful of
    error cases involving invalid input files. Specifically, a
    subset of syntax and schema errors now produce more detailed
    and actionable error messages (#1396)
  - The use-trusted-publishing audit now detects additional
    publishing command patterns, including uv run ..., uvx ...,
    and poetry publish (#1402)
  - zizmor now produces more useful and less ambiguous spans for
    many findings, particularly those from the
    anonymous-definition audit (#1416)
  - zizmor now discovers configuration files named zizmor.yaml,
    in addition to zizmor.yml (#1431)
  - zizmor now produces a more useful error message when input
    collection yields no inputs (#1439)
  - The --render-links flag now allows users to control zizmor's
    OSC 8 terminal link rendering behavior. This is particularly
    useful in environments that advertise themselves as terminals
    but fail to correctly render or ignore OSC 8 links (#1454)
  * Performance Improvements
  - The [impostor-commit] audit is now significantly faster on
    true positives, making true positive detection virtually as
    fast as true negative detection. In practice, true positive
    runs are over 100 times faster than before (#1429)
  * Bug Fixes
  - Fixed a bug where the obfuscation audit would crash if it
    encountered a CMD shell that was defined outside of the
    current step block (i.e. as a job or workflow default)
    (#1418)
  - Fixed a bug where the opentofu ecosystem was not recognized
    in Dependabot configuration files (#1452)
  - --color=always no longer implies --render-links=always, as
    some environments (like GitHub Actions) support ANSI color
    codes but fail to handle OSC escapes gracefully (#1454)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 1.20.0:
  * Enhancements
  - The excessive-permissions audit is now aware of the
    artifact-metadata and models permissions (#1461)
  - The cache-poisoning audit is now aware of the
    ramsey/composer-install action (#1489)
  - The unpinned-images audit is now significantly more precise
    in the presence of matrix references, e.g. image: ${{
    matrix.image }} (#1482)
  * Changes
  - The default policy for the unpinned-uses audit has changed
    from allowing ref-pinning for first-party actions (those
    under actions/* and similar) to requiring hash-pinning. This
    makes the default policy more strict, as well as more
    consistent across the actions ecosystem.
    Users who with to retain the old (permissive policy) for
    first-party actions may configure it explicitly in their
    zizmor.yml:
    zizmor.yml
    rules:
    unpinned-uses:
    config:
    policies:
    actions/*: ref-pin
    github/*: ref-pin
    dependabot/*: ref-pin
  * Bug Fixes
  - The dependabot-cooldown audit no longer flags missing
    cooldowns on ecosystems that don't (yet) support cooldowns,
    such as opentofu (#1480)
  - Fixed a false positive in the cache-poisoning audit where
    zizmor would treat empty strings (e.g. cache: '') as enabling
    rather than disabling caching (#1482)
  - Fixed two gaps in the use-trusted-publishing audit's
    detection of common yarn publishing commands (#1495)
  * Miscellaneous
  - zizmor's configuration now has an official JSON schema that
    will be available via SchemaStore soon!  Many thanks to
    @kiwamizamurai for implementing this improvement!</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768564800">- Update to version 1.21.0:
  * New Features
  - New audit: misfeature detects usage of GitHub Actions
    features that are considered "misfeatures." (#1517)
  * Enhancements
  - zizmor now uses exit code 3 to signal an audit that has
    failed because no input files were collected. See the exit
    code documentation for details (#1515)
  - The unpinned-uses audit now supports auto-fixes for many
    findings (#1525)
  * Changes
  - The obfuscation audit no longer flags shell: cmd. That check
    has been moved to the new misfeature audit. Users may need to
    update their ignore comments and/or configuration (#1517)
  * Bug Fixes
  - The unpinned-uses audit now flags reusable workflows that are
    unpinned, in addition to actions (#1509)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768824000">- Update to version 1.22.0:
  * Changes
  - The misfeature audit now only shows non-"well known" shell:
    findings when running with the "auditor" persona (#1532)
  * Bug Fixes
  - Fixed a bug where inputs containing CRLF line endings were
    not patched correctly by the unpinned-uses audit (#1536)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773057600">- Update to version 1.23.1:
  * Bug Fixes
  - Fixed a bug where zizmor would error if given both a GH_TOKEN
    and a GITHUB_TOKEN (or ZIZMOR_GITHUB_TOKEN) via the
    environment (#1724)
- Update to version 1.23.0:
  * New Features
  - New audit: secrets-outside-env detects usage of the secrets
    context in jobs that don't have a corresponding environment
    (#1599)
  - New audit: superfluous-actions detects usage of actions that
    perform operations already provided by GitHub's own runner
    images (#1618)
  * Enhancements
  - zizmor's LSP mode is now configuration-aware, and will load
    configuration files relative to workspace roots (#1555)
  - zizmor now reads the GITHUB_TOKEN environment variable as an
    alias/equivalent for GH_TOKEN (#1566)
  - zizmor now supports inputs that contain duplicated anchor
    names (#1575)
  - zizmor now flags missing cooldowns on opentofu ecosystem
    definitions in Dependabot (again) (#1586)
  - zizmor now reads the ZIZMOR_GITHUB_TOKEN environment variable
    as an alias/equivalent for GH_TOKEN and GITHUB_TOKEN (#1641)
  - The SARIF output format now adds zizmor/confidence,
    zizmor/persona and zizmor/severity to the properties of
    findings (#1656)
  - Added awalsh128/cache-apt-pkgs-action as a cache-aware action
    to the cache-poisoning audit (#1708)
  * Changes
  - SARIF categories have been regraded. zizmor's "medium" is
    changed from SARIF's "warning" to "low" (#1635)
  * Bug Fixes
  - Fixed a bug where zizmor would crash on uses: clauses
    containing non-significant whitespace while performing the
    unpinned-uses audit (#1544)
  - Fixed a bug in yamlpath where sequences containing anchors
    were splatted instead of being properly nested (#1557)
  - Fixed a bug in yamlpath where anchor prefixes in sequences
    and mapping were not stripped during path queries (#1562)
  - Fixed a bug where "merge into" autofixes would produce
    incorrect patches in the presence of multi-byte Unicode
    characters (#1581)
  - Fixed a bug where the template-injection audit would produce
    duplicated pedantic-only findings (#1589)
  - Fixed a bug where the obfuscation audit would produce
    incorrect autofixes for a subset of constant-reducible
    expressions (#1597)
  - Fixed a bug where the obfuscation audit would fail to apply
    fixes to a subset of inputs with leading whitespace (#1597)
  - Fixed a bug where the concurrency-limits audit would
    incorrectly flag reusable-only workflows as needing a
    concurrency: key (#1620)
  - Fixed a bug where the known-vulnerable-actions audit would
    fail when applying some fixes (#1640)
  - Fixed a bug where the pre-commit ecosystem was not recognized
    in Dependabot configuration files (#1637)
  - Fixed a bug where the template-injection audit would
    incorrectly flag github.triggering_actor as an injection risk
    in the default persona (#1645)
  - Fixed a bug where zizmor's expression parser did not
    correctly handle number literals in GitHub Actions
    expressions (#1625)
  - Fixed a bug where the template-injection audit would crash on
    some forms of multi-line expressions (#1669)
  - Fixed a bug where deserialization of a workflow containing
    fractional minutes would fail (#1675)
  - Fixed a bug where deserialization of a workflow where a
    workflow_run with a scalar types would fail (#1676)
  - Fixed a bug where zizmor would crash on workflows containing
    bare numeric values in if: conditions (#1683)
  - Fixed a bug where GitHub Actions expression string
    comparisons were not case-insensitive (#1687)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776081600">- Update to version 1.24.0:
  * New Features
  - zizmor now allows users to audit from stdin, by passing
    zizmor - (#1611)
  * Enhancements
  - The use-trusted-publishing audit now detects bun publish and
    bunx npm publish patterns (#1737)
  - zizmor's CLI help and usage output now uses a custom color
    scheme for improved readability (#1747)
  - The secrets-outside-env audit is now configurable with an
    allowlist of secret names that should not be flagged, even
    when referenced outside of an environment (#1759)
  - The dependabot-cooldown audit now emits a pedantic finding
    whenever it encounters a cooldown used with a
    multi-ecosystem-group, as the two do not interact well
    (#1780)
  - Recommend gh release upload as a replacement for
    svenstaro/upload-release-action in superfluous-actions
    (#1801)
  - Recommend gh issue create as a replacement for
    dacbd/create-issue-action in superfluous-actions (#1873)
  - The obfuscation audit now emits a finding for with: ${{ expr
    }} clauses cannot be analyzed (#1772)
  - zizmor --help is now rendered with option groups for improved
    readability (#1831)
  - zizmor's SARIF output now uses codeflows instead of related
    locations, improving its rendering behavior on GitHub
    Advanced Security (#1843)
  - The ref-version-mismatch audit now uses a more useful audit
    description for its findings (#1843)
  - The unpinned-images audit now produces more precise findings
    for image references that are computed through expressions
    (#1756)
  - The ref-version-mismatch audit now detects missing version
    comments as well (#1849)
  * Bug Fixes
  - Fixed a bug where the concurrency-limits audit reported
    findings at the job level instead of the workflow level
    (#1627)
  - Fixed a bug where with: ${{ expr }} clauses would cause a
    crash. artipacked audit emits a pedantic finding on such
    clauses. (#1772)
  - Fixed a bug where auto-fixes for the template-injection audit
    would fail to preserve an environment variable's casing
    (#1766)
  - Fixed a bug where the secrets-outside-env audit would
    incorrectly flag reusable workflows (#1777)
  - Fixed a bug where expressions containing Infinity or NaN
    would fail to parse (#1778)
  - Fixed several bugs where some parenthetical forms in
    expressions would fail to parse (#1779, #1856)
  - Fixed a bug where expressions with invalid identifiers (such
    as -Inf) would be incorrectly accepted (#1794)
  - Fixed a bug where the known-vulnerable-actions audit would
    fail to handle multiple discrete packages in a single
    advisory (#1810)
  - Fixed a bug where the template-injection audit would
    incorrectly flag needs.*.result as an injection risk in the
    default persona (#1814)
  - Fixed a bug where the unpinned-uses audit would product
    incorrect auto-fixes for actions with subpaths (#1841)
  - Fixed a bug where the ref-version-mismatch audit would fail
    to produce findings for comments containing nonexistent refs
    (#1853)
  - Fixed a bug where expressions containing NaN would be
    constant-evaluated incorrectly (#1858)
  - Fixed a bug where nix would not be recognized as a
    package-ecosystem in dependabot.yml (#1867)
  - Fixed a bug where the ref-version-mismatch audit would
    incorrectly parse prerelease version comments (such as #
    v6-beta), causing some findings to appear unresolvable
    (#1870)
  - Fixed a bug where various string comparisons in expressions
    did not perfectly match GitHub's own special uppercasing
    semantics (#1879)
  - Fixed a bug where zizmor would incorrectly contact github.com
    instead of the user's requested --gh-hostname for some online
    requests (#1874)
  - Fixed a bug where the artipacked audit would fail to honor
    the --no-online-audits flag (#1874)
  * Changes
  - The secrets-outside-env audit now only flags findings with
    the 'auditor' persona, due to numerous false positives and
    negatives caused by GitHub's platform limitations (primarily
    around interactions between environment secrets and reusable
    workflows) (#1777)
  - zizmor's handling of GitHub Actions expressions has been made
    stricter, and now rejects unknown functions and function
    calls with incorrect arities (#1823, #1826)
  - The superfluous-actions audit now uses the "pedantic" persona
    for some findings along with a medium or low confidence
    marker to signal when a action may not be easily replaced
    with built-in functionality (#1822, #1859)
  - The unpinned-uses audit no longer suggests auto-fixes for Git
    references that don't look like version tags, such as main
    (#1860)
  - The template-injection audit now considers more "URL-shaped"
    contexts to be fully attacker-controllable, rather than
    partially controllable (#1868)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776513600">- Update to version 1.24.1:
  * Bug Fixes
  - Fixed a bug where the ref-version-mismatch audit would
    incorrectly flag some version comments as not containing an
    appropriate version (#1900)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778846400">- Update to version 1.25.0:
  * New Features
  - zizmor's finding severities can now be remapped on a
    per-audit basis. See the configuration for details (#1913)
  - New audit: github-app detects dangerous usages of GitHub App
    installation tokens (#1926)
  - New audit: [unpinned-tools] detects actions that install
    tools without pinning to a specific version (#1820)
  - zizmor now accepts the --no-ignores flag to disable all
    ignore comments and configurations when reporting findings
    (#1935)
  - zizmor's LSP now honors the --persona flag on the CLI (#1943)
  - zizmor is now aware of Docker-based action definitions, in
    addition to the pre-existing support for "composite" actions
    (#1965)
  * Enhancements
  - Recommend gh issue edit --add-label / gh pr edit --add-label
    as a replacement for actions-ecosystem/action-add-labels in
    superfluous-actions
  - Recommend gh issue edit --remove-label / gh pr edit
  - -remove-label as a replacement for
    actions-ecosystem/action-remove-labels in superfluous-actions
  - Recommend jq as a replacement for sergeysova/jq-action in
    superfluous-actions
  - Recommend git add, git commit, and git push as a replacement
    for stefanzweifel/git-auto-commit-action in
    superfluous-actions
  - Recommend git add, git commit, and git push as a replacement
    for EndBug/add-and-commit in superfluous-actions
  - tibdex/github-app-token is now recognized as an archived
    action by archived-uses (#1910)
  - The [dangerous-triggers] audit now explicitly exempts
    workflows that only invoke actions/labeler (#1956)
  - The unpinned-images audit now detects unpinned image
    references in Docker-based action definitions (#1965)
  - zizmor's SARIF output now provides slightly more detailed
    finding messages (#1972)
  - The archived-uses audit now detects more archived actions
    (#1978)
  - deno is now recognized as a package-ecosystem in
    dependabot.yml (#1991)
  * Performance Improvements
  - The impostor-commit audit is now significantly faster (in
    addition to being more correct) when the user has pinned
    their action to a tag SHA instead of a commit SHA (#1998)
  * Bug Fixes
  - Fixed a crash in the template-injection audit when a workflow
    uses a parenthesized compound expression in context position
    (#1904)
  - Fixed a bug where local directory input collection could miss
    workflows for relative-path invocations from within .github
    subdirectories (#1909)
  - Fixed a bug where the unpinned-images audit would miss images
    defined in container: clauses (#1944)
  - Fixed a bug where inline ignore comments could not be easily
    applied to superfluous-actions findings (#1945)
  - Fixed a bug where the cache-poisoning audit would fail to
    detect some release trigger patterns (#1946)
  - Fixed a bug where inline ignore comments could not be easily
    applied to cache-poisoning findings (#1962)
  - Fixed a class of imprecisions where the cache-poisoning audit
    would incorrectly flag cache usage that doesn't actually
    occur on release events (#1940)
  - Fixed a bug where dependabot.yml files containing a private
    cargo repository couldn't be parsed (#1976)
  - Fixed a bug where zizmor's input validation warnings lacked a
    mention of which files failed to validate (#1980)
  - Fixed a bug where the impostor-commit audit would falsely
    indicate impostor commits if an action was pinned to a tag
    SHA instead of a commit SHA (#1998)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 1.25.2:
  * Bug Fixes
  - Fixed a bug where the unpinned-tools audit would incorrectly
    flag the aquasecurity/trivy-action action as installing an
    unpinned tool version, rather than aquasecurity/setup-trivy
    (#2018)
- Update to version 1.25.1:
  * Bug Fixes
  - Fixed a bug where the cache-poisoning audit would fail to
    consider release events as exempt from cache usage findings
    when filtered by a tag condition (#2004)
  - Fixed a typo when suggesting --fix flags for findings (#2010)
  - Fixed a typo in unpinned-tools annotations (#2008)
  - Fixed a bug where the github-app audit would incorrectly flag
    some safe uses of actions/create-github-app-token as unsafe
    (#2011)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782043200">- Update to version 1.26.1:
  This is a small corrective release for 1.26.0.
- Update to version 1.26.0:
  * New Features
  - New audit: typosquat-uses detects uses: clauses that
    reference likely typoed actions (#1985)
  - New audit: unsound-ternary detects pseudo-ternary expressions
    that don't evaluate as expected (#2085)
  - New audit: adhoc-packages detects run: steps that install
    packages in an ad-hoc manner (#2061)
  * Enhancements
  - The cache-poisoning audit now detects additional cache
    disablement heuristics (#2053)
  - The known-vulnerable-actions audit is now configurable. See
    the configuration documentation for details (#2084)
  - The excessive-permissions audit is now aware of the
    code-quality permission (#2088)
  - The unpinned-uses audit's auto-fix now uses the fully
    qualified version tag (e.g. # v6.0.2) when fixing a
    major-version ref (e.g. @v6) (#2127)
  * Performance Improvements
  - Most online audits are significantly faster, thanks to more
    precise retry handling (#2036)
  * Bug Fixes
  - Fixed a bug where zizmor's LSP would not recognize
    dependabot.yaml files in its default configuration (#2026)
  - Fixed a bug where ref-version-mismatch would fail to fully
    match some version comments (#2040)
  - Fixed a bug where dependabot-cooldown would fail to honor the
    user's configured days when performing autofixes (#2055)
  - Steps and jobs gated by statically-false if: conditions (e.g.
    if: false, if: ${{ false }}) are now skipped during auditing,
    since they cannot execute (#2059, #2069)
  - Fixed a bug where ref-version-mismatch would fail to identify
    some valid version comments (#2073)
  - Fixed a bug where unpinned-images would incorrectly flag
    empty matrix expansions as unpinned container image
    references (#2102)
  - Fixed a bug where unpinned-images would incorrectly flag some
    matrix expansions as unpinned (#2098)
  - The SARIF (--format=sarif) and GitHub Annotations
    (--format=github) output formats now provide more
    correct/useful paths, particularly when the user provides a
    relative path as input to zizmor rather than zizmor . (#1748,
    [#2095])
  * Changes
  - The impostor-commit audit no longer suggests auto-fixes, to
    avoid incorrectly minimizing the amount of manual remediation
    work needed (#2054)
  - The JSON and SARIF outputs no longer contain a misleading
    prefix key (#2095)
  * Dependencies
  - chore(deps): bump http from 1.4.1 to 1.4.2 in the cargo group
    (#2125)
  - chore(deps): bump the github-actions group across 1 directory
    with 3 updates (#2119)
  - chore(deps): bump the cargo group across 1 directory with 2
    updates (#2118)
  - chore(deps): bump CodSpeedHQ/action from 4.15.1 to 4.17.0 in
    the github-actions group (#2109)
  - chore(deps): bump the github-actions group with 5 updates
    (#2091)
  - chore(deps): bump the cargo group with 5 updates (#2090)
  - chore(deps): bump the cargo group with 3 updates (#2066)
  - chore(deps): bump the github-actions group with 2 updates
    (#2067)
  - chore(deps): bump the cargo group with 3 updates (#2034)
  - chore(deps): bump the github-actions group with 2 updates
    (#2035)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784030400">- Update to version 1.27.0:
  * New Features
  - zizmor now has experimental support for workflows that
    specify parallel steps. See Usage - Parallel steps for more
    information (#2153)
  * Enhancements
  - zizmor's handling of paths is now more consistent,
    particularly when run on Windows (#2163)
  - zizmor now emits a helpful warning when being run in implicit
    offline mode (#2180)
  * Bug Fixes
  - Fixed a bug where the secrets-outside-env audit would not
    honor ignore comments within the same job scope (#2157)
  - Fixed a bug where the ref-version-mismatch audit would not
    honor ignore comments within the same steps scope (#2177)
  - Fixed a bug where --collect=[MODE] was not correctly handled
    when auditing remote inputs (#2185)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784721600">- Update to version 1.28.0:
  * Security
  - v1.27.0 contained a logging defect that would print any
    configured GitHub credentials as part of zizmor's cleartext
    logging. No versions other than v1.27.0 were affected. See
    GHSA-f42p-wjw5-97qh for full information.
  - Many thanks to @shaanmajid for finding and reporting this
    vulnerability.
  * Enhancements
  - The JSON (v1) output format now includes metadata for each
    finding's fixes, if the finding has fixes (#2186)
  - The dependabot-cooldown audit is now aware of GitHub's new
    three-day default cooldown (#2193)
  - sbt is now recognized as a package-ecosystem in
    dependabot.yml (#2211)
  * Bug Fixes
  - Fixed a bug where the template-injection audit would
    incorrectly flag steps..outcome and steps..conclusion as
    injection risks in the default persona (#2199)
  - Fixed a bug where the github-env audit would incorrectly flag
    some printf calls as exploitable (#2201)
  - Fixed a bug where zizmor would produce a misleading and
    confusing error message when asked to audit an ambiguous
    remote input (#2205)</changelog>
</package>
<package pkgid="588b6a2df2cdb6568a86914ea1cf4285f8c0c06c9a08a4b3a297774e171ed9e8042bbc5eaa65765def38ae62ecbe3f83b5bf67b6556f1b6dcd14e5d09f75450c" name="zizmor-debugsource" arch="s390x">
  <version epoch="0" ver="1.28.0" rel="74.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760443200">- Update to version 1.15.1:
  * Bug Fixes
  - Fixed a bug where zizmor would fail to parse Dependabot
    configuration files due to missing support for some package
    ecosystems (#1240)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- Update to version 1.15.2:
  * Bug Fixes
  - Fixed a bug where zizmor would fail to parse some Dependabot
    configuration files due to missing support for some schedule
    formats (#1247)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761307200">- Update to version 1.16.0:
  * New Features
  - New audit: concurrency-limits detects insufficient
    concurrency limits in workflows (#1227)
  - Many thanks to @jwallwork23 for proposing and implementing
    this audit!
  * Performance Improvements
  - zizmor's online mode is now significantly (40% to over 95%)
    faster on common workloads, thanks to a combination of
    caching improvements and conversion of GitHub API requests
    into Git remote lookups (#1257)
  - Many thanks to @Bo98 for implementing these improvements!
  * Enhancements
  - When running in --fix mode and all fixes are successfully
    applied, zizmor now has similar exit code behavior as the
  - -no-exit-codes and --format=sarif flags (#1242)
  - Many thanks to @cnaples79 for implementing this improvement!
  - The dependabot-cooldown audit now supports auto-fixes for
    many findings (#1229)
  - Many thanks to @mostafa for implementing this improvement!
  - The dependabot-execution audit now supports auto-fixes for
    many findings (#1229)
  - Many thanks to @mostafa for implementing this improvement!
  - zizmor now has limited, experimental support for handling
    inputs that contain YAML anchors (#1266)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761739200">- Update to version 1.16.1:
  * Enhancements
  - zizmor now produces a more useful error message when asked to
    indirectly access a nonexistent or private repository via a
    uses: clause (without a sufficiently privileged GitHub token)
    (#1293)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762084800">- Update to version 1.16.2:
  * Enhancements
  - The concurrency-limits audit no longer flags explicit user
    concurrency overrides, e.g. cancel-in-progress: false (#1302)
  - zizmor now detects CI environments and specializes its panic
    handling accordingly, improving the quality of panic reports
    when running in CI (#1307)
  * Bug Fixes
  - Fixed a bug where zizmor would reject some Dependabot
    configuration files with logically unsound schedules (but
    that are accepted by GitHub regardless) (#1308)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762344000">- Update to version 1.16.3:
  * Bug Fixes
  - Fixed a bug where zizmor would crash on an unexpected caching
    middleware state. zizmor will now exit with a controlled
    error instead (#1319)
  * Dependencies
  - chore(deps): bump the cargo group with 2 updates (#1316)
  - chore(deps): bump the github-actions group with 3 updates
    (#1317)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764158400">- Update to version 1.17.0:
  * Enhancements
  - zizmor now produces a more useful error message when asked to
    collect only workflows from a remote input that contains no
    workflows (#1324)
  - zizmor now produces more precise severities on
    actions/checkout versions that have more misuse-resistant
    credentials persistence behavior (#1353)
  - Many thanks to @ManuelLerchnerQC for proposing and
    implementing this improvement!
  - The use-trusted-publishing audit now correctly detecting more
    "dry-run" patterns, making it significantly more accurate
    (#1357)
  - The obfuscation audit now detects usages of shell: cmd and
    similar, as the Windows CMD shell lacks a formal grammar and
    limits analysis of run: blocks in other audits (#1361)
  * Performance Improvements
  - zizmor's core has been refactored to be asynchronous, making
    online and I/O-heavy audits significantly faster. Typical
    user workloads should see speedups of 40% to 70% (#1314)
  * Bug Fixes
  - Fixed a bug where auto-fixes would fail to preserve a
    document's final newline (#1323)
  - zizmor now uses the native (OS) TLS roots when performing
    HTTPS requests, improving compatibility with user
    environments that perform TLS interception (#1328)
  - The github-env audit now falls back to assuming bash-like
    shell syntax in run: blocks if it can't infer the shell being
    used (#1336)
  - The concurrency-limits audit now correctly detects job-level
    concurrency settings, in addition to workflow-level settings
    (#1338)
  - Fixed a bug where zizmor would fail to collect workflows with
    names that overlapped with other input types (e.g. action.yml
    and dependabot.yml) when passed explicitly by path (#1345)
  * Dependencies
  - chore(deps): bump github/codeql-action in the github-actions
    group (#1331)
  - chore(deps): bump the cargo group with 3 updates (#1358)
  - chore(deps): bump the cargo group with 8 updates (#1330)
  - chore(deps): bump the github-actions group with 2 updates
    (#1343)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764849600">- Update to version 1.18.0:
  * Enhancements
  - The use-trusted-publishing audit now detects NuGet publishing
    commands (#1369)
  - The dependabot-cooldown audit now flags cooldown periods of
    less than 7 days by default (#1375)
  - The dependabot-cooldown audit can now be configured with a
    custom minimum cooldown period via
    rules.dependabot-cooldown.config.days (#1377)
  - zizmor now produces slightly more useful error messages when
    the user supplies an invalid configuration for the
    forbidden-uses audit (#1381)
  * Bug Fixes
  - Fixed additional edge cases where auto-fixed would fail to
    preserve a document's final newline (#1372)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145600">- Update to version 1.19.0:
  * New Features
  - New audit: archived-uses detects usages of archived
    repositories in uses: clauses (#1411)
  * Enhancements
  - The use-trusted-publishing audit now detects additional
    publishing command patterns, including common "wrapped"
    patterns like bundle exec gem publish (#1394)
  - zizmor now produces better error messages on a handful of
    error cases involving invalid input files. Specifically, a
    subset of syntax and schema errors now produce more detailed
    and actionable error messages (#1396)
  - The use-trusted-publishing audit now detects additional
    publishing command patterns, including uv run ..., uvx ...,
    and poetry publish (#1402)
  - zizmor now produces more useful and less ambiguous spans for
    many findings, particularly those from the
    anonymous-definition audit (#1416)
  - zizmor now discovers configuration files named zizmor.yaml,
    in addition to zizmor.yml (#1431)
  - zizmor now produces a more useful error message when input
    collection yields no inputs (#1439)
  - The --render-links flag now allows users to control zizmor's
    OSC 8 terminal link rendering behavior. This is particularly
    useful in environments that advertise themselves as terminals
    but fail to correctly render or ignore OSC 8 links (#1454)
  * Performance Improvements
  - The [impostor-commit] audit is now significantly faster on
    true positives, making true positive detection virtually as
    fast as true negative detection. In practice, true positive
    runs are over 100 times faster than before (#1429)
  * Bug Fixes
  - Fixed a bug where the obfuscation audit would crash if it
    encountered a CMD shell that was defined outside of the
    current step block (i.e. as a job or workflow default)
    (#1418)
  - Fixed a bug where the opentofu ecosystem was not recognized
    in Dependabot configuration files (#1452)
  - --color=always no longer implies --render-links=always, as
    some environments (like GitHub Actions) support ANSI color
    codes but fail to handle OSC escapes gracefully (#1454)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 1.20.0:
  * Enhancements
  - The excessive-permissions audit is now aware of the
    artifact-metadata and models permissions (#1461)
  - The cache-poisoning audit is now aware of the
    ramsey/composer-install action (#1489)
  - The unpinned-images audit is now significantly more precise
    in the presence of matrix references, e.g. image: ${{
    matrix.image }} (#1482)
  * Changes
  - The default policy for the unpinned-uses audit has changed
    from allowing ref-pinning for first-party actions (those
    under actions/* and similar) to requiring hash-pinning. This
    makes the default policy more strict, as well as more
    consistent across the actions ecosystem.
    Users who with to retain the old (permissive policy) for
    first-party actions may configure it explicitly in their
    zizmor.yml:
    zizmor.yml
    rules:
    unpinned-uses:
    config:
    policies:
    actions/*: ref-pin
    github/*: ref-pin
    dependabot/*: ref-pin
  * Bug Fixes
  - The dependabot-cooldown audit no longer flags missing
    cooldowns on ecosystems that don't (yet) support cooldowns,
    such as opentofu (#1480)
  - Fixed a false positive in the cache-poisoning audit where
    zizmor would treat empty strings (e.g. cache: '') as enabling
    rather than disabling caching (#1482)
  - Fixed two gaps in the use-trusted-publishing audit's
    detection of common yarn publishing commands (#1495)
  * Miscellaneous
  - zizmor's configuration now has an official JSON schema that
    will be available via SchemaStore soon!  Many thanks to
    @kiwamizamurai for implementing this improvement!</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768564800">- Update to version 1.21.0:
  * New Features
  - New audit: misfeature detects usage of GitHub Actions
    features that are considered "misfeatures." (#1517)
  * Enhancements
  - zizmor now uses exit code 3 to signal an audit that has
    failed because no input files were collected. See the exit
    code documentation for details (#1515)
  - The unpinned-uses audit now supports auto-fixes for many
    findings (#1525)
  * Changes
  - The obfuscation audit no longer flags shell: cmd. That check
    has been moved to the new misfeature audit. Users may need to
    update their ignore comments and/or configuration (#1517)
  * Bug Fixes
  - The unpinned-uses audit now flags reusable workflows that are
    unpinned, in addition to actions (#1509)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768824000">- Update to version 1.22.0:
  * Changes
  - The misfeature audit now only shows non-"well known" shell:
    findings when running with the "auditor" persona (#1532)
  * Bug Fixes
  - Fixed a bug where inputs containing CRLF line endings were
    not patched correctly by the unpinned-uses audit (#1536)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773057600">- Update to version 1.23.1:
  * Bug Fixes
  - Fixed a bug where zizmor would error if given both a GH_TOKEN
    and a GITHUB_TOKEN (or ZIZMOR_GITHUB_TOKEN) via the
    environment (#1724)
- Update to version 1.23.0:
  * New Features
  - New audit: secrets-outside-env detects usage of the secrets
    context in jobs that don't have a corresponding environment
    (#1599)
  - New audit: superfluous-actions detects usage of actions that
    perform operations already provided by GitHub's own runner
    images (#1618)
  * Enhancements
  - zizmor's LSP mode is now configuration-aware, and will load
    configuration files relative to workspace roots (#1555)
  - zizmor now reads the GITHUB_TOKEN environment variable as an
    alias/equivalent for GH_TOKEN (#1566)
  - zizmor now supports inputs that contain duplicated anchor
    names (#1575)
  - zizmor now flags missing cooldowns on opentofu ecosystem
    definitions in Dependabot (again) (#1586)
  - zizmor now reads the ZIZMOR_GITHUB_TOKEN environment variable
    as an alias/equivalent for GH_TOKEN and GITHUB_TOKEN (#1641)
  - The SARIF output format now adds zizmor/confidence,
    zizmor/persona and zizmor/severity to the properties of
    findings (#1656)
  - Added awalsh128/cache-apt-pkgs-action as a cache-aware action
    to the cache-poisoning audit (#1708)
  * Changes
  - SARIF categories have been regraded. zizmor's "medium" is
    changed from SARIF's "warning" to "low" (#1635)
  * Bug Fixes
  - Fixed a bug where zizmor would crash on uses: clauses
    containing non-significant whitespace while performing the
    unpinned-uses audit (#1544)
  - Fixed a bug in yamlpath where sequences containing anchors
    were splatted instead of being properly nested (#1557)
  - Fixed a bug in yamlpath where anchor prefixes in sequences
    and mapping were not stripped during path queries (#1562)
  - Fixed a bug where "merge into" autofixes would produce
    incorrect patches in the presence of multi-byte Unicode
    characters (#1581)
  - Fixed a bug where the template-injection audit would produce
    duplicated pedantic-only findings (#1589)
  - Fixed a bug where the obfuscation audit would produce
    incorrect autofixes for a subset of constant-reducible
    expressions (#1597)
  - Fixed a bug where the obfuscation audit would fail to apply
    fixes to a subset of inputs with leading whitespace (#1597)
  - Fixed a bug where the concurrency-limits audit would
    incorrectly flag reusable-only workflows as needing a
    concurrency: key (#1620)
  - Fixed a bug where the known-vulnerable-actions audit would
    fail when applying some fixes (#1640)
  - Fixed a bug where the pre-commit ecosystem was not recognized
    in Dependabot configuration files (#1637)
  - Fixed a bug where the template-injection audit would
    incorrectly flag github.triggering_actor as an injection risk
    in the default persona (#1645)
  - Fixed a bug where zizmor's expression parser did not
    correctly handle number literals in GitHub Actions
    expressions (#1625)
  - Fixed a bug where the template-injection audit would crash on
    some forms of multi-line expressions (#1669)
  - Fixed a bug where deserialization of a workflow containing
    fractional minutes would fail (#1675)
  - Fixed a bug where deserialization of a workflow where a
    workflow_run with a scalar types would fail (#1676)
  - Fixed a bug where zizmor would crash on workflows containing
    bare numeric values in if: conditions (#1683)
  - Fixed a bug where GitHub Actions expression string
    comparisons were not case-insensitive (#1687)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776081600">- Update to version 1.24.0:
  * New Features
  - zizmor now allows users to audit from stdin, by passing
    zizmor - (#1611)
  * Enhancements
  - The use-trusted-publishing audit now detects bun publish and
    bunx npm publish patterns (#1737)
  - zizmor's CLI help and usage output now uses a custom color
    scheme for improved readability (#1747)
  - The secrets-outside-env audit is now configurable with an
    allowlist of secret names that should not be flagged, even
    when referenced outside of an environment (#1759)
  - The dependabot-cooldown audit now emits a pedantic finding
    whenever it encounters a cooldown used with a
    multi-ecosystem-group, as the two do not interact well
    (#1780)
  - Recommend gh release upload as a replacement for
    svenstaro/upload-release-action in superfluous-actions
    (#1801)
  - Recommend gh issue create as a replacement for
    dacbd/create-issue-action in superfluous-actions (#1873)
  - The obfuscation audit now emits a finding for with: ${{ expr
    }} clauses cannot be analyzed (#1772)
  - zizmor --help is now rendered with option groups for improved
    readability (#1831)
  - zizmor's SARIF output now uses codeflows instead of related
    locations, improving its rendering behavior on GitHub
    Advanced Security (#1843)
  - The ref-version-mismatch audit now uses a more useful audit
    description for its findings (#1843)
  - The unpinned-images audit now produces more precise findings
    for image references that are computed through expressions
    (#1756)
  - The ref-version-mismatch audit now detects missing version
    comments as well (#1849)
  * Bug Fixes
  - Fixed a bug where the concurrency-limits audit reported
    findings at the job level instead of the workflow level
    (#1627)
  - Fixed a bug where with: ${{ expr }} clauses would cause a
    crash. artipacked audit emits a pedantic finding on such
    clauses. (#1772)
  - Fixed a bug where auto-fixes for the template-injection audit
    would fail to preserve an environment variable's casing
    (#1766)
  - Fixed a bug where the secrets-outside-env audit would
    incorrectly flag reusable workflows (#1777)
  - Fixed a bug where expressions containing Infinity or NaN
    would fail to parse (#1778)
  - Fixed several bugs where some parenthetical forms in
    expressions would fail to parse (#1779, #1856)
  - Fixed a bug where expressions with invalid identifiers (such
    as -Inf) would be incorrectly accepted (#1794)
  - Fixed a bug where the known-vulnerable-actions audit would
    fail to handle multiple discrete packages in a single
    advisory (#1810)
  - Fixed a bug where the template-injection audit would
    incorrectly flag needs.*.result as an injection risk in the
    default persona (#1814)
  - Fixed a bug where the unpinned-uses audit would product
    incorrect auto-fixes for actions with subpaths (#1841)
  - Fixed a bug where the ref-version-mismatch audit would fail
    to produce findings for comments containing nonexistent refs
    (#1853)
  - Fixed a bug where expressions containing NaN would be
    constant-evaluated incorrectly (#1858)
  - Fixed a bug where nix would not be recognized as a
    package-ecosystem in dependabot.yml (#1867)
  - Fixed a bug where the ref-version-mismatch audit would
    incorrectly parse prerelease version comments (such as #
    v6-beta), causing some findings to appear unresolvable
    (#1870)
  - Fixed a bug where various string comparisons in expressions
    did not perfectly match GitHub's own special uppercasing
    semantics (#1879)
  - Fixed a bug where zizmor would incorrectly contact github.com
    instead of the user's requested --gh-hostname for some online
    requests (#1874)
  - Fixed a bug where the artipacked audit would fail to honor
    the --no-online-audits flag (#1874)
  * Changes
  - The secrets-outside-env audit now only flags findings with
    the 'auditor' persona, due to numerous false positives and
    negatives caused by GitHub's platform limitations (primarily
    around interactions between environment secrets and reusable
    workflows) (#1777)
  - zizmor's handling of GitHub Actions expressions has been made
    stricter, and now rejects unknown functions and function
    calls with incorrect arities (#1823, #1826)
  - The superfluous-actions audit now uses the "pedantic" persona
    for some findings along with a medium or low confidence
    marker to signal when a action may not be easily replaced
    with built-in functionality (#1822, #1859)
  - The unpinned-uses audit no longer suggests auto-fixes for Git
    references that don't look like version tags, such as main
    (#1860)
  - The template-injection audit now considers more "URL-shaped"
    contexts to be fully attacker-controllable, rather than
    partially controllable (#1868)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776513600">- Update to version 1.24.1:
  * Bug Fixes
  - Fixed a bug where the ref-version-mismatch audit would
    incorrectly flag some version comments as not containing an
    appropriate version (#1900)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778846400">- Update to version 1.25.0:
  * New Features
  - zizmor's finding severities can now be remapped on a
    per-audit basis. See the configuration for details (#1913)
  - New audit: github-app detects dangerous usages of GitHub App
    installation tokens (#1926)
  - New audit: [unpinned-tools] detects actions that install
    tools without pinning to a specific version (#1820)
  - zizmor now accepts the --no-ignores flag to disable all
    ignore comments and configurations when reporting findings
    (#1935)
  - zizmor's LSP now honors the --persona flag on the CLI (#1943)
  - zizmor is now aware of Docker-based action definitions, in
    addition to the pre-existing support for "composite" actions
    (#1965)
  * Enhancements
  - Recommend gh issue edit --add-label / gh pr edit --add-label
    as a replacement for actions-ecosystem/action-add-labels in
    superfluous-actions
  - Recommend gh issue edit --remove-label / gh pr edit
  - -remove-label as a replacement for
    actions-ecosystem/action-remove-labels in superfluous-actions
  - Recommend jq as a replacement for sergeysova/jq-action in
    superfluous-actions
  - Recommend git add, git commit, and git push as a replacement
    for stefanzweifel/git-auto-commit-action in
    superfluous-actions
  - Recommend git add, git commit, and git push as a replacement
    for EndBug/add-and-commit in superfluous-actions
  - tibdex/github-app-token is now recognized as an archived
    action by archived-uses (#1910)
  - The [dangerous-triggers] audit now explicitly exempts
    workflows that only invoke actions/labeler (#1956)
  - The unpinned-images audit now detects unpinned image
    references in Docker-based action definitions (#1965)
  - zizmor's SARIF output now provides slightly more detailed
    finding messages (#1972)
  - The archived-uses audit now detects more archived actions
    (#1978)
  - deno is now recognized as a package-ecosystem in
    dependabot.yml (#1991)
  * Performance Improvements
  - The impostor-commit audit is now significantly faster (in
    addition to being more correct) when the user has pinned
    their action to a tag SHA instead of a commit SHA (#1998)
  * Bug Fixes
  - Fixed a crash in the template-injection audit when a workflow
    uses a parenthesized compound expression in context position
    (#1904)
  - Fixed a bug where local directory input collection could miss
    workflows for relative-path invocations from within .github
    subdirectories (#1909)
  - Fixed a bug where the unpinned-images audit would miss images
    defined in container: clauses (#1944)
  - Fixed a bug where inline ignore comments could not be easily
    applied to superfluous-actions findings (#1945)
  - Fixed a bug where the cache-poisoning audit would fail to
    detect some release trigger patterns (#1946)
  - Fixed a bug where inline ignore comments could not be easily
    applied to cache-poisoning findings (#1962)
  - Fixed a class of imprecisions where the cache-poisoning audit
    would incorrectly flag cache usage that doesn't actually
    occur on release events (#1940)
  - Fixed a bug where dependabot.yml files containing a private
    cargo repository couldn't be parsed (#1976)
  - Fixed a bug where zizmor's input validation warnings lacked a
    mention of which files failed to validate (#1980)
  - Fixed a bug where the impostor-commit audit would falsely
    indicate impostor commits if an action was pinned to a tag
    SHA instead of a commit SHA (#1998)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 1.25.2:
  * Bug Fixes
  - Fixed a bug where the unpinned-tools audit would incorrectly
    flag the aquasecurity/trivy-action action as installing an
    unpinned tool version, rather than aquasecurity/setup-trivy
    (#2018)
- Update to version 1.25.1:
  * Bug Fixes
  - Fixed a bug where the cache-poisoning audit would fail to
    consider release events as exempt from cache usage findings
    when filtered by a tag condition (#2004)
  - Fixed a typo when suggesting --fix flags for findings (#2010)
  - Fixed a typo in unpinned-tools annotations (#2008)
  - Fixed a bug where the github-app audit would incorrectly flag
    some safe uses of actions/create-github-app-token as unsafe
    (#2011)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782043200">- Update to version 1.26.1:
  This is a small corrective release for 1.26.0.
- Update to version 1.26.0:
  * New Features
  - New audit: typosquat-uses detects uses: clauses that
    reference likely typoed actions (#1985)
  - New audit: unsound-ternary detects pseudo-ternary expressions
    that don't evaluate as expected (#2085)
  - New audit: adhoc-packages detects run: steps that install
    packages in an ad-hoc manner (#2061)
  * Enhancements
  - The cache-poisoning audit now detects additional cache
    disablement heuristics (#2053)
  - The known-vulnerable-actions audit is now configurable. See
    the configuration documentation for details (#2084)
  - The excessive-permissions audit is now aware of the
    code-quality permission (#2088)
  - The unpinned-uses audit's auto-fix now uses the fully
    qualified version tag (e.g. # v6.0.2) when fixing a
    major-version ref (e.g. @v6) (#2127)
  * Performance Improvements
  - Most online audits are significantly faster, thanks to more
    precise retry handling (#2036)
  * Bug Fixes
  - Fixed a bug where zizmor's LSP would not recognize
    dependabot.yaml files in its default configuration (#2026)
  - Fixed a bug where ref-version-mismatch would fail to fully
    match some version comments (#2040)
  - Fixed a bug where dependabot-cooldown would fail to honor the
    user's configured days when performing autofixes (#2055)
  - Steps and jobs gated by statically-false if: conditions (e.g.
    if: false, if: ${{ false }}) are now skipped during auditing,
    since they cannot execute (#2059, #2069)
  - Fixed a bug where ref-version-mismatch would fail to identify
    some valid version comments (#2073)
  - Fixed a bug where unpinned-images would incorrectly flag
    empty matrix expansions as unpinned container image
    references (#2102)
  - Fixed a bug where unpinned-images would incorrectly flag some
    matrix expansions as unpinned (#2098)
  - The SARIF (--format=sarif) and GitHub Annotations
    (--format=github) output formats now provide more
    correct/useful paths, particularly when the user provides a
    relative path as input to zizmor rather than zizmor . (#1748,
    [#2095])
  * Changes
  - The impostor-commit audit no longer suggests auto-fixes, to
    avoid incorrectly minimizing the amount of manual remediation
    work needed (#2054)
  - The JSON and SARIF outputs no longer contain a misleading
    prefix key (#2095)
  * Dependencies
  - chore(deps): bump http from 1.4.1 to 1.4.2 in the cargo group
    (#2125)
  - chore(deps): bump the github-actions group across 1 directory
    with 3 updates (#2119)
  - chore(deps): bump the cargo group across 1 directory with 2
    updates (#2118)
  - chore(deps): bump CodSpeedHQ/action from 4.15.1 to 4.17.0 in
    the github-actions group (#2109)
  - chore(deps): bump the github-actions group with 5 updates
    (#2091)
  - chore(deps): bump the cargo group with 5 updates (#2090)
  - chore(deps): bump the cargo group with 3 updates (#2066)
  - chore(deps): bump the github-actions group with 2 updates
    (#2067)
  - chore(deps): bump the cargo group with 3 updates (#2034)
  - chore(deps): bump the github-actions group with 2 updates
    (#2035)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784030400">- Update to version 1.27.0:
  * New Features
  - zizmor now has experimental support for workflows that
    specify parallel steps. See Usage - Parallel steps for more
    information (#2153)
  * Enhancements
  - zizmor's handling of paths is now more consistent,
    particularly when run on Windows (#2163)
  - zizmor now emits a helpful warning when being run in implicit
    offline mode (#2180)
  * Bug Fixes
  - Fixed a bug where the secrets-outside-env audit would not
    honor ignore comments within the same job scope (#2157)
  - Fixed a bug where the ref-version-mismatch audit would not
    honor ignore comments within the same steps scope (#2177)
  - Fixed a bug where --collect=[MODE] was not correctly handled
    when auditing remote inputs (#2185)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784721600">- Update to version 1.28.0:
  * Security
  - v1.27.0 contained a logging defect that would print any
    configured GitHub credentials as part of zizmor's cleartext
    logging. No versions other than v1.27.0 were affected. See
    GHSA-f42p-wjw5-97qh for full information.
  - Many thanks to @shaanmajid for finding and reporting this
    vulnerability.
  * Enhancements
  - The JSON (v1) output format now includes metadata for each
    finding's fixes, if the finding has fixes (#2186)
  - The dependabot-cooldown audit is now aware of GitHub's new
    three-day default cooldown (#2193)
  - sbt is now recognized as a package-ecosystem in
    dependabot.yml (#2211)
  * Bug Fixes
  - Fixed a bug where the template-injection audit would
    incorrectly flag steps..outcome and steps..conclusion as
    injection risks in the default persona (#2199)
  - Fixed a bug where the github-env audit would incorrectly flag
    some printf calls as exploitable (#2201)
  - Fixed a bug where zizmor would produce a misleading and
    confusing error message when asked to audit an ambiguous
    remote input (#2205)</changelog>
</package>
<package pkgid="69accb206d1e4dba42c0a605a6c73ebf984db3475b69256fd8c377f2a35e1ad3499cf95791ac480cd0bc959922a6f7695aa18edeaedebb9627b87395f14a20dc" name="zizmor-fish-completion" arch="noarch">
  <version epoch="0" ver="1.28.0" rel="74.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760443200">- Update to version 1.15.1:
  * Bug Fixes
  - Fixed a bug where zizmor would fail to parse Dependabot
    configuration files due to missing support for some package
    ecosystems (#1240)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- Update to version 1.15.2:
  * Bug Fixes
  - Fixed a bug where zizmor would fail to parse some Dependabot
    configuration files due to missing support for some schedule
    formats (#1247)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761307200">- Update to version 1.16.0:
  * New Features
  - New audit: concurrency-limits detects insufficient
    concurrency limits in workflows (#1227)
  - Many thanks to @jwallwork23 for proposing and implementing
    this audit!
  * Performance Improvements
  - zizmor's online mode is now significantly (40% to over 95%)
    faster on common workloads, thanks to a combination of
    caching improvements and conversion of GitHub API requests
    into Git remote lookups (#1257)
  - Many thanks to @Bo98 for implementing these improvements!
  * Enhancements
  - When running in --fix mode and all fixes are successfully
    applied, zizmor now has similar exit code behavior as the
  - -no-exit-codes and --format=sarif flags (#1242)
  - Many thanks to @cnaples79 for implementing this improvement!
  - The dependabot-cooldown audit now supports auto-fixes for
    many findings (#1229)
  - Many thanks to @mostafa for implementing this improvement!
  - The dependabot-execution audit now supports auto-fixes for
    many findings (#1229)
  - Many thanks to @mostafa for implementing this improvement!
  - zizmor now has limited, experimental support for handling
    inputs that contain YAML anchors (#1266)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761739200">- Update to version 1.16.1:
  * Enhancements
  - zizmor now produces a more useful error message when asked to
    indirectly access a nonexistent or private repository via a
    uses: clause (without a sufficiently privileged GitHub token)
    (#1293)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762084800">- Update to version 1.16.2:
  * Enhancements
  - The concurrency-limits audit no longer flags explicit user
    concurrency overrides, e.g. cancel-in-progress: false (#1302)
  - zizmor now detects CI environments and specializes its panic
    handling accordingly, improving the quality of panic reports
    when running in CI (#1307)
  * Bug Fixes
  - Fixed a bug where zizmor would reject some Dependabot
    configuration files with logically unsound schedules (but
    that are accepted by GitHub regardless) (#1308)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762344000">- Update to version 1.16.3:
  * Bug Fixes
  - Fixed a bug where zizmor would crash on an unexpected caching
    middleware state. zizmor will now exit with a controlled
    error instead (#1319)
  * Dependencies
  - chore(deps): bump the cargo group with 2 updates (#1316)
  - chore(deps): bump the github-actions group with 3 updates
    (#1317)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764158400">- Update to version 1.17.0:
  * Enhancements
  - zizmor now produces a more useful error message when asked to
    collect only workflows from a remote input that contains no
    workflows (#1324)
  - zizmor now produces more precise severities on
    actions/checkout versions that have more misuse-resistant
    credentials persistence behavior (#1353)
  - Many thanks to @ManuelLerchnerQC for proposing and
    implementing this improvement!
  - The use-trusted-publishing audit now correctly detecting more
    "dry-run" patterns, making it significantly more accurate
    (#1357)
  - The obfuscation audit now detects usages of shell: cmd and
    similar, as the Windows CMD shell lacks a formal grammar and
    limits analysis of run: blocks in other audits (#1361)
  * Performance Improvements
  - zizmor's core has been refactored to be asynchronous, making
    online and I/O-heavy audits significantly faster. Typical
    user workloads should see speedups of 40% to 70% (#1314)
  * Bug Fixes
  - Fixed a bug where auto-fixes would fail to preserve a
    document's final newline (#1323)
  - zizmor now uses the native (OS) TLS roots when performing
    HTTPS requests, improving compatibility with user
    environments that perform TLS interception (#1328)
  - The github-env audit now falls back to assuming bash-like
    shell syntax in run: blocks if it can't infer the shell being
    used (#1336)
  - The concurrency-limits audit now correctly detects job-level
    concurrency settings, in addition to workflow-level settings
    (#1338)
  - Fixed a bug where zizmor would fail to collect workflows with
    names that overlapped with other input types (e.g. action.yml
    and dependabot.yml) when passed explicitly by path (#1345)
  * Dependencies
  - chore(deps): bump github/codeql-action in the github-actions
    group (#1331)
  - chore(deps): bump the cargo group with 3 updates (#1358)
  - chore(deps): bump the cargo group with 8 updates (#1330)
  - chore(deps): bump the github-actions group with 2 updates
    (#1343)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764849600">- Update to version 1.18.0:
  * Enhancements
  - The use-trusted-publishing audit now detects NuGet publishing
    commands (#1369)
  - The dependabot-cooldown audit now flags cooldown periods of
    less than 7 days by default (#1375)
  - The dependabot-cooldown audit can now be configured with a
    custom minimum cooldown period via
    rules.dependabot-cooldown.config.days (#1377)
  - zizmor now produces slightly more useful error messages when
    the user supplies an invalid configuration for the
    forbidden-uses audit (#1381)
  * Bug Fixes
  - Fixed additional edge cases where auto-fixed would fail to
    preserve a document's final newline (#1372)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145600">- Update to version 1.19.0:
  * New Features
  - New audit: archived-uses detects usages of archived
    repositories in uses: clauses (#1411)
  * Enhancements
  - The use-trusted-publishing audit now detects additional
    publishing command patterns, including common "wrapped"
    patterns like bundle exec gem publish (#1394)
  - zizmor now produces better error messages on a handful of
    error cases involving invalid input files. Specifically, a
    subset of syntax and schema errors now produce more detailed
    and actionable error messages (#1396)
  - The use-trusted-publishing audit now detects additional
    publishing command patterns, including uv run ..., uvx ...,
    and poetry publish (#1402)
  - zizmor now produces more useful and less ambiguous spans for
    many findings, particularly those from the
    anonymous-definition audit (#1416)
  - zizmor now discovers configuration files named zizmor.yaml,
    in addition to zizmor.yml (#1431)
  - zizmor now produces a more useful error message when input
    collection yields no inputs (#1439)
  - The --render-links flag now allows users to control zizmor's
    OSC 8 terminal link rendering behavior. This is particularly
    useful in environments that advertise themselves as terminals
    but fail to correctly render or ignore OSC 8 links (#1454)
  * Performance Improvements
  - The [impostor-commit] audit is now significantly faster on
    true positives, making true positive detection virtually as
    fast as true negative detection. In practice, true positive
    runs are over 100 times faster than before (#1429)
  * Bug Fixes
  - Fixed a bug where the obfuscation audit would crash if it
    encountered a CMD shell that was defined outside of the
    current step block (i.e. as a job or workflow default)
    (#1418)
  - Fixed a bug where the opentofu ecosystem was not recognized
    in Dependabot configuration files (#1452)
  - --color=always no longer implies --render-links=always, as
    some environments (like GitHub Actions) support ANSI color
    codes but fail to handle OSC escapes gracefully (#1454)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 1.20.0:
  * Enhancements
  - The excessive-permissions audit is now aware of the
    artifact-metadata and models permissions (#1461)
  - The cache-poisoning audit is now aware of the
    ramsey/composer-install action (#1489)
  - The unpinned-images audit is now significantly more precise
    in the presence of matrix references, e.g. image: ${{
    matrix.image }} (#1482)
  * Changes
  - The default policy for the unpinned-uses audit has changed
    from allowing ref-pinning for first-party actions (those
    under actions/* and similar) to requiring hash-pinning. This
    makes the default policy more strict, as well as more
    consistent across the actions ecosystem.
    Users who with to retain the old (permissive policy) for
    first-party actions may configure it explicitly in their
    zizmor.yml:
    zizmor.yml
    rules:
    unpinned-uses:
    config:
    policies:
    actions/*: ref-pin
    github/*: ref-pin
    dependabot/*: ref-pin
  * Bug Fixes
  - The dependabot-cooldown audit no longer flags missing
    cooldowns on ecosystems that don't (yet) support cooldowns,
    such as opentofu (#1480)
  - Fixed a false positive in the cache-poisoning audit where
    zizmor would treat empty strings (e.g. cache: '') as enabling
    rather than disabling caching (#1482)
  - Fixed two gaps in the use-trusted-publishing audit's
    detection of common yarn publishing commands (#1495)
  * Miscellaneous
  - zizmor's configuration now has an official JSON schema that
    will be available via SchemaStore soon!  Many thanks to
    @kiwamizamurai for implementing this improvement!</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768564800">- Update to version 1.21.0:
  * New Features
  - New audit: misfeature detects usage of GitHub Actions
    features that are considered "misfeatures." (#1517)
  * Enhancements
  - zizmor now uses exit code 3 to signal an audit that has
    failed because no input files were collected. See the exit
    code documentation for details (#1515)
  - The unpinned-uses audit now supports auto-fixes for many
    findings (#1525)
  * Changes
  - The obfuscation audit no longer flags shell: cmd. That check
    has been moved to the new misfeature audit. Users may need to
    update their ignore comments and/or configuration (#1517)
  * Bug Fixes
  - The unpinned-uses audit now flags reusable workflows that are
    unpinned, in addition to actions (#1509)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768824000">- Update to version 1.22.0:
  * Changes
  - The misfeature audit now only shows non-"well known" shell:
    findings when running with the "auditor" persona (#1532)
  * Bug Fixes
  - Fixed a bug where inputs containing CRLF line endings were
    not patched correctly by the unpinned-uses audit (#1536)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773057600">- Update to version 1.23.1:
  * Bug Fixes
  - Fixed a bug where zizmor would error if given both a GH_TOKEN
    and a GITHUB_TOKEN (or ZIZMOR_GITHUB_TOKEN) via the
    environment (#1724)
- Update to version 1.23.0:
  * New Features
  - New audit: secrets-outside-env detects usage of the secrets
    context in jobs that don't have a corresponding environment
    (#1599)
  - New audit: superfluous-actions detects usage of actions that
    perform operations already provided by GitHub's own runner
    images (#1618)
  * Enhancements
  - zizmor's LSP mode is now configuration-aware, and will load
    configuration files relative to workspace roots (#1555)
  - zizmor now reads the GITHUB_TOKEN environment variable as an
    alias/equivalent for GH_TOKEN (#1566)
  - zizmor now supports inputs that contain duplicated anchor
    names (#1575)
  - zizmor now flags missing cooldowns on opentofu ecosystem
    definitions in Dependabot (again) (#1586)
  - zizmor now reads the ZIZMOR_GITHUB_TOKEN environment variable
    as an alias/equivalent for GH_TOKEN and GITHUB_TOKEN (#1641)
  - The SARIF output format now adds zizmor/confidence,
    zizmor/persona and zizmor/severity to the properties of
    findings (#1656)
  - Added awalsh128/cache-apt-pkgs-action as a cache-aware action
    to the cache-poisoning audit (#1708)
  * Changes
  - SARIF categories have been regraded. zizmor's "medium" is
    changed from SARIF's "warning" to "low" (#1635)
  * Bug Fixes
  - Fixed a bug where zizmor would crash on uses: clauses
    containing non-significant whitespace while performing the
    unpinned-uses audit (#1544)
  - Fixed a bug in yamlpath where sequences containing anchors
    were splatted instead of being properly nested (#1557)
  - Fixed a bug in yamlpath where anchor prefixes in sequences
    and mapping were not stripped during path queries (#1562)
  - Fixed a bug where "merge into" autofixes would produce
    incorrect patches in the presence of multi-byte Unicode
    characters (#1581)
  - Fixed a bug where the template-injection audit would produce
    duplicated pedantic-only findings (#1589)
  - Fixed a bug where the obfuscation audit would produce
    incorrect autofixes for a subset of constant-reducible
    expressions (#1597)
  - Fixed a bug where the obfuscation audit would fail to apply
    fixes to a subset of inputs with leading whitespace (#1597)
  - Fixed a bug where the concurrency-limits audit would
    incorrectly flag reusable-only workflows as needing a
    concurrency: key (#1620)
  - Fixed a bug where the known-vulnerable-actions audit would
    fail when applying some fixes (#1640)
  - Fixed a bug where the pre-commit ecosystem was not recognized
    in Dependabot configuration files (#1637)
  - Fixed a bug where the template-injection audit would
    incorrectly flag github.triggering_actor as an injection risk
    in the default persona (#1645)
  - Fixed a bug where zizmor's expression parser did not
    correctly handle number literals in GitHub Actions
    expressions (#1625)
  - Fixed a bug where the template-injection audit would crash on
    some forms of multi-line expressions (#1669)
  - Fixed a bug where deserialization of a workflow containing
    fractional minutes would fail (#1675)
  - Fixed a bug where deserialization of a workflow where a
    workflow_run with a scalar types would fail (#1676)
  - Fixed a bug where zizmor would crash on workflows containing
    bare numeric values in if: conditions (#1683)
  - Fixed a bug where GitHub Actions expression string
    comparisons were not case-insensitive (#1687)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776081600">- Update to version 1.24.0:
  * New Features
  - zizmor now allows users to audit from stdin, by passing
    zizmor - (#1611)
  * Enhancements
  - The use-trusted-publishing audit now detects bun publish and
    bunx npm publish patterns (#1737)
  - zizmor's CLI help and usage output now uses a custom color
    scheme for improved readability (#1747)
  - The secrets-outside-env audit is now configurable with an
    allowlist of secret names that should not be flagged, even
    when referenced outside of an environment (#1759)
  - The dependabot-cooldown audit now emits a pedantic finding
    whenever it encounters a cooldown used with a
    multi-ecosystem-group, as the two do not interact well
    (#1780)
  - Recommend gh release upload as a replacement for
    svenstaro/upload-release-action in superfluous-actions
    (#1801)
  - Recommend gh issue create as a replacement for
    dacbd/create-issue-action in superfluous-actions (#1873)
  - The obfuscation audit now emits a finding for with: ${{ expr
    }} clauses cannot be analyzed (#1772)
  - zizmor --help is now rendered with option groups for improved
    readability (#1831)
  - zizmor's SARIF output now uses codeflows instead of related
    locations, improving its rendering behavior on GitHub
    Advanced Security (#1843)
  - The ref-version-mismatch audit now uses a more useful audit
    description for its findings (#1843)
  - The unpinned-images audit now produces more precise findings
    for image references that are computed through expressions
    (#1756)
  - The ref-version-mismatch audit now detects missing version
    comments as well (#1849)
  * Bug Fixes
  - Fixed a bug where the concurrency-limits audit reported
    findings at the job level instead of the workflow level
    (#1627)
  - Fixed a bug where with: ${{ expr }} clauses would cause a
    crash. artipacked audit emits a pedantic finding on such
    clauses. (#1772)
  - Fixed a bug where auto-fixes for the template-injection audit
    would fail to preserve an environment variable's casing
    (#1766)
  - Fixed a bug where the secrets-outside-env audit would
    incorrectly flag reusable workflows (#1777)
  - Fixed a bug where expressions containing Infinity or NaN
    would fail to parse (#1778)
  - Fixed several bugs where some parenthetical forms in
    expressions would fail to parse (#1779, #1856)
  - Fixed a bug where expressions with invalid identifiers (such
    as -Inf) would be incorrectly accepted (#1794)
  - Fixed a bug where the known-vulnerable-actions audit would
    fail to handle multiple discrete packages in a single
    advisory (#1810)
  - Fixed a bug where the template-injection audit would
    incorrectly flag needs.*.result as an injection risk in the
    default persona (#1814)
  - Fixed a bug where the unpinned-uses audit would product
    incorrect auto-fixes for actions with subpaths (#1841)
  - Fixed a bug where the ref-version-mismatch audit would fail
    to produce findings for comments containing nonexistent refs
    (#1853)
  - Fixed a bug where expressions containing NaN would be
    constant-evaluated incorrectly (#1858)
  - Fixed a bug where nix would not be recognized as a
    package-ecosystem in dependabot.yml (#1867)
  - Fixed a bug where the ref-version-mismatch audit would
    incorrectly parse prerelease version comments (such as #
    v6-beta), causing some findings to appear unresolvable
    (#1870)
  - Fixed a bug where various string comparisons in expressions
    did not perfectly match GitHub's own special uppercasing
    semantics (#1879)
  - Fixed a bug where zizmor would incorrectly contact github.com
    instead of the user's requested --gh-hostname for some online
    requests (#1874)
  - Fixed a bug where the artipacked audit would fail to honor
    the --no-online-audits flag (#1874)
  * Changes
  - The secrets-outside-env audit now only flags findings with
    the 'auditor' persona, due to numerous false positives and
    negatives caused by GitHub's platform limitations (primarily
    around interactions between environment secrets and reusable
    workflows) (#1777)
  - zizmor's handling of GitHub Actions expressions has been made
    stricter, and now rejects unknown functions and function
    calls with incorrect arities (#1823, #1826)
  - The superfluous-actions audit now uses the "pedantic" persona
    for some findings along with a medium or low confidence
    marker to signal when a action may not be easily replaced
    with built-in functionality (#1822, #1859)
  - The unpinned-uses audit no longer suggests auto-fixes for Git
    references that don't look like version tags, such as main
    (#1860)
  - The template-injection audit now considers more "URL-shaped"
    contexts to be fully attacker-controllable, rather than
    partially controllable (#1868)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776513600">- Update to version 1.24.1:
  * Bug Fixes
  - Fixed a bug where the ref-version-mismatch audit would
    incorrectly flag some version comments as not containing an
    appropriate version (#1900)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778846400">- Update to version 1.25.0:
  * New Features
  - zizmor's finding severities can now be remapped on a
    per-audit basis. See the configuration for details (#1913)
  - New audit: github-app detects dangerous usages of GitHub App
    installation tokens (#1926)
  - New audit: [unpinned-tools] detects actions that install
    tools without pinning to a specific version (#1820)
  - zizmor now accepts the --no-ignores flag to disable all
    ignore comments and configurations when reporting findings
    (#1935)
  - zizmor's LSP now honors the --persona flag on the CLI (#1943)
  - zizmor is now aware of Docker-based action definitions, in
    addition to the pre-existing support for "composite" actions
    (#1965)
  * Enhancements
  - Recommend gh issue edit --add-label / gh pr edit --add-label
    as a replacement for actions-ecosystem/action-add-labels in
    superfluous-actions
  - Recommend gh issue edit --remove-label / gh pr edit
  - -remove-label as a replacement for
    actions-ecosystem/action-remove-labels in superfluous-actions
  - Recommend jq as a replacement for sergeysova/jq-action in
    superfluous-actions
  - Recommend git add, git commit, and git push as a replacement
    for stefanzweifel/git-auto-commit-action in
    superfluous-actions
  - Recommend git add, git commit, and git push as a replacement
    for EndBug/add-and-commit in superfluous-actions
  - tibdex/github-app-token is now recognized as an archived
    action by archived-uses (#1910)
  - The [dangerous-triggers] audit now explicitly exempts
    workflows that only invoke actions/labeler (#1956)
  - The unpinned-images audit now detects unpinned image
    references in Docker-based action definitions (#1965)
  - zizmor's SARIF output now provides slightly more detailed
    finding messages (#1972)
  - The archived-uses audit now detects more archived actions
    (#1978)
  - deno is now recognized as a package-ecosystem in
    dependabot.yml (#1991)
  * Performance Improvements
  - The impostor-commit audit is now significantly faster (in
    addition to being more correct) when the user has pinned
    their action to a tag SHA instead of a commit SHA (#1998)
  * Bug Fixes
  - Fixed a crash in the template-injection audit when a workflow
    uses a parenthesized compound expression in context position
    (#1904)
  - Fixed a bug where local directory input collection could miss
    workflows for relative-path invocations from within .github
    subdirectories (#1909)
  - Fixed a bug where the unpinned-images audit would miss images
    defined in container: clauses (#1944)
  - Fixed a bug where inline ignore comments could not be easily
    applied to superfluous-actions findings (#1945)
  - Fixed a bug where the cache-poisoning audit would fail to
    detect some release trigger patterns (#1946)
  - Fixed a bug where inline ignore comments could not be easily
    applied to cache-poisoning findings (#1962)
  - Fixed a class of imprecisions where the cache-poisoning audit
    would incorrectly flag cache usage that doesn't actually
    occur on release events (#1940)
  - Fixed a bug where dependabot.yml files containing a private
    cargo repository couldn't be parsed (#1976)
  - Fixed a bug where zizmor's input validation warnings lacked a
    mention of which files failed to validate (#1980)
  - Fixed a bug where the impostor-commit audit would falsely
    indicate impostor commits if an action was pinned to a tag
    SHA instead of a commit SHA (#1998)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 1.25.2:
  * Bug Fixes
  - Fixed a bug where the unpinned-tools audit would incorrectly
    flag the aquasecurity/trivy-action action as installing an
    unpinned tool version, rather than aquasecurity/setup-trivy
    (#2018)
- Update to version 1.25.1:
  * Bug Fixes
  - Fixed a bug where the cache-poisoning audit would fail to
    consider release events as exempt from cache usage findings
    when filtered by a tag condition (#2004)
  - Fixed a typo when suggesting --fix flags for findings (#2010)
  - Fixed a typo in unpinned-tools annotations (#2008)
  - Fixed a bug where the github-app audit would incorrectly flag
    some safe uses of actions/create-github-app-token as unsafe
    (#2011)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782043200">- Update to version 1.26.1:
  This is a small corrective release for 1.26.0.
- Update to version 1.26.0:
  * New Features
  - New audit: typosquat-uses detects uses: clauses that
    reference likely typoed actions (#1985)
  - New audit: unsound-ternary detects pseudo-ternary expressions
    that don't evaluate as expected (#2085)
  - New audit: adhoc-packages detects run: steps that install
    packages in an ad-hoc manner (#2061)
  * Enhancements
  - The cache-poisoning audit now detects additional cache
    disablement heuristics (#2053)
  - The known-vulnerable-actions audit is now configurable. See
    the configuration documentation for details (#2084)
  - The excessive-permissions audit is now aware of the
    code-quality permission (#2088)
  - The unpinned-uses audit's auto-fix now uses the fully
    qualified version tag (e.g. # v6.0.2) when fixing a
    major-version ref (e.g. @v6) (#2127)
  * Performance Improvements
  - Most online audits are significantly faster, thanks to more
    precise retry handling (#2036)
  * Bug Fixes
  - Fixed a bug where zizmor's LSP would not recognize
    dependabot.yaml files in its default configuration (#2026)
  - Fixed a bug where ref-version-mismatch would fail to fully
    match some version comments (#2040)
  - Fixed a bug where dependabot-cooldown would fail to honor the
    user's configured days when performing autofixes (#2055)
  - Steps and jobs gated by statically-false if: conditions (e.g.
    if: false, if: ${{ false }}) are now skipped during auditing,
    since they cannot execute (#2059, #2069)
  - Fixed a bug where ref-version-mismatch would fail to identify
    some valid version comments (#2073)
  - Fixed a bug where unpinned-images would incorrectly flag
    empty matrix expansions as unpinned container image
    references (#2102)
  - Fixed a bug where unpinned-images would incorrectly flag some
    matrix expansions as unpinned (#2098)
  - The SARIF (--format=sarif) and GitHub Annotations
    (--format=github) output formats now provide more
    correct/useful paths, particularly when the user provides a
    relative path as input to zizmor rather than zizmor . (#1748,
    [#2095])
  * Changes
  - The impostor-commit audit no longer suggests auto-fixes, to
    avoid incorrectly minimizing the amount of manual remediation
    work needed (#2054)
  - The JSON and SARIF outputs no longer contain a misleading
    prefix key (#2095)
  * Dependencies
  - chore(deps): bump http from 1.4.1 to 1.4.2 in the cargo group
    (#2125)
  - chore(deps): bump the github-actions group across 1 directory
    with 3 updates (#2119)
  - chore(deps): bump the cargo group across 1 directory with 2
    updates (#2118)
  - chore(deps): bump CodSpeedHQ/action from 4.15.1 to 4.17.0 in
    the github-actions group (#2109)
  - chore(deps): bump the github-actions group with 5 updates
    (#2091)
  - chore(deps): bump the cargo group with 5 updates (#2090)
  - chore(deps): bump the cargo group with 3 updates (#2066)
  - chore(deps): bump the github-actions group with 2 updates
    (#2067)
  - chore(deps): bump the cargo group with 3 updates (#2034)
  - chore(deps): bump the github-actions group with 2 updates
    (#2035)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784030400">- Update to version 1.27.0:
  * New Features
  - zizmor now has experimental support for workflows that
    specify parallel steps. See Usage - Parallel steps for more
    information (#2153)
  * Enhancements
  - zizmor's handling of paths is now more consistent,
    particularly when run on Windows (#2163)
  - zizmor now emits a helpful warning when being run in implicit
    offline mode (#2180)
  * Bug Fixes
  - Fixed a bug where the secrets-outside-env audit would not
    honor ignore comments within the same job scope (#2157)
  - Fixed a bug where the ref-version-mismatch audit would not
    honor ignore comments within the same steps scope (#2177)
  - Fixed a bug where --collect=[MODE] was not correctly handled
    when auditing remote inputs (#2185)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784721600">- Update to version 1.28.0:
  * Security
  - v1.27.0 contained a logging defect that would print any
    configured GitHub credentials as part of zizmor's cleartext
    logging. No versions other than v1.27.0 were affected. See
    GHSA-f42p-wjw5-97qh for full information.
  - Many thanks to @shaanmajid for finding and reporting this
    vulnerability.
  * Enhancements
  - The JSON (v1) output format now includes metadata for each
    finding's fixes, if the finding has fixes (#2186)
  - The dependabot-cooldown audit is now aware of GitHub's new
    three-day default cooldown (#2193)
  - sbt is now recognized as a package-ecosystem in
    dependabot.yml (#2211)
  * Bug Fixes
  - Fixed a bug where the template-injection audit would
    incorrectly flag steps..outcome and steps..conclusion as
    injection risks in the default persona (#2199)
  - Fixed a bug where the github-env audit would incorrectly flag
    some printf calls as exploitable (#2201)
  - Fixed a bug where zizmor would produce a misleading and
    confusing error message when asked to audit an ambiguous
    remote input (#2205)</changelog>
</package>
<package pkgid="5b26e31b37dadeb8f417cdb32c11cb8ab5900eca73e445f4ae670bfb4bd838dcc65c1e354b0ec521d18428ef6ca9f792a171db91c0ff4586a311220db8d590b8" name="zizmor-zsh-completion" arch="noarch">
  <version epoch="0" ver="1.28.0" rel="74.1"/>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760443200">- Update to version 1.15.1:
  * Bug Fixes
  - Fixed a bug where zizmor would fail to parse Dependabot
    configuration files due to missing support for some package
    ecosystems (#1240)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1760702400">- Update to version 1.15.2:
  * Bug Fixes
  - Fixed a bug where zizmor would fail to parse some Dependabot
    configuration files due to missing support for some schedule
    formats (#1247)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761307200">- Update to version 1.16.0:
  * New Features
  - New audit: concurrency-limits detects insufficient
    concurrency limits in workflows (#1227)
  - Many thanks to @jwallwork23 for proposing and implementing
    this audit!
  * Performance Improvements
  - zizmor's online mode is now significantly (40% to over 95%)
    faster on common workloads, thanks to a combination of
    caching improvements and conversion of GitHub API requests
    into Git remote lookups (#1257)
  - Many thanks to @Bo98 for implementing these improvements!
  * Enhancements
  - When running in --fix mode and all fixes are successfully
    applied, zizmor now has similar exit code behavior as the
  - -no-exit-codes and --format=sarif flags (#1242)
  - Many thanks to @cnaples79 for implementing this improvement!
  - The dependabot-cooldown audit now supports auto-fixes for
    many findings (#1229)
  - Many thanks to @mostafa for implementing this improvement!
  - The dependabot-execution audit now supports auto-fixes for
    many findings (#1229)
  - Many thanks to @mostafa for implementing this improvement!
  - zizmor now has limited, experimental support for handling
    inputs that contain YAML anchors (#1266)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1761739200">- Update to version 1.16.1:
  * Enhancements
  - zizmor now produces a more useful error message when asked to
    indirectly access a nonexistent or private repository via a
    uses: clause (without a sufficiently privileged GitHub token)
    (#1293)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762084800">- Update to version 1.16.2:
  * Enhancements
  - The concurrency-limits audit no longer flags explicit user
    concurrency overrides, e.g. cancel-in-progress: false (#1302)
  - zizmor now detects CI environments and specializes its panic
    handling accordingly, improving the quality of panic reports
    when running in CI (#1307)
  * Bug Fixes
  - Fixed a bug where zizmor would reject some Dependabot
    configuration files with logically unsound schedules (but
    that are accepted by GitHub regardless) (#1308)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1762344000">- Update to version 1.16.3:
  * Bug Fixes
  - Fixed a bug where zizmor would crash on an unexpected caching
    middleware state. zizmor will now exit with a controlled
    error instead (#1319)
  * Dependencies
  - chore(deps): bump the cargo group with 2 updates (#1316)
  - chore(deps): bump the github-actions group with 3 updates
    (#1317)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764158400">- Update to version 1.17.0:
  * Enhancements
  - zizmor now produces a more useful error message when asked to
    collect only workflows from a remote input that contains no
    workflows (#1324)
  - zizmor now produces more precise severities on
    actions/checkout versions that have more misuse-resistant
    credentials persistence behavior (#1353)
  - Many thanks to @ManuelLerchnerQC for proposing and
    implementing this improvement!
  - The use-trusted-publishing audit now correctly detecting more
    "dry-run" patterns, making it significantly more accurate
    (#1357)
  - The obfuscation audit now detects usages of shell: cmd and
    similar, as the Windows CMD shell lacks a formal grammar and
    limits analysis of run: blocks in other audits (#1361)
  * Performance Improvements
  - zizmor's core has been refactored to be asynchronous, making
    online and I/O-heavy audits significantly faster. Typical
    user workloads should see speedups of 40% to 70% (#1314)
  * Bug Fixes
  - Fixed a bug where auto-fixes would fail to preserve a
    document's final newline (#1323)
  - zizmor now uses the native (OS) TLS roots when performing
    HTTPS requests, improving compatibility with user
    environments that perform TLS interception (#1328)
  - The github-env audit now falls back to assuming bash-like
    shell syntax in run: blocks if it can't infer the shell being
    used (#1336)
  - The concurrency-limits audit now correctly detects job-level
    concurrency settings, in addition to workflow-level settings
    (#1338)
  - Fixed a bug where zizmor would fail to collect workflows with
    names that overlapped with other input types (e.g. action.yml
    and dependabot.yml) when passed explicitly by path (#1345)
  * Dependencies
  - chore(deps): bump github/codeql-action in the github-actions
    group (#1331)
  - chore(deps): bump the cargo group with 3 updates (#1358)
  - chore(deps): bump the cargo group with 8 updates (#1330)
  - chore(deps): bump the github-actions group with 2 updates
    (#1343)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1764849600">- Update to version 1.18.0:
  * Enhancements
  - The use-trusted-publishing audit now detects NuGet publishing
    commands (#1369)
  - The dependabot-cooldown audit now flags cooldown periods of
    less than 7 days by default (#1375)
  - The dependabot-cooldown audit can now be configured with a
    custom minimum cooldown period via
    rules.dependabot-cooldown.config.days (#1377)
  - zizmor now produces slightly more useful error messages when
    the user supplies an invalid configuration for the
    forbidden-uses audit (#1381)
  * Bug Fixes
  - Fixed additional edge cases where auto-fixed would fail to
    preserve a document's final newline (#1372)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1766145600">- Update to version 1.19.0:
  * New Features
  - New audit: archived-uses detects usages of archived
    repositories in uses: clauses (#1411)
  * Enhancements
  - The use-trusted-publishing audit now detects additional
    publishing command patterns, including common "wrapped"
    patterns like bundle exec gem publish (#1394)
  - zizmor now produces better error messages on a handful of
    error cases involving invalid input files. Specifically, a
    subset of syntax and schema errors now produce more detailed
    and actionable error messages (#1396)
  - The use-trusted-publishing audit now detects additional
    publishing command patterns, including uv run ..., uvx ...,
    and poetry publish (#1402)
  - zizmor now produces more useful and less ambiguous spans for
    many findings, particularly those from the
    anonymous-definition audit (#1416)
  - zizmor now discovers configuration files named zizmor.yaml,
    in addition to zizmor.yml (#1431)
  - zizmor now produces a more useful error message when input
    collection yields no inputs (#1439)
  - The --render-links flag now allows users to control zizmor's
    OSC 8 terminal link rendering behavior. This is particularly
    useful in environments that advertise themselves as terminals
    but fail to correctly render or ignore OSC 8 links (#1454)
  * Performance Improvements
  - The [impostor-commit] audit is now significantly faster on
    true positives, making true positive detection virtually as
    fast as true negative detection. In practice, true positive
    runs are over 100 times faster than before (#1429)
  * Bug Fixes
  - Fixed a bug where the obfuscation audit would crash if it
    encountered a CMD shell that was defined outside of the
    current step block (i.e. as a job or workflow default)
    (#1418)
  - Fixed a bug where the opentofu ecosystem was not recognized
    in Dependabot configuration files (#1452)
  - --color=always no longer implies --render-links=always, as
    some environments (like GitHub Actions) support ANSI color
    codes but fail to handle OSC escapes gracefully (#1454)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768132800">- Update to version 1.20.0:
  * Enhancements
  - The excessive-permissions audit is now aware of the
    artifact-metadata and models permissions (#1461)
  - The cache-poisoning audit is now aware of the
    ramsey/composer-install action (#1489)
  - The unpinned-images audit is now significantly more precise
    in the presence of matrix references, e.g. image: ${{
    matrix.image }} (#1482)
  * Changes
  - The default policy for the unpinned-uses audit has changed
    from allowing ref-pinning for first-party actions (those
    under actions/* and similar) to requiring hash-pinning. This
    makes the default policy more strict, as well as more
    consistent across the actions ecosystem.
    Users who with to retain the old (permissive policy) for
    first-party actions may configure it explicitly in their
    zizmor.yml:
    zizmor.yml
    rules:
    unpinned-uses:
    config:
    policies:
    actions/*: ref-pin
    github/*: ref-pin
    dependabot/*: ref-pin
  * Bug Fixes
  - The dependabot-cooldown audit no longer flags missing
    cooldowns on ecosystems that don't (yet) support cooldowns,
    such as opentofu (#1480)
  - Fixed a false positive in the cache-poisoning audit where
    zizmor would treat empty strings (e.g. cache: '') as enabling
    rather than disabling caching (#1482)
  - Fixed two gaps in the use-trusted-publishing audit's
    detection of common yarn publishing commands (#1495)
  * Miscellaneous
  - zizmor's configuration now has an official JSON schema that
    will be available via SchemaStore soon!  Many thanks to
    @kiwamizamurai for implementing this improvement!</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768564800">- Update to version 1.21.0:
  * New Features
  - New audit: misfeature detects usage of GitHub Actions
    features that are considered "misfeatures." (#1517)
  * Enhancements
  - zizmor now uses exit code 3 to signal an audit that has
    failed because no input files were collected. See the exit
    code documentation for details (#1515)
  - The unpinned-uses audit now supports auto-fixes for many
    findings (#1525)
  * Changes
  - The obfuscation audit no longer flags shell: cmd. That check
    has been moved to the new misfeature audit. Users may need to
    update their ignore comments and/or configuration (#1517)
  * Bug Fixes
  - The unpinned-uses audit now flags reusable workflows that are
    unpinned, in addition to actions (#1509)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1768824000">- Update to version 1.22.0:
  * Changes
  - The misfeature audit now only shows non-"well known" shell:
    findings when running with the "auditor" persona (#1532)
  * Bug Fixes
  - Fixed a bug where inputs containing CRLF line endings were
    not patched correctly by the unpinned-uses audit (#1536)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1773057600">- Update to version 1.23.1:
  * Bug Fixes
  - Fixed a bug where zizmor would error if given both a GH_TOKEN
    and a GITHUB_TOKEN (or ZIZMOR_GITHUB_TOKEN) via the
    environment (#1724)
- Update to version 1.23.0:
  * New Features
  - New audit: secrets-outside-env detects usage of the secrets
    context in jobs that don't have a corresponding environment
    (#1599)
  - New audit: superfluous-actions detects usage of actions that
    perform operations already provided by GitHub's own runner
    images (#1618)
  * Enhancements
  - zizmor's LSP mode is now configuration-aware, and will load
    configuration files relative to workspace roots (#1555)
  - zizmor now reads the GITHUB_TOKEN environment variable as an
    alias/equivalent for GH_TOKEN (#1566)
  - zizmor now supports inputs that contain duplicated anchor
    names (#1575)
  - zizmor now flags missing cooldowns on opentofu ecosystem
    definitions in Dependabot (again) (#1586)
  - zizmor now reads the ZIZMOR_GITHUB_TOKEN environment variable
    as an alias/equivalent for GH_TOKEN and GITHUB_TOKEN (#1641)
  - The SARIF output format now adds zizmor/confidence,
    zizmor/persona and zizmor/severity to the properties of
    findings (#1656)
  - Added awalsh128/cache-apt-pkgs-action as a cache-aware action
    to the cache-poisoning audit (#1708)
  * Changes
  - SARIF categories have been regraded. zizmor's "medium" is
    changed from SARIF's "warning" to "low" (#1635)
  * Bug Fixes
  - Fixed a bug where zizmor would crash on uses: clauses
    containing non-significant whitespace while performing the
    unpinned-uses audit (#1544)
  - Fixed a bug in yamlpath where sequences containing anchors
    were splatted instead of being properly nested (#1557)
  - Fixed a bug in yamlpath where anchor prefixes in sequences
    and mapping were not stripped during path queries (#1562)
  - Fixed a bug where "merge into" autofixes would produce
    incorrect patches in the presence of multi-byte Unicode
    characters (#1581)
  - Fixed a bug where the template-injection audit would produce
    duplicated pedantic-only findings (#1589)
  - Fixed a bug where the obfuscation audit would produce
    incorrect autofixes for a subset of constant-reducible
    expressions (#1597)
  - Fixed a bug where the obfuscation audit would fail to apply
    fixes to a subset of inputs with leading whitespace (#1597)
  - Fixed a bug where the concurrency-limits audit would
    incorrectly flag reusable-only workflows as needing a
    concurrency: key (#1620)
  - Fixed a bug where the known-vulnerable-actions audit would
    fail when applying some fixes (#1640)
  - Fixed a bug where the pre-commit ecosystem was not recognized
    in Dependabot configuration files (#1637)
  - Fixed a bug where the template-injection audit would
    incorrectly flag github.triggering_actor as an injection risk
    in the default persona (#1645)
  - Fixed a bug where zizmor's expression parser did not
    correctly handle number literals in GitHub Actions
    expressions (#1625)
  - Fixed a bug where the template-injection audit would crash on
    some forms of multi-line expressions (#1669)
  - Fixed a bug where deserialization of a workflow containing
    fractional minutes would fail (#1675)
  - Fixed a bug where deserialization of a workflow where a
    workflow_run with a scalar types would fail (#1676)
  - Fixed a bug where zizmor would crash on workflows containing
    bare numeric values in if: conditions (#1683)
  - Fixed a bug where GitHub Actions expression string
    comparisons were not case-insensitive (#1687)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776081600">- Update to version 1.24.0:
  * New Features
  - zizmor now allows users to audit from stdin, by passing
    zizmor - (#1611)
  * Enhancements
  - The use-trusted-publishing audit now detects bun publish and
    bunx npm publish patterns (#1737)
  - zizmor's CLI help and usage output now uses a custom color
    scheme for improved readability (#1747)
  - The secrets-outside-env audit is now configurable with an
    allowlist of secret names that should not be flagged, even
    when referenced outside of an environment (#1759)
  - The dependabot-cooldown audit now emits a pedantic finding
    whenever it encounters a cooldown used with a
    multi-ecosystem-group, as the two do not interact well
    (#1780)
  - Recommend gh release upload as a replacement for
    svenstaro/upload-release-action in superfluous-actions
    (#1801)
  - Recommend gh issue create as a replacement for
    dacbd/create-issue-action in superfluous-actions (#1873)
  - The obfuscation audit now emits a finding for with: ${{ expr
    }} clauses cannot be analyzed (#1772)
  - zizmor --help is now rendered with option groups for improved
    readability (#1831)
  - zizmor's SARIF output now uses codeflows instead of related
    locations, improving its rendering behavior on GitHub
    Advanced Security (#1843)
  - The ref-version-mismatch audit now uses a more useful audit
    description for its findings (#1843)
  - The unpinned-images audit now produces more precise findings
    for image references that are computed through expressions
    (#1756)
  - The ref-version-mismatch audit now detects missing version
    comments as well (#1849)
  * Bug Fixes
  - Fixed a bug where the concurrency-limits audit reported
    findings at the job level instead of the workflow level
    (#1627)
  - Fixed a bug where with: ${{ expr }} clauses would cause a
    crash. artipacked audit emits a pedantic finding on such
    clauses. (#1772)
  - Fixed a bug where auto-fixes for the template-injection audit
    would fail to preserve an environment variable's casing
    (#1766)
  - Fixed a bug where the secrets-outside-env audit would
    incorrectly flag reusable workflows (#1777)
  - Fixed a bug where expressions containing Infinity or NaN
    would fail to parse (#1778)
  - Fixed several bugs where some parenthetical forms in
    expressions would fail to parse (#1779, #1856)
  - Fixed a bug where expressions with invalid identifiers (such
    as -Inf) would be incorrectly accepted (#1794)
  - Fixed a bug where the known-vulnerable-actions audit would
    fail to handle multiple discrete packages in a single
    advisory (#1810)
  - Fixed a bug where the template-injection audit would
    incorrectly flag needs.*.result as an injection risk in the
    default persona (#1814)
  - Fixed a bug where the unpinned-uses audit would product
    incorrect auto-fixes for actions with subpaths (#1841)
  - Fixed a bug where the ref-version-mismatch audit would fail
    to produce findings for comments containing nonexistent refs
    (#1853)
  - Fixed a bug where expressions containing NaN would be
    constant-evaluated incorrectly (#1858)
  - Fixed a bug where nix would not be recognized as a
    package-ecosystem in dependabot.yml (#1867)
  - Fixed a bug where the ref-version-mismatch audit would
    incorrectly parse prerelease version comments (such as #
    v6-beta), causing some findings to appear unresolvable
    (#1870)
  - Fixed a bug where various string comparisons in expressions
    did not perfectly match GitHub's own special uppercasing
    semantics (#1879)
  - Fixed a bug where zizmor would incorrectly contact github.com
    instead of the user's requested --gh-hostname for some online
    requests (#1874)
  - Fixed a bug where the artipacked audit would fail to honor
    the --no-online-audits flag (#1874)
  * Changes
  - The secrets-outside-env audit now only flags findings with
    the 'auditor' persona, due to numerous false positives and
    negatives caused by GitHub's platform limitations (primarily
    around interactions between environment secrets and reusable
    workflows) (#1777)
  - zizmor's handling of GitHub Actions expressions has been made
    stricter, and now rejects unknown functions and function
    calls with incorrect arities (#1823, #1826)
  - The superfluous-actions audit now uses the "pedantic" persona
    for some findings along with a medium or low confidence
    marker to signal when a action may not be easily replaced
    with built-in functionality (#1822, #1859)
  - The unpinned-uses audit no longer suggests auto-fixes for Git
    references that don't look like version tags, such as main
    (#1860)
  - The template-injection audit now considers more "URL-shaped"
    contexts to be fully attacker-controllable, rather than
    partially controllable (#1868)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1776513600">- Update to version 1.24.1:
  * Bug Fixes
  - Fixed a bug where the ref-version-mismatch audit would
    incorrectly flag some version comments as not containing an
    appropriate version (#1900)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778846400">- Update to version 1.25.0:
  * New Features
  - zizmor's finding severities can now be remapped on a
    per-audit basis. See the configuration for details (#1913)
  - New audit: github-app detects dangerous usages of GitHub App
    installation tokens (#1926)
  - New audit: [unpinned-tools] detects actions that install
    tools without pinning to a specific version (#1820)
  - zizmor now accepts the --no-ignores flag to disable all
    ignore comments and configurations when reporting findings
    (#1935)
  - zizmor's LSP now honors the --persona flag on the CLI (#1943)
  - zizmor is now aware of Docker-based action definitions, in
    addition to the pre-existing support for "composite" actions
    (#1965)
  * Enhancements
  - Recommend gh issue edit --add-label / gh pr edit --add-label
    as a replacement for actions-ecosystem/action-add-labels in
    superfluous-actions
  - Recommend gh issue edit --remove-label / gh pr edit
  - -remove-label as a replacement for
    actions-ecosystem/action-remove-labels in superfluous-actions
  - Recommend jq as a replacement for sergeysova/jq-action in
    superfluous-actions
  - Recommend git add, git commit, and git push as a replacement
    for stefanzweifel/git-auto-commit-action in
    superfluous-actions
  - Recommend git add, git commit, and git push as a replacement
    for EndBug/add-and-commit in superfluous-actions
  - tibdex/github-app-token is now recognized as an archived
    action by archived-uses (#1910)
  - The [dangerous-triggers] audit now explicitly exempts
    workflows that only invoke actions/labeler (#1956)
  - The unpinned-images audit now detects unpinned image
    references in Docker-based action definitions (#1965)
  - zizmor's SARIF output now provides slightly more detailed
    finding messages (#1972)
  - The archived-uses audit now detects more archived actions
    (#1978)
  - deno is now recognized as a package-ecosystem in
    dependabot.yml (#1991)
  * Performance Improvements
  - The impostor-commit audit is now significantly faster (in
    addition to being more correct) when the user has pinned
    their action to a tag SHA instead of a commit SHA (#1998)
  * Bug Fixes
  - Fixed a crash in the template-injection audit when a workflow
    uses a parenthesized compound expression in context position
    (#1904)
  - Fixed a bug where local directory input collection could miss
    workflows for relative-path invocations from within .github
    subdirectories (#1909)
  - Fixed a bug where the unpinned-images audit would miss images
    defined in container: clauses (#1944)
  - Fixed a bug where inline ignore comments could not be easily
    applied to superfluous-actions findings (#1945)
  - Fixed a bug where the cache-poisoning audit would fail to
    detect some release trigger patterns (#1946)
  - Fixed a bug where inline ignore comments could not be easily
    applied to cache-poisoning findings (#1962)
  - Fixed a class of imprecisions where the cache-poisoning audit
    would incorrectly flag cache usage that doesn't actually
    occur on release events (#1940)
  - Fixed a bug where dependabot.yml files containing a private
    cargo repository couldn't be parsed (#1976)
  - Fixed a bug where zizmor's input validation warnings lacked a
    mention of which files failed to validate (#1980)
  - Fixed a bug where the impostor-commit audit would falsely
    indicate impostor commits if an action was pinned to a tag
    SHA instead of a commit SHA (#1998)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1778932800">- Update to version 1.25.2:
  * Bug Fixes
  - Fixed a bug where the unpinned-tools audit would incorrectly
    flag the aquasecurity/trivy-action action as installing an
    unpinned tool version, rather than aquasecurity/setup-trivy
    (#2018)
- Update to version 1.25.1:
  * Bug Fixes
  - Fixed a bug where the cache-poisoning audit would fail to
    consider release events as exempt from cache usage findings
    when filtered by a tag condition (#2004)
  - Fixed a typo when suggesting --fix flags for findings (#2010)
  - Fixed a typo in unpinned-tools annotations (#2008)
  - Fixed a bug where the github-app audit would incorrectly flag
    some safe uses of actions/create-github-app-token as unsafe
    (#2011)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1782043200">- Update to version 1.26.1:
  This is a small corrective release for 1.26.0.
- Update to version 1.26.0:
  * New Features
  - New audit: typosquat-uses detects uses: clauses that
    reference likely typoed actions (#1985)
  - New audit: unsound-ternary detects pseudo-ternary expressions
    that don't evaluate as expected (#2085)
  - New audit: adhoc-packages detects run: steps that install
    packages in an ad-hoc manner (#2061)
  * Enhancements
  - The cache-poisoning audit now detects additional cache
    disablement heuristics (#2053)
  - The known-vulnerable-actions audit is now configurable. See
    the configuration documentation for details (#2084)
  - The excessive-permissions audit is now aware of the
    code-quality permission (#2088)
  - The unpinned-uses audit's auto-fix now uses the fully
    qualified version tag (e.g. # v6.0.2) when fixing a
    major-version ref (e.g. @v6) (#2127)
  * Performance Improvements
  - Most online audits are significantly faster, thanks to more
    precise retry handling (#2036)
  * Bug Fixes
  - Fixed a bug where zizmor's LSP would not recognize
    dependabot.yaml files in its default configuration (#2026)
  - Fixed a bug where ref-version-mismatch would fail to fully
    match some version comments (#2040)
  - Fixed a bug where dependabot-cooldown would fail to honor the
    user's configured days when performing autofixes (#2055)
  - Steps and jobs gated by statically-false if: conditions (e.g.
    if: false, if: ${{ false }}) are now skipped during auditing,
    since they cannot execute (#2059, #2069)
  - Fixed a bug where ref-version-mismatch would fail to identify
    some valid version comments (#2073)
  - Fixed a bug where unpinned-images would incorrectly flag
    empty matrix expansions as unpinned container image
    references (#2102)
  - Fixed a bug where unpinned-images would incorrectly flag some
    matrix expansions as unpinned (#2098)
  - The SARIF (--format=sarif) and GitHub Annotations
    (--format=github) output formats now provide more
    correct/useful paths, particularly when the user provides a
    relative path as input to zizmor rather than zizmor . (#1748,
    [#2095])
  * Changes
  - The impostor-commit audit no longer suggests auto-fixes, to
    avoid incorrectly minimizing the amount of manual remediation
    work needed (#2054)
  - The JSON and SARIF outputs no longer contain a misleading
    prefix key (#2095)
  * Dependencies
  - chore(deps): bump http from 1.4.1 to 1.4.2 in the cargo group
    (#2125)
  - chore(deps): bump the github-actions group across 1 directory
    with 3 updates (#2119)
  - chore(deps): bump the cargo group across 1 directory with 2
    updates (#2118)
  - chore(deps): bump CodSpeedHQ/action from 4.15.1 to 4.17.0 in
    the github-actions group (#2109)
  - chore(deps): bump the github-actions group with 5 updates
    (#2091)
  - chore(deps): bump the cargo group with 5 updates (#2090)
  - chore(deps): bump the cargo group with 3 updates (#2066)
  - chore(deps): bump the github-actions group with 2 updates
    (#2067)
  - chore(deps): bump the cargo group with 3 updates (#2034)
  - chore(deps): bump the github-actions group with 2 updates
    (#2035)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784030400">- Update to version 1.27.0:
  * New Features
  - zizmor now has experimental support for workflows that
    specify parallel steps. See Usage - Parallel steps for more
    information (#2153)
  * Enhancements
  - zizmor's handling of paths is now more consistent,
    particularly when run on Windows (#2163)
  - zizmor now emits a helpful warning when being run in implicit
    offline mode (#2180)
  * Bug Fixes
  - Fixed a bug where the secrets-outside-env audit would not
    honor ignore comments within the same job scope (#2157)
  - Fixed a bug where the ref-version-mismatch audit would not
    honor ignore comments within the same steps scope (#2177)
  - Fixed a bug where --collect=[MODE] was not correctly handled
    when auditing remote inputs (#2185)</changelog>
  <changelog author="Johannes Kastl &lt;opensuse_buildservice@ojkastl.de&gt;" date="1784721600">- Update to version 1.28.0:
  * Security
  - v1.27.0 contained a logging defect that would print any
    configured GitHub credentials as part of zizmor's cleartext
    logging. No versions other than v1.27.0 were affected. See
    GHSA-f42p-wjw5-97qh for full information.
  - Many thanks to @shaanmajid for finding and reporting this
    vulnerability.
  * Enhancements
  - The JSON (v1) output format now includes metadata for each
    finding's fixes, if the finding has fixes (#2186)
  - The dependabot-cooldown audit is now aware of GitHub's new
    three-day default cooldown (#2193)
  - sbt is now recognized as a package-ecosystem in
    dependabot.yml (#2211)
  * Bug Fixes
  - Fixed a bug where the template-injection audit would
    incorrectly flag steps..outcome and steps..conclusion as
    injection risks in the default persona (#2199)
  - Fixed a bug where the github-env audit would incorrectly flag
    some printf calls as exploitable (#2201)
  - Fixed a bug where zizmor would produce a misleading and
    confusing error message when asked to audit an ambiguous
    remote input (#2205)</changelog>
</package>
</otherdata>